// https://syzkaller.appspot.com/bug?id=4462682cd32aee8ff03a43c8b9be3963743bc506 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } struct csum_inet { uint32_t acc; }; static void csum_inet_init(struct csum_inet* csum) { csum->acc = 0; } static void csum_inet_update(struct csum_inet* csum, const uint8_t* data, size_t length) { if (length == 0) return; size_t i; for (i = 0; i < length - 1; i += 2) csum->acc += *(uint16_t*)&data[i]; if (length & 1) csum->acc += (uint16_t)data[length - 1]; while (csum->acc > 0xffff) csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16); } static uint16_t csum_inet_digest(struct csum_inet* csum) { return ~csum->acc; } static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } long r[88]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x2002a000, "\x2f\x64\x65\x76\x2f\x73\x67\x23\x00", 9); r[2] = syz_open_dev(0x2002a000ul, 0x0ul, 0x142ul); *(uint8_t*)0x205c3000 = (uint8_t)0x0; *(uint8_t*)0x205c3001 = (uint8_t)0x84; *(uint16_t*)0x205c3002 = (uint16_t)0x1; *(uint16_t*)0x205c3004 = (uint16_t)0x0; *(uint16_t*)0x205c3006 = (uint16_t)0x5; *(uint16_t*)0x205c3008 = (uint16_t)0x1; STORE_BY_BITMASK(uint8_t, 0x205c300a, 0x0, 0, 4); STORE_BY_BITMASK(uint8_t, 0x205c300a, 0x6, 4, 4); memcpy((void*)0x205c300b, "\xde\x57\x29", 3); *(uint16_t*)0x205c300e = (uint16_t)0x5800; *(uint8_t*)0x205c3010 = (uint8_t)0x7f; *(uint8_t*)0x205c3011 = (uint8_t)0x0; *(uint8_t*)0x205c3012 = (uint8_t)0xfe; *(uint8_t*)0x205c3013 = (uint8_t)0x80; *(uint8_t*)0x205c3014 = (uint8_t)0x0; *(uint8_t*)0x205c3015 = (uint8_t)0x0; *(uint8_t*)0x205c3016 = (uint8_t)0x0; *(uint8_t*)0x205c3017 = (uint8_t)0x0; *(uint8_t*)0x205c3018 = (uint8_t)0x0; *(uint8_t*)0x205c3019 = (uint8_t)0x0; *(uint8_t*)0x205c301a = (uint8_t)0x0; *(uint8_t*)0x205c301b = (uint8_t)0x0; *(uint8_t*)0x205c301c = (uint8_t)0x0; *(uint8_t*)0x205c301d = (uint8_t)0x0; *(uint8_t*)0x205c301e = (uint8_t)0x0; *(uint8_t*)0x205c301f = (uint8_t)0x0; *(uint8_t*)0x205c3020 = (uint8_t)0x0; *(uint8_t*)0x205c3021 = (uint8_t)0xaa; *(uint8_t*)0x205c3022 = (uint8_t)0xfe; *(uint8_t*)0x205c3023 = (uint8_t)0x80; *(uint8_t*)0x205c3024 = (uint8_t)0x0; *(uint8_t*)0x205c3025 = (uint8_t)0x0; *(uint8_t*)0x205c3026 = (uint8_t)0x0; *(uint8_t*)0x205c3027 = (uint8_t)0x0; *(uint8_t*)0x205c3028 = (uint8_t)0x0; *(uint8_t*)0x205c3029 = (uint8_t)0x0; *(uint8_t*)0x205c302a = (uint8_t)0x0; *(uint8_t*)0x205c302b = (uint8_t)0x0; *(uint8_t*)0x205c302c = (uint8_t)0x0; *(uint8_t*)0x205c302d = (uint8_t)0x0; *(uint8_t*)0x205c302e = (uint8_t)0x0; *(uint8_t*)0x205c302f = (uint8_t)0x0; *(uint8_t*)0x205c3030 = (uint8_t)0x0; *(uint8_t*)0x205c3031 = (uint8_t)0xaa; *(uint16_t*)0x205c3032 = (uint16_t)0x204e; *(uint16_t*)0x205c3034 = (uint16_t)0x204e; *(uint32_t*)0x205c3036 = (uint32_t)0x42424242; *(uint32_t*)0x205c303a = (uint32_t)0x42424242; STORE_BY_BITMASK(uint8_t, 0x205c303e, 0x0, 0, 1); STORE_BY_BITMASK(uint8_t, 0x205c303e, 0x0, 1, 3); STORE_BY_BITMASK(uint8_t, 0x205c303e, 0x16, 4, 4); *(uint8_t*)0x205c303f = (uint8_t)0x0; *(uint16_t*)0x205c3040 = (uint16_t)0x700; *(uint16_t*)0x205c3042 = (uint16_t)0x0; *(uint16_t*)0x205c3044 = (uint16_t)0x0; *(uint8_t*)0x205c3046 = (uint8_t)0x5; *(uint8_t*)0x205c3047 = (uint8_t)0x6; *(uint32_t*)0x205c3048 = (uint32_t)0x0; *(uint8_t*)0x205c304c = (uint8_t)0x5; *(uint8_t*)0x205c304d = (uint8_t)0x22; *(uint32_t*)0x205c304e = (uint32_t)0x0; *(uint32_t*)0x205c3052 = (uint32_t)0x0; *(uint32_t*)0x205c3056 = (uint32_t)0x1000000; *(uint32_t*)0x205c305a = (uint32_t)0x0; *(uint32_t*)0x205c305e = (uint32_t)0x0; *(uint32_t*)0x205c3062 = (uint32_t)0x0; *(uint32_t*)0x205c3066 = (uint32_t)0x0; *(uint32_t*)0x205c306a = (uint32_t)0x1000000; *(uint8_t*)0x205c306e = (uint8_t)0x2; *(uint8_t*)0x205c306f = (uint8_t)0x4; *(uint16_t*)0x205c3070 = (uint16_t)0xac1; *(uint8_t*)0x205c3072 = (uint8_t)0xfe; *(uint8_t*)0x205c3073 = (uint8_t)0x2; *(uint8_t*)0x205c3074 = (uint8_t)0x0; *(uint8_t*)0x205c3075 = (uint8_t)0x13; *(uint8_t*)0x205c3076 = (uint8_t)0x12; memcpy((void*)0x205c3077, "\x40\x08\x07\xe3\xee\xe9\xb1\x73\xb4\x08" "\x11\x5e\xf4\x5c\x5e\x18", 16); *(uint8_t*)0x205c3087 = (uint8_t)0x3; *(uint8_t*)0x205c3088 = (uint8_t)0x3; *(uint8_t*)0x205c3089 = (uint8_t)0x6; struct csum_inet csum_83; csum_inet_init(&csum_83); csum_inet_update(&csum_83, (const uint8_t*)0x205c3012, 16); csum_inet_update(&csum_83, (const uint8_t*)0x205c3022, 16); uint32_t csum_83_chunk_2 = 0x58000000; csum_inet_update(&csum_83, (const uint8_t*)&csum_83_chunk_2, 4); uint32_t csum_83_chunk_3 = 0x6000000; csum_inet_update(&csum_83, (const uint8_t*)&csum_83_chunk_3, 4); csum_inet_update(&csum_83, (const uint8_t*)0x205c3032, 88); *(uint16_t*)0x205c3042 = csum_inet_digest(&csum_83); r[84] = syscall(__NR_write, r[2], 0x205c3000ul, 0x8aul); *(uint64_t*)0x20764000 = (uint64_t)0x20ce2000; *(uint64_t*)0x20764008 = (uint64_t)0x4f; r[87] = syscall(__NR_readv, r[2], 0x20764000ul, 0x1ul); } int main() { loop(); return 0; }