// https://syzkaller.appspot.com/bug?id=0075499a00c437c2571fd521bd57068098df35ee // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include static long syz_open_procfs(volatile long a0, volatile long a1) { char buf[128]; memset(buf, 0, sizeof(buf)); if (a0 == 0) { snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1); } else if (a0 == -1) { snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1); } else { snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0, (char*)a1); } int fd = open(buf, O_RDWR); if (fd == -1) fd = open(buf, O_RDONLY); return fd; } uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; memcpy((void*)0x20000000, "net/igmp6\000", 10); res = -1; res = syz_open_procfs(0, 0x20000000); if (res != -1) r[0] = res; res = syscall(__NR_socket, 2ul, 1ul, 0); if (res != -1) r[1] = res; res = syscall(__NR_socket, 2ul, 2ul, 0x88); if (res != -1) r[2] = res; memcpy((void*)0x20000440, "mangle\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000", 32); *(uint32_t*)0x20000460 = 0x1f; *(uint32_t*)0x20000464 = 6; *(uint32_t*)0x20000468 = 0x3f0; *(uint32_t*)0x2000046c = 0; *(uint32_t*)0x20000470 = 0x1c8; *(uint32_t*)0x20000474 = 0x130; *(uint32_t*)0x20000478 = 0x98; *(uint32_t*)0x2000047c = 0; *(uint32_t*)0x20000480 = 0x358; *(uint32_t*)0x20000484 = 0x358; *(uint32_t*)0x20000488 = 0x358; *(uint32_t*)0x2000048c = 0x358; *(uint32_t*)0x20000490 = 0x358; *(uint32_t*)0x20000494 = 6; *(uint64_t*)0x20000498 = 0; *(uint8_t*)0x200004a0 = 0xac; *(uint8_t*)0x200004a1 = 0x14; *(uint8_t*)0x200004a2 = 0x14; *(uint8_t*)0x200004a3 = 0; *(uint32_t*)0x200004a4 = htobe32(0xe0000002); *(uint32_t*)0x200004a8 = htobe32(0); *(uint32_t*)0x200004ac = htobe32(0); memcpy((void*)0x200004b0, "netdevsim0\000\000\000\000\000\000", 16); memcpy((void*)0x200004c0, "veth1\000\000\000\000\000\000\000\000\000\000\000", 16); *(uint8_t*)0x200004d0 = 0; *(uint8_t*)0x200004e0 = 0; *(uint16_t*)0x200004f0 = 0; *(uint8_t*)0x200004f2 = 0; *(uint8_t*)0x200004f3 = 0; *(uint32_t*)0x200004f4 = 0; *(uint16_t*)0x200004f8 = 0x70; *(uint16_t*)0x200004fa = 0x98; *(uint32_t*)0x200004fc = 0; *(uint64_t*)0x20000500 = 0; *(uint64_t*)0x20000508 = 0; *(uint16_t*)0x20000510 = 0x28; memcpy((void*)0x20000512, "TTL\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000", 29); *(uint8_t*)0x2000052f = 0; *(uint8_t*)0x20000530 = 0; *(uint8_t*)0x20000531 = 0; *(uint8_t*)0x20000538 = 0xac; *(uint8_t*)0x20000539 = 0x14; *(uint8_t*)0x2000053a = 0x14; *(uint8_t*)0x2000053b = 0xaa; *(uint32_t*)0x2000053c = htobe32(0x7f000001); *(uint32_t*)0x20000540 = htobe32(0); *(uint32_t*)0x20000544 = htobe32(0); memcpy((void*)0x20000548, "ip_vti0\000\000\000\000\000\000\000\000\000", 16); memcpy((void*)0x20000558, "caif0\000\000\000\000\000\000\000\000\000\000\000", 16); *(uint8_t*)0x20000568 = 0; *(uint8_t*)0x20000578 = 0; *(uint16_t*)0x20000588 = 0; *(uint8_t*)0x2000058a = 0; *(uint8_t*)0x2000058b = 0; *(uint32_t*)0x2000058c = 0; *(uint16_t*)0x20000590 = 0x70; *(uint16_t*)0x20000592 = 0x98; *(uint32_t*)0x20000594 = 0; *(uint64_t*)0x20000598 = 0; *(uint64_t*)0x200005a0 = 0; *(uint16_t*)0x200005a8 = 0x28; memcpy((void*)0x200005aa, "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000", 29); *(uint8_t*)0x200005c7 = 0; *(uint32_t*)0x200005c8 = 0xfffffffb; *(uint8_t*)0x200005d0 = 0; *(uint8_t*)0x200005d1 = 0; *(uint8_t*)0x200005d2 = 0; *(uint8_t*)0x200005d3 = 0; *(uint8_t*)0x200005d4 = 0; *(uint8_t*)0x200005d5 = 0; *(uint8_t*)0x200005d6 = 0; *(uint8_t*)0x200005d7 = 0; *(uint8_t*)0x200005d8 = 0; *(uint8_t*)0x200005d9 = 0; *(uint8_t*)0x200005da = 0; *(uint8_t*)0x200005db = 0; *(uint8_t*)0x200005dc = 0; *(uint8_t*)0x200005dd = 0; *(uint8_t*)0x200005de = 0; *(uint8_t*)0x200005df = 0; *(uint8_t*)0x200005e0 = 0; *(uint8_t*)0x200005e1 = 0; *(uint8_t*)0x200005e2 = 0; *(uint8_t*)0x200005e3 = 0; *(uint8_t*)0x200005e4 = 0; *(uint8_t*)0x200005e5 = 0; *(uint8_t*)0x200005e6 = 0; *(uint8_t*)0x200005e7 = 0; *(uint8_t*)0x200005e8 = 0; *(uint8_t*)0x200005e9 = 0; *(uint8_t*)0x200005ea = 0; *(uint8_t*)0x200005eb = 0; *(uint8_t*)0x200005ec = 0; *(uint8_t*)0x200005ed = 0; *(uint8_t*)0x200005ee = 0; *(uint8_t*)0x200005ef = 0; *(uint8_t*)0x200005f0 = 0; *(uint8_t*)0x200005f1 = 0; *(uint8_t*)0x200005f2 = 0; *(uint8_t*)0x200005f3 = 0; *(uint8_t*)0x200005f4 = 0; *(uint8_t*)0x200005f5 = 0; *(uint8_t*)0x200005f6 = 0; *(uint8_t*)0x200005f7 = 0; *(uint8_t*)0x200005f8 = 0; *(uint8_t*)0x200005f9 = 0; *(uint8_t*)0x200005fa = 0; *(uint8_t*)0x200005fb = 0; *(uint8_t*)0x200005fc = 0; *(uint8_t*)0x200005fd = 0; *(uint8_t*)0x200005fe = 0; *(uint8_t*)0x200005ff = 0; *(uint8_t*)0x20000600 = 0; *(uint8_t*)0x20000601 = 0; *(uint8_t*)0x20000602 = 0; *(uint8_t*)0x20000603 = 0; *(uint8_t*)0x20000604 = 0; *(uint8_t*)0x20000605 = 0; *(uint8_t*)0x20000606 = 0; *(uint8_t*)0x20000607 = 0; *(uint8_t*)0x20000608 = 0; *(uint8_t*)0x20000609 = 0; *(uint8_t*)0x2000060a = 0; *(uint8_t*)0x2000060b = 0; *(uint8_t*)0x2000060c = 0; *(uint8_t*)0x2000060d = 0; *(uint8_t*)0x2000060e = 0; *(uint8_t*)0x2000060f = 0; *(uint8_t*)0x20000610 = 0; *(uint8_t*)0x20000611 = 0; *(uint8_t*)0x20000612 = 0; *(uint8_t*)0x20000613 = 0; *(uint8_t*)0x20000614 = 0; *(uint8_t*)0x20000615 = 0; *(uint8_t*)0x20000616 = 0; *(uint8_t*)0x20000617 = 0; *(uint8_t*)0x20000618 = 0; *(uint8_t*)0x20000619 = 0; *(uint8_t*)0x2000061a = 0; *(uint8_t*)0x2000061b = 0; *(uint8_t*)0x2000061c = 0; *(uint8_t*)0x2000061d = 0; *(uint8_t*)0x2000061e = 0; *(uint8_t*)0x2000061f = 0; *(uint8_t*)0x20000620 = 0; *(uint8_t*)0x20000621 = 0; *(uint8_t*)0x20000622 = 0; *(uint8_t*)0x20000623 = 0; *(uint32_t*)0x20000624 = 0; *(uint16_t*)0x20000628 = 0x70; *(uint16_t*)0x2000062a = 0x98; *(uint32_t*)0x2000062c = 0; *(uint64_t*)0x20000630 = 0; *(uint64_t*)0x20000638 = 0; *(uint16_t*)0x20000640 = 0x28; memcpy((void*)0x20000642, "CHECKSUM\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x2000065f = 0; *(uint8_t*)0x20000660 = 1; *(uint32_t*)0x20000668 = htobe32(0xe0000001); *(uint32_t*)0x2000066c = htobe32(0xe0000001); *(uint32_t*)0x20000670 = htobe32(0); *(uint32_t*)0x20000674 = htobe32(0); memcpy((void*)0x20000678, "bond_slave_1\000\000\000\000", 16); memcpy((void*)0x20000688, "netdevsim0\000\000\000\000\000\000", 16); *(uint8_t*)0x20000698 = 0; *(uint8_t*)0x200006a8 = 0; *(uint16_t*)0x200006b8 = 0; *(uint8_t*)0x200006ba = 0; *(uint8_t*)0x200006bb = 0; *(uint32_t*)0x200006bc = 0; *(uint16_t*)0x200006c0 = 0x70; *(uint16_t*)0x200006c2 = 0x98; *(uint32_t*)0x200006c4 = 0; *(uint64_t*)0x200006c8 = 0; *(uint64_t*)0x200006d0 = 0; *(uint16_t*)0x200006d8 = 0x28; memcpy((void*)0x200006da, "CHECKSUM\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200006f7 = 0; *(uint8_t*)0x200006f8 = 1; *(uint8_t*)0x20000700 = 0xac; *(uint8_t*)0x20000701 = 0x1e; *(uint8_t*)0x20000702 = 0; *(uint8_t*)0x20000703 = 1; *(uint32_t*)0x20000704 = htobe32(0); *(uint32_t*)0x20000708 = htobe32(0); *(uint32_t*)0x2000070c = htobe32(0); memcpy((void*)0x20000710, "macvtap0\000\000\000\000\000\000\000\000", 16); memcpy((void*)0x20000720, "tunl0\000\000\000\000\000\000\000\000\000\000\000", 16); *(uint8_t*)0x20000730 = 0; *(uint8_t*)0x20000740 = 0; *(uint16_t*)0x20000750 = 0x6c; *(uint8_t*)0x20000752 = 0; *(uint8_t*)0x20000753 = 0; *(uint32_t*)0x20000754 = 0; *(uint16_t*)0x20000758 = 0xd0; *(uint16_t*)0x2000075a = 0xf8; *(uint32_t*)0x2000075c = 0; *(uint64_t*)0x20000760 = 0; *(uint64_t*)0x20000768 = 0; *(uint16_t*)0x20000770 = 0x30; memcpy((void*)0x20000772, "ipcomp\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x2000078f = 0; *(uint32_t*)0x20000790 = htobe32(0); *(uint32_t*)0x20000794 = htobe32(0); *(uint8_t*)0x20000798 = 0; *(uint8_t*)0x20000799 = 0; *(uint16_t*)0x200007a0 = 0x30; memcpy((void*)0x200007a2, "addrtype\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200007bf = 0; *(uint16_t*)0x200007c0 = 0; *(uint16_t*)0x200007c2 = 0; *(uint32_t*)0x200007c4 = 0; *(uint32_t*)0x200007c8 = 0; *(uint16_t*)0x200007d0 = 0x28; memcpy((void*)0x200007d2, "ECN\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000", 29); *(uint8_t*)0x200007ef = 0; *(uint8_t*)0x200007f0 = 0; *(uint8_t*)0x200007f1 = 0; *(uint8_t*)0x200007f2 = 0; *(uint8_t*)0x200007f8 = 0; *(uint8_t*)0x200007f9 = 0; *(uint8_t*)0x200007fa = 0; *(uint8_t*)0x200007fb = 0; *(uint8_t*)0x200007fc = 0; *(uint8_t*)0x200007fd = 0; *(uint8_t*)0x200007fe = 0; *(uint8_t*)0x200007ff = 0; *(uint8_t*)0x20000800 = 0; *(uint8_t*)0x20000801 = 0; *(uint8_t*)0x20000802 = 0; *(uint8_t*)0x20000803 = 0; *(uint8_t*)0x20000804 = 0; *(uint8_t*)0x20000805 = 0; *(uint8_t*)0x20000806 = 0; *(uint8_t*)0x20000807 = 0; *(uint8_t*)0x20000808 = 0; *(uint8_t*)0x20000809 = 0; *(uint8_t*)0x2000080a = 0; *(uint8_t*)0x2000080b = 0; *(uint8_t*)0x2000080c = 0; *(uint8_t*)0x2000080d = 0; *(uint8_t*)0x2000080e = 0; *(uint8_t*)0x2000080f = 0; *(uint8_t*)0x20000810 = 0; *(uint8_t*)0x20000811 = 0; *(uint8_t*)0x20000812 = 0; *(uint8_t*)0x20000813 = 0; *(uint8_t*)0x20000814 = 0; *(uint8_t*)0x20000815 = 0; *(uint8_t*)0x20000816 = 0; *(uint8_t*)0x20000817 = 0; *(uint8_t*)0x20000818 = 0; *(uint8_t*)0x20000819 = 0; *(uint8_t*)0x2000081a = 0; *(uint8_t*)0x2000081b = 0; *(uint8_t*)0x2000081c = 0; *(uint8_t*)0x2000081d = 0; *(uint8_t*)0x2000081e = 0; *(uint8_t*)0x2000081f = 0; *(uint8_t*)0x20000820 = 0; *(uint8_t*)0x20000821 = 0; *(uint8_t*)0x20000822 = 0; *(uint8_t*)0x20000823 = 0; *(uint8_t*)0x20000824 = 0; *(uint8_t*)0x20000825 = 0; *(uint8_t*)0x20000826 = 0; *(uint8_t*)0x20000827 = 0; *(uint8_t*)0x20000828 = 0; *(uint8_t*)0x20000829 = 0; *(uint8_t*)0x2000082a = 0; *(uint8_t*)0x2000082b = 0; *(uint8_t*)0x2000082c = 0; *(uint8_t*)0x2000082d = 0; *(uint8_t*)0x2000082e = 0; *(uint8_t*)0x2000082f = 0; *(uint8_t*)0x20000830 = 0; *(uint8_t*)0x20000831 = 0; *(uint8_t*)0x20000832 = 0; *(uint8_t*)0x20000833 = 0; *(uint8_t*)0x20000834 = 0; *(uint8_t*)0x20000835 = 0; *(uint8_t*)0x20000836 = 0; *(uint8_t*)0x20000837 = 0; *(uint8_t*)0x20000838 = 0; *(uint8_t*)0x20000839 = 0; *(uint8_t*)0x2000083a = 0; *(uint8_t*)0x2000083b = 0; *(uint8_t*)0x2000083c = 0; *(uint8_t*)0x2000083d = 0; *(uint8_t*)0x2000083e = 0; *(uint8_t*)0x2000083f = 0; *(uint8_t*)0x20000840 = 0; *(uint8_t*)0x20000841 = 0; *(uint8_t*)0x20000842 = 0; *(uint8_t*)0x20000843 = 0; *(uint8_t*)0x20000844 = 0; *(uint8_t*)0x20000845 = 0; *(uint8_t*)0x20000846 = 0; *(uint8_t*)0x20000847 = 0; *(uint8_t*)0x20000848 = 0; *(uint8_t*)0x20000849 = 0; *(uint8_t*)0x2000084a = 0; *(uint8_t*)0x2000084b = 0; *(uint32_t*)0x2000084c = 0; *(uint16_t*)0x20000850 = 0x70; *(uint16_t*)0x20000852 = 0x98; *(uint32_t*)0x20000854 = 0; *(uint64_t*)0x20000858 = 0; *(uint64_t*)0x20000860 = 0; *(uint16_t*)0x20000868 = 0x28; memcpy((void*)0x2000086a, "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000", 29); *(uint8_t*)0x20000887 = 0; *(uint32_t*)0x20000888 = 0xfffffffe; syscall(__NR_setsockopt, r[2], 0, 0x40, 0x20000440ul, 0x450ul); *(uint32_t*)0x20000040 = 1; syscall(__NR_setsockopt, r[1], 6, 0x13, 0x20000040ul, 4ul); *(uint16_t*)0x20000180 = 2; *(uint16_t*)0x20000182 = htobe16(0); *(uint8_t*)0x20000184 = 0xac; *(uint8_t*)0x20000185 = 0x14; *(uint8_t*)0x20000186 = 0x14; *(uint8_t*)0x20000187 = 0xbb; syscall(__NR_connect, r[1], 0x20000180ul, 0x10ul); *(uint32_t*)0x20000080 = 0; *(uint32_t*)0x20000084 = 0x4007ffd; *(uint32_t*)0x20000088 = 0x32fe3cf1; *(uint32_t*)0x2000008c = 0; *(uint32_t*)0x20000090 = 0; syscall(__NR_setsockopt, r[1], 6, 0x1d, 0x20000080ul, 0x14ul); syscall(__NR_sendfile, r[1], r[0], 0ul, 0x4000000000edc0ul); return 0; }