map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// mkdirat arguments: [
// fd: fd_dir (resource)
// path: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// mode: open_mode = 0x0 (8 bytes)
// ]
memcpy((void*)0x200000000000, "./file0\000", 8);
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000000ul, /*mode=*/0ul);
// mount$9p_virtio arguments: [
// src: ptr[in, buffer] {
// buffer: {73 79 7a 00} (length 0x4)
// }
// dst: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// type: ptr[in, buffer] {
// buffer: {39 70 00} (length 0x3)
// }
// flags: mount_flags = 0x0 (8 bytes)
// opts: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {78 22 6e 6f 65 78 61 63 63 81 73 73 3d 61 6e 79 2c 63 61 63 68 65 3d 66 73 63 61 63 68 65} (length 0x1e)
// }
// }
// }
// ]
memcpy((void*)0x2000000001c0, "syz\000", 4);
memcpy((void*)0x200000000480, "./file0\000", 8);
memcpy((void*)0x2000000004c0, "9p\000", 3);
memcpy((void*)0x200000000840, "\x78\x22\x6e\x6f\x65\x78\x61\x63\x63\x81\x73\x73\x3d\x61\x6e\x79\x2c\x63\x61\x63\x68\x65\x3d\x66\x73\x63\x61\x63\x68\x65", 30);
syscall(__NR_mount, /*src=*/0x2000000001c0ul, /*dst=*/0x200000000480ul, /*type=*/0x2000000004c0ul, /*flags=*/0ul, /*opts=*/0x200000000840ul);
// chdir arguments: [
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// ]
memcpy((void*)0x200000000280, "./file0\000", 8);
syscall(__NR_chdir, /*dir=*/0x200000000280ul);
// openat$cgroup_ro arguments: [
// fd: fd_cgroup (resource)
// file: ptr[in, buffer] {
// buffer: {62 6c 6b 69 6f 2e 62 66 71 2e 69 6f 5f 73 65 72 76 69 63 65 64 00} (length 0x16)
// }
// flags: const = 0x275a (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x200000000000, "blkio.bfq.io_serviced\000", 22);
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000000ul, /*flags=*/0x275a, /*mode=*/0);
if (res != -1)
r[0] = res;
// mmap arguments: [
// addr: VMA[0xb36000]
// len: len = 0xb36000 (8 bytes)
// prot: mmap_prot = 0x2 (8 bytes)
// flags: mmap_flags = 0x28011 (8 bytes)
// fd: fd (resource)
// offset: intptr = 0x0 (8 bytes)
// ]
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul, /*prot=PROT_WRITE*/2ul, /*flags=MAP_STACK|MAP_POPULATE|MAP_FIXED|MAP_SHARED*/0x28011ul, /*fd=*/r[0], /*offset=*/0ul);
// ftruncate arguments: [
// fd: fd (resource)
// len: intptr = 0xc17c (8 bytes)
// ]
syscall(__NR_ftruncate, /*fd=*/r[0], /*len=*/0xc17cul);
// openat$vmci arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 76 6d 63 69 00} (length 0xa)
// }
// flags: const = 0x2 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_vmci
memcpy((void*)0x200000000740, "/dev/vmci\000", 10);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000740ul, /*flags=*/2, /*mode=*/0);
if (res != -1)
r[1] = res;
// ioctl$IOCTL_VMCI_VERSION2 arguments: [
// fd: fd_vmci (resource)
// cmd: const = 0x7a7 (4 bytes)
// arg: ptr[in, vmci_version] {
// vmci_version = 0xb0000 (4 bytes)
// }
// ]
*(uint32_t*)0x200000000080 = 0xb0000;
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x7a7, /*arg=*/0x200000000080ul);
// unshare arguments: [
// flags: unshare_flags = 0xc040400 (8 bytes)
// ]
syscall(__NR_unshare, /*flags=CLONE_SYSVSEM|CLONE_NEWUTS|CLONE_NEWIPC|CLONE_FILES*/0xc040400ul);
// ioctl$IOCTL_VMCI_INIT_CONTEXT arguments: [
// fd: fd_vmci (resource)
// cmd: const = 0x7a0 (4 bytes)
// arg: ptr[in, vmci_init_blk] {
// vmci_init_blk {
// cid: union vmaddr_cid {
// my: proc = 0x1 (4 bytes)
// }
// flags: vmci_privilege = 0x0 (4 bytes)
// }
// }
// ]
*(uint32_t*)0x200000000000 = 0x4d3;
*(uint32_t*)0x200000000004 = 0;
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x7a0, /*arg=*/0x200000000000ul);
// ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC arguments: [
// fd: fd_vmci (resource)
// cmd: const = 0x7a8 (4 bytes)
// arg: ptr[in, vmci_qp_alloc_info] {
// vmci_qp_alloc_info {
// handle: vmci_handle {
// context: union vmaddr_cid {
// my: proc = 0x1 (4 bytes)
// }
// rsc: int32 = 0x0 (4 bytes)
// }
// peer: union vmaddr_cid {
// hyper: const = 0x0 (4 bytes)
// }
// flags: vmci_qp = 0x0 (4 bytes)
// produce_size: int64 = 0x2925 (8 bytes)
// consume_size: int64 = 0x0 (8 bytes)
// ppn_va: int64 = 0x20000000 (8 bytes)
// num_ppns: int64 = 0x4 (8 bytes)
// result: int32 = 0x0 (4 bytes)
// version: int32 = 0x0 (4 bytes)
// }
// }
// ]
*(uint32_t*)0x200000000640 = 0x4d3;
*(uint32_t*)0x200000000644 = 0;
*(uint32_t*)0x200000000648 = 0;
*(uint32_t*)0x20000000064c = 0;
*(uint64_t*)0x200000000650 = 0x2925;
*(uint64_t*)0x200000000658 = 0;
*(uint64_t*)0x200000000660 = 0x20000000;
*(uint64_t*)0x200000000668 = 4;
*(uint32_t*)0x200000000670 = 0;
*(uint32_t*)0x200000000674 = 0;
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x7a8, /*arg=*/0x200000000640ul);
return 0;
}
]