// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[3] = {0xffffffffffffffff, 0x0, 0x0}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$nl_route arguments: [ // domain: const = 0x10 (8 bytes) // type: const = 0x3 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_nl_route res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0); if (res != -1) r[0] = res; // ioctl$sock_SIOCGIFINDEX arguments: [ // fd: sock (resource) // cmd: const = 0x8933 (4 bytes) // arg: ptr[out, ifreq_dev_t[devnames, ifindex]] { // ifreq_dev_t[devnames, ifindex] { // ifr_ifrn: buffer: {62 6f 6e 64 30 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) elem: ifindex (resource) pad = 0x0 (20 bytes) // } // } // ] memcpy((void*)0x200000000200, "bond0\000\000\000\000\000\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000200ul); if (res != -1) r[1] = *(uint32_t*)0x200000000210; // ioctl$sock_SIOCGIFINDEX arguments: [ // fd: sock (resource) // cmd: const = 0x8933 (4 bytes) // arg: ptr[out, ifreq_dev_t[devnames, ifindex]] { // ifreq_dev_t[devnames, ifindex] { // ifr_ifrn: buffer: {64 75 6d 6d 79 30 00 00 00 00 00 00 00 00 00 00} // (length 0x10) elem: ifindex (resource) pad = 0x0 (20 bytes) // } // } // ] memcpy((void*)0x200000000000, "dummy0\000\000\000\000\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000000ul); if (res != -1) r[2] = *(uint32_t*)0x200000000010; // sendmsg$nl_route arguments: [ // fd: sock_nl_route (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_route]] { // msghdr_netlink[netlink_msg_route] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_route]] { // iovec[in, netlink_msg_route] { // addr: ptr[in, netlink_msg_route] { // union netlink_msg_route { // newlink: netlink_msg_t[const[RTM_NEWLINK, int16], // ifinfomsg[AF_UNSPEC], ifla_policy] { // len: len = 0x40 (4 bytes) // type: const = 0x10 (2 bytes) // flags: netlink_msg_flags = 0x401 (2 bytes) // seq: int32 = 0x0 (4 bytes) // pid: int32 = 0x0 (4 bytes) // payload: ifinfomsg[AF_UNSPEC] { // ifi_family: const = 0x0 (1 bytes) // __ifi_pad: const = 0x0 (1 bytes) // ifi_type: const = 0x0 (2 bytes) // ifi_index: ifindex (resource) // ifi_flags: net_device_flags = 0x44f81 (4 bytes) // ifi_change: net_device_flags = 0x0 (4 bytes) // } // attrs: array[ifla_policy] { // union ifla_policy { // IFLA_LINKINFO: nlattr_tt[const[IFLA_LINKINFO, // int16:14], 0, 1, ifla_info_policy] { // nla_len: offsetof = 0x20 (2 bytes) // nla_type: const = 0x12 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: union ifla_info_policy { // hsr: ifla_info_policy$t["hsr", IFLA_INFO_DATA, // array[hsr_policy]] { // IFLA_INFO_KIND: nlattr_t[const[IFLA_INFO_KIND, // int16], string["hsr"]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {68 73 72 00} (length 0x4) // size: buffer: {} (length 0x0) // } // IFLA_INFO_DATA: nlattr_tt[const[IFLA_INFO_DATA, // int16:14], 0, 1, array[hsr_policy]] { // nla_len: offsetof = 0x14 (2 bytes) // nla_type: const = 0x2 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[hsr_policy] { // union hsr_policy { // IFLA_HSR_SLAVE2: // nlattr_t[const[IFLA_HSR_SLAVE2, int16], // ifindex] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: ifindex (resource) // size: buffer: {} (length 0x0) // } // } // union hsr_policy { // IFLA_HSR_SLAVE1: // nlattr_t[const[IFLA_HSR_SLAVE1, int16], // ifindex] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: ifindex (resource) // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // } // } // } // len: len = 0x40 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x40000 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x80c0 (8 bytes) // ] *(uint64_t*)0x2000000002c0 = 0; *(uint32_t*)0x2000000002c8 = 0; *(uint64_t*)0x2000000002d0 = 0x200000000040; *(uint64_t*)0x200000000040 = 0x200000000300; *(uint32_t*)0x200000000300 = 0x40; *(uint16_t*)0x200000000304 = 0x10; *(uint16_t*)0x200000000306 = 0x401; *(uint32_t*)0x200000000308 = 0; *(uint32_t*)0x20000000030c = 0; *(uint8_t*)0x200000000310 = 0; *(uint8_t*)0x200000000311 = 0; *(uint16_t*)0x200000000312 = 0; *(uint32_t*)0x200000000314 = 0; *(uint32_t*)0x200000000318 = 0x44f81; *(uint32_t*)0x20000000031c = 0; *(uint16_t*)0x200000000320 = 0x20; STORE_BY_BITMASK(uint16_t, , 0x200000000322, 0x12, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000323, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000323, 1, 7, 1); *(uint16_t*)0x200000000324 = 8; *(uint16_t*)0x200000000326 = 1; memcpy((void*)0x200000000328, "hsr\000", 4); *(uint16_t*)0x20000000032c = 0x14; STORE_BY_BITMASK(uint16_t, , 0x20000000032e, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000000032f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000000032f, 1, 7, 1); *(uint16_t*)0x200000000330 = 8; *(uint16_t*)0x200000000332 = 2; *(uint32_t*)0x200000000334 = r[2]; *(uint16_t*)0x200000000338 = 8; *(uint16_t*)0x20000000033a = 1; *(uint32_t*)0x20000000033c = r[1]; *(uint64_t*)0x200000000048 = 0x40; *(uint64_t*)0x2000000002d8 = 1; *(uint64_t*)0x2000000002e0 = 0; *(uint64_t*)0x2000000002e8 = 0; *(uint32_t*)0x2000000002f0 = 0x40000; syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x2000000002c0ul, /*f=MSG_MORE|MSG_EOR|MSG_DONTWAIT*/ 0x80c0ul); return 0; }