// https://syzkaller.appspot.com/bug?id=ef63e8f374513652b7f79ccf13470a29f387680b // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } } } #ifndef SYS_chdir #define SYS_chdir 12 #endif #ifndef SYS_getegid #define SYS_getegid 43 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_getuid #define SYS_getuid 24 #endif #ifndef SYS_lchown #define SYS_lchown 275 #endif #ifndef SYS_lseek #define SYS_lseek 199 #endif #ifndef SYS_mknod #define SYS_mknod 450 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_open #define SYS_open 5 #endif #ifndef SYS_paccept #define SYS_paccept 456 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_semop #define SYS_semop 222 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[4] = {0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; syscall(SYS_chdir, 0ul); memcpy((void*)0x20000780, "./file0\000", 8); syscall(SYS_open, 0x20000780ul, 0ul, 0ul); syscall(SYS_mknod, 0ul, 0x6000ul, 0x701ul + procid * 2); memcpy((void*)0x20000040, "./file0\000", 8); syscall(SYS_open, 0x20000040ul, 0x70eul, 0ul); *(uint64_t*)0x20000300 = 0x20001180; memcpy( (void*)0x20001180, "\xf0\x78\x48\x47\xcd\xf6\xb8\xc3\xec\x89\xdd\xee\x96\xff\xf5\xa6\x37\x8b" "\x94\xdd\x29\x6f\x9b\x2d\xf5\xf0\xe5\x46\x11\x8b\x62\x44\x1d\xfc\x5f\x4d" "\xae\x70\x7a\x68\xbf\x08\x5d\xbb\x46\x90\xd3\x15\xb9\x2b\x7e\x50\xf8\xd2" "\xd3\xa1\x7e\x21\x1e\xfb\x1a\xdc\x43\xca\xff\x4b\xb1\xc1\xc3\x3e\x82\x92" "\x53\x40\x5b\xae\xea\x7d\x05\x67\xc9\xc7\x75\xa9\x7d\x84\x5f\xde\x9d\x3e" "\x56\x70\x07\xf4\xbe\xae\xee\x5a\xaf\x08\xe3\xb0\xce\xa2\x3c\x62\xb2\xdb" "\xb0\x8d\x01\x3c\x88\x5f\x18\x35\x4f\xfa\xac\x3e\x44\x33\x22\xe3\x88\x30" "\xfa\xc6\xc1\x49\x44\xde\x42\x89\x0a\x5d\x53\x79\x1c\x20\x3c\xcd\x5c\xf9" "\x9d\x83\xa1\xce\xce\xe7\xeb\x8d\x3b\xa3\x29\xf6\xf0\xa8\xd9\xce\xca\x46" "\x30\x97\xc4\x29\x1c\x4e\xdc\xc1\xb3\x93\x54\xe4\xf3\x2b\x39\xbb\x1c\x9e" "\x2a\x2a\x0a\x36\xba\xed\x3d\x64\xe3\x70\xc7\xe2\xa1\x25\xc7\x14\x55\xd8" "\xad\x8c\xa9\x7c\x8d\x68\x97\x97\xd2\x20\x79\xbd\x8a\x0e\xcb\xc3\x82\xe7" "\x92\x83\x7f\x3f\xa9\xc9\x44\xe0\xdd\xe2\xed\xec\xe6\x13\x53\xa2\x6d\x7c" "\xe2\xca\xdf\xac\x3b\x0c\xef\xe9\x53\x14\x36\x37\xad\xac\x51\x61\x6b\xdb" "\x16\x84\x29\x22\xdf\x6d\xb9\xe7\x90\x4b\x53\x39\x82\xe6\x4a\xb4\xd7\x58" "\x4e\xa8\x4d\x89\x7b\xde\xbe\x65\x93\xd0\xd7\xad\xde\xa2\x86\x6e\x0d\x87" "\x0a\x94\xa6\x2f\x10\x90\x1d\x51\x31\x5a\x02\x0f\xbb\xee\x97\x45\x93\xed" "\xb6\x2e\xed\xc5\x1d\x73\xdb\x4f\x68\xbe\x6c\x2b\x95\x01\xe4\x00\x46\xa4" "\x49\xf0\x50\x54\x00\xe5\x57\xbd\xde\xbc\xe2\xb0\xad\x9d\x4e\x66\x96\x68" "\xe6\xb2\x1b\x00\x7c\x38\x4a\x93\xdc\x49\xca\xb6\xa7\xd7\xe7\xa1\xab\x4b" "\xcb\x75\x89\x5d\x77\x28\x26\xa7\xdd\x5e\xac\xdc\xc1\xc5\x4c\x10\x75\x8d" "\x4d\x41\x7f\x66\xfa\x02\x2f\x60\xe5\xf3\xbe\xd3\x68\x45\x66\xca\xc3\xf4" "\xfa\x4e\x8d\xaf\x0e\x31\x51\xe1\xfc\x89\x4e\x10\x12\x87\xf2\x35\xaa\xe1" "\xcd\x37\x10\x28\x8d\x93\xd6\x71\xec\x72\x41\xfe\x20\x51\x0f\xc1\x01\x46" "\x65\xeb\x9b\x05\xe8\xc5\xdb\x3c\x58\x93\x3a\x8d\xaf\x52\x34\xe4\xe4\x65" "\xbf\xb7\x14\xac\x8f\x3f\xe2\xbf\x48\x1d\x21\x02\x9e\x06\x44\xb2\xcd\xe8" "\x50\x3c\x46\xdc\xc6\xa0\x56\xcf\xf4\x6a\xd6\x2f\xbf\x77\xba\x92\xa5\x1c" "\xe3\xa0\x21\xe3\x93\x55\x75\x8a\x1e\x72\x48\xb8\xa0\xcc\x62\xc2\x16\x55" "\x5d\x8e\xab\x32\xc3\x2d\x65\xdd\x38\x14\x8c\x6b\xd3\x4a\x90\x2b\x68\x23" "\x0a\x2e\x1a\x68\xa1\xad\x7b\xe5\xc8\xe6\xb8\xff\xaf\x19\x61\x31\x13\x69" "\x11\x54\x5d\x9c\x0d\xff\x52\x25\x22\x59\xd3\x32\x31\x62\xed\x42\xe7\x8c" "\x17\x7a\xa6\xdc\x98\x70\xad\x09\x24\x69\xc8\x1b\xd8\x08\xf8\xfe\xbb\x95" "\x42\x6e\xed\x35\xde\xf5\x68\x34\xa3\x71\xa3\xf0\xa9\x1e\xc5\x72\x12\x59" "\x2c\xf6\x26\x7a\x36\x2d\xbb\x2e\x01\x80\x5c\x6b\x85\xd3\x29\xf6\xe4\x1b" "\x5d\x4e\x2b\xd2\x3c\xf9\xee\x12\x38\x40\x3a\x14\xd5\x5f\x94\xd0\x46\x82" "\xce\xa0\x3b\xb1\xbc\x9a\xe9\xd9\x6c\x43\xa4\x3c\xac\x5a\x4c\x3c\x2d\x0c" "\x19\xd2\x48\x93\xd2\x52\x7b\xb4\x2d\xad\xb0\xde\xc5\x91\x74\xe7\x66\x85" "\xc6\xdd\xd0\x3d\x19\x8d\xfb\xbf\xf3\x14\x20\x7e\x1c\xa2\x51\x6d\x35\xdd" "\xb3\xaf\x49\x96\xff\x86\xd2\x0b\x17\x36\x50\x89\xb0\x98\x6f\x27\x46\xce" "\x6f\xef\xa0\x15\xf4\x7f\xb5\xb6\x68\x17\x9f\x0a\x6f\xeb\x1b\xb1\x8e\xbc" "\x44\xfc\x9b\x0e\xb1\xc1\xea\xd4\x73\x05\xa2\xd1\x4e\x1b\xc9\x60\x50\x89" "\x90\x10\x72\x5b\x9a\x9a\x55\xe2\xc1\x92\x9c\x50\x64\x73\xb3\x60\x46\x89" "\x7a\x91\xaa\x1f\x43\x4b\xda\x84\xfd\x4e\x59\xe9\xb8\x79\x4f\x65\xf5\x7e" "\x10\xf3\x17\x11\x21\xff\x17\xb6\x58\x9f\x99\x54\xb2\xb7\x96\xdd\x81\x4a" "\x19\xa5\x87\xed\x9f\xe2\x4a\x43\xd2\x43\xf9\x1d\xbe\x66\x8b\x59\x96\xef" "\x9a\xaa\x01\xe3\x74\xd6\x5a\x98\x0d\x1d\xe8\xa5\x41\x65\xb6\xb0\xa2\x96" "\x0b\x2b\x6d\xf5\x5c\x93\xc9\x7e\x83\x01\xab\x92\xe6\xaa\xe6\xb7\xb4\x34" "\x0a\xaa\x7f\x96\x82\x24\x6d\x8c\xa2\xb9\x95\x0f\x4c\xba\x74\xd3\x41\xa5" "\xdf\xcb\x40\xbd\x42\x79\xb4\xb8\x14\x05\xe3\xd8\xd8\xaa\x14\xd3\x5c\xa4" "\xd4\xa3\x81\xf0\x1f\x03\x80\x1a\x9b\x75\x81\x46\xc7\x45\xa8\x7b\x8e\xa4" "\x61\x63\xd4\xff\xfa\x3e\xc0\x77\x89\x80\x1e\x00\x31\x5b\x6b\x99\x20\x6a" "\xaf\x08\x5b\x82\x91\xb5\xbe\x67\x53\x60\xb5\x74\x52\xf9\xce\x15\xe6\x75" "\xcc\xbe\x42\xa4\x9a\xb2\xed\xc6\x2a\x49\x26\x8a\x7c\x06\x31\x38\xa2\xcd" "\xa6\x80\x70\x90\xf9\x14\x4d\xa6\x5e\xb9\xac\xc3\x82\x1c\xff\x39\xf5\xe6" "\x50\x6c\x75\x4c\x4d\x4d\xf1\xb6\x44\x01\xc7\xde\xa5\xec\x4c\xee\x52\x15" "\xb3\xbe\x1c\x2a\xf0\x59\xe1\x1a\x07\x51\x9e\x36\xf9\x9d\x1f\xdc\xca\xd7" "\x91\xa1\x6a\x8d\x9a\xc0\x6c\xac\x22\x48\x18\x6b\x74\x6a\x88\x74\x9c\x40" "\xf4\x1d\xfb\x66\x03\xec\x1d\x63\x9c\xe9\x45\xff\x95\xbe\xd5\x54\x7e\x37" "\x2a\xd1\xba\x68\x86\x51\x9f\xd0\x52\x4b\x9b\x3c\x04\x58\x0c\xc7\x63\x25" "\x1c\x63\x09\x61\xc3\xa8\xf0\x3e\xe9\x8f\xf5\xa0\x2b\x4a\x5a\x05\x42\x52" "\xf9\xec\xbe\x8e\x15\xd8\x13\x34\x4e\x14\x2a\xb3\x3a\xcc\x45\x62\x48\x49" "\x05\x18\x20\x2a\x9e\xb6\xad\xfd\x60\x2b\x41\x9a\x57\x09\x20\x91\xdd\xa9" "\xe4\x19\x11\x43\xbe\x0b\x02\x55\x6f\xfd\xb7\x0a\xdd\x9f\x3e\x67\x22\x16" "\x80\xbd\x8a\xa7\xb2\xf9\xbc\xf2\x93\x16\xea\x27\x6f\xf4\x2d\x36\x46\x22" "\xd2\xae\xca\xf7\xfd\x54\x23\x50\x65\x6d\x5d\x83\x01\x98\xc0\x6e\x21\x40" "\xeb\x3b\xae\x85\xcd\x9c\x1b\xd2\x46\xb8\x75\x45\x16\x61\x6e\x1e\x90\x49" "\x8f\x88\x9e\x53\x7a\xfe\x73\x3b\xd3\x84\xd9\x66\xb9\xe1\x6a\x78\x74\x05" "\x43\xa1\xa3\xce\x3f\x9f\x0f\x1f\x86\x16\xbc\x0e\x64\x84\xd9\xa7\xd8\x6d" "\x32\x91\xe0\xdf\xc1\xab\xa4\xce\x73\xe1\x76\xa5\x3c\x7b\x63\xbe\xcd\xbb" "\xd3\xde\xbf\xbc\xb0\x1a\x89\xfa\xa7\x3d\xf2\x72\x0d\xe0\xb0\xee\x7f\x1e" "\x40\xce\xc9\xe1\x6b\xcd\x08\xb6\xeb\x56\x01\x6e\xd6\x64\x13\xca\xda\x38" "\x69\xc5\x97\x85\xb5\x8a\x0b\xb7\x63\xbd\x1a\x58\x25\xcb\x1a\xbd\x00\x87" "\xfb\x6e\x4c\x0c\x54\x4b\xf0\xb4\x84\x8c\x8b\xe2\xb7\xb5\xee\x36\xd3\xc9" "\xd3\x34\xee\x93\xe9\x59\x73\xf5\x3d\xba\x82\xe0\x08\xdf\x39\xa0\x67\xbe" "\x88\x4d\xfa\x8f\x68\xac\x33\x12\xc4\xb9\x9e\x39\x19\x85\xb1\x9e\xa5\xf4" "\xa0\x98\x34\xbb\x7f\x5b\xdf\x79\x4c\xc7\x95\x94\x9e\xa5\x44\xe5\xeb\x88" "\xad\x22\xcd\x03\x67\x79\x14\x56\x2f\xfc\x62\x56\xaa\x51\x8d\x6e\x1b\x41" "\x91\xf4\x60\x3c\xb9\xaa\x98\x71\xc3\x98\x33\xf0\x47\xd1\xb0\x64\x8d\xde" "\x49\x6d\x59\x53\x00\x84\xc5\x71\x5f\x47\x4b\x2a\x05\x85\xd2\x71\xd8\xa1" "\x0d\xa0\xba\xe0\xcc\xb3\x9c\x3e\xba\xd9\x01\x08\x03\x69\xaf\x6f\x8e\x1d" "\x02\xeb\xbf\x6f\x3d\x59\x17\xb3\x47\x02\x8a\xfa\xec\x80\xef\x95\xf8\xf1" "\x43\xfd\xd6\x31\x42\x33\x62\xc7\xb8\xe8\x0e\x15\x2a\xb8\x31\xfa\x9f\xad" "\xf2\x28\xbd\x58\xa7\x87\xa6\x18\x49\x24\xf2\xe2\xbb\x91\xb2\xe5\x74\xf9" "\xab\x59\x88\xce\x06\x61\x25\x88\xf0\x4c\x4a\x02\x86\xd8\x08\x10\x7b\x5e" "\xfc\x8e\x32\x5d\x5f\xde\xbc\xe1\x75\xf4\x93\xc7\xa7\xa2\x7a\x68\x63\x42" "\xa3\x3e\x86\x94\x2e\x7e\x55\xbe\xc7\xd7\xcb\xd2\xcb\xce\x2c\x19\x09\xad" "\x7d\xc8\xff\x93\x0f\xbd\x0f\x31\x90\x3d\xef\x05\x8b\xc1\xd8\x96\x5b\x13" "\xd2\x4e\x2d\x59\x28\xf9\xcf\xd6\x68\xf0\xed\x7a\x73\xdb\x4e\x2d\x02\x3c" "\x83\xc4\x80\x18\x35\xb5\x71\x8e\x45\xc0\xe3\x8f\xcf\x35\x9e\x25\x09\x29" "\xf9\x49\xd8\x8f\x9f\x98\xc5\x62\x49\x52\xee\x8e\x90\x30\xda\x84\x12\x4b" "\x5f\x12\xa1\xc2\xe0\x4c\x26\xf3\xc5\x67\xee\xe9\x07\x89\xb1\x99\x0c\x48" "\xd1\x08\xec\x4a\x0c\x13\x02\xfc\x38\xe9\xab\xae\x34\x8d\x27\x64\xba\x14" "\xbf\xba\x12\xe4\x40\xfb\x79\xbd\x03\xa4\x38\x26\xbe\x4f\x53\x51\x33\x73" "\x0d\x7d\x1c\x33\xfd\x4f\xf4\x2c\xce\x1f\x76\xa1\x99\x45\x17\xc3\x13\xe7" "\x49\xeb\xd6\x5b\xb5\xe5\x93\x07\x7f\xe1\xa1\x02\x22\x07\x20\x24\x94\x4d" "\x25\x3b\x1a\x62\x16\x00\x0a\x94\x63\x38\x45\x24\xab\x6e\x14\xfe\xc4\xae" "\xa1\xfa\x46\xb2\xfb\x8d\x3b\x1f\xd3\xa1\x2e\xdb\xfe\x8e\xd2\xb5\x60\xe3" "\xf3\x5b\x9f\x85\x3e\xa7\x80\x16\x7b\xd4\x4e\x90\x46\xc4\x91\x86\x88\xaf" "\x3a\x97\x49\x10\xc6\xe6\x51\x08\xfa\xe6\xf7\x12\x8d\x36\x3e\x34\x5e\xd6" "\xac\x96\x30\x43\x46\xa8\xa2\x75\x40\x2b\x00\x05\x3e\x23\x50\x45\xf5\xf4" "\x67\xd6\x7d\x77\xc3\x5f\xfa\xe8\x60\xc0\x36\x3c\xdc\x0f\x73\x6f\x9d\x6c" "\xb8\x19\xcd\x03\xdf\xbc\xa2\x73\x42\xe8\xd9\x69\xaa\x21\x97\x6b\xa0\x99" "\x41\xff\xe1\x45\x2f\xa4\xfe\x64\x74\x32\x94\x35\xac\xc1\x58\x33\x98\xff" "\x47\x8b\x36\x2b\x02\x73\x8a\x43\x96\x22\x7c\xc5\xdf\x24\x5d\x99\x16\x0a" "\xf3\x11\xe0\xe5\x9f\xda\xfe\x75\xfd\xd9\x2c\x23\x8b\x57\x54\x27\xb5\x90" "\x0e\x1e\x02\xc2\xcf\xbb\x1a\x06\x17\x41\xb1\xc6\xee\xe9\x58\x54\x95\x05" "\xe5\xfd\xfc\x55\x95\x78\x2c\xc4\xc8\xf1\x33\x0b\xb3\x7e\xe2\x23\x20\x10" "\xbe\x2e\x09\xfd\x75\x95\xc4\x48\xdb\xb2\x5d\x6a\x62\xc0\x74\xb8\xde\xbc" "\xfd\x66\x85\xd1\x36\xba\x6c\x16\xd5\xa5\xca\x74\x14\x17\x3a\xce\x00\x96" "\x1f\xf3\x61\x96\xb3\x6b\xf0\x53\x8a\xd8\xec\x6a\x6a\x4f\x25\xf0\x0b\x87" "\x9d\xa8\xa4\x54\x38\x7d\xb8\xc0\x52\x98\x02\x7f\x79\xd7\x19\x0c\xab\xcd" "\xa9\x5c\x1f\x64\x92\x7a\xa2\x42\x5e\xeb\x84\x60\x7f\x78\x49\x58\xe2\xd2" "\x3a\x25\x55\x53\xa3\xea\xb0\x44\x2c\x52\x87\x54\x76\x5b\x31\x00\xa5\x5d" "\x39\x24\xee\xf4\x71\x4b\x19\xca\x4f\x01\x77\x88\x04\xf9\xfd\x4d\xa6\x7b" "\x8e\x76\x8a\xf3\x99\xba\x3e\x33\x29\x92\x0a\x38\x1c\x43\x03\x14\x54\x92" "\x79\x58\xbc\x20\xbf\x8c\x8c\xee\x18\x2c\xe3\xff\x6e\x28\x65\x99\x67\x1b" "\xf6\x43\x84\x02\x3d\xbf\xe5\x9b\x4d\x55\x59\xb6\xe1\x84\xc2\x33\xef\x9e" "\xcc\xc6\x22\x32\x4b\x2c\x48\xb5\x7c\x07\x75\xef\x90\x90\xc3\xdf\x1e\xb8" "\x11\x55\xe0\xbc\x80\xca\xf3\xaa\x15\x05\xac\xfa\x65\x20\x03\x65\xb8\x8c" "\x17\x6c\xc8\xba\xe9\xab\xb7\x6b\xa9\x2b\x8f\x07\x87\xa9\xec\x8a\xeb\x64" "\xe5\xc5\xc2\x9f\x5c\xf2\xc8\x5a\x7c\xf3\x9d\x73\x54\x83\x14\x1b\x43\x80" "\x4d\x64\xdc\x4d\xed\xea\xcf\x09\x53\x7b\xf2\xca\x2d\xb7\xd0\x34\x97\x18" "\xd8\x92\x9f\x03\xee\xed\x8c\x45\xca\x63\x6e\xe5\xdc\x57\xb3\x3b\x50\x13" "\x51\xa4\x1e\x47\xb8\x74\x60\xc7\xea\x47\x9a\xe8\xf0\x2a\x86\xb5\xd9\x1b" "\x1b\x27\x8a\xe5\x5b\x4f\x7f\xba\xf5\xa2\xed\x97\x20\xbd\x73\x57\x99\x32" "\x04\x0e\x84\xd6\x92\x4f\x03\x6d\x0a\xe0\x25\x0c\xad\xc2\x39\x8c\xbc\x5a" "\x08\x24\x8b\xac\x01\x57\x8b\x50\xc9\xf6\x93\x91\x5f\x91\xdd\x9c\xab\x46" "\xa7\xd6\xfe\x09\x45\xcc\xf5\x3d\x30\xc7\x07\x40\x3a\xd1\x40\x4c\xb7\xe7" "\xe5\x38\x65\xb8\x06\x8f\xf7\x93\x53\x39\xee\xe3\x4e\x9d\xc4\x1e\x5c\x14" "\x4d\xb0\x0f\xf2\xae\xd0\x18\x44\x29\x53\x32\xed\x40\xac\x32\x63\xf6\xfe" "\xa2\x90\xb1\x4c\xfa\xea\xfb\xbd\x1b\x5e\xa3\x79\x0f\xd6\x5b\x0d\xae\xa4" "\x41\xe8\x31\x72\x18\xd3\x93\x83\x84\x77\x21\xd6\x04\x94\x4e\x2b\x95\x89" "\x19\x41\xa7\xc7\xac\x1a\x44\xd8\x62\x86\xea\xda\xde\x21\x86\xc1\xd4\x0a" "\x87\xc1\x2e\x51\x80\xe1\xc2\xbf\xed\x43\xf0\x0b\xfa\x13\xd1\xe3\x97\xc6" "\xc5\xb2\x74\x78\x2d\xff\xf6\xc5\xbb\x2b\xdb\x46\x97\x48\x20\x54\xac\xcb" "\x46\x8e\xd7\x27\xad\x9c\x09\x06\x14\x60\xc5\x1d\x8c\xde\x72\x36\xc9\x44" "\xbf\x42\xe5\xc1\x97\x70\x82\x99\xab\x28\x3c\xec\x7a\x39\x56\x63\xe3\xd3" "\xa7\x22\x5b\x6f\xb4\x1b\xc8\xcd\x11\xea\xde\xe1\x6e\x61\xf7\xbc\x3c\x53" "\x15\x4e\x89\x4e\x7e\x4a\x6b\x43\xcb\xb5\xef\x9f\xd8\xa9\x06\xf3\xec\x56" "\x71\xf4\x21\x33\x68\x3c\xab\x49\x39\xd7\x0f\x8a\xa7\xd2\x94\x1d\x13\x09" "\xcf\xc5\xf6\xcc\xff\xb7\xe1\x46\xce\xe5\x90\x2a\xf1\xe3\x3b\xb6\xbf\xaf" "\x21\x80\xa2\xe3\xd7\xe9\x16\x64\x18\xff\x08\xa8\xb2\x91\xf7\xe5\x62\x14" "\x56\x18\x5d\x7d\x7b\xc9\x7d\x5a\xe3\x2f\x0b\x30\x5e\x27\x34\x9b\x67\xf3" "\xb7\xa7\x3b\x70\x10\x51\x22\x71\xde\x1d\x84\x5e\xc1\x8c\x8c\xf3\xf2\xfd" "\x9b\x15\xd5\xa0\x49\x11\x71\x28\xa8\x32\x51\xd5\x21\xdb\x4a\x60\x10\xc5" "\xdd\x99\x41\x01\x7c\x35\xac\x79\x62\x44\x16\xfd\x31\xde\x9f\x65\x29\xfe" "\xf8\x5f\xe8\x6e\x3a\xb9\xc6\x8e\x2f\xc5\x84\x29\xd4\x5a\xfb\xf2\x89\xbf" "\x77\xaf\x53\x68\x42\x1e\x50\xb0\x13\x42\x25\x08\x02\x78\x50\x68\x15\x1f" "\x7c\x12\x3e\xb1\x53\x39\x8a\x9c\x25\xc6\xd4\x42\xd6\x69\x64\xb6\x33\x90" "\x6f\x24\xb5\xdd\xde\x57\x78\x9b\x28\x5c\x5f\x23\x46\xd2\x8a\x1b\x4a\x5d" "\x14\x92\x66\x94\xe3\x31\xde\x8f\x21\xcc\x3a\x04\xfe\x92\xe3\xaf\x11\xbe" "\x63\x12\xfa\x3c\x49\x5a\xb1\x27\x01\x46\x79\xca\xe0\x4e\x41\x5b\xf6\xd7" "\x2e\xd7\x7d\xbc\x27\x08\x69\x19\x3c\xcc\x32\xc9\x76\xf6\x4e\x36\x1b\xe0" "\x68\xf4\xbe\xbf\x79\x18\x55\x05\xf4\x57\xce\xb7\x19\xd5\x65\x9a\x49\x63" "\xe5\xb5\xb0\xee\xe7\xbe\xa6\xbd\xc0\xc0\x65\x7c\x58\x5c\xef\x84\x1f\x82" "\x08\xe2\x12\x23\x40\xe8\x97\x2d\x6f\xb2\x7a\x66\xfe\x68\xbc\x90\xe7\x29" "\xa4\x4b\xf4\xec\xe4\x11\xc9\xb4\x41\xca\xa0\x68\x13\x5a\x4d\xd0\xd8\xb0" "\x59\xc3\xdc\x41\x5f\xf8\x65\x6b\xf3\x04\x10\xbd\x4a\x27\x57\xe9\x0c\x8f" "\xea\xe6\xad\xac\x49\x28\x07\x31\x0f\x96\xc8\x78\x4f\x88\x6c\x45\x62\x1f" "\x43\xf5\x6a\xa6\xf5\xfa\xad\xf6\xd3\xab\xb4\x64\x8c\x59\xf9\xac\x87\x4c" "\xb7\x9b\x15\xa6\x8f\xd5\x93\xdb\xc7\x8a\x16\x0e\x8b\xbe\xd3\x30\xe7\xe4" "\x31\x1e\x3b\x29\x26\xf0\xaf\x74\x8a\x06\xda\xe6\xac\x6a\x62\x3a\x12\x01" "\x82\x80\x53\xca\xe8\x41\x4c\x91\xbc\x14\xcf\x6f\x56\x73\xb9\x11\x6b\xfe" "\x39\x2e\x64\xa5\x65\x70\x9f\x94\xe5\xbc\xff\x1b\xc4\x76\xd2\x88\xb6\x5e" "\xa1\x2f\x4e\x8a\x82\x59\x56\xee\x2e\xd3\xa9\xd6\x00\xa0\x0b\x77\x44\xa2" "\xef\xde\xe1\x99\x09\x87\x6a\xe8\xc5\x2d\xbb\xb7\x55\x53\x45\xa5\x5a\x90" "\xc9\x55\x96\xc5\x99\xe4\x16\x27\x7c\x37\xe9\xd5\x51\x00\x8b\x0f\xa0\xc1" "\x3c\xb9\x96\x1b\x1b\x6e\xc8\x22\x1b\x3a\xfc\xd4\x93\xf7\x7c\xea\x6e\x7b" "\x35\x12\xa5\x24\x1f\x9a\x05\x10\x60\x76\x5a\xa1\x22\x15\x45\xf1\xfd\x12" "\x37\x52\x69\xf9\x15\x76\x0b\x74\x9d\x19\xf3\x8a\x04\x25\xbe\x3d\x1e\x87" "\xf4\xa2\x1c\xb3\x0b\x4f\x0f\xbb\x22\xed\x91\x52\x86\x21\x88\x5a\xd8\x71" "\xac\xb0\xf6\xb5\x36\xd2\xcd\x52\x72\xc0\x70\x7e\x1d\xb6\xb7\x9c\xa9\xcb" "\x1b\x44\xf3\x25\x78\xcb\xe1\x37\xa1\x6c\x5f\xe0\x5b\x82\xb1\x6b\x5a\xbf" "\x25\xb8\xd9\x24\xbe\xbd\x37\xf1\xfa\x9c\x4f\x22\x9f\x98\x3e\x46\x55\x6c" "\xfd\x43\x65\x12\xdb\xfa\xd1\xe7\xde\xe8\xad\x93\x5a\xd6\xe5\x2f\x3d\xd1" "\x96\x9e\xb1\xd0\x9b\x1e\x4f\x41\x66\x8b\xc1\x2a\x9e\x6c\x26\xe8\x3b\x4f" "\xf9\x65\x3f\x15\x4e\x47\x59\x85\x17\xe3\x10\xf2\xf9\x92\x8d\xe7\xda\x72" "\x8b\x35\x73\x60\x9e\xd8\x28\xa9\xcd\xd9\x85\xae\x11\x6b\x85\x2b\x14\x02" "\x23\xdc\x26\xe1\x60\xb5\x7a\x86\x4b\xe9\xf4\xf5\x82\xdc\xb5\x06\x78\x4f" "\xbe\x63\xd8\x03\x74\x64\x87\xb4\x37\xf5\x54\x58\xd1\xa2\x35\xe8\x0f\x46" "\x31\x0b\x30\x1e\xa3\x65\xc2\xde\xe2\x66\xda\x4e\xed\x32\x66\xa8\xbc\x88" "\xc4\xaa\x41\xdd\x98\xbc\xcd\x9b\x5d\x67\x90\x92\x57\x65\xe7\x90\xb2\xdf" "\x48\x2a\x5e\x62\x7f\x6a\x5e\xf1\xd8\x2c\xd8\x4f\xca\x6c\xf8\x48\xd5\x5b" "\x42\xe6\x17\x5d\x6e\x04\x47\x65\x6c\x90\x2c\xab\xd3\x6f\x34\x89\xa9\x29" "\x22\xdc\xa2\x58\x1f\xa4\xfe\x13\x09\xef\x24\xae\xd7\x56\x9c\xfe\x62\x08" "\x98\xcf\xaf\xf5\xe9\x95\x7e\xeb\x9d\x51\x16\x19\xc4\xbf\x29\x03\xde\xb0" "\x62\x41\x8b\xe8\x7c\x29\x7f\xac\xc8\x1c\x88\x8e\xa0\xd9\x72\xdc\x75\x31" "\xb4\xff\xd1\x10\x9b\xc2\xdd\x91\xa1\x46\xd2\xeb\xcf\x44\x95\x0b\x70\x99" "\x2a\x01\x7c\xe5\x78\x3f\xa0\x16\x19\x27\x75\x19\x1f\x57\x04\xb2\xbb\x7f" "\x2f\xec\x9a\x6c\xf6\xe0\x78\xd9\x62\x8d\x78\xc5\x11\x52\xdf\x4e\xc2\xc9" "\x40\x06\x85\xd8\x69\x51\x39\xae\x78\x9c\x12\x3f\x3b\x1b\xed\x7a\xad\x86" "\xe0\xa0\xbb\xed\x6a\x4f\xd2\x98\x6e\xb1\x6e\x23\x73\xfb\xd8\xa7\x3e\xd6" "\x10\xe2\xa4\x9a\xcb\x3c\xd9\xed\x61\x95\xef\x30\xf8\xc8\xa4\x7b\x12\x7b" "\x26\xc1\xf9\xf7\x87\xdb\x45\xec\x0f\x74\x33\xd3\x36\xac\x91\x98\x83\x44" "\xdb\x0b\x2b\x85\xed\xee\x12\x00\x23\x5b\xe4\x1e\xda\x85\x77\x0c\xcb\x5c" "\xd8\xbe\xbb\xbc\x11\x0a\x04\x50\xd0\x25\x18\xf4\x67\x5c\xcf\x41\xfd\x4f" "\xea\x09\x19\x80\xbf\x11\x4d\xee\x30\x86\xad\xc8\x66\xc9\xc0\xbc\x0b\x4c" "\x00\x51\x73\x2d\xe7\x5d\x7e\x44\xe1\x31\x79\x8e\x8b\x79\x7f\x18\xf6\x7b" "\xa1\x2b\x4a\x70\xba\xc0\x34\x6e\xa5\x53\xdd\xb0\x32\x1c\x89\xb5\x08\x3d" "\x11\x14\x11\xe8\x0a\x5e\x0f\x74\xf7\x43\xb9\x63\x7f\xed\x04\x6e\x1c\x35" "\xe3\x79\x30\x14\x07\x98\xca\x3b\x96\x0a\xfb\x3d\x12\x52\xd2\x5b\xdb\x44" "\x72\xa6\xd2\x7e\x7c\x87\xbd\x0f\x21\xfc\x97\x37\x97\xbe\xa0\x46\xfd\x92" "\x76\x7a\x42\x15\x75\x2c\xb1\xbe\xd7\x23\x83\x9e\x59\x09\x3e\x39\x3e\xab" "\x82\x7c\x0d\xc8\x1a\x70\x70\x7c\x65\x5f\x54\x37\xae\x69\xbc\x3b\x0b\x0f" "\x01\xcb\x3a\x52\xda\x2b\xbf\x7c\x01\x00\x34\x3a\xff\x24\x75\x08\x08\x15" "\x21\x90\x1c\xb2\xc7\xf6\x56\x86\x07\xf0\x4a\x22\x68\x2e\x84\x2f\x40\x66" "\x46\x8f\xbe\x82\x0d\x1a\xce\xc5\xd1\x84\x04\xc9\x71\x93\xdb\x4c\x1f\x97" "\x64\x76\xc7\x0a\x7f\xf3\xbc\x6b\xd4\x17\x34\xb6\x02\xec\x73\x5e\xda\x7f" "\x76\xe3\x62\x04\xa9\xa7\x8a\xe2\xb2\x2a\x1b\x4c\x46\xc9\x72\xe7\x7c\x2c" "\xb6\xd2\x86\x42\x96\xec\xaf\x8c\x5b\x38\xe8\x5e\xaa\xde\x83\x19\x9a\xc5" "\x53\x25\xe1\xef\xa1\xcb\xae\x0b\x9c\x91\x38\xaa\x97\xa4\x2a\xdb\xbd\x6d" "\x1a\x26\xf8\xb8\xe2\x9f\x2f\xd1\x7c\xd2\x1a\x44\x89\xd1\xa5\x8d\xaa\x21" "\x71\x86\xd2\x4c\x3b\x67\x23\x69\x3a\x33\x4a\x5a\x80\x37\xf1\x63\x7d\xf4" "\x7d\x7e\x2f\xd8\x21\x9e\xc8\x8b\x62\x6a\x57\xb4\x99\x0f\xbb\x62\x3a\x2d" "\x1a\xcb\x1c\xf3\x7a\xec\x37\xf7\x91\x75\x1d\xb4\xcb\x7d\x0e\xc0\xcb\x9d" "\x2b\xe9\xd1\x41\xe0\xc0\xa7\x5f\xfd\xb1\xcb\x48\xe9\x43\x67\x70\xb4\x52" "\xc6\x39\x36\x4a\xd2\xaa\xce\x47\xf3\xb5\x58\xf6\x58\xd9\x1e\xae\x1b\x0f" "\x4b\x45\xf7\xe2\x0a\x6e\xc0\x48\x9b\xe5\x47\x81\x4c\xa5\x7b\xfb\x61\x5d" "\xdd\x3c\xbe\x8c\x6b\x32\x76\xf1\xc7\x0c\x7b\xc7\x67\xec\x07\x5d\x5e\xa5" "\xd1\x89\xfb\x9f\x1c\x50\x6b\x9e\xeb\xe8\x80\xdf\xb1\x96\x7c\x8a\x0d\xf2" "\x31\x87\xc1\xea\xac\xa5\x40\x68\xd0\xc9\x63\x7c\x22\xff\x21\x39\x3f\x1f" "\xf1\x1e\xf8\xe7\xd5\x90\x6e\xdc\x5e\x64\xd1\x42\x1d\x2f\xcb\xee\x79\x54" "\x8b\xc0\xad\x7e\x9e\x3d\x24\x9e\x4a\xc1\x1e\x90\x96\x63\xa3\x9c\x59\x6a" "\x3e\x52\x59\xd8\x70\xda\xc9\xbb\xfa\x69\x30\x75\xf4\x5b\x53\xcc\xa2\xdb" "\x39\xb6\xda\x2f\x6f\x99\x82\xd2\x07\x9d\x07\x09\xbe\xc9\xff\x66\xcb\xee" "\x69\x6d\x5e\xc2\xd6\x4f\x13\x14\xc6\x87\xb3\xdb\x68\x48\x8d\x3c\x3e\xf6" "\x17\x97\x5b\x7b\xbc\xe8\xe8\xdb\x67\xd3\x4d\x8f\x4d\x41\x05\x83\xc8\x2d" "\x69\xf0\x0d\x80\xfa\x06\x20\x71\x14\xb4", 4096); *(uint64_t*)0x20000308 = 0x1000; *(uint64_t*)0x20000310 = 0x20004180; memcpy((void*)0x20004180, "%", 1); *(uint64_t*)0x20000318 = 1; syscall(SYS_writev, -1, 0x20000300ul, 2ul); *(uint32_t*)0x20000180 = 0xc; syscall(SYS_paccept, -1, 0x20000140ul, 0x20000180ul, 0xd0000000ul); res = syscall(SYS_semget, 0ul, 7ul, 0ul); if (res != -1) r[0] = res; *(uint16_t*)0x20000240 = 0; *(uint16_t*)0x20000242 = 6; *(uint16_t*)0x20000244 = 0x1000; *(uint16_t*)0x20000246 = 0; *(uint16_t*)0x20000248 = 0x40; *(uint16_t*)0x2000024a = 0; *(uint16_t*)0x2000024c = 0; *(uint16_t*)0x2000024e = 3; *(uint16_t*)0x20000250 = 0; *(uint16_t*)0x20000252 = 0; *(uint16_t*)0x20000254 = 7; *(uint16_t*)0x20000256 = 0; *(uint16_t*)0x20000258 = 0; *(uint16_t*)0x2000025a = 0; *(uint16_t*)0x2000025c = 0; *(uint16_t*)0x2000025e = 0; *(uint16_t*)0x20000260 = 0xfffc; *(uint16_t*)0x20000262 = 0; *(uint16_t*)0x20000264 = 1; *(uint16_t*)0x20000266 = 0xfff8; *(uint16_t*)0x20000268 = 0; syscall(SYS_semop, r[0], 0x20000240ul, 7ul); syscall(SYS_semop, r[0], 0ul, 0ul); syscall(SYS_semctl, r[0], 0ul, 8ul, 0ul); *(uint16_t*)0x20000040 = 0; *(uint16_t*)0x20000042 = 0xdce0; *(uint16_t*)0x20000044 = 0x800; *(uint16_t*)0x20000046 = 4; *(uint16_t*)0x20000048 = 8; *(uint16_t*)0x2000004a = 0x1000; syscall(SYS_semop, r[0], 0x20000040ul, 2ul); syscall(SYS_semctl, r[0], 0ul, 9ul, 0ul); res = syscall(SYS_getuid); if (res != -1) r[1] = res; syscall(SYS_lchown, 0ul, r[1], 0); syscall(SYS_getegid); memcpy((void*)0x20000180, "./file0\000", 8); res = syscall(SYS_open, 0x20000180ul, 0ul, 0ul); if (res != -1) r[2] = res; syscall(SYS_getsockopt, r[2], 0xfffful, 0x11ul, 0x20000040ul, 0ul); *(uint32_t*)0x20000100 = 0; syscall(SYS_getsockopt, 0xffffff9c, 0xfffful, 0x11ul, 0ul, 0x20000100ul); syscall(SYS_semctl, r[0], 0ul, 1ul, 0ul); syscall(SYS_semctl, r[0], 0ul, 2ul, 0x20000240ul); syscall(SYS_mmap, 0x20ffb000ul, 0x2000ul, 4ul, 0xa10ul, -1, 0ul, 0ul); res = syscall(SYS_open, 0ul, 0x70eul, 0ul); if (res != -1) r[3] = res; syscall(SYS_lseek, r[3], 0ul, 0xf9c3c9a4711b196dul); syscall(SYS_open, 0ul, 0x42000400000002c1ul, 0ul); syscall(SYS_semctl, -1, 0ul, 9ul, 0ul); } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); for (procid = 0; procid < 6; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; }