// https://syzkaller.appspot.com/bug?id=d71f28b21dad3419f79cf010f30167620cb0cfff // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } *(uint64_t*)0x20000040 = 0; *(uint64_t*)0x20000048 = 0x200014c0; *(uint32_t*)0x20000050 = 0; *(uint32_t*)0x20000054 = 0xffe; *(uint32_t*)0x20000058 = 0; *(uint32_t*)0x2000005c = 0; syscall(__NR_bpf, /*cmd=*/0x12ul, /*arg=*/0x20000040ul, /*size=*/0x20ul); memcpy((void*)0x20000080, "cpuset.memory_pressure\000", 23); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000080ul, /*flags=*/0x26e1ul, /*mode=*/0ul); if (res != -1) r[0] = res; *(uint64_t*)0x20000040 = 0; syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x4030582a, /*period=*/0x20000040ul); syscall(__NR_perf_event_open, /*attr=*/0ul, /*pid=*/0, /*cpu=*/-1, /*group=*/-1, /*flags=*/0ul); syscall(__NR_write, /*fd=*/-1, /*buf=*/0ul, /*len=*/0ul); syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0ul, /*flags=*/0x100002ul, /*mode=*/0ul); *(uint32_t*)0x200054c0 = 0xe; *(uint32_t*)0x200054c4 = 0x16; *(uint64_t*)0x200054c8 = 0x20000940; memcpy( (void*)0x20000940, "\x61\x15\x88\x00\x00\x00\x00\x00\x61\x13\x50\x00\x00\x00\x00\x00\xbf\xa0" "\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\xee\x00\x16\x05\x5e\x03\x01\x00" "\x00\x00\x00\x00\x64\x05\x00\x00\x00\x00\x00\x00\x69\x16\x3e\x00\x00\x00" "\x00\x00\xbf\x07\x00\x00\x00\x00\x00\x00\x26\x05\x07\x00\x0f\xff\x07\x20" "\x67\x06\x00\x00\x20\x00\x00\x00\x04\x06\x00\x00\x0e\xe6\x00\x60\xbf\x50" "\x00\x00\x00\x00\x00\x00\x2f\x65\x00\x00\x00\x00\x00\x00\x65\x07\xf9\xff" "\x01\x00\x00\x00\x07\x07\x00\x00\xcd\xdf\xff\xff\x1e\x75\x00\x00\x00\x00" "\x00\x00\xbf\x54\x00\x00\x00\x00\x00\x00\x07\x04\x00\x00\x04\x00\xf9\xff" "\xad\x43\x01\x00\x00\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x15\x00" "\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x32\xed\x3c\x12" "\xdc\x8c\x27\xdf\x8e\xcf\x26\x4e\x0f\x84\xf9\xf1\x7d\x3c\x30\xe3\x2f\x17" "\x54\x55\x8f\x22\x78\xaf\x6d\x71\xd7\x9a\x5e\x12\x81\x4c\xb1\xd8\xa5\xd4" "\x60\x1d\x29\x5c\x45\xa6\xa0\xb9\xbd\xb7\xdd\x39\x97\xf9\xc9\xc4\xf6\xf3" "\xbe\x4b\x36\x92\x89\xaa\x68\x12\xb8\xe0\x07\xe7\x33\xa9\xa4\xf1\xb0\xaf" "\x3d\xda\x82\xee\x45\xa0\x10\xfb\x94\xfe\x9d\xe5\x7b\x9d\x8a\x81\x42\x61" "\xbd\xb9\x4a\x05\x00\x20\x00\xc6\xc6\x0b\xf7\x0d\x74\x2a\x81\x76\x2b\xab" "\x83\x95\xfa\x64\x81\x0b\x5b\x40\xd8\x93\xea\x8f\xe0\x18\x54\x73\xd5\x1b" "\x54\x6c\xad\x3f\x1d\x5a\xce\x06\x00\x00\x6e\x7c\x95\x5c\xce\xfa\x1f\x6a" "\xb6\x89\xb5\x55\x20\x2d\xa2\xe0\xec\x28\x71\xb4\xa7\xe6\x58\x36\x42\x9a" "\x52\x7d\xc4\x7e\xbe\x84\xa4\x23\xb6\xc8\xd3\x45\xdc\x0d\xa3\x08\x5b\x0a" "\xb7\x1c\xa1\xb9\x01\x62\x7b\x56\x2e\xd0\x4a\xe7\x60\x02\xd4\x51\x9a\xf6" "\x19\xe3\xcc\xa4\xd6\x9e\x0d\xee\x5e\xb1\x06\x77\x4a\x8f\x3e\x69\x16\xdf" "\xec\x88\x15\x8f\x02\x00\x00\x00\x00\xc8\xfb\x73\x0a\x5c\x1b\xf2\xb2\xbb" "\x71\xa6\x29\x36\x19\x97\xa7\x5f\xd5\x52\xbd\xc2\x06\x43\x8b\x8e\xf4\x90" "\x1f\xd0\x3c\x16\xdf\xda\x44\xe2\xa2\x23\x5c\x8a\xc8\x6d\x8a\x29\x7d\xff" "\x04\x45\xa1\x5f\x21\xdc\xe4\x31\xe5\x67\x23\x88\x8f\xb1\x26\xa1\x63\xf1" "\x6f\x92\x0a\xe2\xfb\x49\x40\x59\xbb\xa8\xe3\xb6\x80\x32\x4a\x18\x80\x76" "\xeb\x68\x5d\x00\xc4\xe9\xb2\xad\x9b\xc1\x17\x2b\xa7\xcb\xeb\xe1\x74\xab" "\xa2\x10\xd7\x39\xa0\x18\xf9\xbb\xec\x63\x22\x2d\x20\xce\xca\xc4\xd0\x37" "\x23\xf1\xc9\x32\xfb\x3b\xba\x54\xb3\xa6\xaa\x57\xf1\xad\x2e\x99\xe0\xe6" "\x7a\xb9\xff\x16\xd2\x00\x00\x00\x9f\x0f\x53\xac\xbb\x40\xb4\xf8\xe2\x73" "\x82\x70\x00\x15\x62\xed\x83\x4f\x2a\xf9\x77\x87\xf6\x96\x64\x9a\x46\x2e" "\x7e\xe4\xbc\xf8\xb0\x7a\x10\xd6\x73\x51\x54\xbe\xb4\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\xbc\x00\xf6\x79\x62\x97\x09\xe7" "\xe7\x8f\x4d\xdc\x21\x1b\xc3\xeb\xe6\xbd\x9d\x42\xca\x01\x40\xa7\xaf\xaa" "\xb4\x31\x76\xe6\x5e\xc1\x11\x8d\x50\xd1\xe8\x27\xf3\x47\x2f\x44\x45\xd2" "\x53\x88\x08\x00\x00\x00\x00\x00\x00\x00\x69\x08\x84\xf8\x00\x03\x1e\x03" "\xa6\x51\xbb\x96\x58\x9a\x7e\x2e\x50\x9b\xcc\x1d\x16\x13\x47\x62\x3c\xb5" "\xe7\xac\x46\x29\xc8\xab\x04\x87\x1b\xc4\x72\x87\xcd\x31\xcc\x43\x01\x00" "\x00\x00\x7b\x40\x40\x7d\x00\x00\x00\x21\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x5f\x37\xd8\x3f\x84\xe9\x8a\x52\x3d\x80\xbd\x97\x0d\x70\x3f\x37\xca" "\x36\x4a\x60\x1a\xe8\x99\xa5\x67\x15\xa0\xa6\x2a\x34\xc6\xc9\x4c\xce\x69" "\x94\x52\x16\x29\xab\x02\x8a\xcf\xc1\xd9\x26\xa0\xf6\xa5\x48\x9a\xf8\xdc" "\x2f\x17\x92\x3f\x3c\x40\xdf\xd1\x97\x0a\x55\xc2\x2f\xe3\xa5\xac\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc1\xeb\x2d\x91\xfb" "\x79\xea\x00\x00\x00\x00\x81\x52\x66\xb2\xc9\xe1\xbf\xad\xc7\x49\x8e\x9d" "\xda\x5d\x00\x00\x00\xbb\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe4" "\x00\x7b\xe5\x11\xfe\x32\xfb\xc9\x0e\x23\x64\xa5\x5e\x9b\xb6\x6a\xc6\x44" "\x23\xd2\xd0\x0f\xea\x25\x94\xe1\x90\xde\xae\x46\xe2\x6c\x59\x6f\x84\xeb" "\xa9\x00\x00\x00\x00\x00\x00\x00\x3c\xc3\xaa\x39\xee\x4b\x13\x86\xba\xb5" "\x61\xcd\xa8\x86\xfa\x64\x29\x94\xca\xcd\x47\x3b\x54\x3c\xcb\x5f\x0d\x7b" "\x63\x92\x4f\x17\xc6\x7b\x13\x63\x18\x22\xa1\x1d\xc3\xc6\x93\x96\x28\x95" "\x49\x6d\x4f\x6e\x9c\xc5\x4d\xb6\xc7\x20\x5a\x6b\x26\xf9\x21\x21\xef\x53" "\xe5\x53\xac\xdf\x42\x06\x8f\xff\x49\x6d\x2d\xa7\xd6\x32\x7f\x31\xd7\xc8" "\xcc\x5d\x32\x5c\x53\x79\xb0\x36\x3c\xe8\xbd\x1f\x61\xb0\x07\xe1\xff\x5f" "\x1b\xe1\x96\x9a\x1b\xa7\x91\xad\x46\xd8\x00\x00\x00\x00\xc7\xf2\x6a\x03" "\x37\x30\x2f\x3b\x41\xea\xe5\x98\x09\xfd\x05\xd1\x2f\x61\x86\xf1\x17\xb0" "\x62\xdf\x67\xd3\xa6\x3f\x32\x65\xdd\x14\x10\xee\xa6\x82\x08\xa3\xf2\x6b" "\x29\x89\xb8\x32\xd8\xb3\x4a\x34\xa4\xf0\x8b\x34\xb3\x04\x20\x65\xac\xaa" "\x10\x85\x6e\x85\x8d\x27\xad\xee\x7d\xaf\x32\x90\x3d\x3f\xc7\x87\x00\xd4" "\x29\xa2\xd4\xc8\xb6\xd8\x03\xeb\x83\xee\xcf\xe4\xc7\xff\x9e\x6a\xb5\xa5" "\x2e\x83\xd0\x89\xda\xd7\xa8\x71\x0e\xec\x53\xf1\xb1\x1c\xce\xd7\xbc\x3c" "\x8d\xa0\xc4\x4d\x2f\xbf\x9f\x6f\x3f\xf3\xbe\x4d\x14\x58\x07\x7c\x22\x53" "\xb0\xc7\xc7\xa0\xa9\xfd\xd6\x3b\xf9\x10\xdc\x20\xe5\xcb\x2a\x88\xe5\x9f" "\xeb\xc4\x7f\x12\x12\xa2\x1f\x63\x1d\xba\xa7\x4f\x22\xba\xd0\x50\xe9\x85" "\x6b\x48\xae\x3a\x03\xa4\x97\xc3\x77\x58\x53\x76\x50\xfe\x6d\xb8\x03\x00" "\xc4\x1f\xdc\x3d\x78\xe0\x46\xf6\x16\x0e\x17\x41\x29\x9e\x8d\xc2\x99\x06" "\x87\x0e\x64\x31\xed\x1e\xab\x5d\x06\x7a\x18\x3f\x06\x4b\x06\x0a\x8e\xc1" "\x27\x25\xd4\x2e\x3a\x74\x86\x3d\x66\xbe\xe9\x66\xb1\x57\x4f\x8e\x01\xb3" "\xf3\x4a\x26\x7f\xf0\xaf\xa1\xe1\xc7\x58\xa0\x07\x9b\x74\x70\x67\x31\x2e" "\x98\x15\xa2\x1c\xb3\xf1\xf8\x15\x0d\x99\x9d\x78\x85\x35\xa4\xd3\x11\x4d" "\xbc\x7e\x2b\xf2\x40\x2a\x75\xfd\x7a\x55\x73\x33\x60\x04\x08\x55\xed\x5d" "\x1c\x0d\x63\x4f\xc5\xfb\x38\xf8\x70\x9d\x87\xb2\x7f\x8a\x5d\x91\x21\xfd" "\xc0\x58\x44\x7b\x72\x8f\x13\x4f\x72\x06\x2f\xc4\xb1\xca\x07\x80\xb1\xa7" "\xaf\x13\x7f\xf7\xb4\xff\x13\x96\x04\xfa\xf0\x45\x3b\x65\x58\x6f\x65\xc7" "\x94\x3d\x56\xb5\x2f\x06\xc8\x70\xed\xf0\xc5\xd7\x44\xb5\x27\x2b\x44\xc2" "\x34\x80\xb2\xbd\xbf\xf9\x47\xc4\xdf\xa1\x08\xcb\xb8\x82\x02\xee\xb8\x1f" "\x42\x8a\x5b\x3c\x29\x98\x48\x64\x9e\x1a\x6b\xff\x52\xf6\x57\xa6\x74\x63" "\xd7\xdb\xf8\x5a\xe9\x32\x1f\xc2\xcc\x17\xdc\x4a\x29\xb9\xcb\xa8\xde\xd5" "\xde\x82\x06\xc8\x12\x43\x9a\xb1\x29\xae\x81\x88\x37\xee\x15\x62\x07\x8f" "\xc5\x24\xb3\xba\xf4\x9a\x0b\xe9\xbb\x7d\x95\x8d\x5e\x87\xc6\xc0\x9b\xf7" "\x1a\x89\x4b\xad\x62\x93\x47\x82\xcc\x30\x8e\x93\x6d\x76\x37\xe0\x7c\x4a" "\x2a\x3b\xc8\x7b\x0d\xa2\x00\x00\xd9\xef\x41\x8c\xf1\x9e\x7a\x8c\x4c\x32" "\x8b\xe0\xce\x91\x79\x8a\xdc\x2d\xca\x87\x10\x73\xf6\xbd\x61\x94\x0a\xab" "\xc8\x6b\x94\xf8\xcb\xde\x4d\x47\x06\x04\x00\xe7\x22\xa6\xa2\xaf\x48\x3a" "\xd0\xd3\x41\x5e\xd0\xf9\xdb\x00\x9a\xca\xba\x9e\xae\xa9\x3f\x81\x1d\x43" "\x4e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd1\x54\x67\x2f\xea\x96\xae" "\xdf\x34\x62\x79\xec\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd5\x35\xd4" "\x1b\x00\x67\xf0\x1e\x2e\x54\xb9\x15\x4d\x87\x60\x20\xb6\x69\x64\x0e\xad" "\x4c\xa4\x46\x31\xfa\xdf\x7c\x4a\xc3\x9a\x1b\x33\x1d\xbd\xcd\x52\xb3\x6d" "\xf0\x21\xb7\x31\xef\x1f\x92\x33\x0d\x34\x7f\x88\xce\xd5\xc1\xaa\xad\xbc" "\xdd\x8d\x22\x57\xe3\xa9\xa7\xc7\x49\x4f\xad\xf9\xbe\x36\xf7\xa2\x33\x4e" "\xe6\xe9\x44\x6f\xa1\xfd\x48\x6f\x85\xd6\x72\xa7\x7d\xc5\xbd\x21\x46\x39" "\x94\xd4\x9f\x12\x01\x63\x05\xa1\xe3\x94\xd2\x92\xb6\x68\x40\xfe\x32\xb4" "\x0a\xd6\x65\xd2\x41\xa8\xb8\xa3\x2b\x31\x00\x45\x0c\x32\x83\x27\x89\xaa" "\x8a\x09\x6f\x41\x20\x1b\x58\x5c\xd7\x66\x31\xc8\x8c\xf9\x58\xe9\xe9\x04" "\x7f\x5a\xf1\x73\x0c\x5e\x83\xdb\x12\x46\x0a\x07\x68\xfd\x4b\x62\xbe\x6c" "\x41\xee\xd3\x07\x04\x8b\xac\x8d\x1f\x7f\x16\x45\x74\x24\x1e\x06\x02\x76" "\x54\xb2\x48\xdc\xc3\x87\x49\xee\xe0\xc1\xee\x7c\x61\xb3\xf6\x41\x1a\x55" "\x9c\x3d\x45\x63\x7b\x11\xe4\x40\xed\x5a\x99\x10\x9b\x8e\x71\xd2\x8c\x3d" "\x67\x7a\xf5\xf0\x49\x9c\x6d\x3f\xc6\xa1\x29\x77\x50\x56\x95\x8c\x9d\xf8" "\x24\xeb\xe5\xfa\x9f\xb3\x06\xb2\x4a\x8a\x83\x34\x91\x06\x27\xd0\x3e\xfe" "\x69\xd4\xb6\x1c\x43\x45\xf0\x48\xc5\xda\x8a\xca\x16\xce\xa8\x48\xfa\x77" "\xd2\x50\x7c\x92\x0a\x6b\xd6\x54\xb0\x0e\x07\x78\x93\x82\xed\x90\x2c\x80" "\xde\xef\xf2\xfd\x5c\x78\xf4\x2e\x43\x53\xe5\x36\x0c\x3e\x55\x96\x2e\xfd" "\x13\x31\xe6\x73\x6e\xaf\x4e\xe2\x77\x36\xfa\x54\x80\x3e\xe8\xec\x1a\x15" "\x26\x6f\xfc\xd8\xb3\x03\x68\x74\x0b\x58\x4c\x25\x59\xe6\x91\xe5\x42\xca" "\xb3\xd4\x9d\xb3\x27\xdb\x62\x32\x8f\x15\x9d\x1e\x09\x00\xb3\xe2\x3e\x84" "\xde\xdc\xd1\x37\x7a\xa1\x5d\xbe\xab\x7d\xb1\x81\xbd\x66\x98\x0c\x35\x57" "\xc7\xd9\xf7\x37\x7f\xcb\x60\x23\xac\xcb\x5c\x36\x8a\x12\x1a\xcf\x70\xe5" "\xf4\xc3\xf2\xa0\xea\x07\x01\x1c\x71\x49\xea\x97\x9c\xab\x2e\xe6\x5c\xf7" "\xff\xa2\x91\x52\xb7\xa8\xfe\xd8\x95\x75\xe6\xe6\xfd\x77\xd4\xd9\x46\x3d" "\x21\x77\x5a\xba\xc8\x86\xee\x6a\x1f\x2d\x7d\x85\x23\x84\x04\x38\xa7\x3d" "\x63\x07\xa8\x7e\x2f\x52\x58\x67\xfc\x3a\xf7\xab\x74\x52\x0a\x77\x3a\xe2" "\x6b\xae\x74\xcd\xd4\x05\xa2\x11\xe8\x83\x3e\x1b\xa5\x23\xcd\xe5\x1d\x04" "\xa7\xca\x67\x32", 2074); *(uint64_t*)0x200054d0 = 0; *(uint32_t*)0x200054d8 = 0; *(uint32_t*)0x200054dc = 0; *(uint64_t*)0x200054e0 = 0; *(uint32_t*)0x200054e8 = 0; *(uint32_t*)0x200054ec = 0; memset((void*)0x200054f0, 0, 16); *(uint32_t*)0x20005500 = 0; *(uint32_t*)0x20005504 = 0; *(uint32_t*)0x20005508 = -1; *(uint32_t*)0x2000550c = 8; *(uint64_t*)0x20005510 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20005518 = 8; *(uint32_t*)0x2000551c = 0x10; *(uint64_t*)0x20005520 = 0; *(uint32_t*)0x20005528 = 0; *(uint32_t*)0x2000552c = 0; *(uint32_t*)0x20005530 = -1; *(uint32_t*)0x20005534 = 0; *(uint64_t*)0x20005538 = 0; *(uint64_t*)0x20005540 = 0; *(uint32_t*)0x20005548 = 0x10; *(uint32_t*)0x2000554c = 0; syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200054c0ul, /*size=*/0x90ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; loop(); return 0; }