// https://syzkaller.appspot.com/bug?id=b36854b47dcb827d45fda42ecc3c2a187b70bbef // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // mode: open_mode = 0x1c0 (8 bytes) // ] memcpy((void*)0x200000000180, "./file0\000", 8); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000180ul, /*mode=S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1c0ul); // mount$incfs arguments: [ // src: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // dst: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // type: ptr[in, buffer] { // buffer: {69 6e 63 72 65 6d 65 6e 74 61 6c 2d 66 73 00} (length 0xf) // } // flags: mount_flags = 0x80 (8 bytes) // opts: nil // ] memcpy((void*)0x200000000440, "./file0\000", 8); memcpy((void*)0x200000000140, "./file0\000", 8); memcpy((void*)0x200000000200, "incremental-fs\000", 15); syscall(__NR_mount, /*src=*/0x200000000440ul, /*dst=*/0x200000000140ul, /*type=*/0x200000000200ul, /*flags=MS_DIRSYNC*/ 0x80ul, /*opts=*/0ul); // openat arguments: [ // fd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // flags: open_flags = 0xc2c02e4d8eb3a414 (4 bytes) // mode: open_mode = 0x4 (2 bytes) // ] // returns fd memcpy((void*)0x200000000000, "./file0\000", 8); res = syscall( __NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000000ul, /*flags=O_PATH|O_NOFOLLOW|O_LARGEFILE|O_DIRECTORY|FASYNC|0x8e900414*/ 0x8eb3a414, /*mode=S_IROTH*/ 4); if (res != -1) r[0] = res; // openat$incfs arguments: [ // fd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 70 65 6e 64 69 6e 67 5f 72 65 61 64 73 00} (length 0xf) // } // flags: open_flags = 0x1 (4 bytes) // mode: open_mode = 0x130 (2 bytes) // ] // returns fd memcpy((void*)0x200000000280, ".pending_reads\000", 15); res = syscall(__NR_openat, /*fd=*/r[0], /*file=*/0x200000000280ul, /*flags=O_WRONLY*/ 1, /*mode=S_IWGRP|S_IRGRP|S_IRUSR*/ 0x130); if (res != -1) r[1] = res; // setsockopt$inet_buf arguments: [ // fd: sock_in (resource) // level: const = 0x0 (4 bytes) // optname: inet_option_types_buf = 0x8008000000010 (4 bytes) // optval: ptr[in, buffer] { // buffer: {17 00 00 00 02 00 01 04 00 ff be 8c 5e e1 76 88 a2 00 32 e8 // 01 01 00 0a 00 00 02 a2 57 fc 5a d9 02 00 bb 6a 88 00 00 d6 c8 db 00 // 00 00 df 01 80 02 00 00 00 fc 06 07 bd ff 59 10 0a c4 57 61 54 7a 68 // 1f 00 9c ee 4a 5a cb 3d a4 00 00 1f b7 00 67 4f 00 c8 8e bb f9 31 50 // 33 bf 79 ac 2d fc 06 01 15 00 39 01 00 00 00 00 00 00 ea ff ff 00 00 // 00 00 00 00 62 06 8f 5e e5 0c e5 af 9b 1c 56 83 ff ff ff 02 ff 03 00 // 00 ba 00 08 40 02 4f 02 98 e9 e9 05 39 06 2a 80 e6 05 00 7f 71 17 4a // a9 51 f3 c6 3e 5a 1b 47 b6 3a 63 23 de d2 23 14 54 66 84 92 f9 c6 81 // a6 a9 fc} (length 0xb8) // } // optlen: len = 0xb8 (8 bytes) // ] memcpy((void*)0x2000000000c0, "\x17\x00\x00\x00\x02\x00\x01\x04\x00\xff\xbe\x8c\x5e\xe1\x76\x88\xa2" "\x00\x32\xe8\x01\x01\x00\x0a\x00\x00\x02\xa2\x57\xfc\x5a\xd9\x02\x00" "\xbb\x6a\x88\x00\x00\xd6\xc8\xdb\x00\x00\x00\xdf\x01\x80\x02\x00\x00" "\x00\xfc\x06\x07\xbd\xff\x59\x10\x0a\xc4\x57\x61\x54\x7a\x68\x1f\x00" "\x9c\xee\x4a\x5a\xcb\x3d\xa4\x00\x00\x1f\xb7\x00\x67\x4f\x00\xc8\x8e" "\xbb\xf9\x31\x50\x33\xbf\x79\xac\x2d\xfc\x06\x01\x15\x00\x39\x01\x00" "\x00\x00\x00\x00\x00\xea\xff\xff\x00\x00\x00\x00\x00\x00\x62\x06\x8f" "\x5e\xe5\x0c\xe5\xaf\x9b\x1c\x56\x83\xff\xff\xff\x02\xff\x03\x00\x00" "\xba\x00\x08\x40\x02\x4f\x02\x98\xe9\xe9\x05\x39\x06\x2a\x80\xe6\x05" "\x00\x7f\x71\x17\x4a\xa9\x51\xf3\xc6\x3e\x5a\x1b\x47\xb6\x3a\x63\x23" "\xde\xd2\x23\x14\x54\x66\x84\x92\xf9\xc6\x81\xa6\xa9\xfc", 184); syscall(__NR_setsockopt, /*fd=*/(intptr_t)-1, /*level=*/0, /*optname=IP_IPSEC_POLICY*/ 0x10, /*optval=*/0x2000000000c0ul, /*optlen=*/0xb8ul); // ioctl$TIOCL_GETKMSGREDIRECT arguments: [ // fd: fd_tty (resource) // cmd: const = 0x40106726 (4 bytes) // arg: ptr[in, const[17, const]] { // const = 0x11 (1 bytes) // } // ] *(uint8_t*)0x2000000000c0 = 0x11; syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x40106726, /*arg=*/0x2000000000c0ul); return 0; }