// https://syzkaller.appspot.com/bug?id=1d42890d41dadc5071210c19d79c3c6a93b72308 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$alg arguments: [ // domain: const = 0x26 (8 bytes) // type: const = 0x5 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_alg res = syscall(__NR_socket, /*domain=*/0x26ul, /*type=*/5ul, /*proto=*/0); if (res != -1) r[0] = res; // bind$alg arguments: [ // fd: sock_alg (resource) // addr: ptr[in, sockaddr_alg] { // sockaddr_alg { // family: const = 0x26 (2 bytes) // type: buffer: {61 65 61 64 00 00 00 00 00 00 00 00 00 00} (length // 0xe) feat: af_alg_type = 0x0 (4 bytes) mask: af_alg_type = 0x0 (4 // bytes) name: buffer: {70 63 72 79 70 74 28 67 65 6e 65 72 69 63 2d // 67 63 6d 2d 61 65 73 6e 69 29 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00} (length 0x40) // } // } // addrlen: len = 0x58 (8 bytes) // ] *(uint16_t*)0x200000000040 = 0x26; memcpy((void*)0x200000000042, "aead\000\000\000\000\000\000\000\000\000\000", 14); *(uint32_t*)0x200000000050 = 0; *(uint32_t*)0x200000000054 = 0; memcpy((void*)0x200000000058, "pcrypt(generic-gcm-aesni)" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000", 64); syscall(__NR_bind, /*fd=*/r[0], /*addr=*/0x200000000040ul, /*addrlen=*/0x58ul); // socket$inet6_tcp arguments: [ // domain: const = 0xa (8 bytes) // type: const = 0x1 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_tcp6 res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0); if (res != -1) r[1] = res; // setsockopt$inet6_tcp_int arguments: [ // fd: sock_tcp6 (resource) // level: const = 0x6 (4 bytes) // optname: tcp_option_types_int = 0x13 (4 bytes) // optval: ptr[in, int32] { // int32 = 0x100000001 (4 bytes) // } // optlen: len = 0x4 (8 bytes) // ] *(uint32_t*)0x200000000000 = 1; syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/6, /*optname=TCP_THIN_LINEAR_TIMEOUTS|TCP_CORK*/ 0x13, /*optval=*/0x200000000000ul, /*optlen=*/4ul); // connect$inet6 arguments: [ // fd: sock_in6 (resource) // addr: ptr[in, sockaddr_in6] { // sockaddr_in6 { // family: const = 0xa (2 bytes) // port: int16be = 0x0 (2 bytes) // flow: int32be = 0x2 (4 bytes) // addr: union ipv6_addr { // loopback: ipv6_addr_loopback { // a0: const = 0x0 (8 bytes) // a1: const = 0x1 (8 bytes) // } // } // scope: int32 = 0x0 (4 bytes) // } // } // addrlen: len = 0x1c (8 bytes) // ] *(uint16_t*)0x200000000200 = 0xa; *(uint16_t*)0x200000000202 = htobe16(0); *(uint32_t*)0x200000000204 = htobe32(2); *(uint64_t*)0x200000000208 = htobe64(0); *(uint64_t*)0x200000000210 = htobe64(1); *(uint32_t*)0x200000000218 = 0; syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x200000000200ul, /*addrlen=*/0x1cul); // setsockopt$inet6_tcp_TCP_ULP arguments: [ // fd: sock_tcp6 (resource) // level: const = 0x6 (4 bytes) // optname: const = 0x1f (4 bytes) // optval: ptr[in, buffer] { // buffer: {74 6c 73} (length 0x3) // } // optlen: len = 0x4 (8 bytes) // ] memcpy((void*)0x2000000000c0, "tls", 3); syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/6, /*optname=*/0x1f, /*optval=*/0x2000000000c0ul, /*optlen=*/4ul); // setsockopt$inet6_tcp_TLS_TX arguments: [ // fd: sock_tcp6 (resource) // level: const = 0x11a (4 bytes) // optname: const = 0x1 (4 bytes) // optval: ptr[in, tls_crypto_info_u] { // union tls_crypto_info_u { // gcm_128: tls12_crypto_info_aes_gcm_128 { // info: tls_crypto_info[TLS_CIPHER_AES_GCM_128] { // version: tls_crypto_version = 0x303 (2 bytes) // cipher_type: const = 0x33 (2 bytes) // } // iv: buffer: {87 ee 8a c6 c4 6d ad 33} (length 0x8) // key: buffer: {26 07 08 0d 7f 4f cf 00 fd 4e f2 de ce 6c 7c 58} // (length 0x10) salt: buffer: {00 00 00 00} (length 0x4) rec_seq: // buffer: {23 00 00 00 00 00 00 00} (length 0x8) // } // } // } // optlen: len = 0x28 (8 bytes) // ] *(uint16_t*)0x200000000140 = 0x303; *(uint16_t*)0x200000000142 = 0x33; memcpy((void*)0x200000000144, "\x87\xee\x8a\xc6\xc4\x6d\xad\x33", 8); memcpy((void*)0x20000000014c, "\x26\x07\x08\x0d\x7f\x4f\xcf\x00\xfd\x4e\xf2\xde\xce\x6c\x7c\x58", 16); memset((void*)0x20000000015c, 0, 4); memcpy((void*)0x200000000160, "#\000\000\000\000\000\000\000", 8); syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/0x11a, /*optname=*/1, /*optval=*/0x200000000140ul, /*optlen=*/0x28ul); // sendmsg$inet arguments: [ // fd: sock (resource) // msg: ptr[in, msghdr_inet] { // msghdr_inet { // msg_name: nil // msg_namelen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // msg_iov: ptr[in, array[iovec[in, array[int8]]]] { // array[iovec[in, array[int8]]] { // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {19} (length 0x1) // } // len: len = 0xfdef (8 bytes) // } // } // } // msg_iovlen: len = 0x1 (8 bytes) // msg_control: nil // msg_controllen: bytesize = 0x0 (8 bytes) // msg_flags: const = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000180 = 0; *(uint32_t*)0x200000000188 = 0; *(uint64_t*)0x200000000190 = 0x2000000004c0; *(uint64_t*)0x2000000004c0 = 0x200000000400; memset((void*)0x200000000400, 25, 1); *(uint64_t*)0x2000000004c8 = 0xfdef; *(uint64_t*)0x200000000198 = 1; *(uint64_t*)0x2000000001a0 = 0; *(uint64_t*)0x2000000001a8 = 0; *(uint32_t*)0x2000000001b0 = 0; syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000180ul, /*f=*/0ul); return 0; }