// https://syzkaller.appspot.com/bug?id=33458d923ef73cc4433972a99c8f67eecc5acf1f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0x0}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // openat$dm_control arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2f 64 65 76 2f 6d 61 70 70 65 72 2f 63 6f 6e 74 72 6f 6c 00} // (length 0x14) // } // flags: open_flags = 0x2 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_dm_ctl memcpy((void*)0x200000000240, "/dev/mapper/control\000", 20); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000240ul, /*flags=O_RDWR*/ 2, /*mode=*/0); if (res != -1) r[0] = res; // ioctl$DM_DEV_CREATE arguments: [ // fd: fd_dm_ctl (resource) // cmd: const = 0xc138fd03 (4 bytes) // arg: ptr[inout, dm_ioctl_t[dm_id_create, void, const[0, int32], const[0, // int32]]] { // dm_ioctl_t[dm_id_create, void, const[0, int32], const[0, int32]] { // version_major: const = 0x4 (4 bytes) // version_minor: const = 0x0 (4 bytes) // version_patch: const = 0x0 (4 bytes) // data_size: bytesize = 0x138 (4 bytes) // data_start: offsetof = 0x138 (4 bytes) // target_count: const = 0x0 (4 bytes) // open_count: const = 0x0 (4 bytes) // flags: dm_ioctl_flags = 0x0 (4 bytes) // event_nr: const = 0x0 (4 bytes) // padding: const = 0x0 (4 bytes) // id: dm_id_create { // dev: dm_dev_number (resource) // name: dm_dev_name { // prefix: buffer: {73 79 7a} (length 0x3) // proc: proc = 0x0 (1 bytes) // slot: buffer: {32 00} (length 0x2) // pad = 0x0 (122 bytes) // } // uuid: union dm_dev_uuid_opt { // none: const = 0x0 (1 bytes) // } // } // data: buffer: {} (length 0x0) // } // } // ] *(uint32_t*)0x2000000003c0 = 4; *(uint32_t*)0x2000000003c4 = 0; *(uint32_t*)0x2000000003c8 = 0; *(uint32_t*)0x2000000003cc = 0x138; *(uint32_t*)0x2000000003d0 = 0x138; *(uint32_t*)0x2000000003d4 = 0; *(uint32_t*)0x2000000003d8 = 0; *(uint32_t*)0x2000000003dc = 0; *(uint32_t*)0x2000000003e0 = 0; *(uint32_t*)0x2000000003e4 = 0; memcpy((void*)0x2000000003f0, "syz", 3); *(uint8_t*)0x2000000003f3 = 0x61; memcpy((void*)0x2000000003f4, "2\000", 2); *(uint8_t*)0x200000000470 = 0; res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc138fd03, /*arg=*/0x2000000003c0ul); if (res != -1) r[1] = *(uint64_t*)0x2000000003e8; // ioctl$DM_TABLE_LOAD arguments: [ // fd: fd_dm_ctl (resource) // cmd: const = 0xc138fd09 (4 bytes) // arg: ptr[inout, dm_ioctl_t[dm_id_lookup, array[dm_target, 1], len[data, // int32], const[0, int32]]] { // dm_ioctl_t[dm_id_lookup, array[dm_target, 1], len[data, int32], // const[0, int32]] { // version_major: const = 0x4 (4 bytes) // version_minor: const = 0x0 (4 bytes) // version_patch: const = 0x0 (4 bytes) // data_size: bytesize = 0x1b8 (4 bytes) // data_start: offsetof = 0x138 (4 bytes) // target_count: len = 0x1 (4 bytes) // open_count: const = 0x0 (4 bytes) // flags: dm_ioctl_flags = 0x80000 (4 bytes) // event_nr: const = 0x0 (4 bytes) // padding: const = 0x0 (4 bytes) // id: union dm_id_lookup { // by_dev: dm_id_by_dev { // dev: dm_dev_number (resource) // pad = 0x0 (264 bytes) // } // } // data: array[dm_target] { // union dm_target { // snapshot: dm_target_spec_t[dm_target_snapshot, // dm_snapshot_params] { // sector_start: const = 0x0 (8 bytes) // length: dm_lengths = 0x440 (8 bytes) // status: const = 0x0 (4 bytes) // next: bytesize = 0x80 (4 bytes) // target_type: buffer: {73 6e 61 70 73 68 6f 74 00 00 00 00 00 // 00 00 00} (length 0x10) params: dm_snapshot_params { // origin: union dm_dev { // ram_num: dm_ram_num { // major: buffer: {31 3a} (length 0x2) // minor: proc = 0x0 (20 bytes) // } // } // sp0: const = 0x20 (1 bytes) // cow: union dm_dev { // ram: dm_dev_proc_t["/dev/ram", 2] { // prefix: buffer: {2f 64 65 76 2f 72 61 6d} (length 0x8) // id: proc = 0x0 (1 bytes) // } // } // sp1: const = 0x20 (1 bytes) // pers: buffer: {4e} (length 0x1) // sp2: const = 0x20 (1 bytes) // chunk: buffer: {33 32} (length 0x2) // feat: buffer: {20 32 20 64 69 73 63 61 72 64 5f 7a 65 72 6f // 65 73 5f 63 6f 77 20 64 69 73 63 61 72 64 5f 70 61 73 73 64 // 6f 77 6e 5f 6f 72 69 67 69 6e} (length 0x2d) // } // z: const = 0x0 (1 bytes) // } // } // } // } // } // ] *(uint32_t*)0x200000000500 = 4; *(uint32_t*)0x200000000504 = 0; *(uint32_t*)0x200000000508 = 0; *(uint32_t*)0x20000000050c = 0x1b8; *(uint32_t*)0x200000000510 = 0x138; *(uint32_t*)0x200000000514 = 1; *(uint32_t*)0x200000000518 = 0; *(uint32_t*)0x20000000051c = 0x80000; *(uint32_t*)0x200000000520 = 0; *(uint32_t*)0x200000000524 = 0; *(uint64_t*)0x200000000528 = r[1]; *(uint64_t*)0x200000000638 = 0; *(uint64_t*)0x200000000640 = 0x440; *(uint32_t*)0x200000000648 = 0; *(uint32_t*)0x20000000064c = 0x80; memcpy((void*)0x200000000650, "snapshot\000\000\000\000\000\000\000\000", 16); memcpy((void*)0x200000000660, "1:", 2); sprintf((char*)0x200000000662, "%020llu", (long long)0); *(uint8_t*)0x200000000676 = 0x20; memcpy((void*)0x200000000677, "/dev/ram", 8); *(uint8_t*)0x20000000067f = 0x30; *(uint8_t*)0x200000000680 = 0x20; memset((void*)0x200000000681, 78, 1); *(uint8_t*)0x200000000682 = 0x20; memcpy((void*)0x200000000683, "32", 2); memcpy((void*)0x200000000685, " 2 discard_zeroes_cow discard_passdown_origin", 45); *(uint8_t*)0x2000000006b2 = 0; syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc138fd09, /*arg=*/0x200000000500ul); return 0; }