// https://syzkaller.appspot.com/bug?id=cb98d4633cad367e239e527e64850e1ddf489e70 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include struct thread_t { int created, running, call; pthread_t th; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static int collide; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { while (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &th->running, FUTEX_WAIT, 0, 0); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); __atomic_store_n(&th->running, 0, __ATOMIC_RELEASE); syscall(SYS_futex, &th->running, FUTEX_WAKE); } return 0; } static void execute(int num_calls) { int call, thread; running = 0; for (call = 0; call < num_calls; call++) { for (thread = 0; thread < sizeof(threads) / sizeof(threads[0]); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); pthread_create(&th->th, &attr, thr, th); } if (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) { th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); __atomic_store_n(&th->running, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &th->running, FUTEX_WAKE); if (collide && call % 2) break; struct timespec ts; ts.tv_sec = 0; ts.tv_nsec = 20 * 1000 * 1000; syscall(SYS_futex, &th->running, FUTEX_WAIT, 1, &ts); if (running) usleep((call == num_calls - 1) ? 10000 : 1000); break; } } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_call(int call) { long res; switch (call) { case 0: res = syscall(__NR_socket, 0x40000000015, 5, 0); if (res != -1) r[0] = res; break; case 1: *(uint16_t*)0x20fc4ff0 = 2; *(uint16_t*)0x20fc4ff2 = htobe16(0); *(uint32_t*)0x20fc4ff4 = htobe32(0x7f000001); *(uint8_t*)0x20fc4ff8 = 0; *(uint8_t*)0x20fc4ff9 = 0; *(uint8_t*)0x20fc4ffa = 0; *(uint8_t*)0x20fc4ffb = 0; *(uint8_t*)0x20fc4ffc = 0; *(uint8_t*)0x20fc4ffd = 0; *(uint8_t*)0x20fc4ffe = 0; *(uint8_t*)0x20fc4fff = 0; syscall(__NR_bind, r[0], 0x20fc4ff0, 0x10); break; case 2: memcpy((void*)0x203cbffc, "\x02\x00\x00\x00", 4); syscall(__NR_setsockopt, r[0], 0x114, 0xa, 0x203cbffc, 4); break; case 3: *(uint16_t*)0x20adf000 = 2; *(uint16_t*)0x20adf002 = htobe16(0); *(uint32_t*)0x20adf004 = htobe32(0x7f000001); *(uint8_t*)0x20adf008 = 0; *(uint8_t*)0x20adf009 = 0; *(uint8_t*)0x20adf00a = 0; *(uint8_t*)0x20adf00b = 0; *(uint8_t*)0x20adf00c = 0; *(uint8_t*)0x20adf00d = 0; *(uint8_t*)0x20adf00e = 0; *(uint8_t*)0x20adf00f = 0; syscall(__NR_connect, r[0], 0x20adf000, 0x10); break; case 4: *(uint64_t*)0x20000780 = 0x20000180; *(uint16_t*)0x20000180 = 3; memcpy((void*)0x20000182, "\xe4\x38\xca\xa7\x01\xbe\x4e", 7); *(uint32_t*)0x2000018c = 1; memcpy((void*)0x20000190, "\x46\xa7\x8b\xe3\x36\xa1\x14", 7); memcpy((void*)0x20000197, "\xae\xa1\x32\xde\x64\x05\xe2", 7); memcpy((void*)0x2000019e, "\x57\xf5\xcf\xf6\xd9\x30\xb7", 7); memcpy((void*)0x200001a5, "\x7b\xd9\x59\xd9\x58\x23\x77", 7); memcpy((void*)0x200001ac, "\x37\x78\x42\xf7\x5b\x81\x8e", 7); memcpy((void*)0x200001b3, "\x67\x3a\xe7\xfe\xed\xa6\x1d", 7); memcpy((void*)0x200001ba, "\xeb\x67\x17\x02\x52\x37\xb6", 7); memcpy((void*)0x200001c1, "\x1f\x39\xdd\xc1\x99\x70\x17", 7); *(uint32_t*)0x20000788 = 0x48; *(uint64_t*)0x20000790 = 0x20000500; *(uint64_t*)0x20000500 = 0x20000200; *(uint64_t*)0x20000508 = 0; *(uint64_t*)0x20000510 = 0x20000240; *(uint64_t*)0x20000518 = 0; *(uint64_t*)0x20000520 = 0x20000300; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0x20000400; *(uint64_t*)0x20000538 = 0; *(uint64_t*)0x20000798 = 4; *(uint64_t*)0x200007a0 = 0x200009c0; memcpy( (void*)0x200009c0, "\x50\x00\x00\x00\x00\x00\x00\x00\x0c\x01\x00\x00\x00\x00\x00\x00\x84" "\xb0\xc5\xdb\x61\xeb\xe7\x09\xf7\xd7\xd6\x04\xa4\x71\x5e\x8e\x56\x13" "\x46\xd3\xcc\xce\xd7\xea\x85\x3d\xab\xa2\xe1\xc0\xcd\xc9\x25\x8d\x83" "\x56\x6e\x54\xa1\xdd\xbb\xf2\x8a\xd0\xde\x1f\x5c\x67\xca\xd5\xae\x29" "\x3b\xa4\x1a\xa1\xe3\x1c\xbe\x7a\x7b\xcb\x00\x00\x18\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x43\x24\x00\x00\x00\x00" "\x00\x00\xd0\x00\x00\x00\x00\x00\x00\x00\x19\x01\x00\x00\xa7\x00\x00" "\x00\x82\x33\x99\x8a\x04\x15\x3d\xab\x36\x52\x78\x85\x80\xf1\x8a\xa8" "\xd7\x63\x84\x54\x53\x70\x11\xea\x2c\xfc\x4f\xf5\xce\x80\xa9\x90\xf5" "\xdb\x68\xec\x38\x5c\x86\x51\x32\x0b\x8c\x34\x85\xf9\x07\x57\xf8\xb8" "\x07\xe9\xd7\x97\x3c\xfb\xc0\x91\x25\xfa\x86\x27\xc7\x2a\x6d\x97\xd8" "\xe0\x81\x55\x53\x94\xe3\x05\x29\x47\x0d\x93\x11\x14\xbc\x66\x79\x39" "\x54\xb9\xce\xb5\xd4\x48\x0d\xdb\xec\xe8\xc8\x34\x71\x20\xa6\x65\x70" "\x0e\xe9\x95\x1d\x81\xb1\x29\x03\x5f\x6c\x02\x88\x00\x64\xf0\xa5\x10" "\x58\x38\x82\x46\xd4\x72\x5f\x1b\x6a\x25\x07\x63\x07\x21\x51\xff\x2c" "\x31\x19\x29\xf3\xa3\xc9\xa2\x63\x1f\x66\x0d\xcb\xbe\x9a\x64\x93\x1f" "\xb2\x43\x39\xec\xa1\xa4\x82\x2b\xa1\xa5\x54\x70\x0b\xbb\xf9\x38\x01" "\x98\x17\x8c\x7d\xaa\x14\x82\x6b\x29\x62\x88\x85\xd1\x32\x00\xca\x25" "\x00\x00\x00\x00\x00\x00\xe8\x00\x00\x00\x00\x00\x00\x00\x01\x01\x00" "\x00\x04\x00\x00\x00\xa9\x1b\x88\x2e\xca\xf0\xd0\x52\xe2\xf7\xe3\x0d" "\x85\x92\x2a\x86\x08\x3e\xf4\x85\x79\x09\x05\xc1\xc0\x4d\x0e\x99\xc7" "\xc9\x45\x48\x47\x90\x73\xa3\x4a\xdc\x23\x0a\x21\xb9\x6f\x33\xae\x7e" "\x38\x12\xc4\x78\xfb\x41\x0e\xbd\x19\x4f\x1b\x51\x3d\x09\x8c\xad\x13" "\xbd\x7c\x47\xd0\x66\xe8\x0e\xb7\xa9\x3e\x2d\xb7\xf7\xba\x0d\x03\xf5" "\xc5\x8a\x31\x0f\xaa\xd3\x44\x09\x2c\xd2\xf2\x1e\xaf\xae\x78\xb5\x36" "\x02\x49\x29\x1e\x95\x7f\x25\x82\xc7\xa8\x8b\x01\x6c\xf7\x72\xc8\x76" "\x5a\x82\xd0\xfd\xa7\x3e\x77\x75\xc3\xa0\x1d\x4e\x4f\x19\x29\x20\x10" "\x97\x8a\x87\x2d\x28\x56\x17\x79\x40\x5e\x6d\x53\xd7\x66\x0b\xf3\xe0" "\x59\x9c\x84\xf3\x47\x69\x4e\x52\x4d\xff\x36\x15\x88\x8b\x4c\x40\x86" "\x50\xea\x6f\xb6\xaf\x92\xf9\xd6\x39\x08\x49\xe8\x18\xe1\x94\xf5\x64" "\x03\xaa\x6c\x3b\x05\xe6\x74\x92\x65\x22\x2a\xfc\xc6\x27\xe3\x00\xa9" "\x06\x39\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x44\xa4\xe8\xe8\x2d\x34\xbe\x10\xc3\xd3\x32\xb8\xa7\x36\x70\x4e\x6f" "\xc9\x1e\x02\x6a\xb4\x24\xcc\x92\xe3\x3f\x5d\x32\xe9\x3e\xf2\x20\xb3" "\xdb\x6d\x58\xd3\xcb\x16\x18\x6a\x78\x95\x1d\xb5\x54\x1d\xd5\x0a\x5a" "\x6d\x46\xff\x51\x73\x8b\xc4\x89\xe4\xee\x7b\x02\x36\xd4\xf0\x6b\xa0" "\x0e\x2f\xba\x56\x48\x8c\x04\x50\x55\x70\x28\x8d\x1a\x07\x3d\xf2\xe6" "\xef\x58\x75\xd2\xc6\xa6\x87\x99\x56\xe4\x34\xd4\xfe\x9c\x55\x08\x1b" "\x77\x8b\xb1\xc6\x54\x50\x93\x3d\x63\xe9\xc3\xe2\x9f\x81\x10\x0e\xdd" "\x6a\x34\xc2\x92\x07\xde\xdc\x28\x5d\xf0\xab\xe3\xa0\xc6\x76\x93\xf1" "\xb3\xcb\x43\xde\xf0\xd8\x63\x59\x54\x7b\x4f\x9d\xf5\x04\x95\x32\x1c" "\x41\x1c\xee\x3d\x23\xcb\x3d\x01\xc5\x04\x62\x6e\x8d\x42\xef\x70\xda" "\x4c\xfd\x4e\xdb\x42\xa9\x37\xc6\x78\x9a\x8c\xeb\x49\xf2\x26\x34\xbf" "\xbc\xe0\x2b\x5b\x8c\x54\xe9\x5a\x08\xb3\x2d\x74\x3b\xe2\x64\x5f\x7f" "\x2c\xd1\x64\x05\x08\xd3\x67\xc3\x4a\x77\x62\x65\x4f\x3b", 762); *(uint64_t*)0x200007a8 = 0x2fa; *(uint32_t*)0x200007b0 = 0x80; syscall(__NR_recvmsg, r[0], 0x20000780, 0); break; case 5: *(uint64_t*)0x20159fc8 = 0; *(uint32_t*)0x20159fd0 = 0; *(uint64_t*)0x20159fd8 = 0x20fc8000; *(uint64_t*)0x20159fe0 = 0; *(uint64_t*)0x20159fe8 = 0x20000e8e; *(uint64_t*)0x20159ff0 = 0; *(uint32_t*)0x20159ff8 = 0; syscall(__NR_sendmsg, r[0], 0x20159fc8, 0); break; } } void loop() { execute(6); collide = 1; execute(6); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }