// https://syzkaller.appspot.com/bug?id=2668718853a3764ffe6976db2451c75e34780d67 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_pipe2, 0x20000100, 0); if (res != -1) { r[0] = *(uint32_t*)0x20000100; r[1] = *(uint32_t*)0x20000104; } *(uint32_t*)0x200001c0 = 7; *(uint8_t*)0x200001c4 = 0x4d; *(uint16_t*)0x200001c5 = 0; syscall(__NR_write, r[1], 0x200001c0, 7); memcpy((void*)0x20000140, "./file0", 8); syscall(__NR_mkdir, 0x20000140, 0); memcpy((void*)0x20000380, "./file0", 8); memcpy((void*)0x200003c0, "9p", 3); memcpy((void*)0x200004c0, "trans=fd,", 9); memcpy((void*)0x200004c9, "rfdno", 5); *(uint8_t*)0x200004ce = 0x3d; sprintf((char*)0x200004cf, "0x%016llx", (long long)r[0]); *(uint8_t*)0x200004e1 = 0x2c; memcpy((void*)0x200004e2, "wfdno", 5); *(uint8_t*)0x200004e7 = 0x3d; sprintf((char*)0x200004e8, "0x%016llx", (long long)r[1]); *(uint8_t*)0x200004fa = 0x2c; memcpy((void*)0x200004fb, "noextend", 8); *(uint8_t*)0x20000503 = 0x2c; *(uint8_t*)0x20000504 = 0; syscall(__NR_mount, 0, 0x20000380, 0x200003c0, 0, 0x200004c0); *(uint32_t*)0x20000200 = 0xa0; *(uint8_t*)0x20000204 = 0x19; *(uint16_t*)0x20000205 = 1; *(uint64_t*)0x20000207 = 0; *(uint8_t*)0x2000020f = 0; *(uint32_t*)0x20000210 = 0; *(uint64_t*)0x20000214 = 0; *(uint32_t*)0x2000021c = 0; *(uint32_t*)0x20000220 = 0; *(uint32_t*)0x20000224 = 0; *(uint64_t*)0x20000228 = 0; *(uint64_t*)0x20000230 = 0; *(uint64_t*)0x20000238 = 0; *(uint64_t*)0x20000240 = 0; *(uint64_t*)0x20000248 = 0; *(uint64_t*)0x20000250 = 0; *(uint64_t*)0x20000258 = 0; *(uint64_t*)0x20000260 = 0; *(uint64_t*)0x20000268 = 0; *(uint64_t*)0x20000270 = 0; *(uint64_t*)0x20000278 = 0; *(uint64_t*)0x20000280 = 0; *(uint64_t*)0x20000288 = 0; *(uint64_t*)0x20000290 = 0; *(uint64_t*)0x20000298 = 0; syscall(__NR_write, r[1], 0x20000200, 0xa0); syscall(__NR_write, r[1], 0x20000080, 0); *(uint32_t*)0x20000540 = 0xa0; *(uint8_t*)0x20000544 = 0x19; *(uint16_t*)0x20000545 = 1; *(uint64_t*)0x20000547 = 0; *(uint8_t*)0x2000054f = 0; *(uint32_t*)0x20000550 = 0; *(uint64_t*)0x20000554 = 0; *(uint32_t*)0x2000055c = 0; *(uint32_t*)0x20000560 = 0; *(uint32_t*)0x20000564 = 0; *(uint64_t*)0x20000568 = 0; *(uint64_t*)0x20000570 = 0; *(uint64_t*)0x20000578 = 0; *(uint64_t*)0x20000580 = 0; *(uint64_t*)0x20000588 = 0; *(uint64_t*)0x20000590 = 0; *(uint64_t*)0x20000598 = 0; *(uint64_t*)0x200005a0 = 0; *(uint64_t*)0x200005a8 = 0; *(uint64_t*)0x200005b0 = 0; *(uint64_t*)0x200005b8 = 0; *(uint64_t*)0x200005c0 = 0; *(uint64_t*)0x200005c8 = 0; *(uint64_t*)0x200005d0 = 0; *(uint64_t*)0x200005d8 = 0; syscall(__NR_write, r[1], 0x20000540, 0xa0); *(uint32_t*)0x20000180 = 0x2be; *(uint8_t*)0x20000184 = 0x77; *(uint16_t*)0x20000185 = 1; *(uint32_t*)0x20000187 = 0; syscall(__NR_write, r[1], 0x20000180, 0xb); *(uint32_t*)0x20000800 = 0xa0; *(uint8_t*)0x20000804 = 0x19; *(uint16_t*)0x20000805 = 1; *(uint64_t*)0x20000807 = 0; *(uint8_t*)0x2000080f = 0; *(uint32_t*)0x20000810 = 0; *(uint64_t*)0x20000814 = 0; *(uint32_t*)0x2000081c = 0; *(uint32_t*)0x20000820 = 0; *(uint32_t*)0x20000824 = 0; *(uint64_t*)0x20000828 = 0; *(uint64_t*)0x20000830 = 0; *(uint64_t*)0x20000838 = 0; *(uint64_t*)0x20000840 = 0; *(uint64_t*)0x20000848 = 0; *(uint64_t*)0x20000850 = 0; *(uint64_t*)0x20000858 = 0; *(uint64_t*)0x20000860 = 0; *(uint64_t*)0x20000868 = 0; *(uint64_t*)0x20000870 = 0; *(uint64_t*)0x20000878 = 0; *(uint64_t*)0x20000880 = 0; *(uint64_t*)0x20000888 = 0; *(uint64_t*)0x20000890 = 0; *(uint64_t*)0x20000898 = 0; syscall(__NR_write, r[1], 0x20000800, 0xa0); *(uint32_t*)0x20000440 = 0x43; *(uint8_t*)0x20000444 = 9; *(uint16_t*)0x20000445 = 1; *(uint32_t*)0x20000447 = 0; *(uint32_t*)0x2000044b = 0; *(uint64_t*)0x2000044f = 0; *(uint64_t*)0x20000457 = 0; *(uint64_t*)0x2000045f = 0; *(uint64_t*)0x20000467 = 0; *(uint64_t*)0x2000046f = 0; *(uint64_t*)0x20000477 = 0; *(uint32_t*)0x2000047f = 0; syscall(__NR_write, r[1], 0x20000440, 0x43); *(uint32_t*)0x20000900 = 0xa0; *(uint8_t*)0x20000904 = 0x19; *(uint16_t*)0x20000905 = 1; *(uint64_t*)0x20000907 = 0; *(uint8_t*)0x2000090f = 0; *(uint32_t*)0x20000910 = 0; *(uint64_t*)0x20000914 = 0; *(uint32_t*)0x2000091c = 0; *(uint32_t*)0x20000920 = 0; *(uint32_t*)0x20000924 = 0; *(uint64_t*)0x20000928 = 0; *(uint64_t*)0x20000930 = 0; *(uint64_t*)0x20000938 = 0; *(uint64_t*)0x20000940 = 0; *(uint64_t*)0x20000948 = 0; *(uint64_t*)0x20000950 = 0; *(uint64_t*)0x20000958 = 0; *(uint64_t*)0x20000960 = 0; *(uint64_t*)0x20000968 = 0; *(uint64_t*)0x20000970 = 0; *(uint64_t*)0x20000978 = 0; *(uint64_t*)0x20000980 = 0; *(uint64_t*)0x20000988 = 0; *(uint64_t*)0x20000990 = 0; *(uint64_t*)0x20000998 = 0; syscall(__NR_write, r[1], 0x20000900, 0xa0); memcpy((void*)0x20000000, "./file0", 8); memcpy((void*)0x200008c0, "9p", 3); memcpy((void*)0x20000a80, "trans=fd,", 9); memcpy((void*)0x20000a89, "rfdno", 5); *(uint8_t*)0x20000a8e = 0x3d; sprintf((char*)0x20000a8f, "0x%016llx", (long long)r[0]); *(uint8_t*)0x20000aa1 = 0x2c; memcpy((void*)0x20000aa2, "wfdno", 5); *(uint8_t*)0x20000aa7 = 0x3d; sprintf((char*)0x20000aa8, "0x%016llx", (long long)r[1]); *(uint8_t*)0x20000aba = 0x2c; *(uint8_t*)0x20000abb = 0; syscall(__NR_mount, 0, 0x20000000, 0x200008c0, 0, 0x20000a80); return 0; }