map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
uint64_t r[1] = {0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// openat$rfkill arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 72 66 6b 69 6c 6c 00} (length 0xc)
// }
// flags: open_flags = 0x82002 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_rfkill
memcpy((void*)0x200000000080, "/dev/rfkill\000", 12);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000080ul, /*flags=O_CLOEXEC|FASYNC|O_RDWR*/0x82002, /*mode=*/0);
if (res != -1)
r[0] = res;
// write$rfkill arguments: [
// fd: fd_rfkill (resource)
// data: ptr[in, rfkill_event] {
// rfkill_event {
// idx: int32 = 0x0 (4 bytes)
// type: int8 = 0x0 (1 bytes)
// op: int8 = 0x3 (1 bytes)
// soft: int8 = 0x81 (1 bytes)
// hard: int8 = 0x0 (1 bytes)
// }
// }
// len: bytesize = 0x8 (8 bytes)
// ]
*(uint32_t*)0x200000000040 = 0;
*(uint8_t*)0x200000000044 = 0;
*(uint8_t*)0x200000000045 = 3;
*(uint8_t*)0x200000000046 = 0x81;
*(uint8_t*)0x200000000047 = 0;
syscall(__NR_write, /*fd=*/r[0], /*data=*/0x200000000040ul, /*len=*/8ul);
// openat$nci arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 76 69 72 74 75 61 6c 5f 6e 63 69 00} (length 0x11)
// }
// flags: const = 0x2 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_nci
memcpy((void*)0x200000000000, "/dev/virtual_nci\000", 17);
syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000000ul, /*flags=*/2, /*mode=*/0);
return 0;
}
]