// https://syzkaller.appspot.com/bug?id=a20f71140ab561e09542ed5ae5978f6b3ffe44b6 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include __attribute__((noreturn)) static void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } } #include #include #include #include #include const int kFailStatus = 67; const int kRetryStatus = 69; static void exitf(const char* msg, ...) { int e = errno; va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit(kRetryStatus); } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static int inject_fault(int nth) { int fd; char buf[16]; fd = open("/proc/thread-self/fail-nth", O_RDWR); if (fd == -1) exitf("failed to open /proc/thread-self/fail-nth"); sprintf(buf, "%d", nth + 1); if (write(fd, buf, strlen(buf)) != (ssize_t)strlen(buf)) exitf("failed to write /proc/thread-self/fail-nth"); return fd; } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void loop() { long res = 0; memcpy((void*)0x20000040, "/dev/ion", 9); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000040, 0, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20010000 = 0x8004; *(uint32_t*)0x20010008 = 0x1a; *(uint32_t*)0x2001000c = 0; *(uint32_t*)0x20010010 = -1; *(uint32_t*)0x20010014 = 0; res = syscall(__NR_ioctl, r[0], 0xc0184900, 0x20010000); if (res != -1) r[1] = *(uint32_t*)0x20010010; *(uint64_t*)0x20fd3ff8 = 2; write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N"); write_file("/sys/kernel/debug/fail_futex/ignore-private", "N"); inject_fault(0); syscall(__NR_ioctl, r[1], 0x40086200, 0x20fd3ff8); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }