// https://syzkaller.appspot.com/bug?id=6561688706743c11833ce829dee471a1a66929a9 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif static unsigned long long procid; static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i = 0; for (; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { int state; } event_t; static void event_init(event_t* ev) { ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { if (ev->state) exit(1); __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000); } static void event_wait(event_t* ev) { while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); } static int event_isset(event_t* ev) { return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; for (;;) { uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) return 1; now = current_time_ms(); if (now - start > timeout) return 0; } } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } //% This code is derived from puff.{c,h}, found in the zlib development. The //% original files come with the following copyright notice: //% Copyright (C) 2002-2013 Mark Adler, all rights reserved //% version 2.3, 21 Jan 2013 //% This software is provided 'as-is', without any express or implied //% warranty. In no event will the author be held liable for any damages //% arising from the use of this software. //% Permission is granted to anyone to use this software for any purpose, //% including commercial applications, and to alter it and redistribute it //% freely, subject to the following restrictions: //% 1. The origin of this software must not be misrepresented; you must not //% claim that you wrote the original software. If you use this software //% in a product, an acknowledgment in the product documentation would be //% appreciated but is not required. //% 2. Altered source versions must be plainly marked as such, and must not be //% misrepresented as being the original software. //% 3. This notice may not be removed or altered from any source distribution. //% Mark Adler madler@alumni.caltech.edu //% BEGIN CODE DERIVED FROM puff.{c,h} #define MAXBITS 15 #define MAXLCODES 286 #define MAXDCODES 30 #define MAXCODES (MAXLCODES + MAXDCODES) #define FIXLCODES 288 struct puff_state { unsigned char* out; unsigned long outlen; unsigned long outcnt; const unsigned char* in; unsigned long inlen; unsigned long incnt; int bitbuf; int bitcnt; jmp_buf env; }; static int puff_bits(struct puff_state* s, int need) { long val = s->bitbuf; while (s->bitcnt < need) { if (s->incnt == s->inlen) longjmp(s->env, 1); val |= (long)(s->in[s->incnt++]) << s->bitcnt; s->bitcnt += 8; } s->bitbuf = (int)(val >> need); s->bitcnt -= need; return (int)(val & ((1L << need) - 1)); } static int puff_stored(struct puff_state* s) { s->bitbuf = 0; s->bitcnt = 0; if (s->incnt + 4 > s->inlen) return 2; unsigned len = s->in[s->incnt++]; len |= s->in[s->incnt++] << 8; if (s->in[s->incnt++] != (~len & 0xff) || s->in[s->incnt++] != ((~len >> 8) & 0xff)) return -2; if (s->incnt + len > s->inlen) return 2; if (s->outcnt + len > s->outlen) return 1; for (; len--; s->outcnt++, s->incnt++) { if (s->in[s->incnt]) s->out[s->outcnt] = s->in[s->incnt]; } return 0; } struct puff_huffman { short* count; short* symbol; }; static int puff_decode(struct puff_state* s, const struct puff_huffman* h) { int first = 0; int index = 0; int bitbuf = s->bitbuf; int left = s->bitcnt; int code = first = index = 0; int len = 1; short* next = h->count + 1; while (1) { while (left--) { code |= bitbuf & 1; bitbuf >>= 1; int count = *next++; if (code - count < first) { s->bitbuf = bitbuf; s->bitcnt = (s->bitcnt - len) & 7; return h->symbol[index + (code - first)]; } index += count; first += count; first <<= 1; code <<= 1; len++; } left = (MAXBITS + 1) - len; if (left == 0) break; if (s->incnt == s->inlen) longjmp(s->env, 1); bitbuf = s->in[s->incnt++]; if (left > 8) left = 8; } return -10; } static int puff_construct(struct puff_huffman* h, const short* length, int n) { int len; for (len = 0; len <= MAXBITS; len++) h->count[len] = 0; int symbol; for (symbol = 0; symbol < n; symbol++) (h->count[length[symbol]])++; if (h->count[0] == n) return 0; int left = 1; for (len = 1; len <= MAXBITS; len++) { left <<= 1; left -= h->count[len]; if (left < 0) return left; } short offs[MAXBITS + 1]; offs[1] = 0; for (len = 1; len < MAXBITS; len++) offs[len + 1] = offs[len] + h->count[len]; for (symbol = 0; symbol < n; symbol++) if (length[symbol] != 0) h->symbol[offs[length[symbol]]++] = symbol; return left; } static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode, const struct puff_huffman* distcode) { static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; static const short dists[30] = { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577}; static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13}; int symbol; do { symbol = puff_decode(s, lencode); if (symbol < 0) return symbol; if (symbol < 256) { if (s->outcnt == s->outlen) return 1; if (symbol) s->out[s->outcnt] = symbol; s->outcnt++; } else if (symbol > 256) { symbol -= 257; if (symbol >= 29) return -10; int len = lens[symbol] + puff_bits(s, lext[symbol]); symbol = puff_decode(s, distcode); if (symbol < 0) return symbol; unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); if (dist > s->outcnt) return -11; if (s->outcnt + len > s->outlen) return 1; while (len--) { if (dist <= s->outcnt && s->out[s->outcnt - dist]) s->out[s->outcnt] = s->out[s->outcnt - dist]; s->outcnt++; } } } while (symbol != 256); return 0; } static int puff_fixed(struct puff_state* s) { static int virgin = 1; static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; static struct puff_huffman lencode, distcode; if (virgin) { lencode.count = lencnt; lencode.symbol = lensym; distcode.count = distcnt; distcode.symbol = distsym; short lengths[FIXLCODES]; int symbol; for (symbol = 0; symbol < 144; symbol++) lengths[symbol] = 8; for (; symbol < 256; symbol++) lengths[symbol] = 9; for (; symbol < 280; symbol++) lengths[symbol] = 7; for (; symbol < FIXLCODES; symbol++) lengths[symbol] = 8; puff_construct(&lencode, lengths, FIXLCODES); for (symbol = 0; symbol < MAXDCODES; symbol++) lengths[symbol] = 5; puff_construct(&distcode, lengths, MAXDCODES); virgin = 0; } return puff_codes(s, &lencode, &distcode); } static int puff_dynamic(struct puff_state* s) { static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; int nlen = puff_bits(s, 5) + 257; int ndist = puff_bits(s, 5) + 1; int ncode = puff_bits(s, 4) + 4; if (nlen > MAXLCODES || ndist > MAXDCODES) return -3; short lengths[MAXCODES]; int index; for (index = 0; index < ncode; index++) lengths[order[index]] = puff_bits(s, 3); for (; index < 19; index++) lengths[order[index]] = 0; short lencnt[MAXBITS + 1], lensym[MAXLCODES]; struct puff_huffman lencode = {lencnt, lensym}; int err = puff_construct(&lencode, lengths, 19); if (err != 0) return -4; index = 0; while (index < nlen + ndist) { int symbol; int len; symbol = puff_decode(s, &lencode); if (symbol < 0) return symbol; if (symbol < 16) lengths[index++] = symbol; else { len = 0; if (symbol == 16) { if (index == 0) return -5; len = lengths[index - 1]; symbol = 3 + puff_bits(s, 2); } else if (symbol == 17) symbol = 3 + puff_bits(s, 3); else symbol = 11 + puff_bits(s, 7); if (index + symbol > nlen + ndist) return -6; while (symbol--) lengths[index++] = len; } } if (lengths[256] == 0) return -9; err = puff_construct(&lencode, lengths, nlen); if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) return -7; short distcnt[MAXBITS + 1], distsym[MAXDCODES]; struct puff_huffman distcode = {distcnt, distsym}; err = puff_construct(&distcode, lengths + nlen, ndist); if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) return -8; return puff_codes(s, &lencode, &distcode); } static int puff(unsigned char* dest, unsigned long* destlen, const unsigned char* source, unsigned long sourcelen) { struct puff_state s = { .out = dest, .outlen = *destlen, .outcnt = 0, .in = source, .inlen = sourcelen, .incnt = 0, .bitbuf = 0, .bitcnt = 0, }; int err; if (setjmp(s.env) != 0) err = 2; else { int last; do { last = puff_bits(&s, 1); int type = puff_bits(&s, 2); err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); if (err != 0) break; } while (!last); } *destlen = s.outcnt; return err; } //% END CODE DERIVED FROM puff.{c,h} #define ZLIB_HEADER_WIDTH 2 static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) { if (sourcelen < ZLIB_HEADER_WIDTH) return 0; source += ZLIB_HEADER_WIDTH; sourcelen -= ZLIB_HEADER_WIDTH; const unsigned long max_destlen = 132 << 20; void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); if (ret == MAP_FAILED) return -1; unsigned char* dest = (unsigned char*)ret; unsigned long destlen = max_destlen; int err = puff(dest, &destlen, source, sourcelen); if (err) { munmap(dest, max_destlen); errno = -err; return -1; } if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { munmap(dest, max_destlen); return -1; } return munmap(dest, max_destlen); } static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) { int err = 0, loopfd = -1; int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (puff_zlib_to_file(data, size, memfd)) { err = errno; goto error_close_memfd; } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } close(memfd); *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static void reset_loop_device(const char* loopname) { int loopfd = open(loopname, O_RDWR); if (loopfd == -1) { return; } if (ioctl(loopfd, LOOP_CLR_FD, 0)) { } close(loopfd); } static long syz_mount_image(volatile long fsarg, volatile long dir, volatile long flags, volatile long optsarg, volatile long change_dir, volatile unsigned long size, volatile long image) { unsigned char* data = (unsigned char*)image; int res = -1, err = 0, need_loop_device = !!size; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { int loopfd; memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(data, size, loopname, &loopfd) == -1) return -1; close(loopfd); source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { bool has_remount_ro = false; char* remount_ro_start = strstr(opts, "errors=remount-ro"); if (remount_ro_start != NULL) { char after = *(remount_ro_start + strlen("errors=remount-ro")); char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); } if (strstr(opts, "errors=panic") || !has_remount_ro) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) { strcat(opts, ",errors=withdraw"); } res = mount(source, target, fs, flags, opts); if (res == -1) { err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; goto error_clear_loop; } if (change_dir) { res = chdir(target); if (res == -1) { err = errno; } } error_clear_loop: if (need_loop_device) reset_loop_device(loopname); errno = err; return res; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void reset_loop() { char buf[64]; snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); int loopfd = open(buf, O_RDWR); if (loopfd != -1) { ioctl(loopfd, LOOP_CLR_FD, 0); close(loopfd); } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } int i, call, thread; for (call = 0; call < 9; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 50 + (call == 0 ? 4000 : 0) + (call == 5 ? 4000 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { reset_loop(); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: // syz_mount_image$ext4 arguments: [ // fs: ptr[in, buffer] { // buffer: {65 78 74 34 00} (length 0x5) // } // dir: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 32 00} (length 0x8) // } // flags: mount_flags = 0x404 (8 bytes) // opts: ptr[in, fs_options[ext4_options]] { // fs_options[ext4_options] { // elems: array[fs_opt_elem[ext4_options]] { // fs_opt_elem[ext4_options] { // elem: union ext4_options { // max_batch_time: fs_opt["max_batch_time", fmt[hex, int32]] { // name: buffer: {6d 61 78 5f 62 61 74 63 68 5f 74 69 6d 65} // (length 0xe) eq: const = 0x3d (1 bytes) val: int32 = 0x4 // (18 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // max_batch_time: fs_opt["max_batch_time", fmt[hex, int32]] { // name: buffer: {6d 61 78 5f 62 61 74 63 68 5f 74 69 6d 65} // (length 0xe) eq: const = 0x3d (1 bytes) val: int32 = 0x2 // (18 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // debug_want_extra_isize: fs_opt["debug_want_extra_isize", // fmt[hex, int32]] { // name: buffer: {64 65 62 75 67 5f 77 61 6e 74 5f 65 78 74 // 72 61 5f 69 73 69 7a 65} (length 0x16) eq: const = 0x3d (1 // bytes) val: int32 = 0x6a (18 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // mb_optimize_scan: fs_opt["mb_optimize_scan", fmt[hex, // int32[0:1]]] { // name: buffer: {6d 62 5f 6f 70 74 69 6d 69 7a 65 5f 73 63 // 61 6e} (length 0x10) eq: const = 0x3d (1 bytes) val: int32 // = 0x1 (18 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // errors_remount: buffer: {65 72 72 6f 72 73 3d 72 65 6d 6f 75 // 6e 74 2d 72 6f} (length 0x11) // } // comma: const = 0x2c (1 bytes) // } // fs_opt_elem[ext4_options] { // elem: union ext4_options { // nombcache: buffer: {6e 6f 6d 62 63 61 63 68 65} (length 0x9) // } // comma: const = 0x2c (1 bytes) // } // } // common: array[fs_opt_elem[fs_options_common]] { // } // null: const = 0x0 (1 bytes) // } // } // chdir: int8 = 0x1 (1 bytes) // size: len = 0x437 (8 bytes) // img: ptr[in, buffer] { // buffer: (compressed buffer with length 0x437) // } // ] // returns fd_dir NONFAILING(memcpy((void*)0x200000000180, "ext4\000", 5)); NONFAILING(memcpy((void*)0x2000000001c0, "./file2\000", 8)); NONFAILING(memcpy((void*)0x200000000580, "max_batch_time", 14)); NONFAILING(*(uint8_t*)0x20000000058e = 0x3d); NONFAILING(sprintf((char*)0x20000000058f, "0x%016llx", (long long)4)); NONFAILING(*(uint8_t*)0x2000000005a1 = 0x2c); NONFAILING(memcpy((void*)0x2000000005a2, "max_batch_time", 14)); NONFAILING(*(uint8_t*)0x2000000005b0 = 0x3d); NONFAILING(sprintf((char*)0x2000000005b1, "0x%016llx", (long long)2)); NONFAILING(*(uint8_t*)0x2000000005c3 = 0x2c); NONFAILING(memcpy((void*)0x2000000005c4, "debug_want_extra_isize", 22)); NONFAILING(*(uint8_t*)0x2000000005da = 0x3d); NONFAILING(sprintf((char*)0x2000000005db, "0x%016llx", (long long)0x6a)); NONFAILING(*(uint8_t*)0x2000000005ed = 0x2c); NONFAILING(memcpy((void*)0x2000000005ee, "mb_optimize_scan", 16)); NONFAILING(*(uint8_t*)0x2000000005fe = 0x3d); NONFAILING(sprintf((char*)0x2000000005ff, "0x%016llx", (long long)1)); NONFAILING(*(uint8_t*)0x200000000611 = 0x2c); NONFAILING(memcpy((void*)0x200000000612, "errors=remount-ro", 17)); NONFAILING(*(uint8_t*)0x200000000623 = 0x2c); NONFAILING(memcpy((void*)0x200000000624, "nombcache", 9)); NONFAILING(*(uint8_t*)0x20000000062d = 0x2c); NONFAILING(*(uint8_t*)0x20000000062e = 0); NONFAILING(memcpy( (void*)0x200000000900, "\x78\x9c\xec\xdb\xcf\x4f\x1c\x55\x1c\x00\xf0\xef\xec\x42\x91\xfe\x10" "\x6c\xea\x8f\xd2\xaa\x68\x35\x12\x7f\x40\xa1\xb5\xf6\xe0\x45\xa3\x89" "\x07\x4d\x4c\xf4\x50\x8f\x08\xb4\xc1\x6e\x8b\x29\x98\xd8\x86\x28\x1a" "\x53\x8f\xa6\x89\x77\xe3\xd1\xc4\xbf\xc0\x93\x5e\x8c\x7a\x32\xf1\xaa" "\x77\xd3\xa4\x31\x5c\x5a\x3d\xad\x99\xdd\x19\xd8\x5d\x76\xb7\x40\x17" "\xb6\xba\x9f\x4f\x32\xf0\xde\xcc\x5b\xde\xfb\xee\xcc\xdb\x7d\x6f\x1e" "\x13\x40\xcf\x1a\x4d\x7f\x24\x11\xfb\x23\xe2\xf7\x88\x18\xaa\x66\xeb" "\x0b\x8c\x56\x7f\xdd\x5a\x5d\x9e\xf9\x7b\x75\x79\x26\x89\x72\xf9\xad" "\xbf\x92\x4a\xb9\x9b\xab\xcb\x33\x79\xd1\xfc\x75\xfb\xf2\x4c\x5f\x44" "\xe1\xb3\x24\x8e\x34\xa9\x77\xf1\xf2\x95\xf3\xd3\xa5\xd2\xdc\xa5\x2c" "\x3f\xb1\x74\xe1\xfd\x89\xc5\xcb\x57\x9e\x9b\xbf\x30\x7d\x6e\xee\xdc" "\xdc\xc5\xa9\xd3\xa7\x4f\x9e\x98\x7c\xe1\xd4\xd4\xf3\x1d\x89\x33\x8d" "\xeb\xe6\xc8\x47\x0b\x47\x0f\xbf\xf6\xce\xb5\x37\x66\xce\x5c\x7b\xf7" "\xe7\x6f\x93\x3c\xfe\x86\x38\x3a\x64\xb4\xdd\xc1\x27\xcb\xe5\x0e\x57" "\xd7\x5d\x07\x6a\xd2\x49\x5f\x17\x1b\xc2\x96\x14\xab\xdd\x34\xfa\x2b" "\xfd\x7f\x28\x8a\xb1\x7e\xf2\x86\xe2\xd5\x4f\xbb\xda\x38\x60\x47\x95" "\xcb\xe5\xf2\x03\xad\x0f\xaf\x94\x81\xff\xb1\x24\xba\xdd\x02\xa0\x3b" "\xf2\x2f\xfa\x74\xfe\x9b\x6f\xbb\x34\xf4\xb8\x2b\xdc\x78\xa9\x3a\x01" "\x4a\xe3\xbe\x95\x6d\xd5\x23\x7d\x51\xc8\xca\xf4\x37\xcc\x6f\x3b\x69" "\x34\x22\xce\xac\xfc\xf3\x55\xba\xc5\xce\xdc\x87\x00\x00\xa8\xf3\x7d" "\x3a\xfe\x79\xb6\xd9\xf8\xaf\x10\xb5\xf7\x85\xee\xcd\xd6\x50\x86\x23" "\xe2\xbe\x88\x38\x18\x11\xa7\x22\xe2\x50\x44\xdc\x1f\x51\x29\xfb\x60" "\x44\x3c\xd4\xac\x92\xa4\x75\xfd\x8d\x8b\x24\x1b\xc7\x3f\x85\xeb\xdb" "\x0e\x6e\x13\xd2\xf1\xdf\x8b\xd9\xda\x56\xfd\xf8\x2f\x1f\xfd\xc5\x70" "\x31\xcb\x1d\xa8\xc4\xdf\x9f\x9c\x9d\x2f\xcd\x1d\xcf\xde\x93\xb1\xe8" "\x1f\x48\xf3\x93\x6d\xea\xf8\xe1\x95\xdf\xbe\x68\x75\xac\x76\xfc\x97" "\x6e\x69\xfd\xf9\x58\x30\x6b\xc7\xf5\xbe\x81\xfa\xd7\xcc\x4e\x2f\x4d" "\xdf\x49\xcc\xb5\x6e\x7c\x12\x31\xd2\xd7\x2c\xfe\x64\x6d\x25\x20\x3d" "\x7d\x87\x23\x62\x64\x9b\x75\xcc\x3f\xfd\xcd\xd1\x56\xc7\x6e\x1f\x7f" "\x1b\x1d\x58\x67\x2a\x7f\x1d\xf1\x54\xf5\xfc\xaf\x44\x43\xfc\xb9\xa4" "\xfd\xfa\xe4\xc4\x3d\x51\x9a\x3b\x3e\x91\x5f\x15\x1b\xfd\xf2\xeb\xd5" "\x37\x5b\xd5\x7f\x47\xf1\x77\x40\x7a\xfe\xf7\x36\xbd\xfe\xd7\xe2\x1f" "\x4e\x6a\xd7\x6b\x17\xb7\x5e\xc7\xd5\x3f\x3e\x6f\x39\xa7\xd9\xee\xf5" "\xbf\x27\x79\xbb\x6e\xdf\x87\xd3\x4b\x4b\x97\x26\x23\xf6\x24\xaf\x57" "\x1b\x5d\xbb\x7f\xaa\xa1\xdc\xd4\x7a\xf9\x34\xfe\xb1\x63\xcd\xfb\xff" "\xc1\x58\x7f\x27\x8e\x44\x44\x7a\x11\x3f\x1c\x11\x8f\x44\xc4\xa3\x59" "\xdb\x1f\x8b\x88\xc7\x23\xe2\x58\x9b\xf8\x7f\x7a\xf9\x89\xf7\xb6\x17" "\xff\x40\x9b\xbf\xda\x19\x69\xfc\xb3\x5b\x3a\xff\xeb\x89\x3d\xd1\xb8" "\xa7\x79\xa2\x78\xfe\xc7\xef\xea\x2a\x1d\xde\x6c\xfc\x91\x9d\xff\x93" "\x95\xd4\x58\xb6\x67\x33\x9f\x7f\x9b\x69\xd7\xf6\xae\x66\x00\x00\x00" "\xf8\xef\x29\x44\xc4\xfe\x48\x0a\xe3\x6b\xe9\x42\x61\x7c\xbc\xfa\x3f" "\xfc\x87\x62\x6f\xa1\xb4\xb0\xb8\xf4\xcc\xd9\x85\x0f\x2e\xce\x56\x9f" "\x11\x18\x8e\xfe\x42\x7e\xa7\x6b\xa8\xe6\x7e\xe8\x64\x36\xad\xcf\xf3" "\x53\x0d\xf9\x13\xd9\x7d\xe3\x2f\x8b\x83\x95\xfc\xf8\xcc\x42\x69\xb6" "\xdb\xc1\x43\x8f\xdb\xd7\xa2\xff\xa7\xfe\x2c\x76\xbb\x75\xc0\x8e\xf3" "\xbc\x16\xf4\x2e\xfd\x1f\x7a\x97\xfe\x0f\xbd\x4b\xff\x87\xde\xd5\xa4" "\xff\x0f\x76\xa3\x1d\xc0\xee\x6b\xf6\xfd\xff\x71\x17\xda\x01\xec\xbe" "\x86\xfe\x6f\xd9\x0f\x7a\x88\xf9\x3f\xf4\x2e\xfd\x1f\x7a\x97\xfe\x0f" "\x3d\x69\x71\x30\x6e\xff\x90\xbc\x84\xc4\x86\x44\x14\xee\x8a\x66\x48" "\xec\x50\xa2\xdb\x9f\x4c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9d\xf1\x6f\x00" "\x00\x00\xff\xff\x3a\x52\xe6\xdd", 1079)); NONFAILING(syz_mount_image(/*fs=*/0x200000000180, /*dir=*/0x2000000001c0, /*flags=MS_NODEV|MS_NOATIME*/ 0x404, /*opts=*/0x200000000580, /*chdir=*/1, /*size=*/0x437, /*img=*/0x200000000900)); break; case 1: // quotactl$Q_QUOTAON arguments: [ // cmd: quota_cmd_quota_on = 0xffffffff80000201 (8 bytes) // special: ptr[in, blockdev_filename] { // union blockdev_filename { // loop: loop_filename { // prefix: buffer: {2f 64 65 76 2f 6c 6f 6f 70} (length 0x9) // id: proc = 0x0 (1 bytes) // z: const = 0x0 (1 bytes) // } // } // } // id: uid (resource) // addr: nil // ] NONFAILING(memcpy((void*)0x200000000180, "/dev/loop", 9)); NONFAILING(*(uint8_t*)0x200000000189 = 0x30 + procid * 1); NONFAILING(*(uint8_t*)0x20000000018a = 0); syscall(__NR_quotactl, /*cmd=Q_QUOTAON_GRP*/ 0xffffffff80000201ul, /*special=*/0x200000000180ul, /*id=*/0, /*addr=*/0ul); break; case 2: // mprotect arguments: [ // addr: VMA[0x3000] // len: len = 0x3000 (8 bytes) // prot: mmap_prot = 0x1 (8 bytes) // ] syscall(__NR_mprotect, /*addr=*/0x200000000000ul, /*len=*/0x3000ul, /*prot=PROT_READ*/ 1ul); break; case 3: // openat$cgroup_ro arguments: [ // fd: fd_cgroup (resource) // file: ptr[in, buffer] { // buffer: {6d 65 6d 6f 72 79 2e 63 75 72 72 65 6e 74 00} (length 0xf) // } // flags: const = 0x275a (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd NONFAILING(memcpy((void*)0x200000000180, "memory.current\000", 15)); res = syscall(__NR_openat, /*fd=*/(intptr_t)-1, /*file=*/0x200000000180ul, /*flags=*/0x275a, /*mode=*/0); if (res != -1) r[0] = res; break; case 4: // mmap arguments: [ // addr: VMA[0xb36000] // len: len = 0xb36000 (4 bytes) // prot: mmap_prot = 0xa (8 bytes) // flags: mmap_flags = 0x28011 (8 bytes) // fd: fd (resource) // offset: intptr = 0x0 (8 bytes) // ] syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000, /*prot=PROT_SEM|PROT_WRITE*/ 0xaul, /*flags=MAP_STACK|MAP_POPULATE|MAP_FIXED|MAP_SHARED*/ 0x28011ul, /*fd=*/r[0], /*offset=*/0ul); break; case 5: // syz_mount_image$vfat arguments: [ // fs: ptr[in, buffer] { // buffer: {76 66 61 74 00} (length 0x5) // } // dir: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // flags: mount_flags = 0x1010004 (8 bytes) // opts: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // union ANYUNION { // ANYRES16: ANYRES16 (resource) // } // union ANYUNION { // ANYBLOB: buffer: {91 3c 51 90 1b a1 45 0c 0a d5 a5 67 8b 97 f9 // 68 1d a4 3e bb 43 72 8a 32 39 0e a5 98 c0 94 7d 08 a2 7b 84 bc // 7e 41 d6 6a 27 eb 83 d0 5a 18 f2 31 2c 7b e4 e5 bf d7 d7 3e 65 // 4b 42 fd f8 d4 d7 8a 5f 47 1d f1 d7 38 9b 1e 8f 30 f5 14 75 eb // 05 b8 07 b9 f3 98 f4 60 86 77 a0 b0 78 42 55 18 d3 5b b9 17 0e // e4 99 ae 27 a7 18 71 1f b0 f2 a8 4d e4 59 54 47 09 24 e5 a1 8a // 87 9a 91 0a ac 97 50 32 dd 58 77 20 ac 8e 5d 87 70 21 65 9d b3 // ce 30 cc e1 77 49 5f a5 a1 cd ea ad 5e 1d 3e cf 28 db f5 da a2 // bd f6 51 85 87 0e 17} (length 0xa9) // } // union ANYUNION { // ANYRES8: ANYRES8 (resource) // } // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // union ANYUNION { // ANYRES64: ANYRES64 (resource) // } // union ANYUNION { // ANYRESDEC: ANYRES64 (resource) // } // } // } // chdir: int8 = 0x1 (1 bytes) // size: len = 0x304 (8 bytes) // img: ptr[in, buffer] { // buffer: (compressed buffer with length 0x304) // } // ] // returns fd_dir NONFAILING(memcpy((void*)0x200000000080, "vfat\000", 5)); NONFAILING(memcpy((void*)0x200000000480, "./file0\000", 8)); NONFAILING(*(uint32_t*)0x2000000000c0 = 0); NONFAILING(*(uint16_t*)0x2000000000c4 = -1); NONFAILING(memcpy( (void*)0x2000000000c6, "\x91\x3c\x51\x90\x1b\xa1\x45\x0c\x0a\xd5\xa5\x67\x8b\x97\xf9\x68\x1d" "\xa4\x3e\xbb\x43\x72\x8a\x32\x39\x0e\xa5\x98\xc0\x94\x7d\x08\xa2\x7b" "\x84\xbc\x7e\x41\xd6\x6a\x27\xeb\x83\xd0\x5a\x18\xf2\x31\x2c\x7b\xe4" "\xe5\xbf\xd7\xd7\x3e\x65\x4b\x42\xfd\xf8\xd4\xd7\x8a\x5f\x47\x1d\xf1" "\xd7\x38\x9b\x1e\x8f\x30\xf5\x14\x75\xeb\x05\xb8\x07\xb9\xf3\x98\xf4" "\x60\x86\x77\xa0\xb0\x78\x42\x55\x18\xd3\x5b\xb9\x17\x0e\xe4\x99\xae" "\x27\xa7\x18\x71\x1f\xb0\xf2\xa8\x4d\xe4\x59\x54\x47\x09\x24\xe5\xa1" "\x8a\x87\x9a\x91\x0a\xac\x97\x50\x32\xdd\x58\x77\x20\xac\x8e\x5d\x87" "\x70\x21\x65\x9d\xb3\xce\x30\xcc\xe1\x77\x49\x5f\xa5\xa1\xcd\xea\xad" "\x5e\x1d\x3e\xcf\x28\xdb\xf5\xda\xa2\xbd\xf6\x51\x85\x87\x0e\x17", 169)); NONFAILING(*(uint8_t*)0x20000000016f = 0); NONFAILING(*(uint32_t*)0x200000000170 = 0); NONFAILING(*(uint64_t*)0x200000000174 = -1); NONFAILING(sprintf((char*)0x20000000017c, "%020llu", (long long)0)); NONFAILING(memcpy( (void*)0x200000000bc0, "\x78\x9c\xec\xdc\xcf\x4f\x13\x69\x18\xc0\xf1\xa7\x3f\x28\x6d\x09\x94" "\xc3\x66\x37\xbb\xc9\x86\x77\x77\x2f\xeb\x65\x02\xd5\xb3\xd2\x18\x48" "\x8c\x4d\x24\x48\x8d\x3f\x12\x93\x01\xa6\xda\x74\x6c\x49\xa7\xc1\xd4" "\x18\x91\x93\x57\xe3\xcd\x7f\xc0\x03\xe1\xc8\x8d\x44\xf9\x07\xb8\x78" "\xd3\x8b\x17\x6f\x5c\x4c\x3c\xc8\xc1\x38\xa6\xd3\x19\x4a\xcb\x14\xa4" "\xb4\x94\x1f\xdf\x4f\x42\xe6\xe1\x7d\xde\x67\x3a\x6f\x5b\xc8\x33\x0d" "\x2f\x5b\xb7\x5f\x3e\xca\x67\x2d\x2d\xab\x97\x25\x18\x55\x12\x10\x11" "\xd9\x16\x19\x96\xa0\x78\x02\xee\x31\xe8\xc4\x11\xd9\xed\xb9\x5c\x18" "\xf8\xfa\xe1\xef\x9b\x77\xee\x5e\x4f\xa5\xd3\x13\xd3\x4a\x4d\xa6\x66" "\x2e\x26\x95\x52\x43\x23\x6f\x1f\x3f\x8d\xb9\xd3\xd6\xfb\x65\x73\xf8" "\xfe\xd6\x97\xe4\xe7\xcd\xdf\x37\xff\xdc\xfa\x31\xf3\x30\x67\xa9\x9c" "\xa5\x0a\xc5\xb2\xd2\xd5\x6c\xf1\x53\x59\x9f\x35\x0d\x35\x9f\xb3\xf2" "\x9a\x52\x53\xa6\xa1\x5b\x86\xca\x15\x2c\xa3\x54\xcb\x17\x6b\xf9\xac" "\x59\x5c\x58\xa8\x28\xbd\x30\x3f\x18\x5f\x28\x19\x96\xa5\xf4\x42\x45" "\xe5\x8d\x8a\x2a\x17\x55\xb9\x54\x51\xa1\x07\x7a\xae\xa0\x34\x4d\x53" "\x83\x71\xc1\x41\x32\x2b\xd3\xd3\x7a\xaa\xcd\xe2\xb9\x0e\x5f\x0c\xba" "\xa4\x54\x4a\xe9\x21\x11\x89\xed\xc9\x64\x56\x7a\x72\x41\x00\x00\xa0" "\xa7\x9a\xfb\xff\xa0\xa8\x4e\xf6\xff\xab\xff\x6e\x94\x07\x6e\xad\x0d" "\xb9\xfd\xff\x7a\xc4\xaf\xff\xbf\xf4\xb1\x76\xae\x86\xfe\x3f\x2a\x22" "\xbe\xfd\xbf\xf7\xf8\xbe\xfd\xbf\x7e\xb8\xfe\x7f\x6f\x47\x74\x4a\xd9" "\x76\x5b\x65\x47\xea\xff\x71\x32\x8c\x44\xf6\x0c\x05\xea\x61\x35\x59" "\x4a\xe9\x71\xf7\xe7\xd7\xb1\x7c\x6f\x75\xd4\x09\xe8\xff\x01\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x38\x0d\xb6" "\x6d\x3b\x61\xdb\x76\xc2\x3b\x7a\x5f\xfd\x22\x12\x75\x36\x96\xd4\xbe" "\xf7\x29\x0d\x89\xc8\x95\x1e\x5c\x32\x3a\xe8\x08\xaf\x3f\xce\x80\xfa" "\xc6\xbd\xf0\x90\x88\xf9\x62\x31\xb3\x98\xa9\x1d\xdd\x09\x1b\x22\x62" "\x3a\xaf\x7f\x42\xbe\x3b\xef\x07\x57\x35\xf6\x76\x1e\xa9\xaa\x61\x79" "\x67\x2e\xb9\xf5\x4b\x8b\x99\x90\x93\x49\x65\x25\x27\xa6\x18\x32\x26" "\x89\x3e\x69\xae\xb7\xed\xc9\x6b\xe9\x89\x31\x55\xd3\x58\xdf\x27\xf1" "\xdd\xf5\x49\x49\xc8\x6f\xfe\xf5\x49\xdf\xfa\x88\xfc\xff\xdf\xae\x7a" "\x4d\x12\xf2\x7e\x4e\x8a\x62\xca\xbc\xbb\x61\xce\xab\x7f\x36\xa6\xd4" "\xd5\x1b\xe9\xa6\xfa\x98\x33\x0f\x00\x00\x00\x00\x80\xb3\x40\x53\x3b" "\x7c\xef\xdf\x35\xad\x55\xbe\x56\xbf\x73\x7f\x3d\xda\xf4\xf9\x40\xa8" "\x7e\x7f\x3d\xea\x7b\x7f\x1e\x96\xbf\xc2\xbd\x5d\x3b\x00\x00\x00\x00" "\x00\xe7\x85\x55\x79\x92\xd7\x4d\xd3\x28\xed\x04\x83\x22\xd2\x38\x12" "\x93\xe6\x39\x9d\x0c\xc2\x5d\x3a\xb3\xb7\xc2\x5f\xad\xf2\xfe\x96\xa1" "\x7b\x2b\xdd\x27\xf0\x1e\xbc\x21\x15\x75\x07\x3b\xfe\xb4\x04\x0e\xf1" "\xb4\xb4\x08\x82\xd2\x4e\xd5\x48\x75\x35\xaa\x29\xf5\xcf\xb2\xcf\xda" "\xf7\x0b\xbc\x8f\x8d\x5a\xcd\x91\xa9\x71\x77\xe4\x75\xcb\x39\xdd\x09" "\xfe\x78\xf5\xe6\x5b\xe7\x4e\x78\x79\x2d\x7a\xc0\x4a\xdb\x0f\x42\xfb" "\xbf\x01\xfa\x8e\xe7\xb7\x0f\x00\x00\x00\x80\xe3\x54\x6f\xfa\xbd\x91" "\xf1\xde\x5e\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe7\xd0\x71\xfc\x77\xb4\x5e" "\xaf\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x38\x29\x7e\x06\x00" "\x00\xff\xff\xd9\xad\x02\xed", 772)); NONFAILING( syz_mount_image(/*fs=*/0x200000000080, /*dir=*/0x200000000480, /*flags=MS_POSIXACL|MS_STRICTATIME|MS_NODEV*/ 0x1010004, /*opts=*/0x2000000000c0, /*chdir=*/1, /*size=*/0x304, /*img=*/0x200000000bc0)); break; case 6: // openat$cgroup_ro arguments: [ // fd: fd_cgroup (resource) // file: ptr[in, buffer] { // buffer: {62 6c 6b 69 6f 2e 62 66 71 2e 69 6f 5f 73 65 72 76 69 63 65 // 5f 62 79 74 65 73 00} (length 0x1b) // } // flags: const = 0x275a (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd NONFAILING( memcpy((void*)0x200000000000, "blkio.bfq.io_service_bytes\000", 27)); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000000ul, /*flags=*/0x275a, /*mode=*/0); if (res != -1) r[1] = res; break; case 7: // write$binfmt_script arguments: [ // fd: fd_binfmt (resource) // data: ptr[in, binfmt_script] { // binfmt_script { // hdr: buffer: {23 21 20} (length 0x3) // bin: buffer: {} (length 0x0) // args: array[binfmt_script_arg] { // } // nl: const = 0xa (1 bytes) // data: buffer: {} (length 0x0) // } // } // len: bytesize = 0x208e24b (8 bytes) // ] NONFAILING(memcpy((void*)0x200000000040, "#! ", 3)); NONFAILING(*(uint8_t*)0x200000000043 = 0xa); syscall(__NR_write, /*fd=*/r[1], /*data=*/0x200000000040ul, /*len=*/0x208e24bul); break; case 8: // memfd_create arguments: [ // name: ptr[in, buffer] { // buffer: {2b 8b 8a 16 11 4f dd df 6b 28 46 99 df 92 d5 3e 6f 4a 02 75 // 9b af 61 ac 06 9c 26 f5 e3 6a fa 09 63 71 4d b8 52 86 d9 d2 2e 9f 12 // ed 10 0c bd 1a 7c 8a bb da 84 09 00 00 00 00 00 00 c0 b5 df 9a 8d db // 2c 6e ae 0e 54 80 8c fd d7 b0 94 82 74 96 0d 4b 78 c5 9b 8c 87 96 8b // 63 bc ee cc 9f e3 46 99 56 34 8e 3b 4d a9 82 33 e3 b3 6d 47 8f db ed // 1b 05 ec fc d1 b5 fd ec 40 de 55 dd a4 c1 e4 4c 29 8e e5 91 8e d4 89 // ef 95 54 05 47 ac b8 c1 3a 20 29 6d 68 c7 f1 3f bb 13 3b ad 95 d7 38 // b6 0e 7f 84 72 0e bf c5 f6 d4 dd 09 14 02 00 00 00 69 93 03 d2 f2 08 // 4b 22 d2 b5 aa b8 c8 e0 ac 99 e8 73 75 cd c3 45 12 d7 dd 96 21 16 54 // 75 e3 f0 84 23 52 d9 e3 7e 57 6a b0 72 87 27 ea 07 cf 4f 65 4b 9d 61 // 57 f4 87 40 9c f3 f1 4b 00 00 00 00 00 01 00 00 00 00 00 00 00 db c2 // a5 68 27 df 49 6e 97 02 36 33 7e eb be 28 69 0a c2 6b 34 7f 12 a9 65 // 60 53 4f 73 8c b4 e7 46 65 51 c6 24 92 6a 5f 55 fa 08 ea b0 62 59 6b // 57 c0 05 07 43 7b cc 03 54 17 a5 53 6b 87 50 c2 97 44 b2 fa 1b 9f 65 // f4 10 1a ad 92 ce 88 1b bc e1 34 19 aa d3 0d f4 a2 c3 9e 3d a0 20 e6 // 6a e5 85 f8 97 03 15 aa 92 30 dc 72 49 d8 08 fb c7 e7 78 58 7b 3e 64 // bb a7 31 ad 9a fb e6 13 87 93 5c e5 57 2d fc fd b8 4f b9 6a b8 f2 9d // 78 b2 86 ad 92 1a 2b d4 a6 99 d8 96 00 fe fc 54 0c e9 e6 89 06 a3 c1 // ea c5 9f 77 75 0b de 47 4d d1 61 f0 1e ec f9 f3 58 ec 22 60 b1 69 42 // fb 38 4b 43 f0 b0 ff e4 00 f1 10 d5 15 f5 3c 5a 94 6a eb dd b1 36 66 // 25 d0 83 cd f7 52 c9 d5 79 b7 e6 90 61 cf f3 91 73 02 d1 80 b7 a9 c3 // ec f4 d1 a9 19 51 de 73 9a c4 bb 0a 3a 14 b8 6e 51 c0 e7 65 de 89 e5 // 30 9f 5a fd 63 f1 ac f1 54 75 f0 83 6d 59 0f a0 f3 96 ef 17 c7 cd a2 // d2 09 77 ff d0 b2 5b 3d f8 d3 9b 4a b3 27 ae 1d cc e2 4e 71 11 a8 3e // 36 01 ff f5 cf ea 4a 64 44 25 62 aa 41 4b 5b db 67 ef a9 e9 a4 cf 8c // 99 7c a2 57 f4 03 86 26 88 b8 e8 25 3e 64 dc 9a f2 aa 6b 46 be 3a b4 // b2 3d df 7f 73 06 9d 1f 8d 78 de 8c 09 89 fe 09 7c 7d ef 72 2a b6 d5 // dd 6d 13 85 50 a5 6f 0d 05 f7 48 9a dd c1 63 b3 b0 8f 00 7c 5f cb 57 // f7 7b 4d eb 44 da 33 b8 5e cf e0 e3 df a3 df 86 9e e9 43 0e 72 00 00 // 00 00} (length 0x29a) // } // flags: memfd_flags = 0x0 (8 bytes) // ] // returns fd_memfd NONFAILING(memcpy( (void*)0x200000000300, "+\213\212\026\021O\335\337k(F\231\337\222\325>" "oJ\002u\233\257a\254\006\234&\365\343j\372\tcqM\270R\206\331\322." "\237\022\355\020\f\275\032|" "\212\273\332\204\t\000\000\000\000\000\000\300\265\337\232\215\333," "n\256\016T\200\214\375\327\260\224\202t\226\rKx\305\233\214\207\226" "\213c\274\356\314\237\343F\231V4\216;" "M\251\2023\343\263mG\217\333\355\033\005\354\374\321\265\375\354@" "\336U\335\244\301\344L)" "\216\345\221\216\324\211\357\225T\005G\254\270\301: " ")mh\307\361?\273\023;" "\255\225\3278\266\016\177\204r\016\277\305\366\324\335\t\024\002\000" "\000\000i\223\003\322\362\bK\"\322\265\252\270\310\340\254\231\350su" "\315\303E\022\327\335\226!\026Tu\343\360\204#R\331\343~" "Wj\260r\207\'\352\a\317OeK\235aW\364\207@" "\234\363\361K\000\000\000\000\000\001\000\000\000\000\000\000\000\333" "\302\245h\'\337In\227\00263~\353\276(i\n\302k4\177\022\251e`" "SOs\214\264\347FeQ\306$\222j_U\372\b\352\260bYkW\300\005\aC{" "\314\003T\027\245Sk\207P\302\227D\262\372\033\237e\364\020\032\255\222" "\316\210\033\274\3414\031\252\323\r\364\242\303\236=\240 " "\346j\345\205\370\227\003\025\252\2220\334rI\330\b\373\307\347xX{>" "d\273\2471\255\232\373\346\023\207\223\\\345W-" "\374\375\270O\271j\270\362\235x\262\206\255\222\032+" "\324\246\231\330\226\000\376\374T\f\351\346\211\006\243\301\352\305" "\237wu\v\336GM\321a\360\036\354\371\363X\354\"`" "\261iB\3738KC\360\260\377\344\000\361\020\325\025\365<" "Z\224j\353\335\2616f%" "\320\203\315\367R\311\325y\267\346\220a\317\363\221s\002\321\200\267" "\251\303\354\364\321\251\031Q\336s\232\304\273\n:" "\024\270nQ\300\347e\336\211\3450\237Z\375c\361\254\361Tu\360\203mY\017" "\240\363\226\357\027\307\315\242\322\tw\377\320\262[=" "\370\323\233J\263\'\256\035\314\342Nq\021\250>" "6\001\377\365\317\352JdD%b\252AK[\333g\357\251\351\244\317\214\231|" "\242W\364\003\206&\210\270\350%>d\334\232\362\252kF\276:\264\262=" "\337\177s\006\235\037\215x\336\214\t\211\376\t|}\357r*" "\266\325\335m\023\205P\245o\r\005\367H\232\335\301c\263\260\217\000|_" "\313W\367{M\353D\3323\270^" "\317\340\343\337\243\337\206\236\351C\016r\000\000\000\000", 666)); syscall(__NR_memfd_create, /*name=*/0x200000000300ul, /*flags=*/0ul); break; } } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; install_segv_handler(); for (procid = 0; procid < 5; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; }