// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // sendmsg$nl_generic arguments: [ // fd: sock_nl_generic (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_t[netlink_random_msg_type, // genlmsghdr, nl_generic_attr]]] { // msghdr_netlink[netlink_msg_t[netlink_random_msg_type, genlmsghdr, // nl_generic_attr]] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: nil // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x4048957 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x48050 (8 bytes) // ] *(uint64_t*)0x200000000180 = 0; *(uint32_t*)0x200000000188 = 0; *(uint64_t*)0x200000000190 = 0; *(uint64_t*)0x200000000198 = 1; *(uint64_t*)0x2000000001a0 = 0; *(uint64_t*)0x2000000001a8 = 0; *(uint32_t*)0x2000000001b0 = 0x4048957; syscall(__NR_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0x200000000180ul, /*f=MSG_BATCH|MSG_PROBE|MSG_MORE|MSG_DONTWAIT*/ 0x48050ul); // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0xe (4 bytes) // ninsn: bytesize8 = 0x4 (4 bytes) // insns: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {18 00 00 00 01 00 00 00 00 00 00 00 00 00 00 // 00 a5 00 00 00 a0 00 00 00 95} (length 0x19) // } // } // } // license: ptr[in, buffer] { // buffer: {47 50 4c 00} (length 0x4) // } // loglev: int32 = 0x0 (4 bytes) // logsize: len = 0x0 (4 bytes) // log: nil // kern_version: bpf_kern_version = 0x0 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // sk_skb: sk_skb_attach_types = 0x0 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x0 (4 bytes) // func_info: nil // func_info_cnt: len = 0x0 (4 bytes) // line_info_rec_size: const = 0x0 (4 bytes) // line_info: nil // line_info_cnt: len = 0x0 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x10 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0xb9 (8 bytes) // ] // returns fd_bpf_prog *(uint32_t*)0x200000000100 = 0xe; *(uint32_t*)0x200000000104 = 4; *(uint64_t*)0x200000000108 = 0x200000000200; memcpy((void*)0x200000000200, "\x18\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa5" "\x00\x00\x00\xa0\x00\x00\x00\x95", 25); *(uint64_t*)0x200000000110 = 0x2000000001c0; memcpy((void*)0x2000000001c0, "GPL\000", 4); *(uint32_t*)0x200000000118 = 0; *(uint32_t*)0x20000000011c = 0; *(uint64_t*)0x200000000120 = 0; *(uint32_t*)0x200000000128 = 0; *(uint32_t*)0x20000000012c = 0; memset((void*)0x200000000130, 0, 16); *(uint32_t*)0x200000000140 = 0; *(uint32_t*)0x200000000144 = 0; *(uint32_t*)0x200000000148 = 0; *(uint32_t*)0x20000000014c = 0; *(uint64_t*)0x200000000150 = 0; *(uint32_t*)0x200000000158 = 0; *(uint32_t*)0x20000000015c = 0; *(uint64_t*)0x200000000160 = 0; *(uint32_t*)0x200000000168 = 0; *(uint32_t*)0x20000000016c = 0; *(uint32_t*)0x200000000170 = 0; *(uint32_t*)0x200000000174 = 0; *(uint64_t*)0x200000000178 = 0; *(uint64_t*)0x200000000180 = 0; *(uint32_t*)0x200000000188 = 0x10; *(uint32_t*)0x20000000018c = 0; *(uint32_t*)0x200000000190 = 0; syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000100ul, /*size=*/0xb9ul); return 0; }