// https://syzkaller.appspot.com/bug?id=c15dd66633f182dfa034edb10c8b2665d76be898 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define CAST uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t,intptr_t,intptr_t))CAST(mmap))(/*addr=*/0x20000000, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ*/3, /*flags=MAP_ANONYMOUS|MAP_FIXED|MAP_PRIVATE*/0x1012, /*fd=*/-1, /*offset=*/0); intptr_t res = 0; *(uint32_t*)0x20000100 = 0xa; *(uint32_t*)0x20000104 = 1; *(uint32_t*)0x20000108 = 0x11; ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t,intptr_t,intptr_t))CAST(sysctl))(/*name=*/0x20000100, /*namelen=*/3, /*oldp=*/0, /*oldlenp=*/0, /*newp=*/0x20000200, /*newlen=*/4); memcpy((void*)0x200002c0, ".\000", 2); res = -1; res = ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(open))(/*file=*/0x200002c0, /*flags=*/0, /*mode=*/0); if (res != -1) r[0] = res; memcpy((void*)0x20000340, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78); ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(mkdirat))(/*fd=*/r[0], /*path=*/0x20000340, /*mode=S_IWOTH|S_IWUSR|S_IRUSR*/0x182); memcpy((void*)0x20000000, "./file0\000", 8); ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(mkdirat))(/*fd=*/r[0], /*path=*/0x20000000, /*mode=*/0); memcpy((void*)0x20000440, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238//file0\000", 84); ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(mkdirat))(/*fd=*/r[0], /*path=*/0x20000440, /*mode=*/0); memcpy((void*)0x20000540, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238//../file0\000", 87); res = -1; res = ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(open))(/*file=*/0x20000540, /*flags=*/0, /*mode=*/0); if (res != -1) r[1] = res; memcpy((void*)0x20000400, "./file0/file0\000", 14); ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(open))(/*file=*/0x20000400, /*flags=*/0, /*mode=*/0); memcpy((void*)0x20000100, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238//file0\000", 84); memcpy((void*)0x20000180, "./file0\000", 8); ((intptr_t(*)(intptr_t,intptr_t))CAST(rename))(/*old=*/0x20000100, /*new=*/0x20000180); memcpy((void*)0x200000c0, "./file0\000", 8); ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t))CAST(renameat))(/*oldfd=*/r[1], /*old=*/0x200000c0, /*newfd=*/r[0], /*new=*/0); return 0; }