// https://syzkaller.appspot.com/bug?id=d547cd6cbe394dbc852abbfee48f80925dfbe0e5 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } struct nlmsg { char* pos; int nesting; struct nlattr* nested[8]; char buf[4096]; }; static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, const void* data, int size) { memset(nlmsg, 0, sizeof(*nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; if (size > 0) memcpy(attr + 1, data, size); nlmsg->pos += NLMSG_ALIGN(attr->nla_len); } static void netlink_nest(struct nlmsg* nlmsg, int typ) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_type = typ; nlmsg->pos += sizeof(*attr); nlmsg->nested[nlmsg->nesting++] = attr; } static void netlink_done(struct nlmsg* nlmsg) { struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; attr->nla_len = nlmsg->pos - (char*)attr; } static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, int* reply_len, bool dofail) { if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != (ssize_t)hdr->nlmsg_len) { if (dofail) exit(1); return -1; } n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); if (reply_len) *reply_len = 0; if (n < 0) { if (dofail) exit(1); return -1; } if (n < (ssize_t)sizeof(struct nlmsghdr)) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type == NLMSG_DONE) return 0; if (reply_len && hdr->nlmsg_type == reply_type) { *reply_len = n; return 0; } if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type != NLMSG_ERROR) { errno = EINVAL; if (dofail) exit(1); return -1; } errno = -((struct nlmsgerr*)(hdr + 1))->error; return -errno; } static int netlink_send(struct nlmsg* nlmsg, int sock) { return netlink_send_ext(nlmsg, sock, 0, NULL, true); } static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = CTRL_CMD_GETFAMILY; netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); int n = 0; int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); if (err < 0) { return -1; } uint16_t id = 0; struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { id = *(uint16_t*)(attr + 1); break; } } if (!id) { errno = EINVAL; return -1; } recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); return id; } static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type, const char* name, bool up) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); if (name) netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); netlink_nest(nlmsg, IFLA_LINKINFO); netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type)); } static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up, const char* master, const void* mac, int macsize, const char* new_name) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; hdr.ifi_index = if_nametoindex(name); netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); if (master) { int ifindex = if_nametoindex(master); netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); } if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev, const void* addr, int addrsize) { struct ifaddrmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; hdr.ifa_scope = RT_SCOPE_UNIVERSE; hdr.ifa_index = if_nametoindex(dev); netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr)); netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); return netlink_send(nlmsg, sock); } static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in_addr in_addr; inet_pton(AF_INET, addr, &in_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); if (err < 0) { } } static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in6_addr in6_addr; inet_pton(AF_INET6, addr, &in6_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); if (err < 0) { } } static void netlink_add_neigh(struct nlmsg* nlmsg, int sock, const char* name, const void* addr, int addrsize, const void* mac, int macsize) { struct ndmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ndm_ifindex = if_nametoindex(name); hdr.ndm_state = NUD_PERMANENT; netlink_init(nlmsg, RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); netlink_attr(nlmsg, NDA_DST, addr, addrsize); netlink_attr(nlmsg, NDA_LLADDR, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static struct nlmsg nlmsg; static int tunfd = -1; #define TUN_IFACE "syz_tun" #define LOCAL_MAC 0xaaaaaaaaaaaa #define REMOTE_MAC 0xaaaaaaaaaabb #define LOCAL_IPV4 "172.20.20.170" #define REMOTE_IPV4 "172.20.20.187" #define LOCAL_IPV6 "fe80::aa" #define REMOTE_IPV6 "fe80::bb" #define IFF_NAPI 0x0010 static void initialize_tun(void) { tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); if (tunfd == -1) { printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n"); printf("otherwise fuzzing or reproducing might not work as intended\n"); return; } const int kTunFd = 200; if (dup2(tunfd, kTunFd) < 0) exit(1); close(tunfd); tunfd = kTunFd; struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ); ifr.ifr_flags = IFF_TAP | IFF_NO_PI; if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) { exit(1); } char sysctl[64]; sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE); write_file(sysctl, "0"); sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE); write_file(sysctl, "0"); int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); netlink_add_addr4(&nlmsg, sock, TUN_IFACE, LOCAL_IPV4); netlink_add_addr6(&nlmsg, sock, TUN_IFACE, LOCAL_IPV6); uint64_t macaddr = REMOTE_MAC; struct in_addr in_addr; inet_pton(AF_INET, REMOTE_IPV4, &in_addr); netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in_addr, sizeof(in_addr), &macaddr, ETH_ALEN); struct in6_addr in6_addr; inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr); netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), &macaddr, ETH_ALEN); macaddr = LOCAL_MAC; netlink_device_change(&nlmsg, sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN, NULL); close(sock); } #define WIFI_INITIAL_DEVICE_COUNT 2 #define WIFI_MAC_BASE \ { \ 0x08, 0x02, 0x11, 0x00, 0x00, 0x00 \ } #define WIFI_IBSS_BSSID \ { \ 0x50, 0x50, 0x50, 0x50, 0x50, 0x50 \ } #define WIFI_IBSS_SSID \ { \ 0x10, 0x10, 0x10, 0x10, 0x10, 0x10 \ } #define WIFI_DEFAULT_FREQUENCY 2412 #define WIFI_DEFAULT_SIGNAL 0 #define WIFI_DEFAULT_RX_RATE 1 #define HWSIM_CMD_REGISTER 1 #define HWSIM_CMD_FRAME 2 #define HWSIM_CMD_NEW_RADIO 4 #define HWSIM_ATTR_SUPPORT_P2P_DEVICE 14 #define HWSIM_ATTR_PERM_ADDR 22 #define IF_OPER_UP 6 struct join_ibss_props { int wiphy_freq; bool wiphy_freq_fixed; uint8_t* mac; uint8_t* ssid; int ssid_len; }; static int set_interface_state(const char* interface_name, int on) { struct ifreq ifr; int sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { return -1; } memset(&ifr, 0, sizeof(ifr)); strcpy(ifr.ifr_name, interface_name); int ret = ioctl(sock, SIOCGIFFLAGS, &ifr); if (ret < 0) { close(sock); return -1; } if (on) ifr.ifr_flags |= IFF_UP; else ifr.ifr_flags &= ~IFF_UP; ret = ioctl(sock, SIOCSIFFLAGS, &ifr); close(sock); if (ret < 0) { return -1; } return 0; } static int nl80211_set_interface(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, uint32_t iftype, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL80211_CMD_SET_INTERFACE; netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(nlmsg, NL80211_ATTR_IFTYPE, &iftype, sizeof(iftype)); int err = netlink_send_ext(nlmsg, sock, 0, NULL, dofail); if (err < 0) { } return err; } static int nl80211_join_ibss(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, struct join_ibss_props* props, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL80211_CMD_JOIN_IBSS; netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(nlmsg, NL80211_ATTR_SSID, props->ssid, props->ssid_len); netlink_attr(nlmsg, NL80211_ATTR_WIPHY_FREQ, &(props->wiphy_freq), sizeof(props->wiphy_freq)); if (props->mac) netlink_attr(nlmsg, NL80211_ATTR_MAC, props->mac, ETH_ALEN); if (props->wiphy_freq_fixed) netlink_attr(nlmsg, NL80211_ATTR_FREQ_FIXED, NULL, 0); int err = netlink_send_ext(nlmsg, sock, 0, NULL, dofail); if (err < 0) { } return err; } static int get_ifla_operstate(struct nlmsg* nlmsg, int ifindex, bool dofail) { struct ifinfomsg info; memset(&info, 0, sizeof(info)); info.ifi_family = AF_UNSPEC; info.ifi_index = ifindex; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) { return -1; } netlink_init(nlmsg, RTM_GETLINK, 0, &info, sizeof(info)); int n; int err = netlink_send_ext(nlmsg, sock, RTM_NEWLINK, &n, dofail); close(sock); if (err) { return -1; } struct rtattr* attr = IFLA_RTA(NLMSG_DATA(nlmsg->buf)); for (; RTA_OK(attr, n); attr = RTA_NEXT(attr, n)) { if (attr->rta_type == IFLA_OPERSTATE) return *((int32_t*)RTA_DATA(attr)); } return -1; } static int await_ifla_operstate(struct nlmsg* nlmsg, char* interface, int operstate, bool dofail) { int ifindex = if_nametoindex(interface); while (true) { usleep(1000); int ret = get_ifla_operstate(nlmsg, ifindex, dofail); if (ret < 0) return ret; if (ret == operstate) return 0; } return 0; } static int nl80211_setup_ibss_interface(struct nlmsg* nlmsg, int sock, int nl80211_family_id, char* interface, struct join_ibss_props* ibss_props, bool dofail) { int ifindex = if_nametoindex(interface); if (ifindex == 0) { return -1; } int ret = nl80211_set_interface(nlmsg, sock, nl80211_family_id, ifindex, NL80211_IFTYPE_ADHOC, dofail); if (ret < 0) { return -1; } ret = set_interface_state(interface, 1); if (ret < 0) { return -1; } ret = nl80211_join_ibss(nlmsg, sock, nl80211_family_id, ifindex, ibss_props, dofail); if (ret < 0) { return -1; } return 0; } static int hwsim80211_create_device(struct nlmsg* nlmsg, int sock, int hwsim_family, uint8_t mac_addr[ETH_ALEN]) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = HWSIM_CMD_NEW_RADIO; netlink_init(nlmsg, hwsim_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, HWSIM_ATTR_SUPPORT_P2P_DEVICE, NULL, 0); netlink_attr(nlmsg, HWSIM_ATTR_PERM_ADDR, mac_addr, ETH_ALEN); int err = netlink_send(nlmsg, sock); if (err < 0) { } return err; } static void initialize_wifi_devices(void) { int rfkill = open("/dev/rfkill", O_RDWR); if (rfkill == -1) exit(1); struct rfkill_event event = {0}; event.type = RFKILL_TYPE_ALL; event.op = RFKILL_OP_CHANGE_ALL; if (write(rfkill, &event, sizeof(event)) != (ssize_t)(sizeof(event))) exit(1); close(rfkill); uint8_t mac_addr[6] = WIFI_MAC_BASE; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock < 0) exit(1); int hwsim_family_id = netlink_query_family_id(&nlmsg, sock, "MAC80211_HWSIM", true); int nl80211_family_id = netlink_query_family_id(&nlmsg, sock, "nl80211", true); if (hwsim_family_id < 0 || nl80211_family_id < 0) exit(1); uint8_t ssid[] = WIFI_IBSS_SSID; uint8_t bssid[] = WIFI_IBSS_BSSID; struct join_ibss_props ibss_props = {.wiphy_freq = WIFI_DEFAULT_FREQUENCY, .wiphy_freq_fixed = true, .mac = bssid, .ssid = ssid, .ssid_len = sizeof(ssid)}; for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) { mac_addr[5] = device_id; int ret = hwsim80211_create_device(&nlmsg, sock, hwsim_family_id, mac_addr); if (ret < 0) exit(1); char interface[6] = "wlan0"; interface[4] += device_id; if (nl80211_setup_ibss_interface(&nlmsg, sock, nl80211_family_id, interface, &ibss_props, true) < 0) exit(1); } for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) { char interface[6] = "wlan0"; interface[4] += device_id; int ret = await_ifla_operstate(&nlmsg, interface, IF_OPER_UP, true); if (ret < 0) exit(1); } close(sock); } #define MAX_FDS 30 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static struct usb_device_index* lookup_usb_index(int fd) { for (int i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) return &usb_devices[i].index; } return NULL; } static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index)) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = {8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0}; static const char default_lang_id[] = {4, USB_DT_STRING, 0x09, 0x04}; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, struct usb_qualifier_descriptor* qual, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_data = (char*)qual; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)( int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic( int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } #define UDC_NAME_LENGTH_MAX 128 struct usb_raw_init { __u8 driver_name[UDC_NAME_LENGTH_MAX]; __u8 device_name[UDC_NAME_LENGTH_MAX]; __u8 speed; }; enum usb_raw_event_type { USB_RAW_EVENT_INVALID = 0, USB_RAW_EVENT_CONNECT = 1, USB_RAW_EVENT_CONTROL = 2, }; struct usb_raw_event { __u32 type; __u32 length; __u8 data[0]; }; struct usb_raw_ep_io { __u16 ep; __u16 flags; __u32 length; __u8 data[0]; }; #define USB_RAW_EPS_NUM_MAX 30 #define USB_RAW_EP_NAME_MAX 16 #define USB_RAW_EP_ADDR_ANY 0xff struct usb_raw_ep_caps { __u32 type_control : 1; __u32 type_iso : 1; __u32 type_bulk : 1; __u32 type_int : 1; __u32 dir_in : 1; __u32 dir_out : 1; }; struct usb_raw_ep_limits { __u16 maxpacket_limit; __u16 max_streams; __u32 reserved; }; struct usb_raw_ep_info { __u8 name[USB_RAW_EP_NAME_MAX]; __u32 addr; struct usb_raw_ep_caps caps; struct usb_raw_ep_limits limits; }; struct usb_raw_eps_info { struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX]; }; #define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init) #define USB_RAW_IOCTL_RUN _IO('U', 1) #define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event) #define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io) #define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io) #define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor) #define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32) #define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io) #define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io) #define USB_RAW_IOCTL_CONFIGURE _IO('U', 9) #define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32) #define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info) #define USB_RAW_IOCTL_EP0_STALL _IO('U', 12) #define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32) #define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32) #define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32) static int usb_raw_open() { return open("/dev/raw-gadget", O_RDWR); } static int usb_raw_init(int fd, uint32_t speed, const char* driver, const char* device) { struct usb_raw_init arg; strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name)); strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name)); arg.speed = speed; return ioctl(fd, USB_RAW_IOCTL_INIT, &arg); } static int usb_raw_run(int fd) { return ioctl(fd, USB_RAW_IOCTL_RUN, 0); } static int usb_raw_configure(int fd) { return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0); } static int usb_raw_vbus_draw(int fd, uint32_t power) { return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power); } static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io) { return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io); } static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io) { return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io); } static int usb_raw_event_fetch(int fd, struct usb_raw_event* event) { return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event); } static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc) { return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc); } static int usb_raw_ep_disable(int fd, int ep) { return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep); } static int usb_raw_ep0_stall(int fd) { return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0); } #define USB_MAX_PACKET_SIZE 4096 struct usb_raw_control_event { struct usb_raw_event inner; struct usb_ctrlrequest ctrl; char data[USB_MAX_PACKET_SIZE]; }; struct usb_raw_ep_io_data { struct usb_raw_ep_io inner; char data[USB_MAX_PACKET_SIZE]; }; static void set_interface(int fd, int n) { struct usb_device_index* index = lookup_usb_index(fd); if (!index) return; if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) { for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) { int rv = usb_raw_ep_disable( fd, index->ifaces[index->iface_cur].eps[ep].handle); if (rv < 0) { } else { } } } if (n >= 0 && n < index->ifaces_num) { for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) { int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc); if (rv < 0) { } else { index->ifaces[n].eps[ep].handle = rv; } } index->iface_cur = n; } } static int configure_device(int fd) { struct usb_device_index* index = lookup_usb_index(fd); if (!index) return -1; int rv = usb_raw_vbus_draw(fd, index->bMaxPower); if (rv < 0) { return rv; } rv = usb_raw_configure(fd); if (rv < 0) { return rv; } set_interface(fd, 0); return 0; } static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { if (!dev) { return -1; } int fd = usb_raw_open(); if (fd < 0) { return fd; } if (fd >= MAX_FDS) { close(fd); return -1; } struct usb_device_index* index = add_usb_index(fd, dev, dev_len); if (!index) { return -1; } char device[32]; sprintf(&device[0], "dummy_udc.%llu", procid); int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]); if (rv < 0) { return rv; } rv = usb_raw_run(fd); if (rv < 0) { return rv; } bool done = false; while (!done) { struct usb_raw_control_event event; event.inner.type = 0; event.inner.length = sizeof(event.ctrl); rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event); if (rv < 0) { return rv; } if (event.inner.type != USB_RAW_EVENT_CONTROL) continue; char* response_data = NULL; uint32_t response_length = 0; struct usb_qualifier_descriptor qual; if (event.ctrl.bRequestType & USB_DIR_IN) { if (!lookup_connect_response_in(fd, descs, &event.ctrl, &qual, &response_data, &response_length)) { usb_raw_ep0_stall(fd); continue; } } else { if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) { usb_raw_ep0_stall(fd); continue; } response_data = NULL; response_length = event.ctrl.wLength; } if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { rv = configure_device(fd); if (rv < 0) { return rv; } } struct usb_raw_ep_io_data response; response.inner.ep = 0; response.inner.flags = 0; if (response_length > sizeof(response.data)) response_length = 0; if (event.ctrl.wLength < response_length) response_length = event.ctrl.wLength; response.inner.length = response_length; if (response_data) memcpy(&response.data[0], response_data, response_length); else memset(&response.data[0], 0, response_length); if (event.ctrl.bRequestType & USB_DIR_IN) { rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response); } else { rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response); } if (rv < 0) { return rv; } } sleep_ms(200); return fd; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } #define BTPROTO_HCI 1 #define ACL_LINK 1 #define SCAN_PAGE 2 typedef struct { uint8_t b[6]; } __attribute__((packed)) bdaddr_t; #define HCI_COMMAND_PKT 1 #define HCI_EVENT_PKT 4 #define HCI_VENDOR_PKT 0xff struct hci_command_hdr { uint16_t opcode; uint8_t plen; } __attribute__((packed)); struct hci_event_hdr { uint8_t evt; uint8_t plen; } __attribute__((packed)); #define HCI_EV_CONN_COMPLETE 0x03 struct hci_ev_conn_complete { uint8_t status; uint16_t handle; bdaddr_t bdaddr; uint8_t link_type; uint8_t encr_mode; } __attribute__((packed)); #define HCI_EV_CONN_REQUEST 0x04 struct hci_ev_conn_request { bdaddr_t bdaddr; uint8_t dev_class[3]; uint8_t link_type; } __attribute__((packed)); #define HCI_EV_REMOTE_FEATURES 0x0b struct hci_ev_remote_features { uint8_t status; uint16_t handle; uint8_t features[8]; } __attribute__((packed)); #define HCI_EV_CMD_COMPLETE 0x0e struct hci_ev_cmd_complete { uint8_t ncmd; uint16_t opcode; } __attribute__((packed)); #define HCI_OP_WRITE_SCAN_ENABLE 0x0c1a #define HCI_OP_READ_BUFFER_SIZE 0x1005 struct hci_rp_read_buffer_size { uint8_t status; uint16_t acl_mtu; uint8_t sco_mtu; uint16_t acl_max_pkt; uint16_t sco_max_pkt; } __attribute__((packed)); #define HCI_OP_READ_BD_ADDR 0x1009 struct hci_rp_read_bd_addr { uint8_t status; bdaddr_t bdaddr; } __attribute__((packed)); #define HCI_EV_LE_META 0x3e struct hci_ev_le_meta { uint8_t subevent; } __attribute__((packed)); #define HCI_EV_LE_CONN_COMPLETE 0x01 struct hci_ev_le_conn_complete { uint8_t status; uint16_t handle; uint8_t role; uint8_t bdaddr_type; bdaddr_t bdaddr; uint16_t interval; uint16_t latency; uint16_t supervision_timeout; uint8_t clk_accurancy; } __attribute__((packed)); struct hci_dev_req { uint16_t dev_id; uint32_t dev_opt; }; struct vhci_vendor_pkt_request { uint8_t type; uint8_t opcode; } __attribute__((packed)); struct vhci_pkt { uint8_t type; union { struct { uint8_t opcode; uint16_t id; } __attribute__((packed)) vendor_pkt; struct hci_command_hdr command_hdr; }; } __attribute__((packed)); #define HCIDEVUP _IOW('H', 201, int) #define HCISETSCAN _IOW('H', 221, int) static int vhci_fd = -1; static void rfkill_unblock_all() { int fd = open("/dev/rfkill", O_WRONLY); if (fd < 0) exit(1); struct rfkill_event event = {0}; event.idx = 0; event.type = RFKILL_TYPE_ALL; event.op = RFKILL_OP_CHANGE_ALL; event.soft = 0; event.hard = 0; if (write(fd, &event, sizeof(event)) < 0) exit(1); close(fd); } static void hci_send_event_packet(int fd, uint8_t evt, void* data, size_t data_len) { struct iovec iv[3]; struct hci_event_hdr hdr; hdr.evt = evt; hdr.plen = data_len; uint8_t type = HCI_EVENT_PKT; iv[0].iov_base = &type; iv[0].iov_len = sizeof(type); iv[1].iov_base = &hdr; iv[1].iov_len = sizeof(hdr); iv[2].iov_base = data; iv[2].iov_len = data_len; if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0) exit(1); } static void hci_send_event_cmd_complete(int fd, uint16_t opcode, void* data, size_t data_len) { struct iovec iv[4]; struct hci_event_hdr hdr; hdr.evt = HCI_EV_CMD_COMPLETE; hdr.plen = sizeof(struct hci_ev_cmd_complete) + data_len; struct hci_ev_cmd_complete evt_hdr; evt_hdr.ncmd = 1; evt_hdr.opcode = opcode; uint8_t type = HCI_EVENT_PKT; iv[0].iov_base = &type; iv[0].iov_len = sizeof(type); iv[1].iov_base = &hdr; iv[1].iov_len = sizeof(hdr); iv[2].iov_base = &evt_hdr; iv[2].iov_len = sizeof(evt_hdr); iv[3].iov_base = data; iv[3].iov_len = data_len; if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0) exit(1); } static bool process_command_pkt(int fd, char* buf, ssize_t buf_size) { struct hci_command_hdr* hdr = (struct hci_command_hdr*)buf; if (buf_size < (ssize_t)sizeof(struct hci_command_hdr) || hdr->plen != buf_size - sizeof(struct hci_command_hdr)) exit(1); switch (hdr->opcode) { case HCI_OP_WRITE_SCAN_ENABLE: { uint8_t status = 0; hci_send_event_cmd_complete(fd, hdr->opcode, &status, sizeof(status)); return true; } case HCI_OP_READ_BD_ADDR: { struct hci_rp_read_bd_addr rp = {0}; rp.status = 0; memset(&rp.bdaddr, 0xaa, 6); hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp)); return false; } case HCI_OP_READ_BUFFER_SIZE: { struct hci_rp_read_buffer_size rp = {0}; rp.status = 0; rp.acl_mtu = 1021; rp.sco_mtu = 96; rp.acl_max_pkt = 4; rp.sco_max_pkt = 6; hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp)); return false; } } char dummy[0xf9] = {0}; hci_send_event_cmd_complete(fd, hdr->opcode, dummy, sizeof(dummy)); return false; } static void* event_thread(void* arg) { while (1) { char buf[1024] = {0}; ssize_t buf_size = read(vhci_fd, buf, sizeof(buf)); if (buf_size < 0) exit(1); if (buf_size > 0 && buf[0] == HCI_COMMAND_PKT) { if (process_command_pkt(vhci_fd, buf + 1, buf_size - 1)) break; } } return NULL; } #define HCI_HANDLE_1 200 #define HCI_HANDLE_2 201 #define HCI_PRIMARY 0 #define HCI_OP_RESET 0x0c03 static void initialize_vhci() { int hci_sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI); if (hci_sock < 0) exit(1); vhci_fd = open("/dev/vhci", O_RDWR); if (vhci_fd == -1) exit(1); const int kVhciFd = 202; if (dup2(vhci_fd, kVhciFd) < 0) exit(1); close(vhci_fd); vhci_fd = kVhciFd; struct vhci_vendor_pkt_request vendor_pkt_req = {HCI_VENDOR_PKT, HCI_PRIMARY}; if (write(vhci_fd, &vendor_pkt_req, sizeof(vendor_pkt_req)) != sizeof(vendor_pkt_req)) exit(1); struct vhci_pkt vhci_pkt; if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt)) exit(1); if (vhci_pkt.type == HCI_COMMAND_PKT && vhci_pkt.command_hdr.opcode == HCI_OP_RESET) { char response[1] = {0}; hci_send_event_cmd_complete(vhci_fd, HCI_OP_RESET, response, sizeof(response)); if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt)) exit(1); } if (vhci_pkt.type != HCI_VENDOR_PKT) exit(1); int dev_id = vhci_pkt.vendor_pkt.id; pthread_t th; if (pthread_create(&th, NULL, event_thread, NULL)) exit(1); int ret = ioctl(hci_sock, HCIDEVUP, dev_id); if (ret) { if (errno == ERFKILL) { rfkill_unblock_all(); ret = ioctl(hci_sock, HCIDEVUP, dev_id); } if (ret && errno != EALREADY) exit(1); } struct hci_dev_req dr = {0}; dr.dev_id = dev_id; dr.dev_opt = SCAN_PAGE; if (ioctl(hci_sock, HCISETSCAN, &dr)) exit(1); struct hci_ev_conn_request request; memset(&request, 0, sizeof(request)); memset(&request.bdaddr, 0xaa, 6); *(uint8_t*)&request.bdaddr.b[5] = 0x10; request.link_type = ACL_LINK; hci_send_event_packet(vhci_fd, HCI_EV_CONN_REQUEST, &request, sizeof(request)); struct hci_ev_conn_complete complete; memset(&complete, 0, sizeof(complete)); complete.status = 0; complete.handle = HCI_HANDLE_1; memset(&complete.bdaddr, 0xaa, 6); *(uint8_t*)&complete.bdaddr.b[5] = 0x10; complete.link_type = ACL_LINK; complete.encr_mode = 0; hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete, sizeof(complete)); struct hci_ev_remote_features features; memset(&features, 0, sizeof(features)); features.status = 0; features.handle = HCI_HANDLE_1; hci_send_event_packet(vhci_fd, HCI_EV_REMOTE_FEATURES, &features, sizeof(features)); struct { struct hci_ev_le_meta le_meta; struct hci_ev_le_conn_complete le_conn; } le_conn; memset(&le_conn, 0, sizeof(le_conn)); le_conn.le_meta.subevent = HCI_EV_LE_CONN_COMPLETE; memset(&le_conn.le_conn.bdaddr, 0xaa, 6); *(uint8_t*)&le_conn.le_conn.bdaddr.b[5] = 0x11; le_conn.le_conn.role = 1; le_conn.le_conn.handle = HCI_HANDLE_2; hci_send_event_packet(vhci_fd, HCI_EV_LE_META, &le_conn, sizeof(le_conn)); pthread_join(th, NULL); close(hci_sock); } static void setup_gadgetfs(); static void setup_binderfs(); static void setup_fusectl(); static void sandbox_common_mount_tmpfs(void) { write_file("/proc/sys/fs/mount-max", "100000"); if (mkdir("./syz-tmp", 0777)) exit(1); if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot", 0777)) exit(1); if (mkdir("./syz-tmp/newroot/dev", 0700)) exit(1); unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE; if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/proc", 0700)) exit(1); if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/selinux", 0700)) exit(1); const char* selinux_path = "./syz-tmp/newroot/selinux"; if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) { if (errno != ENOENT) exit(1); if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); } if (mkdir("./syz-tmp/newroot/sys", 0700)) exit(1); if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL)) exit(1); if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/pivot", 0777)) exit(1); if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { if (chdir("./syz-tmp")) exit(1); } else { if (chdir("/")) exit(1); if (umount2("./pivot", MNT_DETACH)) exit(1); } if (chroot("./newroot")) exit(1); if (chdir("/")) exit(1); setup_gadgetfs(); setup_binderfs(); setup_fusectl(); } static void setup_gadgetfs() { if (mkdir("/dev/gadgetfs", 0777)) { } if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) { } } static void setup_fusectl() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void setup_binderfs() { if (mkdir("/dev/binderfs", 0777)) { } if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); if (getppid() == 1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); initialize_vhci(); sandbox_common(); drop_caps(); if (unshare(CLONE_NEWNET)) { } write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); initialize_tun(); initialize_wifi_devices(); sandbox_common_mount_tmpfs(); loop(); exit(1); } static void close_fds() { for (int fd = 3; fd < MAX_FDS; fd++) close(fd); } static const char* setup_binfmt_misc() { if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0) && errno != EBUSY) { return NULL; } if (!write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:") || !write_file("/proc/sys/fs/binfmt_misc/register", ":syz1:M:1:\x02::./file0:POC")) return "write(/proc/sys/fs/binfmt_misc/register) failed"; return NULL; } static void setup_sysctl() { int cad_pid = fork(); if (cad_pid < 0) exit(1); if (cad_pid == 0) { for (;;) sleep(100); } char tmppid[32]; snprintf(tmppid, sizeof(tmppid), "%d", cad_pid); struct { const char* name; const char* data; } files[] = { {"/sys/kernel/debug/x86/nmi_longest_ns", "10000000000"}, {"/proc/sys/kernel/hung_task_check_interval_secs", "20"}, {"/proc/sys/net/core/bpf_jit_kallsyms", "1"}, {"/proc/sys/net/core/bpf_jit_harden", "0"}, {"/proc/sys/kernel/kptr_restrict", "0"}, {"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"}, {"/proc/sys/fs/mount-max", "100"}, {"/proc/sys/vm/oom_dump_tasks", "0"}, {"/proc/sys/debug/exception-trace", "0"}, {"/proc/sys/kernel/printk", "7 4 1 3"}, {"/proc/sys/kernel/keys/gc_delay", "1"}, {"/proc/sys/vm/oom_kill_allocating_task", "1"}, {"/proc/sys/kernel/ctrl-alt-del", "0"}, {"/proc/sys/kernel/cad_pid", tmppid}, }; for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) { if (!write_file(files[i].name, files[i].data)) { } } kill(cad_pid, SIGKILL); while (waitpid(cad_pid, NULL, 0) != cad_pid) ; } #define NL802154_CMD_SET_SHORT_ADDR 11 #define NL802154_ATTR_IFINDEX 3 #define NL802154_ATTR_SHORT_ADDR 10 static const char* setup_802154() { const char* error = NULL; int sock_generic = -1; int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock_route == -1) { error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) failed"; goto fail; } sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock_generic == -1) { error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) failed"; goto fail; } { int nl802154_family_id = netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true); if (nl802154_family_id < 0) { error = "netlink_query_family_id failed"; goto fail; } for (int i = 0; i < 2; i++) { char devname[] = "wpan0"; devname[strlen(devname) - 1] += i; uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8); uint16_t shortaddr = 0xaaa0 + i; int ifindex = if_nametoindex(devname); struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR; netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr, sizeof(shortaddr)); if (netlink_send(&nlmsg, sock_generic) < 0) { error = "NL802154_CMD_SET_SHORT_ADDR failed"; goto fail; } netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr, sizeof(hwaddr), 0); if (i == 0) { netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false); netlink_done(&nlmsg); netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); if (netlink_send(&nlmsg, sock_route) < 0) { error = "netlink: adding device lowpan0 type lowpan link wpan0"; goto fail; } } } } fail: close(sock_route); close(sock_generic); return error; } uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void loop(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0); if (res != -1) r[0] = res; *(uint8_t*)0x200000c0 = 0xfe; *(uint8_t*)0x200000c1 = 0x80; memset((void*)0x200000c2, 0, 13); *(uint8_t*)0x200000cf = 0xaa; *(uint32_t*)0x200000d0 = 0x800; *(uint8_t*)0x200000d4 = 0; *(uint8_t*)0x200000d5 = 1; *(uint16_t*)0x200000d6 = 2; *(uint16_t*)0x200000d8 = 0xf; *(uint16_t*)0x200000da = 0x4002; *(uint32_t*)0x200000dc = 0; syscall(__NR_setsockopt, /*fd=*/r[0], /*level=*/0x29, /*optname=*/0x20, /*optval=*/0x200000c0ul, /*optlen=*/0x20ul); memcpy((void*)0x20000000, "/dev/vhost-vsock\000", 17); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000000ul, /*flags=*/2, /*mode=*/0); if (res != -1) r[1] = res; res = syscall(__NR_pipe2, /*pipefd=*/0x20000040ul, /*flags=*/0ul); if (res != -1) { r[2] = *(uint32_t*)0x20000040; r[3] = *(uint32_t*)0x20000044; } *(uint32_t*)0x20000100 = r[1]; memcpy( (void*)0x20000108, "\x68\xf9\x09\xc4\xee\xce\x4e\xec\x72\xa6\xc3\xe7\xd2\x78\x88\x84\x58\x04" "\x7d\xdc\x12\xb6\x20\xd6\xeb\xc9\x30\x62\xa5\x2b\x06\xc8\x04\x5d\x0f\xe6" "\xbc\xf4\x52\xa4\x23\x51\xf4\xb4\x12\xd2\x2f\xeb\x27\xc1\xe9\x7a\x8a\xc3" "\x87\xdf\xf2\xe7\x6b\x6c\x90\x75\x17\x50\xbb\xb9\x01\x28\x34\xf4\x97\x5e" "\x9e\x02\x76\xdf\x4c\xcb\x29\xc9\xc6\x09\x6b\xe2\x42\x88\x61\x75\xf8\x59" "\xb5\xb0\xdb\x88\xfa\x63\x32\x1f\x2d\x59\xe6\x82\x25\x15\x58\x0d\xd6\x4e" "\xd7\x78\x7f\x4c\xf4\xe4\x80\x8d\x25\xbf\x9e\x24\x20\x9d\x25\x89\x6d\xfe" "\x05\x6c\x94\xef\xcb\x09\xe6\xc7\xf2\x5e\xf9\x1d\xa2\xb8\x90\x7a\xc0\x78" "\xa8\x2d\xd7\xb8\x82\xc1\x69\x48\xe2\x9d\x3e\xf9\xa8\x10\x47\xe1\xf6\xa8" "\xab\xc0\x12\xe0\x54\x0b\x1d\x0b\x9e\x3e\x1e\xd6\xed\x81\x37\xc0\xab\x98" "\xcd\xa8\xb7\x86\x9f\x12\x13\x1b\x71\x1c\x2f\x3e\x3e\x3d\x8d\xed\xa0\x8c" "\xae\x9d\x9a\xa8\x3f\x74\x61\x38\x3d\xe5\x09\xed\x5a\x94\x21\x08\xd5\x62" "\x6e\xf8\xda\xb9\xf8\xaf\x9a\x0b\xf1\xc3\xd6\x3e\xe8\x34\xf2\xa1\x44\x89" "\x99\x9a\x83\xd5\x00\x48\xd4\x37\xb1\x02\x92\x71\x0c\x21\x40\x81\x73\x2e" "\x68\xde\xa3\xcc\x59\x5d\xec\xbc\x64\x5d\x07\x85\xf7\x43\xf8\x74\x2f\x38" "\x84\xa8\x6f\x36\xeb\x5d\xa5\xb4\x9d\x18\xe6\x2b\xa4\x70\x19\x98\x29\xef" "\x1d\x2e\xda\x79\xfe\x51\x4a\x42\xba\x79\x15\x06\xf8\x35\xe1\x49\x61\xe8" "\xde\x1c\x53\x74\xea\x20\xdc\xf1\x84\x68\xb8\x01\xc5\x95\x37\x54\x48\xae" "\x4d\xbc\x82\x9d\xdb\xb4\xf2\xf3\x38\xc3\x94\x13\x0e\x56\xe2\x24\x11\x5b" "\x8d\x7a\x89\xd1\x46\x60\x4a\xee\x3c\x58\x79\x84\x20\x6d\x80\x43\x9a\xbc" "\x97\x87\x72\xe7\xaf\x00\xe0\x57\x7c\xde\x90\x72\xe2\x51\xf8\x14\xe6\xed" "\x04\x37\xe6\x65\x2b\x0d\x0a\xbd\x01\x0c\x3c\xe4\x10\x85\xd7\x28\x6a\x57" "\x33\xe9\x55\x17\x9a\x85\x12\x0c\xf7\x9f\xb7\x7d\x9d\x2e\x58\xfd\x1b\x95" "\x17\x10\xff\xcb\xbe\x4a\x7e\x6f\xb8\xfb\x19\x81\x71\x62\xe2\x69\x29\x1d" "\x07\x78\x24\x9e\x43\xc9\x46\xde\xf9\x58\x1d\x5f\xf0\xe9\x6e\x67\xe0\xa7" "\x2c\xb6\xc5\x2e\x83\xf2\x4d\x45\x20\x97\xa6\x0c\x4f\x36\x65\xd0\x6c\xc9" "\xfc\x96\x7f\x0c\xaa\x09\xf3\xb4\xfa\x26\x3f\x84\x26\x90\xb4\x6b\x6d\x6c" "\x61\x50\x88\x64\x51\x87\xdb\xba\x96\xf0\x8e\x9d\x50\x01\x5a\x35\x89\xef" "\xcc\xea\xd3\xba\xa9\x98\xe0\x40\xe4\xbb\x16\xe1\xed\x7b\x73\xab\x6d\xe3" "\x27\x3a\x7b\x51\x38\x07\x24\xb0\xb0\xa2\x0c\xee\xa4\x76\x7f\x09\x1f\x69" "\x8b\xfe\x71\xe3\x41\x87\x46\x64\x11\x7d\x3a\x18\xe3\x31\xfe\x03\xa2\x52" "\x94\xa3\x64\xf8\xec\xda\x80\xe4\xb9\x45\x0c\x21\x4c\x11\xc5\x0e\x19\xcb" "\x48\x7d\x20\xed\x3b\x3b\xeb\xe7\x28\xf7\xa6\x09\x88\xf6\x3a\xdc\x43\xd7" "\x51\x44\x63\x5c\xfe\x78\x72\x74\x87\x79\xf1\x0b\x24\xfd\x0c\x17\x1b\xd1" "\xf2\x5f\x48\x00\x20\x4c\xb9\x19\xd8\xd3\x73\x95\x5c\xf6\x60\x33\x24\xa1" "\x19\x85\x86\xc8\xea\x17\x13\xb6\xc9\xe4\xb5\x8b\xc4\x4c\x66\x35\xf6\x1c" "\x65\xda\xa2\x16\x09\x15\x51\x53\xcf\xf3\x38\x8b\xd0\xc3\xc3\x02\x6d\x42" "\x95\xfa\xcd\x4a\x3a\x10\xd1\x9b\xad\x47\x00\x8e\xfd\x56\x80\x14\x0e\xa4" "\xc8\x44\x5e\xdd\x19\x6a\xae\x00\xd2\xdf\xe4\xb0\x55\xcf\x31\x4d\xeb\xdc" "\xcd\x5c\x3d\x34\xd1\x0a\x20\x69\xde\x9e\xeb\xd0\xa7\xf5\xd8\x70\x35\x63" "\x4b\x61\x34\x51\x76\x63\x52\xa3\x90\x72\xcf\x8d\x95\xab\x78\xe3\x25\x30" "\xd9\x52\x91\xef\xf5\x79\x29\x4c\xc2\x83\x2e\xba\x9e\xe7\xb1\xfd\x48\x36" "\x2c\xd6\xb5\x43\xee\xc6\x5d\xf9\x98\x22\x9c\x8c\x98\x3a\x5d\x63\xe2\xae" "\x41\xa7\xfb\x6a\x29\xf2\x90\x97\x1a\x18\x01\x90\x54\xe4\x8a\xa5\x02\x13" "\xbe\x81\xff\x98\x56\xaa\x90\x76\x44\xb2\x9e\x50\x2e\xba\x8c\x3e\x1f\xbf" "\x7e\x80\xa1\xc9\xe4\x7b\xd1\x9b\x1c\x68\x6d\xe7\xdf\xa8\x11\xbe\xeb\xf6" "\xb3\x3d\x5e\x86\x66\x3a\x37\xd4\x0e\x73\x85\xfe\xce\xa5\xbb\xcf\xe6\xc6" "\x57\xed\x02\xfa\x7f\xb2\x5e\x48\x5c\x2b\x69\x9b\x26\x0f\xe8\x2c\xc2\x94" "\x39\x30\x93\xb5\xa2\x6a\xe1\xf5\xbc\x6a\xe8\xb7\xb2\x75\xb4\x93\x34\xf8" "\x75\xc1\x85\x90\x78\x2e\x2b\xc5\xbc\xd3\xb1\x01\xc2\x90\xc3\x37\x70\x5f" "\x85\x6e\xe3\xd4\xff\x9b\xce\xe2\x4d\xf5\xff\x2b\xcd\x94\xa8\x17\xc1\x50" "\x55\xd3\x0e\xea\x43\x5a\x17\xce\xab\x89\xa7\x18\xa2\x85\x47\x53\x61\x9f" "\xb7\x5f\x36\xcd\xbe\x62\x5d\x48\x67\xb4\xc0\xbf\xa3\x8d\x09\x87\x28\xc6" "\x74\x58\x93\x05\x9c\xd7\x62\x3a\xd8\x2e\x43\x6d\x9b\x7c\x38\xc7\xb7\xe1" "\x4e\xcb\x34\x4a\x3a\xcd\xa7\xb4\x5b\x19\x7d\xc5\x8c\xf0\x07\x8e\x5b\x03" "\x7d\x3f\x20\x4c\x6d\x70\x36\x86\xe8\x29\xcc\xfa\xca\x02\x76\xeb\xc3\x13" "\x69\x38\x3c\xd1\xf2\x48\x6c\x92\xa8\x81\x4a\xdd\x18\x45\xcb\x9d\xb2\x6f" "\x48\xc6\xa5\xe5\xd2\xcf\xc5\x5f\x28\x3f\x63\xc2\x40\xa4\x05\xbc\xd8\xa1" "\x2c\x28\x8c\x3a\xff\x18\xca\x1a\xdb\xff\xfe\xfa\xbf\x2e\x46\x19\x12\x0d" "\x97\x4f\x59\xde\x19\xa5\xa5\xa6\xe0\xf6\x47\xb1\x7b\x9a\xe7\xae\xc6\x36" "\x47\x12\x73\x79\xa6\xe1\x4d\x0a\x0b\x85\x07\x89\xd5\xce\x38\x67\x0c\x62" "\x46\xc6\xb1\x49\x2e\xec\x23\xb7\x3b\x91\x09\x98\x62\x52\xe8\xa2\x5f\x65" "\x68\xc7\x07\x3b\xa9\x19\xdb\x6d\x2e\xd2\xf3\xca\x0f\x91\xd5\xa1\x60\x20" "\x33\xe7\x44\xea\xd2\x9f\xa4\x46\xe1\x60\xff\xdb\xd3\x74\xb6\x24\x58\xf5" "\x1b\x7b\x5d\x86\x3e\xc0\xa8\x5c\x5f\x29\xc9\x5f\x25\x46\xa4\x26\x89\xaf" "\x11\xf1\x44\x3e\xb4\xf0\xf6\x4b\xad\x94\xf1\x66\xc0\x48\xa9\xed\x81\xe4" "\x53\xac\x38\x7d\xca\xb4\xf3\xcc\x50\x52\xab\xef\x60\xf8\x5c\x05\xe1\x46" "\xcb\xd3\x13\x3f\xd9\x27\xd9\xe3\x5f\x6a\x5f\x82\x85\xb2\x1e\xeb\x8d\x2a" "\xd3\xe1\xdf\x4c\x2b\x06\x9a\xf9\xce\xc3\x6e\xfc\xcf\x5c\xf3\x21\x45\x22" "\xde\xca\x97\x17\xb0\xea\xd5\xfe\x19\x0d\xe9\x52\x35\xe3\xa0\x2e\x06\x10" "\xa4\xac\x57\x4d\x32\x59\xd8\x3e\x34\xfa\x89\x55\x6c\x61\xf5\x97\x4c\xb1" "\xfb\x94\xae\x17\x80\x3d\x5f\xef\x9e\xec\xa6\xb6\x26\x12\x21\x77\x23\xe5" "\x08\x61\x6f\x1b\xa5\x8a\x96\x27\x9e\xf7\xad\x13\x1c\x30\x1e\x7d\xd9\xd7" "\xc7\xf8\x0a\x0b\xc7\x78\x0a\xa7\x0e\xa2\x8a\x10\x62\x4a\x5b\xf3\x80\xbd" "\x7c\x65\xb1\x27\xc2\x28\x6c\xaf\x51\x1d\x8a\x06\x26\x20\x04\x0c\x8a\xdc" "\x27\xef\x83\x0a\x96\xa2\x34\x44\xc8\xff\x08\x53\xbb\x33\x60\x8a\x12\x26" "\x2e\x6a\x5b\xdf\xe9\x4d\xd5\xc7\x27\x81\x1a\x1e\x40\x4b\x3f\x5d\xbc\x12" "\x94\xf0\xfc\x82\xdf\x09\xcb\xfd\xfd\x65\x12\x30\xe6\xb2\x4c\x0e\x29\x2c" "\x4c\xf1\x97\x78\x99\xe3\x3a\x00\x59\x30\x84\x01\x1f\x7e\x5b\x75\x3e\x9a" "\x9f\x2a\x91\x38\xe3\xca\x6e\x1d\x68\xba\x1a\x4b\x20\x7c\x9c\x83\xcc\x0b" "\x60\xc0\x83\x1f\x64\xca\x3c\x83\x95\xb1\x1b\x94\x5b\x48\x54\xc3\x43\x28" "\xa0\xe0\x2c\xb0\xd7\xa2\x19\xf0\xc4\xdb\xf8\x13\xe6\xe5\x1f\xf4\xae\xfe" "\x6f\xc2\x3c\x87\x3e\xfc\xf7\x8b\x9c\x8d\x76\x94\x62\xd4\x43\x0b\x43\x97" "\x1a\xb9\xef\x90\xb4\x91\x4e\xed\x97\x5e\x31\x3f\x23\xf3\x6b\xb3\x30\xf2" "\xbd\x13\x05\x2c\xbf\x97\x43\x7d\x7e\x7e\x16\xdb\x5e\x3f\x25\x43\xcd\xe3" "\x89\x1e\xdf\x50\x36\xff\x65\xd4\xde\x20\x91\x95\x99\x41\xb5\xa3\x2f\xb4" "\xf9\xaa\xf9\x63\x49\x6f\xd6\x23\xcb\x68\x77\xc7\xb3\x1a\x0e\xb9\x18\xbe" "\x4e\x85\x1f\xe0\x8f\xb3\x88\x41\x06\xce\xef\x55\xd9\xfb\xdf\x50\x7a\x58" "\x4a\x80\x8b\x23\x11\x87\xd1\x53\x68\x12\x35\x69\xa5\x08\x4f\x83\x97\xc9" "\x64\xb6\x44\x65\x8f\x7d\x22\x8c\x2a\xe2\x9a\x14\x30\xf3\x3f\x63\xf2\xf6" "\x55\xf6\x6e\xd0\x71\xcd\xe7\xaf\xe8\xff\xe2\x7b\x6e\x50\x19\x61\x18\x32" "\x5a\xd8\x86\x57\xa9\xbf\xa1\x29\xf1\xdb\x83\xff\x22\x47\x47\xcc\x85\x3f" "\x76\x86\x2c\x70\xef\xfb\x7d\x9e\x37\x12\x16\x10\x73\xa9\x80\x3f\x90\x66" "\xb4\xce\xd3\x2d\xe7\xde\x29\x15\x7e\x22\xaf\x20\x67\xcc\x14\x93\xf7\x01" "\x56\x8c\xa5\xaa\xaf\x98\xc1\xb8\x98\xa7\x85\x75\x1c\x61\x11\xd1\xc5\xcb" "\x6f\xf0\xc3\x9b\x51\x8d\xb8\xc7\x1c\x25\x25\xf5\x17\x84\x5b\x63\x84\xfd" "\xdd\x1e\x96\xce\xb2\x20\x7b\xe6\x33\xef\x92\x24\xfc\x2c\xfa\x2b\xcf\xf2" "\x93\x52\x45\x50\x23\x3c\x62\x11\x71\xad\xb0\xf5\x82\x92\x0f\xbf\x5b\x81" "\xcb\xec\xf3\x7a\xe2\xb9\xef\xd9\xd8\xf3\x13\x20\x0d\x43\x30\x67\x32\x1f" "\xa3\x26\x3e\x6b\xa8\xf7\x92\x80\xe0\xec\x6b\x00\x62\x6a\x87\x97\xbd\xef" "\xf8\xc0\xaf\xd9\x71\x8a\x3f\x96\xf7\xc2\xd9\xbf\x66\x5d\x68\xad\x80\x8e" "\xca\x08\x97\x59\x14\x59\xe5\xce\x22\xf5\x0f\x59\x93\x4a\xa8\x92\x67\x3a" "\xc0\xb3\xb8\x1c\x48\x8e\xdd\x5f\x0f\x7b\x63\x4c\xf1\xce\x20\x70\x13\x8f" "\x3a\x50\x57\x64\x8e\x75\x75\x47\x6b\x71\x82\x6f\x22\xda\x16\xfd\x55\x82" "\xdc\x6f\x08\x99\xb1\xcd\xbb\xfc\xdf\x17\x24\x77\x93\x96\xa9\xdf\x0b\xbf" "\xa1\x51\xe6\xf4\xe3\x15\x87\x98\xe0\x09\x26\x0b\xe4\xea\xdc\xde\x6c\xbe" "\xeb\xae\x59\xf8\xcf\x33\x6b\xc5\xef\xc0\xa7\xca\xb2\x4b\xf8\x2d\x53\x0e" "\x45\x90\xe6\x84\x29\xb6\x80\x51\x45\xd9\x92\xb7\xcf\x93\x75\x24\xd1\x43" "\x68\xfc\x15\x05\xec\x5d\x34\x0e\xff\x2d\x22\x08\xfe\xd6\x10\xea\xd6\xaa" "\x35\x2b\x46\x1f\x8b\xad\xfd\x6b\xcc\x22\x43\xaa\xcd\xb4\xdf\x78\x40\xfa" "\x1e\x9b\x92\x97\x71\xdd\xba\x91\xd8\xf7\x24\xd8\x37\xba\xe5\x13\x07\x3a" "\x6c\x4f\xfa\xda\x84\xa8\xff\x99\xd2\xc7\xf5\x5d\x1c\xdf\x16\x94\xa4\x94" "\x0e\x09\xf3\xed\x83\xca\x52\x43\xba\xbe\x87\xaf\x48\x4f\x1f\x14\xca\xf2" "\x89\xca\x9f\x34\xa6\x0e\xc5\x02\x35\x8c\x5c\xa4\xff\x73\xe1\x90\x63\x95" "\x31\x6f\xa2\x38\xd8\x59\xff\x04\x40\xe6\x44\x23\x15\x0b\xe0\x8e\x1a\x5f" "\x3a\xd6\xe0\xbc\x9c\xa8\xec\x57\x6f\x5f\x8a\xa6\xc1\x49\x82\xa3\xe4\xa6" "\xa9\x78\x1a\x67\x95\x0e\xed\x76\x2e\x28\xda\x65\x8c\x29\x12\x83\xda\x5d" "\x24\xb6\x27\x58\x11\xe9\x5b\x6b\x82\x49\x12\x40\x6e\x20\x5f\xf7\xfa\xdf" "\x08\x56\x0d\xb8\xcf\x6e\x3f\xec\xb5\x9b\x8b\x38\x55\x0b\x8e\x01\x2a\x4d" "\xfc\xbb\x56\xbb\x8f\x9a\x2e\x4b\x0f\x70\x9f\x0e\xcb\x1e\x22\x8d\xfa\xf2" "\x4f\xe2\xe3\x6c\xba\x5d\xbb\x96\x2f\x96\x51\xf8\xc7\x75\x91\x04\xcb\x6b" "\x91\xf5\xff\xf2\x7d\x49\x4e\xa8\x2e\x4b\x16\x6a\x18\xf1\x4b\x3d\x6e\x0a" "\xb5\x24\x62\xae\xa2\x1c\xee\xcf\xbf\xd0\xd5\xdc\xa3\xf6\x6e\x13\xf9\x05" "\xa2\xf3\xcf\x92\xdf\xb0\x1a\x1d\x51\x74\x72\xf1\x24\x77\xff\x6d\xa7\x82" "\xb8\xbe\x59\x1d\x2a\x29\x9a\xf9\xfe\x17\xcc\xe4\x54\x9d\x83\x54\x0b\x89" "\x37\xe1\x24\x10\x76\x16\x96\x94\x25\x01\x5e\x5d\x37\x9b\x5f\x64\x2a\xd4" "\x0e\x84\xd9\xa4\x62\x11\xeb\xf8\x52\x80\xd8\x62\x2e\xaa\x2b\xef\x0d\xfd" "\x72\xce\xa9\x8d\x2b\xa2\x0d\xea\x96\x66\xd6\xb2\xc0\xde\x3b\xed\xf9\xcf" "\xad\x8c\xab\x21\x71\x25\xa9\xc2\x6f\xd6\xd3\xfb\x57\xcc\x94\xc2\x0f\x33" "\x1e\x1b\x5c\x4d\x94\xc8\x2d\xf0\xde\x5a\x67\xc4\xe3\x21\x42\xab\xda\x93" "\xae\x95\x46\x6d\xc6\x73\xe1\x99\xd4\xe7\x83\x3e\x51\x1e\xf8\x06\x9a\xa5" "\xdf\x47\xb8\x1a\x26\xca\x5c\x18\xa0\xfc\x35\x89\xaa\xa5\x51\x80\xa4\xf4" "\x3c\xca\x37\xfc\xaa\x3b\x79\x1e\x2d\x8c\xd3\xb5\x68\xb5\x67\xac\x8c\x08" "\xee\x8c\x60\xe9\x42\x79\xb9\x31\xd8\xc7\x84\x72\x8b\x84\xf9\x04\xe5\xff" "\x8c\x6a\xe4\xf4\x7d\x30\x7b\xf6\xf7\x97\xf8\x90\xfe\x69\x16\x63\x78\x36" "\xe6\xdf\xc1\x71\xd7\xf2\xc6\x4e\xa8\x64\x29\x97\xd0\x12\xab\x80\x92\xda" "\x92\xa9\xcb\xa1\x70\x62\x3e\x6e\x17\x6e\x19\x42\xda\x50\xbb\x70\x56\xd9" "\xb3\xe4\x51\x20\x95\xe4\x1e\xc5\xf7\x04\xcc\x14\x52\xb2\x4b\xab\x8f\x1f" "\xe1\xb4\x01\x81\x0b\xf4\x0a\x73\x47\xc4\xfd\x5c\x34\x13\x43\x0a\x6b\xe2" "\x82\x2e\x1a\x98\xc7\x80\x29\x0f\x13\x77\xd7\x6a\xd5\xb7\x93\xae\x96\x52" "\x88\x77\x4f\x27\xa1\xcb\xdb\x28\x61\x8e\xc2\x78\x10\xa4\xee\x1e\x1f\x88" "\x1b\xab\x26\x54\x5e\x6b\x5c\x31\xa5\x61\x1c\x23\xc3\x40\x5f\x44\xaf\x18" "\x4c\x41\x0c\x72\xfc\xcb\x95\x2a\x79\x1d\xd5\x6d\x10\x0c\xdd\x07\xfe\xc6" "\x9b\xf7\x3a\x79\xae\xee\xcc\x3f\xd9\x89\x3b\xaf\xd1\xf2\x97\xe9\x63\x06" "\xa0\xca\xc5\xf6\x13\x81\x26\xcc\x83\x13\x04\xe5\x95\xd3\x14\xde\xfc\xc7" "\x53\xda\x2d\x81\x5d\x3c\xcb\xe2\x52\xf8\x2d\x78\x7b\x92\x48\x45\x0b\x7b" "\xd0\xec\xe9\x99\x05\x40\xc9\x6e\x19\x7c\x2c\x6b\xef\xbf\x54\x49\xda\xf7" "\x8e\x69\xf7\x72\x57\x94\xa0\xaa\xaf\x5a\xaf\x90\x21\x04\x24\x0b\xee\x40" "\x06\x8b\x0c\x2e\x72\xa4\x0d\x58\x84\x9a\xc0\xf2\x27\xbe\x49\x6b\x41\x95" "\xac\xd2\x57\xfc\xc9\x6f\x9a\x3e\x79\xfd\x99\xdc\x3e\xa1\x08\x18\xd0\xab" "\x71\x65\xad\x14\x08\x9b\xd6\x63\x1c\xd8\xd1\x83\xc1\x4e\x4e\xf8\x6a\xbc" "\x6a\xee\x46\x15\xf2\xdd\xe1\xdf\x83\x9e\x65\x11\x4e\x22\x98\xe8\x09\x8a" "\xde\x96\xc6\x68\x7f\xdd\x58\xea\xf0\xad\xc7\x21\x51\xc8\xd0\xa9\x6d\xdb" "\x46\xbe\x6a\xf0\x24\xa0\x8f\xd7\x13\x2c\x01\x41\xb6\x4c\x3e\x17\x80\xfe" "\x67\x26\x79\xb2\xc4\x6c\x90\x8f\xf5\xba\x13\xdf\xe3\x69\x60\xd5\xa9\x10" "\xf7\xe5\xfb\xb7\xc2\x65\x92\xba\xbc\x27\x66\xcf\x98\x77\x9c\x72\x53\x91" "\x3b\x0d\x57\xda\x7b\xfc\x30\x01\x62\xca\x44\x9e\x66\xbf\x17\x93\xd3\x3f" "\xf4\xca\x36\x9d\xb5\x7e\x63\x20\x43\x94\x97\x20\x9f\x8d\x2c\x6a\x2a\x08" "\x30\x98\xc0\x99\x0e\x06\x5d\x03\x8c\x4f\x94\xe5\x12\x72\x91\xf5\x03\x0e" "\xff\xfa\x9b\xc6\xcb\x23\x54\x4a\x1c\x86\x31\xad\xe7\x13\x6a\x6f\x78\x76" "\xf0\xe7\xbf\xa6\x5a\x05\xe3\x8b\xe6\xf6\xd1\x5f\xf5\xa0\x47\x25\x1f\x74" "\xe7\x19\x66\x67\x52\xbf\x4b\xc6\x1f\x05\x5c\x13\x4b\xd9\xf7\x9a\xe1\xc5" "\x6e\x83\xba\xfd\x40\xca\x6d\xaf\x61\x35\x6d\xbe\x8e\xcd\xab\x7d\x52\xb9" "\xd4\x1c\x30\xe4\xe6\x73\xf2\x56\xc5\x4f\x03\x5f\x2d\x6f\x88\x6e\x2b\x0f" "\xdf\x23\x2f\x80\xb9\xdb\x3a\x1b\x8d\x93\x45\x14\xa3\x78\x23\xf7\xbc\x2e" "\xe3\x2d\xc4\x12\x62\xe3\x9e\xb2\x41\x27\xe3\xc0\xcd\x0d\x4d\xf9\x4a\xf9" "\x33\xe3\xdb\x97\x7a\x19\xca\x5b\x93\x49\x8b\x0f\xa6\x53\x9d\xae\x0b\xdb" "\x61\xc2\xbc\xb7\x5d\x4a\xdb\x0a\x61\x51\xef\xd5\xad\x53\x8c\x35\xbd\x4d" "\xd9\xe9\xd1\x3d\x56\x63\x80\x23\x09\xa6\x3a\x8b\x63\xe7\x21\x78\xbd\x15" "\x0a\x46\x4c\x0f\x8b\xa3\x4a\x94\x7e\x3c\x0f\x87\x95\xa5\x88\xae\x0a\xd0" "\x38\xe7\x7e\x0e\x54\x14\xf9\x9d\xb5\x4d\x2a\x13\x00\x1a\xb3\xea\x98\x32" "\x57\x71\x56\x32\x12\x24\xef\xcd\xae\x7c\xad\xf2\xea\x26\x52\x67\x40\x22" "\x88\xde\xb3\x3c\x8e\x33\xfa\xe9\x92\xa7\x2a\xae\x77\x19\x4e\xba\x26\xf4" "\xea\x53\x17\x43\x10\x98\x04\xe4\xbe\xf0\xb1\x22\xa2\x1c\x5c\x61\x99\x33" "\xc0\xdf\x37\x61\x89\x5d\x3e\xdb\xc8\x42\x68\x3b\x0f\x4c\x58\x0e\x67\xc8" "\xdb\xd4\xa7\x95\x49\xdc\xca\x1e\x46\x43\xcf\x96\x0f\x1e\xa1\x01\x12\x43" "\xf0\xb5\x9e\x60\x37\x3b\xd5\x63\xcc\x29\xcd\x1d\xcb\xf8\x0a\x85\x52\xa6" "\x88\xad\x05\x48\x0c\xf5\xad\x11\xbd\x05\x99\xc5\x3c\x0d\x88\x53\xc4\xbf" "\xfe\x78\x85\x57\x2f\x34\xca\x7c\x47\x06\x35\xc1\x17\x57\x39\x5b\xf0\xe5" "\xaa\xf6\xf2\x31\x1b\x5d\xf9\x35\x6d\x83\x60\x99\x0f\x15\x00\x8d\x12\x29" "\x38\x86\x9d\xfc\xa9\xf0\x7e\x51\xa2\xf3\xfc\x1b\x1e\x72\x2a\xc4\x7f\xa5" "\x8e\xeb\xa3\xe2\x3e\x8a\x27\x9b\x1d\xee\x66\x81\x89\x92\x9b\xb3\x82\x10" "\x52\x19\x33\xe6\x5c\x7c\xaa\x85\x08\x24\x76\xa2\xe7\x9c\xa7\x04\x4f\x55" "\xa4\x57\x8c\x53\xe6\x6b\x19\x94\x04\x89\x3c\xda\x51\xac\xf0\x11\xfc\x29" "\x14\x93\x79\x26\x1e\x1d\x92\x4c\xf1\x98\x8c\xe9\xf8\x79\x75\xdb\xba\x7a" "\x8b\xeb\xb0\xbc\x85\xe4\x20\xa2\x37\x91\x85\xbf\xd8\x09\xa9\xc6\x82\x33" "\xc8\xf0\x1d\x47\x1e\x1d\x54\x64\xed\xbf\x76\x1c\x57\xf3\xb0\x55\x16\x77" "\x08\xd0\xf9\x9b\x0b\xb4\x7e\x45\x80\x38\x01\x12\xa6\x91\xd5\xf1\xcc\x12" "\x26\xb7\x83\xdf\x0e\x2a\x22\xf3\x01\x64\xb9\x67\x01\xa9\x08\x9d\xd4\x1e" "\xc6\x2c\xed\x7d\x06\x9e\x30\x21\xd5\xdb\x4e\x1b\xd3\xa3\x49\x67\x26\xd4" "\x0a\x98\xca\x3d\x9f\xec\x33\xaf\x9b\xe1\xb1\x1a\x83\xc4\x60\x45\xbc\x56" "\x80\x76\x64\x33\x49\x36\x81\xd6\xc9\x01\xcd\xf6\x31\xfd\xb6\x8b\x92\x18" "\x8c\xb0\xa9\x15\xfd\x99\x2d\x1f\x67\x3e\x06\xc0\x14\x99\xbf\xd8\xd3\x54" "\x77\x18\x09\x1b\xff\xb6\x05\x17\x48\x34\xec\xbf\x7c\x25\xa9\xd6\xfd\x94" "\x60\xd4\x70\x90\xed\xc4\x91\x11\xfd\x41\x5a\x8d\xf7\x48\xb2\x75\x7d\x53" "\x4d\x5e\xef\x57\x8b\xfa\x0f\xf4\xca\x75\xeb\x83\xb9\x6b\x9f\xd8\x6f\x6a" "\x8f\xed\x54\xef\x21\x10\xa1\xcc\x58\xd3\x19\x70\xa7\x3b\x9d\xba\x77\x82" "\x26\x75\x67\x18\x69\x37\x45\x8a\xec\x32\xf3\x34\x34\x55\xc5\x17\x1d\x61" "\xe0\x8a\x71\x32\xea\xd1\x67\x8a\xe4\x3d\x8c\xc0\xb7\x1f\x07\x15\xbf\x53" "\xf4\x9b\xdc\x55\xbb\x5d\xe7\xeb\x2b\xe0\x46\x3c\x91\xc0\xcd\xd4\x11\xef" "\xf4\x84\xd5\x1e\x35\x3b\xcb\x2c\x38\xbe\x51\x42\x6d\xe7\x82\x94\xc1\x07" "\x11\x5e\x3e\x29\x42\x0c\x1c\xcc\x71\xe0\x99\xaa\x0d\x50\x05\x29\x31\x07" "\xb8\x97\x9a\x12\x76\x34\x26\x6e\x9b\x9f\xbd\x3d\x4e\x0b\x59\xf2\xa1\x60" "\x94\x16\xa7\xa5\xf3\x93\x67\xa4\xd0\xab\xa1\x0b\x35\xf2\x4f\x80\xb8\x5c" "\xb2\xcd\xbb\x7c\x7a\x18\x90\x06\xb8\xe4\x0c\x6d\x0e\xa5\x8d\x2a\xd6\x5b" "\x8b\x16\xa2\xb8\x14\x78\x30\x89\x12\x85\x17\xdc\x03\x39\xf8\x36\x00\xef" "\x79\xb6\x40\x12\x1d\x8e\xe2\xc1\x50\xcf\x90\xef\xf5\xb8\x4a\x49\x41\xc6" "\x23\x97\xfc\x4a\xa1\x5a\x38\xa0\xb6\x89\x80\x01\x71\xc7\x9f\x4b\xfa\x48" "\x35\x12\x2f\x3f\x5b\x72\x56\x0e\x03\x5e\x25\xaf\xfc\xc7\x93\x24\xba\xf2" "\xb2\xc8\xb3\xa7\x18\x40\x27\xfd\xe2\x32\x12\x0f\x84\x4a\x42\x96\xa9\xe9" "\xb1\x53\xb6\x19\x88\xbd\x75\x56\xf2\x19\x79\x1d\x1c\x74\x31\xbe\xb3\xac" "\xce\x1d\x7c\x4c\xf3\xed\xb5\x5d\x1e\x2a\x1f\x1c\x92\x18\xe9\x2c\x92\xcc" "\xef\x41\xfe\x6e\x7c\x9c\xd9\x80\x8f\x7f\xe5\xdc\x18\x9e\x2b\x27\x87\xe1" "\x74\x17\x96\x4e\x0e\xd1\xcb\xfa\xe7\x68\x17\xf6\x66\xc4\x46\x55\x1b\xb0" "\x06\x3d\xa4\x97\x8e\xd9\x71\xda\xcf\x11\xb0\xab\x85\xd4\x27\x34\xa2\x0b" "\x5f\x38\x8b\x12\x72\x3c\xa0\xbe\xce\x67\xdf\xba\xce\xa4\x5c\xa0\xcd\xde" "\x11\x6b\x8c\x19\x83\xb4\xcc\x2a\xa9\xc4\xd1\xc1\x36\x3e\x01\x99\xa4\xec" "\x94\x4a\x9b\xbd\x20\xd7\xec\xc8\xe0\x17\x7f\x98\xc9\xd1\xd1\xc8\x31\x77" "\x10\x33\xad\x86\xaf\x34\x8e\xec\x0c\xdc\x7f\x8a\x26\x2d\xf7\xe6\xae\xd5" "\x64\xd8\xfe\xe9\x5f\x41\x3b\x52\x22\x39\xcd\x3b\x17\xd4\x5e\x2b\xec\xac" "\x48\x2b\xc0\x78\xd5\x18\xd4\x6c\x6c\xe1\xdf\x29\xfc\x1f\xac\xfd\xd5\x03" "\xea\x7f\x34\xf9\xef\x42\x24\xc3\x20\xb8\xb2\x1c\xe2\xb7\xa7\x79\x98\x59" "\x73\x64\xb9\x25\xfc\xb6\xb1\xa2\x03\x40\x3d\x8a\xa7\x46\x2d\x5f\x44\xa6" "\xe9\x2b\x6a\x0b\xee\x7d\x5b\x2f\x16\xa0\x75\x29\x32\x2f\x47\xc6\x05\x32" "\x11\xed\xa2\x4e\xa9\x65\xc1\x9b\x04\x88\x42\x9e\x89\x93\x86\xe8\x7e\x8c" "\xcd\x2a\xc0\x7a\x54\x84\x10\xba\xba\x2c\xe2\x85\x32\x06\xcd\xc5\x89\x2f" "\x58\xe1\xcb\x35\x5b\x83\x0d\x07\x87\x74\x36\xf2\x7e\x96\x35\x9c\x33\xe8" "\xe3\x98", 4088); syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0x5000940b, /*arg=*/0x20000100ul); memcpy((void*)0x20000080, "\x2a\x01\x00\x00\x20\x00\x00\x40\xb7\x08\x00\x00\x00\x00\x00\x00\x03" "\x01\x09\x02\x92\x00\x03\x01\x72\xe5\x00\x09\x04\x00\x00\x00\x01\x01" "\x00\x00\x0a\x24\x01\x00\x00\x00\x02\x01\x02\x0c\x0d\x24\x07\x00\x00" "\x05\x00\x00\x00\x00\x00\x00\x00\x0c\x24\x00\x00\xe9\xff\xff\xf5\xff" "\xff\xff\xff\x09\x24\x03\xf3\xff\x00\x00\x05\x02\x45\x24", 82); *(uint8_t*)0x200000d2 = r[3]; memset((void*)0x200000d3, 5, 1); syz_usb_connect(/*speed=*/0, /*dev_len=*/0xa4, /*dev=*/0x20000080, /*conn_descs=*/0); close_fds(); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); setup_sysctl(); const char* reason; (void)reason; if ((reason = setup_binfmt_misc())) printf("the reproducer may not work as expected: binfmt_misc setup failed: " "%s\n", reason); if ((reason = setup_802154())) printf("the reproducer may not work as expected: 802154 injection setup " "failed: %s\n", reason); use_temporary_dir(); do_sandbox_none(); return 0; }