map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// socket arguments: [
// domain: socket_domain = 0x11 (8 bytes)
// type: socket_type = 0x800000003 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
res = syscall(__NR_socket, /*domain=AF_PACKET*/0x11ul, /*type=SOCK_RAW|0x800000000*/0x800000003ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// ioctl$ifreq_SIOCGIFINDEX_team arguments: [
// fd: sock (resource)
// cmd: const = 0x8933 (4 bytes)
// arg: ptr[out, ifreq_dev_t["team0", ifindex_team]] {
// ifreq_dev_t["team0", ifindex_team] {
// ifr_ifrn: buffer: {74 65 61 6d 30 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// elem: ifindex_team (resource)
// pad = 0x0 (20 bytes)
// }
// }
// ]
memcpy((void*)0x200000000600, "team0\000\000\000\000\000\000\000\000\000\000\000", 16);
res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200000000600ul);
if (res != -1)
r[1] = *(uint32_t*)0x200000000610;
// socket$netlink arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: netlink_proto = 0x0 (4 bytes)
// ]
// returns sock_netlink
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[2] = res;
// sendmsg$nl_route_sched arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] {
// msghdr_netlink[netlink_msg_route_sched] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route_sched]] {
// iovec[in, netlink_msg_route_sched] {
// addr: ptr[in, netlink_msg_route_sched] {
// union netlink_msg_route_sched {
// newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], tcmsg[AF_UNSPEC], rtm_tca_policy] {
// len: len = 0xa4 (4 bytes)
// type: const = 0x24 (2 bytes)
// flags: netlink_msg_flags = 0xf0b (2 bytes)
// seq: int32 = 0x0 (4 bytes)
// pid: int32 = 0x0 (4 bytes)
// payload: tcmsg[AF_UNSPEC] {
// family: const = 0x0 (1 bytes)
// tcm__pad1: const = 0x0 (1 bytes)
// tcm__pad2: const = 0x12 (2 bytes)
// ifindex: ifindex (resource)
// tcm_handle: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// tcm_parent: tcm_handle {
// minor: tcm_handle_offsets = 0xffff (2 bytes)
// major: tcm_handle_offsets = 0xffff (2 bytes)
// }
// tcm_info: tcm_handle {
// minor: tcm_handle_offsets = 0x0 (2 bytes)
// major: tcm_handle_offsets = 0x0 (2 bytes)
// }
// }
// attrs: array[rtm_tca_policy] {
// union rtm_tca_policy {
// qdisc_kind_options: union qdisc_kind_options {
// q_taprio: tca_kind_options_t["taprio", array[taprio_policy]] {
// TCA_KIND: nlattr_t[const[TCA_KIND, int16], string["taprio"]] {
// nla_len: offsetof = 0xb (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {74 61 70 72 69 6f 00} (length 0x7)
// size: buffer: {} (length 0x0)
// pad = 0x0 (1 bytes)
// }
// TCA_OPTIONS: nlattr_t[const[TCA_OPTIONS, int16], array[taprio_policy]] {
// nla_len: offsetof = 0x74 (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: array[taprio_policy] {
// union taprio_policy {
// TCA_TAPRIO_ATTR_PRIOMAP: nlattr_t[const[TCA_TAPRIO_ATTR_PRIOMAP, int16], tc_mqprio_qopt] {
// nla_len: offsetof = 0x56 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: tc_mqprio_qopt {
// num_tc: int8 = 0x2 (1 bytes)
// prio_tc_map: array[int8] {
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// int8 = 0x0 (1 bytes)
// }
// hw: int8 = 0x0 (1 bytes)
// count: array[int16] {
// int16 = 0x8 (2 bytes)
// int16 = 0x4 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// }
// offset: array[int16] {
// int16 = 0x0 (2 bytes)
// int16 = 0x8 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// int16 = 0x0 (2 bytes)
// }
// }
// size: buffer: {} (length 0x0)
// pad = 0x0 (2 bytes)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST: nlattr_tt[const[TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST, int16:14], 0, 1, array[nlnest[TCA_TAPRIO_SCHED_ENTRY, array[entry_policy$taprio]]]] {
// nla_len: offsetof = 0x10 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[TCA_TAPRIO_SCHED_ENTRY, int16:14], 0, 1, array[entry_policy$taprio]]] {
// nlattr_tt[const[TCA_TAPRIO_SCHED_ENTRY, int16:14], 0, 1, array[entry_policy$taprio]] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[entry_policy$taprio] {
// union entry_policy$taprio {
// TCA_TAPRIO_SCHED_ENTRY_INTERVAL: nlattr_t[const[TCA_TAPRIO_SCHED_ENTRY_INTERVAL, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x4 (2 bytes)
// payload: int32 = 0x7eb24548 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// union taprio_policy {
// TCA_TAPRIO_ATTR_SCHED_CLOCKID: nlattr_t[const[TCA_TAPRIO_ATTR_SCHED_CLOCKID, int16], int32] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x5 (2 bytes)
// payload: int32 = 0x0 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// }
// }
// len: len = 0xa4 (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x2000000007c0 = 0;
*(uint32_t*)0x2000000007c8 = 0;
*(uint64_t*)0x2000000007d0 = 0x200000000780;
*(uint64_t*)0x200000000780 = 0x200000000500;
*(uint32_t*)0x200000000500 = 0xa4;
*(uint16_t*)0x200000000504 = 0x24;
*(uint16_t*)0x200000000506 = 0xf0b;
*(uint32_t*)0x200000000508 = 0;
*(uint32_t*)0x20000000050c = 0;
*(uint8_t*)0x200000000510 = 0;
*(uint8_t*)0x200000000511 = 0;
*(uint16_t*)0x200000000512 = 0x12;
*(uint32_t*)0x200000000514 = r[1];
*(uint16_t*)0x200000000518 = 0;
*(uint16_t*)0x20000000051a = 0;
*(uint16_t*)0x20000000051c = -1;
*(uint16_t*)0x20000000051e = -1;
*(uint16_t*)0x200000000520 = 0;
*(uint16_t*)0x200000000522 = 0;
*(uint16_t*)0x200000000524 = 0xb;
*(uint16_t*)0x200000000526 = 1;
memcpy((void*)0x200000000528, "taprio\000", 7);
*(uint16_t*)0x200000000530 = 0x74;
*(uint16_t*)0x200000000532 = 2;
*(uint16_t*)0x200000000534 = 0x56;
*(uint16_t*)0x200000000536 = 1;
*(uint8_t*)0x200000000538 = 2;
*(uint8_t*)0x200000000539 = 0;
*(uint8_t*)0x20000000053a = 0;
*(uint8_t*)0x20000000053b = 0;
*(uint8_t*)0x20000000053c = 0;
*(uint8_t*)0x20000000053d = 0;
*(uint8_t*)0x20000000053e = 0;
*(uint8_t*)0x20000000053f = 0;
*(uint8_t*)0x200000000540 = 0;
*(uint8_t*)0x200000000541 = 0;
*(uint8_t*)0x200000000542 = 0;
*(uint8_t*)0x200000000543 = 0;
*(uint8_t*)0x200000000544 = 0;
*(uint8_t*)0x200000000545 = 0;
*(uint8_t*)0x200000000546 = 0;
*(uint8_t*)0x200000000547 = 0;
*(uint8_t*)0x200000000548 = 0;
*(uint8_t*)0x200000000549 = 0;
*(uint16_t*)0x20000000054a = 8;
*(uint16_t*)0x20000000054c = 4;
*(uint16_t*)0x20000000054e = 0;
*(uint16_t*)0x200000000550 = 0;
*(uint16_t*)0x200000000552 = 0;
*(uint16_t*)0x200000000554 = 0;
*(uint16_t*)0x200000000556 = 0;
*(uint16_t*)0x200000000558 = 0;
*(uint16_t*)0x20000000055a = 0;
*(uint16_t*)0x20000000055c = 0;
*(uint16_t*)0x20000000055e = 0;
*(uint16_t*)0x200000000560 = 0;
*(uint16_t*)0x200000000562 = 0;
*(uint16_t*)0x200000000564 = 0;
*(uint16_t*)0x200000000566 = 0;
*(uint16_t*)0x200000000568 = 0;
*(uint16_t*)0x20000000056a = 0;
*(uint16_t*)0x20000000056c = 8;
*(uint16_t*)0x20000000056e = 0;
*(uint16_t*)0x200000000570 = 0;
*(uint16_t*)0x200000000572 = 0;
*(uint16_t*)0x200000000574 = 0;
*(uint16_t*)0x200000000576 = 0;
*(uint16_t*)0x200000000578 = 0;
*(uint16_t*)0x20000000057a = 0;
*(uint16_t*)0x20000000057c = 0;
*(uint16_t*)0x20000000057e = 0;
*(uint16_t*)0x200000000580 = 0;
*(uint16_t*)0x200000000582 = 0;
*(uint16_t*)0x200000000584 = 0;
*(uint16_t*)0x200000000586 = 0;
*(uint16_t*)0x200000000588 = 0;
*(uint16_t*)0x20000000058c = 0x10;
STORE_BY_BITMASK(uint16_t, , 0x20000000058e, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000058f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000058f, 1, 7, 1);
*(uint16_t*)0x200000000590 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x200000000592, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000593, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000593, 1, 7, 1);
*(uint16_t*)0x200000000594 = 8;
*(uint16_t*)0x200000000596 = 4;
*(uint32_t*)0x200000000598 = 0x7eb24548;
*(uint16_t*)0x20000000059c = 8;
*(uint16_t*)0x20000000059e = 5;
*(uint32_t*)0x2000000005a0 = 0;
*(uint64_t*)0x200000000788 = 0xa4;
*(uint64_t*)0x2000000007d8 = 1;
*(uint64_t*)0x2000000007e0 = 0;
*(uint64_t*)0x2000000007e8 = 0;
*(uint32_t*)0x2000000007f0 = 0;
syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x2000000007c0ul, /*f=*/0ul);
// clock_adjtime arguments: [
// id: clock_id = 0x0 (8 bytes)
// tx: ptr[in, timex] {
// timex {
// stuff0: intptr = 0xd54 (8 bytes)
// stuff1: intptr = 0x0 (8 bytes)
// stuff2: intptr = 0x0 (8 bytes)
// stuff3: intptr = 0x0 (8 bytes)
// stuff4: intptr = 0x0 (8 bytes)
// stuff5: intptr = 0x0 (8 bytes)
// stuff6: intptr = 0x0 (8 bytes)
// stuff7: intptr = 0x0 (8 bytes)
// stuff8: intptr = 0x0 (8 bytes)
// stuff9: intptr = 0x8000000 (8 bytes)
// stuff10: intptr = 0x0 (8 bytes)
// stuff11: intptr = 0x0 (8 bytes)
// stuff12: intptr = 0x0 (8 bytes)
// stuff13: intptr = 0x0 (8 bytes)
// stuff14: intptr = 0x0 (8 bytes)
// stuff15: intptr = 0x0 (8 bytes)
// stuff16: intptr = 0x0 (8 bytes)
// stuff17: intptr = 0x0 (8 bytes)
// stuff18: intptr = 0x0 (8 bytes)
// stuff19: intptr = 0x0 (8 bytes)
// stuff20: intptr = 0x0 (8 bytes)
// stuff21: intptr = 0x0 (8 bytes)
// stuff22: intptr = 0x0 (8 bytes)
// stuff23: intptr = 0x0 (8 bytes)
// stuff24: intptr = 0x0 (8 bytes)
// stuff25: intptr = 0x0 (8 bytes)
// }
// }
// ]
*(uint64_t*)0x200000000040 = 0xd54;
*(uint64_t*)0x200000000048 = 0;
*(uint64_t*)0x200000000050 = 0;
*(uint64_t*)0x200000000058 = 0;
*(uint64_t*)0x200000000060 = 0;
*(uint64_t*)0x200000000068 = 0;
*(uint64_t*)0x200000000070 = 0;
*(uint64_t*)0x200000000078 = 0;
*(uint64_t*)0x200000000080 = 0;
*(uint64_t*)0x200000000088 = 0x8000000;
*(uint64_t*)0x200000000090 = 0;
*(uint64_t*)0x200000000098 = 0;
*(uint64_t*)0x2000000000a0 = 0;
*(uint64_t*)0x2000000000a8 = 0;
*(uint64_t*)0x2000000000b0 = 0;
*(uint64_t*)0x2000000000b8 = 0;
*(uint64_t*)0x2000000000c0 = 0;
*(uint64_t*)0x2000000000c8 = 0;
*(uint64_t*)0x2000000000d0 = 0;
*(uint64_t*)0x2000000000d8 = 0;
*(uint64_t*)0x2000000000e0 = 0;
*(uint64_t*)0x2000000000e8 = 0;
*(uint64_t*)0x2000000000f0 = 0;
*(uint64_t*)0x2000000000f8 = 0;
*(uint64_t*)0x200000000100 = 0;
*(uint64_t*)0x200000000108 = 0;
syscall(__NR_clock_adjtime, /*id=*/0ul, /*tx=*/0x200000000040ul);
return 0;
}
]