// https://syzkaller.appspot.com/bug?id=5010ffea75f88119d6b5d88e6f4ccb28fefc3aaa // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #ifndef __NR_add_key #define __NR_add_key 217 #endif #ifndef __NR_keyctl #define __NR_keyctl 219 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif uint64_t r[2] = {0x0, 0x0}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // add_key arguments: [ // type: ptr[in, buffer] { // buffer: {6b 65 79 72 69 6e 67 00} (length 0x8) // } // desc: ptr[in, key_desc] { // key_desc { // prefix: buffer: {73 79 7a} (length 0x3) // id: proc = 0x0 (1 bytes) // z: const = 0x0 (1 bytes) // } // } // payload: nil // paylen: len = 0x0 (8 bytes) // keyring: keyring (resource) // ] // returns key memcpy((void*)0x20000000, "keyring\000", 8); memcpy((void*)0x20000100, "syz", 3); *(uint8_t*)0x20000103 = 0x20; *(uint8_t*)0x20000104 = 0; res = syscall(__NR_add_key, /*type=*/0x20000000ul, /*desc=*/0x20000100ul, /*payload=*/0ul, /*paylen=*/0ul, /*keyring=*/0xfffffffc); if (res != -1) r[0] = res; // add_key arguments: [ // type: ptr[in, buffer] { // buffer: {61 73 79 6d 6d 65 74 72 69 63 00} (length 0xb) // } // desc: nil // payload: ptr[in, buffer] { // buffer: {30 82 05 55 30 82 03 3d a0 03 02 01 02 02 14 73 98 ea 98 2d // d0 2e a8 b1 cf 57 c7 f2 97 b3 e6 1a fc 8c 0a 30 0d 06 09 2a 86 48 86 // f7 0d 01 01 0b 05 00 30 34 31 32 30 30 06 03 55 04 03 0c 29 43 65 72 // 74 69 66 69 63 61 74 65 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 73 // 65 6c 66 2d 74 65 73 74 69 6e 67 20 6b 65 79 30 20 17 0d 32 32 30 35 // 31 38 32 32 33 32 34 31 5a 18 0f 32 31 32 32 30 34 32 34 32 32 33 32 // 34 31 5a 30 34 31 32 30 30 06 03 55 04 03 0c 29 43 65 72 74 69 66 69 // 63 61 74 65 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 73 65 6c 66 2d // 74 65 73 74 69 6e 67 20 6b 65 7a 30 82 02 22 30 0d 06 09 2a 86 48 86 // f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 cc ac // 49 dd 3b ca b0 15 7e 84 6a b2 0a 69 5f 1c 0a 61 82 3b 4f 2c a3 95 2c // 08 58 4b b1 5d 99 e0 c3 c1 79 c2 b3 eb c0 1e 6d 3e 54 1d bd b7 92 7b // 4d b5 95 58 b2 52 2e c6 24 4b 71 63 80 32 77 a7 38 5e db 72 ae 6e 0d // ec fb b6 6d 01 7f e9 55 66 df bf 1d 76 78 02 31 e8 e5 07 f8 b7 82 5c // 0d d4 bb fb a2 59 0d 2e 3a 78 95 3a 8b 46 06 47 44 46 d7 cd 06 6a 41 // 13 e3 19 f6 bb 6e 38 f4 83 01 a3 bf 4a 39 4f d7 0a e9 38 b3 f5 94 14 // 4e dd f7 43 fd 24 b2 49 3c a5 f7 7a 7c d4 45 3d 97 75 68 f1 ed 4c 42 // 0b 70 ca 85 f3 de e5 88 2c c5 be b6 97 34 ba 24 02 cd 8b 86 9f a9 73 // ca 73 cf 92 81 ee 75 55 bb 18 67 5c ff 3f b5 dd 33 1b 0c e9 78 db 5c // cf aa 5c 43 42 df 5e a9 6d ec d7 d7 ff e6 a1 3a 92 1a da ae f6 8c 6f // 7b d5 b4 6e 06 e9 8f e8 de 09 31 89 ed 0e 11 a1 fa 8a e9 e9 64 59 62 // 53 da d1 70 be 11 d4 99 97 11 cf 99 de 0b 9d 94 7e aa b8 52 ea 37 db // 90 7e 35 bd d9 fe 6d 0a 48 70 28 dd d5 0d 7f 03 80 93 14 23 8f b9 22 // cd 7c 29 fe f1 72 b5 5c 0b 12 cf 9c 15 f6 11 4c 7a 45 25 8c 45 0a 34 // ac 2d 9a 81 ca 0b 13 22 cd eb 1a 38 88 18 97 96 08 81 aa cc 8f 0f 8a // 32 7b 76 68 03 68 43 bf 11 ba 55 60 fd 80 1c 0d 9b 69 b6 09 72 bc 0f // 41 2f 07 82 c6 e3 b2 13 91 c4 6d 14 95 31 be 19 bd bc ed e1 4c 74 a2 // e0 78 0b bb 94 ec 4c 53 3a a2 b5 84 1d 4b 65 7e dc f7 db 36 7d be 9e // 3b 36 66 42 66 76 35 bf be f0 c1 3c 7c e9 42 5c 24 53 03 05 a8 67 24 // 50 02 75 ff 24 46 3b 35 89 76 e6 70 da c5 51 8c 9a e5 05 b0 0b d0 2d // d4 7d 57 75 94 6b f9 0a ad 0e 41 00 15 d0 4f c0 7f 90 2d 18 48 8f 28 // fe 5d a7 cd 99 9e bd 02 6c 8a 31 f3 1c c7 4b e6 93 cd 42 a2 e4 68 10 // 47 9d fc 21 02 03 01 00 01 a3 5d 30 5b 30 0c 06 03 55 1d 13 01 01 ff // 04 02 30 00 30 0b 06 03 55 1d 0f 04 04 03 02 07 80 30 1d 06 03 55 1d // 0e 04 16 04 14 f5 87 03 bb 33 ce 1b 73 ee 02 ec cd ee 5b 88 17 51 8f // e3 db 30 1f 06 03 55 1d 23 04 18 30 16 80 14 f5 87 03 bb 33 ce 1b 73 // ee 02 ec cd ee 5b 88 17 51 8f e3 db 30 0d 06 09 2a 86 48 86 f7 0d 01 // 01 0b 05 00 03 82 02 01 00 c0 2e 12 41 7b 73 85 16 c8 db 86 79 e8 f5 // cd 44 f4 c6 e2 81 23 5e 47 cb ab 25 f1 1e 58 3e 31 7f 78 ad 85 eb fe // 14 88 60 f7 7f d2 26 a2 f4 98 2a fd ba 05 0c 20 33 12 cc 4d 14 61 64 // 81 93 d3 33 ed c8 ff f1 78 cc 5f 51 9f 09 d7 be 0d 5c 74 fd 9b df 52 // 4a c9 a8 71 25 33 04 10 67 36 d0 b3 0b c9 a1 40 72 ae 41 7b 68 e6 e4 // 7b d0 28 f7 6d e7 3f 50 fc 91 7c 91 56 d4 df a6 bb e8 4d 1b 58 aa 28 // fa c1 19 eb 11 2f 24 8b 7c c5 a9 86 26 aa 6e b7 9b d5 f8 06 fb 02 52 // 7b 9c 9e a1 e0 07 8b 5e e4 b8 55 29 f6 48 52 1c 1b 54 2d 46 d8 e5 71 // b9 60 d1 45 b5 92 89 8a 63 58 2a b3 c6 b2 76 e2 3c 82 59 04 ae 5a c4 // 99 7b 2e 4b 46 57 b8 29 24 b2 fd ee 2c 0d a4 83 fa 65 2a 07 35 8b 97 // cf bd 96 2e d1 7e 6c c2 1e 87 b6 6c 76 65 b5 b2 62 da 8b e9 73 e3 db // 33 dd 13 3a 17 63 6a 76 de 8d 8f e0 47 61 28 3a 83 ff 8f e7 c7 e0 4a // a3 e5 07 cf e9 8c 35 35 2e e7 80 66 31 bf 91 58 0a e1 25 3d 38 d3 a4 // f0 59 34 47 07 62 0f be 30 dd 81 88 58 f0 28 b0 96 e5 82 f8 05 b7 13 // 01 bc fa c6 1f 86 72 cc f9 ee 8e d9 d6 04 8c 24 6c bf 0f 5d 37 39 cf // 45 c1 93 3a d2 ed 5c 58 79 74 86 62 30 7e 8e bb dd 7a a9 ed ca 40 cb // 62 47 f4 b4 9f 52 7f 72 63 a8 f0 2b af 45 2a 48 19 6d e3 fb f9 19 66 // 69 c8 cc 62 87 6c 53 2b 2d 6e 90 6c 54 3a 82 25 41 cb 18 6a a4 22 a8 // a1 c4 47 d7 81 00 1c 15 51 0f 1a af ef 9f a6 61 8c bd 6b 8b ed e6 ac // 0e b6 3a 4c 92 e6 0f 91 0a 0f 71 c7 a0 b9 0d 3a 17 5a 6f 35 c8 e7 50 // 4f 46 e8 70 60 48 06 82 8b 66 58 e6 73 91 9c 12 3d 35 8e 46 ad 5a f5 // b3 db 69 21 04 fd d3 1c df 94 9d 56 b0 0a d1 95 76 8d ec 9e dd 0b 15 // 97 64 ad e5 f2 62 02 fc 9e 5f 56 42 39 05 b3} (length 0x559) // } // paylen: len = 0x559 (8 bytes) // keyring: keyring (resource) // ] // returns key memcpy((void*)0x20000040, "asymmetric\000", 11); memcpy( (void*)0x20000200, "\x30\x82\x05\x55\x30\x82\x03\x3d\xa0\x03\x02\x01\x02\x02\x14\x73\x98\xea" "\x98\x2d\xd0\x2e\xa8\xb1\xcf\x57\xc7\xf2\x97\xb3\xe6\x1a\xfc\x8c\x0a\x30" "\x0d\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x01\x0b\x05\x00\x30\x34\x31\x32" "\x30\x30\x06\x03\x55\x04\x03\x0c\x29\x43\x65\x72\x74\x69\x66\x69\x63\x61" "\x74\x65\x20\x76\x65\x72\x69\x66\x69\x63\x61\x74\x69\x6f\x6e\x20\x73\x65" "\x6c\x66\x2d\x74\x65\x73\x74\x69\x6e\x67\x20\x6b\x65\x79\x30\x20\x17\x0d" "\x32\x32\x30\x35\x31\x38\x32\x32\x33\x32\x34\x31\x5a\x18\x0f\x32\x31\x32" "\x32\x30\x34\x32\x34\x32\x32\x33\x32\x34\x31\x5a\x30\x34\x31\x32\x30\x30" "\x06\x03\x55\x04\x03\x0c\x29\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65" "\x20\x76\x65\x72\x69\x66\x69\x63\x61\x74\x69\x6f\x6e\x20\x73\x65\x6c\x66" "\x2d\x74\x65\x73\x74\x69\x6e\x67\x20\x6b\x65\x7a\x30\x82\x02\x22\x30\x0d" "\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x01\x01\x05\x00\x03\x82\x02\x0f\x00" "\x30\x82\x02\x0a\x02\x82\x02\x01\x00\xcc\xac\x49\xdd\x3b\xca\xb0\x15\x7e" "\x84\x6a\xb2\x0a\x69\x5f\x1c\x0a\x61\x82\x3b\x4f\x2c\xa3\x95\x2c\x08\x58" "\x4b\xb1\x5d\x99\xe0\xc3\xc1\x79\xc2\xb3\xeb\xc0\x1e\x6d\x3e\x54\x1d\xbd" "\xb7\x92\x7b\x4d\xb5\x95\x58\xb2\x52\x2e\xc6\x24\x4b\x71\x63\x80\x32\x77" "\xa7\x38\x5e\xdb\x72\xae\x6e\x0d\xec\xfb\xb6\x6d\x01\x7f\xe9\x55\x66\xdf" "\xbf\x1d\x76\x78\x02\x31\xe8\xe5\x07\xf8\xb7\x82\x5c\x0d\xd4\xbb\xfb\xa2" "\x59\x0d\x2e\x3a\x78\x95\x3a\x8b\x46\x06\x47\x44\x46\xd7\xcd\x06\x6a\x41" "\x13\xe3\x19\xf6\xbb\x6e\x38\xf4\x83\x01\xa3\xbf\x4a\x39\x4f\xd7\x0a\xe9" "\x38\xb3\xf5\x94\x14\x4e\xdd\xf7\x43\xfd\x24\xb2\x49\x3c\xa5\xf7\x7a\x7c" "\xd4\x45\x3d\x97\x75\x68\xf1\xed\x4c\x42\x0b\x70\xca\x85\xf3\xde\xe5\x88" "\x2c\xc5\xbe\xb6\x97\x34\xba\x24\x02\xcd\x8b\x86\x9f\xa9\x73\xca\x73\xcf" "\x92\x81\xee\x75\x55\xbb\x18\x67\x5c\xff\x3f\xb5\xdd\x33\x1b\x0c\xe9\x78" "\xdb\x5c\xcf\xaa\x5c\x43\x42\xdf\x5e\xa9\x6d\xec\xd7\xd7\xff\xe6\xa1\x3a" "\x92\x1a\xda\xae\xf6\x8c\x6f\x7b\xd5\xb4\x6e\x06\xe9\x8f\xe8\xde\x09\x31" "\x89\xed\x0e\x11\xa1\xfa\x8a\xe9\xe9\x64\x59\x62\x53\xda\xd1\x70\xbe\x11" "\xd4\x99\x97\x11\xcf\x99\xde\x0b\x9d\x94\x7e\xaa\xb8\x52\xea\x37\xdb\x90" "\x7e\x35\xbd\xd9\xfe\x6d\x0a\x48\x70\x28\xdd\xd5\x0d\x7f\x03\x80\x93\x14" "\x23\x8f\xb9\x22\xcd\x7c\x29\xfe\xf1\x72\xb5\x5c\x0b\x12\xcf\x9c\x15\xf6" "\x11\x4c\x7a\x45\x25\x8c\x45\x0a\x34\xac\x2d\x9a\x81\xca\x0b\x13\x22\xcd" "\xeb\x1a\x38\x88\x18\x97\x96\x08\x81\xaa\xcc\x8f\x0f\x8a\x32\x7b\x76\x68" "\x03\x68\x43\xbf\x11\xba\x55\x60\xfd\x80\x1c\x0d\x9b\x69\xb6\x09\x72\xbc" "\x0f\x41\x2f\x07\x82\xc6\xe3\xb2\x13\x91\xc4\x6d\x14\x95\x31\xbe\x19\xbd" "\xbc\xed\xe1\x4c\x74\xa2\xe0\x78\x0b\xbb\x94\xec\x4c\x53\x3a\xa2\xb5\x84" "\x1d\x4b\x65\x7e\xdc\xf7\xdb\x36\x7d\xbe\x9e\x3b\x36\x66\x42\x66\x76\x35" "\xbf\xbe\xf0\xc1\x3c\x7c\xe9\x42\x5c\x24\x53\x03\x05\xa8\x67\x24\x50\x02" "\x75\xff\x24\x46\x3b\x35\x89\x76\xe6\x70\xda\xc5\x51\x8c\x9a\xe5\x05\xb0" "\x0b\xd0\x2d\xd4\x7d\x57\x75\x94\x6b\xf9\x0a\xad\x0e\x41\x00\x15\xd0\x4f" "\xc0\x7f\x90\x2d\x18\x48\x8f\x28\xfe\x5d\xa7\xcd\x99\x9e\xbd\x02\x6c\x8a" "\x31\xf3\x1c\xc7\x4b\xe6\x93\xcd\x42\xa2\xe4\x68\x10\x47\x9d\xfc\x21\x02" "\x03\x01\x00\x01\xa3\x5d\x30\x5b\x30\x0c\x06\x03\x55\x1d\x13\x01\x01\xff" "\x04\x02\x30\x00\x30\x0b\x06\x03\x55\x1d\x0f\x04\x04\x03\x02\x07\x80\x30" "\x1d\x06\x03\x55\x1d\x0e\x04\x16\x04\x14\xf5\x87\x03\xbb\x33\xce\x1b\x73" "\xee\x02\xec\xcd\xee\x5b\x88\x17\x51\x8f\xe3\xdb\x30\x1f\x06\x03\x55\x1d" "\x23\x04\x18\x30\x16\x80\x14\xf5\x87\x03\xbb\x33\xce\x1b\x73\xee\x02\xec" "\xcd\xee\x5b\x88\x17\x51\x8f\xe3\xdb\x30\x0d\x06\x09\x2a\x86\x48\x86\xf7" "\x0d\x01\x01\x0b\x05\x00\x03\x82\x02\x01\x00\xc0\x2e\x12\x41\x7b\x73\x85" "\x16\xc8\xdb\x86\x79\xe8\xf5\xcd\x44\xf4\xc6\xe2\x81\x23\x5e\x47\xcb\xab" "\x25\xf1\x1e\x58\x3e\x31\x7f\x78\xad\x85\xeb\xfe\x14\x88\x60\xf7\x7f\xd2" "\x26\xa2\xf4\x98\x2a\xfd\xba\x05\x0c\x20\x33\x12\xcc\x4d\x14\x61\x64\x81" "\x93\xd3\x33\xed\xc8\xff\xf1\x78\xcc\x5f\x51\x9f\x09\xd7\xbe\x0d\x5c\x74" "\xfd\x9b\xdf\x52\x4a\xc9\xa8\x71\x25\x33\x04\x10\x67\x36\xd0\xb3\x0b\xc9" "\xa1\x40\x72\xae\x41\x7b\x68\xe6\xe4\x7b\xd0\x28\xf7\x6d\xe7\x3f\x50\xfc" "\x91\x7c\x91\x56\xd4\xdf\xa6\xbb\xe8\x4d\x1b\x58\xaa\x28\xfa\xc1\x19\xeb" "\x11\x2f\x24\x8b\x7c\xc5\xa9\x86\x26\xaa\x6e\xb7\x9b\xd5\xf8\x06\xfb\x02" "\x52\x7b\x9c\x9e\xa1\xe0\x07\x8b\x5e\xe4\xb8\x55\x29\xf6\x48\x52\x1c\x1b" "\x54\x2d\x46\xd8\xe5\x71\xb9\x60\xd1\x45\xb5\x92\x89\x8a\x63\x58\x2a\xb3" "\xc6\xb2\x76\xe2\x3c\x82\x59\x04\xae\x5a\xc4\x99\x7b\x2e\x4b\x46\x57\xb8" "\x29\x24\xb2\xfd\xee\x2c\x0d\xa4\x83\xfa\x65\x2a\x07\x35\x8b\x97\xcf\xbd" "\x96\x2e\xd1\x7e\x6c\xc2\x1e\x87\xb6\x6c\x76\x65\xb5\xb2\x62\xda\x8b\xe9" "\x73\xe3\xdb\x33\xdd\x13\x3a\x17\x63\x6a\x76\xde\x8d\x8f\xe0\x47\x61\x28" "\x3a\x83\xff\x8f\xe7\xc7\xe0\x4a\xa3\xe5\x07\xcf\xe9\x8c\x35\x35\x2e\xe7" "\x80\x66\x31\xbf\x91\x58\x0a\xe1\x25\x3d\x38\xd3\xa4\xf0\x59\x34\x47\x07" "\x62\x0f\xbe\x30\xdd\x81\x88\x58\xf0\x28\xb0\x96\xe5\x82\xf8\x05\xb7\x13" "\x01\xbc\xfa\xc6\x1f\x86\x72\xcc\xf9\xee\x8e\xd9\xd6\x04\x8c\x24\x6c\xbf" "\x0f\x5d\x37\x39\xcf\x45\xc1\x93\x3a\xd2\xed\x5c\x58\x79\x74\x86\x62\x30" "\x7e\x8e\xbb\xdd\x7a\xa9\xed\xca\x40\xcb\x62\x47\xf4\xb4\x9f\x52\x7f\x72" "\x63\xa8\xf0\x2b\xaf\x45\x2a\x48\x19\x6d\xe3\xfb\xf9\x19\x66\x69\xc8\xcc" "\x62\x87\x6c\x53\x2b\x2d\x6e\x90\x6c\x54\x3a\x82\x25\x41\xcb\x18\x6a\xa4" "\x22\xa8\xa1\xc4\x47\xd7\x81\x00\x1c\x15\x51\x0f\x1a\xaf\xef\x9f\xa6\x61" "\x8c\xbd\x6b\x8b\xed\xe6\xac\x0e\xb6\x3a\x4c\x92\xe6\x0f\x91\x0a\x0f\x71" "\xc7\xa0\xb9\x0d\x3a\x17\x5a\x6f\x35\xc8\xe7\x50\x4f\x46\xe8\x70\x60\x48" "\x06\x82\x8b\x66\x58\xe6\x73\x91\x9c\x12\x3d\x35\x8e\x46\xad\x5a\xf5\xb3" "\xdb\x69\x21\x04\xfd\xd3\x1c\xdf\x94\x9d\x56\xb0\x0a\xd1\x95\x76\x8d\xec" "\x9e\xdd\x0b\x15\x97\x64\xad\xe5\xf2\x62\x02\xfc\x9e\x5f\x56\x42\x39\x05" "\xb3", 1369); res = syscall(__NR_add_key, /*type=*/0x20000040ul, /*desc=*/0ul, /*payload=*/0x20000200ul, /*paylen=*/0x559ul, /*keyring=*/r[0]); if (res != -1) r[1] = res; // keyctl$KEYCTL_PKEY_DECRYPT arguments: [ // code: const = 0x1a (8 bytes) // params: ptr[in, keyctl_pkey_params] { // keyctl_pkey_params { // key_id: key (resource) // in_len: bytesize = 0x0 (4 bytes) // out_len: bytesize = 0x0 (4 bytes) // __spare: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00} (length 0x1c) // } // } // info: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // } // } // inout: nil // output: nil // ] *(uint32_t*)0x20000180 = r[1]; *(uint32_t*)0x20000184 = 0; *(uint32_t*)0x20000188 = 0; memset((void*)0x2000018c, 0, 28); syscall(__NR_keyctl, /*code=*/0x1aul, /*params=*/0x20000180ul, /*info=*/0x20000840ul, /*inout=*/0ul, /*output=*/0ul); return 0; }