// https://syzkaller.appspot.com/bug?id=c9f717b49aca3872ae156bace9e55918b9b65e59 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } #ifndef __NR_bpf #define __NR_bpf 321 #endif long r[104]; void* thr(void* arg) { switch ((long)arg) { case 0: r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); break; case 1: r[1] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul); break; case 2: *(uint32_t*)0x20105000 = (uint32_t)0x1; *(uint32_t*)0x20105004 = (uint32_t)0x2; *(uint64_t*)0x20105008 = (uint64_t)0x20414ff0; *(uint64_t*)0x20105010 = (uint64_t)0x20ef4ffa; *(uint32_t*)0x20105018 = (uint32_t)0x1; *(uint32_t*)0x2010501c = (uint32_t)0x80; *(uint64_t*)0x20105020 = (uint64_t)0x2000a000; *(uint32_t*)0x20105028 = (uint32_t)0x0; *(uint32_t*)0x2010502c = (uint32_t)0x0; *(uint8_t*)0x20414ff0 = (uint8_t)0x8db7; *(uint8_t*)0x20414ff1 = (uint8_t)0x0; *(uint16_t*)0x20414ff2 = (uint16_t)0x0; *(uint32_t*)0x20414ff4 = (uint32_t)0x0; *(uint8_t*)0x20414ff8 = (uint8_t)0xd395; *(uint8_t*)0x20414ff9 = (uint8_t)0x0; *(uint16_t*)0x20414ffa = (uint16_t)0x0; *(uint32_t*)0x20414ffc = (uint32_t)0x0; memcpy((void*)0x20ef4ffa, "\x73\x79\x73\x65\x4f\x00", 6); r[20] = syscall(__NR_bpf, 0x5ul, 0x20105000ul, 0x30ul); break; case 3: r[21] = syscall(__NR_socket, 0x29ul, 0x2ul, 0x0ul); break; case 4: *(uint32_t*)0x20a9e000 = r[1]; *(uint32_t*)0x20a9e004 = r[20]; r[24] = syscall(__NR_ioctl, r[21], 0x89e0ul, 0x20a9e000ul); break; case 5: *(uint16_t*)0x20248ff0 = (uint16_t)0x2; *(uint16_t*)0x20248ff2 = (uint16_t)0x234e; *(uint32_t*)0x20248ff4 = (uint32_t)0xffffffff; *(uint8_t*)0x20248ff8 = (uint8_t)0x0; *(uint8_t*)0x20248ff9 = (uint8_t)0x0; *(uint8_t*)0x20248ffa = (uint8_t)0x0; *(uint8_t*)0x20248ffb = (uint8_t)0x0; *(uint8_t*)0x20248ffc = (uint8_t)0x0; *(uint8_t*)0x20248ffd = (uint8_t)0x0; *(uint8_t*)0x20248ffe = (uint8_t)0x0; *(uint8_t*)0x20248fff = (uint8_t)0x0; r[36] = syscall(__NR_bind, r[1], 0x20248ff0ul, 0x10ul); break; case 6: *(uint16_t*)0x20868ff0 = (uint16_t)0x2; *(uint16_t*)0x20868ff2 = (uint16_t)0x234e; *(uint32_t*)0x20868ff4 = (uint32_t)0x0; *(uint8_t*)0x20868ff8 = (uint8_t)0x0; *(uint8_t*)0x20868ff9 = (uint8_t)0x0; *(uint8_t*)0x20868ffa = (uint8_t)0x0; *(uint8_t*)0x20868ffb = (uint8_t)0x0; *(uint8_t*)0x20868ffc = (uint8_t)0x0; *(uint8_t*)0x20868ffd = (uint8_t)0x0; *(uint8_t*)0x20868ffe = (uint8_t)0x0; *(uint8_t*)0x20868fff = (uint8_t)0x0; r[48] = syscall(__NR_connect, r[1], 0x20868ff0ul, 0x10ul); break; case 7: r[49] = syscall(__NR_recvfrom, r[1], 0x20302000ul, 0x0ul, 0x0ul, 0x20000000ul, 0x0ul); break; case 8: *(uint32_t*)0x20c53ffc = (uint32_t)0xffffffffffffffff; r[51] = syscall(__NR_ioctl, r[21], 0x89e2ul, 0x20c53ffcul); if (r[51] != -1) r[52] = *(uint32_t*)0x20c53ffc; break; case 9: *(uint64_t*)0x20814ff0 = (uint64_t)0x0; *(uint64_t*)0x20814ff8 = (uint64_t)0x2710; r[55] = syscall(__NR_setsockopt, r[1], 0x1ul, 0x14ul, 0x20814ff0ul, 0x10ul); break; case 10: memcpy((void*)0x20ff5000, "\x4b\x50\x20\x8b\xe1\x3b\x4d\x7a\xee\x66\x77\x5c\x35\xbb" "\x65\xa7\xe4\x72\xed\xef\x27\x87\x07\xfa\x9d\xe1\xc0\x5e" "\x8b\x96\xfd\xea\xb1\x1b\x67\x12\x9a\x95\x21\x94\x06\xca" "\x9d\x9f\x49\x83\x85\xa4\xa7\x5f", 50); *(uint16_t*)0x20ff5000 = (uint16_t)0x0; memcpy((void*)0x20ff5002, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8); r[59] = syscall(__NR_sendto, r[52], 0x20ff5000ul, 0x32ul, 0x0ul, 0x20ff5000ul, 0xaul); break; case 11: r[60] = syscall(__NR_socket, 0x2ul, 0x806ul, 0x0ul); break; case 12: memcpy((void*)0x2000d000, "\x6c\x6f\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 16); *(uint16_t*)0x2000d010 = (uint16_t)0xfffffffffffffffd; r[63] = syscall(__NR_ioctl, r[60], 0x8914ul, 0x2000d000ul); break; case 13: *(uint32_t*)0x20044f60 = (uint32_t)0x0; *(uint16_t*)0x20044f64 = (uint16_t)0xa; *(uint16_t*)0x20044f66 = (uint16_t)0x204e; *(uint32_t*)0x20044f68 = (uint32_t)0x0; *(uint8_t*)0x20044f6c = (uint8_t)0x0; *(uint8_t*)0x20044f6d = (uint8_t)0x0; *(uint8_t*)0x20044f6e = (uint8_t)0x0; *(uint8_t*)0x20044f6f = (uint8_t)0x0; *(uint8_t*)0x20044f70 = (uint8_t)0x0; *(uint8_t*)0x20044f71 = (uint8_t)0x0; *(uint8_t*)0x20044f72 = (uint8_t)0x0; *(uint8_t*)0x20044f73 = (uint8_t)0x0; *(uint8_t*)0x20044f74 = (uint8_t)0x0; *(uint8_t*)0x20044f75 = (uint8_t)0x0; *(uint8_t*)0x20044f76 = (uint8_t)0x0; *(uint8_t*)0x20044f77 = (uint8_t)0x0; *(uint8_t*)0x20044f78 = (uint8_t)0x0; *(uint8_t*)0x20044f79 = (uint8_t)0x0; *(uint8_t*)0x20044f7a = (uint8_t)0x0; *(uint8_t*)0x20044f7b = (uint8_t)0x0; *(uint32_t*)0x20044f7c = (uint32_t)0x0; *(uint64_t*)0x20044f84 = (uint64_t)0x0; *(uint64_t*)0x20044f8c = (uint64_t)0x0; *(uint64_t*)0x20044f94 = (uint64_t)0x0; *(uint64_t*)0x20044f9c = (uint64_t)0x0; *(uint64_t*)0x20044fa4 = (uint64_t)0x0; *(uint64_t*)0x20044fac = (uint64_t)0x0; *(uint64_t*)0x20044fb4 = (uint64_t)0x0; *(uint64_t*)0x20044fbc = (uint64_t)0x0; *(uint64_t*)0x20044fc4 = (uint64_t)0x0; *(uint64_t*)0x20044fcc = (uint64_t)0x0; *(uint64_t*)0x20044fd4 = (uint64_t)0x0; *(uint64_t*)0x20044fdc = (uint64_t)0x0; *(uint32_t*)0x20044fec = (uint32_t)0x0; *(uint32_t*)0x20044ff0 = (uint32_t)0x40000000; *(uint32_t*)0x20044ff4 = (uint32_t)0x0; *(uint32_t*)0x20044ff8 = (uint32_t)0x0; *(uint32_t*)0x20044ffc = (uint32_t)0x2; *(uint32_t*)0x20042ffe = (uint32_t)0xa0; r[103] = syscall(__NR_getsockopt, 0xfffffffffffffffful, 0x84ul, 0xful, 0x20044f60ul, 0x20042ffeul); break; } return 0; } void test() { long i; pthread_t th[28]; memset(r, -1, sizeof(r)); for (i = 0; i < 14; i++) { pthread_create(&th[i], 0, thr, (void*)i); usleep(rand() % 10000); } usleep(rand() % 100000); } int main() { int i; for (i = 0; i < 8; i++) { if (fork() == 0) { loop(); return 0; } } sleep(1000000); return 0; }