// https://syzkaller.appspot.com/bug?id=8593724cce469c9898b7fbc49f48f4943fee940f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; *(uint32_t*)0x20000080 = 3; *(uint32_t*)0x20000084 = 3; *(uint64_t*)0x20000088 = 0x20000440; memcpy((void*)0x20000440, "\x85\x00\x00\x00\x4f\x00\x00\x00\x3f\x00\x00\x00\x00\x00\x00\x00\x95" "\x00\x00\xe6\x00\x00\x00\x00\x40\x2c\xe8\x5f\xbf\x62\xc2\x1e\xb4\xd9" "\x81\x83\xdd\x3c\xd5\x8e\xe1\xc9\x48\x6c\x70\xbf\xaa\x12\x47\x41\x7d" "\x55\x88\x65\x03\x9a\xf3\x16\x70\x20\xc7\xe2\xb2\xec\xd8\xdd\xe1\x1c" "\xcf\x86\x9c\x0d\x8d\x4a\xdd\x1f\x02\x64\x5b\x52\xcd\x5f\xa0\x52\xac" "\x6f\x1c\xe7\x1e\xb0\x92\xd6\xaa\x88\x33\x23\x8d\x4a\x93\x92\x40\x65" "\xdc\xde\x4b\x45\x14\x5c\x2e\x02\x8b\xfb\x5b\x5a\x17\xff\x38\x62\x43" "\xa1\x13\x2d\x2c\x53\x11\xe4\x4c\x54\xdb\x5d\x3c\x86\x09\x00\x00\x00" "\xf9\xd3\xa2\x99\x71\xf0\x6c\xf4\x58\x69\xc0\x81\x78\x7f\x62\x60\xb6" "\xb2\x19\x54\x55\x1f\x5e\xd4\xda\xc7\xa3\x98\x47\xd9\x28\xf5\xf3\x3d" "\xa8\x9f\xb1\x66\xec\xf6\xdb\x63\x7f\x00\xc5\x89\xca\xc9\xb8\x2c\xb7" "\xb7\x5c\x59\xf6\x24\xdb\x94\xa7\xa9\xdd\x3f\x02\x00\x00\x63\x61\x5a" "\xfe\x06\x3e\x59\x4e\x53\xfe\xeb\xf5\xae\x0e\xa0\x5a\xd7\xaf\x1c\x50" "\x72\xd3\x2e\x70\x35\x40\xfb\xc6\x8c\x0f\x19\x6f\xa0\x37\x76\x67\xa0" "\xe0\xc7\xc9\x2f\x01\x90\x9e\x61\x08\x55\xe3\xb8\x75\x7b\x7d\x43\xf4" "\xe5\x93\x62\xb7\xbe\x89\xfe\x30\x8d\x28\x40\x93\xec\x41\x16\xca\xd0" "\x0a\x9a\xc3\x53\xff\x10\x62\xec\x17\xce\x9b\xf3\xad\x22\xdf\xe6\x02" "\xb8\x32\x1d\xe6\x80\x36\xc7\xf6\xcb\x00\x00\x00\x91\x33\xcf\xd2\xaa" "\x8f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x9a\x10\x79\xf8\x9a\x73\xac\x25\x1d\xda\x5d" "\xbc\x25\x92\x35\x8a\xd1\x04\x77\x3e\x04\xae\x9d\x07\x34\xc1\x83\x7f" "\xb8\xf6\xd6\x1a\x00\x00\x00\x00\x00\x8e\xd7\x2e\x70\xcc\x19\x57\xb0" "\xea\x30\x43\xc4\x37\x90\x23\x11\xb2\x04\x01\x46\xc7\x3c\x53\xec\xad" "\x9c\x10\xa9\xbb\x28\xca\x8d\xcb\xa4\x37\x6f\x58\xeb\x2c\xf7\xee\xd7" "\x89\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x1c\x22\xd1\xb5" "\xbf\xec\x8c\xc9\x36\x37\xa1\x16\x26\xee\x60\x1c\xdf\xcf\x29\x2b\xf8" "\xda\x1c\x7e\x4d\x2e\x92\x46\x3b\x00\x00\x6c\xb4\xd3\x5e\x59\x52\x1e" "\x99\xe5\x51\x6f\xe0\xb1\x94\x9d\x8b\x6b\x8d\x28\xc0\x87\xa8\x11\x4e" "\x2c\x76\x14\x23\x35\xb9\x5b\x72\xe0\x41\xbe\x5d\xe4\x0f\x7a\x17\x79" "\x48\xca\xd6\xee\x7b\x5a\x07\x97\xb2\xf3\xb4\xdd\x2e\xdc\x52\xa7\x5c" "\x97\x3f\xe9\xe3\x0d\x9c\x9b\x74\x16\xc1\x6c\xa5\x8c\xe5\x84\xa9\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 540); *(uint64_t*)0x20000090 = 0x20000000; memcpy((void*)0x20000000, "GPL\000", 4); *(uint32_t*)0x20000098 = 5; *(uint32_t*)0x2000009c = 0x487; *(uint64_t*)0x200000a0 = 0x2000cf3d; *(uint32_t*)0x200000a8 = 0; *(uint32_t*)0x200000ac = 0; *(uint8_t*)0x200000b0 = 0; *(uint8_t*)0x200000b1 = 0; *(uint8_t*)0x200000b2 = 0; *(uint8_t*)0x200000b3 = 0; *(uint8_t*)0x200000b4 = 0; *(uint8_t*)0x200000b5 = 0; *(uint8_t*)0x200000b6 = 0; *(uint8_t*)0x200000b7 = 0; *(uint8_t*)0x200000b8 = 0; *(uint8_t*)0x200000b9 = 0; *(uint8_t*)0x200000ba = 0; *(uint8_t*)0x200000bb = 0; *(uint8_t*)0x200000bc = 0; *(uint8_t*)0x200000bd = 0; *(uint8_t*)0x200000be = 0; *(uint8_t*)0x200000bf = 0; *(uint32_t*)0x200000c0 = 0; *(uint32_t*)0x200000c4 = 0; *(uint32_t*)0x200000c8 = -1; *(uint32_t*)0x200000cc = 8; *(uint64_t*)0x200000d0 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x200000d8 = 0; *(uint32_t*)0x200000dc = 0x10; *(uint64_t*)0x200000e0 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x200000e8 = 0; *(uint32_t*)0x200000ec = 0; *(uint32_t*)0x200000f0 = -1; res = syscall(__NR_bpf, 5ul, 0x20000080ul, 0x48ul); if (res != -1) r[0] = res; *(uint32_t*)0x200001c0 = r[0]; *(uint32_t*)0x200001c4 = 0; *(uint32_t*)0x200001c8 = 0xe; *(uint32_t*)0x200001cc = 0; *(uint64_t*)0x200001d0 = 0x20000100; memcpy((void*)0x20000100, "\x26\x3a\xbd\x03\xd8\xee\x2f\xe5\x06\x55\xa1\x5c\x88\xa8", 14); *(uint64_t*)0x200001d8 = 0; *(uint32_t*)0x200001e0 = 0x3ff; *(uint32_t*)0x200001e4 = 0; *(uint32_t*)0x200001e8 = 0; *(uint32_t*)0x200001ec = 0; *(uint64_t*)0x200001f0 = 0x20000000; *(uint64_t*)0x200001f8 = 0x20000000; syscall(__NR_bpf, 0xaul, 0x200001c0ul, 0x28ul); return 0; }