// https://syzkaller.appspot.com/bug?id=c934d0e3d6da62919c605370fa3c3514e889b655 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$inet_udp arguments: [ // domain: const = 0x2 (8 bytes) // type: const = 0x2 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_udp res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0); if (res != -1) r[0] = res; // close arguments: [ // fd: fd (resource) // ] syscall(__NR_close, /*fd=*/r[0]); // mknod$loop arguments: [ // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // mode: mknod_mode = 0xfff (8 bytes) // dev: proc = 0x1 (4 bytes) // ] memcpy((void*)0x200000000140, "./file0\000", 8); syscall(__NR_mknod, /*file=*/0x200000000140ul, /*mode=S_ISVTX|S_ISGID|S_ISUID|0x1ff*/ 0xffful, /*dev=*/0x701); // mount$fuse arguments: [ // src: const = 0x0 (8 bytes) // dst: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // type: ptr[in, buffer] { // buffer: {66 75 73 65 00} (length 0x5) // } // flags: mount_flags = 0x0 (8 bytes) // opts: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {66 64 3d} (length 0x3) // } // union ANYUNION { // ANYRESHEX: ANYRES64 (resource) // } // union ANYUNION { // ANYBLOB: buffer: {2c 72 6f 6f 74 6d 6f 64 65 3d 30 30 30 30 30 30 // 30 30 30 31 30 30 30 30 30 2c 75 73 65 72 5f 69 64 3d} (length // 0x22) // } // union ANYUNION { // ANYRESDEC: ANYRES64 (resource) // } // union ANYUNION { // ANYBLOB: buffer: {} (length 0x0) // } // union ANYUNION { // ANYRESDEC: ANYRES64 (resource) // } // } // } // ] memcpy((void*)0x2000000020c0, "./file0\000", 8); memcpy((void*)0x200000002100, "fuse\000", 5); memcpy((void*)0x200000002140, "fd=", 3); sprintf((char*)0x200000002143, "0x%016llx", (long long)r[0]); memcpy((void*)0x200000002155, ",rootmode=000000000100000,user_id=", 34); sprintf((char*)0x200000002177, "%020llu", (long long)0); sprintf((char*)0x20000000218b, "%020llu", (long long)0); syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x2000000020c0ul, /*type=*/0x200000002100ul, /*flags=*/0ul, /*opts=*/0x200000002140ul); return 0; }