// https://syzkaller.appspot.com/bug?id=7619688ea2fa147355bbecfde4f68fcabfdd8fa3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } struct nlmsg { char* pos; int nesting; struct nlattr* nested[8]; char buf[4096]; }; static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, const void* data, int size) { memset(nlmsg, 0, sizeof(*nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; if (size > 0) memcpy(attr + 1, data, size); nlmsg->pos += NLMSG_ALIGN(attr->nla_len); } static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, int* reply_len, bool dofail) { if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != (ssize_t)hdr->nlmsg_len) { if (dofail) exit(1); return -1; } n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); if (reply_len) *reply_len = 0; if (n < 0) { if (dofail) exit(1); return -1; } if (n < (ssize_t)sizeof(struct nlmsghdr)) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type == NLMSG_DONE) return 0; if (reply_len && hdr->nlmsg_type == reply_type) { *reply_len = n; return 0; } if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type != NLMSG_ERROR) { errno = EINVAL; if (dofail) exit(1); return -1; } errno = -((struct nlmsgerr*)(hdr + 1))->error; return -errno; } static int netlink_send(struct nlmsg* nlmsg, int sock) { return netlink_send_ext(nlmsg, sock, 0, NULL, true); } static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = CTRL_CMD_GETFAMILY; netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); int n = 0; int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); if (err < 0) { return -1; } uint16_t id = 0; struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { id = *(uint16_t*)(attr + 1); break; } } if (!id) { errno = EINVAL; return -1; } recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); return id; } static struct nlmsg nlmsg; #define WIFI_INITIAL_DEVICE_COUNT 2 #define WIFI_MAC_BASE {0x08, 0x02, 0x11, 0x00, 0x00, 0x00} #define WIFI_IBSS_BSSID {0x50, 0x50, 0x50, 0x50, 0x50, 0x50} #define WIFI_IBSS_SSID {0x10, 0x10, 0x10, 0x10, 0x10, 0x10} #define WIFI_DEFAULT_FREQUENCY 2412 #define WIFI_DEFAULT_SIGNAL 0 #define WIFI_DEFAULT_RX_RATE 1 #define HWSIM_CMD_REGISTER 1 #define HWSIM_CMD_FRAME 2 #define HWSIM_CMD_NEW_RADIO 4 #define HWSIM_ATTR_SUPPORT_P2P_DEVICE 14 #define HWSIM_ATTR_PERM_ADDR 22 #define IF_OPER_UP 6 struct join_ibss_props { int wiphy_freq; bool wiphy_freq_fixed; uint8_t* mac; uint8_t* ssid; int ssid_len; }; static int set_interface_state(const char* interface_name, int on) { struct ifreq ifr; int sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { return -1; } memset(&ifr, 0, sizeof(ifr)); strcpy(ifr.ifr_name, interface_name); int ret = ioctl(sock, SIOCGIFFLAGS, &ifr); if (ret < 0) { close(sock); return -1; } if (on) ifr.ifr_flags |= IFF_UP; else ifr.ifr_flags &= ~IFF_UP; ret = ioctl(sock, SIOCSIFFLAGS, &ifr); close(sock); if (ret < 0) { return -1; } return 0; } static int nl80211_set_interface(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, uint32_t iftype, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL80211_CMD_SET_INTERFACE; netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(nlmsg, NL80211_ATTR_IFTYPE, &iftype, sizeof(iftype)); int err = netlink_send_ext(nlmsg, sock, 0, NULL, dofail); if (err < 0) { } return err; } static int nl80211_join_ibss(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, struct join_ibss_props* props, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL80211_CMD_JOIN_IBSS; netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(nlmsg, NL80211_ATTR_SSID, props->ssid, props->ssid_len); netlink_attr(nlmsg, NL80211_ATTR_WIPHY_FREQ, &(props->wiphy_freq), sizeof(props->wiphy_freq)); if (props->mac) netlink_attr(nlmsg, NL80211_ATTR_MAC, props->mac, ETH_ALEN); if (props->wiphy_freq_fixed) netlink_attr(nlmsg, NL80211_ATTR_FREQ_FIXED, NULL, 0); int err = netlink_send_ext(nlmsg, sock, 0, NULL, dofail); if (err < 0) { } return err; } static int get_ifla_operstate(struct nlmsg* nlmsg, int ifindex, bool dofail) { struct ifinfomsg info; memset(&info, 0, sizeof(info)); info.ifi_family = AF_UNSPEC; info.ifi_index = ifindex; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) { return -1; } netlink_init(nlmsg, RTM_GETLINK, 0, &info, sizeof(info)); int n; int err = netlink_send_ext(nlmsg, sock, RTM_NEWLINK, &n, dofail); close(sock); if (err) { return -1; } struct rtattr* attr = IFLA_RTA(NLMSG_DATA(nlmsg->buf)); for (; RTA_OK(attr, n); attr = RTA_NEXT(attr, n)) { if (attr->rta_type == IFLA_OPERSTATE) return *((int32_t*)RTA_DATA(attr)); } return -1; } static int await_ifla_operstate(struct nlmsg* nlmsg, char* interface, int operstate, bool dofail) { int ifindex = if_nametoindex(interface); while (true) { usleep(1000); int ret = get_ifla_operstate(nlmsg, ifindex, dofail); if (ret < 0) return ret; if (ret == operstate) return 0; } return 0; } static int nl80211_setup_ibss_interface(struct nlmsg* nlmsg, int sock, int nl80211_family_id, char* interface, struct join_ibss_props* ibss_props, bool dofail) { int ifindex = if_nametoindex(interface); if (ifindex == 0) { return -1; } int ret = nl80211_set_interface(nlmsg, sock, nl80211_family_id, ifindex, NL80211_IFTYPE_ADHOC, dofail); if (ret < 0) { return -1; } ret = set_interface_state(interface, 1); if (ret < 0) { return -1; } ret = nl80211_join_ibss(nlmsg, sock, nl80211_family_id, ifindex, ibss_props, dofail); if (ret < 0) { return -1; } return 0; } static int hwsim80211_create_device(struct nlmsg* nlmsg, int sock, int hwsim_family, uint8_t mac_addr[ETH_ALEN]) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = HWSIM_CMD_NEW_RADIO; netlink_init(nlmsg, hwsim_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, HWSIM_ATTR_SUPPORT_P2P_DEVICE, NULL, 0); netlink_attr(nlmsg, HWSIM_ATTR_PERM_ADDR, mac_addr, ETH_ALEN); int err = netlink_send(nlmsg, sock); if (err < 0) { } return err; } static void initialize_wifi_devices(void) { int rfkill = open("/dev/rfkill", O_RDWR); if (rfkill == -1) exit(1); struct rfkill_event event = {0}; event.type = RFKILL_TYPE_ALL; event.op = RFKILL_OP_CHANGE_ALL; if (write(rfkill, &event, sizeof(event)) != (ssize_t)(sizeof(event))) exit(1); close(rfkill); uint8_t mac_addr[6] = WIFI_MAC_BASE; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock < 0) exit(1); int hwsim_family_id = netlink_query_family_id(&nlmsg, sock, "MAC80211_HWSIM", true); int nl80211_family_id = netlink_query_family_id(&nlmsg, sock, "nl80211", true); if (hwsim_family_id < 0 || nl80211_family_id < 0) exit(1); uint8_t ssid[] = WIFI_IBSS_SSID; uint8_t bssid[] = WIFI_IBSS_BSSID; struct join_ibss_props ibss_props = {.wiphy_freq = WIFI_DEFAULT_FREQUENCY, .wiphy_freq_fixed = true, .mac = bssid, .ssid = ssid, .ssid_len = sizeof(ssid)}; for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) { mac_addr[5] = device_id; int ret = hwsim80211_create_device(&nlmsg, sock, hwsim_family_id, mac_addr); if (ret < 0) exit(1); char interface[6] = "wlan0"; interface[4] += device_id; if (nl80211_setup_ibss_interface(&nlmsg, sock, nl80211_family_id, interface, &ibss_props, true) < 0) exit(1); } for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) { char interface[6] = "wlan0"; interface[4] += device_id; int ret = await_ifla_operstate(&nlmsg, interface, IF_OPER_UP, true); if (ret < 0) exit(1); } close(sock); } #define BTPROTO_HCI 1 #define ACL_LINK 1 #define SCAN_PAGE 2 typedef struct { uint8_t b[6]; } __attribute__((packed)) bdaddr_t; #define HCI_COMMAND_PKT 1 #define HCI_EVENT_PKT 4 #define HCI_VENDOR_PKT 0xff struct hci_command_hdr { uint16_t opcode; uint8_t plen; } __attribute__((packed)); struct hci_event_hdr { uint8_t evt; uint8_t plen; } __attribute__((packed)); #define HCI_EV_CONN_COMPLETE 0x03 struct hci_ev_conn_complete { uint8_t status; uint16_t handle; bdaddr_t bdaddr; uint8_t link_type; uint8_t encr_mode; } __attribute__((packed)); #define HCI_EV_CONN_REQUEST 0x04 struct hci_ev_conn_request { bdaddr_t bdaddr; uint8_t dev_class[3]; uint8_t link_type; } __attribute__((packed)); #define HCI_EV_REMOTE_FEATURES 0x0b struct hci_ev_remote_features { uint8_t status; uint16_t handle; uint8_t features[8]; } __attribute__((packed)); #define HCI_EV_CMD_COMPLETE 0x0e struct hci_ev_cmd_complete { uint8_t ncmd; uint16_t opcode; } __attribute__((packed)); #define HCI_OP_WRITE_SCAN_ENABLE 0x0c1a #define HCI_OP_READ_BUFFER_SIZE 0x1005 struct hci_rp_read_buffer_size { uint8_t status; uint16_t acl_mtu; uint8_t sco_mtu; uint16_t acl_max_pkt; uint16_t sco_max_pkt; } __attribute__((packed)); #define HCI_OP_READ_BD_ADDR 0x1009 struct hci_rp_read_bd_addr { uint8_t status; bdaddr_t bdaddr; } __attribute__((packed)); #define HCI_EV_LE_META 0x3e struct hci_ev_le_meta { uint8_t subevent; } __attribute__((packed)); #define HCI_EV_LE_CONN_COMPLETE 0x01 struct hci_ev_le_conn_complete { uint8_t status; uint16_t handle; uint8_t role; uint8_t bdaddr_type; bdaddr_t bdaddr; uint16_t interval; uint16_t latency; uint16_t supervision_timeout; uint8_t clk_accurancy; } __attribute__((packed)); struct hci_dev_req { uint16_t dev_id; uint32_t dev_opt; }; struct vhci_vendor_pkt_request { uint8_t type; uint8_t opcode; } __attribute__((packed)); struct vhci_pkt { uint8_t type; union { struct { uint8_t opcode; uint16_t id; } __attribute__((packed)) vendor_pkt; struct hci_command_hdr command_hdr; }; } __attribute__((packed)); #define HCIDEVUP _IOW('H', 201, int) #define HCISETSCAN _IOW('H', 221, int) static int vhci_fd = -1; static void rfkill_unblock_all() { int fd = open("/dev/rfkill", O_WRONLY); if (fd < 0) exit(1); struct rfkill_event event = {0}; event.idx = 0; event.type = RFKILL_TYPE_ALL; event.op = RFKILL_OP_CHANGE_ALL; event.soft = 0; event.hard = 0; if (write(fd, &event, sizeof(event)) < 0) exit(1); close(fd); } static void hci_send_event_packet(int fd, uint8_t evt, void* data, size_t data_len) { struct iovec iv[3]; struct hci_event_hdr hdr; hdr.evt = evt; hdr.plen = data_len; uint8_t type = HCI_EVENT_PKT; iv[0].iov_base = &type; iv[0].iov_len = sizeof(type); iv[1].iov_base = &hdr; iv[1].iov_len = sizeof(hdr); iv[2].iov_base = data; iv[2].iov_len = data_len; if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0) exit(1); } static void hci_send_event_cmd_complete(int fd, uint16_t opcode, void* data, size_t data_len) { struct iovec iv[4]; struct hci_event_hdr hdr; hdr.evt = HCI_EV_CMD_COMPLETE; hdr.plen = sizeof(struct hci_ev_cmd_complete) + data_len; struct hci_ev_cmd_complete evt_hdr; evt_hdr.ncmd = 1; evt_hdr.opcode = opcode; uint8_t type = HCI_EVENT_PKT; iv[0].iov_base = &type; iv[0].iov_len = sizeof(type); iv[1].iov_base = &hdr; iv[1].iov_len = sizeof(hdr); iv[2].iov_base = &evt_hdr; iv[2].iov_len = sizeof(evt_hdr); iv[3].iov_base = data; iv[3].iov_len = data_len; if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0) exit(1); } static bool process_command_pkt(int fd, char* buf, ssize_t buf_size) { struct hci_command_hdr* hdr = (struct hci_command_hdr*)buf; if (buf_size < (ssize_t)sizeof(struct hci_command_hdr) || hdr->plen != buf_size - sizeof(struct hci_command_hdr)) exit(1); switch (hdr->opcode) { case HCI_OP_WRITE_SCAN_ENABLE: { uint8_t status = 0; hci_send_event_cmd_complete(fd, hdr->opcode, &status, sizeof(status)); return true; } case HCI_OP_READ_BD_ADDR: { struct hci_rp_read_bd_addr rp = {0}; rp.status = 0; memset(&rp.bdaddr, 0xaa, 6); hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp)); return false; } case HCI_OP_READ_BUFFER_SIZE: { struct hci_rp_read_buffer_size rp = {0}; rp.status = 0; rp.acl_mtu = 1021; rp.sco_mtu = 96; rp.acl_max_pkt = 4; rp.sco_max_pkt = 6; hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp)); return false; } } char dummy[0xf9] = {0}; hci_send_event_cmd_complete(fd, hdr->opcode, dummy, sizeof(dummy)); return false; } static void* event_thread(void* arg) { while (1) { char buf[1024] = {0}; ssize_t buf_size = read(vhci_fd, buf, sizeof(buf)); if (buf_size < 0) exit(1); if (buf_size > 0 && buf[0] == HCI_COMMAND_PKT) { if (process_command_pkt(vhci_fd, buf + 1, buf_size - 1)) break; } } return NULL; } #define HCI_HANDLE_1 200 #define HCI_HANDLE_2 201 #define HCI_PRIMARY 0 #define HCI_OP_RESET 0x0c03 static void initialize_vhci() { int hci_sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI); if (hci_sock < 0) exit(1); vhci_fd = open("/dev/vhci", O_RDWR); if (vhci_fd == -1) exit(1); const int kVhciFd = 202; if (dup2(vhci_fd, kVhciFd) < 0) exit(1); close(vhci_fd); vhci_fd = kVhciFd; struct vhci_vendor_pkt_request vendor_pkt_req = {HCI_VENDOR_PKT, HCI_PRIMARY}; if (write(vhci_fd, &vendor_pkt_req, sizeof(vendor_pkt_req)) != sizeof(vendor_pkt_req)) exit(1); struct vhci_pkt vhci_pkt; if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt)) exit(1); if (vhci_pkt.type == HCI_COMMAND_PKT && vhci_pkt.command_hdr.opcode == HCI_OP_RESET) { char response[1] = {0}; hci_send_event_cmd_complete(vhci_fd, HCI_OP_RESET, response, sizeof(response)); if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt)) exit(1); } if (vhci_pkt.type != HCI_VENDOR_PKT) exit(1); int dev_id = vhci_pkt.vendor_pkt.id; pthread_t th; if (pthread_create(&th, NULL, event_thread, NULL)) exit(1); int ret = ioctl(hci_sock, HCIDEVUP, dev_id); if (ret) { if (errno == ERFKILL) { rfkill_unblock_all(); ret = ioctl(hci_sock, HCIDEVUP, dev_id); } if (ret && errno != EALREADY) exit(1); } struct hci_dev_req dr = {0}; dr.dev_id = dev_id; dr.dev_opt = SCAN_PAGE; if (ioctl(hci_sock, HCISETSCAN, &dr)) exit(1); struct hci_ev_conn_request request; memset(&request, 0, sizeof(request)); memset(&request.bdaddr, 0xaa, 6); *(uint8_t*)&request.bdaddr.b[5] = 0x10; request.link_type = ACL_LINK; hci_send_event_packet(vhci_fd, HCI_EV_CONN_REQUEST, &request, sizeof(request)); struct hci_ev_conn_complete complete; memset(&complete, 0, sizeof(complete)); complete.status = 0; complete.handle = HCI_HANDLE_1; memset(&complete.bdaddr, 0xaa, 6); *(uint8_t*)&complete.bdaddr.b[5] = 0x10; complete.link_type = ACL_LINK; complete.encr_mode = 0; hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete, sizeof(complete)); struct hci_ev_remote_features features; memset(&features, 0, sizeof(features)); features.status = 0; features.handle = HCI_HANDLE_1; hci_send_event_packet(vhci_fd, HCI_EV_REMOTE_FEATURES, &features, sizeof(features)); struct { struct hci_ev_le_meta le_meta; struct hci_ev_le_conn_complete le_conn; } le_conn; memset(&le_conn, 0, sizeof(le_conn)); le_conn.le_meta.subevent = HCI_EV_LE_CONN_COMPLETE; memset(&le_conn.le_conn.bdaddr, 0xaa, 6); *(uint8_t*)&le_conn.le_conn.bdaddr.b[5] = 0x11; le_conn.le_conn.role = 1; le_conn.le_conn.handle = HCI_HANDLE_2; hci_send_event_packet(vhci_fd, HCI_EV_LE_META, &le_conn, sizeof(le_conn)); pthread_join(th, NULL); close(hci_sock); } static void setup_gadgetfs(); static void setup_binderfs(); static void setup_fusectl(); static void sandbox_common_mount_tmpfs(void) { write_file("/proc/sys/fs/mount-max", "100000"); if (mkdir("./syz-tmp", 0777)) exit(1); if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot", 0777)) exit(1); if (mkdir("./syz-tmp/newroot/dev", 0700)) exit(1); unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE; if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/proc", 0700)) exit(1); if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/selinux", 0700)) exit(1); const char* selinux_path = "./syz-tmp/newroot/selinux"; if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) { if (errno != ENOENT) exit(1); if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); } if (mkdir("./syz-tmp/newroot/sys", 0700)) exit(1); if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL)) exit(1); if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/newroot/syz-inputs", 0700)) exit(1); if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, bind_mount_flags | MS_RDONLY, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/pivot", 0777)) exit(1); if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { if (chdir("./syz-tmp")) exit(1); } else { if (chdir("/")) exit(1); if (umount2("./pivot", MNT_DETACH)) exit(1); } if (chroot("./newroot")) exit(1); if (chdir("/")) exit(1); setup_gadgetfs(); setup_binderfs(); setup_fusectl(); } static void setup_gadgetfs() { if (mkdir("/dev/gadgetfs", 0777)) { } if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) { } } static void setup_fusectl() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void setup_binderfs() { if (mkdir("/dev/binderfs", 0777)) { } if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); if (getppid() == 1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); initialize_vhci(); sandbox_common(); drop_caps(); if (unshare(CLONE_NEWNET)) { } write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); initialize_wifi_devices(); sandbox_common_mount_tmpfs(); loop(); exit(1); } static const char* setup_usb() { if (chmod("/dev/raw-gadget", 0666)) return "failed to chmod /dev/raw-gadget"; return NULL; } uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void loop(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // perf_event_open arguments: [ // attr: ptr[in, perf_event_attr] { // perf_event_attr { // type: perf_event_type = 0x5 (4 bytes) // size: len = 0x80 (4 bytes) // config0: int8 = 0x0 (1 bytes) // config1: int8 = 0x0 (1 bytes) // config2: int8 = 0x0 (1 bytes) // config3: int8 = 0x0 (1 bytes) // config4: const = 0x0 (4 bytes) // sample_freq: int64 = 0x5 (8 bytes) // sample_type: perf_sample_type = 0x0 (8 bytes) // read_format: perf_read_format = 0x0 (8 bytes) // disabled: int64 = 0x0 (0 bytes) // inherit: int64 = 0x0 (0 bytes) // pinned: int64 = 0x0 (0 bytes) // exclusive: int64 = 0x0 (0 bytes) // exclude_user: int64 = 0x0 (0 bytes) // exclude_kernel: int64 = 0x0 (0 bytes) // exclude_hv: int64 = 0x0 (0 bytes) // exclude_idle: int64 = 0x0 (0 bytes) // mmap: int64 = 0x0 (0 bytes) // comm: int64 = 0x0 (0 bytes) // freq: int64 = 0x0 (0 bytes) // inherit_stat: int64 = 0x0 (0 bytes) // enable_on_exec: int64 = 0x0 (0 bytes) // task: int64 = 0x0 (0 bytes) // watermark: int64 = 0x0 (0 bytes) // precise_ip: int64 = 0x0 (0 bytes) // mmap_data: int64 = 0x0 (0 bytes) // sample_id_all: int64 = 0x0 (0 bytes) // exclude_host: int64 = 0x0 (0 bytes) // exclude_guest: int64 = 0x0 (0 bytes) // exclude_callchain_kernel: int64 = 0x0 (0 bytes) // exclude_callchain_user: int64 = 0x0 (0 bytes) // mmap2: int64 = 0x0 (0 bytes) // comm_exec: int64 = 0x0 (0 bytes) // use_clockid: int64 = 0x0 (0 bytes) // context_switch: int64 = 0x0 (0 bytes) // write_backward: int64 = 0x0 (0 bytes) // namespaces: int64 = 0x0 (0 bytes) // ksymbol: int64 = 0x0 (0 bytes) // bpf_event: int64 = 0x0 (0 bytes) // aux_output: int64 = 0x0 (0 bytes) // cgroup: int64 = 0x0 (0 bytes) // text_poke: int64 = 0x0 (0 bytes) // build_id: int64 = 0x0 (0 bytes) // inherit_thread: int64 = 0x0 (0 bytes) // remove_on_exec: int64 = 0x0 (0 bytes) // sigtrap: int64 = 0x0 (0 bytes) // __reserved_1: const = 0x0 (8 bytes) // wakeup_events: int32 = 0x0 (4 bytes) // bp_type: perf_bp_type = 0x3 (4 bytes) // bp_config: union perf_bp_config { // perf_bp: perf_bp { // bp_addr: ptr[out, int8] { // int8 = 0x0 (1 bytes) // } // bp_len: perf_bp_lens = 0x4 (8 bytes) // } // } // branch_sample_type: perf_branch_sample_type = 0x4044 (8 bytes) // sample_regs_user: int64 = 0x0 (8 bytes) // sample_stack_user: int32 = 0x0 (4 bytes) // clockid: clock_type = 0x0 (4 bytes) // sample_regs_intr: int64 = 0x0 (8 bytes) // aux_watermark: int32 = 0x0 (4 bytes) // sample_max_stack: int16 = 0x0 (2 bytes) // __reserved_2: const = 0x0 (2 bytes) // aux_sample_size: int32 = 0x0 (4 bytes) // __reserved_3: const = 0x0 (4 bytes) // sig_data: int64 = 0x0 (8 bytes) // } // } // pid: pid (resource) // cpu: intptr = 0xffffffffffffffff (8 bytes) // group: fd_perf (resource) // flags: perf_flags = 0xb (8 bytes) // ] // returns fd_perf NONFAILING(*(uint32_t*)0x200000000100 = 5); NONFAILING(*(uint32_t*)0x200000000104 = 0x80); NONFAILING(*(uint8_t*)0x200000000108 = 0); NONFAILING(*(uint8_t*)0x200000000109 = 0); NONFAILING(*(uint8_t*)0x20000000010a = 0); NONFAILING(*(uint8_t*)0x20000000010b = 0); NONFAILING(*(uint32_t*)0x20000000010c = 0); NONFAILING(*(uint64_t*)0x200000000110 = 5); NONFAILING(*(uint64_t*)0x200000000118 = 0); NONFAILING(*(uint64_t*)0x200000000120 = 0); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 0, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 1, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 2, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 4, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 5, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 7, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 8, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 9, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 10, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 11, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 12, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 13, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 14, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 15, 2)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 17, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 18, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 19, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 20, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 21, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 22, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 23, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 24, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 25, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 26, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 27, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 28, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 29, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 30, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 31, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 32, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 33, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 34, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 35, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 36, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 37, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000128, 0, 38, 26)); NONFAILING(*(uint32_t*)0x200000000130 = 0); NONFAILING(*(uint32_t*)0x200000000134 = 3); NONFAILING(*(uint64_t*)0x200000000138 = 0x200000000300); NONFAILING(*(uint64_t*)0x200000000140 = 4); NONFAILING(*(uint64_t*)0x200000000148 = 0x4044); NONFAILING(*(uint64_t*)0x200000000150 = 0); NONFAILING(*(uint32_t*)0x200000000158 = 0); NONFAILING(*(uint32_t*)0x20000000015c = 0); NONFAILING(*(uint64_t*)0x200000000160 = 0); NONFAILING(*(uint32_t*)0x200000000168 = 0); NONFAILING(*(uint16_t*)0x20000000016c = 0); NONFAILING(*(uint16_t*)0x20000000016e = 0); NONFAILING(*(uint32_t*)0x200000000170 = 0); NONFAILING(*(uint32_t*)0x200000000174 = 0); NONFAILING(*(uint64_t*)0x200000000178 = 0); res = syscall( __NR_perf_event_open, /*attr=*/0x200000000100ul, /*pid=*/0, /*cpu=*/(intptr_t)-1, /*group=*/(intptr_t)-1, /*flags=PERF_FLAG_FD_CLOEXEC|PERF_FLAG_FD_OUTPUT|PERF_FLAG_FD_NO_GROUP*/ 0xbul); if (res != -1) r[0] = res; // bpf$MAP_CREATE arguments: [ // cmd: const = 0x0 (8 bytes) // arg: ptr[in, bpf_map_create_arg] { // union bpf_map_create_arg { // base: bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, // int32, flags[map_flags, int32], const[0, int64]] { // type: bpf_map_type = 0x9 (4 bytes) // ksize: int32 = 0x1 (4 bytes) // vsize: int32 = 0x7fe2 (4 bytes) // max: int32 = 0x1 (4 bytes) // flags: map_flags = 0x12 (4 bytes) // inner: fd_bpf_map (resource) // node: int32 = 0x0 (4 bytes) // map_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00} (length 0x10) map_ifindex: ifindex (resource) btf_fd: fd_btf // (resource) btf_key_type_id: int32 = 0x0 (4 bytes) // btf_value_type_id: int32 = 0x0 (4 bytes) // btf_vmlinux_type_id: int32 = 0x0 (4 bytes) // map_extra: const = 0x0 (8 bytes) // value_type_btf_obj_fd: union // _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, // int32, flags[map_flags, int32], const[0, // int64]]_value_type_btf_obj_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad1: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], // int32, int32, int32, flags[map_flags, int32], const[0, // int64]]_pad1_wrapper { // value: const = 0x0 (4 bytes) // } // map_token_fd: union _bpf_map_create_arg_t[flags[bpf_map_type, // int32], int32, int32, int32, flags[map_flags, int32], const[0, // int64]]_map_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad2: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], // int32, int32, int32, flags[map_flags, int32], const[0, // int64]]_pad2_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // } // size: len = 0x50 (8 bytes) // ] // returns fd_bpf_map NONFAILING(*(uint32_t*)0x200000000340 = 9); NONFAILING(*(uint32_t*)0x200000000344 = 1); NONFAILING(*(uint32_t*)0x200000000348 = 0x7fe2); NONFAILING(*(uint32_t*)0x20000000034c = 1); NONFAILING(*(uint32_t*)0x200000000350 = 0x12); NONFAILING(*(uint32_t*)0x200000000354 = -1); NONFAILING(*(uint32_t*)0x200000000358 = 0); NONFAILING(memset((void*)0x20000000035c, 0, 16)); NONFAILING(*(uint32_t*)0x20000000036c = 0); NONFAILING(*(uint32_t*)0x200000000370 = -1); NONFAILING(*(uint32_t*)0x200000000374 = 0); NONFAILING(*(uint32_t*)0x200000000378 = 0); NONFAILING(*(uint32_t*)0x20000000037c = 0); NONFAILING(*(uint64_t*)0x200000000380 = 0); NONFAILING(*(uint32_t*)0x200000000388 = 0); NONFAILING(*(uint32_t*)0x20000000038c = 0); res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200000000340ul, /*size=*/0x50ul); if (res != -1) r[1] = res; // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0x0 (4 bytes) // ninsn: bytesize8 = 0xc (4 bytes) // insns: ptr[in, bpf_instructions] { // union bpf_instructions { // framed: bpf_framed_program { // initr0: bpf_insn_init_r0 { // code: const = 0x18 (1 bytes) // dst: const = 0x0 (0 bytes) // src: const = 0x0 (1 bytes) // off: const = 0x0 (2 bytes) // imm: int32 = 0x0 (4 bytes) // code2: const = 0x0 (1 bytes) // regs2: const = 0x0 (1 bytes) // off2: const = 0x0 (2 bytes) // imm2: int32 = 0x0 (4 bytes) // } // body: array[bpf_insn] { // union bpf_insn { // ringbuf_output: bpf_insn_ringbuf_output { // insn1: bpf_insn_map_fd_t[const[BPF_REG_1, int8:4], // tail_call_map] { // code: const = 0x18 (1 bytes) // dst: const = 0x1 (0 bytes) // src: const = 0x1 (1 bytes) // off: const = 0x0 (2 bytes) // imm: tail_call_map (resource) // code2: const = 0x0 (1 bytes) // regs2: const = 0x0 (1 bytes) // off2: const = 0x0 (2 bytes) // imm2: const = 0x0 (4 bytes) // } // insn2: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, // const[BPF_REG_8, int8:4], const[0, int8:4], const[0, // int16], int32] { // code_class: int8 = 0x7 (0 bytes) // code_s: int8 = 0x0 (0 bytes) // code_op: int8 = 0xb (1 bytes) // dst: const = 0x8 (0 bytes) // src: const = 0x0 (1 bytes) // off: const = 0x0 (2 bytes) // imm: int32 = 0x0 (4 bytes) // } // insn3: bpf_insn_ldst_t[BPF_STX, BPF_DW0, BPF_MEM0, // const[BPF_REG_10, int8:4], const[BPF_REG_8, int8:4], // const[-8, int16], const[0, int32]] { // code_class: int8 = 0x3 (0 bytes) // code_size: int8 = 0x3 (0 bytes) // code_mode: int8 = 0x3 (1 bytes) // dst: const = 0xa (0 bytes) // src: const = 0x8 (1 bytes) // off: const = 0xfff8 (2 bytes) // imm: const = 0x0 (4 bytes) // } // insn4: bpf_insn_alu_t[BPF_ALU64, BPF_X0, BPF_MOV0, // const[BPF_REG_2, int8:4], const[BPF_REG_10, int8:4], // const[0, int16], const[0, int32]] { // code_class: int8 = 0x7 (0 bytes) // code_s: int8 = 0x1 (0 bytes) // code_op: int8 = 0xb (1 bytes) // dst: const = 0x2 (0 bytes) // src: const = 0xa (1 bytes) // off: const = 0x0 (2 bytes) // imm: const = 0x0 (4 bytes) // } // insn5: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_ADD0, // const[BPF_REG_2, int8:4], const[0, int8:4], const[0, // int16], const[-8, int32]] { // code_class: int8 = 0x7 (0 bytes) // code_s: int8 = 0x0 (0 bytes) // code_op: int8 = 0x0 (1 bytes) // dst: const = 0x2 (0 bytes) // src: const = 0x0 (1 bytes) // off: const = 0x0 (2 bytes) // imm: const = 0xfffffff8 (4 bytes) // } // insn6: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, // const[BPF_REG_3, int8:4], const[0, int8:4], const[0, // int16], const[8, int32]] { // code_class: int8 = 0x7 (0 bytes) // code_s: int8 = 0x0 (0 bytes) // code_op: int8 = 0xb (1 bytes) // dst: const = 0x3 (0 bytes) // src: const = 0x0 (1 bytes) // off: const = 0x0 (2 bytes) // imm: const = 0x8 (4 bytes) // } // insn7: bpf_insn_alu_t[BPF_ALU64, BPF_K0, BPF_MOV0, // const[BPF_REG_4, int8:4], const[0, int8:4], const[0, // int16], flags[bpf_ringbuf_wakeup_flags, int32]] { // code_class: int8 = 0x7 (0 bytes) // code_s: int8 = 0x0 (0 bytes) // code_op: int8 = 0xb (1 bytes) // dst: const = 0x4 (0 bytes) // src: const = 0x0 (1 bytes) // off: const = 0x0 (2 bytes) // imm: bpf_ringbuf_wakeup_flags = 0x0 (4 bytes) // } // insn8: // bpf_insn_call_helper_t[const[BPF_FUNC_ringbuf_output, // int32]] { // code: const = 0x85 (1 bytes) // regs: const = 0x0 (1 bytes) // off: const = 0x0 (2 bytes) // func: const = 0x3 (4 bytes) // } // } // } // } // exit: bpf_insn_exit { // code: const = 0x95 (1 bytes) // regs: const = 0x0 (1 bytes) // off: const = 0x0 (2 bytes) // imm: const = 0x0 (4 bytes) // } // } // } // } // license: nil // loglev: int32 = 0x0 (4 bytes) // logsize: len = 0x0 (4 bytes) // log: nil // kern_version: bpf_kern_version = 0x0 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // fallback: bpf_attach_types = 0x0 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x0 (4 bytes) // func_info: nil // func_info_cnt: len = 0x0 (4 bytes) // line_info_rec_size: const = 0x0 (4 bytes) // line_info: nil // line_info_cnt: len = 0x0 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x0 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x94 (8 bytes) // ] // returns fd_bpf_prog NONFAILING(*(uint32_t*)0x200000000580 = 0); NONFAILING(*(uint32_t*)0x200000000584 = 0xc); NONFAILING(*(uint64_t*)0x200000000588 = 0x200000000440); NONFAILING(*(uint8_t*)0x200000000440 = 0x18); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000441, 0, 0, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000441, 0, 4, 4)); NONFAILING(*(uint16_t*)0x200000000442 = 0); NONFAILING(*(uint32_t*)0x200000000444 = 0); NONFAILING(*(uint8_t*)0x200000000448 = 0); NONFAILING(*(uint8_t*)0x200000000449 = 0); NONFAILING(*(uint16_t*)0x20000000044a = 0); NONFAILING(*(uint32_t*)0x20000000044c = 0); NONFAILING(*(uint8_t*)0x200000000450 = 0x18); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000451, 1, 0, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000451, 1, 4, 4)); NONFAILING(*(uint16_t*)0x200000000452 = 0); NONFAILING(*(uint32_t*)0x200000000454 = r[1]); NONFAILING(*(uint8_t*)0x200000000458 = 0); NONFAILING(*(uint8_t*)0x200000000459 = 0); NONFAILING(*(uint16_t*)0x20000000045a = 0); NONFAILING(*(uint32_t*)0x20000000045c = 0); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000460, 7, 0, 3)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000460, 0, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000460, 0xb, 4, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000461, 8, 0, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000461, 0, 4, 4)); NONFAILING(*(uint16_t*)0x200000000462 = 0); NONFAILING(*(uint32_t*)0x200000000464 = 0); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000468, 3, 0, 3)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000468, 3, 3, 2)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000468, 3, 5, 3)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000469, 0xa, 0, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000469, 8, 4, 4)); NONFAILING(*(uint16_t*)0x20000000046a = 0xfff8); NONFAILING(*(uint32_t*)0x20000000046c = 0); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000470, 7, 0, 3)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000470, 1, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000470, 0xb, 4, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000471, 2, 0, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000471, 0xa, 4, 4)); NONFAILING(*(uint16_t*)0x200000000472 = 0); NONFAILING(*(uint32_t*)0x200000000474 = 0); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000478, 7, 0, 3)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000478, 0, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000478, 0, 4, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000479, 2, 0, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000479, 0, 4, 4)); NONFAILING(*(uint16_t*)0x20000000047a = 0); NONFAILING(*(uint32_t*)0x20000000047c = 0xfffffff8); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000480, 7, 0, 3)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000480, 0, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000480, 0xb, 4, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000481, 3, 0, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000481, 0, 4, 4)); NONFAILING(*(uint16_t*)0x200000000482 = 0); NONFAILING(*(uint32_t*)0x200000000484 = 8); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000488, 7, 0, 3)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000488, 0, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000488, 0xb, 4, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000489, 4, 0, 4)); NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x200000000489, 0, 4, 4)); NONFAILING(*(uint16_t*)0x20000000048a = 0); NONFAILING(*(uint32_t*)0x20000000048c = 0); NONFAILING(*(uint8_t*)0x200000000490 = 0x85); NONFAILING(*(uint8_t*)0x200000000491 = 0); NONFAILING(*(uint16_t*)0x200000000492 = 0); NONFAILING(*(uint32_t*)0x200000000494 = 3); NONFAILING(*(uint8_t*)0x200000000498 = 0x95); NONFAILING(*(uint8_t*)0x200000000499 = 0); NONFAILING(*(uint16_t*)0x20000000049a = 0); NONFAILING(*(uint32_t*)0x20000000049c = 0); NONFAILING(*(uint64_t*)0x200000000590 = 0); NONFAILING(*(uint32_t*)0x200000000598 = 0); NONFAILING(*(uint32_t*)0x20000000059c = 0); NONFAILING(*(uint64_t*)0x2000000005a0 = 0); NONFAILING(*(uint32_t*)0x2000000005a8 = 0); NONFAILING(*(uint32_t*)0x2000000005ac = 0); NONFAILING(memset((void*)0x2000000005b0, 0, 16)); NONFAILING(*(uint32_t*)0x2000000005c0 = 0); NONFAILING(*(uint32_t*)0x2000000005c4 = 0); NONFAILING(*(uint32_t*)0x2000000005c8 = -1); NONFAILING(*(uint32_t*)0x2000000005cc = 0); NONFAILING(*(uint64_t*)0x2000000005d0 = 0); NONFAILING(*(uint32_t*)0x2000000005d8 = 0); NONFAILING(*(uint32_t*)0x2000000005dc = 0); NONFAILING(*(uint64_t*)0x2000000005e0 = 0); NONFAILING(*(uint32_t*)0x2000000005e8 = 0); NONFAILING(*(uint32_t*)0x2000000005ec = 0); NONFAILING(*(uint32_t*)0x2000000005f0 = 0); NONFAILING(*(uint32_t*)0x2000000005f4 = 0); NONFAILING(*(uint64_t*)0x2000000005f8 = 0); NONFAILING(*(uint64_t*)0x200000000600 = 0); NONFAILING(*(uint32_t*)0x200000000608 = 0); NONFAILING(*(uint32_t*)0x20000000060c = 0); NONFAILING(*(uint32_t*)0x200000000610 = 0); syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000580ul, /*size=*/0x94ul); // bpf$MAP_UPDATE_BATCH arguments: [ // cmd: const = 0x1a (8 bytes) // arg: ptr[in, bpf_map_batch_arg] { // bpf_map_batch_arg { // in_batch: nil // out_batch: nil // key: ptr[in, buffer] { // buffer: {} (length 0x0) // } // val: ptr[in, buffer] { // buffer: {} (length 0x0) // } // count: int32 = 0x80000002 (4 bytes) // map_fd: fd_bpf_map (resource) // elem_flags: bpf_batch_flags = 0x0 (8 bytes) // flags: const = 0x0 (8 bytes) // } // } // size: len = 0x38 (8 bytes) // ] NONFAILING(*(uint64_t*)0x200000000200 = 0); NONFAILING(*(uint64_t*)0x200000000208 = 0); NONFAILING(*(uint64_t*)0x200000000210 = 0x2000000002c0); NONFAILING(*(uint64_t*)0x200000000218 = 0x200000000740); NONFAILING(*(uint32_t*)0x200000000220 = 0x80000002); NONFAILING(*(uint32_t*)0x200000000224 = r[1]); NONFAILING(*(uint64_t*)0x200000000228 = 0); NONFAILING(*(uint64_t*)0x200000000230 = 0); syscall(__NR_bpf, /*cmd=*/0x1aul, /*arg=*/0x200000000200ul, /*size=*/0x38ul); // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0x7 (4 bytes) // ninsn: bytesize8 = 0xc (4 bytes) // insns: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // } // } // license: ptr[in, buffer] { // buffer: {47 50 4c 00} (length 0x4) // } // loglev: int32 = 0x0 (4 bytes) // logsize: len = 0x0 (4 bytes) // log: nil // kern_version: bpf_kern_version = 0x0 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // fallback: bpf_attach_types = 0x24 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x0 (4 bytes) // func_info: nil // func_info_cnt: len = 0x0 (4 bytes) // line_info_rec_size: const = 0x0 (4 bytes) // line_info: nil // line_info_cnt: len = 0x0 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x0 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x94 (8 bytes) // ] // returns fd_bpf_prog NONFAILING(*(uint32_t*)0x2000000005c0 = 7); NONFAILING(*(uint32_t*)0x2000000005c4 = 0xc); NONFAILING(*(uint64_t*)0x2000000005c8 = 0x200000000440); NONFAILING(*(uint64_t*)0x2000000005d0 = 0x200000000240); NONFAILING(memcpy((void*)0x200000000240, "GPL\000", 4)); NONFAILING(*(uint32_t*)0x2000000005d8 = 0); NONFAILING(*(uint32_t*)0x2000000005dc = 0); NONFAILING(*(uint64_t*)0x2000000005e0 = 0); NONFAILING(*(uint32_t*)0x2000000005e8 = 0); NONFAILING(*(uint32_t*)0x2000000005ec = 0); NONFAILING(memset((void*)0x2000000005f0, 0, 16)); NONFAILING(*(uint32_t*)0x200000000600 = 0); NONFAILING(*(uint32_t*)0x200000000604 = 0x24); NONFAILING(*(uint32_t*)0x200000000608 = -1); NONFAILING(*(uint32_t*)0x20000000060c = 0); NONFAILING(*(uint64_t*)0x200000000610 = 0); NONFAILING(*(uint32_t*)0x200000000618 = 0); NONFAILING(*(uint32_t*)0x20000000061c = 0); NONFAILING(*(uint64_t*)0x200000000620 = 0); NONFAILING(*(uint32_t*)0x200000000628 = 0); NONFAILING(*(uint32_t*)0x20000000062c = 0); NONFAILING(*(uint32_t*)0x200000000630 = 0); NONFAILING(*(uint32_t*)0x200000000634 = 0); NONFAILING(*(uint64_t*)0x200000000638 = 0); NONFAILING(*(uint64_t*)0x200000000640 = 0); NONFAILING(*(uint32_t*)0x200000000648 = 0); NONFAILING(*(uint32_t*)0x20000000064c = 0); NONFAILING(*(uint32_t*)0x200000000650 = 0); res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x2000000005c0ul, /*size=*/0x94ul); if (res != -1) r[2] = res; // ioctl$PERF_EVENT_IOC_SET_BPF arguments: [ // fd: fd_perf (resource) // cmd: const = 0x40042408 (4 bytes) // prog: fd_bpf_prog (resource) // ] syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40042408, /*prog=*/r[2]); // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0x1 (4 bytes) // ninsn: bytesize8 = 0x4 (4 bytes) // insns: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {b7 05 00 00 00 00 00 00 79 10 a8 00 00 00 00 // 00 1d 0a 00 00 00 00 00 00 95 00 00 00 00 00 00 00 08 06 ff 63 // 0a e1 a6 b3 15 38 53 bd b4 64 f7 43 85 d7 b1 31 9f 24 66 b3 d7 // ed d8 47 90 9d da f8 e8 3e f1 88 a3 20 05 54 a5 e4 03 c7 62 47 // f6 24 af 44 2d 11 d7 12 ff 15 b5 dc 5d 81 de bc f5 a1 28 d2 85 // 67 83 f4 14 8b f5 37 98 f6 c7 e1 84 cd d6 14 8c ba 66 e2 1e cb // da 60 4b 4b 0e d6 ec be 14 bf aa 10 aa ed e3 ed 5e 07 c0 89 3a // 19 a1 c9 f2 83 46 e5 72 38 cf 70 f0 3a 84 b1 66 5e b9 03 e6 ea // 0b d4 d2 60 b4 ff 14 58 23 29 22 0e 0a 6a f4 af 66 49 a8 18 a8 // bc} (length 0xb8) // } // } // } // license: ptr[in, buffer] { // buffer: {47 50 4c 00} (length 0x4) // } // loglev: int32 = 0x5 (4 bytes) // logsize: len = 0xfd90 (4 bytes) // log: ptr[out, buffer] { // buffer: (DirOut) // } // kern_version: bpf_kern_version = 0x0 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // fallback: bpf_attach_types = 0x0 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x8 (4 bytes) // func_info: ptr[in, bpf_func_info] { // bpf_func_info { // insn_off: int32 = 0x0 (4 bytes) // type_id: int32 = 0x0 (4 bytes) // } // } // func_info_cnt: len = 0x1f3 (4 bytes) // line_info_rec_size: const = 0x10 (4 bytes) // line_info: ptr[in, bpf_line_info] { // bpf_line_info { // insn_off: int32 = 0x0 (4 bytes) // file_name_off: int32 = 0x0 (4 bytes) // line_off: int32 = 0x0 (4 bytes) // line_col: int32 = 0x0 (4 bytes) // } // } // line_info_cnt: len = 0xfffffffffffffc79 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x10 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x2a (8 bytes) // ] // returns fd_bpf_prog NONFAILING(*(uint32_t*)0x200000000240 = 1); NONFAILING(*(uint32_t*)0x200000000244 = 4); NONFAILING(*(uint64_t*)0x200000000248 = 0x200000000540); NONFAILING(memcpy( (void*)0x200000000540, "\xb7\x05\x00\x00\x00\x00\x00\x00\x79\x10\xa8\x00\x00\x00\x00\x00\x1d\x0a" "\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x08\x06\xff\x63" "\x0a\xe1\xa6\xb3\x15\x38\x53\xbd\xb4\x64\xf7\x43\x85\xd7\xb1\x31\x9f\x24" "\x66\xb3\xd7\xed\xd8\x47\x90\x9d\xda\xf8\xe8\x3e\xf1\x88\xa3\x20\x05\x54" "\xa5\xe4\x03\xc7\x62\x47\xf6\x24\xaf\x44\x2d\x11\xd7\x12\xff\x15\xb5\xdc" "\x5d\x81\xde\xbc\xf5\xa1\x28\xd2\x85\x67\x83\xf4\x14\x8b\xf5\x37\x98\xf6" "\xc7\xe1\x84\xcd\xd6\x14\x8c\xba\x66\xe2\x1e\xcb\xda\x60\x4b\x4b\x0e\xd6" "\xec\xbe\x14\xbf\xaa\x10\xaa\xed\xe3\xed\x5e\x07\xc0\x89\x3a\x19\xa1\xc9" "\xf2\x83\x46\xe5\x72\x38\xcf\x70\xf0\x3a\x84\xb1\x66\x5e\xb9\x03\xe6\xea" "\x0b\xd4\xd2\x60\xb4\xff\x14\x58\x23\x29\x22\x0e\x0a\x6a\xf4\xaf\x66\x49" "\xa8\x18\xa8\xbc", 184)); NONFAILING(*(uint64_t*)0x200000000250 = 0x2000000002c0); NONFAILING(memcpy((void*)0x2000000002c0, "GPL\000", 4)); NONFAILING(*(uint32_t*)0x200000000258 = 5); NONFAILING(*(uint32_t*)0x20000000025c = 0xfd90); NONFAILING(*(uint64_t*)0x200000000260 = 0x200000000300); NONFAILING(*(uint32_t*)0x200000000268 = 0); NONFAILING(*(uint32_t*)0x20000000026c = 0); NONFAILING(memset((void*)0x200000000270, 0, 16)); NONFAILING(*(uint32_t*)0x200000000280 = 0); NONFAILING(*(uint32_t*)0x200000000284 = 0); NONFAILING(*(uint32_t*)0x200000000288 = -1); NONFAILING(*(uint32_t*)0x20000000028c = 8); NONFAILING(*(uint64_t*)0x200000000290 = 0x200000000000); NONFAILING(*(uint32_t*)0x200000000000 = 0); NONFAILING(*(uint32_t*)0x200000000004 = 0); NONFAILING(*(uint32_t*)0x200000000298 = 0x1f3); NONFAILING(*(uint32_t*)0x20000000029c = 0x10); NONFAILING(*(uint64_t*)0x2000000002a0 = 0x200000000080); NONFAILING(*(uint32_t*)0x200000000080 = 0); NONFAILING(*(uint32_t*)0x200000000084 = 0); NONFAILING(*(uint32_t*)0x200000000088 = 0); NONFAILING(*(uint32_t*)0x20000000008c = 0); NONFAILING(*(uint32_t*)0x2000000002a8 = 0xfffffc79); NONFAILING(*(uint32_t*)0x2000000002ac = 0); NONFAILING(*(uint32_t*)0x2000000002b0 = -1); NONFAILING(*(uint32_t*)0x2000000002b4 = 0); NONFAILING(*(uint64_t*)0x2000000002b8 = 0); NONFAILING(*(uint64_t*)0x2000000002c0 = 0); NONFAILING(*(uint32_t*)0x2000000002c8 = 0x10); NONFAILING(*(uint32_t*)0x2000000002cc = 0); NONFAILING(*(uint32_t*)0x2000000002d0 = 0); syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000240ul, /*size=*/0x2aul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; if ((reason = setup_usb())) printf("the reproducer may not work as expected: USB injection setup " "failed: %s\n", reason); install_segv_handler(); use_temporary_dir(); do_sandbox_none(); return 0; }