// https://syzkaller.appspot.com/bug?id=4ee9d2df4117e1ae6875e98908f89e8462ba3a51 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 211 #endif #ifndef __NR_socket #define __NR_socket 198 #endif #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$nl_netfilter arguments: [ // domain: const = 0x10 (8 bytes) // type: const = 0x3 (8 bytes) // proto: const = 0xc (4 bytes) // ] // returns sock_nl_netfilter res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc); if (res != -1) r[0] = res; // sendmsg$NFT_BATCH arguments: [ // fd: sock_nl_netfilter (resource) // msg: ptr[in, msghdr_netlink[nft_batch_msg]] { // msghdr_netlink[nft_batch_msg] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, nft_batch_msg]] { // iovec[in, nft_batch_msg] { // addr: ptr[in, nft_batch_msg] { // nft_batch_msg { // begin: nft_nlmsghdr[NFNL_MSG_BATCH_BEGIN] { // nlmsg_len: len = 0x14 (4 bytes) // nlmsg_type: const = 0x10 (2 bytes) // nlmsg_flags: const = 0x1 (2 bytes) // nlmsg_seq: const = 0x0 (4 bytes) // nlmsg_pid: const = 0x0 (4 bytes) // hdr: nfgenmsg_nft { // nfgen_family: families = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: const = 0xa (2 bytes) // } // } // msgs: array[nft_batch_message] { // union nft_batch_message { // NFT_MSG_NEWTABLE: // netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES, // NFT_MSG_NEWTABLE, array[nft_table_policy]] { // len: len = 0x20 (4 bytes) // type: const = 0x0 (1 bytes) // subsys: const = 0xa (1 bytes) // flags: netlink_netfilter_msg_flags = 0x301 (2 bytes) // seq: const = 0x0 (4 bytes) // pid: const = 0x0 (4 bytes) // hdr: nfgenmsg { // nfgen_family: nfproto = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: int16be = 0x0 (2 bytes) // } // attrs: array[nft_table_policy] { // union nft_table_policy { // NFTA_TABLE_NAME: nlattr_t[const[NFTA_TABLE_NAME, // int16], string[nft_table_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {73 79 7a 30 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // } // } // } // union nft_batch_message { // NFT_MSG_NEWSET: // netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES, // NFT_MSG_NEWSET, array[nft_set_policy]] { // len: len = 0x64 (4 bytes) // type: const = 0x9 (1 bytes) // subsys: const = 0xa (1 bytes) // flags: netlink_netfilter_msg_flags = 0x401 (2 bytes) // seq: const = 0x0 (4 bytes) // pid: const = 0x0 (4 bytes) // hdr: nfgenmsg { // nfgen_family: nfproto = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: int16be = 0xfffc (2 bytes) // } // attrs: array[nft_set_policy] { // union nft_set_policy { // NFTA_SET_ID: nlattr_tt[const[NFTA_SET_ID, // int16:14], 1, 0, nft_set_id] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0xa (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 bytes) // payload: int32be = 0x1 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union nft_set_policy { // NFTA_SET_NAME: nlattr_t[const[NFTA_SET_NAME, // int16], string[nft_set_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: buffer: {73 79 7a 31 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // union nft_set_policy { // NFTA_SET_TABLE: nlattr_t[const[NFTA_SET_TABLE, // int16], string[nft_table_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {73 79 7a 30 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // union nft_set_policy { // NFTA_SET_KEY_LEN: // nlattr_tt[const[NFTA_SET_KEY_LEN, int16:14], 1, 0, // int32be[1:NFT_DATA_VALUE_MAXLEN]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x5 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 bytes) // payload: int32be = 0x8 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union nft_set_policy { // NFTA_SET_FLAGS: nlattr_tt[const[NFTA_SET_FLAGS, // int16:14], 1, 0, flags[nft_set_flags, int32be]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x3 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 bytes) // payload: nft_set_flags = 0x94 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union nft_set_policy { // NFTA_SET_DESC: nlattr_tt[const[NFTA_SET_DESC, // int16:14], 0, 1, array[nft_set_desc_policy]] { // nla_len: offsetof = 0x20 (2 bytes) // nla_type: const = 0x9 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[nft_set_desc_policy] { // union nft_set_desc_policy { // NFTA_SET_DESC_CONCAT: // nlattr_tt[const[NFTA_SET_DESC_CONCAT, // int16:14], 0, 1, // array[nlnest[NFTA_LIST_ELEM, // array[nft_concat_policy]]]] { // nla_len: offsetof = 0x1c (2 bytes) // nla_type: const = 0x2 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: // array[nlattr_tt[const[NFTA_LIST_ELEM, // int16:14], 0, 1, // array[nft_concat_policy]]] { // nlattr_tt[const[NFTA_LIST_ELEM, // int16:14], 0, 1, // array[nft_concat_policy]] { // nla_len: offsetof = 0xc (2 bytes) // nla_type: const = 0x1 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 // bytes) NLA_F_NESTED: const = 0x1 (1 // bytes) payload: // array[nft_concat_policy] { // union nft_concat_policy { // NFTA_SET_FIELD_LEN: // nlattr_tt[const[NFTA_SET_FIELD_LEN, // int16:14], 1, 0, int32be] { // nla_len: offsetof = 0x8 (2 // bytes) nla_type: const = 0x1 (1 // bytes) NLA_F_NET_BYTEORDER: // const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 // bytes) payload: int32be = 0x4 (4 // bytes) size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // nlattr_tt[const[NFTA_LIST_ELEM, // int16:14], 0, 1, // array[nft_concat_policy]] { // nla_len: offsetof = 0xc (2 bytes) // nla_type: const = 0x1 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 // bytes) NLA_F_NESTED: const = 0x1 (1 // bytes) payload: // array[nft_concat_policy] { // union nft_concat_policy { // NFTA_SET_FIELD_LEN: // nlattr_tt[const[NFTA_SET_FIELD_LEN, // int16:14], 1, 0, int32be] { // nla_len: offsetof = 0x8 (2 // bytes) nla_type: const = 0x1 (1 // bytes) NLA_F_NET_BYTEORDER: // const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 // bytes) payload: int32be = 0x4 (4 // bytes) size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // } // } // union nft_batch_message { // NFT_MSG_NEWSETELEM: // netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES, // NFT_MSG_NEWSETELEM, array[nft_set_elem_list_policy]] { // len: len = 0x3c (4 bytes) // type: const = 0xc (1 bytes) // subsys: const = 0xa (1 bytes) // flags: netlink_netfilter_msg_flags = 0x101 (2 bytes) // seq: const = 0x0 (4 bytes) // pid: const = 0x0 (4 bytes) // hdr: nfgenmsg { // nfgen_family: nfproto = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: int16be = 0x0 (2 bytes) // } // attrs: array[nft_set_elem_list_policy] { // union nft_set_elem_list_policy { // NFTA_SET_ELEM_LIST_SET: // nlattr_t[const[NFTA_SET_ELEM_LIST_SET, int16], // string[nft_set_elem_list_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: buffer: {73 79 7a 31 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // union nft_set_elem_list_policy { // NFTA_SET_ELEM_LIST_TABLE: // nlattr_t[const[NFTA_SET_ELEM_LIST_TABLE, int16], // string[nft_table_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {73 79 7a 30 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // union nft_set_elem_list_policy { // NFTA_SET_ELEM_LIST_ELEMENTS: // nlattr_tt[const[NFTA_SET_ELEM_LIST_ELEMENTS, // int16:14], 0, 1, array[nlnest[0, // array[nft_set_elem_policy]]]] { // nla_len: offsetof = 0x10 (2 bytes) // nla_type: const = 0x3 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[nlattr_tt[const[0, int16:14], 0, // 1, array[nft_set_elem_policy]]] { // nlattr_tt[const[0, int16:14], 0, 1, // array[nft_set_elem_policy]] { // nla_len: offsetof = 0xc (2 bytes) // nla_type: const = 0x0 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[nft_set_elem_policy] { // union nft_set_elem_policy { // NFTA_SET_ELEM_FLAGS: // nlattr_tt[const[NFTA_SET_ELEM_FLAGS, // int16:14], 1, 0, // flags[nft_set_elem_flags, int32be]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x3 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x1 (0 // bytes) NLA_F_NESTED: const = 0x0 (1 // bytes) payload: nft_set_elem_flags = // 0x2 (4 bytes) size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // size: buffer: {} (length 0x0) // } // } // } // } // } // } // end: nft_nlmsghdr[NFNL_MSG_BATCH_END] { // nlmsg_len: len = 0x14 (4 bytes) // nlmsg_type: const = 0x11 (2 bytes) // nlmsg_flags: const = 0x1 (2 bytes) // nlmsg_seq: const = 0x0 (4 bytes) // nlmsg_pid: const = 0x0 (4 bytes) // hdr: nfgenmsg_nft { // nfgen_family: families = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: const = 0xa (2 bytes) // } // } // } // } // len: len = 0xe8 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x20000400 = 0; *(uint32_t*)0x20000408 = 0; *(uint64_t*)0x20000410 = 0x20000000; *(uint64_t*)0x20000000 = 0x20000a00; *(uint32_t*)0x20000a00 = 0x14; *(uint16_t*)0x20000a04 = 0x10; *(uint16_t*)0x20000a06 = 1; *(uint32_t*)0x20000a08 = 0; *(uint32_t*)0x20000a0c = 0; *(uint8_t*)0x20000a10 = 2; *(uint8_t*)0x20000a11 = 0; *(uint16_t*)0x20000a12 = htobe16(0xa); *(uint32_t*)0x20000a14 = 0x20; *(uint8_t*)0x20000a18 = 0; *(uint8_t*)0x20000a19 = 0xa; *(uint16_t*)0x20000a1a = 0x301; *(uint32_t*)0x20000a1c = 0; *(uint32_t*)0x20000a20 = 0; *(uint8_t*)0x20000a24 = 2; *(uint8_t*)0x20000a25 = 0; *(uint16_t*)0x20000a26 = htobe16(0); *(uint16_t*)0x20000a28 = 9; *(uint16_t*)0x20000a2a = 1; memcpy((void*)0x20000a2c, "syz0\000", 5); *(uint32_t*)0x20000a34 = 0x64; *(uint8_t*)0x20000a38 = 9; *(uint8_t*)0x20000a39 = 0xa; *(uint16_t*)0x20000a3a = 0x401; *(uint32_t*)0x20000a3c = 0; *(uint32_t*)0x20000a40 = 0; *(uint8_t*)0x20000a44 = 2; *(uint8_t*)0x20000a45 = 0; *(uint16_t*)0x20000a46 = htobe16(0xfffc); *(uint16_t*)0x20000a48 = 8; STORE_BY_BITMASK(uint16_t, , 0x20000a4a, 0xa, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a4b, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a4b, 0, 7, 1); *(uint32_t*)0x20000a4c = htobe32(1); *(uint16_t*)0x20000a50 = 9; *(uint16_t*)0x20000a52 = 2; memcpy((void*)0x20000a54, "syz1\000", 5); *(uint16_t*)0x20000a5c = 9; *(uint16_t*)0x20000a5e = 1; memcpy((void*)0x20000a60, "syz0\000", 5); *(uint16_t*)0x20000a68 = 8; STORE_BY_BITMASK(uint16_t, , 0x20000a6a, 5, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a6b, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a6b, 0, 7, 1); *(uint32_t*)0x20000a6c = htobe32(8); *(uint16_t*)0x20000a70 = 8; STORE_BY_BITMASK(uint16_t, , 0x20000a72, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a73, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a73, 0, 7, 1); *(uint32_t*)0x20000a74 = htobe32(0x94); *(uint16_t*)0x20000a78 = 0x20; STORE_BY_BITMASK(uint16_t, , 0x20000a7a, 9, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a7b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a7b, 1, 7, 1); *(uint16_t*)0x20000a7c = 0x1c; STORE_BY_BITMASK(uint16_t, , 0x20000a7e, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a7f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a7f, 1, 7, 1); *(uint16_t*)0x20000a80 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x20000a82, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a83, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a83, 1, 7, 1); *(uint16_t*)0x20000a84 = 8; STORE_BY_BITMASK(uint16_t, , 0x20000a86, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a87, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a87, 0, 7, 1); *(uint32_t*)0x20000a88 = htobe32(4); *(uint16_t*)0x20000a8c = 0xc; STORE_BY_BITMASK(uint16_t, , 0x20000a8e, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a8f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a8f, 1, 7, 1); *(uint16_t*)0x20000a90 = 8; STORE_BY_BITMASK(uint16_t, , 0x20000a92, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000a93, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000a93, 0, 7, 1); *(uint32_t*)0x20000a94 = htobe32(4); *(uint32_t*)0x20000a98 = 0x3c; *(uint8_t*)0x20000a9c = 0xc; *(uint8_t*)0x20000a9d = 0xa; *(uint16_t*)0x20000a9e = 0x101; *(uint32_t*)0x20000aa0 = 0; *(uint32_t*)0x20000aa4 = 0; *(uint8_t*)0x20000aa8 = 2; *(uint8_t*)0x20000aa9 = 0; *(uint16_t*)0x20000aaa = htobe16(0); *(uint16_t*)0x20000aac = 9; *(uint16_t*)0x20000aae = 2; memcpy((void*)0x20000ab0, "syz1\000", 5); *(uint16_t*)0x20000ab8 = 9; *(uint16_t*)0x20000aba = 1; memcpy((void*)0x20000abc, "syz0\000", 5); *(uint16_t*)0x20000ac4 = 0x10; STORE_BY_BITMASK(uint16_t, , 0x20000ac6, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000ac7, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000ac7, 1, 7, 1); *(uint16_t*)0x20000ac8 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x20000aca, 0, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000acb, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000acb, 1, 7, 1); *(uint16_t*)0x20000acc = 8; STORE_BY_BITMASK(uint16_t, , 0x20000ace, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000acf, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000acf, 0, 7, 1); *(uint32_t*)0x20000ad0 = htobe32(2); *(uint32_t*)0x20000ad4 = 0x14; *(uint16_t*)0x20000ad8 = 0x11; *(uint16_t*)0x20000ada = 1; *(uint32_t*)0x20000adc = 0; *(uint32_t*)0x20000ae0 = 0; *(uint8_t*)0x20000ae4 = 2; *(uint8_t*)0x20000ae5 = 0; *(uint16_t*)0x20000ae6 = htobe16(0xa); *(uint64_t*)0x20000008 = 0xe8; *(uint64_t*)0x20000418 = 1; *(uint64_t*)0x20000420 = 0; *(uint64_t*)0x20000428 = 0; *(uint32_t*)0x20000430 = 0; syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x20000400ul, /*f=*/0ul); // socket$nl_netfilter arguments: [ // domain: const = 0x10 (8 bytes) // type: const = 0x3 (8 bytes) // proto: const = 0xc (4 bytes) // ] // returns sock_nl_netfilter res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc); if (res != -1) r[1] = res; // sendmsg$NFT_BATCH arguments: [ // fd: sock_nl_netfilter (resource) // msg: ptr[in, msghdr_netlink[nft_batch_msg]] { // msghdr_netlink[nft_batch_msg] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, nft_batch_msg]] { // iovec[in, nft_batch_msg] { // addr: ptr[in, nft_batch_msg] { // nft_batch_msg { // begin: nft_nlmsghdr[NFNL_MSG_BATCH_BEGIN] { // nlmsg_len: len = 0x14 (4 bytes) // nlmsg_type: const = 0x10 (2 bytes) // nlmsg_flags: const = 0x1 (2 bytes) // nlmsg_seq: const = 0x0 (4 bytes) // nlmsg_pid: const = 0x0 (4 bytes) // hdr: nfgenmsg_nft { // nfgen_family: families = 0x5 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: const = 0xa (2 bytes) // } // } // msgs: array[nft_batch_message] { // union nft_batch_message { // NFT_MSG_DELTABLE: // netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES, // NFT_MSG_DELTABLE, array[nft_table_policy]] { // len: len = 0x14 (4 bytes) // type: const = 0x2 (1 bytes) // subsys: const = 0xa (1 bytes) // flags: netlink_netfilter_msg_flags = 0x101 (2 bytes) // seq: const = 0x0 (4 bytes) // pid: const = 0x0 (4 bytes) // hdr: nfgenmsg { // nfgen_family: nfproto = 0x0 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: int16be = 0x3 (2 bytes) // } // attrs: array[nft_table_policy] { // } // } // } // } // end: nft_nlmsghdr[NFNL_MSG_BATCH_END] { // nlmsg_len: len = 0x14 (4 bytes) // nlmsg_type: const = 0x11 (2 bytes) // nlmsg_flags: const = 0x1 (2 bytes) // nlmsg_seq: const = 0x0 (4 bytes) // nlmsg_pid: const = 0x0 (4 bytes) // hdr: nfgenmsg_nft { // nfgen_family: families = 0x1 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: const = 0xa (2 bytes) // } // } // } // } // len: len = 0x3c (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x20000840 = 0; *(uint32_t*)0x20000848 = 0; *(uint64_t*)0x20000850 = 0x20000380; *(uint64_t*)0x20000380 = 0x20000500; *(uint32_t*)0x20000500 = 0x14; *(uint16_t*)0x20000504 = 0x10; *(uint16_t*)0x20000506 = 1; *(uint32_t*)0x20000508 = 0; *(uint32_t*)0x2000050c = 0; *(uint8_t*)0x20000510 = 5; *(uint8_t*)0x20000511 = 0; *(uint16_t*)0x20000512 = htobe16(0xa); *(uint32_t*)0x20000514 = 0x14; *(uint8_t*)0x20000518 = 2; *(uint8_t*)0x20000519 = 0xa; *(uint16_t*)0x2000051a = 0x101; *(uint32_t*)0x2000051c = 0; *(uint32_t*)0x20000520 = 0; *(uint8_t*)0x20000524 = 0; *(uint8_t*)0x20000525 = 0; *(uint16_t*)0x20000526 = htobe16(3); *(uint32_t*)0x20000528 = 0x14; *(uint16_t*)0x2000052c = 0x11; *(uint16_t*)0x2000052e = 1; *(uint32_t*)0x20000530 = 0; *(uint32_t*)0x20000534 = 0; *(uint8_t*)0x20000538 = 1; *(uint8_t*)0x20000539 = 0; *(uint16_t*)0x2000053a = htobe16(0xa); *(uint64_t*)0x20000388 = 0x3c; *(uint64_t*)0x20000858 = 1; *(uint64_t*)0x20000860 = 0; *(uint64_t*)0x20000868 = 0; *(uint32_t*)0x20000870 = 0; syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x20000840ul, /*f=*/0ul); return 0; }