// https://syzkaller.appspot.com/bug?id=84d8d0412304b2fae21e7af29f8dab76c1d74a99 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_landlock_create_ruleset #define __NR_landlock_create_ruleset 444 #endif #ifndef __NR_landlock_restrict_self #define __NR_landlock_restrict_self 446 #endif #ifndef __NR_mkdirat #define __NR_mkdirat 34 #endif #ifndef __NR_mknodat #define __NR_mknodat 33 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_mount #define __NR_mount 40 #endif #ifndef __NR_openat #define __NR_openat 56 #endif #ifndef __NR_renameat2 #define __NR_renameat2 276 #endif uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // mode: open_mode = 0x1c0 (8 bytes) // ] memcpy((void*)0x20000040, "./file0\000", 8); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x20000040ul, /*mode=S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1c0ul); // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 31 00} (length 0xe) // } // mode: open_mode = 0x1c0 (8 bytes) // ] memcpy((void*)0x20000100, "./file0/file1\000", 14); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x20000100ul, /*mode=S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1c0ul); // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 31 2f 66 69 6c 65 32 00} // (length 0x14) // } // mode: open_mode = 0x1c0 (8 bytes) // ] memcpy((void*)0x20000140, "./file0/file1/file2\000", 20); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x20000140ul, /*mode=S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1c0ul); // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 31 2f 66 69 6c 65 32 2f // 66 69 6c 65 33 00} (length 0x1a) // } // mode: open_mode = 0x1c0 (8 bytes) // ] memcpy((void*)0x20000180, "./file0/file1/file2/file3\000", 26); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x20000180ul, /*mode=S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1c0ul); // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 31 2f 66 69 6c 65 32 2f // 66 69 6c 65 33 2f 66 69 6c 65 34 00} (length 0x20) // } // mode: open_mode = 0x1c0 (8 bytes) // ] memcpy((void*)0x200001c0, "./file0/file1/file2/file3/file4\000", 32); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200001c0ul, /*mode=S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1c0ul); // mknodat arguments: [ // dirfd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 31 2f 66 69 6c 65 32 2f // 66 69 6c 65 33 2f 66 69 6c 65 35 00} (length 0x20) // } // mode: mknod_mode = 0x81c0 (8 bytes) // dev: int32 = 0x0 (4 bytes) // ] memcpy((void*)0x20000200, "./file0/file1/file2/file3/file5\000", 32); syscall(__NR_mknodat, /*dirfd=*/0xffffff9c, /*file=*/0x20000200ul, /*mode=S_IFREG|0x1c0*/ 0x81c0ul, /*dev=*/0); // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 36 00} (length 0xe) // } // mode: open_mode = 0x1c0 (8 bytes) // ] memcpy((void*)0x20000240, "./file0/file6\000", 14); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x20000240ul, /*mode=S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1c0ul); // mount$bind arguments: [ // src: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 31 00} (length 0xe) // } // dst: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 36 00} (length 0xe) // } // type: nil // flags: mount_flags = 0x5000 (8 bytes) // data: const = 0x0 (8 bytes) // ] memcpy((void*)0x20000300, "./file0/file1\000", 14); memcpy((void*)0x20000340, "./file0/file6\000", 14); syscall(__NR_mount, /*src=*/0x20000300ul, /*dst=*/0x20000340ul, /*type=*/0ul, /*flags=MS_REC|MS_BIND*/ 0x5000ul, /*data=*/0ul); // openat$dir arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 36 2f 66 69 6c 65 32 00} // (length 0x14) // } // flags: open_flags = 0x0 (4 bytes) // mode: open_mode = 0x0 (2 bytes) // ] // returns fd_dir memcpy((void*)0x20000380, "./file0/file6/file2\000", 20); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000380ul, /*flags=*/0, /*mode=*/0); if (res != -1) r[0] = res; // renameat2 arguments: [ // oldfd: fd_dir (resource) // old: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 31 2f 66 69 6c 65 32 00} // (length 0x14) // } // newfd: fd_dir (resource) // new: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 2f 66 69 6c 65 32 00} (length 0xe) // } // flags: renameat2_flags = 0x0 (8 bytes) // ] memcpy((void*)0x200003c0, "./file0/file1/file2\000", 20); memcpy((void*)0x20000400, "./file0/file2\000", 14); syscall(__NR_renameat2, /*oldfd=*/0xffffff9c, /*old=*/0x200003c0ul, /*newfd=*/0xffffff9c, /*new=*/0x20000400ul, /*flags=*/0ul); // landlock_create_ruleset arguments: [ // attr: ptr[in, landlock_ruleset_attr] { // landlock_ruleset_attr { // handled_access_fs: landlock_access_fs_flags = 0x2004 (8 bytes) // handled_access_net: landlock_access_net_flags = 0x0 (8 bytes) // scoped: landlock_scope_flags = 0x0 (8 bytes) // } // } // size: bytesize = 0x18 (8 bytes) // flags: landlock_create_ruleset_flags = 0x0 (8 bytes) // ] // returns fd_ruleset *(uint64_t*)0x20000440 = 0x2004; *(uint64_t*)0x20000448 = 0; *(uint64_t*)0x20000450 = 0; res = syscall(__NR_landlock_create_ruleset, /*attr=*/0x20000440ul, /*size=*/0x18ul, /*flags=*/0ul); if (res != -1) r[1] = res; // landlock_restrict_self arguments: [ // ruleset_fd: fd_ruleset (resource) // flags: landlock_restrict_self_flags = 0x0 (8 bytes) // ] syscall(__NR_landlock_restrict_self, /*ruleset_fd=*/r[1], /*flags=*/0ul); // renameat2 arguments: [ // oldfd: fd_dir (resource) // old: ptr[in, buffer] { // buffer: {66 69 6c 65 33 2f 66 69 6c 65 35 00} (length 0xc) // } // newfd: fd_dir (resource) // new: ptr[in, buffer] { // buffer: {66 69 6c 65 33 2f 66 69 6c 65 34 2f 66 69 6c 65 35 00} // (length 0x12) // } // flags: renameat2_flags = 0x0 (8 bytes) // ] memcpy((void*)0x20000540, "file3/file5\000", 12); memcpy((void*)0x20000580, "file3/file4/file5\000", 18); syscall(__NR_renameat2, /*oldfd=*/r[0], /*old=*/0x20000540ul, /*newfd=*/r[0], /*new=*/0x20000580ul, /*flags=*/0ul); return 0; }