map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_getsockname
#define __NR_getsockname 204
#endif
#ifndef __NR_mmap
#define __NR_mmap 222
#endif
#ifndef __NR_sendmsg
#define __NR_sendmsg 211
#endif
#ifndef __NR_socket
#define __NR_socket 198
#endif
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
uint64_t r[6] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// socket$netlink arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: netlink_proto = 0x0 (4 bytes)
// ]
// returns sock_netlink
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// socket arguments: [
// domain: socket_domain = 0x10 (8 bytes)
// type: socket_type = 0x803 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
res = syscall(__NR_socket, /*domain=AF_NETLINK*/0x10ul, /*type=SOCK_NONBLOCK|SOCK_RAW*/0x803ul, /*proto=*/0);
if (res != -1)
r[1] = res;
// sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR arguments: [
// fd: sock_nl_generic (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_t[genl_devlink_family_id, genlmsghdr_t[DEVLINK_CMD_SB_OCC_MAX_CLEAR], devlink_sb_occ_max_clear_policy]]] {
// msghdr_netlink[netlink_msg_t[genl_devlink_family_id, genlmsghdr_t[DEVLINK_CMD_SB_OCC_MAX_CLEAR], devlink_sb_occ_max_clear_policy]] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_t[genl_devlink_family_id, genlmsghdr_t[DEVLINK_CMD_SB_OCC_MAX_CLEAR], devlink_sb_occ_max_clear_policy]]] {
// iovec[in, netlink_msg_t[genl_devlink_family_id, genlmsghdr_t[DEVLINK_CMD_SB_OCC_MAX_CLEAR], devlink_sb_occ_max_clear_policy]] {
// addr: nil
// len: len = 0x14 (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x20000500 = 0;
*(uint32_t*)0x20000508 = 0;
*(uint64_t*)0x20000510 = 0x200004c0;
*(uint64_t*)0x200004c0 = 0;
*(uint64_t*)0x200004c8 = 0x14;
*(uint64_t*)0x20000518 = 1;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint32_t*)0x20000530 = 0;
syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x20000500ul, /*f=*/0ul);
// getsockname$packet arguments: [
// fd: sock_packet (resource)
// addr: ptr[out, sockaddr_ll] {
// sockaddr_ll {
// sll_family: const = 0x11 (2 bytes)
// sll_protocol: packet_protocols = 0x0 (2 bytes)
// sll_ifindex: ifindex (resource)
// sll_hatype: const = 0x1 (2 bytes)
// sll_pkttype: int8 = 0x0 (1 bytes)
// sll_halen: const = 0x6 (1 bytes)
// sll_addr: union mac_addr {
// broadcast: buffer: (DirOut)
// }
// pad: buffer: (DirOut)
// }
// }
// addrlen: ptr[inout, len] {
// len = 0x14 (4 bytes)
// }
// ]
*(uint32_t*)0x200000c0 = 0x14;
res = syscall(__NR_getsockname, /*fd=*/r[1], /*addr=*/0x20000100ul, /*addrlen=*/0x200000c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000104;
// sendmsg$nl_route arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route]] {
// msghdr_netlink[netlink_msg_route] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route]] {
// iovec[in, netlink_msg_route] {
// addr: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {3c 00 00 00 10 00 85 06 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x14)
// }
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {fe 67 00 00 00 00 00 00 1c 00 12 00 0c 00 01 00 62 6f 6e 64} (length 0x14)
// }
// }
// }
// len: len = 0x3c (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x20000340 = 0;
*(uint32_t*)0x20000348 = 0;
*(uint64_t*)0x20000350 = 0x20000000;
*(uint64_t*)0x20000000 = 0x20000380;
memcpy((void*)0x20000380, "\x3c\x00\x00\x00\x10\x00\x85\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 20);
*(uint32_t*)0x20000394 = r[2];
memcpy((void*)0x20000398, "\xfe\x67\x00\x00\x00\x00\x00\x00\x1c\x00\x12\x00\x0c\x00\x01\x00\x62\x6f\x6e\x64", 20);
*(uint64_t*)0x20000008 = 0x3c;
*(uint64_t*)0x20000358 = 1;
*(uint64_t*)0x20000360 = 0;
*(uint64_t*)0x20000368 = 0;
*(uint32_t*)0x20000370 = 0;
syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x20000340ul, /*f=*/0ul);
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[3] = res;
// socket$packet arguments: [
// domain: const = 0x11 (8 bytes)
// type: packet_socket_type = 0x3 (8 bytes)
// proto: const = 0x300 (4 bytes)
// ]
// returns sock_packet
res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=SOCK_RAW*/3ul, /*proto=*/0x300);
if (res != -1)
r[4] = res;
// getsockname$packet arguments: [
// fd: sock_packet (resource)
// addr: ptr[out, sockaddr_ll] {
// sockaddr_ll {
// sll_family: const = 0x11 (2 bytes)
// sll_protocol: packet_protocols = 0x0 (2 bytes)
// sll_ifindex: ifindex (resource)
// sll_hatype: const = 0x1 (2 bytes)
// sll_pkttype: int8 = 0x0 (1 bytes)
// sll_halen: const = 0x6 (1 bytes)
// sll_addr: union mac_addr {
// broadcast: buffer: (DirOut)
// }
// pad: buffer: (DirOut)
// }
// }
// addrlen: ptr[inout, len] {
// len = 0x0 (4 bytes)
// }
// ]
*(uint32_t*)0x20000200 = 0;
res = syscall(__NR_getsockname, /*fd=*/r[4], /*addr=*/0x20000100ul, /*addrlen=*/0x20000200ul);
if (res != -1)
r[5] = *(uint32_t*)0x20000104;
// sendmsg$nl_route arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route]] {
// msghdr_netlink[netlink_msg_route] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route]] {
// iovec[in, netlink_msg_route] {
// addr: ptr[in, netlink_msg_route] {
// union netlink_msg_route {
// newlink: netlink_msg_t[const[RTM_NEWLINK, int16], ifinfomsg[AF_UNSPEC], ifla_policy] {
// len: len = 0x44 (4 bytes)
// type: const = 0x10 (2 bytes)
// flags: netlink_msg_flags = 0x705 (2 bytes)
// seq: int32 = 0x0 (4 bytes)
// pid: int32 = 0x1e000000 (4 bytes)
// payload: ifinfomsg[AF_UNSPEC] {
// ifi_family: const = 0x0 (1 bytes)
// __ifi_pad: const = 0x0 (1 bytes)
// ifi_type: const = 0x0 (2 bytes)
// ifi_index: ifindex (resource)
// ifi_flags: net_device_flags = 0x0 (4 bytes)
// ifi_change: net_device_flags = 0x0 (4 bytes)
// }
// attrs: array[ifla_policy] {
// union ifla_policy {
// IFLA_LINKINFO: nlattr_tt[const[IFLA_LINKINFO, int16:14], 0, 1, ifla_info_policy] {
// nla_len: offsetof = 0x1c (2 bytes)
// nla_type: const = 0x12 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union ifla_info_policy {
// gretap: ifla_info_policy$t["gretap", IFLA_INFO_DATA, array[ipgre_policy]] {
// IFLA_INFO_KIND: nlattr_t[const[IFLA_INFO_KIND, int16], string["gretap"]] {
// nla_len: offsetof = 0xb (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {67 72 65 74 61 70 00} (length 0x7)
// size: buffer: {} (length 0x0)
// pad = 0x0 (1 bytes)
// }
// IFLA_INFO_DATA: nlattr_tt[const[IFLA_INFO_DATA, int16:14], 0, 1, array[ipgre_policy]] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[ipgre_policy] {
// union ipgre_policy {
// IFLA_GRE_LINK: nlattr_t[const[IFLA_GRE_LINK, int16], ifindex] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: ifindex (resource)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// union ifla_policy {
// IFLA_MASTER: nlattr_t[const[IFLA_MASTER, int16], ifindex] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0xa (2 bytes)
// payload: ifindex (resource)
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// len: len = 0x44 (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x20000240 = 0;
*(uint32_t*)0x20000248 = 0;
*(uint64_t*)0x20000250 = 0x20000000;
*(uint64_t*)0x20000000 = 0x20000140;
*(uint32_t*)0x20000140 = 0x44;
*(uint16_t*)0x20000144 = 0x10;
*(uint16_t*)0x20000146 = 0x705;
*(uint32_t*)0x20000148 = 0;
*(uint32_t*)0x2000014c = 0x1e000000;
*(uint8_t*)0x20000150 = 0;
*(uint8_t*)0x20000151 = 0;
*(uint16_t*)0x20000152 = 0;
*(uint32_t*)0x20000154 = 0;
*(uint32_t*)0x20000158 = 0;
*(uint32_t*)0x2000015c = 0;
*(uint16_t*)0x20000160 = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x20000162, 0x12, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000163, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000163, 1, 7, 1);
*(uint16_t*)0x20000164 = 0xb;
*(uint16_t*)0x20000166 = 1;
memcpy((void*)0x20000168, "gretap\000", 7);
*(uint16_t*)0x20000170 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x20000172, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000173, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000173, 1, 7, 1);
*(uint16_t*)0x20000174 = 8;
*(uint16_t*)0x20000176 = 1;
*(uint32_t*)0x20000178 = r[2];
*(uint16_t*)0x2000017c = 8;
*(uint16_t*)0x2000017e = 0xa;
*(uint32_t*)0x20000180 = r[5];
*(uint64_t*)0x20000008 = 0x44;
*(uint64_t*)0x20000258 = 1;
*(uint64_t*)0x20000260 = 0;
*(uint64_t*)0x20000268 = 0;
*(uint32_t*)0x20000270 = 0;
syscall(__NR_sendmsg, /*fd=*/r[3], /*msg=*/0x20000240ul, /*f=*/0ul);
return 0;
}
]