// https://syzkaller.appspot.com/bug?id=2aabc827b8aea09353150377f96630a3ff18f6a3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } *(uint64_t*)0x200000000980 = 0; *(uint32_t*)0x200000000988 = -1; *(uint32_t*)0x20000000098c = 0; *(uint64_t*)0x200000000990 = 0; syscall(__NR_bpf, /*cmd=*/0x11ul, /*arg=*/0x200000000980ul, /*size=*/0x10ul); res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/1ul, /*proto=*/0); if (res != -1) r[0] = res; *(uint32_t*)0x200000000040 = 1; syscall(__NR_setsockopt, /*fd=*/r[0], /*level=*/1, /*optname=SO_ZEROCOPY*/ 0x3c, /*optval=*/0x200000000040ul, /*optlen=*/0xfff0ul); *(uint32_t*)0x2000000000c0 = 1; syscall(__NR_setsockopt, /*fd=*/r[0], /*level=*/6, /*optname=*/0x13, /*optval=*/0x2000000000c0ul, /*optlen=*/4ul); *(uint16_t*)0x200000000080 = 2; *(uint16_t*)0x200000000082 = htobe16(0); *(uint32_t*)0x200000000084 = htobe32(0x7f000001); syscall(__NR_connect, /*fd=*/r[0], /*addr=*/0x200000000080ul, /*addrlen=*/0x10ul); *(uint32_t*)0x2000000001c0 = -1; syscall(__NR_setsockopt, /*fd=*/r[0], /*level=*/6, /*optname=*/0x13, /*optval=*/0x2000000001c0ul, /*optlen=*/4ul); syscall(__NR_write, /*fd=*/r[0], /*data=*/0x2000000014c0ul, /*len=*/0x46bul); *(uint64_t*)0x200000000f40 = 0; *(uint32_t*)0x200000000f48 = 0; *(uint64_t*)0x200000000f50 = 0x200000000500; *(uint64_t*)0x200000000500 = 0x2000000006c0; memset((void*)0x2000000006c0, 237, 1); *(uint64_t*)0x200000000508 = 1; *(uint64_t*)0x200000000510 = 0x200000000200; memset((void*)0x200000000200, 181, 1); *(uint64_t*)0x200000000518 = 1; *(uint64_t*)0x200000000520 = 0x200000000340; memset((void*)0x200000000340, 46, 1); *(uint64_t*)0x200000000528 = 1; *(uint64_t*)0x200000000530 = 0x200000000140; memset((void*)0x200000000140, 85, 1); *(uint64_t*)0x200000000538 = 1; *(uint64_t*)0x200000000540 = 0x200000000180; memset((void*)0x200000000180, 243, 1); *(uint64_t*)0x200000000548 = 1; *(uint64_t*)0x200000000f58 = 0xa6; *(uint64_t*)0x200000000f60 = 0; *(uint64_t*)0x200000000f68 = 0; *(uint32_t*)0x200000000f70 = 0; *(uint32_t*)0x200000000f78 = 0; *(uint64_t*)0x200000000f80 = 0; *(uint32_t*)0x200000000f88 = 0; *(uint64_t*)0x200000000f90 = 0x200000000900; *(uint64_t*)0x200000000900 = 0x200000000580; memset((void*)0x200000000580, 241, 1); *(uint64_t*)0x200000000908 = 1; *(uint64_t*)0x200000000910 = 0x200000000c80; memset((void*)0x200000000c80, 97, 1); *(uint64_t*)0x200000000918 = 1; *(uint64_t*)0x200000000920 = 0x200000000b40; memset((void*)0x200000000b40, 77, 1); *(uint64_t*)0x200000000928 = 1; *(uint64_t*)0x200000000930 = 0x200000000d80; memset((void*)0x200000000d80, 111, 1); *(uint64_t*)0x200000000938 = 1; *(uint64_t*)0x200000000940 = 0x200000000e80; memset((void*)0x200000000e80, 8, 1); *(uint64_t*)0x200000000948 = 1; *(uint64_t*)0x200000000f98 = 0xa6; *(uint64_t*)0x200000000fa0 = 0; *(uint64_t*)0x200000000fa8 = 0; *(uint32_t*)0x200000000fb0 = 0; *(uint32_t*)0x200000000fb8 = 0x70040000; *(uint64_t*)0x200000000fc0 = 0; *(uint32_t*)0x200000000fc8 = 0; *(uint64_t*)0x200000000fd0 = 0x2000000002c0; *(uint64_t*)0x2000000002c0 = 0x200000000380; memset((void*)0x200000000380, 187, 1); *(uint64_t*)0x2000000002c8 = 1; *(uint64_t*)0x2000000002d0 = 0x2000000007c0; memset((void*)0x2000000007c0, 161, 1); *(uint64_t*)0x2000000002d8 = 1; *(uint64_t*)0x2000000002e0 = 0x200000000800; memset((void*)0x200000000800, 115, 1); *(uint64_t*)0x2000000002e8 = 1; *(uint64_t*)0x2000000002f0 = 0x2000000009c0; memset((void*)0x2000000009c0, 92, 1); *(uint64_t*)0x2000000002f8 = 1; *(uint64_t*)0x200000000fd8 = 4; *(uint64_t*)0x200000000fe0 = 0; *(uint64_t*)0x200000000fe8 = 0; *(uint32_t*)0x200000000ff0 = 0; *(uint32_t*)0x200000000ff8 = 0; *(uint64_t*)0x200000001000 = 0; *(uint32_t*)0x200000001008 = 0; *(uint64_t*)0x200000001010 = 0x200000000dc0; *(uint64_t*)0x200000000dc0 = 0x200000000440; memset((void*)0x200000000440, 136, 1); *(uint64_t*)0x200000000dc8 = 1; *(uint64_t*)0x200000000dd0 = 0x200000000840; memset((void*)0x200000000840, 229, 1); *(uint64_t*)0x200000000dd8 = 1; *(uint64_t*)0x200000000de0 = 0x200000001040; memset((void*)0x200000001040, 150, 1); *(uint64_t*)0x200000000de8 = 1; *(uint64_t*)0x200000001018 = 3; *(uint64_t*)0x200000001020 = 0; *(uint64_t*)0x200000001028 = 0; *(uint32_t*)0x200000001030 = 0; *(uint32_t*)0x200000001038 = 0; syscall(__NR_sendmmsg, /*fd=*/r[0], /*mmsg=*/0x200000000f40ul, /*vlen=*/4ul, /*f=MSG_ZEROCOPY|MSG_BATCH|MSG_OOB|MSG_MORE|MSG_DONTWAIT|MSG_CONFIRM*/ 0x4048841ul); return 0; }