// https://syzkaller.appspot.com/bug?id=4e0e5ce9666e5de0b1eb096218dd28978ef94bf8 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #ifndef __NR_close #define __NR_close 57 #endif #ifndef __NR_ioctl #define __NR_ioctl 29 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_openat #define __NR_openat 56 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 211 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 208 #endif #ifndef __NR_socket #define __NR_socket 198 #endif #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[10] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // openat$tun arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2f 64 65 76 2f 6e 65 74 2f 74 75 6e 00} (length 0xd) // } // flags: open_flags = 0x82c03 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_tun memcpy((void*)0x20000240, "/dev/net/tun\000", 13); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000240ul, /*flags=O_NONBLOCK|O_CLOEXEC|FASYNC|O_APPEND|0x3*/ 0x82c03, /*mode=*/0); if (res != -1) r[0] = res; // ioctl$TUNSETIFF arguments: [ // fd: fd_tun (resource) // cmd: const = 0x400454ca (4 bytes) // arg: ptr[in, ifreq_dev_t[devnames, flags[tun_setiff_flags, int16]]] { // ifreq_dev_t[devnames, flags[tun_setiff_flags, int16]] { // ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 30 00 00 00 00 00 00} // (length 0x10) elem: tun_setiff_flags = 0x7101 (2 bytes) pad = 0x0 // (22 bytes) // } // } // ] memcpy((void*)0x20000040, "syzkaller0\000\000\000\000\000\000", 16); *(uint16_t*)0x20000050 = 0x7101; syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x400454ca, /*arg=*/0x20000040ul); // openat$tun arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2f 64 65 76 2f 6e 65 74 2f 74 75 6e 00} (length 0xd) // } // flags: open_flags = 0x0 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_tun memcpy((void*)0x20000400, "/dev/net/tun\000", 13); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000400ul, /*flags=*/0, /*mode=*/0); if (res != -1) r[1] = res; // close arguments: [ // fd: fd (resource) // ] syscall(__NR_close, /*fd=*/r[1]); // socket arguments: [ // domain: socket_domain = 0x400000000010 (8 bytes) // type: socket_type = 0x3 (8 bytes) // proto: int32 = 0x0 (4 bytes) // ] // returns sock res = syscall(__NR_socket, /*domain=AF_NETLINK|0x400000000000*/ 0x400000000010ul, /*type=SOCK_RAW*/ 3ul, /*proto=*/0); if (res != -1) r[2] = res; // ioctl$sock_SIOCGIFINDEX arguments: [ // fd: sock (resource) // cmd: const = 0x8933 (4 bytes) // arg: ptr[out, ifreq_dev_t[devnames, ifindex]] { // ifreq_dev_t[devnames, ifindex] { // ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 30 00 00 00 00 00 00} // (length 0x10) elem: ifindex (resource) pad = 0x0 (20 bytes) // } // } // ] memcpy((void*)0x20000380, "syzkaller0\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0x8933, /*arg=*/0x20000380ul); if (res != -1) r[3] = *(uint32_t*)0x20000390; // sendmsg$nl_route_sched arguments: [ // fd: sock_nl_route (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] { // msghdr_netlink[netlink_msg_route_sched] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_route_sched]] { // iovec[in, netlink_msg_route_sched] { // addr: ptr[in, netlink_msg_route_sched] { // union netlink_msg_route_sched { // newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], // tcmsg[AF_UNSPEC], rtm_tca_policy] { // len: len = 0x2c (4 bytes) // type: const = 0x24 (2 bytes) // flags: netlink_msg_flags = 0x4ee4e6a52ff56541 (2 bytes) // seq: int32 = 0x70bd2a (4 bytes) // pid: int32 = 0xffffffff (4 bytes) // payload: tcmsg[AF_UNSPEC] { // family: const = 0x0 (1 bytes) // tcm__pad1: const = 0x0 (1 bytes) // tcm__pad2: const = 0x0 (2 bytes) // ifindex: ifindex (resource) // tcm_handle: tcm_handle { // minor: tcm_handle_offsets = 0x0 (2 bytes) // major: tcm_handle_offsets = 0x7 (2 bytes) // } // tcm_parent: tcm_handle { // minor: tcm_handle_offsets = 0xffff (2 bytes) // major: tcm_handle_offsets = 0xffff (2 bytes) // } // tcm_info: tcm_handle { // minor: tcm_handle_offsets = 0x0 (2 bytes) // major: tcm_handle_offsets = 0x0 (2 bytes) // } // } // attrs: array[rtm_tca_policy] { // union rtm_tca_policy { // qdisc_kind_options: union qdisc_kind_options { // q_qfg: nlattr_t[const[TCA_KIND, int16], // string["qfq"]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {71 66 71 00} (length 0x4) // size: buffer: {} (length 0x0) // } // } // } // } // } // } // } // len: len = 0x2c (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x40004 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200012c0 = 0; *(uint32_t*)0x200012c8 = 0; *(uint64_t*)0x200012d0 = 0x20000080; *(uint64_t*)0x20000080 = 0x20000200; *(uint32_t*)0x20000200 = 0x2c; *(uint16_t*)0x20000204 = 0x24; *(uint16_t*)0x20000206 = 0x6541; *(uint32_t*)0x20000208 = 0x70bd2a; *(uint32_t*)0x2000020c = -1; *(uint8_t*)0x20000210 = 0; *(uint8_t*)0x20000211 = 0; *(uint16_t*)0x20000212 = 0; *(uint32_t*)0x20000214 = r[3]; *(uint16_t*)0x20000218 = 0; *(uint16_t*)0x2000021a = 7; *(uint16_t*)0x2000021c = -1; *(uint16_t*)0x2000021e = -1; *(uint16_t*)0x20000220 = 0; *(uint16_t*)0x20000222 = 0; *(uint16_t*)0x20000224 = 8; *(uint16_t*)0x20000226 = 1; memcpy((void*)0x20000228, "qfq\000", 4); *(uint64_t*)0x20000088 = 0x2c; *(uint64_t*)0x200012d8 = 1; *(uint64_t*)0x200012e0 = 0; *(uint64_t*)0x200012e8 = 0; *(uint32_t*)0x200012f0 = 0x40004; syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x200012c0ul, /*f=*/0ul); // ioctl$SIOCSIFHWADDR arguments: [ // fd: fd_tun (resource) // cmd: const = 0x8914 (4 bytes) // arg: ptr[in, ifreq_dev_t[devnames, mac_addr]] { // ifreq_dev_t[devnames, mac_addr] { // ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 30 00 00 00 00 00 00} // (length 0x10) elem: union mac_addr { // multicast: buffer: {bb bb bb bb bb bb} (length 0x6) // } // pad = 0x0 (18 bytes) // } // } // ] memcpy((void*)0x20002280, "syzkaller0\000\000\000\000\000\000", 16); memset((void*)0x20002290, 187, 6); syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x8914, /*arg=*/0x20002280ul); // socket arguments: [ // domain: socket_domain = 0x400000000010 (8 bytes) // type: socket_type = 0x3 (8 bytes) // proto: int32 = 0x0 (4 bytes) // ] // returns sock res = syscall(__NR_socket, /*domain=AF_NETLINK|0x400000000000*/ 0x400000000010ul, /*type=SOCK_RAW*/ 3ul, /*proto=*/0); if (res != -1) r[4] = res; // ioctl$sock_SIOCGIFINDEX arguments: [ // fd: sock (resource) // cmd: const = 0x8933 (4 bytes) // arg: ptr[out, ifreq_dev_t[devnames, ifindex]] { // ifreq_dev_t[devnames, ifindex] { // ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 30 00 00 00 00 00 00} // (length 0x10) elem: ifindex (resource) pad = 0x0 (20 bytes) // } // } // ] memcpy((void*)0x20000380, "syzkaller0\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[4], /*cmd=*/0x8933, /*arg=*/0x20000380ul); if (res != -1) r[5] = *(uint32_t*)0x20000390; // socket$kcm arguments: [ // domain: const = 0x11 (8 bytes) // type: kcm_socket_type = 0x3 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_kcm res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=SOCK_DGRAM|0x1*/ 3ul, /*proto=*/0); if (res != -1) r[6] = res; // socket$unix arguments: [ // domain: const = 0x1 (8 bytes) // type: unix_socket_type = 0x1 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_unix res = syscall(__NR_socket, /*domain=*/1ul, /*type=SOCK_STREAM*/ 1ul, /*proto=*/0); if (res != -1) r[7] = res; // ioctl$sock_SIOCGIFINDEX arguments: [ // fd: sock (resource) // cmd: const = 0x8933 (4 bytes) // arg: ptr[out, ifreq_dev_t[devnames, ifindex]] { // ifreq_dev_t[devnames, ifindex] { // ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 30 00 00 00 00 00 00} // (length 0x10) elem: ifindex (resource) pad = 0x0 (20 bytes) // } // } // ] memcpy((void*)0x20000100, "syzkaller0\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[7], /*cmd=*/0x8933, /*arg=*/0x20000100ul); if (res != -1) r[8] = *(uint32_t*)0x20000110; // socket arguments: [ // domain: socket_domain = 0x400000000010 (8 bytes) // type: socket_type = 0x3 (8 bytes) // proto: int32 = 0x0 (4 bytes) // ] // returns sock res = syscall(__NR_socket, /*domain=AF_NETLINK|0x400000000000*/ 0x400000000010ul, /*type=SOCK_RAW*/ 3ul, /*proto=*/0); if (res != -1) r[9] = res; // sendmsg$nl_route_sched arguments: [ // fd: sock_nl_route (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] { // msghdr_netlink[netlink_msg_route_sched] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_route_sched]] { // iovec[in, netlink_msg_route_sched] { // addr: ptr[in, netlink_msg_route_sched] { // union netlink_msg_route_sched { // newtfilter: netlink_msg_t[const[RTM_NEWTFILTER, int16], // tcmsg[AF_UNSPEC], filter_policy] { // len: len = 0x88 (4 bytes) // type: const = 0x2c (2 bytes) // flags: netlink_msg_flags = 0xd3f (2 bytes) // seq: int32 = 0x10bd2d (4 bytes) // pid: int32 = 0x25dfdbfd (4 bytes) // payload: tcmsg[AF_UNSPEC] { // family: const = 0x0 (1 bytes) // tcm__pad1: const = 0x0 (1 bytes) // tcm__pad2: const = 0x0 (2 bytes) // ifindex: ifindex (resource) // tcm_handle: tcm_handle { // minor: tcm_handle_offsets = 0xc (2 bytes) // major: tcm_handle_offsets = 0xfff3 (2 bytes) // } // tcm_parent: tcm_handle { // minor: tcm_handle_offsets = 0x0 (2 bytes) // major: tcm_handle_offsets = 0x0 (2 bytes) // } // tcm_info: tcm_handle { // minor: tcm_handle_offsets = 0x8 (2 bytes) // major: tcm_handle_offsets = 0x7 (2 bytes) // } // } // attrs: array[filter_policy] { // union filter_policy { // filter_kind_options: union filter_kind_options { // f_basic: tca_kind_options_t["basic", // array[basic_policy]] { // TCA_KIND: nlattr_t[const[TCA_KIND, int16], // string["basic"]] { // nla_len: offsetof = 0xa (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {62 61 73 69 63 00} (length // 0x6) size: buffer: {} (length 0x0) pad = 0x0 (2 // bytes) // } // TCA_OPTIONS: nlattr_t[const[TCA_OPTIONS, int16], // array[basic_policy]] { // nla_len: offsetof = 0x58 (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: array[basic_policy] { // union basic_policy { // TCA_BASIC_ACT: nlattr_t[const[TCA_BASIC_ACT, // int16], array[tca_actions]] { // nla_len: offsetof = 0x54 (2 bytes) // nla_type: const = 0x3 (2 bytes) // payload: array[tca_actions] { // union tca_actions { // m_mirred: // nlattr_tt[int16:14[0:TCA_ACT_MAX_PRIO], // 0, 0, tcf_action_policy["mirred", // mirred_policy]] { // nla_len: offsetof = 0x50 (2 bytes) // nla_type: int16 = 0x1 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 // bytes) NLA_F_NESTED: const = 0x0 (1 // bytes) payload: // tcf_action_policy["mirred", // mirred_policy] { // TCA_ACT_KIND: // nlattr_t[const[TCA_ACT_KIND, // int16], string["mirred"]] { // nla_len: offsetof = 0xb (2 // bytes) nla_type: const = 0x1 (2 // bytes) payload: buffer: {6d 69 // 72 72 65 64 00} (length 0x7) // size: buffer: {} (length 0x0) // pad = 0x0 (1 bytes) // } // TCA_ACT_OPTIONS: // nlattr_tt[const[TCA_ACT_OPTIONS, // int16:14], 0, 1, // array[mirred_policy]] { // nla_len: offsetof = 0x24 (2 // bytes) nla_type: const = 0x2 (1 // bytes) NLA_F_NET_BYTEORDER: // const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 // bytes) payload: // array[mirred_policy] { // union mirred_policy { // TCA_MIRRED_PARMS: // nlattr_t[const[TCA_MIRRED_PARMS, // int16], tc_mirred] { // nla_len: offsetof = 0x20 // (2 bytes) nla_type: const // = 0x2 (2 bytes) payload: // tc_mirred { // tc_gen: tc_gen { // index: int32 = 0x7 (4 // bytes) capab: int32 = // 0x4 (4 bytes) action: // tc_actions = 0x4 (4 // bytes) refcnt: int32 = // 0xb (4 bytes) bindcnt: // int32 = 0xdc (4 bytes) // } // eaction: // tc_mirred_eactions = 0x2 // (4 bytes) ifindex: // ifindex (resource) // } // size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // TCA_ACT_COOKIE: // nlattr_t[const[TCA_ACT_COOKIE, // int16], array[int8]] { // nla_len: offsetof = 0x4 (2 // bytes) nla_type: const = 0x6 (2 // bytes) payload: buffer: {} // (length 0x0) size: buffer: {} // (length 0x0) // } // TCA_ACT_FLAGS: // nlattr_t[const[TCA_ACT_FLAGS, // int16], // nla_bitfield32[tcf_action_policy_flags]] // { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = 0x7 (2 // bytes) payload: // nla_bitfield32[tcf_action_policy_flags] // { // value: tcf_action_policy_flags // = 0x0 (4 bytes) selector: // tcf_action_policy_flags = 0x0 // (4 bytes) // } // size: buffer: {} (length 0x0) // } // TCA_ACT_HW_STATS: // nlattr_t[const[TCA_ACT_HW_STATS, // int16], // nla_bitfield32[tcf_action_policy_hw_stats]] // { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = 0x8 (2 // bytes) payload: // nla_bitfield32[tcf_action_policy_hw_stats] // { // value: // tcf_action_policy_hw_stats = // 0x0 (4 bytes) selector: // tcf_action_policy_hw_stats = // 0x3 (4 bytes) // } // size: buffer: {} (length 0x0) // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // } // } // } // } // } // len: len = 0x88 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x10 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x8080 (8 bytes) // ] *(uint64_t*)0x200001c0 = 0; *(uint32_t*)0x200001c8 = 0; *(uint64_t*)0x200001d0 = 0x20000200; *(uint64_t*)0x20000200 = 0x20004800; *(uint32_t*)0x20004800 = 0x88; *(uint16_t*)0x20004804 = 0x2c; *(uint16_t*)0x20004806 = 0xd3f; *(uint32_t*)0x20004808 = 0x10bd2d; *(uint32_t*)0x2000480c = 0x25dfdbfd; *(uint8_t*)0x20004810 = 0; *(uint8_t*)0x20004811 = 0; *(uint16_t*)0x20004812 = 0; *(uint32_t*)0x20004814 = r[8]; *(uint16_t*)0x20004818 = 0xc; *(uint16_t*)0x2000481a = 0xfff3; *(uint16_t*)0x2000481c = 0; *(uint16_t*)0x2000481e = 0; *(uint16_t*)0x20004820 = 8; *(uint16_t*)0x20004822 = 7; *(uint16_t*)0x20004824 = 0xa; *(uint16_t*)0x20004826 = 1; memcpy((void*)0x20004828, "basic\000", 6); *(uint16_t*)0x20004830 = 0x58; *(uint16_t*)0x20004832 = 2; *(uint16_t*)0x20004834 = 0x54; *(uint16_t*)0x20004836 = 3; *(uint16_t*)0x20004838 = 0x50; STORE_BY_BITMASK(uint16_t, , 0x2000483a, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000483b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000483b, 0, 7, 1); *(uint16_t*)0x2000483c = 0xb; *(uint16_t*)0x2000483e = 1; memcpy((void*)0x20004840, "mirred\000", 7); *(uint16_t*)0x20004848 = 0x24; STORE_BY_BITMASK(uint16_t, , 0x2000484a, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000484b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000484b, 1, 7, 1); *(uint16_t*)0x2000484c = 0x20; *(uint16_t*)0x2000484e = 2; *(uint32_t*)0x20004850 = 7; *(uint32_t*)0x20004854 = 4; *(uint32_t*)0x20004858 = 4; *(uint32_t*)0x2000485c = 0xb; *(uint32_t*)0x20004860 = 0xdc; *(uint32_t*)0x20004864 = 2; *(uint32_t*)0x20004868 = r[3]; *(uint16_t*)0x2000486c = 4; *(uint16_t*)0x2000486e = 6; *(uint16_t*)0x20004870 = 0xc; *(uint16_t*)0x20004872 = 7; *(uint32_t*)0x20004874 = 0; *(uint32_t*)0x20004878 = 0; *(uint16_t*)0x2000487c = 0xc; *(uint16_t*)0x2000487e = 8; *(uint32_t*)0x20004880 = 0; *(uint32_t*)0x20004884 = 3; *(uint64_t*)0x20000208 = 0x88; *(uint64_t*)0x200001d8 = 1; *(uint64_t*)0x200001e0 = 0; *(uint64_t*)0x200001e8 = 0; *(uint32_t*)0x200001f0 = 0x10; syscall(__NR_sendmsg, /*fd=*/r[9], /*msg=*/0x200001c0ul, /*f=MSG_MORE|MSG_EOR*/ 0x8080ul); // setsockopt$sock_attach_bpf arguments: [ // fd: sock (resource) // level: const = 0x107 (4 bytes) // optname: const = 0xf (4 bytes) // optval: ptr[in, fd_bpf_prog] { // fd_bpf_prog (resource) // } // optlen: len = 0x56 (8 bytes) // ] *(uint32_t*)0x20000600 = -1; syscall(__NR_setsockopt, /*fd=*/r[6], /*level=*/0x107, /*optname=*/0xf, /*optval=*/0x20000600ul, /*optlen=*/0x56ul); // sendmsg$kcm arguments: [ // fd: sock_kcm (resource) // msg: ptr[in, send_msghdr] { // send_msghdr { // msg_name: ptr[in, sockaddr_storage] { // union sockaddr_storage { // xdp: sockaddr_xdp { // sxdp_family: const = 0x2c (2 bytes) // sxdp_flags: sxdp_flags = 0x0 (2 bytes) // sxdp_ifindex: ifindex (resource) // sxdp_queue_id: int32 = 0x42 (4 bytes) // sxdp_shared_umem_fd: const = 0x0 (4 bytes) // } // } // } // msg_namelen: len = 0x80 (4 bytes) // pad = 0x0 (4 bytes) // msg_iov: ptr[in, array[iovec[in, array[int8]]]] { // array[iovec[in, array[int8]]] { // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {27 03 02 00 dc 0f 14 00 0e 00 03 00 00 24 c1 02 00 // 00 ff 11 07 c2 fb 7f e0 40 00 18 53 4b 4f 6b 3d 32 7d b4 12 // f4 00 00 00 00 00 00 00 00} (length 0x2e) // } // len: len = 0x2e (8 bytes) // } // } // } // msg_iovlen: len = 0x1 (8 bytes) // msg_control: nil // msg_controllen: bytesize = 0x0 (8 bytes) // msg_flags: const = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x4005 (8 bytes) // ] *(uint64_t*)0x20000280 = 0x20000540; *(uint16_t*)0x20000540 = 0x2c; *(uint16_t*)0x20000542 = 0; *(uint32_t*)0x20000544 = r[5]; *(uint32_t*)0x20000548 = 0x42; *(uint32_t*)0x2000054c = 0; *(uint32_t*)0x20000288 = 0x80; *(uint64_t*)0x20000290 = 0x20000440; *(uint64_t*)0x20000440 = 0x200001c0; memcpy((void*)0x200001c0, "\x27\x03\x02\x00\xdc\x0f\x14\x00\x0e\x00\x03\x00\x00\x24\xc1\x02\x00" "\x00\xff\x11\x07\xc2\xfb\x7f\xe0\x40\x00\x18\x53\x4b\x4f\x6b\x3d\x32" "\x7d\xb4\x12\xf4\x00\x00\x00\x00\x00\x00\x00\x00", 46); *(uint64_t*)0x20000448 = 0x2e; *(uint64_t*)0x20000298 = 1; *(uint64_t*)0x200002a0 = 0; *(uint64_t*)0x200002a8 = 0; *(uint32_t*)0x200002b0 = 0; syscall(__NR_sendmsg, /*fd=*/r[6], /*msg=*/0x20000280ul, /*f=MSG_OOB|MSG_NOSIGNAL|MSG_DONTROUTE*/ 0x4005ul); return 0; }