// https://syzkaller.appspot.com/bug?id=4462682cd32aee8ff03a43c8b9be3963743bc506 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } struct csum_inet { uint32_t acc; }; static void csum_inet_init(struct csum_inet* csum) { csum->acc = 0; } static void csum_inet_update(struct csum_inet* csum, const uint8_t* data, size_t length) { if (length == 0) return; size_t i; for (i = 0; i < length - 1; i += 2) csum->acc += *(uint16_t*)&data[i]; if (length & 1) csum->acc += (uint16_t)data[length - 1]; while (csum->acc > 0xffff) csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16); } static uint16_t csum_inet_digest(struct csum_inet* csum) { return ~csum->acc; } static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } long r[168]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x20f66000, "\x2f\x64\x65\x76\x2f\x73\x67\x23\x00", 9); r[2] = syz_open_dev(0x20f66000ul, 0x0ul, 0x2000000000142ul); *(uint8_t*)0x205c3000 = (uint8_t)0x1; *(uint8_t*)0x205c3001 = (uint8_t)0x84; *(uint16_t*)0x205c3002 = (uint16_t)0x1; *(uint16_t*)0x205c3004 = (uint16_t)0xffffffffffffff01; *(uint16_t*)0x205c3006 = (uint16_t)0x5; *(uint16_t*)0x205c3008 = (uint16_t)0x1; STORE_BY_BITMASK(uint8_t, 0x205c300a, 0x3, 0, 4); STORE_BY_BITMASK(uint8_t, 0x205c300a, 0x6, 4, 4); memcpy((void*)0x205c300b, "\xde\x57\x29", 3); *(uint16_t*)0x205c300e = (uint16_t)0xbc00; *(uint8_t*)0x205c3010 = (uint8_t)0x7f; *(uint8_t*)0x205c3011 = (uint8_t)0x9; *(uint8_t*)0x205c3012 = (uint8_t)0xfe; *(uint8_t*)0x205c3013 = (uint8_t)0x80; *(uint8_t*)0x205c3014 = (uint8_t)0x0; *(uint8_t*)0x205c3015 = (uint8_t)0x0; *(uint8_t*)0x205c3016 = (uint8_t)0x0; *(uint8_t*)0x205c3017 = (uint8_t)0x0; *(uint8_t*)0x205c3018 = (uint8_t)0x0; *(uint8_t*)0x205c3019 = (uint8_t)0x0; *(uint8_t*)0x205c301a = (uint8_t)0x0; *(uint8_t*)0x205c301b = (uint8_t)0x0; *(uint8_t*)0x205c301c = (uint8_t)0x0; *(uint8_t*)0x205c301d = (uint8_t)0x0; *(uint8_t*)0x205c301e = (uint8_t)0x0; *(uint8_t*)0x205c301f = (uint8_t)0x0; *(uint8_t*)0x205c3020 = (uint8_t)0x0; *(uint8_t*)0x205c3021 = (uint8_t)0xaa; *(uint8_t*)0x205c3022 = (uint8_t)0xfe; *(uint8_t*)0x205c3023 = (uint8_t)0x80; *(uint8_t*)0x205c3024 = (uint8_t)0x0; *(uint8_t*)0x205c3025 = (uint8_t)0x0; *(uint8_t*)0x205c3026 = (uint8_t)0x0; *(uint8_t*)0x205c3027 = (uint8_t)0x0; *(uint8_t*)0x205c3028 = (uint8_t)0x0; *(uint8_t*)0x205c3029 = (uint8_t)0x0; *(uint8_t*)0x205c302a = (uint8_t)0x0; *(uint8_t*)0x205c302b = (uint8_t)0x0; *(uint8_t*)0x205c302c = (uint8_t)0x0; *(uint8_t*)0x205c302d = (uint8_t)0x0; *(uint8_t*)0x205c302e = (uint8_t)0x0; *(uint8_t*)0x205c302f = (uint8_t)0x0; *(uint8_t*)0x205c3030 = (uint8_t)0x0; *(uint8_t*)0x205c3031 = (uint8_t)0xaa; *(uint8_t*)0x205c3032 = (uint8_t)0x0; *(uint8_t*)0x205c3033 = (uint8_t)0x1; *(uint8_t*)0x205c3034 = (uint8_t)0x0; *(uint8_t*)0x205c3035 = (uint8_t)0x0; *(uint8_t*)0x205c3036 = (uint8_t)0x0; *(uint8_t*)0x205c3037 = (uint8_t)0x0; *(uint8_t*)0x205c3038 = (uint8_t)0x0; *(uint8_t*)0x205c3039 = (uint8_t)0x0; *(uint8_t*)0x205c303a = (uint8_t)0xfe; *(uint8_t*)0x205c303b = (uint8_t)0x0; *(uint8_t*)0x205c303c = (uint8_t)0xff; *(uint8_t*)0x205c303d = (uint8_t)0x0; *(uint8_t*)0x205c303e = (uint8_t)0xcb; *(uint8_t*)0x205c303f = (uint8_t)0x0; *(uint8_t*)0x205c3040 = (uint8_t)0x5; *(uint8_t*)0x205c3041 = (uint8_t)0x0; *(uint8_t*)0x205c3042 = (uint8_t)0xfe; *(uint8_t*)0x205c3043 = (uint8_t)0x0; *(uint8_t*)0x205c304a = (uint8_t)0x0; *(uint8_t*)0x205c304b = (uint8_t)0x8; *(uint8_t*)0x205c304c = (uint8_t)0x0; *(uint8_t*)0x205c304d = (uint8_t)0x0; *(uint32_t*)0x205c304e = (uint32_t)0x7000000; *(uint8_t*)0x205c3052 = (uint8_t)0xfe; *(uint8_t*)0x205c3053 = (uint8_t)0x80; *(uint8_t*)0x205c3054 = (uint8_t)0x0; *(uint8_t*)0x205c3055 = (uint8_t)0x0; *(uint8_t*)0x205c3056 = (uint8_t)0x0; *(uint8_t*)0x205c3057 = (uint8_t)0x0; *(uint8_t*)0x205c3058 = (uint8_t)0x0; *(uint8_t*)0x205c3059 = (uint8_t)0x0; *(uint8_t*)0x205c305a = (uint8_t)0x0; *(uint8_t*)0x205c305b = (uint8_t)0x0; *(uint8_t*)0x205c305c = (uint8_t)0x0; *(uint8_t*)0x205c305d = (uint8_t)0x0; *(uint8_t*)0x205c305e = (uint8_t)0x0; *(uint8_t*)0x205c305f = (uint8_t)0x0; *(uint8_t*)0x205c3060 = (uint8_t)0x0; *(uint8_t*)0x205c3061 = (uint8_t)0xaa; *(uint8_t*)0x205c3062 = (uint8_t)0x0; *(uint8_t*)0x205c3063 = (uint8_t)0x0; *(uint8_t*)0x205c3064 = (uint8_t)0x0; *(uint8_t*)0x205c3065 = (uint8_t)0x0; *(uint8_t*)0x205c3066 = (uint8_t)0x0; *(uint8_t*)0x205c3067 = (uint8_t)0x0; *(uint8_t*)0x205c3068 = (uint8_t)0x0; *(uint8_t*)0x205c3069 = (uint8_t)0x0; *(uint8_t*)0x205c306a = (uint8_t)0x0; *(uint8_t*)0x205c306b = (uint8_t)0x0; *(uint8_t*)0x205c306c = (uint8_t)0x0; *(uint8_t*)0x205c306d = (uint8_t)0x0; *(uint8_t*)0x205c306e = (uint8_t)0x0; *(uint8_t*)0x205c306f = (uint8_t)0x0; *(uint8_t*)0x205c3070 = (uint8_t)0x0; *(uint8_t*)0x205c3071 = (uint8_t)0x0; *(uint64_t*)0x205c3072 = (uint64_t)0x0; *(uint64_t*)0x205c307a = (uint64_t)0x100000000000000; *(uint8_t*)0x205c3082 = (uint8_t)0x0; *(uint8_t*)0x205c3083 = (uint8_t)0x0; *(uint8_t*)0x205c3084 = (uint8_t)0x0; *(uint8_t*)0x205c3085 = (uint8_t)0x0; *(uint8_t*)0x205c3086 = (uint8_t)0x0; *(uint8_t*)0x205c3087 = (uint8_t)0x0; *(uint8_t*)0x205c3088 = (uint8_t)0x0; *(uint8_t*)0x205c3089 = (uint8_t)0x0; *(uint8_t*)0x205c308a = (uint8_t)0x0; *(uint8_t*)0x205c308b = (uint8_t)0x0; *(uint8_t*)0x205c308c = (uint8_t)0x0; *(uint8_t*)0x205c308d = (uint8_t)0x0; *(uint8_t*)0x205c308e = (uint8_t)0x0; *(uint8_t*)0x205c308f = (uint8_t)0x0; *(uint8_t*)0x205c3090 = (uint8_t)0x0; *(uint8_t*)0x205c3091 = (uint8_t)0x0; *(uint16_t*)0x205c3092 = (uint16_t)0x204e; *(uint16_t*)0x205c3094 = (uint16_t)0x214e; *(uint32_t*)0x205c3096 = (uint32_t)0x42424242; *(uint32_t*)0x205c309a = (uint32_t)0x42424242; STORE_BY_BITMASK(uint8_t, 0x205c309e, 0x0, 0, 1); STORE_BY_BITMASK(uint8_t, 0x205c309e, 0x0, 1, 3); STORE_BY_BITMASK(uint8_t, 0x205c309e, 0x17, 4, 4); *(uint8_t*)0x205c309f = (uint8_t)0x2c; *(uint16_t*)0x205c30a0 = (uint16_t)0x700; *(uint16_t*)0x205c30a2 = (uint16_t)0x0; *(uint16_t*)0x205c30a4 = (uint16_t)0x766f; *(uint8_t*)0x205c30a6 = (uint8_t)0x5; *(uint8_t*)0x205c30a7 = (uint8_t)0x6; *(uint32_t*)0x205c30a8 = (uint32_t)0x4000000; *(uint8_t*)0x205c30ac = (uint8_t)0x5; *(uint8_t*)0x205c30ad = (uint8_t)0x26; *(uint32_t*)0x205c30ae = (uint32_t)0x80000; *(uint32_t*)0x205c30b2 = (uint32_t)0x9000000; *(uint32_t*)0x205c30b6 = (uint32_t)0x1000000; *(uint32_t*)0x205c30ba = (uint32_t)0x1f000000; *(uint32_t*)0x205c30be = (uint32_t)0x3d000000; *(uint32_t*)0x205c30c2 = (uint32_t)0x1000000; *(uint32_t*)0x205c30c6 = (uint32_t)0x1000100; *(uint32_t*)0x205c30ca = (uint32_t)0x1000000; *(uint32_t*)0x205c30ce = (uint32_t)0x1010000; *(uint8_t*)0x205c30d2 = (uint8_t)0x2; *(uint8_t*)0x205c30d3 = (uint8_t)0x4; *(uint16_t*)0x205c30d4 = (uint16_t)0xac1; *(uint8_t*)0x205c30d6 = (uint8_t)0xfe; *(uint8_t*)0x205c30d7 = (uint8_t)0x2; *(uint8_t*)0x205c30d8 = (uint8_t)0x0; *(uint8_t*)0x205c30d9 = (uint8_t)0x13; *(uint8_t*)0x205c30da = (uint8_t)0x12; memcpy((void*)0x205c30db, "\x40\x08\x07\xe3\xee\xe9\xb1\x73\xb4\x08" "\x11\x5e\xf4\x5c\x5e\x18", 16); *(uint8_t*)0x205c30eb = (uint8_t)0x3; *(uint8_t*)0x205c30ec = (uint8_t)0x3; *(uint8_t*)0x205c30ed = (uint8_t)0x6; struct csum_inet csum_157; csum_inet_init(&csum_157); csum_inet_update(&csum_157, (const uint8_t*)0x205c3012, 16); csum_inet_update(&csum_157, (const uint8_t*)0x205c3022, 16); uint32_t csum_157_chunk_2 = 0x5c000000; csum_inet_update(&csum_157, (const uint8_t*)&csum_157_chunk_2, 4); uint32_t csum_157_chunk_3 = 0x6000000; csum_inet_update(&csum_157, (const uint8_t*)&csum_157_chunk_3, 4); csum_inet_update(&csum_157, (const uint8_t*)0x205c3092, 92); *(uint16_t*)0x205c30a2 = csum_inet_digest(&csum_157); r[158] = syscall(__NR_write, r[2], 0x205c3000ul, 0xeeul); *(uint64_t*)0x20442fc0 = (uint64_t)0x2081b000; *(uint64_t*)0x20442fc8 = (uint64_t)0xf6; *(uint64_t*)0x20442fd0 = (uint64_t)0x20e52f67; *(uint64_t*)0x20442fd8 = (uint64_t)0x0; *(uint64_t*)0x20442fe0 = (uint64_t)0x20fae000; *(uint64_t*)0x20442fe8 = (uint64_t)0x0; *(uint64_t*)0x20442ff0 = (uint64_t)0x20a82fcf; *(uint64_t*)0x20442ff8 = (uint64_t)0x0; r[167] = syscall(__NR_readv, r[2], 0x20442fc0ul, 0x4ul); } int main() { loop(); return 0; }