// https://syzkaller.appspot.com/bug?id=13cf04ffc8a1fba13da7699f6040d12bdbe68d27 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } *(uint32_t*)0x2000e000 = 0x10; *(uint32_t*)0x2000e004 = 4; *(uint64_t*)0x2000e008 = 0x20000040; memcpy((void*)0x20000040, "\xb4\x00\x00\x00\x00\x00\x00\x00\x79\x10\x48\x00\x00\x00\x00\x00\x61" "\x04\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00", 28); *(uint64_t*)0x2000e010 = 0x20003ff6; memcpy((void*)0x20003ff6, "GPL\000", 4); *(uint32_t*)0x2000e018 = 2; *(uint32_t*)0x2000e01c = 0xfd90; *(uint64_t*)0x2000e020 = 0x2000cf3d; *(uint32_t*)0x2000e028 = 0; *(uint32_t*)0x2000e02c = 0; memset((void*)0x2000e030, 0, 16); *(uint32_t*)0x2000e040 = 0; *(uint32_t*)0x2000e044 = 0; *(uint32_t*)0x2000e048 = -1; *(uint32_t*)0x2000e04c = 8; *(uint64_t*)0x2000e050 = 0; *(uint32_t*)0x2000e058 = 0; *(uint32_t*)0x2000e05c = 0x10; *(uint64_t*)0x2000e060 = 0; *(uint32_t*)0x2000e068 = 0; *(uint32_t*)0x2000e06c = 0; *(uint32_t*)0x2000e070 = -1; *(uint32_t*)0x2000e074 = 0; *(uint64_t*)0x2000e078 = 0; *(uint64_t*)0x2000e080 = 0; *(uint32_t*)0x2000e088 = 0x10; *(uint32_t*)0x2000e08c = 0; *(uint32_t*)0x2000e090 = 0; res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x2000e000ul, /*size=*/0x48ul); if (res != -1) r[0] = res; syscall(__NR_close, /*fd=*/r[0]); res = syscall(__NR_socket, /*domain=AF_VSOCK*/ 0x28ul, /*type=SOCK_SEQPACKET*/ 5ul, /*proto=*/0); if (res != -1) r[1] = res; *(uint16_t*)0x20000080 = 0x28; *(uint16_t*)0x20000082 = 0; *(uint32_t*)0x20000084 = 0; *(uint32_t*)0x20000088 = -1; *(uint32_t*)0x2000008c = 0; syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x20000080ul, /*addrlen=*/0x10ul); memcpy((void*)0x200005c0, "\x0f\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x12", 13); res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200005c0ul, /*size=*/0x48ul); if (res != -1) r[2] = res; *(uint32_t*)0x200000c0 = r[2]; *(uint64_t*)0x200000c8 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint64_t*)0x200000d0 = 0x20000080; *(uint32_t*)0x20000080 = r[0]; *(uint64_t*)0x200000d8 = 0; syscall(__NR_bpf, /*cmd=*/2ul, /*arg=*/0x200000c0ul, /*size=*/0x20ul); *(uint16_t*)0x200001c0 = 0x28; *(uint16_t*)0x200001c2 = 0; *(uint32_t*)0x200001c4 = 0x2711; *(uint32_t*)0x200001c8 = 2; *(uint32_t*)0x200001cc = 0; syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x200001c0ul, /*addrlen=*/0x10ul); *(uint64_t*)0x200061c0 = 0; *(uint32_t*)0x200061c8 = 0; *(uint64_t*)0x200061d0 = 0; *(uint64_t*)0x200061d8 = 0; *(uint64_t*)0x200061e0 = 0; *(uint64_t*)0x200061e8 = 0; *(uint32_t*)0x200061f0 = 0; *(uint32_t*)0x200061f8 = 0x62dc; syscall(__NR_recvmmsg, /*fd=*/r[1], /*mmsg=*/0x200061c0ul, /*vlen=*/1ul, /*f=MSG_ERRQUEUE*/ 0x2000ul, /*timeout=*/0ul); return 0; }