map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_userfaultfd
#define __NR_userfaultfd 323
#endif
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// mmap arguments: [
// addr: VMA[0xfbe000]
// len: len = 0xfbe000 (8 bytes)
// prot: mmap_prot = 0x300000b (8 bytes)
// flags: mmap_flags = 0x4031 (8 bytes)
// fd: fd (resource)
// offset: intptr = 0x0 (8 bytes)
// ]
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xfbe000ul, /*prot=PROT_GROWSUP|PROT_GROWSDOWN|PROT_SEM|PROT_WRITE|PROT_READ*/0x300000bul, /*flags=MAP_NORESERVE|MAP_FIXED|MAP_ANONYMOUS|MAP_SHARED*/0x4031ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
// io_submit arguments: [
// ctx: io_ctx (resource)
// nr: len = 0x1 (8 bytes)
// iocbpp: ptr[in, array[ptr[in, iocb]]] {
// array[ptr[in, iocb]] {
// nil
// }
// }
// ]
*(uint64_t*)0x200000002340 = 0;
syscall(__NR_io_submit, /*ctx=*/0ul, /*nr=*/1ul, /*iocbpp=*/0x200000002340ul);
// madvise arguments: [
// addr: VMA[0x600000]
// len: len = 0x600003 (8 bytes)
// advice: madvise_flags = 0x19 (8 bytes)
// ]
syscall(__NR_madvise, /*addr=*/0x200000000000ul, /*len=*/0x600003ul, /*advice=MADV_COLLAPSE*/0x19ul);
// openat$tun arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 6e 65 74 2f 74 75 6e 00} (length 0xd)
// }
// flags: open_flags = 0x0 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_tun
memcpy((void*)0x2000000038c0, "/dev/net/tun\000", 13);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x2000000038c0ul, /*flags=*/0, /*mode=*/0);
if (res != -1)
r[0] = res;
// ioctl$TUNSETIFF arguments: [
// fd: fd_tun (resource)
// cmd: const = 0x400454ca (4 bytes)
// arg: ptr[in, ifreq_dev_t[devnames, flags[tun_setiff_flags, int16]]] {
// ifreq_dev_t[devnames, flags[tun_setiff_flags, int16]] {
// ifr_ifrn: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// elem: tun_setiff_flags = 0x2 (2 bytes)
// pad = 0x0 (22 bytes)
// }
// }
// ]
memset((void*)0x200000001440, 0, 16);
*(uint16_t*)0x200000001450 = 2;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x400454ca, /*arg=*/0x200000001440ul);
// userfaultfd arguments: [
// flags: userfaultfd_flags = 0x801 (8 bytes)
// ]
// returns fd_uffd
res = syscall(__NR_userfaultfd, /*flags=UFFD_USER_MODE_ONLY|O_NONBLOCK*/0x801ul);
if (res != -1)
r[1] = res;
// ioctl$UFFDIO_API arguments: [
// fd: fd_uffd (resource)
// cmd: const = 0xc018aa3f (4 bytes)
// arg: ptr[in, uffdio_api] {
// uffdio_api {
// api: const = 0xaa (8 bytes)
// featur: uffdio_features = 0x0 (8 bytes)
// ioctls: const = 0x0 (8 bytes)
// }
// }
// ]
*(uint64_t*)0x2000000000c0 = 0xaa;
*(uint64_t*)0x2000000000c8 = 0;
*(uint64_t*)0x2000000000d0 = 0;
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xc018aa3f, /*arg=*/0x2000000000c0ul);
// ioctl$UFFDIO_REGISTER arguments: [
// fd: fd_uffd (resource)
// cmd: const = 0xc020aa00 (4 bytes)
// arg: ptr[in, uffdio_register] {
// uffdio_register {
// range: uffdio_range {
// start: VMA[0x3000]
// len: len = 0x3000 (8 bytes)
// }
// mode: uffdio_register_mode = 0x1 (8 bytes)
// ioctls: const = 0x0 (8 bytes)
// }
// }
// ]
*(uint64_t*)0x200000000000 = 0x20000017a000;
*(uint64_t*)0x200000000008 = 0x3000;
*(uint64_t*)0x200000000010 = 1;
*(uint64_t*)0x200000000018 = 0;
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xc020aa00, /*arg=*/0x200000000000ul);
return 0;
}
]