// https://syzkaller.appspot.com/bug?id=7ef63c67437650b80e78a4da4bd1d4b3d1fa8bc9 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #ifndef SYS_semctl #define SYS_semctl 295 #endif static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) #define __syscall syscall uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul); install_segv_handler(); intptr_t res = 0; res = syscall(SYS_socket, 2ul, 1ul, 0); if (res != -1) r[0] = res; res = syscall(SYS_fcntl, r[0], 0ul, r[0]); if (res != -1) r[1] = res; NONFAILING(*(uint32_t*)0x20000400 = 4); syscall(SYS_semctl, 0, 3ul, 8ul, 0x20000400ul); NONFAILING(*(uint64_t*)0x20000800 = 0); NONFAILING(*(uint32_t*)0x20000808 = 0); NONFAILING(*(uint64_t*)0x20000810 = 0); NONFAILING(*(uint64_t*)0x20000818 = 0); NONFAILING(*(uint64_t*)0x20000820 = 0x200007c0); NONFAILING(*(uint64_t*)0x200007c0 = 0x20); NONFAILING(*(uint32_t*)0x200007c8 = 0xffff); NONFAILING(*(uint32_t*)0x200007cc = 0); NONFAILING(*(uint32_t*)0x200007d0 = 0); NONFAILING(*(uint32_t*)0x200007d4 = 0); NONFAILING(*(uint32_t*)0x200007d8 = 0); NONFAILING(*(uint64_t*)0x200007e0 = 0x20); NONFAILING(*(uint32_t*)0x200007e8 = 0xffff); NONFAILING(*(uint32_t*)0x200007ec = 0); NONFAILING(*(uint32_t*)0x200007f0 = 0); NONFAILING(*(uint32_t*)0x200007f4 = 0); NONFAILING(*(uint32_t*)0x200007f8 = 0); NONFAILING(*(uint64_t*)0x20000828 = 0x40); NONFAILING(*(uint32_t*)0x20000830 = 2); syscall(SYS_sendmsg, r[1], 0x20000800ul, 0x402ul); return 0; }