// https://syzkaller.appspot.com/bug?id=2d2bbce43f98c7bcd3dc505bc9094baa8289c8b8 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x3ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x400000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x400001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=SOCK_RAW*/ 3ul, /*proto=*/0); if (res != -1) r[0] = res; memcpy((void*)0x400000000300, "bond0\000\000\000\000\000\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x400000000300ul); if (res != -1) r[1] = *(uint32_t*)0x400000000310; res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0); if (res != -1) r[2] = res; *(uint64_t*)0x4000000007c0 = 0; *(uint32_t*)0x4000000007c8 = 0; *(uint64_t*)0x4000000007d0 = 0x400000000780; *(uint64_t*)0x400000000780 = 0x400000000000; *(uint32_t*)0x400000000000 = 0x9c; *(uint16_t*)0x400000000004 = 0x24; *(uint16_t*)0x400000000006 = 0xf0b; *(uint32_t*)0x400000000008 = 0x70bd2b; *(uint32_t*)0x40000000000c = 0; *(uint8_t*)0x400000000010 = 0; *(uint8_t*)0x400000000011 = 0; *(uint16_t*)0x400000000012 = 0x12; *(uint32_t*)0x400000000014 = r[1]; *(uint16_t*)0x400000000018 = 0; *(uint16_t*)0x40000000001a = 0; *(uint16_t*)0x40000000001c = -1; *(uint16_t*)0x40000000001e = -1; *(uint16_t*)0x400000000020 = 2; *(uint16_t*)0x400000000022 = 0; *(uint16_t*)0x400000000024 = 0xb; *(uint16_t*)0x400000000026 = 1; memcpy((void*)0x400000000028, "taprio\000", 7); *(uint16_t*)0x400000000030 = 0x6c; *(uint16_t*)0x400000000032 = 2; *(uint16_t*)0x400000000034 = 0x56; *(uint16_t*)0x400000000036 = 1; *(uint8_t*)0x400000000038 = 2; *(uint8_t*)0x400000000039 = 0; *(uint8_t*)0x40000000003a = 0; *(uint8_t*)0x40000000003b = 0; *(uint8_t*)0x40000000003c = 0; *(uint8_t*)0x40000000003d = 0; *(uint8_t*)0x40000000003e = 0; *(uint8_t*)0x40000000003f = 0; *(uint8_t*)0x400000000040 = 0; *(uint8_t*)0x400000000041 = 0; *(uint8_t*)0x400000000042 = 0; *(uint8_t*)0x400000000043 = 1; *(uint8_t*)0x400000000044 = 0; *(uint8_t*)0x400000000045 = 0; *(uint8_t*)0x400000000046 = 0; *(uint8_t*)0x400000000047 = 0; *(uint8_t*)0x400000000048 = 0; *(uint8_t*)0x400000000049 = 0; *(uint16_t*)0x40000000004a = 5; *(uint16_t*)0x40000000004c = 4; *(uint16_t*)0x40000000004e = 2; *(uint16_t*)0x400000000050 = 0; *(uint16_t*)0x400000000052 = 8; *(uint16_t*)0x400000000054 = 0; *(uint16_t*)0x400000000056 = 9; *(uint16_t*)0x400000000058 = 0; *(uint16_t*)0x40000000005a = 0; *(uint16_t*)0x40000000005c = 0; *(uint16_t*)0x40000000005e = 0; *(uint16_t*)0x400000000060 = 0; *(uint16_t*)0x400000000062 = 0; *(uint16_t*)0x400000000064 = 0; *(uint16_t*)0x400000000066 = 0; *(uint16_t*)0x400000000068 = 3; *(uint16_t*)0x40000000006a = 0; *(uint16_t*)0x40000000006c = 8; *(uint16_t*)0x40000000006e = 0; *(uint16_t*)0x400000000070 = 0; *(uint16_t*)0x400000000072 = 2; *(uint16_t*)0x400000000074 = 0; *(uint16_t*)0x400000000076 = 0; *(uint16_t*)0x400000000078 = 0; *(uint16_t*)0x40000000007a = 0; *(uint16_t*)0x40000000007c = 0; *(uint16_t*)0x40000000007e = 0; *(uint16_t*)0x400000000080 = 0; *(uint16_t*)0x400000000082 = 0; *(uint16_t*)0x400000000084 = 0; *(uint16_t*)0x400000000086 = 0; *(uint16_t*)0x400000000088 = 0; *(uint16_t*)0x40000000008c = 8; STORE_BY_BITMASK(uint16_t, , 0x40000000008e, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x40000000008f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x40000000008f, 1, 7, 1); *(uint16_t*)0x400000000090 = 4; STORE_BY_BITMASK(uint16_t, , 0x400000000092, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x400000000093, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x400000000093, 1, 7, 1); *(uint16_t*)0x400000000094 = 8; *(uint16_t*)0x400000000096 = 5; *(uint32_t*)0x400000000098 = 7; *(uint64_t*)0x400000000788 = 0x9c; *(uint64_t*)0x4000000007d8 = 1; *(uint64_t*)0x4000000007e0 = 0; *(uint64_t*)0x4000000007e8 = 0; *(uint32_t*)0x4000000007f0 = 0; syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x4000000007c0ul, /*f=*/0ul); return 0; }