// https://syzkaller.appspot.com/bug?id=7500df6bc86f0d5fbfb433c98112f9054fc61021 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_get_mempolicy #define __NR_get_mempolicy 236 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_openat #define __NR_openat 56 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // openat$cgroup_ro arguments: [ // fd: fd_cgroup (resource) // file: ptr[in, buffer] { // buffer: {6d 65 6d 6f 72 79 2e 65 76 65 6e 74 73 00} (length 0xe) // } // flags: const = 0x275a (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd memcpy((void*)0x20000080, "memory.events\000", 14); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000080ul, /*flags=*/0x275a, /*mode=*/0); if (res != -1) r[0] = res; // mmap arguments: [ // addr: VMA[0x3000] // len: len = 0x3000 (8 bytes) // prot: mmap_prot = 0x1 (8 bytes) // flags: mmap_flags = 0x12 (8 bytes) // fd: fd (resource) // offset: intptr = 0x0 (8 bytes) // ] syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x3000ul, /*prot=PROT_READ*/ 1ul, /*flags=MAP_FIXED|MAP_PRIVATE*/ 0x12ul, /*fd=*/r[0], /*offset=*/0ul); // get_mempolicy arguments: [ // mode: ptr[out, int32] { // int32 = 0x0 (4 bytes) // } // nodemask: nil // maxnode: intptr = 0x69b4 (8 bytes) // addr: VMA[0x1000] // flags: mempolicy_flags = 0x4 (8 bytes) // ] syscall(__NR_get_mempolicy, /*mode=*/0x20000f00ul, /*nodemask=*/0ul, /*maxnode=*/0x69b4ul, /*addr=*/0x20ffe000ul, /*flags=MPOL_F_MEMS_ALLOWED*/ 4ul); return 0; }