// https://syzkaller.appspot.com/bug?id=ef95147925146612c0c5b3abc6a2a10cdc1797f1 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; NONFAILING(strncpy(buf, (char*)a0, sizeof(buf) - 1)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } #ifndef __NR_sched_setattr #define __NR_sched_setattr 314 #endif uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); install_segv_handler(); long res = 0; NONFAILING(*(uint32_t*)0x200002c0 = 0); NONFAILING(*(uint32_t*)0x200002c4 = 2); NONFAILING(*(uint64_t*)0x200002c8 = 0); NONFAILING(*(uint32_t*)0x200002d0 = 0); NONFAILING(*(uint32_t*)0x200002d4 = 3); NONFAILING(*(uint64_t*)0x200002d8 = 0); NONFAILING(*(uint64_t*)0x200002e0 = 0); NONFAILING(*(uint64_t*)0x200002e8 = 0); syscall(__NR_sched_setattr, 0, 0x200002c0, 0); syz_open_dev(0, 0, 0); NONFAILING(memcpy((void*)0x200000c0, "./bus\000", 6)); res = syscall(__NR_creat, 0x200000c0, 0); if (res != -1) r[0] = res; NONFAILING(*(uint64_t*)0x20000380 = -1); syscall(__NR_write, r[0], 0x20000380, 1); NONFAILING(*(uint32_t*)0x20000040 = 1); NONFAILING(*(uint32_t*)0x20000044 = 0x70); NONFAILING(*(uint8_t*)0x20000048 = 0); NONFAILING(*(uint8_t*)0x20000049 = 0); NONFAILING(*(uint8_t*)0x2000004a = 0); NONFAILING(*(uint8_t*)0x2000004b = 0); NONFAILING(*(uint32_t*)0x2000004c = 0); NONFAILING(*(uint64_t*)0x20000050 = 0x50d); NONFAILING(*(uint64_t*)0x20000058 = 0); NONFAILING(*(uint64_t*)0x20000060 = 0); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 0, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 1, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 2, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 4, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 5, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 7, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 8, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 9, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 10, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 11, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 12, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 13, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 14, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 15, 2)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 17, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 18, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 19, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 20, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 21, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 22, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 23, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 24, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 25, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 26, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 27, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 28, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x20000068, 0, 29, 35)); NONFAILING(*(uint32_t*)0x20000070 = 0); NONFAILING(*(uint32_t*)0x20000074 = 0); NONFAILING(*(uint64_t*)0x20000078 = 0); NONFAILING(*(uint64_t*)0x20000080 = 0); NONFAILING(*(uint64_t*)0x20000088 = 0); NONFAILING(*(uint64_t*)0x20000090 = 0); NONFAILING(*(uint32_t*)0x20000098 = 0); NONFAILING(*(uint32_t*)0x2000009c = 0); NONFAILING(*(uint64_t*)0x200000a0 = 0); NONFAILING(*(uint32_t*)0x200000a8 = 0); NONFAILING(*(uint16_t*)0x200000ac = 0); NONFAILING(*(uint16_t*)0x200000ae = 0); syscall(__NR_perf_event_open, 0x20000040, 0, -1, -1, 0); NONFAILING(memcpy((void*)0x20000180, "./bus\000", 6)); res = syscall(__NR_open, 0x20000180, 0, 0); if (res != -1) r[1] = res; syscall(__NR_sendto, r[0], 0, 0, 0x4000800, 0, 0); syscall(__NR_sendfile, r[0], r[1], 0, 0x8000fffffffe); syscall(__NR_preadv, -1, 0, 0, 0); return 0; }