// https://syzkaller.appspot.com/bug?id=8c79967f1c086cddff496f5d8cb0a0576dd7a0fa // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 73 79 73 00} (length 0x6) // } // mode: open_mode = 0x1ff (8 bytes) // ] memcpy((void*)0x200000000000, "./sys\000", 6); syscall( __NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000000ul, /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/ 0x1fful); // mount arguments: [ // src: nil // dst: ptr[in, buffer] { // buffer: {2e 2f 73 79 73 00} (length 0x6) // } // type: ptr[in, buffer] { // buffer: {73 79 73 66 73 00} (length 0x6) // } // flags: mount_flags = 0x0 (8 bytes) // data: nil // ] memcpy((void*)0x200000000000, "./sys\000", 6); memcpy((void*)0x200000000100, "sysfs\000", 6); syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000000ul, /*type=*/0x200000000100ul, /*flags=*/0ul, /*data=*/0ul); // openat arguments: [ // fd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 2f 73 79 73 2f 62 75 73 2f 70 6c 61 74 66 6f 72 6d 2f 64 // 65 76 69 63 65 73 2f 64 75 6d 6d 79 5f 75 64 63 2e 30 2f 64 72 69 76 // 65 72 5f 6f 76 65 72 72 69 64 65 00} (length 0x37) // } // flags: open_flags = 0x1 (4 bytes) // mode: open_mode = 0x0 (2 bytes) // ] // returns fd memcpy((void*)0x200000000200, "./sys/bus/platform/devices/dummy_udc.0/driver_override\000", 55); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000200ul, /*flags=O_WRONLY*/ 1, /*mode=*/0); if (res != -1) r[0] = res; // write arguments: [ // fd: fd (resource) // buf: ptr[in, buffer] { // buffer: {72 65 67 2d 66 69 78 65 64 2d 76 6f 6c 74 61 67 65 00} // (length 0x12) // } // count: len = 0x12 (8 bytes) // ] memcpy((void*)0x200000000300, "reg-fixed-voltage\000", 18); syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000300ul, /*count=*/0x12ul); // openat arguments: [ // fd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 2f 73 79 73 2f 62 75 73 2f 70 6c 61 74 66 6f 72 6d 2f 64 // 72 69 76 65 72 73 2f 64 75 6d 6d 79 5f 75 64 63 2f 75 6e 62 69 6e 64 // 00} (length 0x2c) // } // flags: open_flags = 0x1 (4 bytes) // mode: open_mode = 0x0 (2 bytes) // ] // returns fd memcpy((void*)0x200000000400, "./sys/bus/platform/drivers/dummy_udc/unbind\000", 44); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000400ul, /*flags=O_WRONLY*/ 1, /*mode=*/0); if (res != -1) r[1] = res; // write arguments: [ // fd: fd (resource) // buf: ptr[in, buffer] { // buffer: {64 75 6d 6d 79 5f 75 64 63 2e 30 00} (length 0xc) // } // count: len = 0xb (8 bytes) // ] memcpy((void*)0x200000000500, "dummy_udc.0\000", 12); syscall(__NR_write, /*fd=*/r[1], /*buf=*/0x200000000500ul, /*count=*/0xbul); // openat arguments: [ // fd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 2f 73 79 73 2f 62 75 73 2f 70 6c 61 74 66 6f 72 6d 2f 64 // 72 69 76 65 72 73 2f 72 65 67 2d 66 69 78 65 64 2d 76 6f 6c 74 61 67 // 65 2f 62 69 6e 64 00} (length 0x32) // } // flags: open_flags = 0x1 (4 bytes) // mode: open_mode = 0x0 (2 bytes) // ] // returns fd memcpy((void*)0x200000000600, "./sys/bus/platform/drivers/reg-fixed-voltage/bind\000", 50); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000600ul, /*flags=O_WRONLY*/ 1, /*mode=*/0); if (res != -1) r[2] = res; // write arguments: [ // fd: fd (resource) // buf: ptr[in, buffer] { // buffer: {64 75 6d 6d 79 5f 75 64 63 2e 30 00} (length 0xc) // } // count: len = 0xb (8 bytes) // ] memcpy((void*)0x200000000700, "dummy_udc.0\000", 12); syscall(__NR_write, /*fd=*/r[2], /*buf=*/0x200000000700ul, /*count=*/0xbul); return 0; }