// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0x0}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket arguments: [ // domain: socket_domain = 0x10 (8 bytes) // type: socket_type = 0x3 (8 bytes) // proto: int32 = 0x0 (4 bytes) // ] // returns sock res = syscall(__NR_socket, /*domain=AF_NETLINK*/ 0x10ul, /*type=SOCK_RAW*/ 3ul, /*proto=*/0); if (res != -1) r[0] = res; // ioctl$sock_SIOCGIFINDEX arguments: [ // fd: sock (resource) // cmd: const = 0x8933 (4 bytes) // arg: ptr[out, ifreq_dev_t[devnames, ifindex]] { // ifreq_dev_t[devnames, ifindex] { // ifr_ifrn: buffer: {6c 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) elem: ifindex (resource) pad = 0x0 (20 bytes) // } // } // ] memcpy((void*)0x200000000240, "lo\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000240ul); if (res != -1) r[1] = *(uint32_t*)0x200000000250; // sendmsg$nl_route_sched arguments: [ // fd: sock_nl_route (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] { // msghdr_netlink[netlink_msg_route_sched] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_route_sched]] { // iovec[in, netlink_msg_route_sched] { // addr: ptr[in, netlink_msg_route_sched] { // union netlink_msg_route_sched { // newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], // tcmsg[AF_UNSPEC], rtm_tca_policy] { // len: len = 0x6c (4 bytes) // type: const = 0x24 (2 bytes) // flags: netlink_msg_flags = 0xd0f (2 bytes) // seq: int32 = 0x0 (4 bytes) // pid: int32 = 0x0 (4 bytes) // payload: tcmsg[AF_UNSPEC] { // family: const = 0x60 (1 bytes) // tcm__pad1: const = 0x0 (1 bytes) // tcm__pad2: const = 0x0 (2 bytes) // ifindex: ifindex (resource) // tcm_handle: tcm_handle { // minor: tcm_handle_offsets = 0x0 (2 bytes) // major: tcm_handle_offsets = 0x0 (2 bytes) // } // tcm_parent: tcm_handle { // minor: tcm_handle_offsets = 0xffff (2 bytes) // major: tcm_handle_offsets = 0xffff (2 bytes) // } // tcm_info: tcm_handle { // minor: tcm_handle_offsets = 0x0 (2 bytes) // major: tcm_handle_offsets = 0xfff2 (2 bytes) // } // } // attrs: array[rtm_tca_policy] { // union rtm_tca_policy { // qdisc_kind_options: union qdisc_kind_options { // q_cake: tca_kind_options_t["cake", // array[cake_policy]] { // TCA_KIND: nlattr_t[const[TCA_KIND, int16], // string["cake"]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {63 61 6b 65 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // TCA_OPTIONS: nlattr_t[const[TCA_OPTIONS, int16], // array[cake_policy]] { // nla_len: offsetof = 0x3c (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: array[cake_policy] { // union cake_policy { // TCA_CAKE_SPLIT_GSO: // nlattr_t[const[TCA_CAKE_SPLIT_GSO, int16], // int32[0:1]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x11 (2 bytes) // payload: int32 = 0x0 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union cake_policy { // TCA_CAKE_FWMARK: // nlattr_t[const[TCA_CAKE_FWMARK, int16], // int32] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x12 (2 bytes) // payload: int32 = 0x0 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union cake_policy { // TCA_CAKE_AUTORATE: // nlattr_t[const[TCA_CAKE_AUTORATE, int16], // int32] { // nla_len: offsetof = 0x4 (2 bytes) // nla_type: const = 0x9 (2 bytes) // payload: int32 = 0xff (4 bytes) // size: buffer: {} (length 0x0) // } // } // union cake_policy { // TCA_CAKE_AUTORATE: // nlattr_t[const[TCA_CAKE_AUTORATE, int16], // int32] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x9 (2 bytes) // payload: int32 = 0x9 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union cake_policy { // TCA_CAKE_WASH: nlattr_t[const[TCA_CAKE_WASH, // int16], int32[0:1]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0xd (2 bytes) // payload: int32 = 0x0 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union cake_policy { // TCA_CAKE_AUTORATE: // nlattr_t[const[TCA_CAKE_AUTORATE, int16], // int32] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x9 (2 bytes) // payload: int32 = 0x40 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union cake_policy { // TCA_CAKE_INGRESS: // nlattr_t[const[TCA_CAKE_INGRESS, int16], // int32[0:1]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0xf (2 bytes) // payload: int32 = 0x0 (4 bytes) // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // } // } // } // } // } // len: len = 0x6c (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000000 = 0; *(uint32_t*)0x200000000008 = 0; *(uint64_t*)0x200000000010 = 0x200000000780; *(uint64_t*)0x200000000780 = 0x2000000000c0; *(uint32_t*)0x2000000000c0 = 0x6c; *(uint16_t*)0x2000000000c4 = 0x24; *(uint16_t*)0x2000000000c6 = 0xd0f; *(uint32_t*)0x2000000000c8 = 0; *(uint32_t*)0x2000000000cc = 0; *(uint8_t*)0x2000000000d0 = 0x60; *(uint8_t*)0x2000000000d1 = 0; *(uint16_t*)0x2000000000d2 = 0; *(uint32_t*)0x2000000000d4 = r[1]; *(uint16_t*)0x2000000000d8 = 0; *(uint16_t*)0x2000000000da = 0; *(uint16_t*)0x2000000000dc = -1; *(uint16_t*)0x2000000000de = -1; *(uint16_t*)0x2000000000e0 = 0; *(uint16_t*)0x2000000000e2 = 0xfff2; *(uint16_t*)0x2000000000e4 = 9; *(uint16_t*)0x2000000000e6 = 1; memcpy((void*)0x2000000000e8, "cake\000", 5); *(uint16_t*)0x2000000000f0 = 0x3c; *(uint16_t*)0x2000000000f2 = 2; *(uint16_t*)0x2000000000f4 = 8; *(uint16_t*)0x2000000000f6 = 0x11; *(uint32_t*)0x2000000000f8 = 0; *(uint16_t*)0x2000000000fc = 8; *(uint16_t*)0x2000000000fe = 0x12; *(uint32_t*)0x200000000100 = 0; *(uint16_t*)0x200000000104 = 4; *(uint16_t*)0x200000000106 = 9; *(uint32_t*)0x200000000108 = 0xff; *(uint16_t*)0x20000000010c = 8; *(uint16_t*)0x20000000010e = 9; *(uint32_t*)0x200000000110 = 9; *(uint16_t*)0x200000000114 = 8; *(uint16_t*)0x200000000116 = 0xd; *(uint32_t*)0x200000000118 = 0; *(uint16_t*)0x20000000011c = 8; *(uint16_t*)0x20000000011e = 9; *(uint32_t*)0x200000000120 = 0x40; *(uint16_t*)0x200000000124 = 8; *(uint16_t*)0x200000000126 = 0xf; *(uint32_t*)0x200000000128 = 0; *(uint64_t*)0x200000000788 = 0x6c; *(uint64_t*)0x200000000018 = 1; *(uint64_t*)0x200000000020 = 0; *(uint64_t*)0x200000000028 = 0; *(uint32_t*)0x200000000030 = 0; syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x200000000000ul, /*f=*/0ul); return 0; }