// https://syzkaller.appspot.com/bug?id=e8b3dec484275c8c8dc41292d3df39277e002dbc // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // openat$auto_tracing_mark_raw_fops_trace arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 74 72 61 63 69 6e 67 2f // 74 72 61 63 65 5f 6d 61 72 6b 65 72 5f 72 61 77 00} (length 0x25) // } // flags: open_flags = 0x2 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_tracing_mark_raw_fops_trace memcpy((void*)0x200000000000, "/sys/kernel/tracing/trace_marker_raw\000", 37); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000000ul, /*flags=O_RDWR*/ 2, /*mode=*/0); if (res != -1) r[0] = res; // write$auto arguments: [ // fd: fd (resource) // buf: ptr[in, buffer] { // buffer: {00} (length 0x1) // } // count: intptr = 0xa5f (8 bytes) // ] memset((void*)0x200000000040, 0, 1); syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000040ul, /*count=*/0xa5ful); return 0; }