// https://syzkaller.appspot.com/bug?id=d2b2c2af3a121678871fc363fca6d223fbdfe634 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // mkdir arguments: [ // path: ptr[in, buffer] { // buffer: {2e 2f 62 75 73 00} (length 0x6) // } // mode: open_mode = 0x0 (8 bytes) // ] memcpy((void*)0x200000000300, "./bus\000", 6); syscall(__NR_mkdir, /*path=*/0x200000000300ul, /*mode=*/0ul); // openat arguments: [ // fd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8) // } // flags: open_flags = 0x143142 (4 bytes) // mode: open_mode = 0x120 (2 bytes) // ] // returns fd memcpy((void*)0x200000000400, "./file1\000", 8); syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000400ul, /*flags=O_SYNC|O_NOCTTY|O_NOATIME|O_CREAT|FASYNC|0x2*/ 0x143142, /*mode=S_IRGRP|S_IRUSR*/ 0x120); // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // mode: open_mode = 0x1d0 (8 bytes) // ] memcpy((void*)0x200000000040, "./file0\000", 8); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000040ul, /*mode=S_IWGRP|S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1d0ul); // mount$overlay arguments: [ // src: const = 0x0 (8 bytes) // dst: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // type: ptr[in, buffer] { // buffer: {6f 76 65 72 6c 61 79 00} (length 0x8) // } // flags: mount_flags = 0x8 (8 bytes) // opts: ptr[in, fs_options[overlay_options]] { // fs_options[overlay_options] { // elems: array[fs_opt_elem[overlay_options]] { // fs_opt_elem[overlay_options] { // elem: union overlay_options { // upperdir: fs_opt["upperdir", stringnoz[filename]] { // name: buffer: {75 70 70 65 72 64 69 72} (length 0x8) // eq: const = 0x3d (1 bytes) // val: buffer: {2e 2f 66 69 6c 65 30} (length 0x7) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[overlay_options] { // elem: union overlay_options { // lowerdir: fs_opt["lowerdir", stringnoz[filename]] { // name: buffer: {6c 6f 77 65 72 64 69 72} (length 0x8) // eq: const = 0x3d (1 bytes) // val: buffer: {2e} (length 0x1) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[overlay_options] { // elem: union overlay_options { // workdir: fs_opt["workdir", stringnoz[filename]] { // name: buffer: {77 6f 72 6b 64 69 72} (length 0x7) // eq: const = 0x3d (1 bytes) // val: buffer: {2e 2f 62 75 73} (length 0x5) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[overlay_options] { // elem: union overlay_options { // metacopy_on: buffer: {6d 65 74 61 63 6f 70 79 3d 6f 6e} // (length 0xb) // } // comma: const = 0x2c (1 bytes) // } // } // common: array[fs_opt_elem[fs_options_common]] { // } // null: const = 0x0 (1 bytes) // } // } // ] memcpy((void*)0x200000000100, "./file0\000", 8); memcpy((void*)0x200000000000, "overlay\000", 8); memcpy((void*)0x200000000080, "upperdir", 8); *(uint8_t*)0x200000000088 = 0x3d; memcpy((void*)0x200000000089, "./file0", 7); *(uint8_t*)0x200000000090 = 0x2c; memcpy((void*)0x200000000091, "lowerdir", 8); *(uint8_t*)0x200000000099 = 0x3d; memset((void*)0x20000000009a, 46, 1); *(uint8_t*)0x20000000009b = 0x2c; memcpy((void*)0x20000000009c, "workdir", 7); *(uint8_t*)0x2000000000a3 = 0x3d; memcpy((void*)0x2000000000a4, "./bus", 5); *(uint8_t*)0x2000000000a9 = 0x2c; memcpy((void*)0x2000000000aa, "metacopy=on", 11); *(uint8_t*)0x2000000000b5 = 0x2c; *(uint8_t*)0x2000000000b6 = 0; syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000100ul, /*type=*/0x200000000000ul, /*flags=MS_NOEXEC*/ 8ul, /*opts=*/0x200000000080ul); // mount$incfs arguments: [ // src: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // dst: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // type: ptr[in, buffer] { // buffer: {69 6e 63 72 65 6d 65 6e 74 61 6c 2d 66 73 00} (length 0xf) // } // flags: mount_flags = 0x0 (8 bytes) // opts: nil // ] memcpy((void*)0x200000000080, "./file0\000", 8); memcpy((void*)0x200000000040, "./file0\000", 8); memcpy((void*)0x200000000140, "incremental-fs\000", 15); syscall(__NR_mount, /*src=*/0x200000000080ul, /*dst=*/0x200000000040ul, /*type=*/0x200000000140ul, /*flags=*/0ul, /*opts=*/0ul); // linkat arguments: [ // oldfd: fd_dir (resource) // old: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 31 00} (length 0xe) // } // newfd: fd_dir (resource) // new: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 32 00} (length 0xe) // } // flags: linkat_flags = 0x1000 (8 bytes) // ] memcpy((void*)0x2000000001c0, "./file0/file1\000", 14); memcpy((void*)0x2000000003c0, "./file0/file2\000", 14); syscall(__NR_linkat, /*oldfd=*/0xffffff9c, /*old=*/0x2000000001c0ul, /*newfd=*/0xffffff9c, /*new=*/0x2000000003c0ul, /*flags=AT_EMPTY_PATH*/ 0x1000ul); // lstat arguments: [ // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 32 00} (length 0xe) // } // statbuf: nil // ] memcpy((void*)0x2000000006c0, "./file0/file2\000", 14); syscall(__NR_lstat, /*file=*/0x2000000006c0ul, /*statbuf=*/0ul); return 0; }