map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_bind
#define __NR_bind 200
#endif
#ifndef __NR_mmap
#define __NR_mmap 222
#endif
#ifndef __NR_openat
#define __NR_openat 56
#endif
#ifndef __NR_sendto
#define __NR_sendto 206
#endif
#ifndef __NR_socket
#define __NR_socket 198
#endif
#ifndef __NR_writev
#define __NR_writev 66
#endif
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// openat$smackfs_ambient arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 73 79 73 2f 66 73 2f 73 6d 61 63 6b 66 73 2f 61 6d 62 69 65 6e 74 00} (length 0x18)
// }
// flags: const = 0x2 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_smackfs_label
memcpy((void*)0x20000000, "/sys/fs/smackfs/ambient\000", 24);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000000ul, /*flags=*/2, /*mode=*/0);
if (res != -1)
r[0] = res;
// writev arguments: [
// fd: fd (resource)
// vec: ptr[in, array[iovec[in, array[int8]]]] {
// array[iovec[in, array[int8]]] {
// iovec[in, array[int8]] {
// addr: ptr[in, buffer] {
// buffer: {40} (length 0x1)
// }
// len: len = 0x1 (8 bytes)
// }
// }
// }
// vlen: len = 0x1 (8 bytes)
// ]
*(uint64_t*)0x200078c0 = 0x20007700;
memset((void*)0x20007700, 64, 1);
*(uint64_t*)0x200078c8 = 1;
syscall(__NR_writev, /*fd=*/r[0], /*vec=*/0x200078c0ul, /*vlen=*/1ul);
// socket$inet arguments: [
// domain: const = 0x2 (8 bytes)
// type: socket_type = 0x4000000000000001 (8 bytes)
// proto: int32 = 0x100 (4 bytes)
// ]
// returns sock_in
res = syscall(__NR_socket, /*domain=*/2ul, /*type=SOCK_STREAM|0x4000000000000000*/0x4000000000000001ul, /*proto=*/0x100);
if (res != -1)
r[1] = res;
// bind$inet arguments: [
// fd: sock_in (resource)
// addr: ptr[in, sockaddr_in] {
// sockaddr_in {
// family: const = 0x2 (2 bytes)
// port: int16be = 0x4e23 (2 bytes)
// addr: union ipv4_addr {
// broadcast: const = 0xffffffff (4 bytes)
// }
// pad = 0x0 (8 bytes)
// }
// }
// addrlen: len = 0x10 (8 bytes)
// ]
*(uint16_t*)0x20000000 = 2;
*(uint16_t*)0x20000002 = htobe16(0x4e23);
*(uint32_t*)0x20000004 = htobe32(-1);
syscall(__NR_bind, /*fd=*/r[1], /*addr=*/0x20000000ul, /*addrlen=*/0x10ul);
// sendto$inet arguments: [
// fd: sock_in (resource)
// buf: nil
// len: len = 0x0 (8 bytes)
// f: send_flags = 0x200007fd (8 bytes)
// addr: ptr[in, sockaddr_in] {
// sockaddr_in {
// family: const = 0x2 (2 bytes)
// port: int16be = 0x4e23 (2 bytes)
// addr: union ipv4_addr {
// dev: ipv4_addr_t[netdev_addr_id] {
// a0: const = 0xac (1 bytes)
// a1: const = 0x14 (1 bytes)
// a2: const = 0x14 (1 bytes)
// a3: int8 = 0x13 (1 bytes)
// }
// }
// pad = 0x0 (8 bytes)
// }
// }
// addrlen: len = 0x10 (8 bytes)
// ]
*(uint16_t*)0x20000040 = 2;
*(uint16_t*)0x20000042 = htobe16(0x4e23);
*(uint8_t*)0x20000044 = 0xac;
*(uint8_t*)0x20000045 = 0x14;
*(uint8_t*)0x20000046 = 0x14;
*(uint8_t*)0x20000047 = 0x13;
syscall(__NR_sendto, /*fd=*/r[1], /*buf=*/0ul, /*len=*/0ul, /*f=MSG_FASTOPEN|MSG_PROBE|MSG_OOB|MSG_EOR|MSG_DONTWAIT|MSG_DONTROUTE|0x728*/0x200007fdul, /*addr=*/0x20000040ul, /*addrlen=*/0x10ul);
// sendto$inet arguments: [
// fd: sock_in (resource)
// buf: ptr[in, buffer] {
// buffer: {0c 26 8a 92 7f 1f 65 88 b9 67 48 12 41 ba 78 60 0a 34 f6 5a c6 18 de d8 97 48 95 ab ea f4 b4 83 4f f9 59 bc ec c7 a9 54 25 a3 a0 7e 75 80 44 ab 4e a6 f7 c5 55 d8 8f ec f9 0b 03 75 11 bf 74 6b ec 66 ba} (length 0x43)
// }
// len: len = 0x994b6e03113064ae (8 bytes)
// f: send_flags = 0x0 (8 bytes)
// addr: nil
// addrlen: len = 0x0 (8 bytes)
// ]
memcpy((void*)0x20000700, "... [truncated large byte array] ...", 67);
syscall(__NR_sendto, /*fd=*/r[1], /*buf=*/0x20000700ul, /*len=*/0x994b6e03113064aeul, /*f=*/0ul, /*addr=*/0ul, /*addrlen=*/0ul);
return 0;
}
]