// https://syzkaller.appspot.com/bug?id=ffdf2711c935a1b72550b3334420d7a3b168f335 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } uint64_t current_time_ms() { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define SYZ_HAVE_SETUP_TEST 1 static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); } #define SYZ_HAVE_RESET_TEST 1 static void reset_test() { int fd; for (fd = 3; fd < 30; fd++) close(fd); } static void execute_one(); #define WAIT_FLAGS __WALL static void loop() { int iter; for (iter = 0;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); reset_test(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill(-pid, SIGKILL); kill(pid, SIGKILL); while (waitpid(-1, &status, WAIT_FLAGS) != pid) { } break; } } } uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff}; void execute_one() { long res = 0; res = syscall(__NR_socket, 0xf, 3, 2); if (res != -1) r[0] = res; *(uint64_t*)0x205f5000 = 0xffffff80; *(uint32_t*)0x205f5008 = 0; *(uint64_t*)0x205f5010 = 0x208feff0; *(uint64_t*)0x208feff0 = 0x2080e000; *(uint8_t*)0x2080e000 = 2; *(uint8_t*)0x2080e001 = 0xe; *(uint8_t*)0x2080e002 = 0; *(uint8_t*)0x2080e003 = 0; *(uint16_t*)0x2080e004 = 0x14; *(uint16_t*)0x2080e006 = 0; *(uint32_t*)0x2080e008 = 0; *(uint32_t*)0x2080e00c = 0; *(uint16_t*)0x2080e010 = 5; *(uint16_t*)0x2080e012 = 6; *(uint8_t*)0x2080e014 = 0; *(uint8_t*)0x2080e015 = 0; *(uint16_t*)0x2080e016 = 0; *(uint16_t*)0x2080e018 = 0xa; *(uint16_t*)0x2080e01a = htobe16(0); *(uint32_t*)0x2080e01c = 0; *(uint8_t*)0x2080e020 = 0; *(uint8_t*)0x2080e021 = 0; *(uint8_t*)0x2080e022 = 0; *(uint8_t*)0x2080e023 = 0; *(uint8_t*)0x2080e024 = 0; *(uint8_t*)0x2080e025 = 0; *(uint8_t*)0x2080e026 = 0; *(uint8_t*)0x2080e027 = 0; *(uint8_t*)0x2080e028 = 0; *(uint8_t*)0x2080e029 = 0; *(uint8_t*)0x2080e02a = 0; *(uint8_t*)0x2080e02b = 0; *(uint8_t*)0x2080e02c = 0; *(uint8_t*)0x2080e02d = 0; *(uint8_t*)0x2080e02e = 0; *(uint8_t*)0x2080e02f = 0; *(uint32_t*)0x2080e030 = 0; *(uint16_t*)0x2080e038 = 8; *(uint16_t*)0x2080e03a = 0x12; *(uint16_t*)0x2080e03c = 0; *(uint8_t*)0x2080e03e = 2; *(uint8_t*)0x2080e03f = 0; *(uint32_t*)0x2080e040 = 0; *(uint32_t*)0x2080e044 = 0; *(uint16_t*)0x2080e048 = 0x1f; *(uint16_t*)0x2080e04a = 0; *(uint8_t*)0x2080e04c = 0; *(uint8_t*)0x2080e04d = 0; *(uint16_t*)0x2080e04e = 0; *(uint32_t*)0x2080e050 = 0; *(uint32_t*)0x2080e054 = 0; *(uint8_t*)0x2080e058 = 0xac; *(uint8_t*)0x2080e059 = 0x14; *(uint8_t*)0x2080e05a = -1; *(uint8_t*)0x2080e05b = 0xbb; *(uint8_t*)0x2080e068 = 0xac; *(uint8_t*)0x2080e069 = 0x14; *(uint8_t*)0x2080e06a = 0x14; *(uint8_t*)0x2080e06b = 0; *(uint16_t*)0x2080e078 = 5; *(uint16_t*)0x2080e07a = 5; *(uint8_t*)0x2080e07c = 0; *(uint8_t*)0x2080e07d = 0; *(uint16_t*)0x2080e07e = 0; *(uint16_t*)0x2080e080 = 0xa; *(uint16_t*)0x2080e082 = htobe16(0); *(uint32_t*)0x2080e084 = 0; *(uint8_t*)0x2080e088 = 0xfe; *(uint8_t*)0x2080e089 = 0x80; *(uint8_t*)0x2080e08a = 0; *(uint8_t*)0x2080e08b = 0; *(uint8_t*)0x2080e08c = 0; *(uint8_t*)0x2080e08d = 0; *(uint8_t*)0x2080e08e = 0; *(uint8_t*)0x2080e08f = 0; *(uint8_t*)0x2080e090 = 0; *(uint8_t*)0x2080e091 = 0; *(uint8_t*)0x2080e092 = 0; *(uint8_t*)0x2080e093 = 0; *(uint8_t*)0x2080e094 = 0; *(uint8_t*)0x2080e095 = 0; *(uint8_t*)0x2080e096 = 0; *(uint8_t*)0x2080e097 = -1; *(uint32_t*)0x2080e098 = 0; *(uint64_t*)0x208feff8 = 0xa0; *(uint64_t*)0x205f5018 = 1; *(uint64_t*)0x205f5020 = 0; *(uint64_t*)0x205f5028 = 0; *(uint32_t*)0x205f5030 = 0; syscall(__NR_sendmsg, r[0], 0x205f5000, 0); res = syscall(__NR_inotify_init1, 0); if (res != -1) r[1] = res; syscall(__NR_fcntl, r[1], 8, -1); res = syscall(__NR_fcntl, r[1], 0x10, 0x2045fff8); if (res != -1) r[2] = *(uint32_t*)0x2045fffc; syscall(__NR_ptrace, 0x4206, r[2], 0, 0); syscall(__NR_ptrace, 0x4207, r[2]); syscall(__NR_ptrace, 9, r[2], 0, 0); res = syscall(__NR_socket, 0xa, 2, 0x88); if (res != -1) r[3] = res; *(uint16_t*)0x20000100 = 0xa; *(uint16_t*)0x20000102 = htobe16(0); *(uint32_t*)0x20000104 = 0; *(uint8_t*)0x20000108 = 0xfe; *(uint8_t*)0x20000109 = 0x80; *(uint8_t*)0x2000010a = 0; *(uint8_t*)0x2000010b = 0; *(uint8_t*)0x2000010c = 0; *(uint8_t*)0x2000010d = 0; *(uint8_t*)0x2000010e = 0; *(uint8_t*)0x2000010f = 0; *(uint8_t*)0x20000110 = 0; *(uint8_t*)0x20000111 = 0; *(uint8_t*)0x20000112 = 0; *(uint8_t*)0x20000113 = 0; *(uint8_t*)0x20000114 = 0; *(uint8_t*)0x20000115 = 0; *(uint8_t*)0x20000116 = 0; *(uint8_t*)0x20000117 = 0; *(uint32_t*)0x20000118 = 4; syscall(__NR_connect, r[3], 0x20000100, 0x1c); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (procid = 0; procid < 8; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; }