// https://syzkaller.appspot.com/bug?id=d58bf50d355c36ebc893e14f162b1857f96c95a7 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } *(uint32_t*)0x200000000100 = 1; *(uint32_t*)0x200000000104 = 4; *(uint32_t*)0x200000000108 = 0x7fe2; *(uint32_t*)0x20000000010c = 3; *(uint32_t*)0x200000000110 = 0; *(uint32_t*)0x200000000114 = 1; *(uint32_t*)0x200000000118 = 0; memset((void*)0x20000000011c, 0, 16); *(uint32_t*)0x20000000012c = 0; *(uint32_t*)0x200000000130 = -1; *(uint32_t*)0x200000000134 = 0; *(uint32_t*)0x200000000138 = 0; *(uint32_t*)0x20000000013c = 0; *(uint64_t*)0x200000000140 = 0; *(uint32_t*)0x200000000148 = 0; *(uint32_t*)0x20000000014c = 0; res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200000000100ul, /*size=*/0x50ul); if (res != -1) r[0] = res; *(uint32_t*)0x2000000000c0 = 0x11; *(uint32_t*)0x2000000000c4 = 0xc; *(uint64_t*)0x2000000000c8 = 0x200000000440; *(uint8_t*)0x200000000440 = 0x18; STORE_BY_BITMASK(uint8_t, , 0x200000000441, 0, 0, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000441, 0, 4, 4); *(uint16_t*)0x200000000442 = 0; *(uint32_t*)0x200000000444 = 0; *(uint8_t*)0x200000000448 = 0; *(uint8_t*)0x200000000449 = 0; *(uint16_t*)0x20000000044a = 0; *(uint32_t*)0x20000000044c = 0; *(uint8_t*)0x200000000450 = 0x18; STORE_BY_BITMASK(uint8_t, , 0x200000000451, 1, 0, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000451, 1, 4, 4); *(uint16_t*)0x200000000452 = 0; *(uint32_t*)0x200000000454 = r[0]; *(uint8_t*)0x200000000458 = 0; *(uint8_t*)0x200000000459 = 0; *(uint16_t*)0x20000000045a = 0; *(uint32_t*)0x20000000045c = 0; STORE_BY_BITMASK(uint8_t, , 0x200000000460, 7, 0, 3); STORE_BY_BITMASK(uint8_t, , 0x200000000460, 0, 3, 1); STORE_BY_BITMASK(uint8_t, , 0x200000000460, 0xb, 4, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000461, 8, 0, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000461, 0, 4, 4); *(uint16_t*)0x200000000462 = 0; *(uint32_t*)0x200000000464 = 0; STORE_BY_BITMASK(uint8_t, , 0x200000000468, 3, 0, 3); STORE_BY_BITMASK(uint8_t, , 0x200000000468, 3, 3, 2); STORE_BY_BITMASK(uint8_t, , 0x200000000468, 3, 5, 3); STORE_BY_BITMASK(uint8_t, , 0x200000000469, 0xa, 0, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000469, 8, 4, 4); *(uint16_t*)0x20000000046a = 0xfff8; *(uint32_t*)0x20000000046c = 0; STORE_BY_BITMASK(uint8_t, , 0x200000000470, 7, 0, 3); STORE_BY_BITMASK(uint8_t, , 0x200000000470, 1, 3, 1); STORE_BY_BITMASK(uint8_t, , 0x200000000470, 0xb, 4, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000471, 2, 0, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000471, 0xa, 4, 4); *(uint16_t*)0x200000000472 = 0; *(uint32_t*)0x200000000474 = 0; STORE_BY_BITMASK(uint8_t, , 0x200000000478, 7, 0, 3); STORE_BY_BITMASK(uint8_t, , 0x200000000478, 0, 3, 1); STORE_BY_BITMASK(uint8_t, , 0x200000000478, 0, 4, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000479, 2, 0, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000479, 0, 4, 4); *(uint16_t*)0x20000000047a = 0; *(uint32_t*)0x20000000047c = 0xfffffff8; STORE_BY_BITMASK(uint8_t, , 0x200000000480, 7, 0, 3); STORE_BY_BITMASK(uint8_t, , 0x200000000480, 0, 3, 1); STORE_BY_BITMASK(uint8_t, , 0x200000000480, 0xb, 4, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000481, 3, 0, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000481, 0, 4, 4); *(uint16_t*)0x200000000482 = 0; *(uint32_t*)0x200000000484 = 8; STORE_BY_BITMASK(uint8_t, , 0x200000000488, 7, 0, 3); STORE_BY_BITMASK(uint8_t, , 0x200000000488, 0, 3, 1); STORE_BY_BITMASK(uint8_t, , 0x200000000488, 0xb, 4, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000489, 4, 0, 4); STORE_BY_BITMASK(uint8_t, , 0x200000000489, 0, 4, 4); *(uint16_t*)0x20000000048a = 0; *(uint32_t*)0x20000000048c = 0; *(uint8_t*)0x200000000490 = 0x85; *(uint8_t*)0x200000000491 = 0; *(uint16_t*)0x200000000492 = 0; *(uint32_t*)0x200000000494 = 3; *(uint8_t*)0x200000000498 = 0x95; *(uint8_t*)0x200000000499 = 0; *(uint16_t*)0x20000000049a = 0; *(uint32_t*)0x20000000049c = 0; *(uint64_t*)0x2000000000d0 = 0x200000000240; memcpy((void*)0x200000000240, "GPL\000", 4); *(uint32_t*)0x2000000000d8 = 0; *(uint32_t*)0x2000000000dc = 0; *(uint64_t*)0x2000000000e0 = 0; *(uint32_t*)0x2000000000e8 = 0; *(uint32_t*)0x2000000000ec = 0; memset((void*)0x2000000000f0, 0, 16); *(uint32_t*)0x200000000100 = 0; *(uint32_t*)0x200000000104 = 0; *(uint32_t*)0x200000000108 = -1; *(uint32_t*)0x20000000010c = 0; *(uint64_t*)0x200000000110 = 0; *(uint32_t*)0x200000000118 = 0; *(uint32_t*)0x20000000011c = 0; *(uint64_t*)0x200000000120 = 0; *(uint32_t*)0x200000000128 = 0; *(uint32_t*)0x20000000012c = 0; *(uint32_t*)0x200000000130 = 0; *(uint32_t*)0x200000000134 = 0; *(uint64_t*)0x200000000138 = 0; *(uint64_t*)0x200000000140 = 0; *(uint32_t*)0x200000000148 = 0; *(uint32_t*)0x20000000014c = 0; *(uint32_t*)0x200000000150 = 0; res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x2000000000c0ul, /*size=*/0x94ul); if (res != -1) r[1] = res; *(uint64_t*)0x200000000000 = 0x200000000040; memcpy((void*)0x200000000040, "kmem_cache_free\000", 16); *(uint32_t*)0x200000000008 = r[1]; *(uint32_t*)0x20000000000c = 0; *(uint64_t*)0x200000000010 = 0; syscall(__NR_bpf, /*cmd=*/0x11ul, /*arg=*/0x200000000000ul, /*size=*/0x10ul); *(uint32_t*)0x200000000200 = 0xc; *(uint32_t*)0x200000000204 = 0xe; *(uint64_t*)0x200000000208 = 0x200000000380; memcpy( (void*)0x200000000380, "\xb7\x02\x00\x00\x03\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07\x03" "\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\x01\x00\x00\x00\x79\xa4\xf0\xff" "\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05\x00\x00\x00" "\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00\x01\x00\x7d\x60" "\xb7\x03\x00\x00\x00\x00\x00\x00\x6a\x0a\x00\xfe\x00\x00\x00\x00\x85\x00" "\x00\x00\x0d\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00" "\x00\x00\x00\x00\x5e\xce\xfa\xb8\xf2\xe8\x5c\x6c\x1c\xa7\x11\xfc\xd0\xcd" "\xfa\x14\x6e\xc5\x61\x47\xd6\x65\x27\xda\x30\x7b\xf7\x31\xfe\xf9\x78\x61" "\x75\x03\x79\x58\x5e\x5a\x07\x6d\x83\x92\x40\xd2\x9c\x03\x40\x55\xb6\x7d" "\xaf\xe6\xc8\xdc\x3d\x5d\x78\xc0\x7f\xa1\xf7\xe6\x55\xce\x34\xe4\xd5\xb3" "\x18\x5f\xec\x0e\x07\x00\x4e\x60\xc0\x8d\xc8\xb5\x7a\xe4\x5b\xb7\xc1\x62" "\x6d\xb6\x45\xbb\x0b\x0c\x05\x2d\xb8\xdb\xf1\x1e\x6e\x94\xd7\x59\x38\x32" "\x1a\x3a\xa5\x02\xcd\x24\x24\xa6\x6e\x6d\x2e\xf8\x31\xab\x7e\xa0\xc3\x4f" "\x17\xe3\x94\x6e\xf3\xbb\x62\x20\x03\xb5\x38\xdf\xd8\xe0\x12\xe7\x95\x78" "\xe5\x1b\xc5\x30\x99\xe9\x0f\x45\x80\xd7\x60\x55\x1b\x5b\x34\x1a\x29\xf3" "\x1e\x31\x06\xd1\xdd\xd6\x15\x2f\x7c\xbd\xb9\xcd\x38\xbd\xb2\x20\x9c\x67" "\xde\xca\x8e\xeb\x9c\x15\xab\x3a\x14\x81\x7a\xc6\x1e\x4d\xd1\x11\x83\xa1" "\x34\x77\xbf\x7e\x86\x0e\x36\x70\xef\x0e\x78\x9f\x65\xf1\x32\x8d\x67\x04" "\x90\x2c\xbe\x7b\xc0\x4b\x82\xd2\x78\x9c\xb1\x32\xb8\x66\x7c\x21\x47\x66" "\x1d\xf2\x8d\x99\x61\xb6\x3e\x1a\x9c\xf6\xc2\xa6\x60\xa1\xfe\x3c\x18\x4b" "\x75\x1c\x51\x16\x0f\xb2\x0b\x1c\x58\x1e\x7b\xe6\xba\x0d\xc0\x01\xc4\x11" "\x05\x55\x85\x09\x15\x14\x8b\xa5\x32\xe6\xea\x09\xc3\x46\xdf\xeb\xd3\x86" "\x08\xb3\x28\x00\x80\x00\x5d\x9a\x95\x00\x00\x00\x00\x00\x00\x00\x33\x4d" "\x83\x23\x9d\xd2\x70\x80\x85\x1d\xca\xc3\xc1\x22\x33\xf9\xa1\xfb\x9c\x2a" "\xec\x61\xce\x63\xa3\x8d\x2f\xd5\x01\x17\xb8\x9a\x9a\xb3\x59\xb4\xee\xa0" "\xc6\xe9\x57\x67\xd4\x2b\x4e\x54\x86\x1d\x02\x27\xdb\xfd\x2e\x6d\x7f\x71" "\x5a\x7f\x3d\xea\xdd\x71\x30\x85\x6f\x75\x64\x36\x30\x37\x67\xd2\xe2\x4f" "\x29\xe5\xda\xd9\x79\x6e\xdb\x69\x7a\xee\xa0\x18\x2b\xab\xd1\x8c\xac\x1b" "\xd4\xf4\x39\x0a\xf9\xa9\xce\xaf\xd0\x00\x2c\xab\x15\x4a\xd0\x29\xa1\x09" "\x00\x00\x00\x27\x80\x87\x00\x14\xf5\x1c\x3c\x97\x5d\x5a\xec\x84\x22\x2f" "\xff\x0d\x72\x16\xfd\xb0\xd3\xa0\x04\x00\x00\x00\x63\x11\x2f\x0b\x39\x50" "\x1a\xaf\xe2\x34\x87\x00\x72\x85\x8d\xc0\x6e\x7c\x33\x76\x42\xd3\xe5\xa8" "\x15\x23\x2f\x5e\x16\xc1\xb3\x0c\x3a\x6a\x71\xbc\x85\x01\x8e\x5f\xf2\xc9" "\x10\x18\xaf\xc9\xff\xc2\xcc\x78\x8b\xee\x1b\x47\x68\x3d\xb0\x1a\x46\x93" "\x98\x68\x52\x11\xdf\xbb\xae\x3e\x2e\xd0\xa5\x0e\x73\x13\xbf\xf5\xd4\xc3" "\x91\xdd\xec\xe0\x0f\xc7\x72\xdd\x6b\x4d\x4d\xe2\xa4\x19\x90\xf0\x5c\xa3" "\xbd\xfc\x92\xc8\x8c\x5b\x8d\xcd\x36\xe7\x48\x7a\xfa\x44\x7c\x2e\xdf\xae" "\x4f\x39\x0a\x83\x37\x84\x1c\xef\x38\x6e\x22\xcc\x22\xee\x17\x47\x6d\x73" "\x89\x52\x22\x96\x82\xe2\x4b\x92\x53\x3a\xc2\xa9\xf5\xa6\x99\x59\x3f\x08" "\x44\x19\xca\xe0\xb4\x53\x2b\xcc\x97\xd3\xae\x48\x6a\xca\x54\x18\x3f\xb0" "\x1c\x73\xf9\x79\xca\x98\x57\x39\x95\x37\xf5\xdc\x2a\xcb\x72\xe7\xea\xd0" "\x50\x9d\x38\x05\x78\x67\x3f\x8b\x6e\x74\xce\x23\x87\x7a\x6b\x24\xdb\x0e" "\x06\x73\x45\x56\x09\x42\xfa\x62\x9f\xbe\xf2\x46\x1c\x96\xa0\x88\xa2\x2e" "\x8b\x15\xc3\xe2\x33\xdb\x7a\xb2\x2e\x30\xd4\x6a\x9d\x24\xd3\x7c\xef\x09" "\x9e\xce\x72\x9a\xa2\x18\xf9\xf4\x4a\x32\x10\x22\x3f\xda\xe7\xed\x04\x93" "\x5c\x3c\x90\xd3\xad\xd8\xee\xbc\x86\x19\xd7\x34\x15\xcd\xa2\x13\x0f\x50" "\x11\xe4\x84\x55\xb5\xa8\xb9\x0d\xfa\xe1\x58\xb9\x4f\x50\xad\xab\x98\x8d" "\xd8\xe1\x2b\xaf\x5c\xc9\x39\x8f\xff\x00\x40\x4d\x5d\x99\xf8\x2e\x20\xee" "\x6a\x8c\x88\xe1\x8c\x29\x77\xa2\xb3\x7d\x9a\xc4\xcf\xc1\xc7\xb4\x00\x00" "\x00\x00\x00\x00\x07\xff\x57\xc3\x94\x95\xc8\x26\xb9\x56\xba\x85\x9a\xc8" "\xe3\xc1\x77\xb9\x1b\xd7\xd5\xe4\x1f\xf8\x68\xf7\xca\x16\x64\xfe\x2f\x3c" "\xed\x84\x68\x91\x18\x06\x04\xb6\xdd\x24\x99\xd1\x6d\x7d\x91\x58\xff\xff" "\xff\xff\x00\x00\x00\x00\xef\x06\x9d\xc4\x27\x49\xa8\x9f\x85\x47\x97\xf2" "\x9d\x00\x00\x00\x2d\x8c\x38\xa9\x67\xc1\xbb\xe0\x93\x15\xc2\x98\x77\xa3" "\x31\xbc\xc8\x7d\xc3\xad\xdb\x08\x14\x1b\xde\xe5\xd2\x78\x74\xb2\xf6\x63" "\xdd\xee\xf0\x00\x5b\x3d\x96\xc7\xaa\xbf\x4d\xf5\x17\xd9\x0b\xa9\x08\x00" "\xc6\x6e\xe2\xb1\xad\x76\xdf\xf9\xf9\x00\x00\x71\x41\x4c\x99\xd4\x89\x4e" "\xe7\xf8\x24\x9d\xc1\xe3\x42\x8d\x21\x29\x36\x9e\xe1\xb8\x5a\xf6\xeb\x2e" "\xea\x0d\x0d\xf4\x14\xb3\x15\x92\x47\x9e\xcf\x23\x92\x19\x1f\xa8\x3e\xe8" "\x30\x54\x8f\x11\xe1\x03\x6a\x8d\xeb\xd6\x4c\xbe\x35\x94\x54\xa3\xf2\x23" "\x9c\xfe\x35\xf8\x1b\x7a\x49\x0f\x16\x7e\x6d\x5c\x11\x09\x00\x00\x00\x00" "\x00\x00\x00\x00\x42\xb8\xff\x8c\x21\xad\x70\x2c\xca\xca\xd5\xb3\x9e\xef" "\x21\x3d\x1c\xa2\x96\xd2\xa2\x77\x98\xc8\xce\x2a\x30\x5c\x0c\x7d\x35\xcf" "\x4b\x22\x54\x9a\x4b\xd9\x20\x52\x18\x8b\xd1\xf2\x85\xf6\x53\xb6\x21\x49" "\x1d\xc6\xaa\xee\x02\x00\xe2\xff\x08\x64\x4f\xb9\x4c\x06\x00\x6e\xff\x1b" "\xe2\xf6\x33\xc1\xd9\x87\x59\x1e\xc3\xdb\x58\xa7\xbb\x30\x42\xec\x3f\x77" "\x1f\x7a\x13\x38\xa5\xc3\xdd\x35\xe9\x26\x04\x9f\xe8\x6e\x09\xc5\x8e\x27" "\x3c\xd9\x05\xde\xb2\x8c\x13\xc1\xed\x1c\x0d\x9c\xae\x84\x6b\xcb\xfa\x8c" "\xce\x7b\x89\x3e\x57\x8a\xf7\xdc\x7d\x5e\x87\xd4\x4f\xf8\x28\xde\x45\x3f" "\x34\xc2\xb1\x86\x60\xb0\x80\xef\xc7\x07\xe6\x76\xe1\xfb\x4d\x58\x25\xc0" "\xca\x17\x7a\x4c\x7f\xbb\x4e\x62\xb4\x45\xc0\x0f\x57\x6b\x2b\x5c\xc7\xf8" "\x19\xab\xd0\xf8\x85\xcc\x48\x06\xf4\x03\x00\x96\x6f\xcf\x1e\x54\xf5\xa2" "\xd3\x87\x08\x19\x4c\xd6\xf4\x96\xe5\xde\xe7\x34\xfe\x7d\xa3\x77\x08\x45" "\xcf\x44\x2d\x48\x8a\xfd\xc0\xe1\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x52" "\x05\x00\x00\x00\xdc\x1c\x56\xd5\x9f\x35\xd3\x67\x63\x29\x52\xa9\x34\x66" "\xae\x59\x5c\x6a\x8c\xda\x69\x0d\x19\x2a\x07\x08\x86\xdf\x42\xb2\x70\x98" "\x77\x3b\x45\x19\x8b\x4a\x34\xac\x97\x7e\xbd\x44\x50\xe1\x21\xd0\x13\x42" "\x70\x3f\x5b\xf0\x30\xe9\x35\x87\x8a\x6d\x16\x9c\x80\xaa\x42\x52\xd4\xea" "\x6b\x8f\x62\x16\xff\x20\x2b\x5b\x5a\x18\x2c\xb5\xe8\x38\xb3\x07\x63\x2d" "\x03\xa7\xca\x6f\x6d\x03\x39\xf9\x95\x3c\x30\x93\xc3\x69\x0d\x10\xec\xb6" "\x5d\xc5\xb4\x74\x81\xed\xbf\x1f\x00\x00\x00\x00\x00\x00\x00\x4d\x16\xd2" "\x9c\x28\xeb\x51\x67\xe9\x93\x6e\xd3\x27\xfb\x23\x7a\x56\x22\x4e\x49\xd9" "\xea\x95\x5a\x5f\x0d\xec\x1b\x3c\xcd\x35\x36\x46\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x26\xde\xd4\xdd\x6f\xe1\x51\x8c\xc7\x80\x20\x43" "\xec\xfe\x69\xf7\x43\xf1\x21\x3b\xf8\x17\x9e\xcd\x9e\x5a\x22\x5d\x67\x52" "\x1d\xc7\x28\xea\xc7\xd8\x0a\x56\x56\xac\x2c\xbd\xe2\x1d\x3e\xbf\xbf\x69" "\xff\x86\x1f\x43\x94\x83\x6d\xdf\x12\x8d\x6d\x19\x07\x9e\x64\x33\x6e\x7c" "\x67\x65\x05\xc7\x8a\xd6\x75\x48\xf4\xb1\x92\xbe\x18\x27\xfc\xd9\x5c\xf1" "\x07\x75\x3c\xb0\xa6\xa9\x79\xd3\xdb\x0c\x40\x70\x81\xc6\x28\x1e\x2d\x84" "\x29\xa8\x63\x90\x3c\xa7\x5f\x4c\x7d\xf3\xea\x8f\xc2\x01\x8d\x07\xaf\x14" "\x91\xef\x06\x0c\xd4\x40\x3a\x09\x9f\x32\x46\x8f\x65\xbd\x06\xb4\x08\x2d" "\x43\xe1\x21\x86\x1b\x5c\xc0\x3f\x1a\x15\x61\xf0\x58\x9e\x0d\x12\x96\x9b" "\xc9\x82\xff\x5d\x8e\x9b\x98\x6c\x0c\x6c\x74\x7d\x9a\x1c\xc5\x00\xbb\x89" "\x2c\x3a\x16\xff\x10\xfe\xea\x20\xbd\xac\x00\x00\x00\x00\x00\x00\x00\x00" "\xca\x06\xf2\x56\xc8\x02\x8e\x0f\x9b\x65\xf0\x37\xb2\x1f\x32\x89\xf8\x6a" "\x68\x26\xc6\x9f\xa3\x5b\xa5\xcb\xc3\xf2\xdb\x15\x16\xff\xc5\xc6\xe3\xfa" "\x61\x8b\x24\xa6\xce\x16\xd6\xc7\x01\x0b\xb3\x7b\x61\xfa\x0a\x2d\x89\x74" "\xe6\x91\x15\xd3\x33\x94\xe8\x6e\x4b\x83\x82\x97\xba\x20\xf9\x69\x36\xb7" "\xe4\x74\x6e\x92\xde\xa6\xc5\xd1\xd3\x3d\x84\xd9\x6b\x50\xfb\x00\x00\x00" "\xae\x07\xc6\x5b\x71\x08\x8d\xd7\xd5\xd1\xe1\xba\xb9\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\xb5\xac\xe2\x93\xbe\xc8\x59\xc1\x3e\x32\x29" "\x43\x2a\xd7\x1d\x64\x62\x18\xb5\x22\x9d\xd8\x81\x37\xfc\x7c\x59\xaa\x24" "\x2a\xf3\xbb\x4e\xfb\x82\x05\x5a\x3b\x61\x22\x7a\xd4\x0f\x52\xc9\xf2\x50" "\x05\x79\xac\xa1\x10\x33\xec\x14\xbb\x9c\xc1\x6b\xd8\x3a\x00\x84\x0e\x31" "\xd8\x28\xec\x78\xe1\x16\xae\x46\xc4\x89\x7e\x27\x95\xb6\xff\x92\xe9\xa1" "\xe2\x4b\x0b\x85\x5c\x02\xf2\xb7\xad\xd5\x8f\xfb\x25\xf3\x39\x29\x77\x29" "\xa7\xa5\x18\x10\x13\x4d\x3d\xfb\xf7\x1f\x65\x16\x73\x7b\xe5\x5c\x06\xd9" "\xcd\xcf\xb1\xe2\xbb\x10\xb5\x00\x00\xeb\x4a\xcf\xf9\x07\x56\xdb\xa1\xec" "\xf9\xf5\x8a\xfd\x3c\x19\xb5\xc4\x55\x8b\xa9\xaf\x6b\x73\x33\xc8\x94\xa1" "\xfb\x29\xad\xe9\xad\x75\xc9\xc0\x22\xe8\xd0\x3f\xe2\x8b\xc3\x58\x68\x44" "\x92\xaa\x77\x1d\xbf\xe8\x07\x45\xfe\x89\xad\x34\x9f\xfa\xad\x76\xff\x9d" "\xd6\x43\x79\x6c\xaf\xfd\xf6\x7a\xf5\xdd\x47\x6c\x37\xe7\xe9\xa8\x4e\x2e" "\x5d\xa2\x69\x6e\x28\x5a\x59\xb5\x3f\x2f\xb0\xe1\x6d\x82\x62\xc0\x80\xc1" "\x59\xce\x40\xc1\x40\x89\xc8\x27\x59\x10\x6f\x42\x25\x82\xb4\x2e\x3e\x84" "\x84\xea\x5a\x6a\xd9\xaa\x52\x10\x6e\xaf\xe0\xe0\xca\xea\x1a\xd4\xcb\x23" "\xf3\xc2\xb8\xa0\xf4\x55\xba\x69\xea\x28\x4c\x26\x8d\x54\xb4\x31\x58\xa8" "\xb1\xd1\x28\xd0\x2a\xf2\x63\xb3\xdc\x1c\xab\x79\x4c\x9a\xc5\x7a\x2a\x73" "\x32\xf4\xd8\x76\x4c\x30\x2c\xcd\x5a\xac\x11\x44\x82\xb6\x19\xfc\x57\x5a" "\xa0\xdd\x27\x77\xe8\x81\xe2\x9a\x85\x43\x80\xe2\xf1\xe4\x9d\xb5\xa1\x51" "\x7e\xc4\x0b\xb3\xfa\x44\xf9\x95\x9b\xad\x67\xcc\xab\xa7\x64\x08\xda\x35" "\xc9\xf1\x53\x4c\x8b\xd4\x8b\xbd\x61\x62\x7a\x2e\x0a\x74\xb5\xe6\xae\xfb" "\x7e\xee\x40\x35\x02\x73\x41\x37\xff\x47\x25\x7f\x16\x43\x91\xc6\x73\xb6" "\x07\x1b\x6a\xd0\xf0\x5e\xed\x16\x4c\xa6\x3e\x4e\xa2\x6d\xce\x0f\xb3\xce" "\x0f\x65\x91\xd8\x0d\xfb\x8f\x38\x6b\xb7\x9f\x55\x89\x82\x9b\x6b\x06\x79" "\xb5\xd6\x5a", 2271); *(uint64_t*)0x200000000210 = 0; *(uint32_t*)0x200000000218 = 0; *(uint32_t*)0x20000000021c = 0; *(uint64_t*)0x200000000220 = 0; *(uint32_t*)0x200000000228 = 0; *(uint32_t*)0x20000000022c = 0; memset((void*)0x200000000230, 0, 16); *(uint32_t*)0x200000000240 = 0; *(uint32_t*)0x200000000244 = 0; *(uint32_t*)0x200000000248 = -1; *(uint32_t*)0x20000000024c = 8; *(uint64_t*)0x200000000250 = 0; *(uint32_t*)0x200000000258 = 0; *(uint32_t*)0x20000000025c = 0x10; *(uint64_t*)0x200000000260 = 0; *(uint32_t*)0x200000000268 = 0; *(uint32_t*)0x20000000026c = 0; *(uint32_t*)0x200000000270 = -1; *(uint32_t*)0x200000000274 = 0; *(uint64_t*)0x200000000278 = 0; *(uint64_t*)0x200000000280 = 0; *(uint32_t*)0x200000000288 = 0x10; *(uint32_t*)0x20000000028c = 0; *(uint32_t*)0x200000000290 = 0; syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000200ul, /*size=*/0x94ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; for (procid = 0; procid < 5; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; }