// https://syzkaller.appspot.com/bug?id=a1f555065c04e89f06db42f87d926a717d02d04b // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 280 #endif #ifndef __NR_ioctl #define __NR_ioctl 29 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 208 #endif const int kInitNetNsFd = 201; static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto) { return syscall(__NR_socket, domain, type, proto); } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; *(uint32_t*)0x20000200 = 0; *(uint32_t*)0x20000204 = 5; *(uint64_t*)0x20000208 = 0x20000000; memcpy((void*)0x20000000, "\x18\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x85", 17); *(uint64_t*)0x20000210 = 0; *(uint32_t*)0x20000218 = 0; *(uint32_t*)0x2000021c = 0; *(uint64_t*)0x20000220 = 0; *(uint32_t*)0x20000228 = 0; *(uint32_t*)0x2000022c = 0; memset((void*)0x20000230, 0, 16); *(uint32_t*)0x20000240 = 0; *(uint32_t*)0x20000244 = 2; *(uint32_t*)0x20000248 = -1; *(uint32_t*)0x2000024c = 8; *(uint64_t*)0x20000250 = 0; *(uint32_t*)0x20000258 = 0; *(uint32_t*)0x2000025c = 0x10; *(uint64_t*)0x20000260 = 0; *(uint32_t*)0x20000268 = 0; *(uint32_t*)0x2000026c = 0; *(uint32_t*)0x20000270 = 0; *(uint32_t*)0x20000274 = 0; *(uint64_t*)0x20000278 = 0; *(uint64_t*)0x20000280 = 0; *(uint32_t*)0x20000288 = 0x10; *(uint32_t*)0x2000028c = 0; syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x20000200ul, /*size=*/0x90ul); res = -1; res = syz_init_net_socket(/*fam=*/0x1f, /*type=*/5, /*proto=*/2); if (res != -1) r[0] = res; memcpy((void*)0x20000000, "bpq0\000\000\000\000\000\000\000\000\000\000\000\000", 16); syscall(__NR_setsockopt, /*fd=*/-1, /*level=*/0x101, /*optname=*/0x19, /*optval=*/0x20000000ul, /*optlen=*/0x10ul); syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8914, /*arg=*/0x20000000ul); res = -1; res = syz_init_net_socket(/*domain=*/3, /*type=SOCK_SEQPACKET*/ 5, /*proto=*/0); if (res != -1) r[1] = res; memcpy((void*)0x200002c0, "bpq0\000\000\000\000\000\000\000\000\000\000\000\000", 16); syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/0x101, /*optname=*/0x19, /*optval=*/0x200002c0ul, /*optlen=*/0x10ul); return 0; }