// https://syzkaller.appspot.com/bug?id=c7e345ba243bc4476aae52a3354ccbd2a90e344e // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include unsigned long long procid; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) typedef struct { int state; } event_t; static void event_init(event_t* ev) { ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { if (ev->state) exit(1); __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG); } static void event_wait(event_t* ev) { while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); } static int event_isset(event_t* ev) { return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; for (;;) { uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); if (__atomic_load_n(&ev->state, __ATOMIC_RELAXED)) return 1; now = current_time_ms(); if (now - start > timeout) return 0; } } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static struct { char* pos; int nesting; struct nlattr* nested[8]; char buf[1024]; } nlmsg; static void netlink_init(int typ, int flags, const void* data, int size) { memset(&nlmsg, 0, sizeof(nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg.buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg.pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg.pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; memcpy(attr + 1, data, size); nlmsg.pos += NLMSG_ALIGN(attr->nla_len); } static void netlink_nest(int typ) { struct nlattr* attr = (struct nlattr*)nlmsg.pos; attr->nla_type = typ; nlmsg.pos += sizeof(*attr); nlmsg.nested[nlmsg.nesting++] = attr; } static void netlink_done(void) { struct nlattr* attr = nlmsg.nested[--nlmsg.nesting]; attr->nla_len = nlmsg.pos - (char*)attr; } static int netlink_send(int sock) { if (nlmsg.pos > nlmsg.buf + sizeof(nlmsg.buf) || nlmsg.nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg.buf; hdr->nlmsg_len = nlmsg.pos - nlmsg.buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; unsigned n = sendto(sock, nlmsg.buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != hdr->nlmsg_len) exit(1); n = recv(sock, nlmsg.buf, sizeof(nlmsg.buf), 0); if (n < sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr)) exit(1); if (hdr->nlmsg_type != NLMSG_ERROR) exit(1); return -((struct nlmsgerr*)(hdr + 1))->error; } static void netlink_add_device_impl(const char* type, const char* name) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); netlink_init(RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); if (name) netlink_attr(IFLA_IFNAME, name, strlen(name)); netlink_nest(IFLA_LINKINFO); netlink_attr(IFLA_INFO_KIND, type, strlen(type)); } static void netlink_add_device(int sock, const char* type, const char* name) { netlink_add_device_impl(type, name); netlink_done(); int err = netlink_send(sock); (void)err; } static void netlink_add_veth(int sock, const char* name, const char* peer) { netlink_add_device_impl("veth", name); netlink_nest(IFLA_INFO_DATA); netlink_nest(VETH_INFO_PEER); nlmsg.pos += sizeof(struct ifinfomsg); netlink_attr(IFLA_IFNAME, peer, strlen(peer)); netlink_done(); netlink_done(); netlink_done(); int err = netlink_send(sock); (void)err; } static void netlink_add_hsr(int sock, const char* name, const char* slave1, const char* slave2) { netlink_add_device_impl("hsr", name); netlink_nest(IFLA_INFO_DATA); int ifindex1 = if_nametoindex(slave1); netlink_attr(IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1)); int ifindex2 = if_nametoindex(slave2); netlink_attr(IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2)); netlink_done(); netlink_done(); int err = netlink_send(sock); (void)err; } static void netlink_device_change(int sock, const char* name, bool up, const char* master, const void* mac, int macsize) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; netlink_init(RTM_NEWLINK, 0, &hdr, sizeof(hdr)); netlink_attr(IFLA_IFNAME, name, strlen(name)); if (master) { int ifindex = if_nametoindex(master); netlink_attr(IFLA_MASTER, &ifindex, sizeof(ifindex)); } if (macsize) netlink_attr(IFLA_ADDRESS, mac, macsize); int err = netlink_send(sock); (void)err; } static int netlink_add_addr(int sock, const char* dev, const void* addr, int addrsize) { struct ifaddrmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; hdr.ifa_scope = RT_SCOPE_UNIVERSE; hdr.ifa_index = if_nametoindex(dev); netlink_init(RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr)); netlink_attr(IFA_LOCAL, addr, addrsize); netlink_attr(IFA_ADDRESS, addr, addrsize); return netlink_send(sock); } static void netlink_add_addr4(int sock, const char* dev, const char* addr) { struct in_addr in_addr; inet_pton(AF_INET, addr, &in_addr); int err = netlink_add_addr(sock, dev, &in_addr, sizeof(in_addr)); (void)err; } static void netlink_add_addr6(int sock, const char* dev, const char* addr) { struct in6_addr in6_addr; inet_pton(AF_INET6, addr, &in6_addr); int err = netlink_add_addr(sock, dev, &in6_addr, sizeof(in6_addr)); (void)err; } static void netlink_add_neigh(int sock, const char* name, const void* addr, int addrsize, const void* mac, int macsize) { struct ndmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ndm_ifindex = if_nametoindex(name); hdr.ndm_state = NUD_PERMANENT; netlink_init(RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); netlink_attr(NDA_DST, addr, addrsize); netlink_attr(NDA_LLADDR, mac, macsize); int err = netlink_send(sock); (void)err; } static int tunfd = -1; static int tun_frags_enabled; #define SYZ_TUN_MAX_PACKET_SIZE 1000 #define TUN_IFACE "syz_tun" #define LOCAL_MAC 0xaaaaaaaaaaaa #define REMOTE_MAC 0xaaaaaaaaaabb #define LOCAL_IPV4 "172.20.20.170" #define REMOTE_IPV4 "172.20.20.187" #define LOCAL_IPV6 "fe80::aa" #define REMOTE_IPV6 "fe80::bb" #define IFF_NAPI 0x0010 #define IFF_NAPI_FRAGS 0x0020 static void initialize_tun(void) { tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); if (tunfd == -1) { printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n"); printf("otherwise fuzzing or reproducing might not work as intended\n"); return; } const int kTunFd = 240; if (dup2(tunfd, kTunFd) < 0) exit(1); close(tunfd); tunfd = kTunFd; struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ); ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_NAPI | IFF_NAPI_FRAGS; if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) { ifr.ifr_flags = IFF_TAP | IFF_NO_PI; if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) exit(1); } if (ioctl(tunfd, TUNGETIFF, (void*)&ifr) < 0) exit(1); tun_frags_enabled = (ifr.ifr_flags & IFF_NAPI_FRAGS) != 0; char sysctl[64]; sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE); write_file(sysctl, "0"); sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE); write_file(sysctl, "0"); int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); netlink_add_addr4(sock, TUN_IFACE, LOCAL_IPV4); netlink_add_addr6(sock, TUN_IFACE, LOCAL_IPV6); uint64_t macaddr = REMOTE_MAC; struct in_addr in_addr; inet_pton(AF_INET, REMOTE_IPV4, &in_addr); netlink_add_neigh(sock, TUN_IFACE, &in_addr, sizeof(in_addr), &macaddr, ETH_ALEN); struct in6_addr in6_addr; inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr); netlink_add_neigh(sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), &macaddr, ETH_ALEN); macaddr = LOCAL_MAC; netlink_device_change(sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN); close(sock); } #define DEV_IPV4 "172.20.20.%d" #define DEV_IPV6 "fe80::%02x" #define DEV_MAC 0x00aaaaaaaaaa static void initialize_netdevices(void) { char netdevsim[16]; sprintf(netdevsim, "netdevsim%d", (int)procid); struct { const char* type; const char* dev; } devtypes[] = { {"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"}, {"vcan", "vcan0"}, {"bond", "bond0"}, {"team", "team0"}, {"dummy", "dummy0"}, {"nlmon", "nlmon0"}, {"caif", "caif0"}, {"batadv", "batadv0"}, {"vxcan", "vxcan1"}, {"netdevsim", netdevsim}, {"veth", 0}, }; const char* devmasters[] = {"bridge", "bond", "team"}; struct { const char* name; int macsize; bool noipv6; } devices[] = { {"lo", ETH_ALEN}, {"sit0", 0}, {"bridge0", ETH_ALEN}, {"vcan0", 0, true}, {"tunl0", 0}, {"gre0", 0}, {"gretap0", ETH_ALEN}, {"ip_vti0", 0}, {"ip6_vti0", 0}, {"ip6tnl0", 0}, {"ip6gre0", 0}, {"ip6gretap0", ETH_ALEN}, {"erspan0", ETH_ALEN}, {"bond0", ETH_ALEN}, {"veth0", ETH_ALEN}, {"veth1", ETH_ALEN}, {"team0", ETH_ALEN}, {"veth0_to_bridge", ETH_ALEN}, {"veth1_to_bridge", ETH_ALEN}, {"veth0_to_bond", ETH_ALEN}, {"veth1_to_bond", ETH_ALEN}, {"veth0_to_team", ETH_ALEN}, {"veth1_to_team", ETH_ALEN}, {"veth0_to_hsr", ETH_ALEN}, {"veth1_to_hsr", ETH_ALEN}, {"hsr0", 0}, {"dummy0", ETH_ALEN}, {"nlmon0", 0}, {"vxcan1", 0, true}, {"caif0", ETH_ALEN}, {"batadv0", ETH_ALEN}, {netdevsim, ETH_ALEN}, }; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) netlink_add_device(sock, devtypes[i].type, devtypes[i].dev); for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) { char master[32], slave0[32], veth0[32], slave1[32], veth1[32]; sprintf(slave0, "%s_slave_0", devmasters[i]); sprintf(veth0, "veth0_to_%s", devmasters[i]); netlink_add_veth(sock, slave0, veth0); sprintf(slave1, "%s_slave_1", devmasters[i]); sprintf(veth1, "veth1_to_%s", devmasters[i]); netlink_add_veth(sock, slave1, veth1); sprintf(master, "%s0", devmasters[i]); netlink_device_change(sock, slave0, false, master, 0, 0); netlink_device_change(sock, slave1, false, master, 0, 0); } netlink_device_change(sock, "bridge_slave_0", true, 0, 0, 0); netlink_device_change(sock, "bridge_slave_1", true, 0, 0, 0); netlink_add_veth(sock, "hsr_slave_0", "veth0_to_hsr"); netlink_add_veth(sock, "hsr_slave_1", "veth1_to_hsr"); netlink_add_hsr(sock, "hsr0", "hsr_slave_0", "hsr_slave_1"); netlink_device_change(sock, "hsr_slave_0", true, 0, 0, 0); netlink_device_change(sock, "hsr_slave_1", true, 0, 0, 0); for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) { char addr[32]; sprintf(addr, DEV_IPV4, i + 10); netlink_add_addr4(sock, devices[i].name, addr); if (!devices[i].noipv6) { sprintf(addr, DEV_IPV6, i + 10); netlink_add_addr6(sock, devices[i].name, addr); } uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40); netlink_device_change(sock, devices[i].name, true, 0, &macaddr, devices[i].macsize); } close(sock); } static void initialize_netdevices_init(void) { int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); struct { const char* type; int macsize; bool noipv6; bool noup; } devtypes[] = { {"nr", 7, true}, {"rose", 5, true, true}, }; unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) { char dev[32], addr[32]; sprintf(dev, "%s%d", devtypes[i].type, (int)procid); sprintf(addr, "172.30.%d.%d", i, (int)procid + 1); netlink_add_addr4(sock, dev, addr); if (!devtypes[i].noipv6) { sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1); netlink_add_addr6(sock, dev, addr); } int macsize = devtypes[i].macsize; uint64_t macaddr = 0xbbbbbb + ((unsigned long long)i << (8 * (macsize - 2))) + (procid << (8 * (macsize - 1))); netlink_device_change(sock, dev, !devtypes[i].noup, 0, &macaddr, macsize); } close(sock); } static int read_tun(char* data, int size) { if (tunfd < 0) return -1; int rv = read(tunfd, data, size); if (rv < 0) { if (errno == EAGAIN) return -1; if (errno == EBADFD) return -1; exit(1); } return rv; } static void flush_tun() { char data[SYZ_TUN_MAX_PACKET_SIZE]; while (read_tun(&data[0], sizeof(data)) != -1) { } } #define USB_DEBUG 0 #define USB_MAX_EP_NUM 32 struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; unsigned config_length; struct usb_interface_descriptor* iface; struct usb_endpoint_descriptor* eps[USB_MAX_EP_NUM]; unsigned eps_num; }; static bool parse_usb_descriptor(char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config) + sizeof(*index->iface)) return false; index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->config_length = length - sizeof(*index->dev); index->iface = (struct usb_interface_descriptor*)(buffer + sizeof(*index->dev) + sizeof(*index->config)); index->eps_num = 0; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_ENDPOINT) { index->eps[index->eps_num] = (struct usb_endpoint_descriptor*)(buffer + offset); index->eps_num++; } if (index->eps_num == USB_MAX_EP_NUM) break; offset += desc_length; } return true; } enum usb_fuzzer_event_type { USB_FUZZER_EVENT_INVALID, USB_FUZZER_EVENT_CONNECT, USB_FUZZER_EVENT_DISCONNECT, USB_FUZZER_EVENT_SUSPEND, USB_FUZZER_EVENT_RESUME, USB_FUZZER_EVENT_CONTROL, }; struct usb_fuzzer_event { uint32_t type; uint32_t length; char data[0]; }; struct usb_fuzzer_init { uint64_t speed; const char* driver_name; const char* device_name; }; struct usb_fuzzer_ep_io { uint16_t ep; uint16_t flags; uint32_t length; char data[0]; }; #define USB_FUZZER_IOCTL_INIT _IOW('U', 0, struct usb_fuzzer_init) #define USB_FUZZER_IOCTL_RUN _IO('U', 1) #define USB_FUZZER_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_fuzzer_event) #define USB_FUZZER_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_fuzzer_ep_io) #define USB_FUZZER_IOCTL_EP0_READ _IOWR('U', 4, struct usb_fuzzer_ep_io) #define USB_FUZZER_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor) #define USB_FUZZER_IOCTL_EP_WRITE _IOW('U', 7, struct usb_fuzzer_ep_io) #define USB_FUZZER_IOCTL_EP_READ _IOWR('U', 8, struct usb_fuzzer_ep_io) #define USB_FUZZER_IOCTL_CONFIGURE _IO('U', 9) #define USB_FUZZER_IOCTL_VBUS_DRAW _IOW('U', 10, uint32_t) int usb_fuzzer_open() { return open("/sys/kernel/debug/usb-fuzzer", O_RDWR); } int usb_fuzzer_init(int fd, uint32_t speed, const char* driver, const char* device) { struct usb_fuzzer_init arg; arg.speed = speed; arg.driver_name = driver; arg.device_name = device; return ioctl(fd, USB_FUZZER_IOCTL_INIT, &arg); } int usb_fuzzer_run(int fd) { return ioctl(fd, USB_FUZZER_IOCTL_RUN, 0); } int usb_fuzzer_event_fetch(int fd, struct usb_fuzzer_event* event) { return ioctl(fd, USB_FUZZER_IOCTL_EVENT_FETCH, event); } int usb_fuzzer_ep0_write(int fd, struct usb_fuzzer_ep_io* io) { return ioctl(fd, USB_FUZZER_IOCTL_EP0_WRITE, io); } int usb_fuzzer_ep0_read(int fd, struct usb_fuzzer_ep_io* io) { return ioctl(fd, USB_FUZZER_IOCTL_EP0_READ, io); } int usb_fuzzer_ep_write(int fd, struct usb_fuzzer_ep_io* io) { return ioctl(fd, USB_FUZZER_IOCTL_EP_WRITE, io); } int usb_fuzzer_ep_read(int fd, struct usb_fuzzer_ep_io* io) { return ioctl(fd, USB_FUZZER_IOCTL_EP_READ, io); } int usb_fuzzer_ep_enable(int fd, struct usb_endpoint_descriptor* desc) { return ioctl(fd, USB_FUZZER_IOCTL_EP_ENABLE, desc); } int usb_fuzzer_configure(int fd) { return ioctl(fd, USB_FUZZER_IOCTL_CONFIGURE, 0); } int usb_fuzzer_vbus_draw(int fd, uint32_t power) { return ioctl(fd, USB_FUZZER_IOCTL_VBUS_DRAW, power); } #define USB_MAX_PACKET_SIZE 1024 struct usb_fuzzer_control_event { struct usb_fuzzer_event inner; struct usb_ctrlrequest ctrl; char data[USB_MAX_PACKET_SIZE]; }; struct usb_fuzzer_ep_io_data { struct usb_fuzzer_ep_io inner; char data[USB_MAX_PACKET_SIZE]; }; struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char* default_string = "syzkaller"; static bool lookup_connect_response(struct vusb_connect_descriptors* descs, struct usb_device_index* index, struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { uint8_t str_idx; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (str_idx >= descs->strs_len) { *response_data = (char*)default_string; *response_length = strlen(default_string); } else { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; } return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: *response_data = descs->qual; *response_length = descs->qual_len; return true; default: exit(1); return false; } break; default: exit(1); return false; } break; default: exit(1); return false; } return false; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; char* dev = (char*)a2; struct vusb_connect_descriptors* descs = (struct vusb_connect_descriptors*)a3; if (!dev) { return -1; } struct usb_device_index index; memset(&index, 0, sizeof(index)); int rv = 0; NONFAILING(rv = parse_usb_descriptor(dev, dev_len, &index)); if (!rv) { return rv; } int fd = usb_fuzzer_open(); if (fd < 0) { return fd; } char device[32]; sprintf(&device[0], "dummy_udc.%llu", procid); rv = usb_fuzzer_init(fd, speed, "dummy_udc", &device[0]); if (rv < 0) { return rv; } rv = usb_fuzzer_run(fd); if (rv < 0) { return rv; } bool done = false; while (!done) { struct usb_fuzzer_control_event event; event.inner.type = 0; event.inner.length = sizeof(event.ctrl); rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event); if (rv < 0) { return rv; } if (event.inner.type != USB_FUZZER_EVENT_CONTROL) continue; bool response_found = false; char* response_data = NULL; uint32_t response_length = 0; if (event.ctrl.bRequestType & USB_DIR_IN) { NONFAILING(response_found = lookup_connect_response(descs, &index, &event.ctrl, &response_data, &response_length)); if (!response_found) { return -1; } } else { if ((event.ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD || event.ctrl.bRequest != USB_REQ_SET_CONFIGURATION) { exit(1); return -1; } done = true; } if (done) { rv = usb_fuzzer_vbus_draw(fd, index.config->bMaxPower); if (rv < 0) { return rv; } rv = usb_fuzzer_configure(fd); if (rv < 0) { return rv; } unsigned ep; for (ep = 0; ep < index.eps_num; ep++) { rv = usb_fuzzer_ep_enable(fd, index.eps[ep]); if (rv < 0) { } else { } } } struct usb_fuzzer_ep_io_data response; response.inner.ep = 0; response.inner.flags = 0; if (response_length > sizeof(response.data)) response_length = 0; if (event.ctrl.wLength < response_length) response_length = event.ctrl.wLength; response.inner.length = response_length; if (response_data) memcpy(&response.data[0], response_data, response_length); else memset(&response.data[0], 0, response_length); if (event.ctrl.bRequestType & USB_DIR_IN) rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response); else rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response); if (rv < 0) { return rv; } } sleep_ms(200); return fd; } struct vusb_descriptor { uint8_t req_type; uint8_t desc_type; uint32_t len; char data[0]; } __attribute__((packed)); struct vusb_descriptors { uint32_t len; struct vusb_descriptor* generic; struct vusb_descriptor* descs[0]; } __attribute__((packed)); struct vusb_response { uint8_t type; uint8_t req; uint32_t len; char data[0]; } __attribute__((packed)); struct vusb_responses { uint32_t len; struct vusb_response* generic; struct vusb_response* resps[0]; } __attribute__((packed)); static bool lookup_control_response(struct vusb_descriptors* descs, struct vusb_responses* resps, struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { int descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) / sizeof(descs->descs[0]); int resps_num = (resps->len - offsetof(struct vusb_responses, resps)) / sizeof(resps->resps[0]); uint8_t req = ctrl->bRequest; uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK; uint8_t desc_type = ctrl->wValue >> 8; if (req == USB_REQ_GET_DESCRIPTOR) { int i; for (i = 0; i < descs_num; i++) { struct vusb_descriptor* desc = descs->descs[i]; if (!desc) continue; if (desc->req_type == req_type && desc->desc_type == desc_type) { *response_length = desc->len; if (*response_length != 0) *response_data = &desc->data[0]; else *response_data = NULL; return true; } } if (descs->generic) { *response_data = &descs->generic->data[0]; *response_length = descs->generic->len; return true; } } else { int i; for (i = 0; i < resps_num; i++) { struct vusb_response* resp = resps->resps[i]; if (!resp) continue; if (resp->type == req_type && resp->req == req) { *response_length = resp->len; if (*response_length != 0) *response_data = &resp->data[0]; else *response_data = NULL; return true; } } if (resps->generic) { *response_data = &resps->generic->data[0]; *response_length = resps->generic->len; return true; } } return false; } static volatile long syz_usb_control_io(volatile long a0, volatile long a1, volatile long a2) { int fd = a0; struct vusb_descriptors* descs = (struct vusb_descriptors*)a1; struct vusb_responses* resps = (struct vusb_responses*)a2; struct usb_fuzzer_control_event event; event.inner.type = 0; event.inner.length = USB_MAX_PACKET_SIZE; int rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event); if (rv < 0) { return rv; } if (event.inner.type != USB_FUZZER_EVENT_CONTROL) { return -1; } bool response_found = false; char* response_data = NULL; uint32_t response_length = 0; if (event.ctrl.bRequestType & USB_DIR_IN) { NONFAILING(response_found = lookup_control_response(descs, resps, &event.ctrl, &response_data, &response_length)); if (!response_found) { return -1; } } else { response_length = event.ctrl.wLength; } struct usb_fuzzer_ep_io_data response; response.inner.ep = 0; response.inner.flags = 0; if (response_length > sizeof(response.data)) response_length = 0; if (event.ctrl.wLength < response_length) response_length = event.ctrl.wLength; response.inner.length = response_length; if (response_data) memcpy(&response.data[0], response_data, response_length); else memset(&response.data[0], 0, response_length); if (event.ctrl.bRequestType & USB_DIR_IN) { rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response); } else { rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response); } if (rv < 0) { return rv; } sleep_ms(200); return 0; } static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; NONFAILING(strncpy(buf, (char*)a0, sizeof(buf) - 1)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } static void setup_cgroups() { if (mkdir("/syzcgroup", 0777)) { } if (mkdir("/syzcgroup/unified", 0777)) { } if (mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL)) { } if (chmod("/syzcgroup/unified", 0777)) { } write_file("/syzcgroup/unified/cgroup.subtree_control", "+cpu +memory +io +pids +rdma"); if (mkdir("/syzcgroup/cpu", 0777)) { } if (mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,perf_event,hugetlb")) { } write_file("/syzcgroup/cpu/cgroup.clone_children", "1"); if (chmod("/syzcgroup/cpu", 0777)) { } if (mkdir("/syzcgroup/net", 0777)) { } if (mount("none", "/syzcgroup/net", "cgroup", 0, "net_cls,net_prio,devices,freezer")) { } if (chmod("/syzcgroup/net", 0777)) { } } static void setup_cgroups_loop() { int pid = getpid(); char file[128]; char cgroupdir[64]; snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid); if (mkdir(cgroupdir, 0777)) { } snprintf(file, sizeof(file), "%s/pids.max", cgroupdir); write_file(file, "32"); snprintf(file, sizeof(file), "%s/memory.low", cgroupdir); write_file(file, "%d", 298 << 20); snprintf(file, sizeof(file), "%s/memory.high", cgroupdir); write_file(file, "%d", 299 << 20); snprintf(file, sizeof(file), "%s/memory.max", cgroupdir); write_file(file, "%d", 300 << 20); snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir); write_file(file, "%d", pid); snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid); if (mkdir(cgroupdir, 0777)) { } snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir); write_file(file, "%d", pid); snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid); if (mkdir(cgroupdir, 0777)) { } snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir); write_file(file, "%d", pid); } static void setup_cgroups_test() { char cgroupdir[64]; snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid); if (symlink(cgroupdir, "./cgroup")) { } snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid); if (symlink(cgroupdir, "./cgroup.cpu")) { } snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid); if (symlink(cgroupdir, "./cgroup.net")) { } } static void setup_common() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } setup_cgroups(); } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); setsid(); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); setup_common(); sandbox_common(); drop_caps(); initialize_netdevices_init(); if (unshare(CLONE_NEWNET)) { } initialize_tun(); initialize_netdevices(); loop(); exit(1); } #define FS_IOC_SETFLAGS _IOW('f', 2, long) static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; int iter = 0; retry: while (umount2(dir, MNT_DETACH) == 0) { } dp = opendir(dir); if (dp == NULL) { if (errno == EMFILE) { exit(1); } exit(1); } while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); while (umount2(filename, MNT_DETACH) == 0) { } struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } int i; for (i = 0;; i++) { if (unlink(filename) == 0) break; if (errno == EPERM) { int fd = open(filename, O_RDONLY); if (fd != -1) { long flags = 0; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) close(fd); continue; } } if (errno == EROFS) { break; } if (errno != EBUSY || i > 100) exit(1); if (umount2(filename, MNT_DETACH)) exit(1); } } closedir(dp); int i; for (i = 0;; i++) { if (rmdir(dir) == 0) break; if (i < 100) { if (errno == EPERM) { int fd = open(dir, O_RDONLY); if (fd != -1) { long flags = 0; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) close(fd); continue; } } if (errno == EROFS) { break; } if (errno == EBUSY) { if (umount2(dir, MNT_DETACH)) exit(1); continue; } if (errno == ENOTEMPTY) { if (iter < 100) { iter++; goto retry; } } } exit(1); } } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); int i; for (i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_loop() { setup_cgroups_loop(); } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); setup_cgroups_test(); write_file("/proc/self/oom_score_adj", "1000"); flush_tun(); } static void close_fds() { int fd; for (fd = 3; fd < 30; fd++) close(fd); } static void setup_binfmt_misc() { if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) { } write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:"); write_file("/proc/sys/fs/binfmt_misc/register", ":syz1:M:1:\x02::./file0:POC"); } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 6; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 0 ? 2000 : 0) + (call == 1 ? 300 : 0) + (call == 2 ? 300 : 0) + (call == 4 ? 2000 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); close_fds(); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { setup_loop(); int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res; switch (call) { case 0: NONFAILING(memcpy( (void*)0x20000400, "\x12\x01\x00\x00\x00\x00\x00\x20\x6d\x04\x1c\xc7\x40\x00\x00\x00\x00" "\x01\x09\x02\x24\x00\x01\x00\x00\xa0\x00\x09\x04\x00\x00\x09\x03\x01" "\x01\x00\x09\x21\x00\x00\x00\x01\x22\x15\x00\x09\x05\x81\x03\x00\x00" "\x00\x00\x00\xee\xb4\x88\x8f\xff\xfc\x1f\xe0\x2d\xa3\x65\xa9\xc4\xce" "\xfe\x8b\x90\x61\x70\x1c\x3c\xcd\x35\x2d\x15\x83\x2b\xe2\x59\x85\x90" "\x20\x08\x5b\x4a\x55\x25\xda\xaa\xfd\xc4\x9f\x59\x66\xf9\x00\x63\x4c" "\x11\xc5\x62\x10\x23\x5d\xca\x74\xb0\x5a\xbe\xdf\x3b\x46\xe5\xd9\x29" "\x2b\x05\x00\xe1\x8c\x4a\x00\x00\x00\x00\x9c\xc7\x04\xcc\x79\x15\x55" "\x97\x94\x80\x5a\x7a\xb1\x3d\x44\x84\x90\xdb\xac\xf2\x68\xac\x24\x72" "\x3a\xcf\x3c\xa4\x84\x0a\xf0\x39\xb7\xf9\xb8\x36\xbd\xe4\x66\xbe\x4d" "\x32\x35\x99\x80\x1b\x61\xa4\xa4\xfd\x48\x44\xf9\xeb\xc1\xd2\xc0\x99" "\xd1\x74\x7d\x8a\x91\xb7\x62\xf8\x21\x02\x49\x1b\x72\x36\x20\xa3\xb8" "\x27\x0a\x84\x5f\xf9\xf1\xc3\xb2\x59\x2b\x1c\x7b\xf2\x32\x64\xe0\x73" "\x61\x9b\x76\x05\xc4\x6f\xe4\x0f\xa7\xc3\xf5\x04\xd8\xc8\xea\x34\xf3" "\xb2\x2e\x92\x00\x55\xf2\x4e\x2e\xb6\x78\xb7\x27\xfb\x1a\xc5\xfd\x57" "\x81\x44\xe9\x37\xfd\x37\xa0\xd3\xc6\x04\x6a\xbd\xe8\x52\x6b\x5f\xca" "\xf1\x40\xe7\xf4\x81\x2a\x08\x24\xfa\x5f\x4d\x83\x94\x8b\xa6\x68\xf5" "\x6a\xe3\xe8\x62\x0d\x99\xb9\xc1\xf7\x85\x82\x65\x28\x78\x50\x84\x94" "\xe0\xc4\x14\xf9\x8f\x00\x11\xe4\x80\x59\xb8\x75\x82\x9a\x88\x8f\xe1" "\x7b\x21\xdf\xa2\x20\x06\xeb\xc7\x72\x17\x4d\x01\x54\x90\xa6\x44\x73" "\xe4\xc9\x35\x70\x45\x01\x30\x1c\xf5\x2e\xd2\x74\x04\xac\x30\xd1\x8c" "\xbb\xee\xe2\x4d\x2b\x8f\x6e\x05\x9c\x28\x8d\x50\xcc\x67\xf3\x86\x7c" "\xe5\x40\x31\xe1\x90\x5d\xc7\xc5\xea\xa2\x6b\xe3\xf4\x42\xf0\x3b\x58" "\xa2\x86\xa0\xfd\xf0\xf9\xf5\x56\xb7\x2c\xe8\x9f\x13\xbc\xd8\xe8\x93" "\xda\x40\x0a\xd1\x31\x8d\x76\xa8\x62\xa7\x6f\xb7\xa1\x49\xaf\x39\x37" "\x9d\x9f\x4e\xdf\x33\xe0\x83\xb8\x26\x9d\xa2\x4c\xc9\xf0\x90\xff\xe7" "\xeb\x07\x8a\x60\x50\x1f\x47\x43\x95\x46\x5e\x68\x7f\x67\xcf\xef\x7b" "\xc9\x04\x42\xc4\x2d\x43\xd1\x08\x41\x3a\x24\xdc\x94\x25\xf0\xb3\x26" "\xc2\xf3\x75\x9c\xb7\x96\xfa\x6a\x86\x75\x57\x55\x08\x49\xb6\xc9\xc5" "\xa3\x4b\x7a\x64\x98\xeb\xd5\x0e\x4e\x0c\xe1\xda\x1d\x05\x8d\xeb\x3d" "\x42\x44\x73\x32\xcb\xbd\xe6\xec\xc1\x23\xcc\x2e\x4d\x4d\x3e\x50\x2b" "\xdd\xa0\xdb\xc9\x54\x78\xa0\x2c\xef\xc6\xdf\x24\x2c\xca\x03\x8f\xc4" "\x38\x36\x94\xde\x69\x8b\xec\xde\xeb\xdc\xe5\x9a\x82\xff\x59\x44\x83" "\x31\x9b\x51\xea\xed\xd1\x51\xc3\xf8\x9f\x28\x21\x03\x45\xf0\xc8\xa4" "\x1d\x0d\x95\x7b\x4c\x11\xb9\x04\xab\x8a\x11\x46\x43\x88\x31\x63\xb1" "\x68\x27\x5d\xc3\x8b\x0d\x9d\x64\xfc\xc9\xd1\x62\x3f\xcb\xf0\x7e\x5a" "\x33\x6a\x0f\x00\x00\x00\x00\x00\x00\x0a\x37\x25\x33\x11\x27\x6f\xf7" "\x04\x39\xc7\x6d\xef\xb6\x22\x9b\xb9\x59\xb0\x07\xf3\x41\xce\x76\x6c" "\x42\x91\x20\x98\x57\x70\x75\x9f\x34\xda\x7c\x1c\x5f\x0b\xbc\x9c\xac" "\xbf\x7f\xe7\x09\x00\x00\x00\xc5\x5a\x93\xdc\xf8\x42\x86\x4e\x00\x00" "\x00", 681)); res = syz_usb_connect(0, 0x36, 0x20000400, 0); if (res != -1) r[0] = res; break; case 1: syz_usb_control_io(r[0], 0, 0); break; case 2: NONFAILING(*(uint32_t*)0x20000340 = 0x34); NONFAILING(*(uint64_t*)0x20000344 = 0); NONFAILING(*(uint64_t*)0x2000034c = 0); NONFAILING(*(uint64_t*)0x20000354 = 0); NONFAILING(*(uint64_t*)0x2000035c = 0x20000380); NONFAILING(memcpy( (void*)0x20000380, "\x00\x22\x15\x00\x00\x00\x8e\x03\xdd\x03\x4f\x4e\x37\x85\x15\xe0\x81", 17)); NONFAILING(*(uint32_t*)0x20001bc0 = 0xcc); NONFAILING(*(uint64_t*)0x20001bc4 = 0); NONFAILING(*(uint64_t*)0x20001bcc = 0); NONFAILING(*(uint64_t*)0x20001bd4 = 0); NONFAILING(*(uint64_t*)0x20001bdc = 0); NONFAILING(*(uint64_t*)0x20001be4 = 0); syz_usb_control_io(r[0], 0x20000340, 0x20001bc0); break; case 3: NONFAILING(memcpy((void*)0x200002c0, "/dev/hidraw#\000", 13)); res = syz_open_dev(0x200002c0, 0, 1); if (res != -1) r[1] = res; break; case 4: NONFAILING(*(uint8_t*)0x20000000 = 0x12); NONFAILING(*(uint8_t*)0x20000001 = 1); NONFAILING(*(uint16_t*)0x20000002 = 0x110); NONFAILING(*(uint8_t*)0x20000004 = 0); NONFAILING(*(uint8_t*)0x20000005 = 0); NONFAILING(*(uint8_t*)0x20000006 = 0); NONFAILING(*(uint8_t*)0x20000007 = 8); NONFAILING(*(uint16_t*)0x20000008 = 0x46d); NONFAILING(*(uint16_t*)0x2000000a = 0x57); NONFAILING(*(uint16_t*)0x2000000c = 0x40); NONFAILING(*(uint8_t*)0x2000000e = 0xf1); NONFAILING(*(uint8_t*)0x2000000f = 4); NONFAILING(*(uint8_t*)0x20000010 = 3); NONFAILING(*(uint8_t*)0x20000011 = 1); NONFAILING(*(uint8_t*)0x20000012 = 9); NONFAILING(*(uint8_t*)0x20000013 = 2); NONFAILING(*(uint16_t*)0x20000014 = 0x24); NONFAILING(*(uint8_t*)0x20000016 = 1); NONFAILING(*(uint8_t*)0x20000017 = 1); NONFAILING(*(uint8_t*)0x20000018 = 0xb7); NONFAILING(*(uint8_t*)0x20000019 = 0xd0); NONFAILING(*(uint8_t*)0x2000001a = 0x87); NONFAILING(*(uint8_t*)0x2000001b = 9); NONFAILING(*(uint8_t*)0x2000001c = 4); NONFAILING(*(uint8_t*)0x2000001d = 0); NONFAILING(*(uint8_t*)0x2000001e = -1); NONFAILING(*(uint8_t*)0x2000001f = 9); NONFAILING(*(uint8_t*)0x20000020 = 3); NONFAILING(*(uint8_t*)0x20000021 = 1); NONFAILING(*(uint8_t*)0x20000022 = 3); NONFAILING(*(uint8_t*)0x20000023 = 0); NONFAILING(*(uint8_t*)0x20000024 = 9); NONFAILING(*(uint8_t*)0x20000025 = 0x21); NONFAILING(*(uint16_t*)0x20000026 = 4); NONFAILING(*(uint8_t*)0x20000028 = 0); NONFAILING(*(uint8_t*)0x20000029 = 1); NONFAILING(*(uint8_t*)0x2000002a = 0x22); NONFAILING(*(uint16_t*)0x2000002b = 0x35f); NONFAILING(*(uint8_t*)0x2000002d = 9); NONFAILING(*(uint8_t*)0x2000002e = 5); NONFAILING(*(uint8_t*)0x2000002f = 0x81); NONFAILING(*(uint8_t*)0x20000030 = 3); NONFAILING(*(uint16_t*)0x20000031 = 0x20); NONFAILING(*(uint8_t*)0x20000033 = 1); NONFAILING(*(uint8_t*)0x20000034 = 1); NONFAILING(*(uint8_t*)0x20000035 = 0); NONFAILING(*(uint32_t*)0x20000200 = 0xa); NONFAILING(*(uint64_t*)0x20000204 = 0x20000040); NONFAILING(*(uint8_t*)0x20000040 = 0xa); NONFAILING(*(uint8_t*)0x20000041 = 6); NONFAILING(*(uint16_t*)0x20000042 = 0x201); NONFAILING(*(uint8_t*)0x20000044 = 0xcf); NONFAILING(*(uint8_t*)0x20000045 = 1); NONFAILING(*(uint8_t*)0x20000046 = 8); NONFAILING(*(uint8_t*)0x20000047 = 0x28); NONFAILING(*(uint8_t*)0x20000048 = 9); NONFAILING(*(uint8_t*)0x20000049 = 0); NONFAILING(*(uint32_t*)0x2000020c = 0xf4); NONFAILING(*(uint64_t*)0x20000210 = 0x20000080); NONFAILING(*(uint8_t*)0x20000080 = 5); NONFAILING(*(uint8_t*)0x20000081 = 0xf); NONFAILING(*(uint16_t*)0x20000082 = 0xf4); NONFAILING(*(uint8_t*)0x20000084 = 6); NONFAILING(*(uint8_t*)0x20000085 = 0xb); NONFAILING(*(uint8_t*)0x20000086 = 0x10); NONFAILING(*(uint8_t*)0x20000087 = 1); NONFAILING(*(uint8_t*)0x20000088 = 0xc); NONFAILING(*(uint16_t*)0x20000089 = 0x80); NONFAILING(*(uint8_t*)0x2000008b = 5); NONFAILING(*(uint8_t*)0x2000008c = 2); NONFAILING(*(uint16_t*)0x2000008d = 6); NONFAILING(*(uint8_t*)0x2000008f = 0); NONFAILING(*(uint8_t*)0x20000090 = 0xc5); NONFAILING(*(uint8_t*)0x20000091 = 0x10); NONFAILING(*(uint8_t*)0x20000092 = 1); NONFAILING(memcpy( (void*)0x20000093, "\xd0\x69\x9f\x83\x3a\x70\x4f\x2d\x64\x03\xa4\x92\x6e\x8f\xc8\x6a\x52" "\xc4\xbc\xcb\x0c\xef\x39\x4f\x8d\x0d\x3e\x10\xd9\xe3\xdf\xd1\x16\x46" "\x5c\x0e\x25\xed\x6a\xce\x44\x14\x6e\x6a\x0b\x36\xfb\x32\xba\x9f\xe4" "\xd2\x04\xbc\x8b\x33\x31\x1e\xc9\xe3\x9d\x12\x9c\x92\x14\xb5\x08\x2b" "\x6a\x0a\x1b\x60\x78\xa1\x9b\x76\x57\x30\xae\x90\x3d\x3e\x50\xc6\x3f" "\xe2\xa6\x60\x6a\x4b\x8d\x4f\xf9\x10\x17\x2b\x18\x67\xb0\xd3\xb9\x45" "\xde\x30\x93\x9d\x8a\xfd\x98\x92\xa4\xaa\x0e\xec\x7a\x5f\xaa\xd8\x99" "\x0f\x51\x9b\x4c\x41\x9e\x1d\xd3\x2c\x32\x2f\xce\xa3\x03\xdb\xe6\x70" "\xe3\xbb\xa2\x56\xc0\xda\xea\x65\xa0\xb0\x83\x57\x0a\xa4\xb5\x1c\x7a" "\xb4\xca\xb9\xde\x34\xb0\x0f\x4a\xff\x50\x99\xcc\xb4\x6d\xb9\xe9\x94" "\x6d\xa1\x05\xea\xa0\x60\x98\x2d\x7a\xbc\x1c\xac\xb7\x77\x81\x9f\x61" "\xf3\xb3\xb8\xcb\x34\xcb\x4c", 194)); NONFAILING(*(uint8_t*)0x20000155 = 0xb); NONFAILING(*(uint8_t*)0x20000156 = 0x10); NONFAILING(*(uint8_t*)0x20000157 = 1); NONFAILING(*(uint8_t*)0x20000158 = 0xc); NONFAILING(*(uint16_t*)0x20000159 = 2); NONFAILING(*(uint8_t*)0x2000015b = 6); NONFAILING(*(uint8_t*)0x2000015c = 0x66); NONFAILING(*(uint16_t*)0x2000015d = 9); NONFAILING(*(uint8_t*)0x2000015f = 0); NONFAILING(*(uint8_t*)0x20000160 = 3); NONFAILING(*(uint8_t*)0x20000161 = 0x10); NONFAILING(*(uint8_t*)0x20000162 = 0xb); NONFAILING(*(uint8_t*)0x20000163 = 0xa); NONFAILING(*(uint8_t*)0x20000164 = 0x10); NONFAILING(*(uint8_t*)0x20000165 = 3); NONFAILING(*(uint8_t*)0x20000166 = 2); NONFAILING(*(uint16_t*)0x20000167 = 8); NONFAILING(*(uint8_t*)0x20000169 = 3); NONFAILING(*(uint8_t*)0x2000016a = 1); NONFAILING(*(uint16_t*)0x2000016b = 0xfeff); NONFAILING(*(uint8_t*)0x2000016d = 7); NONFAILING(*(uint8_t*)0x2000016e = 0x10); NONFAILING(*(uint8_t*)0x2000016f = 2); NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000170, 4, 0, 8)); NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000170, 6, 8, 4)); NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000170, 9, 12, 4)); NONFAILING(STORE_BY_BITMASK(uint32_t, , 0x20000170, 7, 16, 16)); NONFAILING(*(uint32_t*)0x20000218 = 3); NONFAILING(*(uint32_t*)0x2000021c = 0x31); NONFAILING(*(uint64_t*)0x20000220 = 0x20000180); NONFAILING(*(uint8_t*)0x20000180 = 0x31); NONFAILING(*(uint8_t*)0x20000181 = 3); NONFAILING(*(uint16_t*)0x20000182 = 0x425); NONFAILING(memcpy((void*)0x20000184, "\x61\x3f\x58\x96\x52\x67\x38\x4c\x87" "\xfb\x08\xae\xcb\xfd\x12\xd5\xd5\x0e" "\x5d\x57\xa8\x5f\xba\xfb\x18\x9f\xa1" "\xd9\xe5\x21\xe9\x6b\xc4\xec\x25\xfa" "\x77\x64\x90\x79\x42\x07\x46\x9d\x27", 45)); NONFAILING(*(uint32_t*)0x20000228 = 4); NONFAILING(*(uint64_t*)0x2000022c = 0x200001c0); NONFAILING(*(uint8_t*)0x200001c0 = 4); NONFAILING(*(uint8_t*)0x200001c1 = 3); NONFAILING(*(uint16_t*)0x200001c2 = 0x80c); NONFAILING(*(uint32_t*)0x20000234 = 0); NONFAILING(*(uint64_t*)0x20000238 = 0); syz_usb_connect(6, 0x36, 0x20000000, 0x20000200); break; case 5: syscall(__NR_ioctl, r[1], 0x80404804, 0x20000240); break; } } int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); setup_binfmt_misc(); install_segv_handler(); for (procid = 0; procid < 6; procid++) { if (fork() == 0) { use_temporary_dir(); do_sandbox_none(); } } sleep(1000000); return 0; }