// https://syzkaller.appspot.com/bug?id=8593724cce469c9898b7fbc49f48f4943fee940f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; *(uint32_t*)0x20caefb8 = 8; *(uint32_t*)0x20caefbc = 3; *(uint64_t*)0x20caefc0 = 0x20000dc0; memcpy( (void*)0x20000dc0, "\x85\x00\x00\x00\x4f\x00\x00\x00\x54\x00\x00\x00\x00\x00\x00\x00\x95\x00" "\x00\x00\x00\x00\x00\x00\xef\x02\x85\xb7\x3e\xae\x79\x5b\x05\xad\x26\x17" "\x77\xdb\x75\x18\x6b\xaf\x0b\x27\x92\xad\x03\xf2\x04\x72\x66\x21\x81\xfe" "\x04\x60\x96\xc5\xdf\x69\x63\x34\xe2\xd8\x36\x39\x55\x60\x23\x05\x00\xef" "\x28\x6f\x21\xc9\x74\xd5\x20\xc2\x47\xfd\x20\x08\x51\xf9\x0b\x2d\xd5\xe5" "\xf6\xb2\x39\x09\xa2\x3e\xe2\x70\x07\xda\xe2\xa0\xfd\xf9\x28\x09\xa9\x31" "\x19\x6d\xf3\xbe\x84\x78\x1f\x7e\xca\xfa\xf3\x3a\xcf\x7e\x01\xa2\x39\x99" "\xfd\xfb\x4b\x49\x0f\x6c\xfe\x5e\xdf\x38\x40\x57\x6a\xcb\x26\x2e\x0d\xe2" "\xb8\xe2\x88\xa8\x5d\xfe\x7c\x79\xe9\x69\xb7\x38\xdb\xc6\x11\x71\xdf\xd8" "\xf5\xe3\x3f\xbf\x1e\xe0\x5b\xc5\xbd\xeb\x16\x4d\xc2\x05\x84\x55\xe3\xba" "\x43\x8c\x91\x09\xdd\x00\x1a\xd9\x3d\xf3\xfc\x23\x5b\xed\x50\xff\xce\x5e" "\xa7\x9c\xfc\x80\xf7\xd5\x3a\xe5\x16\x91\x36\x2b\xa2\x13\x94\xbd\x61\x4e" "\xc4\x1f\x63\x6e\xc0\xe2\x99\xe3\x70\xf5\x63\x1a\xcf\xab\x5a\x65\x19\xa3" "\x6f\x96\x36\x79\x45\x72\x41\xbc\x21\xec\xdd\x1e\xe2\xb9\xb7\xae\x31\x5e" "\x5b\x51\x5c\x71\xc3\x9b\xf4\xb4\x5f\x5e\x3f\x7c\xd3\xf6\x40\x4f\xc9\x3c" "\xf5\x51\x49\xf0\xc3\xa7\xb8\x7f\x86\x12\x01\x53\x72\x57\x84\xe9\x89\x75" "\xe8\x61\x7f\xfc\x7e\x8c\xc4\x97\xf4\x37\x89\xf5\x20\x8f\xd8\x4f\x2b\x34" "\xf7\x85\x3d\x9c\x52\x84\x8d\xd1\x7c\x57\x96\xb3\xcd\xf2\x52\x7d\x79\x29" "\x63\x1c\xca\x05\xe2\x7c\x28\x56\x6d\x2c\x47\x69\x9b\xc6\xc3\xf5\xf7\x66" "\xc3\xcb\x8c\xd6\xa4\xa4\x46\x93\x68\x95\xdc\x5b\x44\xd2\x24\xa0\xb3\xc2" "\xca\x80\x87\x48\x6a\xea\xd1\xd0\x34\xd9\x88\x32\xad\x67\x7b\x28\xb1\x0e" "\xd5\x8f\x8d\xe2\xd5\xae\x49\xba\x35\xbe\x16\x88\x8e\xa8\xda\x9b\xf3\x3f" "\x91\xa6\xc5\x05\x6a\xf1\x35\xb5\x3e\x19\x1b\x0d\xee\x15\xf0\xd8\xab\x12" "\xab\xc0\x4e\xed\xfe\xb6\x53\x55\x40\x09\x00\x00\x00\x00\x00\x00\x00\xb4" "\x71\x71\x07\xbf\x56\x4a\x23\x50\x56\x4f\x5e\xf2\xbb\x8e\x92\x74\xd5\xd4" "\x0a\xf1\x9b\x0a\xfe\x0c\x77\x4b\x56\x23\x78\xfc\x3d\xbf\x8b\xe4\x28\x28" "\xb4\xcb\x3d\x6c\xf6\x93\x0f\x5c\x4c\x71\x56\x3e\x4e\xb0\xd3\x41\xdc\x74" "\x2b\x00\x80\x2b\x49\x8f\xef\x84\x90\xb5\x2a\xd1\x10\x85\xce\x4a\x02\x8c" "\x7a\xf4\x67\x74\xb3\x91\xe2\x12\x4f\xcd\x93\xff\x05\xff\x1a\xd0\xda\x38" "\x4f\xf0\x80\x17\x34\xc5\x8a\xad\x0e\xba\x11\xe3\xe8\x17\xc3\xb6\x51\xbb" "\x99\x09\x01\x89\xee\x00\x01\x2f\x89\xe6\xb5\xca\x8e\x62\xa5\xf5\xff\x0d" "\xc6\xed\x83\x39\x2f\xd5\x51\xd0\xee\xdc\x49\x60\x37\xc1\xde\x1b\x3d\xf8" "\x35\x09\xd2\xfa\x10\x23\xeb\x77\xb8\xa1\x3d\xe0\x9e\x22\xa7\xf1\x90\x88" "\xbc\xbd\x8f\x47\xad\x5a\x96\x4a\xb6\xbb\xb9\x47\x84\xd3\x1b\x39\x72\x29" "\xae\x3f\xb6\x6f\xfe\x0e\x99\x13\xd3\x23\x01\xc8\x44\xe5\x8f\x00\x00\x96" "\xf5\x76\x6d\xc1\xca\x5e\x8c\xfe\xe3\x32\xa2\x88\x09\x00\x00\x00\x80\x00" "\x00\x00\x00\xcb\x88\x18\x6b\xcd\x36\xa2\xec\xce\x33\xa3\x04\x8f\x6f\x97" "\xe1\x4d\xac\x56\xe8\x4a\xba\x0b\xde\xe2\xbc\xd2\x11\x32\x63\x29\x05\xc0" "\x60\xb3\xac\xa1\xd4\x44\x6f\x45\x6e\x20\x88\xe7\x25\x7d\x57\x5e\x84\x65" "\xd7\xed\x76\x7e\x41\x5a\x82\x6d\x14\x58\xa3\x2e\x90\x4a\x1f\xfa\xf0\x90" "\xc2\x88\x4d\x4a\x56\x95\x8a\xb1\x43\xcd\xb9\x5b\x6c\x39\xe0\x40\x10\xb8" "\x88\xbd\x95\xb0\x9d\x50\xd7\xe6\xc5\xc0\x84\xaa\x8c\xdc\x21\x89\x0b\x00" "\x01\x35\xd2\x8f\x97\x7a\xb4\x36\x70\x41\x2a\xfe\x83\x61\xb6\x0b\xf3\x70" "\x58\xfd\xf9\xcd\xf2\x2d\x8d\xa0\xf2\xd1\xcc\x81\x3c\xad\x61\x01\x1e\x30" "\x60\xba\xdb\xe3\x96\xb3\xfb\x92\x8c\x05\x00\x00\x00\x00\x00\x00\x00\x77" "\x0e\x11\xc5\x04\x35\x35\x69\x62\x89\xb2\x27\xc6\xb3\x13\xe2\x85\x2c\x52" "\xf9\x97\x5c\xd1\x24\x77\x1b\xef\x02\xf4\x31\xaf\xe5\x0e\x00\x00\xdf\x13" "\xec\x1a\x2b\xa3\xe4\xbc\x72\x85\xba\xe2\xb9\x89\x55\xa3\x0d\xcc\x99\xae" "\x25\xa5\x68\x98\xb9\x54\x24\xc2\x0d\xfe\x77\xc3\x40\x00\x00\x00\x73\x83" "\x0d\x7d\xeb\x2a\xea\x80\x97\x2c\xf5\xa7\xba\x03\x47\xa4\xa7\xb9\xff\x7c" "\x1d\x17\xce\x2d\xec\x87\xfe\x99\x22\xaa\x04\xcf\x47\x00\x25\x15\xc3\x6a" "\xc6\x46\xda\x67\x83\x13\x5f\x5d\xe5\x33\x54\xea\x5e\x16\x0d\x07\x03\xb3" "\xd6\x41\x2e\x5f\x3c\xe9\xc4\xa4\x3b\x9b\xc1\x9e\xde\xa4\xbf\x8f\x4f\x3f" "\x33\xb8\x02\x42\xaa\xab\xec\x9a\x82\x84\x1a\xaf\x13\x28\x76\xd3\x66\xa1" "\x45\xec\x41\x61\xe7\xc4\x5c\x39\x7a\x1a\xa7\xa1\x12\x6f\x6b\xc9\xf5\x5b" "\x33\xa0\x0c\x54\x20\x83\xc2\x23\x08\xb7\xeb\x04\xe4\xc9\x69\x08\x4c\x65" "\xa1\x5c\xdf\xdf\xc5\x4b\x1b\xd9\x82\x59\x22\xc5\x5a\x2c\x08\xa7\x38\x0b" "\x75\x40\xe5\xe2\xa5\x84\xf3\xbc\x6c\x54\x97\xca\xe5\xd4\x3d\xa0\x3c\xcc" "\xf1\x36\xa8\x25\xe8\xbc\x94\x16\xc1\xe3\x8f\x32\x19\x70\xec\xca\x2b\x48" "\x1c\x91\x9c\x87\xc2\x26\x1b\x89\x6f\x73\x9e\xa9\xd4\xc4\xb8\x69\x47\xb6" "\xcc\xb0\xb0\x2c\x70\x00\xbb\x65\x72\x08\x94\x90\xdf\x75\xb1\xa2\xee\x38" "\xc2\x77\x7a\x6a\x4e\x1e\x97\x78\xa1\x41\x02\x1f\x07\xbd\xcb\x3d\x5e\x5a" "\xee\x51\x39\xda\xf6\x19\xae\x84\xa7\x9f\xcf\x6b\x55\xff\x21\x1a\x58\xaf" "\x84\xff\xa9\xfb\x85\x11\xb3\xfe\x74\x13\x13\x2c\xc1\x75\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\xe5\xe6\x9e" "\x6d\x5c\xa2\xab\x36\x01\x2f\xd1\x8f\x46\xde\x6c\x2b\xf0\xaa\x04\x1a\x54" "\x02\x6a\x2d\x3a\xd8\x2b\xf8\x9b\x40\x2b\xd6\xf5\x0d\x97\x79\xb4\x27\x9d" "\x83\x01\xb6\x26\xa1\xa2\x45\x1f\x6e\x1f\x36\x72\xe1\x52\x4e\x79\xbf\x79" "\x48\xf9\xb4\xa7\xc1\x6a\xd3\x06\x42\xaa\xdb\x84\xfd\x7b\x38\x05\xdd\x38" "\xf3\x2e\x74\xff\x4a\x55\x55\x4f\xa8\xf5\x22\xdc\x7b\xa3\x9d\x20\x34\xab" "\x05\x7f\x8e\x0b\x6b\x9d\x68\x0c\xf7\x75\x01\x4a\xe2\xc8\x60\x3b\x36\xd1" "\x4d\x55\x7b\x9c\x40\x86\x9d\x6b\x7d\x8b\x46\x94\x34\x58\xfe\x0d\xac\xef" "\xb8\x75\xb8\x0b\x5e\xe2\x41\x1f\x28\x5b\xb5\x32\x74\x9a\xa0\x50\x3c\x6e" "\x30\x21\x01\x2e\x1b\x9e\x4d\xae\xe9\x36\x8c\x2b\x9f\x0c\x6b\x4c\xdd\xce" "\xd6\xe6\x65\xa7\x18\x30\xf5\x82\xf6\xcc\x2b\x25\x81\x80\x82\xe3\x7b\x36" "\x4b\x1b\x11\x13\xef\x8f\xdd\x14\x61\xa2\xaf\xd8\xc7\x52\xaa\x11\x6c\xf7" "\xd9\x93\x4b\xe7\x26\x8a\x2f\xb8\x9b\x16\xe5\x90\x0e\xb8\x2d\xcf\x4c\xf3" "\x00\x00\x00\x00\xa4\xcd\x11\x1a\x89\x8d\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x9c\x82\x04\x9f\x39\x0c\xb8\xb5\x00\x3c\x08" "\x93\x57\xaa\xe8\x0a\xea\xa2\x09\xde\x7a\x94\xe8\xdd\xcd\x36\x58\x06\x73" "\xc7\x4f\xd7\x81\x54\xe3\x14\xa5\x22\xbb\x2d\xd1\x91\xce\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00", 1495); *(uint64_t*)0x20caefc8 = 0x20281ffc; memcpy((void*)0x20281ffc, "GPL\000", 4); *(uint32_t*)0x20caefd0 = 0; *(uint32_t*)0x20caefd4 = 0; *(uint64_t*)0x20caefd8 = 0; *(uint32_t*)0x20caefe0 = 0; *(uint32_t*)0x20caefe4 = 0; memset((void*)0x20caefe8, 0, 16); *(uint32_t*)0x20caeff8 = 0; *(uint32_t*)0x20caeffc = 0; *(uint32_t*)0x20caf000 = -1; *(uint32_t*)0x20caf004 = 8; *(uint64_t*)0x20caf008 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20caf010 = 0x185; *(uint32_t*)0x20caf014 = 0x10; *(uint64_t*)0x20caf018 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x20caf020 = 0; *(uint32_t*)0x20caf024 = 0; *(uint32_t*)0x20caf028 = -1; *(uint32_t*)0x20caf02c = 0; *(uint64_t*)0x20caf030 = 0; res = syscall(__NR_bpf, 5ul, 0x20caefb8ul, 0x48ul); if (res != -1) r[0] = res; *(uint32_t*)0x20000180 = r[0]; *(uint32_t*)0x20000184 = 0; *(uint32_t*)0x20000188 = 0x81; *(uint32_t*)0x2000018c = -1; *(uint64_t*)0x20000190 = 0x20000200; memcpy((void*)0x20000200, "\x5c\x71\xf9\x05\xca\xc4\x13\x55\x1b\x2a\xc0\x6c\x08\x00", 14); *(uint64_t*)0x20000198 = 0; *(uint32_t*)0x200001a0 = 0x4000; *(uint32_t*)0x200001a4 = 0; *(uint32_t*)0x200001a8 = 0; *(uint32_t*)0x200001ac = 0; *(uint64_t*)0x200001b0 = 0x20000000; *(uint64_t*)0x200001b8 = 0x20000000; *(uint32_t*)0x200001c0 = 0; *(uint32_t*)0x200001c4 = 0; syscall(__NR_bpf, 0xaul, 0x20000180ul, 0x28ul); return 0; }