// https://syzkaller.appspot.com/bug?id=90cd06695bd4650a5228385b4b02f370ef9c219f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; memcpy((void*)0x200000c0, "/dev/kvm", 9); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x200000c0, 0, 0); if (res != -1) r[0] = res; res = syscall(__NR_ioctl, r[0], 0xae01, 0); if (res != -1) r[1] = res; res = syscall(__NR_ioctl, r[1], 0xae41, 0); if (res != -1) r[2] = res; memcpy( (void*)0x200007c0, "\x0d\x69\xa8\x79\x6b\x92\x59\x8f\x7c\x62\xbc\xfa\x33\xf8\x74\xe1\x73\x2c" "\xbc\x7d\xff\x32\x8a\xd4\x15\x8e\x17\xed\x5b\x73\x44\x6c\x93\xa5\x3b\x9a" "\xd4\x0e\x0c\xfc\xda\x44\xbc\x55\x35\x4c\x75\x06\x0f\x99\x05\x38\xad\x21" "\xbb\xe4\x26\xe0\xd2\xd0\x11\x7e\x05\x57\x3a\x48\x23\xf0\x36\xec\x0d\x74" "\x9b\x8f\x84\xbe\x3f\x0e\xf0\x34\x6e\x9c\x93\x74\x62\xa9\xe1\x71\xa0\x12" "\xe7\xa1\x4f\x70\xd1\x33\xaa\xb4\x8a\x7f\xb4\x80\x11\xbe\x60\xf4\x5b\x63" "\xb1\x36\x89\x9d\x7d\x8f\xac\x2d\x06\xe1\x21\x01\x9b\x5a\xa7\x09\x49\x84" "\x9f\xb7\xb0\x53\x49\x5b\xec\x84\x60\x5a\xfb\x9a\xca\x10\xdd\x81\xcb\x2a" "\xad\x21\x91\x97\xaf\x3c\xaf\x7e\x1f\x35\x7c\x55\x1f\xbf\xb2\x08\x57\x31" "\xed\xc7\x41\x23\xfc\x58\x94\x04\x90\xec\x61\x31\xe5\x87\x99\xf6\xdf\x34" "\x89\x2f\x53\x78\x40\xe9\xcf\xc6\x5e\x6d\xf0\xc1\xa0\x16\xb5\xdd\x34\x19" "\x88\xab\x6d\x44\x20\x56\x2a\xb7\xb1\x0c\xa2\x6d\x09\x5f\xaf\xa0\xe8\xb7" "\xc5\xa6\x05\x96\x46\x85\x32\x5f\xf1\xb5\x0f\x05\x7c\x5f\x88\xa4\x44\x4a" "\x0c\xe6\xb2\x5e\x82\x65\x1d\x01\xe6\xcc\xf7\x9b\x2f\xec\x87\xb4\xf7\x9f" "\x23\xad\x7d\x5d\xff\x95\xa9\x34\x14\xfe\x07\x61\xf7\x14\xf5\x4a\x78\x84" "\x68\x1e\x4d\xfa\x08\x2e\x44\x54\xf3\x50\x23\x37\x0b\x43\x3a\x23\x26\xbd" "\xb5\xf7\x48\xb0\xf5\x46\x43\x36\xdb\xef\xf6\x50\xc4\x2c\xc3\x9f\xad\xae" "\x29\x7d\xba\xae\xd1\xaa\xb5\xad\x29\xc4\x4a\x09\x96\xd6\xae\xa3\x5b\x71" "\x71\x2e\x2a\x30\xc9\x30\x77\x47\xc8\x72\x98\xd8\xd6\xc2\x12\xe6\xb5\x09" "\xc8\xa6\x53\x37\x6d\x63\x72\xae\x29\x76\xf3\x75\x0c\x9a\x1a\xb2\x61\xa2" "\xf4\x8d\x34\xac\x79\x47\x3b\x70\xd6\x4b\xca\x6d\x72\xa9\x1b\x3c\x6c\x04" "\x16\x0b\x3c\x24\x49\xde\x9e\x40\x86\x79\xd9\xc2\x64\xe9\x2d\xcc\xd8\xb8" "\x18\xb9\x51\x00\x6e\x98\xa5\xdb\xaf\xdb\x0c\x44\xa1\xaa\x2e\x68\x63\x0f" "\x55\x5e\x36\xb5\x5c\x18\x33\x0f\x60\x3b\x3e\x17\x78\xc7\xda\x6d\x62\xad" "\x0e\xf4\x98\xc8\x75\x74\x0e\xdb\xb7\xd9\x23\x3a\x74\xa8\xab\xa5\x62\x34" "\x2e\x99\x0a\xae\x27\x9a\xc4\xd3\xbf\xf1\x16\x4b\x2c\x5a\xbc\xd0\x78\x73" "\x0c\x22\xa1\xc7\x44\xa9\xc4\xa2\x1b\x9d\xd7\xae\xe9\x37\xbe\xc9\xf7\x87" "\xf2\xe4\x4e\xbd\x11\x98\x73\x0a\x70\xbe\xa1\xe3\xa1\x9b\xad\xc1\xcc\xc2" "\x59\x9f\xd2\xbe\xeb\xc8\x4d\x0d\x73\x18\xf6\x13\x67\xab\x9d\xa3\xe8\x89" "\xe4\xb1\xca\x2f\x45\x88\xf7\xb2\xc1\x9f\x5c\x15\x80\xff\xb6\x80\x82\x6e" "\xe9\x6f\x2d\x5b\x06\x96\x98\xff\xa1\x77\xf8\x85\x0d\x43\xf1\x58\xaa\x81" "\x61\xc0\xd6\x8a\x75\x2d\xe0\xc5\x5b\x61\x62\xb8\x69\x9b\x40\x6a\xc0\x2f" "\x0c\xd0\xf0\x13\xff\x7e\xb0\xa0\x3a\x7a\x06\x76\x4f\x42\xec\xd8\x8a\x10" "\xf1\xfe\x84\xd8\xde\x50\x82\xa0\xf7\xd3\xa9\xd5\x8b\xa6\x41\x7e\x3b\x7d" "\x78\x0e\x98\x45\x08\x0f\x32\xa1\x5c\xe6\x8f\x9d\xa2\xaf\xf3\x0c\xcc\xa5" "\x86\x77\x30\x0b\x7b\x8f\x1f\xbd\xb3\xce\x16\x12\xe6\x9e\x7c\x7e\xa6\xf6" "\x80\x28\x5a\x4b\x57\xb2\x2b\x58\x77\xa3\x79\x33\x9a\x94\xa6\x8a\xc9\x00" "\x9c\xe9\x36\x1d\x11\x8c\x48\x91\x88\xdb\xc8\xbc\x50\xa7\xd4\x26\x68\x6e" "\x77\x53\x43\xc4\xfb\xc9\x2a\xbf\xc2\x15\x80\x01\x4d\x25\xb9\xc7\x37\xac" "\xa0\x0c\x62\x98\x74\x4d\x49\x86\x33\x6e\xcf\x12\x3d\xd5\x70\xfd\x45\x28" "\x34\x0e\x62\x34\x7a\x2c\xaf\xc3\xf4\x6c\xdc\x08\x76\xb6\x03\xdd\xad\x05" "\x2b\x64\xf7\x6d\x7d\x9d\x62\x0e\xb9\xa1\x24\xe7\xc8\x85\xd0\x7a\xce\x6d" "\x06\xa7\x06\x11\x1a\xcb\x12\x30\x57\x26\x13\xc8\xef\x8e\xaa\xe3\xbe\xaa" "\x1a\x60\xc6\xea\x8c\x34\xf0\xd0\x4f\xe6\x04\x52\x4c\x7f\x42\xbb\x23\xde" "\x8c\xb7\x4f\x42\x1f\xbb\xf1\xe5\x9e\xac\x8f\xf6\xb9\xe5\xc0\xee\x44\xd7" "\xd7\xac\x26\x9a\x7c\xcf\xc8\x0f\xf5\x48\xa0\x8a\x2f\xbe\x2b\x12\xda\x37" "\xde\xdd\xe1\x52\x76\xe5\x8f\xf2\x8c\x68\x6a\xa0\xac\x6e\x9e\x1b\xf9\xc3" "\xcf\xdd\x31\xf2\x9d\xe7\xae\x2f\x6b\x38\x54\x31\x19\x29\x24\xcd\xa0\xeb" "\x6e\x34\x45\x05\xfd\x8c\x39\xd5\x65\x77\xeb\x70\x57\x11\xf3\xd8\xa1\x4a" "\xad\x80\xd1\x6c\x5f\xbb\x7c\x14\x53\x6d\xc5\x83\xa4\x45\x94\xeb\x60\xe8" "\x53\x10\xdc\x62\x66\x27\x5b\x3f\xbc\xe2\x5c\x61\x7d\x3f\x90\xa0\x4d\x4e" "\x28\x5b\xa3\xa9\xed\xa4\x55\xed\x89\xd9\xfc\xd2\x15\xeb\x62\xc5\xc4\x70" "\xba\x40\x47\x65\x5c\xcf\xf6\xe7\x4f\x5a\x77\x3d\xe5\x91\x62\xa3\xdf\x42" "\x8a\xdb\x1c\xa0\xc9\x36\x3a\x07\x63\x44\x71\x23\xb7\x74\x8e\x81\xd1\x32" "\x0f\x72\x1c\x77\x58\x2c\x06\xe6\xf7\x64\xc3\x9f\x73\xe6\x1d\x79\xf9\xb9" "\xdb\xe4\x69\xbb\x88\x3c\xf7\xdf\x15\xdd\x8f\xcd\x24\xf5\xc2\xc7\xb7\x71" "\x75\x52\xe1\xda\x40\x03\xb2\x1f\x47\x91\x77\x1d\xb1\x79\x45\xfe", 1024); syscall(__NR_ioctl, r[2], 0x4080aebf, 0x200007c0); return 0; }