// https://syzkaller.appspot.com/bug?id=c15dd66633f182dfa034edb10c8b2665d76be898 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define CAST uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t,intptr_t,intptr_t))CAST(mmap))(/*addr=*/0x20000000, /*len=*/0x1000000, /*prot=*/3, /*flags=*/0x1012, /*fd=*/-1, /*offset=*/0); intptr_t res = 0; *(uint32_t*)0x20000040 = 0xa; *(uint32_t*)0x20000044 = 1; *(uint32_t*)0x20000048 = 0x11; ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t,intptr_t,intptr_t))CAST(sysctl))(/*name=*/0x20000040, /*namelen=*/3, /*oldp=*/0, /*oldlenp=*/0, /*newp=*/0x20000280, /*newlen=*/4); memcpy((void*)0x20000300, ".\000", 2); res = -1; res = ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(open))(/*file=*/0x20000300, /*flags=*/0, /*mode=*/0); if (res != -1) r[0] = res; memcpy((void*)0x20000340, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78); ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(mkdirat))(/*fd=*/r[0], /*path=*/0x20000340, /*mode=*/0); memcpy((void*)0x20000000, "./file0\000", 8); ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(mkdirat))(/*fd=*/r[0], /*path=*/0x20000000, /*mode=*/0); memcpy((void*)0x20000440, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238//file0\000", 84); ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(mkdirat))(/*fd=*/r[0], /*path=*/0x20000440, /*mode=*/0); memcpy((void*)0x20000040, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238//../file0\000", 87); res = -1; res = ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(open))(/*file=*/0x20000040, /*flags=*/0, /*mode=*/0); if (res != -1) r[1] = res; res = -1; res = ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(fcntl))(/*fd=*/r[1], /*cmd=*/0, /*arg=*/r[0]); if (res != -1) r[2] = res; memcpy((void*)0x200004c0, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238//file0\000", 84); ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t))CAST(renameat))(/*oldfd=*/r[2], /*old=*/0x200004c0, /*newfd=*/-1, /*new=*/0); memcpy((void*)0x20000100, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238//file0\000", 84); memcpy((void*)0x20000180, "./file0\000", 8); ((intptr_t(*)(intptr_t,intptr_t))CAST(rename))(/*old=*/0x20000100, /*new=*/0x20000180); memcpy((void*)0x200001c0, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78); memcpy((void*)0x200000c0, "c\000", 2); ((intptr_t(*)(intptr_t,intptr_t))CAST(unveil))(/*path=*/0x200001c0, /*permissions=*/0x200000c0); memcpy((void*)0x20000240, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78); ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t))CAST(openat))(/*fd=*/r[1], /*file=*/0x20000240, /*flags=*/0x200, /*mode=*/0); return 0; }