// https://syzkaller.appspot.com/bug?id=54bffbf328e57cb723fe1ffdde745a7cc4b86376 #include #include #include #include #include #include #include #include void write_file(const char *path, const char *val) { int fd = open(path, O_WRONLY); if (fd < 0) { printf("[-] Failed to open %s: %s\n", path, strerror(errno)); exit(1); } if (write(fd, val, strlen(val)) < 0) { printf("[-] Failed to write to %s: %s\n", path, strerror(errno)); close(fd); exit(1); } close(fd); printf("[+] Wrote '%s' to %s\n", val, path); } int main() { int res; res = mount("configfs", "/sys/kernel/config", "configfs", 0, NULL); if (res < 0 && errno != EBUSY) { printf("[-] Failed to mount configfs: %s\n", strerror(errno)); } else { printf("[+] configfs mounted or already mounted.\n"); } // Cleanup previous state if any int fd = open("/sys/kernel/config/nullb/mydev/power", O_WRONLY); if (fd >= 0) { if (write(fd, "0\n", 2) < 0) {} close(fd); } rmdir("/sys/kernel/config/nullb/mydev"); res = mkdir("/sys/kernel/config/nullb/mydev", 0755); if (res < 0) { printf("[-] Failed to create mydev: %s\n", strerror(errno)); exit(1); } printf("[+] Created mydev successfully.\n"); write_file("/sys/kernel/config/nullb/mydev/zoned", "1\n"); write_file("/sys/kernel/config/nullb/mydev/memory_backed", "1\n"); write_file("/sys/kernel/config/nullb/mydev/shared_tags", "1\n"); // This should trigger the bug write_file("/sys/kernel/config/nullb/mydev/power", "1\n"); // Sleep to allow asynchronous tasks to finish if needed sleep(2); return 0; }