// https://syzkaller.appspot.com/bug?id=f6df022ea41f34236a5681182603ccb1b0e95c84 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bind #define __NR_bind 200 #endif #ifndef __NR_bpf #define __NR_bpf 280 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_sendto #define __NR_sendto 206 #endif #ifndef __NR_socket #define __NR_socket 198 #endif uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 2ul, 1ul, 0); if (res != -1) r[0] = res; *(uint16_t*)0x20000000 = 2; *(uint16_t*)0x20000002 = htobe16(0x4e20); *(uint32_t*)0x20000004 = htobe32(0xe0000001); syscall(__NR_bind, r[0], 0x20000000ul, 0x10ul); *(uint16_t*)0x200018c0 = 2; *(uint16_t*)0x200018c2 = htobe16(0x4e20); *(uint32_t*)0x200018c4 = htobe32(0); syscall(__NR_sendto, r[0], 0ul, 0ul, 0x20020094ul, 0x200018c0ul, 0x10ul); *(uint32_t*)0x2000e000 = 0xe; *(uint32_t*)0x2000e004 = 4; *(uint64_t*)0x2000e008 = 0x20000600; memcpy( (void*)0x20000600, "\xb4\x05\x00\x00\x20\x00\x80\x00\x61\x10\x00\x00\x00\x00\x00\x00\xc6\x00" "\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x9f\x33\xef\x60" "\x91\x6e\x6e\x89\x3f\x1e\xeb\x0b\xe2\x56\x6c\xd0\x72\x30\x43\xc4\x7c\x89" "\x6c\xe0\xbc\xe6\x6a\x24\x5a\xd9\x9b\x81\x7f\xd9\x8c\xd8\x24\x49\x89\x49" "\x71\x4f\xfa\xac\x8a\x6f\x77\xef\x26\xdc\xca\x55\x82\x05\x4d\x54\xd5\x3c" "\xd2\xb6\xdb\x71\x4e\x4b\x94\xbd\xae\x21\x4f\xa6\x8a\x05\x57\xeb\x2c\x5c" "\xa6\x83\xa4\xb6\xfc\x89\x39\x8f\x2b\x90\x00\xf2\x24\xd4\x42\x01\x7c\xfa" "\x6f\xa2\x6f\xa7\xa3\x47\x00\x45\x8c\x60\x89\x7d\x4a\x61\x48\xa1\xc1\x14" "\x28\x60\x7c\x40\xde\x60\xbe\xac\x67\x1e\x8e\x8f\xde\xcb\x03\x58\x8a\xa6" "\x23\xfa\x71\xf8\x71\xab\x5c\x2f\xf8\x8a\xfc\x60\x02\x08\x4e\x5b\x52\x71" "\x0a\xee\xe8\x35\xcf\x0d\x78\xe4\x5f\x70\x98\x38\x26\xfb\x85\x79\xc1\xfb" "\x01\xd2\xc5\x55\x3d\x2c\xcb\x5f\xc5\xb5\x1f\xe6\xb1\x74\xeb\xd9\x90\x7d" "\xcf\xf4\x14\xed\x55\xb0\xc2\x0c\xdb\xe7\x00\x9a\x6f\xe7\xcc\x78\x76\x2f" "\x1d\x4d\xcd\xbc\xa6\x49\x20\xdb\x9a\x50\xf8\x6c\x21\x63\x2f\xd3\x0b\xf0" "\x51\x21\x43\x8b\xb7\x4e\x46\x70\xab\x5d\xfe\x44\x7a\x4b\xd3\x44\xe0\xbd" "\x74\xff\x05\xd3\x7e\xf6\x8e\x3b\x9d\xb8\x63\xc7\x58\xff\xff\xff\xff\xab" "\xe9\x0a\xc5\xd0\x8d\xd9\xd4\xe2\x35\x9c\x41\xcf\xb4\x26\xe1\x23\x0b\xc1" "\xcd\x4c\x02\xc4\x60\xce\xb4\x42\x76\xe9\xbd\x94\xd1\xc2\xe6\xd1\x7d\xc5" "\xc2\xed\xf3\x32\xa6\x2f\x5f\xe6\x8f\xbb\xbb\xfc\xfd\x78\xa9\xf3\xfd\xc1" "\xf5\x0c\x44\x5e\x3f\x30\xe7\x03\xcf\x05\xb9\x0f\xbf\x94\x0e\x66\x52\xd3" "\x77\x47\x4e\xd5\xf8\x16\xf6\x6a\xc3\x02\x74\x60\xae\x99\x1e\x7f\x83\xcd" "\xd7\xa7\xfc\x2a\x70\x03\xd1\xa6\xcf\x54\x78\x53\x35\x84\x96\x1c\x32\x9f" "\xcf\x4f\xed\x5c\x94\x55\x64\x0d\xcd\x28\x27\x3d\x79\x11\x3f\x29\x15\xa3" "\x03\x9c\x9a\x78\xf6\x3b\x8e\xc7\x5e\x38\x2d\x27\xfe\xd7\xd6\x7c\x44\x0e" "\x23\xd1\x30\xe5\x1e\xea\x1e\x08\x5b\xeb\xab\xe7\x05\x9d\xe9\xcb\xfc\x51" "\x17\xc0\x24\x18\x5a\x06\x2a\xcb\x6b\x8e\xec\x31\xc2\x1b\x3a\xf8\xb9\xee" "\xdb\x46\x60\xed\x2d\xef\x7a\xcf\x2a\x33\xa3\x76\xa5\xcb\x7d\x42\x66\xd5" "\xb0\xbe\x14\x48\x8d\x14\xb4\x73\x50\x24\x86\xaf\x8d\xd6\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 510); *(uint64_t*)0x2000e010 = 0x20003ff6; memcpy((void*)0x20003ff6, "GPL\000", 4); *(uint32_t*)0x2000e018 = 4; *(uint32_t*)0x2000e01c = 0xfd90; *(uint64_t*)0x2000e020 = 0x2000cf3d; *(uint32_t*)0x2000e028 = 0; *(uint32_t*)0x2000e02c = 0; memset((void*)0x2000e030, 0, 16); *(uint32_t*)0x2000e040 = 0; *(uint32_t*)0x2000e044 = 0; *(uint32_t*)0x2000e048 = -1; *(uint32_t*)0x2000e04c = 8; *(uint64_t*)0x2000e050 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x2000e058 = 0x366; *(uint32_t*)0x2000e05c = 0x10; *(uint64_t*)0x2000e060 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x2000e068 = 0x1dd; *(uint32_t*)0x2000e06c = 0; *(uint32_t*)0x2000e070 = -1; *(uint32_t*)0x2000e074 = 0; *(uint64_t*)0x2000e078 = 0; res = syscall(__NR_bpf, 5ul, 0x2000e000ul, 0x48ul); if (res != -1) r[1] = res; *(uint32_t*)0x20000400 = 0xf; *(uint32_t*)0x20000404 = 4; *(uint32_t*)0x20000408 = 4; *(uint32_t*)0x2000040c = 0x12; *(uint32_t*)0x20000410 = 0; *(uint32_t*)0x20000414 = -1; *(uint32_t*)0x20000418 = 0; memset((void*)0x2000041c, 0, 16); *(uint32_t*)0x2000042c = 0; *(uint32_t*)0x20000430 = -1; *(uint32_t*)0x20000434 = 0; *(uint32_t*)0x20000438 = 0; *(uint32_t*)0x2000043c = 0; *(uint64_t*)0x20000440 = 0; res = syscall(__NR_bpf, 0ul, 0x20000400ul, 0x48ul); if (res != -1) r[2] = res; *(uint32_t*)0x20000080 = r[2]; *(uint32_t*)0x20000084 = r[1]; *(uint32_t*)0x20000088 = 5; *(uint32_t*)0x2000008c = 0; syscall(__NR_bpf, 8ul, 0x20000080ul, 0x10ul); *(uint32_t*)0x20000280 = r[2]; *(uint64_t*)0x20000288 = 0x20000340; *(uint64_t*)0x20000290 = 0x20000040; *(uint32_t*)0x20000040 = r[0]; *(uint64_t*)0x20000298 = 0; syscall(__NR_bpf, 2ul, 0x20000280ul, 0x20ul); memset((void*)0x20000200, 43, 1); syscall(__NR_sendto, r[0], 0x20000200ul, 1ul, 0ul, 0ul, 0x146282ul); return 0; }