// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include const int kInitNetNsFd = 201; static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto) { return syscall(__NR_socket, domain, type, proto); } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // syz_init_net_socket$llc arguments: [ // domain: const = 0x1a (8 bytes) // type: llc_socket_type = 0x1 (8 bytes) // proto: const = 0x0 (8 bytes) // ] // returns sock_llc res = -1; res = syz_init_net_socket(/*domain=*/0x1a, /*type=SOCK_STREAM*/ 1, /*proto=*/0); if (res != -1) r[0] = res; // setsockopt$llc_int arguments: [ // fd: sock_llc (resource) // level: const = 0x10c (4 bytes) // optname: llc_option_types_int = 0x3 (4 bytes) // optval: ptr[in, int32] { // int32 = 0x0 (4 bytes) // } // optlen: len = 0x4 (8 bytes) // ] *(uint32_t*)0x200000000040 = 0; syscall(__NR_setsockopt, /*fd=*/r[0], /*level=*/0x10c, /*optname=LLC_OPT_ACK_TMR_EXP*/ 3, /*optval=*/0x200000000040ul, /*optlen=*/4ul); // connect$llc arguments: [ // fd: sock_llc (resource) // addr: ptr[in, sockaddr_llc] { // sockaddr_llc { // sllc_family: const = 0x1a (2 bytes) // sllc_arphrd: dev_type_arphdr = 0x1 (2 bytes) // sllc_test: int8 = 0xc0 (1 bytes) // sllc_xid: int8 = 0x1 (1 bytes) // sllc_ua: int8 = 0x3f (1 bytes) // sllc_sap: int8 = 0x0 (1 bytes) // sll_addr: union mac_addr { // remote: mac_addr_t[const[0xbb, int8]] { // a0: buffer: {aa aa aa aa aa} (length 0x5) // a1: const = 0xbb (1 bytes) // } // } // pad = 0x0 (2 bytes) // } // } // addrlen: len = 0x10 (8 bytes) // ] *(uint16_t*)0x2000000004c0 = 0x1a; *(uint16_t*)0x2000000004c2 = 1; *(uint8_t*)0x2000000004c4 = 0xc0; *(uint8_t*)0x2000000004c5 = 1; *(uint8_t*)0x2000000004c6 = 0x3f; *(uint8_t*)0x2000000004c7 = 0; memset((void*)0x2000000004c8, 170, 5); *(uint8_t*)0x2000000004cd = 0xbb; syscall(__NR_connect, /*fd=*/r[0], /*addr=*/0x2000000004c0ul, /*addrlen=*/0x10ul); return 0; }