// https://syzkaller.appspot.com/bug?id=b2cd598a25df89b531fc9d1093a30c2cad90aa3b // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_renameat2 #define __NR_renameat2 316 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; memcpy((void*)0x200000c0, "./file0\000", 8); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000c0ul, /*mode=*/0ul); memcpy((void*)0x20000040, "./file0\000", 8); memcpy((void*)0x20000080, "tmpfs\000", 6); syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x20000040ul, /*type=*/0x20000080ul, /*flags=*/0ul, /*opts=*/0ul); memcpy((void*)0x20000000, "./file0/file0\000", 14); syscall(__NR_mkdir, /*path=*/0x20000000ul, /*mode=*/0ul); memcpy((void*)0x20000080, "./file0\000", 8); memcpy((void*)0x200002c0, "./file0\000", 8); memcpy((void*)0x20000200, "incremental-fs\000", 15); syscall(__NR_mount, /*src=*/0x20000080ul, /*dst=*/0x200002c0ul, /*type=*/0x20000200ul, /*flags=*/0ul, /*opts=*/0ul); memcpy((void*)0x200000c0, "./file0/../file0\000", 17); syscall(__NR_chdir, /*dir=*/0x200000c0ul); memcpy((void*)0x20000280, ".\000", 2); res = syscall(__NR_open, /*file=*/0x20000280ul, /*flags=*/0ul, /*mode=*/0ul); if (res != -1) r[0] = res; memcpy((void*)0x20000200, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)" "Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$" "\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>" "\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78); syscall(__NR_mkdirat, /*fd=*/r[0], /*path=*/0x20000200ul, /*mode=*/0ul); memcpy((void*)0x20000180, "./file0\000", 8); memcpy((void*)0x20000300, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)" "Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$" "\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>" "\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78); syscall(__NR_renameat2, /*oldfd=*/r[0], /*old=*/0x20000180ul, /*newfd=*/r[0], /*new=*/0x20000300ul, /*flags=RENAME_EXCHANGE*/ 2ul); memcpy((void*)0x20004b00, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)" "Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$" "\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>" "\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78); memcpy((void*)0x20000100, "./file0/../file0\000", 17); syscall(__NR_renameat2, /*oldfd=*/r[0], /*old=*/0x20004b00ul, /*newfd=*/0xffffff9c, /*new=*/0x20000100ul, /*flags=*/0ul); return 0; }