// https://syzkaller.appspot.com/bug?id=ebbbd5f466e1068e36f527e0a142aa864fc755db // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 357 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000, 0x1000, 0, 0x32, -1, 0); syscall(__NR_mmap, 0x20000000, 0x1000000, 7, 0x32, -1, 0); syscall(__NR_mmap, 0x21000000, 0x1000, 0, 0x32, -1, 0); intptr_t res = 0; *(uint32_t*)0x20000200 = 0xc; *(uint32_t*)0x20000204 = 0xe; *(uint64_t*)0x20000208 = 0x20000580; memcpy( (void*)0x20000580, "\xb7\x02\x00\x00\x01\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07\x03" "\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4\xf0\xff" "\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05\x00\x00\x00" "\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00\x01\x00\x7d\x60" "\xb7\x03\x00\x00\x01\x00\x00\x00\x6a\x0a\x00\xfe\x00\x00\x00\x00\x85\x00" "\x00\x00\x0d\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00" "\x00\x00\x00\x00\x49\x6c\xf2\x82\x7f\xb4\x78\x28\x37\xf8\xc8\x90\x3a\x43" "\x1c\xa7\x11\xfc\xd0\xcd\xf2\x14\x6e\xc5\x61\x75\x03\x79\x58\xe2\x71\xf6" "\x0d\x25\xb7\x93\x7f\x02\x00\x05\x00\x5a\x07\x6d\x83\x92\x3d\xd2\x9c\x03" "\x40\x55\xb6\x7d\xaf\xe6\xc8\xdc\x3d\x5d\x78\x7a\x74\xa0\x09\x1f\xf1\x10" "\x02\x6e\x67\xe2\x6d\x2e\xfe\x31\xab\x7e\xa0\xc3\x4f\x17\xe3\xad\x6e\xa4" "\x06\x62\x20\x03\xb5\x38\xdf\xd8\xe0\x12\xe7\x95\x78\xe5\x1b\xc5\x30\x99" "\xe9\x0f\x45\x80\xd7\x60\x55\x1b\x5b\x34\x1a\x2d\x7c\xbd\xb9\xcd\x38\xbd" "\xb2\xca\x8e\xeb\x9c\x15\xab\x3a\x14\x81\x7a\xc6\x1e\x4d\xd1\x11\x83\xa1" "\x34\x77\xbf\x7e\x06\x0e\x36\x70\xef\x0e\x78\x9f\x65\xf1\x32\x8d\x67\x04" "\x90\x2c\xbe\x7b\xc0\x4b\x82\xd2\x78\x9c\xb1\x32\xb8\x66\x7c\x21\x47\x66" "\x19\xf2\x8d\x99\x61\xb6\x3e\x1a\x9c\xf6\xc2\xa6\x60\xa1\x7e\x3c\x18\x4b" "\x75\x1c\x51\x16\x0f\xbc\xbb\xf3\x5b\x1e\x7b\xe6\x14\x8b\xa5\x32\xe6\x08" "\x3b\xe8\x93\x58\xb2\xd0\x24\x21\x79\x7e\xea\x09\xc3\x46\xdf\xeb\xd3\x1a" "\x08\xb3\x28\x08\xb8\x02\x00\x00\x00\x00\x00\x00\x00\x33\x4d\x83\xac\xe8" "\xbe\x6e\x80\xe7\x11\x13\x61\x0e\x10\xd8\x58\xe8\x32\x7a\xf0\x1f\xb6\xc8" "\x6a\xda\xc1\x22\x33\xf9\xa1\xfb\x9c\x2a\xec\x61\xce\x63\xa3\x8d\x2f\xb4" "\x00\x00\x00\x00\x00\x00\x00\xb4\xee\xa0\xc6\xe9\x57\x67\xd4\x2b\x4e\x54" "\x86\x1d\x02\x27\xdb\xfd\x2e\x6d\x7f\x71\x5a\x7f\x3d\xea\xdd\x02\x00\x00" "\x00\x00\x00\x00\x00\x37\x67\xd2\xe2\x4f\x29\x6e\xa0\x18\x2b\xab\xc1\x8c" "\xae\x2e\xd4\xb4\x39\x0a\xf9\xa9\xce\xaf\xd0\x7e\xd0\x0b\x00\x00\x00\x2c" "\xab\x15\x4a\xd0\x29\xa1\x19\xca\x3c\x97\x27\x80\x87\x00\x14\x60\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x2d\xfa\x8e\x2b\xdf\xf1" "\x90\xad\xc5\xf9\xd5\x55\xca\x2c\x46\x61\x08\x11\xa4\xe7\x8e\x94\xd6\xa1" "\x33\x53\x9b\x4e\x39\xa1\x37\xe8\x79\x79\x3c\xe5\x77\x7f\xca\x90\x37\x68" "\xbf\x93\x14\x72\xbc\xbc\x5a\x6f\x33\x07\x8e\x7e\xb5\x95\x00\x00\x00\x00" "\x01\x00\x00\x00\xcb\x8b\xea\xa3\x9e\xdc\xb5\x0e\x90\xa6\x60\x37\x5a\xcf" "\x43\xaa\x14\x99\xb3\x4b\x40\x55\x91\x69\xeb\xb5\xf3\x66\x78\x95\x4f\xc6" "\x28\xef\x23\xcb\x78\xbe\x38\x34\x4e\x12\xd5\x0e\xa5\x9c\x5e\xef\x21\x9d" "\x29\x99\x9b\xa9\xb6\x01\x7e\x05\x06\xe8\xe6\xdb\xd7\xe8\xb1\xe2\xdd\x0d" "\x3c\x7c\x90\xbd\x3c\xf0\x60\xd5\xc3\x7f\x74\x75\x5c\x2c\x0f\xac\x82\x3e" "\x4c\x83\xd7\x8b\xfe\xbb\x64\xdb\xeb\x16\xb2\x9f\x92\x45\x71\x92\x3d\x3b" "\xff\xa8\x0a\x42\x3c\xce\xaf\xa2\x43\x86\x11\x08\x97\xe1\x47\xb7\xb8\x78" "\xdf\x1b\xa7\xd8\x87\xd0\x2e\x48\xab\xd0\x3c\xa2\xdc\xd6\xd4\x21\xa9\x7c" "\x3b\x5a\x00\xcc\x01\x4b\x01\x71\xe5\x35\x69\x9e\x9b\xe0\x7d\x62\x46\xde" "\x8d\xe2\xc5\x7b\xc1\xda\x71\x94\x2d\xf9\x87\xae\x3e\xec\x9e\x1f\x4b\xd5" "\xc8\xbe\x85\xb1\x9f\xcd\x90\x46\x09\x9c\x2c\x24\x60\x3e\xce\x05\xcf\xd0" "\xbc\x45\x45\xd9\xc6\x9b\xfc\xdb\x84\xcd\x2d\x8c\x33\x4e\x24\x0c\xd2\x64" "\xb4\xfb\x4f\x79\x13\x06\x3f\xb8\xf8\x0b\xb3\xc1\xbe\xc6\x38\xd8\x30\x04" "\x79\xf9\xde\x30\xcf\xab\x01\xaf\x1f\x21\xea\xc9\xa8\x2e\xae\x3b\xce\xd4" "\x9a\x24\x64\x4c\x23\x7d\xce\x13\x48\x53\x52\xe7\xf7\xb0\x60\xbc\x32\x0a" "\xa9\x92\x68\x39\x2d\x8b\x8b\x95\xfb\xfb\xec\x94\xcc\xf3\xfd\x7f\x85\xc1" "\xab\x56\x01\x85\xcb\xe9\xe3\x4b\xe1\xdc\x42\xcb\x20\xf1\x77\x85\xd2\x3d" "\x20\x1e\xe7\x3f\x3d\x6b\xd0\xa2\xf3\x22\x5d\x68\x4e\x34\x5d\xa1\x68\xfb" "\x46\x85\xcf\xd2\xc8\xa5\xf9\x12\xe0\x1b\xe6\x43\x71\xb4\x00\x3c\x68\x9e" "\xbc\x54\x03\xa4\xe8\x75\x10\xc0\x60\xd1\x23\xf4\x37\x72\xce\xcd\x4a\xa4" "\xf2\x47\xde\x6c\x40\x4b\x93\x1b\x19\x8f\xa3\xf9\x7d\x66\xe5\x45\xdc\x74" "\x6b\x1d\xf5\x9c\xcd\xfd\xf7\xd1\xd2\xc4\x84\x09\x68\xd2\x79\xbe\x95\x61" "\x63\xdc\xb7\x1d\x17\x7e\x94\x4c\xe0\x1a\x77\x43\x31\x3c\xd1\xcd\x3a\x7e" "\x52\x64\x9a\xda\xbc\xb2\x77\x81\xd7\x0b\x36\x93\xdd\xb6\xb2\xe4\x03\x7a" "\x9e\x74\xde\xa8\xb4\x30\x91\x1e\x24\xe5\x8f\xe7\x99\x96\x2b\xac\xd3\x87" "\x1c\x41\xf8\xec\x20\x26\x54\x0f\xc4\x6b\x70\xf7\x9c\xe5\x33\xdc\x9f\x28" "\xa8\xdc\x1b\xa1\x2d\x39\x44\x95\xde\x8f\x22\xe8\x5a\x2a\xfb\x11\xc9\x15" "\x51\xae\xdd\xe0\xbd\x2b\x36\x4a\xe1\xcf\xb3\x91\xb9\xc4\xc0\x2f\xf9\xd6" "\x7c\x3f\xbb\x0d\x8c\x81\x31\x60\xc1\x27\x95\x0a\x4d\x6d\xe4\xfc\xac\xac" "\xf8\x4e\x9f\x9d\x10\xeb\xf6\x00\xfa\x18\x01\x3a\x1b\xf2\x53\xd6\x62\x7c" "\x55\x02\x23\x8a\x9f\x69\x66\x36\x01\x2c\xc8\x47\x07\x4e\x49\x1f\x94\x50" "\x98\xfe\x58\x0f\x11\x90\x35\xf6\x5a\x7f\x19\x5a\x0b\x8d\x94\x3c\x63\xc8" "\x4c\x0d\xf3\x92\xbd\xb7\x9d\xa7\xd2\x05\x23\x07\xce\x57\xdf\x26\xb6\x8f" "\x80\x14\x4b\x92\xa6\xc8\x04\x0d\xfb\x41\xdf\xaa\x9d\x69\x42\x31\x7b\x94" "\x9f\x6b\xbd\x1b\xa2\x7e\x7a\xca\x70\x5a\x92\x0a\xbe\xb8\x65\x91\xe3\x58" "\x8f\x2f\x32\x4c\xad\x30\x32\x3a\x92\x0e\x66\x7c\xb1\x15\xdc\xf3\x97\xf3" "\x5d\x8c\xd0\x9e\x25\x9a\xe1\xf6\xce\xb0\xac\xcb\xe8\x6f\x74\x00\xe7\xd5" "\x8f\x99\x1a\x97\xc0\xbe\xdc\x4e\x53\xb4\x65\x66\xae\x6b\x0f\x30\x84\x43" "\xae\xd6\x95\x3c\x94\xa9\xbc\xf5\xad\xba\xe9\xa3\xf1\xce\xcf\xe6\x90\xf7" "\xa6\x8c\x90\xe4\x56\xd3\x45\x07\xd2\x91\x9e\x9b\x5e\x45\x04\x08\xb8\x92" "\x77\xcb\x5b\xf0\xdf\xe5\x30\xe7\x45\x24\x43\x5c\x7b\xdd\x7a\x4c\x3c\x6f" "\x83\xcd\x57\xdf\xbc\xa0\xdc\xa5\x16\xde\xa6\x05\x60\xce\x24\x9f\x63\x81" "\xa9\x73\xe1\xd2\x4b\x18\x44\x20\x87\x7a\xca\x9e\x31\x95\x41\x4a\x0f\x87" "\x3e\xa4\xba\x11\xc0\x2b\x08\x88\x86\xf6\xff\x96\x3f\x03\xac\xde\x23\xd4" "\x1b\x35\x10\xb7\x03\x01\x22\x42\x5f\x34\x53\xc5\x83\x41\x4b\x69\x41\x36" "\x9c\xe9\x54\xa8\x26\xac\xc1\xdd\x76\xe9\xdb\x5e\x9f\xe6\x13\xf9\xc7\xe3" "\xdf\xc7\x5c\x24\xfe\x04\xb2\xad\x66\x79\x87\x14\x99\x03\x37\x9d\xc3\x2d" "\xf0\xcb\x1d\x62\x4c\x57\xbf\x47\x52\xd0\x30\xa4\xa5\x51\x12\x00\xe7\xbf" "\xcd\x63\x8c\xa2\x9a\x68\x05\x84\xee\x60\x55\x79\xcc\xf2\xfd\xb4\x75\x8c" "\xf4\xc5\x74\xff\x2e\x0e\x9a\xa5\x8c\x6d\xc5\x5f\xa8\xf6\xc7\x0d\x26\x0d" "\xc4\x4f\x9d\xb1\x28\xa2\x81\x61\x10\x00\x20\x10\x99\xb7\x45\x9b\xeb\x86" "\x58\xf3\x68\xc6\xda\x02\xa5\xfc\xfc\x28\x5d\x85\x70\xca\x16\xd7\xd8\xd1" "\xeb\x92\xd3\x7f\x7e\x23\x12\x15\xba\xeb\x3b\xa9\x47\x6b\x35\x88\xd6\xb7" "\x65\xe5\x5a\x9f\xa5\x11\x18\x6b\x49\x7a\x51\x87\x4b\x86\x1c\xc0\x5a\xa4" "\x49\xb4\xe6\xd6\xf1\xaa\x3d\xf7\xf7\xc1\x1a\xa3\x70\x45\x44\xfc\xa0\xb7" "\x5d\xd0\xd6\x4b\xa4\x01\xb0\xa0\xb7\x2c\x6e\x66\x12\x95\xfd", 1563); *(uint64_t*)0x20000210 = 0x20000340; memcpy((void*)0x20000340, "syzkaller\000", 10); *(uint32_t*)0x20000218 = 0; *(uint32_t*)0x2000021c = 0; *(uint64_t*)0x20000220 = 0; *(uint32_t*)0x20000228 = 0; *(uint32_t*)0x2000022c = 0; *(uint8_t*)0x20000230 = 0; *(uint8_t*)0x20000231 = 0; *(uint8_t*)0x20000232 = 0; *(uint8_t*)0x20000233 = 0; *(uint8_t*)0x20000234 = 0; *(uint8_t*)0x20000235 = 0; *(uint8_t*)0x20000236 = 0; *(uint8_t*)0x20000237 = 0; *(uint8_t*)0x20000238 = 0; *(uint8_t*)0x20000239 = 0; *(uint8_t*)0x2000023a = 0; *(uint8_t*)0x2000023b = 0; *(uint8_t*)0x2000023c = 0; *(uint8_t*)0x2000023d = 0; *(uint8_t*)0x2000023e = 0; *(uint8_t*)0x2000023f = 0; *(uint32_t*)0x20000240 = 0; *(uint32_t*)0x20000244 = 0; *(uint32_t*)0x20000248 = -1; *(uint32_t*)0x2000024c = 8; *(uint64_t*)0x20000250 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000258 = 0; *(uint32_t*)0x2000025c = 0x10; *(uint64_t*)0x20000260 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x20000268 = 0; *(uint32_t*)0x2000026c = 0; *(uint32_t*)0x20000270 = -1; res = syscall(__NR_bpf, 5, 0x20000200, 0x48); if (res != -1) r[0] = res; *(uint32_t*)0x20000080 = r[0]; *(uint32_t*)0x20000084 = 0x2a0; *(uint32_t*)0x20000088 = 0xe; *(uint32_t*)0x2000008c = 0xfffffe7f; *(uint64_t*)0x20000090 = 0x20000500; memcpy((void*)0x20000500, "\xb9\xff\x03\x00\x60\x0d\x69\x8c\xb8\x9e\x14\xf0\x43\x05\x1f\xff\xff" "\xff\x00\x00\x40\x00\x63\x2f\x77\xfb\x05\x14\x14\x0e\xe9\x34\xa0\xa6" "\x62\x07\x9f\x4b\x4d\x2f\x87\xe5\xfe\xca\x6a\xab\x84\x50\x13\xf2\x32" "\x5f\x1a\x39\x01\x01\x08\x03\x8d\xa1\x92\x44\x25\x18\x1a\xa5", 66); *(uint64_t*)0x20000098 = 0; *(uint32_t*)0x200000a0 = 0x100; *(uint32_t*)0x200000a4 = 0x60000000; *(uint32_t*)0x200000a8 = 0xb20c; *(uint32_t*)0x200000ac = 0xfffffe09; *(uint64_t*)0x200000b0 = 0x20000000; *(uint64_t*)0x200000b8 = 0x20000000; syscall(__NR_bpf, 0xa, 0x20000080, 0x28); return 0; }