// https://syzkaller.appspot.com/bug?id=90a60ac9052c9528d51de6882cfb71ce76234884 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include static long syz_genetlink_get_family_id(volatile long name) { char buf[512] = {0}; struct nlmsghdr* hdr = (struct nlmsghdr*)buf; struct genlmsghdr* genlhdr = (struct genlmsghdr*)NLMSG_DATA(hdr); struct nlattr* attr = (struct nlattr*)(genlhdr + 1); hdr->nlmsg_len = sizeof(*hdr) + sizeof(*genlhdr) + sizeof(*attr) + GENL_NAMSIZ; hdr->nlmsg_type = GENL_ID_CTRL; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; genlhdr->cmd = CTRL_CMD_GETFAMILY; attr->nla_type = CTRL_ATTR_FAMILY_NAME; attr->nla_len = sizeof(*attr) + GENL_NAMSIZ; strncpy((char*)(attr + 1), (char*)name, GENL_NAMSIZ); struct iovec iov = {hdr, hdr->nlmsg_len}; struct sockaddr_nl addr = {0}; addr.nl_family = AF_NETLINK; int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (fd == -1) { return -1; } struct msghdr msg = {&addr, sizeof(addr), &iov, 1, NULL, 0, 0}; if (sendmsg(fd, &msg, 0) == -1) { close(fd); return -1; } ssize_t n = recv(fd, buf, sizeof(buf), 0); close(fd); if (n <= 0) { return -1; } if (hdr->nlmsg_type != GENL_ID_CTRL) { return -1; } for (; (char*)attr < buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) return *(uint16_t*)(attr + 1); } return -1; } uint64_t r[2] = {0xffffffffffffffff, 0x0}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0x10, 3, 0x10); if (res != -1) r[0] = res; memcpy((void*)0x20000280, "TIPC\000", 5); res = syz_genetlink_get_family_id(0x20000280); if (res != -1) r[1] = res; *(uint64_t*)0x20004900 = 0; *(uint32_t*)0x20004908 = 0; *(uint64_t*)0x20004910 = 0x200048c0; *(uint64_t*)0x200048c0 = 0x20004840; *(uint32_t*)0x20004840 = 0x68; *(uint16_t*)0x20004844 = r[1]; *(uint16_t*)0x20004846 = 0x601; *(uint32_t*)0x20004848 = 0; *(uint32_t*)0x2000484c = 0; *(uint8_t*)0x20004850 = 1; *(uint8_t*)0x20004851 = 0; *(uint16_t*)0x20004852 = 0; *(uint32_t*)0x20004854 = 0; *(uint16_t*)0x20004858 = 0x4109; *(uint16_t*)0x2000485a = 0; *(uint16_t*)0x2000485c = htobe16(0x4c); *(uint16_t*)0x2000485e = htobe16(0x18); *(uint32_t*)0x20004860 = htobe32(0x60); memcpy((void*)0x20004864, "broadcast-" "link\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000", 68); *(uint64_t*)0x200048c8 = 0x68; *(uint64_t*)0x20004918 = 1; *(uint64_t*)0x20004920 = 0; *(uint64_t*)0x20004928 = 0; *(uint32_t*)0x20004930 = 0; syscall(__NR_sendmsg, r[0], 0x20004900, 0); return 0; }