// https://syzkaller.appspot.com/bug?id=386c42c7796b556fde3ec8283905ae52c37ebbd2 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #ifndef __NR_landlock_create_ruleset #define __NR_landlock_create_ruleset 444 #endif #ifndef __NR_landlock_restrict_self #define __NR_landlock_restrict_self 446 #endif uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // landlock_create_ruleset arguments: [ // attr: ptr[in, landlock_ruleset_attr] { // landlock_ruleset_attr { // handled_access_fs: landlock_access_fs_flags = 0x100 (8 bytes) // handled_access_net: landlock_access_net_flags = 0x0 (8 bytes) // scoped: landlock_scope_flags = 0x0 (8 bytes) // quiet_access_fs: landlock_access_fs_flags = 0x0 (8 bytes) // quiet_access_net: landlock_access_net_flags = 0x0 (8 bytes) // quiet_scoped: landlock_scope_flags = 0x0 (8 bytes) // } // } // size: bytesize = 0x30 (8 bytes) // flags: landlock_create_ruleset_flags = 0x0 (8 bytes) // ] // returns fd_ruleset *(uint64_t*)0x2000000000c0 = 0x100; *(uint64_t*)0x2000000000c8 = 0; *(uint64_t*)0x2000000000d0 = 0; *(uint64_t*)0x2000000000d8 = 0; *(uint64_t*)0x2000000000e0 = 0; *(uint64_t*)0x2000000000e8 = 0; res = syscall(__NR_landlock_create_ruleset, /*attr=*/0x2000000000c0ul, /*size=*/0x30ul, /*flags=*/0ul); if (res != -1) r[0] = res; // landlock_restrict_self arguments: [ // ruleset_fd: fd_ruleset (resource) // flags: landlock_restrict_self_flags = 0x0 (8 bytes) // ] syscall(__NR_landlock_restrict_self, /*ruleset_fd=*/r[0], /*flags=*/0ul); // landlock_create_ruleset arguments: [ // attr: ptr[in, landlock_ruleset_attr] { // landlock_ruleset_attr { // handled_access_fs: landlock_access_fs_flags = 0x20 (8 bytes) // handled_access_net: landlock_access_net_flags = 0x0 (8 bytes) // scoped: landlock_scope_flags = 0x0 (8 bytes) // quiet_access_fs: landlock_access_fs_flags = 0x0 (8 bytes) // quiet_access_net: landlock_access_net_flags = 0x0 (8 bytes) // quiet_scoped: landlock_scope_flags = 0x0 (8 bytes) // } // } // size: bytesize = 0x30 (8 bytes) // flags: landlock_create_ruleset_flags = 0x0 (8 bytes) // ] // returns fd_ruleset *(uint64_t*)0x200000000240 = 0x20; *(uint64_t*)0x200000000248 = 0; *(uint64_t*)0x200000000250 = 0; *(uint64_t*)0x200000000258 = 0; *(uint64_t*)0x200000000260 = 0; *(uint64_t*)0x200000000268 = 0; res = syscall(__NR_landlock_create_ruleset, /*attr=*/0x200000000240ul, /*size=*/0x30ul, /*flags=*/0ul); if (res != -1) r[1] = res; // landlock_restrict_self arguments: [ // ruleset_fd: fd_ruleset (resource) // flags: landlock_restrict_self_flags = 0x0 (8 bytes) // ] syscall(__NR_landlock_restrict_self, /*ruleset_fd=*/r[1], /*flags=*/0ul); return 0; }