// https://syzkaller.appspot.com/bug?id=c08f167db04e8487eb808a785f1106bb8eb9e693 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); intptr_t res = 0; memcpy((void*)0x20000080, "/dev/pf\000", 8); res = syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000080ul, 0ul, 0ul); if (res != -1) r[0] = res; memcpy( (void*)0x20000240, "\x49\x4c\x28\x77\x0e\x6f\xcc\xd0\x08\x6b\xa8\xe2\x4f\x37\x79\xe2\xc6\xcb" "\x18\xb4\x51\x39\xfd\x8c\x9f\x6c\xed\x94\x2e\x94\xe3\x48\xef\xc9\x9b\xd3" "\x82\x60\x22\xe4\x63\x44\xed\x5b\x2d\x6d\x8f\x0e\x9d\x4f\xad\x14\x61\x4c" "\x53\x93\x5c\x09\x4c\xb2\xbb\x49\x57\xc3\x26\x53\xcc\x08\x76\x79\x80\xef" "\x59\xf1\xf7\x71\x45\x5d\xd2\xe9\x24\x48\x42\xb8\x70\x04\x76\x6e\x75\x83" "\x97\xe9\xb6\x7c\xdc\x9c\xbb\x10\x62\x61\x1f\x6f\x9c\xdc\x57\xc2\x3e\xf1" "\xe6\x1b\xcb\xc4\x5c\xdd\x0d\x36\x13\xf1\xcd\xdd\x67\x6e\x30\x03\x8e\x23" "\x88\xad\xae\x72\x92\x81\x1a\x1b\x96\xfa\x53\x76\xfa\x69\x86\x6d\xa8\x84" "\xad\xb6\xc1\x4c\x68\x08\xf4\x0f\x1a\x52\x95\xa9\xcd\xc7\x5d\x7a\xbc\xa2" "\xb7\x36\x3d\xa5\xf3\x60\x2f\x38\xfc\x0a\x15\xb6\x29\xb1\x0e\x71\x3f\xbf" "\xe5\xcb\x33\x99\x55\xf7\x9e\xee\xf5\xab\x53\xad\x94\xca\x95\x5e\x30\x8d" "\x96\x53\x62\xe8\x82\x0c\xb5\x2c\xc5\xb1\x7d\xa9\x9d\x30\xcd\x88\x7f\xec" "\xd5\x87\x72\xbf\x85\x70\xa9\xc3\x74\x76\x83\x44\xd0\x48\x14\xfe\xda\x13" "\xd5\x08\x6d\xad\xae\x66\x0d\x5f\xfb\xe2\xd8\x12\xcf\x29\xc7\x28\xfc\x47" "\xc3\x4b\x2d\x1a\x64\x35\x68\xde\x61\x6c\xe9\xce\x28\x4f\x3f\x3b\x37\x06" "\x61\x47\x15\xd5\xfe\xfc\x51\xbc\x2b\x88\x10\x23\xc0\x68\xa4\x01\x18\x71" "\x58\xf1\xa8\x08\x30\xf2\x92\xf0\x1b\x91\x37\xd3\xae\x2c\x05\xba\x92\x95" "\x0a\x08\xfc\x38\xd1\x74\x58\x81\x90\x90\x2f\x5b\xc4\xc6\x9c\x34\x2a\x67" "\x75\x2c\x8e\x66\xed\x2c\x7b\x10\xdd\x78\xa3\xa5\xe3\x3e\x2a\xe1\x28\xee" "\x94\xdc\xc2\x2d\xa5\xe0\x79\xc9\x71\x4a\x6d\xfb\x21\xdd\x25\xf0\xc5\x1e" "\x31\xd9\x83\x89\xe2\x67\x86\x67\xe1\x0d\x28\xf2\x93\x8c\x07\x18\x24\xf6" "\x5d\x29\xb7\xfa\x61\x31\x08\x0a\x67\x26\x83\x61\xa3\xd4\x3c\xaa\xd2\xf5" "\xea\x19\x46\x84\xed\xff\xd1\x22\x46\x7d\x0b\xea\xe9\x00\x16\x16\x41\xeb" "\x5d\x1d\x2b\x7f\x75\x60\xbe\x34\x13\x5b\x82\x32\xc7\x09\xa7\x21\xad\x26" "\xd1\x9e\x34\x94\x61\x31\x75\x98\x2f\x5a\x2f\xb7\xae\xdf\x39\x9c\x41\x80" "\xaf\x70\xc7\xac\x0c\x45\x4f\x99\xb0\x8e\x69\x9c\x41\x04\xba\xa7\x8e\xec" "\x0a\x3c\x38\xd9\x6f\x71\xda\xfe\xcc\x06\x89\x61\x70\xd2\xeb\xdf\x2f\x3b" "\xcb\xd4\xf0\x3d\xce\x7d\xf6\x80\x13\x25\xf7\x53\x24\x57\x1c\x3a\x0b\x8f" "\x18\x82\x9b\x21\x2e\xd6\x65\x2a\x01\xa2\x50\xe8\x65\xff\x87\xe8\x3b\x17" "\x61\xf8\x96\xd3\x96\x92\xe7\x8c\xe3\x90\xa5\x59\xfc\x33\x91\x30\x83\x41" "\x22\xec\xbb\x6c\xe4\x09\xec\x8d\xae\x3a\xe4\x49\xce\x2e\x54\x1a\x97\xf0" "\xbe\x3b\x95\x11\x84\xe3\x6b\xc0\x2e\xf6\x45\xed\xf7\x06\x44\x13\x32\x76" "\xd9\x95\xdd\xc2\x23\x8d\x1c\x59\xf4\x6b\xc2\x9a\xc7\x03\x91\x44\xe9\x45" "\x4d\xeb\x4f\x5d\x48\x82\x3f\x8d\xcf\x5f\xcf\x96\xe0\xed\xf2\x0c\xb6\x39" "\x50\xf4\xbe\x9c\x48\x6a\x10\xf4\x18\xf2\xab\x38\x15\x85\xb0\x73\x16\x23" "\x7c\x65\x8a\x1e\x6e\xb2\x1e\xc5\xb0\x76\x30\x7d\xe0\xab\x53\xb5\x70\x6a" "\x5d\x11\x51\x8b\x97\x47\x08\xff\x80\xb6\x1f\xc9\x73\xd7\xf5\xff\xdd\x89" "\x5d\x8e\x3e\x42\xdc\x6c\xd7\xa9\x08\x47\x9c\xc7\x6c\x65\xdb\xe0\x72\x5c" "\x74\x13\xd4\x81\x66\x6e\x37\xe6\x65\x35\xa3\x89\xde\x19\x1b\x7e\x86\x84" "\xbd\x68\x36\x33\x00\x53\x04\xfe\x0e\xcc\x5a\x6e\x4c\x16\xd2\x7a\xa4\x95" "\x79\x4f\xb7\xc2\x61\x94\x89\x55\xaf\x80\x9d\x3f\xb1\xf1\x4a\xf0\x77\x4c" "\x28\xa8\x07\xa1\x37\x8c\x50\x6a\xda\x60\x6c\x75\x8a\x36\x18\x32\x1e\x53" "\xe7\x23\x4a\xe6\x26\x86\xe6\x9c\x45\x54\xfa\xcf\xc7\xaf\x89\x61\xfc\x0f" "\x9a\x3a\xc8\x15\x8d\xb0\xd7\x57\x88\x74\x9b\x40\x62\x35\xb4\x99\x99\xdd" "\xdf\xd9\x05\x57\xa4\xea\x81\x2b\x5c\x7c\xeb\x14\x1e\x3c\x06\x00\x00\x00" "\x00\x00\x00\x00\x9e\x38\x16\x81\x39\xb9\x15\x2e\x27\xba\xd1\x41\xee\xd9" "\x8a\x41\xb3\x32\xb2\x19\x55\x55\x2c\x7f\xbf\x08\x09\x1a\xf5\x64\xb4\xf2" "\x79\x40\xd6\xd5\x78\xb5\xd5\xf3\xb6\xe4\x81\xf1\xb2\x85\xe5\xf5\x1d\xf6" "\x79\x52\x24\xc9\x58\x39\x2b\x71\xd2\x7f\xc8\x06\x65\x31\x0f\xfb\x9a\xdd" "\x09\x07\xf5\x7c\x7c\xcf\xc0\x08\xd3\xb4\xf5\x30\x63\x04\x29\xbd\x8e\xe1" "\x66\xa9\x13\x97\xf6\xc2\xf2\x1c\xde\x23\x80\x43\x0b\x3a\x85\xdc\xe3\x24" "\x2a\xc9\xec\xee\xa2\x81\xe6\x5b\x0e\xa5\x33\xab\x1d\x94\xf5\x01\x3d\xe3" "\x2b\x59\x99\x3b\x07\xe2\xe8\xc0\xab\x02\x9b\x31\x36\x31\xa4\x2e\x93\x81" "\xc1\xeb\x26\xe5\x5d\x41\x7d\x87\x4c\x5d\xd6\x2b\x53\xd5\x62\x61\xa2\xfd" "\xe6\x0d\xec\x9f\x76\x5e\x26\x93\xe0\x0b\x17\x33\xc3\xb8\x98\x04\x10\x34" "\xab\xac\x00\xe1\x76\x3b\x24\x04\x69\xc6\xff\x82\x75\x88\x58\xf8\x76\x37" "\xf0\x48\x6f\x6f\x26\x13\x8b\x20\x8d\x67\x81\x1b\x4c\xca\x93\xb6", 1024); memcpy((void*)0x20000640, "\xdd\x88\xfa\x7e\xcd\x18\xee\x90\x8e\xbd\xf2\x7a\xcc\x6d\xfb\x43\xeb" "\x93\x71\xa7\xca\x95\xf8\xcc\x3b\x90\x10\xf3\xca\xf5\x4a\xb0", 32); *(uint32_t*)0x20000660 = 0; *(uint8_t*)0x20000664 = 0; *(uint64_t*)0x20000668 = 0; *(uint64_t*)0x20000670 = 0x8000000000000428; *(uint64_t*)0x20000678 = 0; *(uint64_t*)0x20000680 = 0; *(uint64_t*)0x20000688 = 7; *(uint64_t*)0x20000690 = 0; *(uint64_t*)0x20000698 = 0; *(uint64_t*)0x200006a0 = 3; *(uint32_t*)0x200006a8 = 3; syscall(SYS_ioctl, r[0], 0xc450444aul, 0x20000240ul); return 0; }