// https://syzkaller.appspot.com/bug?id=199d38362a1bbb5f8dc8775b7e49e1a9e3710185 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_io_setup #define __NR_io_setup 0 #endif #ifndef __NR_io_submit #define __NR_io_submit 2 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 208 #endif #ifndef __NR_socket #define __NR_socket 198 #endif uint64_t r[2] = {0x0, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // io_setup arguments: [ // n: int32 = 0x3 (4 bytes) // ctx: ptr[out, io_ctx] { // io_ctx (resource) // } // ] res = syscall(__NR_io_setup, /*n=*/3, /*ctx=*/0x20000000ul); if (res != -1) r[0] = *(uint64_t*)0x20000000; // socket arguments: [ // domain: socket_domain = 0xa (8 bytes) // type: socket_type = 0x1 (8 bytes) // proto: int32 = 0x0 (4 bytes) // ] // returns sock res = syscall(__NR_socket, /*domain=AF_INET6*/ 0xaul, /*type=SOCK_STREAM*/ 1ul, /*proto=*/0); if (res != -1) r[1] = res; // setsockopt$sock_linger arguments: [ // fd: sock (resource) // level: const = 0x1 (4 bytes) // optname: const = 0xd (4 bytes) // optval: ptr[in, linger] { // linger { // onoff: int32 = 0x1 (4 bytes) // linger: int32 = 0x3 (4 bytes) // } // } // optlen: len = 0x8 (8 bytes) // ] *(uint32_t*)0x20000300 = 1; *(uint32_t*)0x20000304 = 3; syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/1, /*optname=*/0xd, /*optval=*/0x20000300ul, /*optlen=*/8ul); // io_submit arguments: [ // ctx: io_ctx (resource) // nr: len = 0x3 (8 bytes) // iocbpp: ptr[in, array[ptr[in, iocb]]] { // array[ptr[in, iocb]] { // ptr[in, iocb] { // iocb { // aio_data: const = 0x0 (8 bytes) // aio_key: const = 0x0 (4 bytes) // aio_rw_flags: const = 0x0 (4 bytes) // aio_lio_opcode: lio_opcode = 0x0 (2 bytes) // aio_reqprio: int16 = 0x8 (2 bytes) // aio_fildes: fd (resource) // aio_buf: nil // aio_nbytes: len = 0x0 (8 bytes) // aio_offset: int64 = 0x0 (8 bytes) // aio_reserved2: const = 0x0 (8 bytes) // aio_flags: iocb_flags = 0x0 (4 bytes) // aio_resfd: fd_event (resource) // } // } // nil // nil // } // } // ] *(uint64_t*)0x200002c0 = 0x20000040; *(uint64_t*)0x20000040 = 0; *(uint32_t*)0x20000048 = 0; *(uint32_t*)0x2000004c = 0; *(uint16_t*)0x20000050 = 0; *(uint16_t*)0x20000052 = 8; *(uint32_t*)0x20000054 = r[1]; *(uint64_t*)0x20000058 = 0; *(uint64_t*)0x20000060 = 0; *(uint64_t*)0x20000068 = 0; *(uint64_t*)0x20000070 = 0; *(uint32_t*)0x20000078 = 0; *(uint32_t*)0x2000007c = -1; *(uint64_t*)0x200002c8 = 0; *(uint64_t*)0x200002d0 = 0; syscall(__NR_io_submit, /*ctx=*/r[0], /*nr=*/3ul, /*iocbpp=*/0x200002c0ul); return 0; }