// https://syzkaller.appspot.com/bug?id=772e7943c6b9c558280573887e1e3a751b36cdea // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 280 #endif #ifndef __NR_listen #define __NR_listen 201 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_sendmmsg #define __NR_sendmmsg 269 #endif #ifndef __NR_socket #define __NR_socket 198 #endif #ifndef __NR_writev #define __NR_writev 66 #endif uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0); if (res != -1) r[0] = res; syscall(__NR_listen, /*fd=*/r[0], /*backlog=*/0); *(uint32_t*)0x20000680 = 0x10; *(uint32_t*)0x20000684 = 4; *(uint64_t*)0x20000688 = 0x20000380; memcpy((void*)0x20000380, "\x18\x02\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x85" "\x00\x00\x00\x3d\x00\x00\x00\x95", 25); *(uint64_t*)0x20000690 = 0x200000c0; memcpy((void*)0x200000c0, "GPL\000", 4); *(uint32_t*)0x20000698 = 1; *(uint32_t*)0x2000069c = 0x98; *(uint64_t*)0x200006a0 = 0x20000000; *(uint32_t*)0x200006a8 = 0; *(uint32_t*)0x200006ac = 0; memset((void*)0x200006b0, 0, 16); *(uint32_t*)0x200006c0 = 0; *(uint32_t*)0x200006c4 = 0; *(uint32_t*)0x200006c8 = -1; *(uint32_t*)0x200006cc = 8; *(uint64_t*)0x200006d0 = 0; *(uint32_t*)0x200006d8 = 0; *(uint32_t*)0x200006dc = 0x10; *(uint64_t*)0x200006e0 = 0; *(uint32_t*)0x200006e8 = 0; *(uint32_t*)0x200006ec = 0; *(uint32_t*)0x200006f0 = 0; *(uint32_t*)0x200006f4 = 0; *(uint64_t*)0x200006f8 = 0; *(uint64_t*)0x20000700 = 0; *(uint32_t*)0x20000708 = 0x10; *(uint32_t*)0x2000070c = 0; res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x20000680ul, /*size=*/0x80ul); if (res != -1) r[1] = res; *(uint32_t*)0x200023c0 = 0x12; *(uint32_t*)0x200023c4 = 4; *(uint32_t*)0x200023c8 = 8; *(uint32_t*)0x200023cc = 0xb; *(uint32_t*)0x200023d0 = 0; *(uint32_t*)0x200023d4 = -1; *(uint32_t*)0x200023d8 = 0; memset((void*)0x200023dc, 0, 16); *(uint32_t*)0x200023ec = 0; *(uint32_t*)0x200023f0 = -1; *(uint32_t*)0x200023f4 = 0; *(uint32_t*)0x200023f8 = 0; *(uint32_t*)0x200023fc = 0; *(uint64_t*)0x20002400 = 0; res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200023c0ul, /*size=*/0x48ul); if (res != -1) r[2] = res; *(uint32_t*)0x200001c0 = r[2]; *(uint32_t*)0x200001c4 = r[1]; *(uint32_t*)0x200001c8 = 7; *(uint32_t*)0x200001cc = 0; *(uint32_t*)0x200001d0 = 0; *(uint32_t*)0x200001d4 = -1; *(uint64_t*)0x200001d8 = 0; syscall(__NR_bpf, /*cmd=*/8ul, /*arg=*/0x200001c0ul, /*size=*/0x10ul); *(uint32_t*)0x20000500 = r[2]; *(uint64_t*)0x20000508 = 0x20000240; *(uint64_t*)0x20000510 = 0x200004c0; *(uint32_t*)0x200004c0 = r[0]; *(uint64_t*)0x20000518 = 0; syscall(__NR_bpf, /*cmd=*/2ul, /*arg=*/0x20000500ul, /*size=*/0x20ul); *(uint64_t*)0x20000300 = 0; *(uint32_t*)0x20000308 = 0; *(uint64_t*)0x20000310 = 0x20000180; *(uint64_t*)0x20000180 = 0x20000200; memset((void*)0x20000200, 176, 1); *(uint64_t*)0x20000188 = 1; *(uint64_t*)0x20000318 = 1; *(uint64_t*)0x20000320 = 0; *(uint64_t*)0x20000328 = 0; *(uint32_t*)0x20000330 = 0; *(uint32_t*)0x20000338 = 0; syscall(__NR_sendmmsg, /*fd=*/r[0], /*mmsg=*/0x20000300ul, /*vlen=*/1ul, /*f=*/0ul); *(uint64_t*)0x20000140 = 0x20000240; memset((void*)0x20000240, 57, 1); *(uint64_t*)0x20000148 = 0x20000241; syscall(__NR_writev, /*fd=*/r[0], /*vec=*/0x20000140ul, /*vlen=*/1ul); return 0; }