// https://syzkaller.appspot.com/bug?id=797cd651dd0d9bd921e4fa51b792f5afdc3f390f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; *(uint32_t*)0x2000e000 = 0xe; *(uint32_t*)0x2000e004 = 4; *(uint64_t*)0x2000e008 = 0x20000400; memcpy( (void*)0x20000400, "\xb4\x05\x00\x00\x00\x00\x00\x00\x61\x10\x58\x00\x00\x00\x00\x00\xc6\x00" "\x00\x00\x00\x00\x00\x00\x95\x00\x00\x02\x00\x00\x00\x00\x3f\x20\x31\x84" "\x23\xfb\xcd\xc4\xca\xf5\xce\xcc\x8c\x41\xd6\x6d\x1e\x8d\x08\xdc\x03\x63" "\x99\x12\xea\xdc\xc2\xd1\xd4\x55\xac\x64\x7a\x72\x65\x55\x9c\xcd\x4d\xff" "\x72\x3f\x30\x58\x06\x46\x92\x47\x42\xcd\x84\x83\x08\xe1\x23\x08\xfc\xcf" "\xfc\x1b\x5a\x2b\x16\xa0\x4d\xf2\xe7\x0b\x8b\xa7\x91\x21\x74\x28\x13\x58" "\xfb\x0b\x3e\xe8\x34\x62\xaa\x91\x1e\xa0\x7d\xe7\x0d\x93\xcb\xd6\x6d\xa9" "\x06\x2a\x2a\x58\xea\x90\xc6\x40\xac\x14\x99\x5f\x48\x98\x24\x1b\x85\x9b" "\x80\x6a\x0d\xd9\x9d\xa8\x3d\x6a\xfc\x40\x16\xcb\xd2\x0a\x23\x1e\x2b\x56" "\x2c\xbb\xdf\x00\x00\x00\x00\xc4\xcd\x68\xa2\x67\x06\x0a\x9f\xa2\xd7\xa4" "\xdd\x02\x73\x84\x34\xe4\x31\x72\x8b\xa4\x60\xed\x7a\xb5\x7d\xea\x45\x60" "\x81\xf0\x03\x00\x00\x00\x81\x03\x26\x33\x61\x6b\x02\x2c\x5d\x19\x91\x5e" "\x18\xb5\x4d\xa3\xf0\xb2\xc7\x8a\xc2\xb9\xee\x67\xcb\x9e\x4c\x06\x13\x00" "\x00\x34\x8b\xec\x48\x30\xaa\x02\x6a\xf8\x1b\x33\x7d\x1c\xc2\xe0\xf5\x23" "\x0c\x11\xe6\xfb\x2d\x95\xee\x56\x16\x7c\x15\x3f\x75\x11\x96\x41\x35\xee" "\xf9\x60\x37\xc1\x4c\x15\x13\x2b\xdd\x86\x7d\xb8\xdb\xa7\x6e\x62\xe5\x15" "\x0d\xb6\xb1\x95\x52\xfb\x01\xbc\x80\x92\xfd\x86\xb6\x87\xc3\x11\xc3\xc5" "\x37\x21\x6d\x3a\xff\xd7\x42\x17\x10\x8f\x5d\x29\xc3\xa4\xc4\xf7\xe2\x60" "\x2d\xf7\x31\x2f\xfd\x74\x7e\xd6\xa9\xa0\xf1\x9e\x90\x95\x0e\xe7\xb3\xf8" "\x43\x83\xdf\xc2\x56\xee\xb0\xad\xa3\xcc\xa4\x7b\xd7\x67\xef\xdf\xa3\x3e" "\xc2\x20\x9c\x96\x5a\x93\x81\xc9\x83\xd0\x8d\x54\xe8\x12\x00", 375); *(uint64_t*)0x2000e010 = 0x20003ff6; memcpy((void*)0x20003ff6, "GPL\000", 4); *(uint32_t*)0x2000e018 = 4; *(uint32_t*)0x2000e01c = 0xfd90; *(uint64_t*)0x2000e020 = 0x2000cf3d; *(uint32_t*)0x2000e028 = 0; *(uint32_t*)0x2000e02c = 0; memset((void*)0x2000e030, 0, 16); *(uint32_t*)0x2000e040 = 0; *(uint32_t*)0x2000e044 = 0; *(uint32_t*)0x2000e048 = -1; *(uint32_t*)0x2000e04c = 8; *(uint64_t*)0x2000e050 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x2000e058 = 0x366; *(uint32_t*)0x2000e05c = 0x10; *(uint64_t*)0x2000e060 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x2000e068 = 0x187; *(uint32_t*)0x2000e06c = 0; *(uint32_t*)0x2000e070 = -1; res = syscall(__NR_bpf, 5ul, 0x2000e000ul, 0x48ul); if (res != -1) r[0] = res; *(uint64_t*)0x20000e80 = 0x20000740; *(uint16_t*)0x20000740 = 2; *(uint16_t*)0x20000742 = htobe16(0x4e23); *(uint32_t*)0x20000744 = htobe32(0xa010102); *(uint32_t*)0x20000e88 = 0x80; *(uint64_t*)0x20000e90 = 0x20000d00; *(uint64_t*)0x20000d00 = 0x200007c0; *(uint64_t*)0x20000d08 = 0; *(uint64_t*)0x20000d10 = 0x200008c0; memcpy((void*)0x200008c0, "\xce\x9e\x50\xc9\x39\x2e\x11\xaa\xd5\xf3\x6d\xd3\x9a\xa9\x8b\xa7\xe8" "\x06\x0d\xf1\xef\x2b\xad\x9a\x3b\xb3\x27\xa0\x68\xcf\xfb\x39\x28\x8e" "\xea\x00\x50\x32\x81\x71\x8d\x69\x1d\xfa\x16\x64\x37\xc7\xc3\x54\xec" "\x45\xa1\x83\xd7\x73\xda\xde\x71\xa3\x99", 61); *(uint64_t*)0x20000d18 = 0x3d; *(uint64_t*)0x20000d20 = 0x20000900; memcpy((void*)0x20000900, "\xbb\x84\x94\x48\xc5\x7b\xa8\x2f\x95\x25\x06\x76\x5a\x82\x68\xf6\x66" "\x01\x3a\xa4\xad\x5d\x19\xc2\x17\xd4\xf0\xa8\x8a\xbb\xde\xaf\xae\xc7" "\x10\x06\xaa\xbd\x45\x49\x6a\x53\x3b\xfc\xaa\x68\x0d\x82\x65\x22\x0f" "\xfa\xb2\xc3\x95\x24\x62\xdc\x95\x2a\x7f\x90\xd6\x9d\x99\x67\x38\x1d" "\xc0\x40\x9a\x84\xbc\x5c\xb9\x4e\xe9\xd4\x12\xd5\x45\x2a\xbf\x8f\x93" "\x2c\x24\x68\x63\x9c\xb7\x86\x33\x3a\xd2\x8c\x16\xee\x35\x3f\x27\xf1" "\xb9\x06\x25\x4e\x27\x8c\xf0\x29\x87\x49\x1b\x71\xd5\x57\xa4\x68\x7a" "\x31\x89\x0c\x68\x4b\xc5\x8a\x06\x5d\x7d\xa2\x35\x94\xf4\xa3\x73\x5c" "\x5e\x93\xf9\xf2\x4e\xd3\x9f\x8a\xcb\xbc", 146); *(uint64_t*)0x20000d28 = 0x92; *(uint64_t*)0x20000d30 = 0x200009c0; memcpy((void*)0x200009c0, "\x59\xdd\x4e\xa4\xed\xbd\x55\x0d\xf4\xc5\x27\x96\x53\x4a\x4f\xb9\x8b" "\x0c\xa1\x0a\xbd\xc8\x74\x86\x65\x81\x31\xaf\xc1\x59\x13\xde\x7b\x44" "\x5c\x59\x37\xc9\x01\x2d\x1a\x0f\x6e\xdc\x20\x6f\xcb\x0a\xd1\xb1\x5c" "\x7d\xdd\x3b\xb2\x86\x64\x02\x85\x97\xa6\xe0\x91\xe2\x26\xc4\xe7\x2c" "\xde\x45\x3e\xcd\x7a\xaa\xd5\x8c\x3a\x4d\x90\x51\xd6\xbf\x50\xb4\xbb" "\x99\xba\x84\x57\xf3\x19\xac\xc8\x7c\x84\x76\xe4\xad\x7b\x8f\x36\x07" "\xdc\x38\x31\xe4\x7b\xfa\x72\xfe\x4c\x0b\x5e\x85\x59\x8c\xb0\x7f\xde" "\x23\x30\x2b\x76\x3b\xa4\xee\xdb\xbf\x51\xe5\x7e\xec\x41\xd4\xd2\x93" "\xb2\xcf\x57\xe3\x80\x4c\xd8\x93\x65\xda\x3e\xf3\x86\xc4\xcc\x12\xeb" "\xa4\x83\xc5\x9b\x6a\x69\xed\x70\xea\x60\x8a\x4a\xc0\xf5\x08\xb2\xe0" "\xef\x62\x6c\xf1\xff\x47\x5b\x0a\x37\x00\xb3\xc6\x14\x14\xe1\x2a\xbf" "\x48\xf2\x92\x8a\xdb\x8f\x5a\xb3\xe6\xd9\x2a\x52\xa5\xa1\xdc\xc5\x33" "\xb9\x80\x07\xe8\xe7\xd4\xef\x40\xab\x14\xad\xdf\x82\x0f\x47\x2e\x35" "\xfb\x00\x94\x5c\x93\xe2\x8a\xe8\x0e\x80\x7d\xf8\xa0\x3b", 235); *(uint64_t*)0x20000d38 = 0xeb; *(uint64_t*)0x20000d40 = 0x20000ac0; memcpy( (void*)0x20000ac0, "\x4d\x44\x42\xb1\x6a\xc8\xd7\xb6\x03\x03\x1a\xbb\xa5\x00\xe6\x0f\x2d\x21" "\x0f\x5b\x10\x25\x2c\x56\xb4\xee\x03\xf0\x38\xb9\xab\xff\xef\x7c\xd6\x3d" "\x4b\x4d\x93\x57\x55\xda\xa9\x99\xaf\x22\xbe\x9e\xa5\xba\xc7\x22\xea\x50" "\xe2\xce\xe7\x0c\xb4\x1a\x0d\x17\x76\x0b\x6e\xed\xb3\xe2\x04\x4d\xbb\x9a" "\xa2\x96\x0d\xc8\x74\xbb\x34\x00\x59\xfe\x11\x67\x65\x36\x21\xb5\x29\x23" "\xed\xb1\x83\x05\xa0\xb8\xa6\x90\x1e\x3c\x2d\x3b\x10\xee\x3f\xfa\x63\x2f" "\x93\xb0\x25\x6b\xd9\x0c\xb1\x1a\xf2\x6b\x19\x42\x72\xe1\xc3\x1a\xef\x75" "\x8a\xb9\x7c\xe1\x08\x91\xc9\xb6\x36\xf9\x44\xf3\xc3\xe7\x73\xc4\x01\xa1" "\xcc\x68\x20\x6d\xe4\x84\x01\x81\xd0\x44\x3e\x6e\xfa\x15\x8c\x6d\x28\x09" "\xd0\xfb\xbb\x72\x59\x15\x6e\x7c\x1f\x5a\xb7\x5e\xf1\x71\x3b\x03\x41\xff" "\x15\xf1\x1a\x26\x2c\x9c\x0d\x24\xcc\x12\xaf\x9b\xbb\x9b\x6f\xe2\x78\xc9" "\xa8\x44\xd6\x5a\x40\x7a\xa4\x44\x4e\xb2\x92\x82\x1e\xce\xe5\x16\x72\x57" "\x5f\xf2\x45\x74\xe6\x43\xdc\x3a\x57\x06\x84", 227); *(uint64_t*)0x20000d48 = 0xe3; *(uint64_t*)0x20000d50 = 0; *(uint64_t*)0x20000d58 = 0; *(uint64_t*)0x20000d60 = 0x20000cc0; memcpy((void*)0x20000cc0, "\xc3\x91\xb3\xd1\x8a\xd5\xaa\x83\x90\x26\xd0\x94\x8e\x34\x11\xa0\x49" "\xea", 18); *(uint64_t*)0x20000d68 = 0x12; *(uint64_t*)0x20000e98 = 7; *(uint64_t*)0x20000ea0 = 0x20000d80; *(uint64_t*)0x20000d80 = 0xd0; *(uint32_t*)0x20000d88 = 0x101; *(uint32_t*)0x20000d8c = 6; memcpy( (void*)0x20000d90, "\xf1\x08\x78\x5a\x95\x96\x50\x7a\x90\x1e\xbc\xb0\x8a\x32\xb7\xfa\xa8\xec" "\x03\xab\x31\xad\xc0\xe3\x37\xa3\x66\x7b\xc3\x13\x45\xf0\x93\x3f\x40\x9d" "\x72\x87\xfd\x66\x8a\x0d\x41\xf7\x59\x7a\xa8\x29\x16\xa8\x3b\x2f\x48\xf6" "\xbb\xee\x6c\xca\x7a\xdd\x72\x4f\xe9\xcf\xf0\x1b\x12\x66\xc7\x0c\x72\x17" "\x17\xbe\x99\x00\x47\x9e\xc4\xdf\x60\xc8\x6f\x7a\xf0\x97\x31\x21\xe2\x65" "\xc5\x0c\xef\xe4\x80\x22\x7a\xf0\x90\x7f\x4c\xfd\xb3\xf9\x0d\x9e\xf4\x63" "\xe5\x99\x57\x92\x22\x2a\x56\x58\x30\x47\xf8\xec\xb6\xb2\xcf\xd8\xc3\x62" "\x3a\x12\xf2\x89\xd2\xae\x43\xc7\xb8\x0a\x7a\xe8\x41\x6b\x2c\x26\x1f\xe9" "\x05\x57\x81\x93\xf2\x4f\xe5\x01\x08\xed\xfb\x31\x28\x3f\xaf\x00\x7a\x3d" "\xb9\xbb\x74\x73\x4d\x40\xa5\xcd\x6f\xad\x83\x84\xa1\x2f\xed\x88\x03\xa3" "\x08\x7e\x1a\x9a\x7d\xf2\x70\x0c\x3f\xbc", 190); *(uint64_t*)0x20000ea8 = 0xd0; *(uint32_t*)0x20000eb0 = 0; syscall(__NR_sendmsg, -1, 0x20000e80ul, 0ul); *(uint32_t*)0x20000100 = 0x12; *(uint32_t*)0x20000104 = 4; *(uint32_t*)0x20000108 = 8; *(uint32_t*)0x2000010c = 4; *(uint32_t*)0x20000110 = 0; *(uint32_t*)0x20000114 = -1; *(uint32_t*)0x20000118 = 0; memset((void*)0x2000011c, 0, 16); *(uint32_t*)0x2000012c = 0; *(uint32_t*)0x20000130 = -1; *(uint32_t*)0x20000134 = 0; *(uint32_t*)0x20000138 = 0; *(uint32_t*)0x2000013c = 0; res = syscall(__NR_bpf, 0x100000000000000ul, 0x20000100ul, 0x40ul); if (res != -1) r[1] = res; memcpy((void*)0x20000140, "memory.events\000", 14); res = syscall(__NR_openat, 0xffffff9c, 0x20000140ul, 0x7a05ul, 0x1700ul); if (res != -1) r[2] = res; res = syscall(__NR_socket, 6ul, 5ul, 0); if (res != -1) r[3] = res; *(uint16_t*)0x20000ec0 = 0x11; *(uint16_t*)0x20000ec2 = htobe16(0x15); *(uint32_t*)0x20000ec4 = 0; *(uint16_t*)0x20000ec8 = 1; *(uint8_t*)0x20000eca = 0xb4; *(uint8_t*)0x20000ecb = 6; memset((void*)0x20000ecc, 255, 6); memset((void*)0x20000ed2, 0, 2); syscall(__NR_bind, r[3], 0x20000ec0ul, 0x14ul); sprintf((char*)0x20000200, "0x%016llx", (long long)0); syscall(__NR_write, r[2], 0x20000200ul, 0x806000ul); syscall(__NR_openat, r[2], 0ul, 2ul, 0ul); *(uint32_t*)0x20000700 = r[2]; *(uint64_t*)0x20000708 = 0x200005c0; memcpy( (void*)0x200005c0, "\x61\x7b\x0c\xa3\x59\x8c\xe9\x11\x3f\x5e\x4f\xdc\x2f\x57\x15\xc0\x6f\x6f" "\x09\x18\x60\x12\xc5\x84\x60\xd9\x52\x6f\xe8\x9c\xf3\xf0\x14\xc8\x2b\xb6" "\x39\xea\x0f\x1d\x7b\xee\x6e\x7d\x88\x40\x4b\xa9\x86\x19\xec\xfe\xdc\xd5" "\xf6\x1d\x48\x68\xc8\x94\xb5\x53\x48\x0d\x69\x03\xc0\xf0\x80\x26\x19\x16" "\x20\x28\x91\x90\xaf\x50\xf8\x8a\x7d\x7e\x2e\xb8\x97\xc9\xa2\x4e\xef\x72" "\x04\x3b\x17\xdb\x96\x4f\xf8\x8f\x6f\x78\xb4\xe0\x0a\xf0\x1b\x66\xe5\xef" "\x90\x59\x53\xa0\x5c\x22\x4c\x77\xe9\x62\xb1\x71\x7c\xd0\x3d\xe8\x3c\x14" "\xb8\x41\x56\xc8\xde\x1f\x4e\x76\xe4\x2d\x24\x7e\x3c\x3b\xd9\xda\x93\xde" "\x11\x8e\x84\x69\x71\xfd\xfb\x09\x91\xe0\x6a\x6f\xb6\x88\xff\x8f\x41\xc6" "\x8a\xad\x10\xff\x8b\x5b\xf1\xeb\xc5\xfd\x34\xed\x7a\xe7\xc9\xac\x1b\x8d" "\x5a\x6a\xdd\xf7\xe2\x26\x91\x26\xc4\xdb\x04\x94\x47\x6e\x7d\x10\x3c\xb5" "\x13\x9c\x69\x59\xd8\x41\x40\x18\xec\x96\xd6\x81\x09\x52\xd1\xfa\xe0\x01" "\x49\xe4\x51\x46\x82\x60\xe7\x94\xa2\x1a\x80\xe6\x93\xe3\xee\x24\x1d", 233); *(uint64_t*)0x20000710 = 0x200006c0; *(uint32_t*)0x200006c0 = -1; *(uint64_t*)0x20000718 = 2; syscall(__NR_bpf, 2ul, 0x20000700ul, 0x20ul); *(uint64_t*)0x20000580 = 0x20000140; *(uint16_t*)0x20000140 = 0x10; *(uint16_t*)0x20000142 = 0; *(uint32_t*)0x20000144 = 0; *(uint32_t*)0x20000148 = 0x1000000; *(uint32_t*)0x20000588 = 0xc; *(uint64_t*)0x20000590 = 0x20000180; *(uint64_t*)0x20000180 = 0x20000240; *(uint32_t*)0x20000240 = 0x184; *(uint16_t*)0x20000244 = 0; *(uint16_t*)0x20000246 = 0x800; *(uint32_t*)0x20000248 = 0x70bd2b; *(uint32_t*)0x2000024c = 0x25dfdbfe; *(uint8_t*)0x20000250 = 5; *(uint8_t*)0x20000251 = 0; *(uint16_t*)0x20000252 = 0; *(uint16_t*)0x20000254 = 0x158; STORE_BY_BITMASK(uint16_t, , 0x20000256, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000257, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000257, 1, 7, 1); *(uint16_t*)0x20000258 = 0x14c; STORE_BY_BITMASK(uint16_t, , 0x2000025a, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000025b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000025b, 1, 7, 1); *(uint16_t*)0x2000025c = 0x1c; STORE_BY_BITMASK(uint16_t, , 0x2000025e, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000025f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000025f, 1, 7, 1); *(uint16_t*)0x20000260 = 4; *(uint16_t*)0x20000262 = 3; *(uint16_t*)0x20000264 = 8; *(uint16_t*)0x20000266 = 2; memcpy((void*)0x20000268, "GPL\000", 4); *(uint16_t*)0x2000026c = 4; *(uint16_t*)0x2000026e = 3; *(uint16_t*)0x20000270 = 8; *(uint16_t*)0x20000272 = 2; memcpy((void*)0x20000274, "GPL\000", 4); *(uint16_t*)0x20000278 = 0x28; STORE_BY_BITMASK(uint16_t, , 0x2000027a, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000027b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000027b, 1, 7, 1); *(uint16_t*)0x2000027c = 5; *(uint16_t*)0x2000027e = 2; memset((void*)0x20000280, 0, 1); *(uint16_t*)0x20000284 = 5; *(uint16_t*)0x20000286 = 2; memset((void*)0x20000288, 0, 1); *(uint16_t*)0x2000028c = 4; *(uint16_t*)0x2000028e = 3; *(uint16_t*)0x20000290 = 8; *(uint16_t*)0x20000292 = 1; *(uint32_t*)0x20000294 = 1; *(uint16_t*)0x20000298 = 8; *(uint16_t*)0x2000029a = 2; memcpy((void*)0x2000029c, "GPL\000", 4); *(uint16_t*)0x200002a0 = 0x28; STORE_BY_BITMASK(uint16_t, , 0x200002a2, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200002a3, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200002a3, 1, 7, 1); *(uint16_t*)0x200002a4 = 8; *(uint16_t*)0x200002a6 = 1; *(uint32_t*)0x200002a8 = 8; *(uint16_t*)0x200002ac = 5; *(uint16_t*)0x200002ae = 2; memset((void*)0x200002b0, 0, 1); *(uint16_t*)0x200002b4 = 9; *(uint16_t*)0x200002b6 = 2; memcpy((void*)0x200002b8, "[@\256\'\000", 5); *(uint16_t*)0x200002c0 = 8; *(uint16_t*)0x200002c2 = 1; *(uint32_t*)0x200002c4 = 8; *(uint16_t*)0x200002c8 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x200002ca, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200002cb, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200002cb, 1, 7, 1); *(uint16_t*)0x200002cc = 8; *(uint16_t*)0x200002ce = 1; *(uint32_t*)0x200002d0 = 0x3ff; *(uint16_t*)0x200002d4 = 0x14; STORE_BY_BITMASK(uint16_t, , 0x200002d6, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200002d7, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200002d7, 1, 7, 1); *(uint16_t*)0x200002d8 = 5; *(uint16_t*)0x200002da = 2; memset((void*)0x200002dc, 0, 1); *(uint16_t*)0x200002e0 = 8; *(uint16_t*)0x200002e2 = 1; *(uint32_t*)0x200002e4 = 0xc00; *(uint16_t*)0x200002e8 = 0x10; STORE_BY_BITMASK(uint16_t, , 0x200002ea, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200002eb, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200002eb, 1, 7, 1); *(uint16_t*)0x200002ec = 4; *(uint16_t*)0x200002ee = 3; *(uint16_t*)0x200002f0 = 5; *(uint16_t*)0x200002f2 = 2; memset((void*)0x200002f4, 0, 1); *(uint16_t*)0x200002f8 = 0x18; STORE_BY_BITMASK(uint16_t, , 0x200002fa, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200002fb, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200002fb, 1, 7, 1); *(uint16_t*)0x200002fc = 8; *(uint16_t*)0x200002fe = 1; *(uint32_t*)0x20000300 = 0x10001; *(uint16_t*)0x20000304 = 4; *(uint16_t*)0x20000306 = 3; *(uint16_t*)0x20000308 = 5; *(uint16_t*)0x2000030a = 2; memset((void*)0x2000030c, 0, 1); *(uint16_t*)0x20000310 = 0x24; STORE_BY_BITMASK(uint16_t, , 0x20000312, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000313, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000313, 1, 7, 1); *(uint16_t*)0x20000314 = 9; *(uint16_t*)0x20000316 = 2; memcpy((void*)0x20000318, "--\'}\000", 5); *(uint16_t*)0x20000320 = 4; *(uint16_t*)0x20000322 = 3; *(uint16_t*)0x20000324 = 5; *(uint16_t*)0x20000326 = 2; memset((void*)0x20000328, 0, 1); *(uint16_t*)0x2000032c = 8; *(uint16_t*)0x2000032e = 2; memcpy((void*)0x20000330, "GPL\000", 4); *(uint16_t*)0x20000334 = 0x1c; STORE_BY_BITMASK(uint16_t, , 0x20000336, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000337, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000337, 1, 7, 1); *(uint16_t*)0x20000338 = 8; *(uint16_t*)0x2000033a = 1; *(uint32_t*)0x2000033c = 0xdc19; *(uint16_t*)0x20000340 = 8; *(uint16_t*)0x20000342 = 1; *(uint32_t*)0x20000344 = 6; *(uint16_t*)0x20000348 = 8; *(uint16_t*)0x2000034a = 1; *(uint32_t*)0x2000034c = 6; *(uint16_t*)0x20000350 = 0x54; STORE_BY_BITMASK(uint16_t, , 0x20000352, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000353, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000353, 1, 7, 1); *(uint16_t*)0x20000354 = 4; *(uint16_t*)0x20000356 = 3; *(uint16_t*)0x20000358 = 5; *(uint16_t*)0x2000035a = 2; memset((void*)0x2000035c, 0, 1); *(uint16_t*)0x20000360 = 8; *(uint16_t*)0x20000362 = 1; *(uint32_t*)0x20000364 = 5; *(uint16_t*)0x20000368 = 8; *(uint16_t*)0x2000036a = 1; *(uint32_t*)0x2000036c = 7; *(uint16_t*)0x20000370 = 8; *(uint16_t*)0x20000372 = 1; *(uint32_t*)0x20000374 = 0x38; *(uint16_t*)0x20000378 = 8; *(uint16_t*)0x2000037a = 1; *(uint32_t*)0x2000037c = 3; *(uint16_t*)0x20000380 = 0xc; *(uint16_t*)0x20000382 = 2; memcpy((void*)0x20000384, ".*@>/,&\000", 8); *(uint16_t*)0x2000038c = 8; *(uint16_t*)0x2000038e = 1; *(uint32_t*)0x20000390 = 0xfffffff8; *(uint16_t*)0x20000394 = 8; *(uint16_t*)0x20000396 = 1; *(uint32_t*)0x20000398 = 2; *(uint16_t*)0x2000039c = 8; *(uint16_t*)0x2000039e = 2; memcpy((void*)0x200003a0, "}%:\000", 4); *(uint16_t*)0x200003a4 = 0x20; *(uint16_t*)0x200003a6 = 1; *(uint16_t*)0x200003a8 = 4; *(uint16_t*)0x200003aa = 1; *(uint16_t*)0x200003ac = 5; *(uint16_t*)0x200003ae = 6; *(uint8_t*)0x200003b0 = 0x82; *(uint16_t*)0x200003b4 = 8; *(uint16_t*)0x200003b6 = 5; *(uint32_t*)0x200003b8 = 0xfffffadf; *(uint16_t*)0x200003bc = 5; *(uint16_t*)0x200003be = 6; *(uint8_t*)0x200003c0 = 0xd4; *(uint64_t*)0x20000188 = 0x184; *(uint64_t*)0x20000598 = 1; *(uint64_t*)0x200005a0 = 0; *(uint64_t*)0x200005a8 = 0; *(uint32_t*)0x200005b0 = 0x44000; syscall(__NR_sendmsg, -1, 0x20000580ul, 0ul); *(uint32_t*)0x20000080 = r[1]; *(uint32_t*)0x20000084 = r[0]; *(uint32_t*)0x20000088 = 5; *(uint32_t*)0x2000008c = 0; syscall(__NR_bpf, 8ul, 0x20000080ul, 0x10ul); res = syscall(__NR_socket, 1ul, 5ul, 0); if (res != -1) r[4] = res; *(uint32_t*)0x200001c0 = r[1]; *(uint64_t*)0x200001c8 = 0x20000140; *(uint64_t*)0x200001d0 = 0x20000040; *(uint32_t*)0x20000040 = r[4]; *(uint64_t*)0x200001d8 = 0; syscall(__NR_bpf, 2ul, 0x200001c0ul, 0x20ul); *(uint32_t*)0x2000e000 = 0xe; *(uint32_t*)0x2000e004 = 4; *(uint64_t*)0x2000e008 = 0x20000400; memcpy( (void*)0x20000400, "\xb4\x05\x00\x00\x00\x00\x00\x00\x61\x10\x58\x00\x00\x00\x00\x00\xc6\x00" "\x00\x00\x00\x00\x00\x00\x95\x00\x00\x02\x00\x00\x00\x00\x3f\x20\x31\x84" "\x23\xfb\xcd\xc4\xca\xf5\xce\xcc\x8c\x41\xd6\x6d\x1e\x8d\x08\xdc\x03\x63" "\x99\x12\xea\xdc\xc2\xd1\xd4\x55\xac\x64\x7a\x72\x65\x55\x9c\xcd\x4d\xff" "\x72\x3f\x30\x58\x06\x46\x92\x47\x42\xcd\x84\x83\x08\xe1\x23\x08\xfc\xcf" "\xfc\x1b\x5a\x2b\x16\xa0\x4d\xf2\xe7\x0b\x8b\xa7\x91\x21\x74\x28\x13\x58" "\xfb\x0b\x3e\xe8\x34\x62\xaa\x91\x1e\xa0\x7d\xe7\x0d\x93\xcb\xd6\x6d\xa9" "\x06\x2a\x2a\x58\xea\x90\xc6\x40\xac\x14\x99\x5f\x48\x98\x24\x1b\x85\x9b" "\x80\x6a\x0d\xd9\x9d\xa8\x3d\x6a\xfc\x40\x16\xcb\xd2\x0a\x23\x1e\x2b\x56" "\x2c\xbb\xdf\x00\x00\x00\x00\xc4\xcd\x68\xa2\x67\x06\x0a\x9f\xa2\xd7\xa4" "\xdd\x02\x73\x84\x34\xe4\x31\x72\x8b\xa4\x60\xed\x7a\xb5\x7d\xea\x45\x60" "\x81\xf0\x03\x00\x00\x00\x81\x03\x26\x33\x61\x6b\x02\x2c\x5d\x19\x91\x5e" "\x18\xb5\x4d\xa3\xf0\xb2\xc7\x8a\xc2\xb9\xee\x67\xcb\x9e\x4c\x06\x13\x00" "\x00\x34\x8b\xec\x48\x30\xaa\x02\x6a\xf8\x1b\x33\x7d\x1c\xc2\xe0\xf5\x23" "\x0c\x11\xe6\xfb\x2d\x95\xee\x56\x16\x7c\x15\x3f\x75\x11\x96\x41\x35\xee" "\xf9\x60\x37\xc1\x4c\x15\x13\x2b\xdd\x86\x7d\xb8\xdb\xa7\x6e\x62\xe5\x15" "\x0d\xb6\xb1\x95\x52\xfb\x01\xbc\x80\x92\xfd\x86\xb6\x87\xc3\x11\xc3\xc5" "\x37\x21\x6d\x3a\xff\xd7\x42\x17\x10\x8f\x5d\x29\xc3\xa4\xc4\xf7\xe2\x60" "\x2d\xf7\x31\x2f\xfd\x74\x7e\xd6\xa9\xa0\xf1\x9e\x90\x95\x0e\xe7\xb3\xf8" "\x43\x83\xdf\xc2\x56\xee\xb0\xad\xa3\xcc\xa4\x7b\xd7\x67\xef\xdf\xa3\x3e" "\xc2\x20\x9c\x96\x5a\x93\x81\xc9\x83\xd0\x8d\x54\xe8\x12\x00", 375); *(uint64_t*)0x2000e010 = 0x20003ff6; memcpy((void*)0x20003ff6, "GPL\000", 4); *(uint32_t*)0x2000e018 = 4; *(uint32_t*)0x2000e01c = 0xfd90; *(uint64_t*)0x2000e020 = 0x2000cf3d; *(uint32_t*)0x2000e028 = 0; *(uint32_t*)0x2000e02c = 0; memset((void*)0x2000e030, 0, 16); *(uint32_t*)0x2000e040 = 0; *(uint32_t*)0x2000e044 = 0; *(uint32_t*)0x2000e048 = -1; *(uint32_t*)0x2000e04c = 8; *(uint64_t*)0x2000e050 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x2000e058 = 0x366; *(uint32_t*)0x2000e05c = 0x10; *(uint64_t*)0x2000e060 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x2000e068 = 0x187; *(uint32_t*)0x2000e06c = 0; *(uint32_t*)0x2000e070 = -1; syscall(__NR_bpf, 5ul, 0x2000e000ul, 0x48ul); } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); for (procid = 0; procid < 6; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; }