// https://syzkaller.appspot.com/bug?id=2d2b235cd0713f8368d32ae05fb315eeab2215d1 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; *(uint32_t*)0x20000200 = 0xc; *(uint32_t*)0x20000204 = 0xe; *(uint64_t*)0x20000208 = 0x20000100; memcpy((void*)0x20000100, "\xb7\x02\x00\x00\x03\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07" "\x01\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4" "\xf0\xff\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05" "\x00\x00\x00\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00" "\x01\x00\x7d\x60\xb7\x03\x00\x00\x00\x00\x00\x00\x6a\x0a\x00\xfe\x00" "\x00\x00\x00\x85\x00\x00\x00\x0d\x00\x00\x00\xb7\x00\x00\x00\x00\x00" "\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x88\xd2\xd0\x29\xbf\xc9\x41" "\x54\x95\x7c\x76\xe6\x9d\x90\xa4\x19\x30\x2d\xed\x5c\xd3\xe7\xd5\x62" "\x1f\x99\xc9\x57\x84\x67\xce\xc2\x76\xee\xc4\x58\x15\x1e\xde\xf7\xec" "\xed\x71\xae\x13\x7a\xd4\x50\x2e\x22\xfd\xa6\x6b\xe4\x23\x71\x8b\x0f" "\x67\x36\x07\xbd\x5b\x80\x10\x0f\x15\x4a\xc3\x86\x33\xc6\x6a\x1e\x58" "\x24\x80\x1a\x21\xa0\x9b\xc6\xc6\x0c\x98\x03\x7f\xc5\x75\xe5\x6e\xdf" "\xc4", 205); *(uint64_t*)0x20000210 = 0x20000340; memcpy((void*)0x20000340, "syzkaller\000", 10); *(uint32_t*)0x20000218 = 0; *(uint32_t*)0x2000021c = 0; *(uint64_t*)0x20000220 = 0; *(uint32_t*)0x20000228 = 0; *(uint32_t*)0x2000022c = 0; *(uint8_t*)0x20000230 = 0; *(uint8_t*)0x20000231 = 0; *(uint8_t*)0x20000232 = 0; *(uint8_t*)0x20000233 = 0; *(uint8_t*)0x20000234 = 0; *(uint8_t*)0x20000235 = 0; *(uint8_t*)0x20000236 = 0; *(uint8_t*)0x20000237 = 0; *(uint8_t*)0x20000238 = 0; *(uint8_t*)0x20000239 = 0; *(uint8_t*)0x2000023a = 0; *(uint8_t*)0x2000023b = 0; *(uint8_t*)0x2000023c = 0; *(uint8_t*)0x2000023d = 0; *(uint8_t*)0x2000023e = 0; *(uint8_t*)0x2000023f = 0; *(uint32_t*)0x20000240 = 0; *(uint32_t*)0x20000244 = 0; *(uint32_t*)0x20000248 = -1; *(uint32_t*)0x2000024c = 8; *(uint64_t*)0x20000250 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000258 = 0; *(uint32_t*)0x2000025c = 0x10; *(uint64_t*)0x20000260 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x20000268 = 0; res = syscall(__NR_bpf, 5, 0x20000200, 0x48); if (res != -1) r[0] = res; *(uint32_t*)0x200000c0 = r[0]; *(uint32_t*)0x200000c4 = 0x2e5; *(uint32_t*)0x200000c8 = 0xe80; *(uint32_t*)0x200000cc = 0; *(uint64_t*)0x200000d0 = 0x20000280; memcpy((void*)0x20000280, "\xb9\x0e\x03\xb7\x00\x00\x00\x00\x00\x9e\x40\xf0\x89\x06\x1f\xff\xff" "\xe1\x00\x00\x0c\x00\x63\x21\x77\xfb\xac\x14\x14\x14\xe9\xa3\x3f\xa1" "\xc6\x99\xda\x15\x3f\x08\xa0\xe6\xe3\x80\xf6\x01\x0a\xf6\x83\x31\x75" "\x85\xd7\x47\x3f\x1c\xab\x44\x39\xf0\xf5\x70\xff\x15\x5b\xc5\xf7\x3b" "\xa3\xf8\xbb\x99\xa6\xe8\xde\xd1\xce\x48\x5c\xf0\x58\x10\x5c\xd9\x81" "\xb4\x24\x93\x48\x1c\xd6\x59\x41\x6a\x2e\x10\xc9\x11\x96\x64\xf3\x6e" "\xb0\x0b\x33", 105); *(uint64_t*)0x200000d8 = 0; *(uint32_t*)0x200000e0 = 0xfd; *(uint32_t*)0x200000e4 = 0; *(uint32_t*)0x200000e8 = 0; *(uint32_t*)0x200000ec = 0; *(uint64_t*)0x200000f0 = 0x20000000; *(uint64_t*)0x200000f8 = 0x20000000; syscall(__NR_bpf, 0xa, 0x200000c0, 0x28); return 0; }