// https://syzkaller.appspot.com/bug?id=c7e345ba243bc4476aae52a3354ccbd2a90e344e // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include unsigned long long procid; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) typedef struct { int state; } event_t; static void event_init(event_t* ev) { ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { if (ev->state) exit(1); __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG); } static void event_wait(event_t* ev) { while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); } static int event_isset(event_t* ev) { return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; for (;;) { uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); if (__atomic_load_n(&ev->state, __ATOMIC_RELAXED)) return 1; now = current_time_ms(); if (now - start > timeout) return 0; } } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static struct { char* pos; int nesting; struct nlattr* nested[8]; char buf[1024]; } nlmsg; static void netlink_init(int typ, int flags, const void* data, int size) { memset(&nlmsg, 0, sizeof(nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg.buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg.pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg.pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; memcpy(attr + 1, data, size); nlmsg.pos += NLMSG_ALIGN(attr->nla_len); } static void netlink_nest(int typ) { struct nlattr* attr = (struct nlattr*)nlmsg.pos; attr->nla_type = typ; nlmsg.pos += sizeof(*attr); nlmsg.nested[nlmsg.nesting++] = attr; } static void netlink_done(void) { struct nlattr* attr = nlmsg.nested[--nlmsg.nesting]; attr->nla_len = nlmsg.pos - (char*)attr; } static int netlink_send(int sock) { if (nlmsg.pos > nlmsg.buf + sizeof(nlmsg.buf) || nlmsg.nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg.buf; hdr->nlmsg_len = nlmsg.pos - nlmsg.buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; unsigned n = sendto(sock, nlmsg.buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != hdr->nlmsg_len) exit(1); n = recv(sock, nlmsg.buf, sizeof(nlmsg.buf), 0); if (n < sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr)) exit(1); if (hdr->nlmsg_type != NLMSG_ERROR) exit(1); return -((struct nlmsgerr*)(hdr + 1))->error; } static void netlink_add_device_impl(const char* type, const char* name) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); netlink_init(RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); if (name) netlink_attr(IFLA_IFNAME, name, strlen(name)); netlink_nest(IFLA_LINKINFO); netlink_attr(IFLA_INFO_KIND, type, strlen(type)); } static void netlink_add_device(int sock, const char* type, const char* name) { netlink_add_device_impl(type, name); netlink_done(); int err = netlink_send(sock); (void)err; } static void netlink_add_veth(int sock, const char* name, const char* peer) { netlink_add_device_impl("veth", name); netlink_nest(IFLA_INFO_DATA); netlink_nest(VETH_INFO_PEER); nlmsg.pos += sizeof(struct ifinfomsg); netlink_attr(IFLA_IFNAME, peer, strlen(peer)); netlink_done(); netlink_done(); netlink_done(); int err = netlink_send(sock); (void)err; } static void netlink_add_hsr(int sock, const char* name, const char* slave1, const char* slave2) { netlink_add_device_impl("hsr", name); netlink_nest(IFLA_INFO_DATA); int ifindex1 = if_nametoindex(slave1); netlink_attr(IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1)); int ifindex2 = if_nametoindex(slave2); netlink_attr(IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2)); netlink_done(); netlink_done(); int err = netlink_send(sock); (void)err; } static void netlink_device_change(int sock, const char* name, bool up, const char* master, const void* mac, int macsize) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; netlink_init(RTM_NEWLINK, 0, &hdr, sizeof(hdr)); netlink_attr(IFLA_IFNAME, name, strlen(name)); if (master) { int ifindex = if_nametoindex(master); netlink_attr(IFLA_MASTER, &ifindex, sizeof(ifindex)); } if (macsize) netlink_attr(IFLA_ADDRESS, mac, macsize); int err = netlink_send(sock); (void)err; } static int netlink_add_addr(int sock, const char* dev, const void* addr, int addrsize) { struct ifaddrmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; hdr.ifa_scope = RT_SCOPE_UNIVERSE; hdr.ifa_index = if_nametoindex(dev); netlink_init(RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr)); netlink_attr(IFA_LOCAL, addr, addrsize); netlink_attr(IFA_ADDRESS, addr, addrsize); return netlink_send(sock); } static void netlink_add_addr4(int sock, const char* dev, const char* addr) { struct in_addr in_addr; inet_pton(AF_INET, addr, &in_addr); int err = netlink_add_addr(sock, dev, &in_addr, sizeof(in_addr)); (void)err; } static void netlink_add_addr6(int sock, const char* dev, const char* addr) { struct in6_addr in6_addr; inet_pton(AF_INET6, addr, &in6_addr); int err = netlink_add_addr(sock, dev, &in6_addr, sizeof(in6_addr)); (void)err; } #define DEV_IPV4 "172.20.20.%d" #define DEV_IPV6 "fe80::%02x" #define DEV_MAC 0x00aaaaaaaaaa static void initialize_netdevices(void) { char netdevsim[16]; sprintf(netdevsim, "netdevsim%d", (int)procid); struct { const char* type; const char* dev; } devtypes[] = { {"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"}, {"vcan", "vcan0"}, {"bond", "bond0"}, {"team", "team0"}, {"dummy", "dummy0"}, {"nlmon", "nlmon0"}, {"caif", "caif0"}, {"batadv", "batadv0"}, {"vxcan", "vxcan1"}, {"netdevsim", netdevsim}, {"veth", 0}, }; const char* devmasters[] = {"bridge", "bond", "team"}; struct { const char* name; int macsize; bool noipv6; } devices[] = { {"lo", ETH_ALEN}, {"sit0", 0}, {"bridge0", ETH_ALEN}, {"vcan0", 0, true}, {"tunl0", 0}, {"gre0", 0}, {"gretap0", ETH_ALEN}, {"ip_vti0", 0}, {"ip6_vti0", 0}, {"ip6tnl0", 0}, {"ip6gre0", 0}, {"ip6gretap0", ETH_ALEN}, {"erspan0", ETH_ALEN}, {"bond0", ETH_ALEN}, {"veth0", ETH_ALEN}, {"veth1", ETH_ALEN}, {"team0", ETH_ALEN}, {"veth0_to_bridge", ETH_ALEN}, {"veth1_to_bridge", ETH_ALEN}, {"veth0_to_bond", ETH_ALEN}, {"veth1_to_bond", ETH_ALEN}, {"veth0_to_team", ETH_ALEN}, {"veth1_to_team", ETH_ALEN}, {"veth0_to_hsr", ETH_ALEN}, {"veth1_to_hsr", ETH_ALEN}, {"hsr0", 0}, {"dummy0", ETH_ALEN}, {"nlmon0", 0}, {"vxcan1", 0, true}, {"caif0", ETH_ALEN}, {"batadv0", ETH_ALEN}, {netdevsim, ETH_ALEN}, }; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) netlink_add_device(sock, devtypes[i].type, devtypes[i].dev); for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) { char master[32], slave0[32], veth0[32], slave1[32], veth1[32]; sprintf(slave0, "%s_slave_0", devmasters[i]); sprintf(veth0, "veth0_to_%s", devmasters[i]); netlink_add_veth(sock, slave0, veth0); sprintf(slave1, "%s_slave_1", devmasters[i]); sprintf(veth1, "veth1_to_%s", devmasters[i]); netlink_add_veth(sock, slave1, veth1); sprintf(master, "%s0", devmasters[i]); netlink_device_change(sock, slave0, false, master, 0, 0); netlink_device_change(sock, slave1, false, master, 0, 0); } netlink_device_change(sock, "bridge_slave_0", true, 0, 0, 0); netlink_device_change(sock, "bridge_slave_1", true, 0, 0, 0); netlink_add_veth(sock, "hsr_slave_0", "veth0_to_hsr"); netlink_add_veth(sock, "hsr_slave_1", "veth1_to_hsr"); netlink_add_hsr(sock, "hsr0", "hsr_slave_0", "hsr_slave_1"); netlink_device_change(sock, "hsr_slave_0", true, 0, 0, 0); netlink_device_change(sock, "hsr_slave_1", true, 0, 0, 0); for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) { char addr[32]; sprintf(addr, DEV_IPV4, i + 10); netlink_add_addr4(sock, devices[i].name, addr); if (!devices[i].noipv6) { sprintf(addr, DEV_IPV6, i + 10); netlink_add_addr6(sock, devices[i].name, addr); } uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40); netlink_device_change(sock, devices[i].name, true, 0, &macaddr, devices[i].macsize); } close(sock); } static void initialize_netdevices_init(void) { int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); struct { const char* type; int macsize; bool noipv6; bool noup; } devtypes[] = { {"nr", 7, true}, {"rose", 5, true, true}, }; unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) { char dev[32], addr[32]; sprintf(dev, "%s%d", devtypes[i].type, (int)procid); sprintf(addr, "172.30.%d.%d", i, (int)procid + 1); netlink_add_addr4(sock, dev, addr); if (!devtypes[i].noipv6) { sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1); netlink_add_addr6(sock, dev, addr); } int macsize = devtypes[i].macsize; uint64_t macaddr = 0xbbbbbb + ((unsigned long long)i << (8 * (macsize - 2))) + (procid << (8 * (macsize - 1))); netlink_device_change(sock, dev, !devtypes[i].noup, 0, &macaddr, macsize); } close(sock); } #define USB_DEBUG 0 #define USB_MAX_EP_NUM 32 struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; unsigned config_length; struct usb_interface_descriptor* iface; struct usb_endpoint_descriptor* eps[USB_MAX_EP_NUM]; unsigned eps_num; }; static bool parse_usb_descriptor(char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config) + sizeof(*index->iface)) return false; index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->config_length = length - sizeof(*index->dev); index->iface = (struct usb_interface_descriptor*)(buffer + sizeof(*index->dev) + sizeof(*index->config)); index->eps_num = 0; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_ENDPOINT) { index->eps[index->eps_num] = (struct usb_endpoint_descriptor*)(buffer + offset); index->eps_num++; } if (index->eps_num == USB_MAX_EP_NUM) break; offset += desc_length; } return true; } enum usb_fuzzer_event_type { USB_FUZZER_EVENT_INVALID, USB_FUZZER_EVENT_CONNECT, USB_FUZZER_EVENT_DISCONNECT, USB_FUZZER_EVENT_SUSPEND, USB_FUZZER_EVENT_RESUME, USB_FUZZER_EVENT_CONTROL, }; struct usb_fuzzer_event { uint32_t type; uint32_t length; char data[0]; }; struct usb_fuzzer_init { uint64_t speed; const char* driver_name; const char* device_name; }; struct usb_fuzzer_ep_io { uint16_t ep; uint16_t flags; uint32_t length; char data[0]; }; #define USB_FUZZER_IOCTL_INIT _IOW('U', 0, struct usb_fuzzer_init) #define USB_FUZZER_IOCTL_RUN _IO('U', 1) #define USB_FUZZER_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_fuzzer_event) #define USB_FUZZER_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_fuzzer_ep_io) #define USB_FUZZER_IOCTL_EP0_READ _IOWR('U', 4, struct usb_fuzzer_ep_io) #define USB_FUZZER_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor) #define USB_FUZZER_IOCTL_EP_WRITE _IOW('U', 7, struct usb_fuzzer_ep_io) #define USB_FUZZER_IOCTL_EP_READ _IOWR('U', 8, struct usb_fuzzer_ep_io) #define USB_FUZZER_IOCTL_CONFIGURE _IO('U', 9) #define USB_FUZZER_IOCTL_VBUS_DRAW _IOW('U', 10, uint32_t) int usb_fuzzer_open() { return open("/sys/kernel/debug/usb-fuzzer", O_RDWR); } int usb_fuzzer_init(int fd, uint32_t speed, const char* driver, const char* device) { struct usb_fuzzer_init arg; arg.speed = speed; arg.driver_name = driver; arg.device_name = device; return ioctl(fd, USB_FUZZER_IOCTL_INIT, &arg); } int usb_fuzzer_run(int fd) { return ioctl(fd, USB_FUZZER_IOCTL_RUN, 0); } int usb_fuzzer_event_fetch(int fd, struct usb_fuzzer_event* event) { return ioctl(fd, USB_FUZZER_IOCTL_EVENT_FETCH, event); } int usb_fuzzer_ep0_write(int fd, struct usb_fuzzer_ep_io* io) { return ioctl(fd, USB_FUZZER_IOCTL_EP0_WRITE, io); } int usb_fuzzer_ep0_read(int fd, struct usb_fuzzer_ep_io* io) { return ioctl(fd, USB_FUZZER_IOCTL_EP0_READ, io); } int usb_fuzzer_ep_write(int fd, struct usb_fuzzer_ep_io* io) { return ioctl(fd, USB_FUZZER_IOCTL_EP_WRITE, io); } int usb_fuzzer_ep_read(int fd, struct usb_fuzzer_ep_io* io) { return ioctl(fd, USB_FUZZER_IOCTL_EP_READ, io); } int usb_fuzzer_ep_enable(int fd, struct usb_endpoint_descriptor* desc) { return ioctl(fd, USB_FUZZER_IOCTL_EP_ENABLE, desc); } int usb_fuzzer_configure(int fd) { return ioctl(fd, USB_FUZZER_IOCTL_CONFIGURE, 0); } int usb_fuzzer_vbus_draw(int fd, uint32_t power) { return ioctl(fd, USB_FUZZER_IOCTL_VBUS_DRAW, power); } #define USB_MAX_PACKET_SIZE 1024 struct usb_fuzzer_control_event { struct usb_fuzzer_event inner; struct usb_ctrlrequest ctrl; char data[USB_MAX_PACKET_SIZE]; }; struct usb_fuzzer_ep_io_data { struct usb_fuzzer_ep_io inner; char data[USB_MAX_PACKET_SIZE]; }; struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char* default_string = "syzkaller"; static bool lookup_connect_response(struct vusb_connect_descriptors* descs, struct usb_device_index* index, struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { uint8_t str_idx; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (str_idx >= descs->strs_len) { *response_data = (char*)default_string; *response_length = strlen(default_string); } else { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; } return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: *response_data = descs->qual; *response_length = descs->qual_len; return true; default: exit(1); return false; } break; default: exit(1); return false; } break; default: exit(1); return false; } return false; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; char* dev = (char*)a2; struct vusb_connect_descriptors* descs = (struct vusb_connect_descriptors*)a3; if (!dev) { return -1; } struct usb_device_index index; memset(&index, 0, sizeof(index)); int rv = 0; NONFAILING(rv = parse_usb_descriptor(dev, dev_len, &index)); if (!rv) { return rv; } int fd = usb_fuzzer_open(); if (fd < 0) { return fd; } char device[32]; sprintf(&device[0], "dummy_udc.%llu", procid); rv = usb_fuzzer_init(fd, speed, "dummy_udc", &device[0]); if (rv < 0) { return rv; } rv = usb_fuzzer_run(fd); if (rv < 0) { return rv; } bool done = false; while (!done) { struct usb_fuzzer_control_event event; event.inner.type = 0; event.inner.length = sizeof(event.ctrl); rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event); if (rv < 0) { return rv; } if (event.inner.type != USB_FUZZER_EVENT_CONTROL) continue; bool response_found = false; char* response_data = NULL; uint32_t response_length = 0; if (event.ctrl.bRequestType & USB_DIR_IN) { NONFAILING(response_found = lookup_connect_response(descs, &index, &event.ctrl, &response_data, &response_length)); if (!response_found) { return -1; } } else { if ((event.ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD || event.ctrl.bRequest != USB_REQ_SET_CONFIGURATION) { exit(1); return -1; } done = true; } if (done) { rv = usb_fuzzer_vbus_draw(fd, index.config->bMaxPower); if (rv < 0) { return rv; } rv = usb_fuzzer_configure(fd); if (rv < 0) { return rv; } unsigned ep; for (ep = 0; ep < index.eps_num; ep++) { rv = usb_fuzzer_ep_enable(fd, index.eps[ep]); if (rv < 0) { } else { } } } struct usb_fuzzer_ep_io_data response; response.inner.ep = 0; response.inner.flags = 0; if (response_length > sizeof(response.data)) response_length = 0; if (event.ctrl.wLength < response_length) response_length = event.ctrl.wLength; response.inner.length = response_length; if (response_data) memcpy(&response.data[0], response_data, response_length); else memset(&response.data[0], 0, response_length); if (event.ctrl.bRequestType & USB_DIR_IN) rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response); else rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response); if (rv < 0) { return rv; } } sleep_ms(200); return fd; } struct vusb_descriptor { uint8_t req_type; uint8_t desc_type; uint32_t len; char data[0]; } __attribute__((packed)); struct vusb_descriptors { uint32_t len; struct vusb_descriptor* generic; struct vusb_descriptor* descs[0]; } __attribute__((packed)); struct vusb_response { uint8_t type; uint8_t req; uint32_t len; char data[0]; } __attribute__((packed)); struct vusb_responses { uint32_t len; struct vusb_response* generic; struct vusb_response* resps[0]; } __attribute__((packed)); static bool lookup_control_response(struct vusb_descriptors* descs, struct vusb_responses* resps, struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { int descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) / sizeof(descs->descs[0]); int resps_num = (resps->len - offsetof(struct vusb_responses, resps)) / sizeof(resps->resps[0]); uint8_t req = ctrl->bRequest; uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK; uint8_t desc_type = ctrl->wValue >> 8; if (req == USB_REQ_GET_DESCRIPTOR) { int i; for (i = 0; i < descs_num; i++) { struct vusb_descriptor* desc = descs->descs[i]; if (!desc) continue; if (desc->req_type == req_type && desc->desc_type == desc_type) { *response_length = desc->len; if (*response_length != 0) *response_data = &desc->data[0]; else *response_data = NULL; return true; } } if (descs->generic) { *response_data = &descs->generic->data[0]; *response_length = descs->generic->len; return true; } } else { int i; for (i = 0; i < resps_num; i++) { struct vusb_response* resp = resps->resps[i]; if (!resp) continue; if (resp->type == req_type && resp->req == req) { *response_length = resp->len; if (*response_length != 0) *response_data = &resp->data[0]; else *response_data = NULL; return true; } } if (resps->generic) { *response_data = &resps->generic->data[0]; *response_length = resps->generic->len; return true; } } return false; } static volatile long syz_usb_control_io(volatile long a0, volatile long a1, volatile long a2) { int fd = a0; struct vusb_descriptors* descs = (struct vusb_descriptors*)a1; struct vusb_responses* resps = (struct vusb_responses*)a2; struct usb_fuzzer_control_event event; event.inner.type = 0; event.inner.length = USB_MAX_PACKET_SIZE; int rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event); if (rv < 0) { return rv; } if (event.inner.type != USB_FUZZER_EVENT_CONTROL) { return -1; } bool response_found = false; char* response_data = NULL; uint32_t response_length = 0; if (event.ctrl.bRequestType & USB_DIR_IN) { NONFAILING(response_found = lookup_control_response(descs, resps, &event.ctrl, &response_data, &response_length)); if (!response_found) { return -1; } } else { response_length = event.ctrl.wLength; } struct usb_fuzzer_ep_io_data response; response.inner.ep = 0; response.inner.flags = 0; if (response_length > sizeof(response.data)) response_length = 0; if (event.ctrl.wLength < response_length) response_length = event.ctrl.wLength; response.inner.length = response_length; if (response_data) memcpy(&response.data[0], response_data, response_length); else memset(&response.data[0], 0, response_length); if (event.ctrl.bRequestType & USB_DIR_IN) { rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response); } else { rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response); } if (rv < 0) { return rv; } sleep_ms(200); return 0; } static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; NONFAILING(strncpy(buf, (char*)a0, sizeof(buf) - 1)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } static void setup_common() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); setsid(); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); setup_common(); sandbox_common(); drop_caps(); initialize_netdevices_init(); if (unshare(CLONE_NEWNET)) { } initialize_netdevices(); loop(); exit(1); } static void close_fds() { int fd; for (fd = 3; fd < 30; fd++) close(fd); } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void loop(void) { int i, call, thread; int collide = 0; again: for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); if (collide && (call % 2) == 0) break; event_timedwait(&th->done, 45 + (call == 0 ? 2000 : 0) + (call == 1 ? 300 : 0) + (call == 2 ? 300 : 0) + (call == 7 ? 300 : 0) + (call == 8 ? 300 : 0) + (call == 10 ? 2000 : 0) + (call == 11 ? 300 : 0) + (call == 13 ? 2000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); close_fds(); if (!collide) { collide = 1; goto again; } } uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res; switch (call) { case 0: NONFAILING(memcpy((void*)0x200005c0, "\x12\x01\x00\x00\x09\x00\x00\x20\x6d\x04\x1c\xc3\x40\x00" "\x00\x00\x00\x01\x09\x02\x24\x00\x01\x00\x00\xa0\x00\x09" "\x04\x00\x00\x01\x03\x11\x01\x00\x09\x21\x00\x00\x00\x01" "\x22\x05\x00\x09\x05\x81\x03\x00\x00\x00\x00\x00\x03\xfc" "\x75\xe8\xa3\x2e\xba\xd1\x80\x5b\xc9\x2e\x0d\x66\x67\xd4" "\x1d\xc1\x96\x01\x00\x4c\x2a\x36\x89\x35\x8c\x46\xa4\x1f" "\x78\x63\x4a\x57\xa1\xf5\x49\x91", 92)); res = syz_usb_connect(0, 0x36, 0x200005c0, 0); if (res != -1) r[0] = res; break; case 1: syz_usb_control_io(r[0], 0, 0); break; case 2: NONFAILING(*(uint32_t*)0x200003c0 = 0x34); NONFAILING(*(uint64_t*)0x200003c4 = 0x20000040); NONFAILING(*(uint8_t*)0x20000040 = 0); NONFAILING(*(uint8_t*)0x20000041 = 0); NONFAILING(*(uint32_t*)0x20000042 = 5); NONFAILING(*(uint8_t*)0x20000046 = 5); NONFAILING(*(uint8_t*)0x20000047 = 0); NONFAILING(memcpy((void*)0x20000048, "\x32\x87\x6a", 3)); NONFAILING(*(uint64_t*)0x200003cc = 0); NONFAILING(*(uint64_t*)0x200003d4 = 0); NONFAILING(*(uint64_t*)0x200003dc = 0); NONFAILING(*(uint32_t*)0x20000d00 = 0xcc); NONFAILING(*(uint64_t*)0x20000d04 = 0); NONFAILING(*(uint64_t*)0x20000d0c = 0); NONFAILING(*(uint64_t*)0x20000d14 = 0); NONFAILING(*(uint64_t*)0x20000d1c = 0); NONFAILING(*(uint64_t*)0x20000d24 = 0); syz_usb_control_io(r[0], 0x200003c0, 0x20000d00); break; case 3: NONFAILING(memcpy((void*)0x20000000, "/dev/hidraw#\000", 13)); syz_open_dev(0x20000000, 0, 0x4202); break; case 4: syz_open_dev(0, 0, 0); break; case 5: syscall(__NR_ioctl, -1, 0x8040451b, 0x20000100); break; case 6: NONFAILING(*(uint32_t*)0x200001c0 = 0x3ff); NONFAILING(*(uint32_t*)0x200001c4 = 0x2c9dd15e); NONFAILING(*(uint32_t*)0x200001c8 = 0xffffff01); NONFAILING(*(uint32_t*)0x200001cc = 0x3ec); NONFAILING(*(uint32_t*)0x200001d0 = 9); NONFAILING(*(uint32_t*)0x200001d4 = 0x1ff); syscall(__NR_ioctl, -1, 0x401845ef, 0x200001c0); break; case 7: NONFAILING(*(uint32_t*)0x20000200 = 0x24); NONFAILING(*(uint64_t*)0x20000204 = 0x20000000); NONFAILING(*(uint8_t*)0x20000000 = 0x4f); NONFAILING(*(uint8_t*)0x20000001 = 0x37); NONFAILING(*(uint32_t*)0x20000002 = 2); NONFAILING(*(uint8_t*)0x20000006 = 2); NONFAILING(*(uint8_t*)0x20000007 = 0xe); NONFAILING(*(uint64_t*)0x2000020c = 0x200006c0); NONFAILING(*(uint8_t*)0x200006c0 = 0); NONFAILING(*(uint8_t*)0x200006c1 = 3); NONFAILING(*(uint32_t*)0x200006c2 = 4); NONFAILING(*(uint8_t*)0x200006c6 = 4); NONFAILING(*(uint8_t*)0x200006c7 = 3); NONFAILING(*(uint16_t*)0x200006c8 = 0xc05); NONFAILING(*(uint64_t*)0x20000214 = 0x20000140); NONFAILING(*(uint8_t*)0x20000140 = 0); NONFAILING(*(uint8_t*)0x20000141 = 0x22); NONFAILING(*(uint32_t*)0x20000142 = 0x11); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000146, 2, 0, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000146, 1, 2, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000146, 5, 4, 4)); NONFAILING(memcpy((void*)0x20000147, "\x16\x0c", 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000149, 1, 0, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000149, 2, 2, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000149, 1, 4, 4)); NONFAILING(memcpy((void*)0x2000014a, "\x82", 1)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014b, 2, 0, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014b, 1, 2, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014b, 4, 4, 4)); NONFAILING(memcpy((void*)0x2000014c, "\xf5\x3a", 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014e, 0, 0, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014e, 2, 2, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014e, 0xa, 4, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014f, 3, 0, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014f, 1, 2, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000014f, 3, 4, 4)); NONFAILING(memcpy((void*)0x20000150, "\xcb\x92\xd9\x37", 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000154, 2, 0, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000154, 2, 2, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000154, 0, 4, 4)); NONFAILING(memcpy((void*)0x20000155, "\xfa\xc9", 2)); NONFAILING(*(uint64_t*)0x2000021c = 0x20000180); NONFAILING(*(uint8_t*)0x20000180 = 0); NONFAILING(*(uint8_t*)0x20000181 = 0x21); NONFAILING(*(uint32_t*)0x20000182 = 9); NONFAILING(*(uint8_t*)0x20000186 = 9); NONFAILING(*(uint8_t*)0x20000187 = 0x21); NONFAILING(*(uint16_t*)0x20000188 = 8); NONFAILING(*(uint8_t*)0x2000018a = 9); NONFAILING(*(uint8_t*)0x2000018b = 1); NONFAILING(*(uint8_t*)0x2000018c = 0x22); NONFAILING(*(uint16_t*)0x2000018d = 0x75c); syz_usb_control_io(-1, 0x20000200, 0); break; case 8: syz_usb_control_io(-1, 0, 0); break; case 9: NONFAILING(memcpy((void*)0x200002c0, "/dev/hidraw#\000", 13)); res = syz_open_dev(0x200002c0, 0, 0); if (res != -1) r[1] = res; break; case 10: NONFAILING(*(uint8_t*)0x20000400 = 0x12); NONFAILING(*(uint8_t*)0x20000401 = 1); NONFAILING(*(uint16_t*)0x20000402 = 0x200); NONFAILING(*(uint8_t*)0x20000404 = 2); NONFAILING(*(uint8_t*)0x20000405 = 0); NONFAILING(*(uint8_t*)0x20000406 = 0); NONFAILING(*(uint8_t*)0x20000407 = 8); NONFAILING(*(uint16_t*)0x20000408 = 0x525); NONFAILING(*(uint16_t*)0x2000040a = 0xa4a1); NONFAILING(*(uint16_t*)0x2000040c = 0x40); NONFAILING(*(uint8_t*)0x2000040e = 2); NONFAILING(*(uint8_t*)0x2000040f = 1); NONFAILING(*(uint8_t*)0x20000410 = 6); NONFAILING(*(uint8_t*)0x20000411 = 1); NONFAILING(*(uint8_t*)0x20000412 = 9); NONFAILING(*(uint8_t*)0x20000413 = 2); NONFAILING(*(uint16_t*)0x20000414 = 0x80); NONFAILING(*(uint8_t*)0x20000416 = 1); NONFAILING(*(uint8_t*)0x20000417 = 1); NONFAILING(*(uint8_t*)0x20000418 = 0x7d); NONFAILING(*(uint8_t*)0x20000419 = 0xa0); NONFAILING(*(uint8_t*)0x2000041a = 8); NONFAILING(*(uint8_t*)0x2000041b = 9); NONFAILING(*(uint8_t*)0x2000041c = 4); NONFAILING(*(uint8_t*)0x2000041d = 0); NONFAILING(*(uint8_t*)0x2000041e = 0); NONFAILING(*(uint8_t*)0x2000041f = 0x12); NONFAILING(*(uint8_t*)0x20000420 = 2); NONFAILING(*(uint8_t*)0x20000421 = 6); NONFAILING(*(uint8_t*)0x20000422 = 0); NONFAILING(*(uint8_t*)0x20000423 = 0xfc); NONFAILING(*(uint8_t*)0x20000424 = 7); NONFAILING(*(uint8_t*)0x20000425 = 0x24); NONFAILING(*(uint8_t*)0x20000426 = 6); NONFAILING(*(uint8_t*)0x20000427 = 0); NONFAILING(*(uint8_t*)0x20000428 = 0); NONFAILING(memcpy((void*)0x20000429, "ms", 2)); NONFAILING(*(uint8_t*)0x2000042b = 5); NONFAILING(*(uint8_t*)0x2000042c = 0x24); NONFAILING(*(uint8_t*)0x2000042d = 0); NONFAILING(*(uint16_t*)0x2000042e = 3); NONFAILING(*(uint8_t*)0x20000430 = 0xd); NONFAILING(*(uint8_t*)0x20000431 = 0x24); NONFAILING(*(uint8_t*)0x20000432 = 0xf); NONFAILING(*(uint8_t*)0x20000433 = 1); NONFAILING(*(uint32_t*)0x20000434 = 0x1000); NONFAILING(*(uint16_t*)0x20000438 = 0xfffc); NONFAILING(*(uint16_t*)0x2000043a = 0xa8); NONFAILING(*(uint8_t*)0x2000043c = 4); NONFAILING(*(uint8_t*)0x2000043d = 0x15); NONFAILING(*(uint8_t*)0x2000043e = 0x24); NONFAILING(*(uint8_t*)0x2000043f = 0x12); NONFAILING(*(uint16_t*)0x20000440 = 0xfff7); NONFAILING(*(uint64_t*)0x20000442 = 0x14f5e048ba817a3); NONFAILING(*(uint64_t*)0x2000044a = 0x2a397ecbffc007a6); NONFAILING(*(uint8_t*)0x20000452 = 0xc); NONFAILING(*(uint8_t*)0x20000453 = 0x24); NONFAILING(*(uint8_t*)0x20000454 = 0x1b); NONFAILING(*(uint16_t*)0x20000455 = 0x1ff); NONFAILING(*(uint16_t*)0x20000457 = 4); NONFAILING(*(uint8_t*)0x20000459 = 6); NONFAILING(*(uint8_t*)0x2000045a = 9); NONFAILING(*(uint16_t*)0x2000045b = 0x3ff); NONFAILING(*(uint8_t*)0x2000045d = 5); NONFAILING(*(uint8_t*)0x2000045e = 7); NONFAILING(*(uint8_t*)0x2000045f = 0x24); NONFAILING(*(uint8_t*)0x20000460 = 0x14); NONFAILING(*(uint16_t*)0x20000461 = 8); NONFAILING(*(uint16_t*)0x20000463 = 0); NONFAILING(*(uint8_t*)0x20000465 = 7); NONFAILING(*(uint8_t*)0x20000466 = 0x24); NONFAILING(*(uint8_t*)0x20000467 = 0xa); NONFAILING(*(uint8_t*)0x20000468 = 3); NONFAILING(*(uint8_t*)0x20000469 = 7); NONFAILING(*(uint8_t*)0x2000046a = 0x3a); NONFAILING(*(uint8_t*)0x2000046b = 0x9b); NONFAILING(*(uint8_t*)0x2000046c = 0xc); NONFAILING(*(uint8_t*)0x2000046d = 0x24); NONFAILING(*(uint8_t*)0x2000046e = 0x1b); NONFAILING(*(uint16_t*)0x2000046f = 8); NONFAILING(*(uint16_t*)0x20000471 = 0xdf3); NONFAILING(*(uint8_t*)0x20000473 = 0x1f); NONFAILING(*(uint8_t*)0x20000474 = 0x20); NONFAILING(*(uint16_t*)0x20000475 = 1); NONFAILING(*(uint8_t*)0x20000477 = 0x50); NONFAILING(*(uint8_t*)0x20000478 = 8); NONFAILING(*(uint8_t*)0x20000479 = 0x24); NONFAILING(*(uint8_t*)0x2000047a = 0x1c); NONFAILING(*(uint16_t*)0x2000047b = 0x101); NONFAILING(*(uint8_t*)0x2000047d = 0x3f); NONFAILING(*(uint16_t*)0x2000047e = 1); NONFAILING(*(uint8_t*)0x20000480 = 9); NONFAILING(*(uint8_t*)0x20000481 = 5); NONFAILING(*(uint8_t*)0x20000482 = 0x82); NONFAILING(*(uint8_t*)0x20000483 = 2); NONFAILING(*(uint16_t*)0x20000484 = 0x20); NONFAILING(*(uint8_t*)0x20000486 = 0x74); NONFAILING(*(uint8_t*)0x20000487 = 1); NONFAILING(*(uint8_t*)0x20000488 = 6); NONFAILING(*(uint8_t*)0x20000489 = 9); NONFAILING(*(uint8_t*)0x2000048a = 5); NONFAILING(*(uint8_t*)0x2000048b = 3); NONFAILING(*(uint8_t*)0x2000048c = 2); NONFAILING(*(uint16_t*)0x2000048d = 0x10); NONFAILING(*(uint8_t*)0x2000048f = -1); NONFAILING(*(uint8_t*)0x20000490 = 0xb9); NONFAILING(*(uint8_t*)0x20000491 = 5); res = syz_usb_connect(5, 0x92, 0x20000400, 0); if (res != -1) r[2] = res; break; case 11: NONFAILING(*(uint32_t*)0x20000d00 = 0x2c); NONFAILING(*(uint64_t*)0x20000d04 = 0); NONFAILING(*(uint64_t*)0x20000d0c = 0x20000ac0); NONFAILING(*(uint8_t*)0x20000ac0 = 0); NONFAILING(*(uint8_t*)0x20000ac1 = 3); NONFAILING(*(uint32_t*)0x20000ac2 = 0x103); NONFAILING(*(uint8_t*)0x20000ac6 = 3); NONFAILING(*(uint8_t*)0x20000ac7 = 3); NONFAILING(*(uint16_t*)0x20000ac8 = 0x41a); NONFAILING(memcpy( (void*)0x20000aca, "\x02\xc6\x10\x9c\x67\xda\x5e\x68\xaa\xe5\xfb\xd9\xe2\x41\xca\xb1\x3e" "\x71\x47\x70\x3b\x7b\xc6\xc0\xf6\xd1\xf0\x59\x27\x10\xf3\xca\x75\x3d" "\xbf\xf3\xfc\x4d\xb6\xdf\xf6\x24\xad\xa4\xee\xc2\x36\xda\x62\x74\x3d" "\x53\x53\x01\xac\x7b\xcc\xb7\xa6\x38\x14\xc0\xd7\x84\xf7\xf1\x9f\x05" "\xb9\x60\xe5\xa9\xc9\x97\xab\x81\xa6\x32\xc5\x2f\x9b\x83\xe7\x5b\x43" "\x0c\xf8\x23\x5e\x3b\xda\xfd\x87\xa3\x8a\x57\xe9\x26\x98\x69\xcc\xf0" "\xf1\x3c\x3a\xb1\x7f\x54\x39\xfc\xba\x73\x7b\x9f\x5f\xe5\x8f\xd2\xb0" "\xa4\x4d\x66\x29\xf6\x99\x71\xe4\x09\x16\x3e\x14\x7a\xf9\x72\xaf\x6d" "\x22\x47\xfb\x01\xd7\x92\xa8\xc9\x04\x4f\x70\x05\x51\x55\x33\x5c\xd4" "\x10\x8e\xda\x8e\xb2\x9f\xee\x62\xb4\xa0\xa1\xf1\xef\x0e\xa5\x3b\x79" "\xdf\x38\x1d\x4d\xa4\xb3\x3a\xf8\x60\x38\x49\xb4\x81\x77\xac\x7f\x13" "\x91\x3f\x36\x6e\x5d\x80\xdc\x1e\x90\x77\xad\xb1\x09\x10\x11\xbd\xe4" "\xcb\x67\xb5\x85\x77\x37\x56\x68\x70\xde\xe3\xab\x89\xd6\x86\x77\x76" "\x3e\xce\x6d\x58\x97\x3e\x18\x5e\xc7\x2f\x58\x7d\x6e\x23\xc5\x49\x34" "\xe5\x02\x36\xcc\x61\x91\xc1\xe4\x3f\xe8\xab\x13\xda\xbc\x46\x81\xbf", 255)); NONFAILING(*(uint64_t*)0x20000d14 = 0x20000c00); NONFAILING(*(uint8_t*)0x20000c00 = 0); NONFAILING(*(uint8_t*)0x20000c01 = 0xf); NONFAILING(*(uint32_t*)0x20000c02 = 0x5d); NONFAILING(*(uint8_t*)0x20000c06 = 5); NONFAILING(*(uint8_t*)0x20000c07 = 0xf); NONFAILING(*(uint16_t*)0x20000c08 = 0x5d); NONFAILING(*(uint8_t*)0x20000c0a = 6); NONFAILING(*(uint8_t*)0x20000c0b = 0xb); NONFAILING(*(uint8_t*)0x20000c0c = 0x10); NONFAILING(*(uint8_t*)0x20000c0d = 1); NONFAILING(*(uint8_t*)0x20000c0e = 8); NONFAILING(*(uint16_t*)0x20000c0f = 7); NONFAILING(*(uint8_t*)0x20000c11 = 5); NONFAILING(*(uint8_t*)0x20000c12 = 0); NONFAILING(*(uint16_t*)0x20000c13 = 0x3ff); NONFAILING(*(uint8_t*)0x20000c15 = 9); NONFAILING(*(uint8_t*)0x20000c16 = 0x14); NONFAILING(*(uint8_t*)0x20000c17 = 0x10); NONFAILING(*(uint8_t*)0x20000c18 = 4); NONFAILING(*(uint8_t*)0x20000c19 = 0x90); NONFAILING(memcpy( (void*)0x20000c1a, "\x8a\x3d\x78\x6d\x07\xb8\x15\x69\xea\x0b\x4c\xb5\x8a\x51\xea\xb2", 16)); NONFAILING(*(uint8_t*)0x20000c2a = 0xa); NONFAILING(*(uint8_t*)0x20000c2b = 0x10); NONFAILING(*(uint8_t*)0x20000c2c = 3); NONFAILING(*(uint8_t*)0x20000c2d = 2); NONFAILING(*(uint16_t*)0x20000c2e = 4); NONFAILING(*(uint8_t*)0x20000c30 = 6); NONFAILING(*(uint8_t*)0x20000c31 = 5); NONFAILING(*(uint16_t*)0x20000c32 = 5); NONFAILING(*(uint8_t*)0x20000c34 = 7); NONFAILING(*(uint8_t*)0x20000c35 = 0x10); NONFAILING(*(uint8_t*)0x20000c36 = 2); NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000c37, 2, 0, 8)); NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000c37, 2, 8, 4)); NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000c37, 9, 12, 4)); NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000c37, -1, 16, 16)); NONFAILING(*(uint8_t*)0x20000c3b = 0x14); NONFAILING(*(uint8_t*)0x20000c3c = 0x10); NONFAILING(*(uint8_t*)0x20000c3d = 4); NONFAILING(*(uint8_t*)0x20000c3e = 5); NONFAILING(memcpy( (void*)0x20000c3f, "\x15\xd0\x85\x97\x8a\xd6\x28\xb1\x88\x58\xba\x3e\x30\xb6\xf4\x1a", 16)); NONFAILING(*(uint8_t*)0x20000c4f = 0x14); NONFAILING(*(uint8_t*)0x20000c50 = 0x10); NONFAILING(*(uint8_t*)0x20000c51 = 4); NONFAILING(*(uint8_t*)0x20000c52 = -1); NONFAILING(memcpy( (void*)0x20000c53, "\xc4\xab\xee\xc2\x6c\x42\x8b\xc5\x6c\x00\x9e\xf8\x98\xb6\x69\xd8", 16)); NONFAILING(*(uint64_t*)0x20000d1c = 0x20000c80); NONFAILING(*(uint8_t*)0x20000c80 = 0x20); NONFAILING(*(uint8_t*)0x20000c81 = 0x29); NONFAILING(*(uint32_t*)0x20000c82 = 0xf); NONFAILING(*(uint8_t*)0x20000c86 = 0xf); NONFAILING(*(uint8_t*)0x20000c87 = 0x29); NONFAILING(*(uint8_t*)0x20000c88 = 1); NONFAILING(*(uint16_t*)0x20000c89 = 0x1b); NONFAILING(*(uint8_t*)0x20000c8b = -1); NONFAILING(*(uint8_t*)0x20000c8c = 1); NONFAILING(memcpy((void*)0x20000c8d, "\xbb\x49\x96\x1a", 4)); NONFAILING(memcpy((void*)0x20000c91, "\xb7\xdc\x89\x5c", 4)); NONFAILING(*(uint64_t*)0x20000d24 = 0x20000cc0); NONFAILING(*(uint8_t*)0x20000cc0 = 0x20); NONFAILING(*(uint8_t*)0x20000cc1 = 0x2a); NONFAILING(*(uint32_t*)0x20000cc2 = 0xc); NONFAILING(*(uint8_t*)0x20000cc6 = 0xc); NONFAILING(*(uint8_t*)0x20000cc7 = 0x2a); NONFAILING(*(uint8_t*)0x20000cc8 = 0x78); NONFAILING(*(uint16_t*)0x20000cc9 = 2); NONFAILING(*(uint8_t*)0x20000ccb = 0); NONFAILING(*(uint8_t*)0x20000ccc = 0); NONFAILING(*(uint8_t*)0x20000ccd = 9); NONFAILING(*(uint16_t*)0x20000cce = 0x8001); NONFAILING(*(uint16_t*)0x20000cd0 = 2); syz_usb_control_io(r[2], 0x20000d00, 0); break; case 12: syscall(__NR_ioctl, r[1], 0xc0404807, 0); break; case 13: syz_usb_connect(0, 1, 0x20000000, 0); break; case 14: syscall(__NR_ioctl, r[1], 0x80404805, 0x20001340); break; case 15: NONFAILING(*(uint32_t*)0x200007c0 = 0x2c); NONFAILING(*(uint64_t*)0x200007c4 = 0); NONFAILING(*(uint64_t*)0x200007cc = 0); NONFAILING(*(uint64_t*)0x200007d4 = 0); NONFAILING(*(uint64_t*)0x200007dc = 0); NONFAILING(*(uint64_t*)0x200007e4 = 0); syz_usb_control_io(-1, 0, 0x200007c0); break; } } int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); install_segv_handler(); do_sandbox_none(); return 0; }