// https://syzkaller.appspot.com/bug?id=3ff26cb6000860a73428556d7df314541369c939 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); install_segv_handler(); long res = 0; res = syscall(__NR_socket, 0xa, 1, 0); if (res != -1) r[0] = res; NONFAILING(*(uint32_t*)0x200000c0 = 1); syscall(__NR_setsockopt, r[0], 6, 0x13, 0x200000c0, 0x1d4); NONFAILING(*(uint16_t*)0x20000080 = 0xa); NONFAILING(*(uint16_t*)0x20000082 = htobe16(0)); NONFAILING(*(uint32_t*)0x20000084 = 0); NONFAILING(*(uint8_t*)0x20000088 = 0); NONFAILING(*(uint8_t*)0x20000089 = 0); NONFAILING(*(uint8_t*)0x2000008a = 0); NONFAILING(*(uint8_t*)0x2000008b = 0); NONFAILING(*(uint8_t*)0x2000008c = 0); NONFAILING(*(uint8_t*)0x2000008d = 0); NONFAILING(*(uint8_t*)0x2000008e = 0); NONFAILING(*(uint8_t*)0x2000008f = 0); NONFAILING(*(uint8_t*)0x20000090 = 0); NONFAILING(*(uint8_t*)0x20000091 = 0); NONFAILING(*(uint8_t*)0x20000092 = 0); NONFAILING(*(uint8_t*)0x20000093 = 0); NONFAILING(*(uint8_t*)0x20000094 = 0); NONFAILING(*(uint8_t*)0x20000095 = 0); NONFAILING(*(uint8_t*)0x20000096 = 0); NONFAILING(*(uint8_t*)0x20000097 = 0); NONFAILING(*(uint32_t*)0x20000098 = 0); syscall(__NR_connect, r[0], 0x20000080, 0x1c); NONFAILING(memcpy((void*)0x20006580, "tls", 4)); syscall(__NR_setsockopt, r[0], 6, 0x1f, 0x20006580, 0x95d59845436eab44); NONFAILING(*(uint16_t*)0x20000100 = 0x303); NONFAILING(*(uint16_t*)0x20000102 = 0x33); syscall(__NR_setsockopt, r[0], 0x11a, 1, 0x20000100, 0x28); NONFAILING(*(uint32_t*)0x20000040 = 0); syscall(__NR_setsockopt, r[0], 6, 0x19, 0x20000040, 4); return 0; }