// https://syzkaller.appspot.com/bug?id=e7604be1b9ca43421bbf00383647b4073dad63dd // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_pwritev2 #define __NR_pwritev2 328 #endif static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static int inject_fault(int nth) { int fd; fd = open("/proc/thread-self/fail-nth", O_RDWR); if (fd == -1) exit(1); char buf[16]; sprintf(buf, "%d", nth); if (write(fd, buf, strlen(buf)) != (ssize_t)strlen(buf)) exit(1); return fd; } static void setup_fault() { static struct { const char* file; const char* val; bool fatal; } files[] = { {"/sys/kernel/debug/failslab/ignore-gfp-wait", "N", true}, {"/sys/kernel/debug/fail_futex/ignore-private", "N", false}, {"/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", "N", false}, {"/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N", false}, {"/sys/kernel/debug/fail_page_alloc/min-order", "0", false}, }; unsigned i; for (i = 0; i < sizeof(files) / sizeof(files[0]); i++) { if (!write_file(files[i].file, files[i].val)) { if (files[i].fatal) exit(1); } } } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); setup_fault(); intptr_t res = 0; memcpy((void*)0x20004400, "./bus\000", 6); res = syscall(__NR_openat, 0xffffff9c, 0x20004400ul, 0x6a142ul, 0ul); if (res != -1) r[0] = res; *(uint64_t*)0x20000480 = 0x20000000; memset((void*)0x20000000, 0, 1); *(uint64_t*)0x20000488 = 1; syscall(__NR_pwritev2, r[0], 0x20000480ul, 1ul, 0x8000000, 0, 0ul); memcpy((void*)0x20000100, "/dev/ptmx\000", 10); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000100ul, 0x161281ul, 0ul); if (res != -1) r[1] = res; inject_fault(24); syscall(__NR_sendfile, r[1], r[0], 0ul, 0x7ffful); return 0; }