// https://syzkaller.appspot.com/bug?id=611b50e30eb1634e75688903289148fe2a042c1d // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static int inject_fault(int nth) { int fd; char buf[16]; fd = open("/proc/thread-self/fail-nth", O_RDWR); if (fd == -1) exit(1); sprintf(buf, "%d", nth + 1); if (write(fd, buf, strlen(buf)) != (ssize_t)strlen(buf)) exit(1); return fd; } int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); memcpy((void*)0x20000000, "./file0", 8); syscall(__NR_mkdir, 0x20000000, 0); memcpy((void*)0x20000100, "./file0", 8); memcpy((void*)0x20000700, "bpf", 4); syscall(__NR_mount, 0x20000000, 0x20000100, 0x20000700, 0x2005890, 0x20000740); memcpy((void*)0x200002c0, "./file0", 8); memcpy((void*)0x20000380, "bpf", 4); write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N"); write_file("/sys/kernel/debug/fail_futex/ignore-private", "N"); inject_fault(3); syscall(__NR_mount, 0, 0x200002c0, 0x20000380, 0x1800a0, 0); return 0; }