// https://syzkaller.appspot.com/bug?id=197404c3aab044e8fb6a57759f344fdf5d17dc02 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } *(uint32_t*)0x2000000054c0 = 0x16; *(uint32_t*)0x2000000054c4 = 0x16; *(uint64_t*)0x2000000054c8 = 0x2000000004c0; memcpy( (void*)0x2000000004c0, "\x61\x12\x4d\x00\x00\x00\x00\x00\x61\x13\x52\x00\x00\x00\x00\x00\xbf\x20" "\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x18\x00\x00\x00\x3d\x03\x01\x00" "\x00\x00\x00\x00\x95\x00\xf0\x00\x00\x00\x00\x00\x69\x26\x00\x00\x00\x00" "\x00\x00\xbf\x67\x00\x00\x00\x00\x00\x00\x56\x06\x02\x00\x0f\xff\x07\x00" "\x77\x06\x00\x00\x20\x00\x00\x00\x17\x02\x00\x00\x0e\xe6\xb1\xf7\xbf\x25" "\x00\x00\x00\x00\x00\x00\x2d\x35\x00\x00\x00\x00\x00\x00\x65\x07\x00\x00" "\x02\x08\x00\x00\x07\x07\x00\x00\x4c\x00\x00\x00\x1f\x75\x00\x00\x00\x00" "\x00\x00\xbf\x54\x00\x00\x00\x00\x00\x00\x07\x04\x00\x00\x04\x00\xf9\xff" "\xad\x15\x01\x00\x00\x00\x00\x00\x84\x04\x00\x00\x00\x00\x00\x00\x14\x00" "\x00\x00\x10\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\xdb\x13\xd5\xd8" "\xb7\x41\xf2\xcd\xaa\xbc\x83\x83\xc8\xf5\x6b\x8c\x2b\x84\x8b\x00\xea\x65" "\x53\xf3\x04\x00\x00\x00\x81\x5d\xcf\x00\xc3\xee\x7b\x04\x2d\x19\x37\xba" "\x52\x03\x7f\xde\xfe\xb0\xcf\xf9\xfc\x56\x35\x7d\x81\xb2\xcc\x1a\x9e\x37" "\xd7\xb7\x5c\x02\x0b\x07\x00\x00\x00\x3e\xb2\x20\x62\xa1\xfa\xca\x03\x6d" "\x9c\xc7\xdb\x66\x71\x57\x3e\x20\x2e\x0a\x92\xee\x4b\xa1\x2b\x06\x49\x85" "\xcc\x32\xd1\xac\x0b\x9e\xcc\x8f\x60\x4d\xca\xc2\x56\x3e\x1c\x90\x49\x17" "\x26\xde\x3b\x0a\xfc\xcc\x00\x00\x00\x00\x00\x00", 300); *(uint64_t*)0x2000000054d0 = 0x200000000100; memcpy((void*)0x200000000100, "GPL\000", 4); *(uint32_t*)0x2000000054d8 = 0; *(uint32_t*)0x2000000054dc = 0; *(uint64_t*)0x2000000054e0 = 0; *(uint32_t*)0x2000000054e8 = 0; *(uint32_t*)0x2000000054ec = 0; memset((void*)0x2000000054f0, 0, 16); *(uint32_t*)0x200000005500 = 0; *(uint32_t*)0x200000005504 = 0; *(uint32_t*)0x200000005508 = -1; *(uint32_t*)0x20000000550c = 8; *(uint64_t*)0x200000005510 = 0; *(uint32_t*)0x200000005518 = 0; *(uint32_t*)0x20000000551c = 0x10; *(uint64_t*)0x200000005520 = 0; *(uint32_t*)0x200000005528 = 0; *(uint32_t*)0x20000000552c = 0; *(uint32_t*)0x200000005530 = -1; *(uint32_t*)0x200000005534 = 0; *(uint64_t*)0x200000005538 = 0; *(uint64_t*)0x200000005540 = 0; *(uint32_t*)0x200000005548 = 0x10; *(uint32_t*)0x20000000554c = 0; *(uint32_t*)0x200000005550 = 0; syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x2000000054c0ul, /*size=*/0x48ul); return 0; }