// https://syzkaller.appspot.com/bug?id=ad83e0cb3d1c7f5590cf761e6a58c69261c76b68 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; *(uint32_t*)0x20000200 = 4; *(uint32_t*)0x20000204 = 0xe; *(uint64_t*)0x20000208 = 0x20000e80; memcpy( (void*)0x20000e80, "\xb7\x02\x00\x00\x00\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07\x02" "\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4\xf0\xff" "\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x6d\x64\x05\x00\x00\x00" "\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00\x01\x00\x00\x00" "\xb7\x05\x00\x00\x40\x00\x00\x00\x6a\x0a\x80\xfe\x00\x00\x00\x00\x85\x00" "\x00\x00\x53\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x95\x00\x00\x10" "\x00\x00\x00\x00\xa8\x05\x01\x36\x30\x34\xfd\xb1\x17\x16\x8b\xd0\x7b\xa0" "\x0a\xf7\x39\xd1\xa1\xee\x35\xfe\x16\x3a\x25\x5c\x33\x28\x20\x44\xb3\x24" "\x95\xef\x8a\xb9\xad\xc6\x7c\xcc\x94\x5f\x10\x5d\x80\x2f\x51\x32\x14\x3c" "\x0a\x9f\xc7\xa8\x44\x52\x56\x99\x57\xc1\x00\x2e\xd7\xd4\xd8\xe1\x7f\x79" "\x1f\x47\x98\xc8\xeb\x48\x3e\x99\x73\x32\x0d\x04\x6c\x31\x26\xc6\xaf\xcf" "\xd8\x4d\xe0\x33\x52\xc6\x9b\x3e\xdf\xf5\xbe\x26\x76\x5b\xa5\xf8\xf2\x87" "\x90\x21\xc2\xea\x53\xea\x79\xac\xd7\xfb\x38\xdd\x1a\xbb\x75\xaa\x39\x3c" "\xea\x26\xd4\x65\x63\x7d\x11\xf7\x05\x00\x00\x00\x47\x3e\x7b\x7c\x4a\xe7" "\xdd\x5e\x4d\xee\x88\x51\x8d\xdf\x12\xdd\xdd\x4b\xfc\x6a\x4d\xd3\xb6\xbe" "\xba\x51\x07\x42\x29\xb0\xd4\xb5\x04\x51\x6c\x4c\x3e\x5d\x1a\xa0\x44\xd8" "\xd0\x07\x28\x14\x1c\xd6\x7b\xcd\x68\xf2\x53\x28\x8e\x65\x5c\x6b\x34\xe0" "\x2e\x90\x63\x7e\xf2\x91\x2b\xa7\xde\x26\xff\x23\x57\xef\x17\xf9\x5a\x25" "\x78\x0c\x3a\x05\x78\x44\xf2\x26\xef\x4e\x91\x2f\x01\xa2\x01\xe6\x94\xe3" "\x80\x6e\x8c\x70\xe8\xb6\x95\x24\xcd\x19\xf7\x52\x5d\x8d\x66\xbb\x76\x6f" "\x7f\x3f\x91\x8c\x86\xa7\x02\x52\x23\x68\x00\x00\x18\x97\x13\x3a\xf9\x4a" "\x5a\x4c\xfc\x79\x4d\x8b\x9d\x7c\x33\x63\x21\x52\xc4\x8e\xaf\x30\x2f\x0b" "\x2e\x0c\x25\x2b\x00\x00\x00\x00\x00\x00\x00\x00\x6f\x1b\xbe\xfb\xe0\x8d" "\xe6\x5e\x37\x62\xe1\x94\xba\x4c\xae\x8b\x13\x53\x5d\x7d\x11\xee\x91\x7b" "\xca\x48\x85\xbb\xf5\x97\xa1\x4a\xb2\x45\x8e\xfc\xe7\x85\x10\xd8\x62\x72" "\xd8\x8e\x0c\x80\x88\xf4\x04\xf0\x11\x28\x9e\xbc\x56\x23\xfa\xa1\x18\x26" "\x32\x16\x1e\x07\x3a\xf1\xd6\x9a\x2e\x36\xbe\xd4\x35\x00\x00\x25\xec\xd2" "\x01\xd2\xff\xb0\xa7\xfa\x4f\x5d\x11\x06\x0c\xdc\xf0\x71\xde\xfd\x0a\x8b" "\xe3\xb6\x9c\xe3\xe4\xf3\x61\xac\xa7\x58\x27\x42\x6d\xde\x87\xfd\xf4\x61" "\x72\x22\x67\x42\x80\xf5\x5e\x98\x10\x74\x50\xc1\x9b\x9d\x86\x32\x9b\xd5" "\xb4\x69\x73\x36\x11\x2b\x0b\x87\x54\xce\x35\x74\x04\x6b\xf6\x11\x4d\x1a" "\x88\x59\x78\x50\xb7\x73\x78\xfa\x8e\xdf\xff\x8f\xaf\x8b\x8e\xc0\x39\xba" "\xb3\x85\xca\xc0\x53\x53\x73\xbb\x8f\xab\x90\x53\x9b\x1a\x65\xdd\xff\x84" "\x1e\xb6\x71\xf7\xfa\xf3\x7e\xbd\xfc\xce\xa0\xc0\x02\xad\x2b\x42\x04\x7c" "\x9e\xc4\x31\x93\xcc\xf6\x17\xdb\xf8\xa1\x2b\x4f\x18\x9e\xdb\xf9\xfb\x7c" "\x42\xb1\xf4\x35\xcc\xd4\xd9\x68\x22\xe6\xb7\x01\x00\x91\x2c\x92\xe3\x94" "\x3e\x9c\x4f\x45\xd8\xbc\xd5\x28\xfa\x8a\x3e\xa8\x47\xf1\x0e\x9b\x25\x06" "\xf3\xbb\x50\x6f\x1d\x7f\xbd\xf8\x01\x00\x00\x00\x00\x00\xa0\x73\xd0\xde" "\x55\x38\xab\x42\xe1\x70\xb3\xba\xae\x34\xc3\x59\x87\xb0\xdd\xa4\x97\xac" "\x3f\x5e\x97\xe6\xe6\xae\xea\x15\xc6\xd5\xed\x24\x31\x01\x00\x00\x00\x03" "\xbb\x60\x30\xf8\x4b\x63\xaa\xf8\x69\x0d\xb0\x22\x1b\x17\x05\xc5\x01\xf8" "\x02\xff\x59\xb4\xe6\x83\xef\xa4\xb6\xe7\x7e\x04\x20\x72\xbd\x2a\xc3\x7d" "\x41\x30\x08\xec\x9e\xb8\x16\x6f\x6e\x28\xb4\x9a\x77\xed\x91\xbe\xfc\x65" "\x31\x58\x78\xf8\x8a\x8f\xb1\xdd\x67\x9f\xb4\xc5\x15\xf8\xb7\xa5\xb7\xac" "\xa6\xa2\x51\xa8\x9d\x47\xb7\x28\x50\x2f\x7e\x62\x1c\xc0\xe3\xba\x04\x00" "\x00\x00\xc1\x49\xee\x66\x01\x72\x8c\x75\x0d\x30\x41\x97\xc2\x2d\xa8\x65" "\x05\x79\x47\x5a\xfd\x96\x18\x7d\x88\x1e\x93\xb4\x2a\x5f\xdf\xd6\x86\xd8" "\x90\x0c\x44\xc6\x71\x33\xda\xd5\x80\x37\xfd\xa6\x58\x85\xa1\x5a\x42\x9e" "\xdf\xe3\x02\x7a\x5e\xbf\x95\x25\x47\x44\xf1\x0f\xd6\x07\xbc\x33\x00\xb9" "\x49\x32\xb8\xd9\x44\x7c\x4d\xf6\xe2\x1e\xe0\xe5\x4f\x8b\xe0\x72\xe0\xb0" "\x83\xbb\xd8\x6b\x19\xcb\x07\x45\x77\xa2\x5f\xf5\x81\xd9\x2a\xf0\x8a\x06" "\xf8\x57\x31\x0a\x2f\x14\x32\x6b\x0b\x29\x02\x05\xe9\x1a\x68\x2e\x00\xc8" "\x76\x2c\xbc\x6b\x90\x4c\x98\x0e\xef\x6e\x6a\x1d\xef\x88\x6c\x95\x67\x6d" "\xce\x6a\x81\x94\x47\x97\x00\xa0\x2b\x92\xbd\xc8\xd0\x5e\xae\x1f\x24\xfd" "\xd7\xb8\x0d\x1b\xb4\x04\xc2\x2f\x68\x15\x94\xde\x2e\xbb\x96\x87\x21\x9d" "\xe8\xd7\x3a\xc8\x38\x23\xfe\xb4\x02\xa2\x41\x5a\x98\x50\xd5\xf0\x18\x3e" "\xc6\x7b\xe9\x6d\xc0\xe4\xc2\xd7\xac\xf1\xdf\xe7\x9d\x67\x71\x90\x3b\x76" "\xe2\x11\x90\xc2\x2d\x64\x10\x30\xe1\xdd\xac\xf0\x06\xc3\x11\x6e\x18\x03" "\xaf\x20\xa5\xf2\xb5\xf7\xba\x58\xac\xa5\xbc\xab\xbb\xab\x24\x41\x4a\x38" "\x10\x78\x8e\x55\x03\xe4\xbe\x66\xd6\x83\xda\xac\x5f\x00\x01\x00\x00\x77" "\x33\x9b\x42\x00\x00\x00\x00\x10\x8a\x3c\x87\xb1\x9d\x5b\x9a\x00\xc7\x5d" "\x84\xa9\x2d\x6d\xcf\x00\xba\x96\xed\xf3\x5e\xde\x0e\x2b\x57\xc2\x6e\x94" "\x80\x1b\x49\x89\x24\x16\x6b\xde\x57\xd5\xf2\x42\x58\xd9\xfd\x02\x80\x96" "\xcc\x15\xa8\xb9\x12\xb4\x94\xd4\xbb\xe6\x09\x03\x1e\xa1\xca\x65\xa5\x48" "\x97\x1d\x5d\x16\x29\x6d\xd0\x8e\x02\x00\x00\x00\x7a\x27\x31\x0d\x5d\x01" "\xf8\xa8\xa0\xf5\x21\x2d\x7f\x62\x8f\x55\x4a\xfe\xa7\x15\xcc\xbc\x66\xcb" "\xb1\x01\x64\x90\xf5\xd5\x79\x30\x8c\xb3\x18\x8c\xf2\xfc\xaf\x67\xe0\xc1" "\x64\x43\xd5\x26\xba\x4b\x96\x8f\x07\xae\x36\x2c\x21\x33\xc1\x68\x31\x3e" "\x84\xbe\xb8\x71\x20\x38\x80\xdd\x45\x3c\x45\xd0\xa1\x37\xd7\xf5\xa8\xb0" "\x39\xdb\xfa\x62\xfb\x2b\x42\x14\xf8\xe6\x9f\x96\x7b\xf1\xfb\xd8\x9e\x77" "\xfc\xca\x11\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\xf8\x87\x79\x94" "\xeb\xdc\x35\xf7\xef\xd4\x1e\x3b\xab\xd9\xb3\x78\x2e\xdd\x67\x76\xd5\xb6" "\xcb\x4e\xcd\x72\xc9\xde\x9b\x55\x03\x74\x7d\x71\x44\x03\x78\xcf\x2c\x2c" "\x7e\xa2\xdc\x5f\xeb\xb6\x54\xa8\x67\xf8\x53\x71\x3c\xf4\xc0\xbb\x32\x2f" "\xbb\xe4\x46\xd1\x8d\xee\x4c\x82\x12\x75\xef\x18\x25\x9c\xaf\xc3\x46\xc8" "\xb3\xb9\xfb\x0f\x3a\xdc\xf6\xea\x31\x0a\x6b\x9a\x3f\x59\xe2\x9a\x59\x09" "\xea\x04\x7f\xb6\x1a\xff\xb4\xbc\x8b\xbe\xa1\xfb\x76\x1b\x89\x33\x79\x5b" "\x1a\x91\x35\x8a\x77\x91\xaa\x84\x3d\x07\x02\x0e\x8b\xb6\xfc\x18\x45\x8c" "\x49\xac\x63\x13\xe7\x16\x5b\x7d\x9f\x65\xe9\x4a\x62\xb6\x9f\x10\x11\xb9" "\x43\x40\xcd\xb7\x30\x3f\x01\xe5\xcd\xb5\x68\x2d\xdf\x73\xd6\x5c\x3d\xe1" "\xd8\x8d\xd7\x49\x6d\x63\x45\xd5\xb9\xde\x02\x23\x98\x80\x56\xa5\x3e\x19" "\xa8\xb9\x6b\x96\x40\xbc\x6c\x09\xd3\xc2\xff\x89\x4d\x62\x6b\x57\xc7\x76" "\xed\x53\xf9\x4d\x5e\x22\xff\x14\x80\x61\xb3\x7f\x72\xbd\x92\x92\x4c\xb1" "\xd0\xa7\x25\xe1\x9b\x26\x43\x46\xb7\xca\xe0\x25\x1a\x85\x0d\xe7\x83\x16" "\x50\x3f\x3c\x3d\x39\x5c\x7e\x3f\x04\xfc\x8d\x52\x58\x33\x27\xcd\x23\x41" "\xce\x4b\x2d\x09\x28\x15\x37\x62\x99\x68\x6f\x41\x35\x3b\x28\x23\x81\x45" "\x63\x01\x1a\x22\x23\xb9\xdd", 1555); *(uint64_t*)0x20000210 = 0x20000340; memcpy((void*)0x20000340, "syzkaller\000", 10); *(uint32_t*)0x20000218 = 0; *(uint32_t*)0x2000021c = 0; *(uint64_t*)0x20000220 = 0; *(uint32_t*)0x20000228 = 0; *(uint32_t*)0x2000022c = 0; memset((void*)0x20000230, 0, 16); *(uint32_t*)0x20000240 = 0; *(uint32_t*)0x20000244 = 0; *(uint32_t*)0x20000248 = -1; *(uint32_t*)0x2000024c = 8; *(uint64_t*)0x20000250 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000258 = 0; *(uint32_t*)0x2000025c = 0x10; *(uint64_t*)0x20000260 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x20000268 = 0; *(uint32_t*)0x2000026c = 0; *(uint32_t*)0x20000270 = -1; res = syscall(__NR_bpf, 5ul, 0x20000200ul, 0x48ul); if (res != -1) r[0] = res; *(uint32_t*)0x20000280 = r[0]; *(uint32_t*)0x20000284 = 0xfeffff; *(uint32_t*)0x20000288 = 0xe80; *(uint32_t*)0x2000028c = 0x3f000002; *(uint64_t*)0x20000290 = 0x20000700; memcpy( (void*)0x20000700, "\xc4\x5c\x57\xce\x39\x5d\xe5\xb2\x89\xf0\x7d\x63\x7a\x22\x39\x20\xf1\x81" "\xc2\xe5\x7d\x71\x48\x3c\xfb\x2d\x07\x5a\x3f\xf0\x72\x58\xe0\x80\xa1\x94" "\x80\x5c\xdb\x0c\x26\xd3\xf7\xff\xb1\xe0\xd9\xcf\x4f\xa3\x6d\xcb\x21\x68" "\xb7\x2d\xe4\x8a\xc8\xf9\x3e\x68\x04\xf1\xc4\xd7\x08\x98\xd0\x81\x0e\x04" "\x4d\x7e\x17\x78\xea\xac\x5d\xfd\xcc\x9f\x12\x08\x90\x55\x22\x02\x5b\xcf" "\xdf\x1b\x6f\x96\x9b\x09\x4d\x5c\x02\x2c\x2b\x7f\xfe\xfd\xe7\x1e\x06\x27" "\xb9\xa2\x06\x9c\xc1\xe0\x17\x5c\x4b\x88\x60\xaa\xd4\xb0\xa1\x03\xc5\x89" "\xf6\x76\xb6\xc4\xe8\x5e\xb3\x95\x0c\x53\x3b\x6e\x62\xc3\x9c\xcf\x9a\xe9" "\xbf\xe5\x4e\xe5\x88\x73\x58\xd4\x4f\x46\x33\x7f\xbe\x09\x0d\x7c\x7e\x55" "\x84\x7e\xde\xe8\x13\x0f\xfd\x3d\x1e\x71\x9e\x01\xa6\x8b\x0e\x69\x1c\x0d" "\x35\xb0\xb5\x6e\x0b\x51\x40\x36\x34\x2f\xd5\x6f\x08\xac\x00\x83\xf3\xc2" "\xfe\x41\xa1\x29\x5a\x3d\x23\xcf\x3d\x16\x0d\x4f\xd9\x0f\x66\xbe\xba\x68" "\x86\x04\x56\xed\x41\x27\x2e\x1e\x68\xd1\x6c\x25\x64\xc8\x5f\x55\x56\xe1" "\x87\x84\x11\x3c\x49\x3d\x13\x25\x3e\x14\xd6\xeb\x89\x17\x07\xfb\xa3\xc3" "\x0d\x07\xd5\xee\x86\x19\xe4\x42\x6c\xaf\xec\x4c\xf6\xa3\x72\x3c\x45\x5d" "\x09\xb5\x86\xb2\x48", 275); *(uint64_t*)0x20000298 = 0; *(uint32_t*)0x200002a0 = 0xf0; *(uint32_t*)0x200002a4 = 0; *(uint32_t*)0x200002a8 = 0xf0; *(uint32_t*)0x200002ac = 0xffffff0c; *(uint64_t*)0x200002b0 = 0x20000000; *(uint64_t*)0x200002b8 = 0x20000000; *(uint32_t*)0x200002c0 = 0; *(uint32_t*)0x200002c4 = 0; syscall(__NR_bpf, 0xaul, 0x20000280ul, 0x40ul); return 0; }