// https://syzkaller.appspot.com/bug?id=8fe3032aaaeac601ec808db097fd1c2f932b7659 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } memcpy((void*)0x200000000280, "./file0\000", 8); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000280ul, /*mode=*/0ul); syscall(__NR_unshare, /*flags=CLONE_NEWPID|CLONE_NEWNS|CLONE_NEWCGROUP|CLONE_FS|0x400*/ 0x22020600ul); syscall(__NR_unshare, /*flags=CLONE_NEWPID|CLONE_NEWNS|CLONE_NEWCGROUP|CLONE_FS|0x400*/ 0x22020600ul); memcpy((void*)0x200000000140, "./file0\000", 8); memcpy((void*)0x200000000180, "overlay\000", 8); memcpy((void*)0x2000000001c0, "lowerdir", 8); *(uint8_t*)0x2000000001c8 = 0x3d; memcpy((void*)0x2000000001c9, "./file0", 7); *(uint8_t*)0x2000000001d0 = 0x3a; *(uint8_t*)0x2000000001d1 = 0x2f; syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000140ul, /*type=*/0x200000000180ul, /*flags=*/0ul, /*opts=*/0x2000000001c0ul); return 0; }