// https://syzkaller.appspot.com/bug?id=3543b2daaecd0dd430ea6fe8a8543ac1fd681e25 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_io_uring_setup #define __NR_io_uring_setup 425 #endif static unsigned long long procid; static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } struct nlmsg { char* pos; int nesting; struct nlattr* nested[8]; char buf[4096]; }; static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, const void* data, int size) { memset(nlmsg, 0, sizeof(*nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; if (size > 0) memcpy(attr + 1, data, size); nlmsg->pos += NLMSG_ALIGN(attr->nla_len); } static void netlink_nest(struct nlmsg* nlmsg, int typ) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_type = typ; nlmsg->pos += sizeof(*attr); nlmsg->nested[nlmsg->nesting++] = attr; } static void netlink_done(struct nlmsg* nlmsg) { struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; attr->nla_len = nlmsg->pos - (char*)attr; } static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, int* reply_len, bool dofail) { if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != (ssize_t)hdr->nlmsg_len) { if (dofail) exit(1); return -1; } n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); if (reply_len) *reply_len = 0; if (n < 0) { if (dofail) exit(1); return -1; } if (n < (ssize_t)sizeof(struct nlmsghdr)) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type == NLMSG_DONE) return 0; if (reply_len && hdr->nlmsg_type == reply_type) { *reply_len = n; return 0; } if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type != NLMSG_ERROR) { errno = EINVAL; if (dofail) exit(1); return -1; } errno = -((struct nlmsgerr*)(hdr + 1))->error; return -errno; } static int netlink_send(struct nlmsg* nlmsg, int sock) { return netlink_send_ext(nlmsg, sock, 0, NULL, true); } static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = CTRL_CMD_GETFAMILY; netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); int n = 0; int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); if (err < 0) { return -1; } uint16_t id = 0; struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { id = *(uint16_t*)(attr + 1); break; } } if (!id) { errno = EINVAL; return -1; } recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); return id; } static int netlink_next_msg(struct nlmsg* nlmsg, unsigned int offset, unsigned int total_len) { struct nlmsghdr* hdr = (struct nlmsghdr*)(nlmsg->buf + offset); if (offset == total_len || offset + hdr->nlmsg_len > total_len) return -1; return hdr->nlmsg_len; } static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type, const char* name, bool up) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); if (name) netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); netlink_nest(nlmsg, IFLA_LINKINFO); netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type)); } static void netlink_add_device(struct nlmsg* nlmsg, int sock, const char* type, const char* name) { netlink_add_device_impl(nlmsg, type, name, false); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_veth(struct nlmsg* nlmsg, int sock, const char* name, const char* peer) { netlink_add_device_impl(nlmsg, "veth", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_nest(nlmsg, VETH_INFO_PEER); nlmsg->pos += sizeof(struct ifinfomsg); netlink_attr(nlmsg, IFLA_IFNAME, peer, strlen(peer)); netlink_done(nlmsg); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_xfrm(struct nlmsg* nlmsg, int sock, const char* name) { netlink_add_device_impl(nlmsg, "xfrm", name, true); netlink_nest(nlmsg, IFLA_INFO_DATA); int if_id = 1; netlink_attr(nlmsg, 2, &if_id, sizeof(if_id)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_hsr(struct nlmsg* nlmsg, int sock, const char* name, const char* slave1, const char* slave2) { netlink_add_device_impl(nlmsg, "hsr", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); int ifindex1 = if_nametoindex(slave1); netlink_attr(nlmsg, IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1)); int ifindex2 = if_nametoindex(slave2); netlink_attr(nlmsg, IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_linked(struct nlmsg* nlmsg, int sock, const char* type, const char* name, const char* link) { netlink_add_device_impl(nlmsg, type, name, false); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_vlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t id, uint16_t proto) { netlink_add_device_impl(nlmsg, "vlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_VLAN_ID, &id, sizeof(id)); netlink_attr(nlmsg, IFLA_VLAN_PROTOCOL, &proto, sizeof(proto)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_macvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link) { netlink_add_device_impl(nlmsg, "macvlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); uint32_t mode = MACVLAN_MODE_BRIDGE; netlink_attr(nlmsg, IFLA_MACVLAN_MODE, &mode, sizeof(mode)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_geneve(struct nlmsg* nlmsg, int sock, const char* name, uint32_t vni, struct in_addr* addr4, struct in6_addr* addr6) { netlink_add_device_impl(nlmsg, "geneve", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_GENEVE_ID, &vni, sizeof(vni)); if (addr4) netlink_attr(nlmsg, IFLA_GENEVE_REMOTE, addr4, sizeof(*addr4)); if (addr6) netlink_attr(nlmsg, IFLA_GENEVE_REMOTE6, addr6, sizeof(*addr6)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } #define IFLA_IPVLAN_FLAGS 2 #define IPVLAN_MODE_L3S 2 #undef IPVLAN_F_VEPA #define IPVLAN_F_VEPA 2 static void netlink_add_ipvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t mode, uint16_t flags) { netlink_add_device_impl(nlmsg, "ipvlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_IPVLAN_MODE, &mode, sizeof(mode)); netlink_attr(nlmsg, IFLA_IPVLAN_FLAGS, &flags, sizeof(flags)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up, const char* master, const void* mac, int macsize, const char* new_name) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; hdr.ifi_index = if_nametoindex(name); netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); if (master) { int ifindex = if_nametoindex(master); netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); } if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev, const void* addr, int addrsize) { struct ifaddrmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; hdr.ifa_scope = RT_SCOPE_UNIVERSE; hdr.ifa_index = if_nametoindex(dev); netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr)); netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); return netlink_send(nlmsg, sock); } static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in_addr in_addr; inet_pton(AF_INET, addr, &in_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); if (err < 0) { } } static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in6_addr in6_addr; inet_pton(AF_INET6, addr, &in6_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); if (err < 0) { } } static struct nlmsg nlmsg; #define DEVLINK_FAMILY_NAME "devlink" #define DEVLINK_CMD_PORT_GET 5 #define DEVLINK_ATTR_BUS_NAME 1 #define DEVLINK_ATTR_DEV_NAME 2 #define DEVLINK_ATTR_NETDEV_NAME 7 static struct nlmsg nlmsg2; static void initialize_devlink_ports(const char* bus_name, const char* dev_name, const char* netdev_prefix) { struct genlmsghdr genlhdr; int len, total_len, id, err, offset; uint16_t netdev_index; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock == -1) exit(1); int rtsock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (rtsock == -1) exit(1); id = netlink_query_family_id(&nlmsg, sock, DEVLINK_FAMILY_NAME, true); if (id == -1) goto error; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = DEVLINK_CMD_PORT_GET; netlink_init(&nlmsg, id, NLM_F_DUMP, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, DEVLINK_ATTR_BUS_NAME, bus_name, strlen(bus_name) + 1); netlink_attr(&nlmsg, DEVLINK_ATTR_DEV_NAME, dev_name, strlen(dev_name) + 1); err = netlink_send_ext(&nlmsg, sock, id, &total_len, true); if (err < 0) { goto error; } offset = 0; netdev_index = 0; while ((len = netlink_next_msg(&nlmsg, offset, total_len)) != -1) { struct nlattr* attr = (struct nlattr*)(nlmsg.buf + offset + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg.buf + offset + len; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == DEVLINK_ATTR_NETDEV_NAME) { char* port_name; char netdev_name[IFNAMSIZ]; port_name = (char*)(attr + 1); snprintf(netdev_name, sizeof(netdev_name), "%s%d", netdev_prefix, netdev_index); netlink_device_change(&nlmsg2, rtsock, port_name, true, 0, 0, 0, netdev_name); break; } } offset += len; netdev_index++; } error: close(rtsock); close(sock); } #define DEV_IPV4 "172.20.20.%d" #define DEV_IPV6 "fe80::%02x" #define DEV_MAC 0x00aaaaaaaaaa static void netdevsim_add(unsigned int addr, unsigned int port_count) { write_file("/sys/bus/netdevsim/del_device", "%u", addr); if (write_file("/sys/bus/netdevsim/new_device", "%u %u", addr, port_count)) { char buf[32]; snprintf(buf, sizeof(buf), "netdevsim%d", addr); initialize_devlink_ports("netdevsim", buf, "netdevsim"); } } #define WG_GENL_NAME "wireguard" enum wg_cmd { WG_CMD_GET_DEVICE, WG_CMD_SET_DEVICE, }; enum wgdevice_attribute { WGDEVICE_A_UNSPEC, WGDEVICE_A_IFINDEX, WGDEVICE_A_IFNAME, WGDEVICE_A_PRIVATE_KEY, WGDEVICE_A_PUBLIC_KEY, WGDEVICE_A_FLAGS, WGDEVICE_A_LISTEN_PORT, WGDEVICE_A_FWMARK, WGDEVICE_A_PEERS, }; enum wgpeer_attribute { WGPEER_A_UNSPEC, WGPEER_A_PUBLIC_KEY, WGPEER_A_PRESHARED_KEY, WGPEER_A_FLAGS, WGPEER_A_ENDPOINT, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, WGPEER_A_LAST_HANDSHAKE_TIME, WGPEER_A_RX_BYTES, WGPEER_A_TX_BYTES, WGPEER_A_ALLOWEDIPS, WGPEER_A_PROTOCOL_VERSION, }; enum wgallowedip_attribute { WGALLOWEDIP_A_UNSPEC, WGALLOWEDIP_A_FAMILY, WGALLOWEDIP_A_IPADDR, WGALLOWEDIP_A_CIDR_MASK, }; static void netlink_wireguard_setup(void) { const char ifname_a[] = "wg0"; const char ifname_b[] = "wg1"; const char ifname_c[] = "wg2"; const char private_a[] = "\xa0\x5c\xa8\x4f\x6c\x9c\x8e\x38\x53\xe2\xfd\x7a\x70\xae\x0f\xb2\x0f\xa1" "\x52\x60\x0c\xb0\x08\x45\x17\x4f\x08\x07\x6f\x8d\x78\x43"; const char private_b[] = "\xb0\x80\x73\xe8\xd4\x4e\x91\xe3\xda\x92\x2c\x22\x43\x82\x44\xbb\x88\x5c" "\x69\xe2\x69\xc8\xe9\xd8\x35\xb1\x14\x29\x3a\x4d\xdc\x6e"; const char private_c[] = "\xa0\xcb\x87\x9a\x47\xf5\xbc\x64\x4c\x0e\x69\x3f\xa6\xd0\x31\xc7\x4a\x15" "\x53\xb6\xe9\x01\xb9\xff\x2f\x51\x8c\x78\x04\x2f\xb5\x42"; const char public_a[] = "\x97\x5c\x9d\x81\xc9\x83\xc8\x20\x9e\xe7\x81\x25\x4b\x89\x9f\x8e\xd9\x25" "\xae\x9f\x09\x23\xc2\x3c\x62\xf5\x3c\x57\xcd\xbf\x69\x1c"; const char public_b[] = "\xd1\x73\x28\x99\xf6\x11\xcd\x89\x94\x03\x4d\x7f\x41\x3d\xc9\x57\x63\x0e" "\x54\x93\xc2\x85\xac\xa4\x00\x65\xcb\x63\x11\xbe\x69\x6b"; const char public_c[] = "\xf4\x4d\xa3\x67\xa8\x8e\xe6\x56\x4f\x02\x02\x11\x45\x67\x27\x08\x2f\x5c" "\xeb\xee\x8b\x1b\xf5\xeb\x73\x37\x34\x1b\x45\x9b\x39\x22"; const uint16_t listen_a = 20001; const uint16_t listen_b = 20002; const uint16_t listen_c = 20003; const uint16_t af_inet = AF_INET; const uint16_t af_inet6 = AF_INET6; const struct sockaddr_in endpoint_b_v4 = { .sin_family = AF_INET, .sin_port = htons(listen_b), .sin_addr = {htonl(INADDR_LOOPBACK)}}; const struct sockaddr_in endpoint_c_v4 = { .sin_family = AF_INET, .sin_port = htons(listen_c), .sin_addr = {htonl(INADDR_LOOPBACK)}}; struct sockaddr_in6 endpoint_a_v6 = {.sin6_family = AF_INET6, .sin6_port = htons(listen_a)}; endpoint_a_v6.sin6_addr = in6addr_loopback; struct sockaddr_in6 endpoint_c_v6 = {.sin6_family = AF_INET6, .sin6_port = htons(listen_c)}; endpoint_c_v6.sin6_addr = in6addr_loopback; const struct in_addr first_half_v4 = {0}; const struct in_addr second_half_v4 = {(uint32_t)htonl(128 << 24)}; const struct in6_addr first_half_v6 = {{{0}}}; const struct in6_addr second_half_v6 = {{{0x80}}}; const uint8_t half_cidr = 1; const uint16_t persistent_keepalives[] = {1, 3, 7, 9, 14, 19}; struct genlmsghdr genlhdr = {.cmd = WG_CMD_SET_DEVICE, .version = 1}; int sock; int id, err; sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock == -1) { return; } id = netlink_query_family_id(&nlmsg, sock, WG_GENL_NAME, true); if (id == -1) goto error; netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_a, strlen(ifname_a) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_a, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_a, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[0], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v6, sizeof(endpoint_c_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[1], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_b, strlen(ifname_b) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_b, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_b, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[2], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v4, sizeof(endpoint_c_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[3], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_c, strlen(ifname_c) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_c, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_c, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[4], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[5], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } error: close(sock); } static void initialize_netdevices(void) { char netdevsim[16]; sprintf(netdevsim, "netdevsim%d", (int)procid); struct { const char* type; const char* dev; } devtypes[] = { {"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"}, {"vcan", "vcan0"}, {"bond", "bond0"}, {"team", "team0"}, {"dummy", "dummy0"}, {"nlmon", "nlmon0"}, {"caif", "caif0"}, {"batadv", "batadv0"}, {"vxcan", "vxcan1"}, {"veth", 0}, {"wireguard", "wg0"}, {"wireguard", "wg1"}, {"wireguard", "wg2"}, }; const char* devmasters[] = {"bridge", "bond", "team", "batadv"}; struct { const char* name; int macsize; bool noipv6; } devices[] = { {"lo", ETH_ALEN}, {"sit0", 0}, {"bridge0", ETH_ALEN}, {"vcan0", 0, true}, {"tunl0", 0}, {"gre0", 0}, {"gretap0", ETH_ALEN}, {"ip_vti0", 0}, {"ip6_vti0", 0}, {"ip6tnl0", 0}, {"ip6gre0", 0}, {"ip6gretap0", ETH_ALEN}, {"erspan0", ETH_ALEN}, {"bond0", ETH_ALEN}, {"veth0", ETH_ALEN}, {"veth1", ETH_ALEN}, {"team0", ETH_ALEN}, {"veth0_to_bridge", ETH_ALEN}, {"veth1_to_bridge", ETH_ALEN}, {"veth0_to_bond", ETH_ALEN}, {"veth1_to_bond", ETH_ALEN}, {"veth0_to_team", ETH_ALEN}, {"veth1_to_team", ETH_ALEN}, {"veth0_to_hsr", ETH_ALEN}, {"veth1_to_hsr", ETH_ALEN}, {"hsr0", 0}, {"dummy0", ETH_ALEN}, {"nlmon0", 0}, {"vxcan0", 0, true}, {"vxcan1", 0, true}, {"caif0", ETH_ALEN}, {"batadv0", ETH_ALEN}, {netdevsim, ETH_ALEN}, {"xfrm0", ETH_ALEN}, {"veth0_virt_wifi", ETH_ALEN}, {"veth1_virt_wifi", ETH_ALEN}, {"virt_wifi0", ETH_ALEN}, {"veth0_vlan", ETH_ALEN}, {"veth1_vlan", ETH_ALEN}, {"vlan0", ETH_ALEN}, {"vlan1", ETH_ALEN}, {"macvlan0", ETH_ALEN}, {"macvlan1", ETH_ALEN}, {"ipvlan0", ETH_ALEN}, {"ipvlan1", ETH_ALEN}, {"veth0_macvtap", ETH_ALEN}, {"veth1_macvtap", ETH_ALEN}, {"macvtap0", ETH_ALEN}, {"macsec0", ETH_ALEN}, {"veth0_to_batadv", ETH_ALEN}, {"veth1_to_batadv", ETH_ALEN}, {"batadv_slave_0", ETH_ALEN}, {"batadv_slave_1", ETH_ALEN}, {"geneve0", ETH_ALEN}, {"geneve1", ETH_ALEN}, {"wg0", 0}, {"wg1", 0}, {"wg2", 0}, }; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) netlink_add_device(&nlmsg, sock, devtypes[i].type, devtypes[i].dev); for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) { char master[32], slave0[32], veth0[32], slave1[32], veth1[32]; sprintf(slave0, "%s_slave_0", devmasters[i]); sprintf(veth0, "veth0_to_%s", devmasters[i]); netlink_add_veth(&nlmsg, sock, slave0, veth0); sprintf(slave1, "%s_slave_1", devmasters[i]); sprintf(veth1, "veth1_to_%s", devmasters[i]); netlink_add_veth(&nlmsg, sock, slave1, veth1); sprintf(master, "%s0", devmasters[i]); netlink_device_change(&nlmsg, sock, slave0, false, master, 0, 0, NULL); netlink_device_change(&nlmsg, sock, slave1, false, master, 0, 0, NULL); } netlink_add_xfrm(&nlmsg, sock, "xfrm0"); netlink_device_change(&nlmsg, sock, "bridge_slave_0", true, 0, 0, 0, NULL); netlink_device_change(&nlmsg, sock, "bridge_slave_1", true, 0, 0, 0, NULL); netlink_add_veth(&nlmsg, sock, "hsr_slave_0", "veth0_to_hsr"); netlink_add_veth(&nlmsg, sock, "hsr_slave_1", "veth1_to_hsr"); netlink_add_hsr(&nlmsg, sock, "hsr0", "hsr_slave_0", "hsr_slave_1"); netlink_device_change(&nlmsg, sock, "hsr_slave_0", true, 0, 0, 0, NULL); netlink_device_change(&nlmsg, sock, "hsr_slave_1", true, 0, 0, 0, NULL); netlink_add_veth(&nlmsg, sock, "veth0_virt_wifi", "veth1_virt_wifi"); netlink_add_linked(&nlmsg, sock, "virt_wifi", "virt_wifi0", "veth1_virt_wifi"); netlink_add_veth(&nlmsg, sock, "veth0_vlan", "veth1_vlan"); netlink_add_vlan(&nlmsg, sock, "vlan0", "veth0_vlan", 0, htons(ETH_P_8021Q)); netlink_add_vlan(&nlmsg, sock, "vlan1", "veth0_vlan", 1, htons(ETH_P_8021AD)); netlink_add_macvlan(&nlmsg, sock, "macvlan0", "veth1_vlan"); netlink_add_macvlan(&nlmsg, sock, "macvlan1", "veth1_vlan"); netlink_add_ipvlan(&nlmsg, sock, "ipvlan0", "veth0_vlan", IPVLAN_MODE_L2, 0); netlink_add_ipvlan(&nlmsg, sock, "ipvlan1", "veth0_vlan", IPVLAN_MODE_L3S, IPVLAN_F_VEPA); netlink_add_veth(&nlmsg, sock, "veth0_macvtap", "veth1_macvtap"); netlink_add_linked(&nlmsg, sock, "macvtap", "macvtap0", "veth0_macvtap"); netlink_add_linked(&nlmsg, sock, "macsec", "macsec0", "veth1_macvtap"); char addr[32]; sprintf(addr, DEV_IPV4, 14 + 10); struct in_addr geneve_addr4; if (inet_pton(AF_INET, addr, &geneve_addr4) <= 0) exit(1); struct in6_addr geneve_addr6; if (inet_pton(AF_INET6, "fc00::01", &geneve_addr6) <= 0) exit(1); netlink_add_geneve(&nlmsg, sock, "geneve0", 0, &geneve_addr4, 0); netlink_add_geneve(&nlmsg, sock, "geneve1", 1, 0, &geneve_addr6); netdevsim_add((int)procid, 4); netlink_wireguard_setup(); for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) { char addr[32]; sprintf(addr, DEV_IPV4, i + 10); netlink_add_addr4(&nlmsg, sock, devices[i].name, addr); if (!devices[i].noipv6) { sprintf(addr, DEV_IPV6, i + 10); netlink_add_addr6(&nlmsg, sock, devices[i].name, addr); } uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40); netlink_device_change(&nlmsg, sock, devices[i].name, true, 0, &macaddr, devices[i].macsize, NULL); } close(sock); } static void initialize_netdevices_init(void) { int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); struct { const char* type; int macsize; bool noipv6; bool noup; } devtypes[] = { {"nr", 7, true}, {"rose", 5, true, true}, }; unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) { char dev[32], addr[32]; sprintf(dev, "%s%d", devtypes[i].type, (int)procid); sprintf(addr, "172.30.%d.%d", i, (int)procid + 1); netlink_add_addr4(&nlmsg, sock, dev, addr); if (!devtypes[i].noipv6) { sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1); netlink_add_addr6(&nlmsg, sock, dev, addr); } int macsize = devtypes[i].macsize; uint64_t macaddr = 0xbbbbbb + ((unsigned long long)i << (8 * (macsize - 2))) + (procid << (8 * (macsize - 1))); netlink_device_change(&nlmsg, sock, dev, !devtypes[i].noup, 0, &macaddr, macsize, NULL); } close(sock); } #define SIZEOF_IO_URING_SQE 64 #define SIZEOF_IO_URING_CQE 16 #define SQ_HEAD_OFFSET 0 #define SQ_TAIL_OFFSET 64 #define SQ_RING_MASK_OFFSET 256 #define SQ_RING_ENTRIES_OFFSET 264 #define SQ_FLAGS_OFFSET 276 #define SQ_DROPPED_OFFSET 272 #define CQ_HEAD_OFFSET 128 #define CQ_TAIL_OFFSET 192 #define CQ_RING_MASK_OFFSET 260 #define CQ_RING_ENTRIES_OFFSET 268 #define CQ_RING_OVERFLOW_OFFSET 284 #define CQ_FLAGS_OFFSET 280 #define CQ_CQES_OFFSET 320 struct io_sqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t flags; uint32_t dropped; uint32_t array; uint32_t resv1; uint64_t resv2; }; struct io_cqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t overflow; uint32_t cqes; uint64_t resv[2]; }; struct io_uring_params { uint32_t sq_entries; uint32_t cq_entries; uint32_t flags; uint32_t sq_thread_cpu; uint32_t sq_thread_idle; uint32_t features; uint32_t resv[4]; struct io_sqring_offsets sq_off; struct io_cqring_offsets cq_off; }; #define IORING_OFF_SQ_RING 0 #define IORING_OFF_SQES 0x10000000ULL #define IORING_SETUP_SQE128 (1U << 10) #define IORING_SETUP_CQE32 (1U << 11) static long syz_io_uring_setup(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint32_t entries = (uint32_t)a0; struct io_uring_params* setup_params = (struct io_uring_params*)a1; void** ring_ptr_out = (void**)a2; void** sqes_ptr_out = (void**)a3; setup_params->flags &= ~(IORING_SETUP_CQE32 | IORING_SETUP_SQE128); uint32_t fd_io_uring = syscall(__NR_io_uring_setup, entries, setup_params); uint32_t sq_ring_sz = setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t); uint32_t cq_ring_sz = setup_params->cq_off.cqes + setup_params->cq_entries * SIZEOF_IO_URING_CQE; uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz; *ring_ptr_out = mmap(0, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, fd_io_uring, IORING_OFF_SQ_RING); uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE; *sqes_ptr_out = mmap(0, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, fd_io_uring, IORING_OFF_SQES); uint32_t* array = (uint32_t*)((uintptr_t)*ring_ptr_out + setup_params->sq_off.array); for (uint32_t index = 0; index < entries; index++) array[index] = index; return fd_io_uring; } #define MAX_FDS 30 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static struct usb_device_index* lookup_usb_index(int fd) { for (int i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) return &usb_devices[i].index; } return NULL; } static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index)) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = {8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0}; static const char default_lang_id[] = {4, USB_DT_STRING, 0x09, 0x04}; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, struct usb_qualifier_descriptor* qual, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_data = (char*)qual; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)( int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic( int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } struct vusb_descriptor { uint8_t req_type; uint8_t desc_type; uint32_t len; char data[0]; } __attribute__((packed)); struct vusb_descriptors { uint32_t len; struct vusb_descriptor* generic; struct vusb_descriptor* descs[0]; } __attribute__((packed)); struct vusb_response { uint8_t type; uint8_t req; uint32_t len; char data[0]; } __attribute__((packed)); struct vusb_responses { uint32_t len; struct vusb_response* generic; struct vusb_response* resps[0]; } __attribute__((packed)); static bool lookup_control_response(const struct vusb_descriptors* descs, const struct vusb_responses* resps, struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { int descs_num = 0; int resps_num = 0; if (descs) descs_num = (descs->len - offsetof(struct vusb_descriptors, descs)) / sizeof(descs->descs[0]); if (resps) resps_num = (resps->len - offsetof(struct vusb_responses, resps)) / sizeof(resps->resps[0]); uint8_t req = ctrl->bRequest; uint8_t req_type = ctrl->bRequestType & USB_TYPE_MASK; uint8_t desc_type = ctrl->wValue >> 8; if (req == USB_REQ_GET_DESCRIPTOR) { int i; for (i = 0; i < descs_num; i++) { struct vusb_descriptor* desc = descs->descs[i]; if (!desc) continue; if (desc->req_type == req_type && desc->desc_type == desc_type) { *response_length = desc->len; if (*response_length != 0) *response_data = &desc->data[0]; else *response_data = NULL; return true; } } if (descs && descs->generic) { *response_data = &descs->generic->data[0]; *response_length = descs->generic->len; return true; } } else { int i; for (i = 0; i < resps_num; i++) { struct vusb_response* resp = resps->resps[i]; if (!resp) continue; if (resp->type == req_type && resp->req == req) { *response_length = resp->len; if (*response_length != 0) *response_data = &resp->data[0]; else *response_data = NULL; return true; } } if (resps && resps->generic) { *response_data = &resps->generic->data[0]; *response_length = resps->generic->len; return true; } } return false; } #define UDC_NAME_LENGTH_MAX 128 struct usb_raw_init { __u8 driver_name[UDC_NAME_LENGTH_MAX]; __u8 device_name[UDC_NAME_LENGTH_MAX]; __u8 speed; }; enum usb_raw_event_type { USB_RAW_EVENT_INVALID = 0, USB_RAW_EVENT_CONNECT = 1, USB_RAW_EVENT_CONTROL = 2, }; struct usb_raw_event { __u32 type; __u32 length; __u8 data[0]; }; struct usb_raw_ep_io { __u16 ep; __u16 flags; __u32 length; __u8 data[0]; }; #define USB_RAW_EPS_NUM_MAX 30 #define USB_RAW_EP_NAME_MAX 16 #define USB_RAW_EP_ADDR_ANY 0xff struct usb_raw_ep_caps { __u32 type_control : 1; __u32 type_iso : 1; __u32 type_bulk : 1; __u32 type_int : 1; __u32 dir_in : 1; __u32 dir_out : 1; }; struct usb_raw_ep_limits { __u16 maxpacket_limit; __u16 max_streams; __u32 reserved; }; struct usb_raw_ep_info { __u8 name[USB_RAW_EP_NAME_MAX]; __u32 addr; struct usb_raw_ep_caps caps; struct usb_raw_ep_limits limits; }; struct usb_raw_eps_info { struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX]; }; #define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init) #define USB_RAW_IOCTL_RUN _IO('U', 1) #define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event) #define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io) #define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io) #define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor) #define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32) #define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io) #define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io) #define USB_RAW_IOCTL_CONFIGURE _IO('U', 9) #define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32) #define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info) #define USB_RAW_IOCTL_EP0_STALL _IO('U', 12) #define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32) #define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32) #define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32) static int usb_raw_open() { return open("/dev/raw-gadget", O_RDWR); } static int usb_raw_init(int fd, uint32_t speed, const char* driver, const char* device) { struct usb_raw_init arg; strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name)); strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name)); arg.speed = speed; return ioctl(fd, USB_RAW_IOCTL_INIT, &arg); } static int usb_raw_run(int fd) { return ioctl(fd, USB_RAW_IOCTL_RUN, 0); } static int usb_raw_ep_write(int fd, struct usb_raw_ep_io* io) { return ioctl(fd, USB_RAW_IOCTL_EP_WRITE, io); } static int usb_raw_configure(int fd) { return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0); } static int usb_raw_vbus_draw(int fd, uint32_t power) { return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power); } static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io) { return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io); } static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io) { return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io); } static int usb_raw_event_fetch(int fd, struct usb_raw_event* event) { return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event); } static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc) { return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc); } static int usb_raw_ep_disable(int fd, int ep) { return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep); } static int usb_raw_ep0_stall(int fd) { return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0); } static int lookup_interface(int fd, uint8_t bInterfaceNumber, uint8_t bAlternateSetting) { struct usb_device_index* index = lookup_usb_index(fd); if (!index) return -1; for (int i = 0; i < index->ifaces_num; i++) { if (index->ifaces[i].bInterfaceNumber == bInterfaceNumber && index->ifaces[i].bAlternateSetting == bAlternateSetting) return i; } return -1; } static int lookup_endpoint(int fd, uint8_t bEndpointAddress) { struct usb_device_index* index = lookup_usb_index(fd); if (!index) return -1; if (index->iface_cur < 0) return -1; for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress == bEndpointAddress) return index->ifaces[index->iface_cur].eps[ep].handle; return -1; } #define USB_MAX_PACKET_SIZE 4096 struct usb_raw_control_event { struct usb_raw_event inner; struct usb_ctrlrequest ctrl; char data[USB_MAX_PACKET_SIZE]; }; struct usb_raw_ep_io_data { struct usb_raw_ep_io inner; char data[USB_MAX_PACKET_SIZE]; }; static void set_interface(int fd, int n) { struct usb_device_index* index = lookup_usb_index(fd); if (!index) return; if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) { for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) { int rv = usb_raw_ep_disable( fd, index->ifaces[index->iface_cur].eps[ep].handle); if (rv < 0) { } else { } } } if (n >= 0 && n < index->ifaces_num) { for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) { int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc); if (rv < 0) { } else { index->ifaces[n].eps[ep].handle = rv; } } index->iface_cur = n; } } static int configure_device(int fd) { struct usb_device_index* index = lookup_usb_index(fd); if (!index) return -1; int rv = usb_raw_vbus_draw(fd, index->bMaxPower); if (rv < 0) { return rv; } rv = usb_raw_configure(fd); if (rv < 0) { return rv; } set_interface(fd, 0); return 0; } static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { if (!dev) { return -1; } int fd = usb_raw_open(); if (fd < 0) { return fd; } if (fd >= MAX_FDS) { close(fd); return -1; } struct usb_device_index* index = add_usb_index(fd, dev, dev_len); if (!index) { return -1; } char device[32]; sprintf(&device[0], "dummy_udc.%llu", procid); int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]); if (rv < 0) { return rv; } rv = usb_raw_run(fd); if (rv < 0) { return rv; } bool done = false; while (!done) { struct usb_raw_control_event event; event.inner.type = 0; event.inner.length = sizeof(event.ctrl); rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event); if (rv < 0) { return rv; } if (event.inner.type != USB_RAW_EVENT_CONTROL) continue; char* response_data = NULL; uint32_t response_length = 0; struct usb_qualifier_descriptor qual; if (event.ctrl.bRequestType & USB_DIR_IN) { if (!lookup_connect_response_in(fd, descs, &event.ctrl, &qual, &response_data, &response_length)) { usb_raw_ep0_stall(fd); continue; } } else { if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) { usb_raw_ep0_stall(fd); continue; } response_data = NULL; response_length = event.ctrl.wLength; } if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { rv = configure_device(fd); if (rv < 0) { return rv; } } struct usb_raw_ep_io_data response; response.inner.ep = 0; response.inner.flags = 0; if (response_length > sizeof(response.data)) response_length = 0; if (event.ctrl.wLength < response_length) response_length = event.ctrl.wLength; response.inner.length = response_length; if (response_data) memcpy(&response.data[0], response_data, response_length); else memset(&response.data[0], 0, response_length); if (event.ctrl.bRequestType & USB_DIR_IN) { rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response); } else { rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response); } if (rv < 0) { return rv; } } sleep_ms(200); return fd; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_control_io(volatile long a0, volatile long a1, volatile long a2) { int fd = a0; const struct vusb_descriptors* descs = (const struct vusb_descriptors*)a1; const struct vusb_responses* resps = (const struct vusb_responses*)a2; struct usb_raw_control_event event; event.inner.type = 0; event.inner.length = USB_MAX_PACKET_SIZE; int rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event); if (rv < 0) { return rv; } if (event.inner.type != USB_RAW_EVENT_CONTROL) { return -1; } char* response_data = NULL; uint32_t response_length = 0; if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) { if (!lookup_control_response(descs, resps, &event.ctrl, &response_data, &response_length)) { usb_raw_ep0_stall(fd); return -1; } } else { if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD || event.ctrl.bRequest == USB_REQ_SET_INTERFACE) { int iface_num = event.ctrl.wIndex; int alt_set = event.ctrl.wValue; int iface_index = lookup_interface(fd, iface_num, alt_set); if (iface_index < 0) { } else { set_interface(fd, iface_index); } } response_length = event.ctrl.wLength; } struct usb_raw_ep_io_data response; response.inner.ep = 0; response.inner.flags = 0; if (response_length > sizeof(response.data)) response_length = 0; if (event.ctrl.wLength < response_length) response_length = event.ctrl.wLength; if ((event.ctrl.bRequestType & USB_DIR_IN) && !event.ctrl.wLength) { response_length = USB_MAX_PACKET_SIZE; } response.inner.length = response_length; if (response_data) memcpy(&response.data[0], response_data, response_length); else memset(&response.data[0], 0, response_length); if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) { rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response); } else { rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response); } if (rv < 0) { return rv; } sleep_ms(200); return 0; } static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { int fd = a0; uint8_t ep = a1; uint32_t len = a2; char* data = (char*)a3; int ep_handle = lookup_endpoint(fd, ep); if (ep_handle < 0) { return -1; } struct usb_raw_ep_io_data io_data; io_data.inner.ep = ep_handle; io_data.inner.flags = 0; if (len > sizeof(io_data.data)) len = sizeof(io_data.data); io_data.inner.length = len; memcpy(&io_data.data[0], data, len); int rv = usb_raw_ep_write(fd, (struct usb_raw_ep_io*)&io_data); if (rv < 0) { return rv; } sleep_ms(200); return 0; } static void setup_gadgetfs(); static void setup_binderfs(); static void setup_fusectl(); static void sandbox_common_mount_tmpfs(void) { write_file("/proc/sys/fs/mount-max", "100000"); if (mkdir("./syz-tmp", 0777)) exit(1); if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot", 0777)) exit(1); if (mkdir("./syz-tmp/newroot/dev", 0700)) exit(1); unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE; if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/proc", 0700)) exit(1); if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/selinux", 0700)) exit(1); const char* selinux_path = "./syz-tmp/newroot/selinux"; if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) { if (errno != ENOENT) exit(1); if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); } if (mkdir("./syz-tmp/newroot/sys", 0700)) exit(1); if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL)) exit(1); if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/newroot/syz-inputs", 0700)) exit(1); if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, bind_mount_flags | MS_RDONLY, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/pivot", 0777)) exit(1); if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { if (chdir("./syz-tmp")) exit(1); } else { if (chdir("/")) exit(1); if (umount2("./pivot", MNT_DETACH)) exit(1); } if (chroot("./newroot")) exit(1); if (chdir("/")) exit(1); setup_gadgetfs(); setup_binderfs(); setup_fusectl(); } static void setup_gadgetfs() { if (mkdir("/dev/gadgetfs", 0777)) { } if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) { } } static void setup_fusectl() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void setup_binderfs() { if (mkdir("/dev/binderfs", 0777)) { } if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { } if (symlink("/dev/binderfs", "./binderfs")) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); if (getppid() == 1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); sandbox_common(); drop_caps(); initialize_netdevices_init(); if (unshare(CLONE_NEWNET)) { } write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); initialize_netdevices(); sandbox_common_mount_tmpfs(); loop(); exit(1); } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void close_fds() { for (int fd = 3; fd < MAX_FDS; fd++) close(fd); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); close_fds(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // syz_io_uring_setup arguments: [ // entries: int32 = 0x239 (4 bytes) // params: nil // ring_ptr: nil // sqes_ptr: nil // ] // returns fd_io_uring NONFAILING(syz_io_uring_setup(/*entries=*/0x239, /*params=*/0, /*ring_ptr=*/0, /*sqes_ptr=*/0)); // syz_usb_connect$hid arguments: [ // speed: usb_device_speed = 0x0 (8 bytes) // dev_len: len = 0x36 (8 bytes) // dev: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {12 01 00 00 00 00 00 40 26 09 33 33 40 00 00 00 // 00 01 09 02 24 00 01 00 00 00 00 09 04 00 00 01 03 01 00 00 09 21 // 00 00 00 01 22 01 00 09 05 81 03 08} (length 0x32) // } // } // } // conn_descs: nil // ] // returns fd_usb_hid NONFAILING(memcpy( (void*)0x200000000140, "\x12\x01\x00\x00\x00\x00\x00\x40\x26\x09\x33\x33\x40\x00\x00\x00\x00\x01" "\x09\x02\x24\x00\x01\x00\x00\x00\x00\x09\x04\x00\x00\x01\x03\x01\x00\x00" "\x09\x21\x00\x00\x00\x01\x22\x01\x00\x09\x05\x81\x03\x08", 50)); res = -1; NONFAILING(res = syz_usb_connect(/*speed=*/0, /*dev_len=*/0x36, /*dev=*/0x200000000140, /*conn_descs=*/0)); if (res != -1) r[0] = res; // syz_usb_control_io$hid arguments: [ // fd: fd_usb_hid (resource) // descs: nil // resps: nil // ] NONFAILING(syz_usb_control_io(/*fd=*/r[0], /*descs=*/0, /*resps=*/0)); // sendmsg$ETHTOOL_MSG_EEE_SET arguments: [ // fd: sock_nl_generic (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_t[genl_ethtool_family_id, // genlmsghdr_t[ETHTOOL_MSG_EEE_SET], ethnl_eee_set_policy]]] { // msghdr_netlink[netlink_msg_t[genl_ethtool_family_id, // genlmsghdr_t[ETHTOOL_MSG_EEE_SET], ethnl_eee_set_policy]] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_t[genl_ethtool_family_id, // genlmsghdr_t[ETHTOOL_MSG_EEE_SET], ethnl_eee_set_policy]]] { // iovec[in, netlink_msg_t[genl_ethtool_family_id, // genlmsghdr_t[ETHTOOL_MSG_EEE_SET], ethnl_eee_set_policy]] { // addr: ptr[in, netlink_msg_t[genl_ethtool_family_id, // genlmsghdr_t[ETHTOOL_MSG_EEE_SET], ethnl_eee_set_policy]] { // netlink_msg_t[genl_ethtool_family_id, // genlmsghdr_t[ETHTOOL_MSG_EEE_SET], ethnl_eee_set_policy] { // len: len = 0x5f0 (4 bytes) // type: genl_ethtool_family_id (resource) // flags: netlink_msg_flags = 0x300 (2 bytes) // seq: int32 = 0x70bd2c (4 bytes) // pid: int32 = 0x25dfdbfd (4 bytes) // payload: genlmsghdr_t[ETHTOOL_MSG_EEE_SET] { // cmd: const = 0x18 (1 bytes) // version: const = 0x0 (1 bytes) // reserved: const = 0x0 (2 bytes) // } // attrs: array[ethnl_eee_set_policy] { // union ethnl_eee_set_policy { // ETHTOOL_A_EEE_MODES_OURS: // nlattr_tt[const[ETHTOOL_A_EEE_MODES_OURS, int16:14], 0, // 1, array[bitset_policy]] { // nla_len: offsetof = 0x5c4 (2 bytes) // nla_type: const = 0x2 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[bitset_policy] { // union bitset_policy { // ETHTOOL_A_BITSET_VALUE: // nlattr_t[const[ETHTOOL_A_BITSET_VALUE, int16], // array[int8]] { // nla_len: offsetof = 0x5bd (2 bytes) // nla_type: const = 0x4 (2 bytes) // payload: buffer: {37 20 6b 61 53 6d d3 cf bf 98 // 08 22 d5 03 b0 3c 79 d5 e8 c8 bc 80 8f 47 e5 94 // d5 80 dd 49 66 7b cc c4 f4 32 ea a2 81 fa 9d c1 // a0 c7 19 8b 67 91 51 e8 27 ca 1a f0 ce 3a aa 45 // c9 46 17 7f 69 37 67 6a d6 f0 22 da 56 9c 4e c8 // 86 38 9d 26 66 4e 4d ac 09 73 e8 cd 90 c7 af d7 // d0 d8 83 2b 4f e9 5f f4 13 c1 9c eb bb 76 0d ec // b5 3f 57 07 75 ca 0b 25 60 99 a1 c9 06 e5 ff 52 // 86 c9 1d d2 99 50 63 29 e4 68 ca ee bf 76 1d f2 // 91 1e 84 1d c1 2f 37 11 87 99 e7 92 ca 08 b6 b8 // 58 ba 4d ef af 0c d6 4e a1 9e 14 6d 89 09 db 57 // 74 32 69 09 2d 36 12 4b 4c 63 f7 c2 eb 7b 7f 59 // 90 8a 82 e6 65 c5 f5 62 bd a7 f2 51 92 88 04 16 // dd 08 97 8d 94 5e ac c2 a3 d3 84 45 91 6f f0 41 // 8f 80 9b e8 84 b3 03 6d 89 b8 75 9b 55 58 b1 aa // 3e f4 ad b5 75 34 86 88 f7 fa a1 f6 8a 17 b6 85 // 54 a9 d8 23 20 5e 50 15 83 34 e4 42 de aa 1a 77 // 6f 23 a1 c2 d2 8e a8 cd 9d 85 fc 7b 82 df 18 5a // 40 19 e1 e8 83 62 88 56 b6 76 b6 e6 45 94 7a c3 // f9 c1 5b ca ea e6 67 f8 e8 7e 6f fd ba ee de f9 // 26 02 05 aa 7c 37 e5 11 07 15 bd b2 f0 5e 25 4d // 84 76 b3 ef df 1d 92 a8 ba 32 56 e7 23 3b f9 d2 // a1 28 94 f9 d4 ca 09 ee 5d 02 60 a0 0b 43 4e cc // fc db ac 11 ec c4 41 ca a5 e7 01 e5 4f 07 fc 53 // 5c d7 0e b6 d4 2e 5a 93 8e 50 63 6c a9 30 0b dc // 37 d3 89 b9 6a 0a 3e 98 7d d5 a5 af 7d 0a f5 1a // 8a 34 26 38 fd c9 24 f0 df a0 9f ef e2 79 5a ef // f4 06 4c 6f 65 5e 15 a8 a8 64 08 31 b4 70 3a 45 // a4 ad a7 e0 c7 52 64 4c 1b b0 6b b8 b8 21 04 2a // 86 d4 b0 c5 18 a1 fe 9c e1 2a 29 7a bf f4 2a 84 // c4 97 f9 27 c4 a7 05 e0 c7 4b 2e 22 61 83 3f 5e // 74 4a 54 eb f4 20 d8 30 87 00 f2 8e 48 c5 67 18 // c9 fd 9c 48 00 3e 52 a7 64 f9 1d a2 b7 b7 6a 8d // 1a 31 ae e2 5c 06 c8 e5 08 d7 1d 8b df d4 ce 44 // 91 5f 87 f7 ce cb 21 3c 31 34 ea f7 41 d6 f0 08 // d3 1d a5 36 a6 8b fd 32 85 bb b5 22 d8 54 99 56 // 71 9e e7 67 46 a7 bd c8 0b 6a 96 b1 a2 0e ac c4 // d6 05 25 60 17 29 3a 78 32 4c 58 2b 8d d1 9c 5c // 23 a8 28 05 a9 16 3e fe 0a 0d a0 2a b6 e3 d4 02 // f5 76 2b 44 35 4d a0 f1 b6 1a 83 ef e7 f0 d8 24 // 4d d9 25 13 8c b9 88 36 fd 90 89 83 df ed c8 9d // 1b 75 62 76 47 25 16 81 5e a9 40 31 a6 54 76 d5 // 23 4f 53 f2 f0 d1 75 15 88 a0 af fc 4b cb d2 7b // 53 28 5a 8d 87 4b 76 2d 64 c7 6e 30 b7 92 51 2b // c7 78 32 9b 59 c5 52 29 69 44 50 c4 a7 c1 5c ef // 84 fb b5 1c ab d3 77 c4 e5 bc 7a 71 9d b8 74 8a // f4 a3 a6 4a 16 7b ca e3 05 ac 19 e9 f1 dd e7 bb // a2 49 b5 bb 57 fc b8 8d 7a ae de f8 2b 18 3b 98 // 18 c1 3a 03 f7 ca 6e 79 cf 9c 6d 7b 98 23 1c db // 4b 33 06 c9 7f 12 8a 9f 0a 5b bb 09 1e 37 10 fb // 18 9d 18 13 a7 52 68 86 8c fa 29 af 14 e4 ea ab // 4c 29 ec 1c 55 7a 8d c4 10 b6 79 7c 66 32 17 7f // 89 6e 06 29 ea aa f8 87 ea fb 57 0a 7a 89 fe d7 // 4a 1e 54 5d 9c cd 2f b4 c3 ac 61 20 c8 59 93 00 // 6e ae 28 45 bf 68 3f be ad 17 8f 37 d6 a8 49 0c // 80 c4 6b fb 93 52 e3 db 83 06 88 23 09 cf 3d 14 // 1b d7 5f af a7 be a4 57 68 6c 00 c8 83 62 b4 d1 // e5 a8 a3 0f f9 f4 b2 71 b4 6d 8e 44 72 be e6 ee // 9f 20 20 df ad 2d 37 1e 97 1b 5b 31 90 cc a1 fa // 4b d6 3e 32 10 83 7a 2f 48 df 87 d3 37 45 9e 73 // a4 e7 22 2f 58 90 39 d4 30 c4 67 79 73 06 5e 4d // 06 74 89 1f 5f 9b 8f f8 10 6b 29 9f cb a4 15 b8 // c6 93 b2 89 4a 05 66 06 15 49 28 24 a2 a9 94 ac // 5e 7d 5c 11 55 55 14 48 b8 ab 5b 96 f3 e6 f7 71 // f0 c9 81 b3 84 7b ec 97 2d 1a 9e c0 72 86 07 2f // 9e 64 30 a0 62 0d 73 16 dd d8 cd 22 eb d2 69 c0 // 89 f2 13 ce 1c e3 5f a5 50 76 13 74 2b 22 61 96 // cf c9 63 30 b5 a6 ee 4a b0 b6 75 e9 a4 3e 68 af // 43 46 50 b0 c3 5a 5b 54 10 3e d9 da ff a5 90 8c // ca de 59 fb 4a c2 db 80 87 dc 8a 9f cf e2 a2 c8 // d4 e6 66 55 9c ee 75 93 ae e0 4e 18 d8 33 e7 ae // 32 1c 90 85 4c 87 4d 47 96 ca a3 6e 0c a4 ec db // 6b 07 bb 3a c6 b4 8f 14 10 6d fd ca f9 f9 d8 10 // 32 c0 0e 06 3a a4 f0 29 13 1e 8e d9 1d 1c b8 25 // 70 cd 10 ea b6 b7 bd bd db 4b 1e 30 52 1e 83 bd // f4 c5 80 38 09 e7 a6 69 6a f0 47 e9 03 2c 29 c4 // a3 74 db e8 49 4e 81 84 3d e8 09 3d b6 0c 47 93 // ea d0 2c 58 7c f8 82 f0 ee b4 b3 4f 6a 4b 2a ac // 27 2b 87 16 d8 e7 d1 8d 89 9a ef 09 8c 93 41 31 // 2e 29 09 fa ae 61 87 c4 af 56 7a cf 78 19 7f b7 // fb b2 70 4c e3 ca 6a 9c e8 67 a7 a7 62 c5 61 4b // 9a 4a 56 09 fe fb a9 50 5e 9c 4a 55 53 c3 b1 cf // a7 d1 ff 8a 65 b5 36 dc 5b 2d 9c 74 e3 48 c2 ee // bc 3f 0f bf a1 94 a7 45 61 cb e8 b1 2d 9f ad 55 // 39 76 13 79 ac 80 8a f3 f6 c9 9f 66 c6 8b f9 0b // f8 f8 01 a8 ac 7c e7 d5 03 ef 37 04 f2 3a 3d a9 // 4d 05 e2 51 c6 b8 3c aa 1c f5 58 22 c3 ec be ed // fb db b0 e5 67 26 8e 7f ee 6a e9 6d 4f e8 2e 00 // 4c 4a 30 38 d7 b5 0d da 42 c0 79 b7 53 f6 4f 39 // 04 58 24 11 b5 54 78 9f cb 8a e9 64 fd 11 79 61 // 7f 39 ea f8 b0 33 2c da 25 6a 29 09 63 1c f3 03 // 43 c4 2b ac b8 e5 6c 80 69 3d 6c e6 8a e6 1f} // (length 0x5b9) size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // union ethnl_eee_set_policy { // ETHTOOL_A_EEE_TX_LPI_TIMER: // nlattr_t[const[ETHTOOL_A_EEE_TX_LPI_TIMER, int16], // int32] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x7 (2 bytes) // payload: int32 = 0xef9 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union ethnl_eee_set_policy { // ETHTOOL_A_EEE_TX_LPI_TIMER: // nlattr_t[const[ETHTOOL_A_EEE_TX_LPI_TIMER, int16], // int32] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x7 (2 bytes) // payload: int32 = 0x7f (4 bytes) // size: buffer: {} (length 0x0) // } // } // union ethnl_eee_set_policy { // ETHTOOL_A_EEE_ENABLED: // nlattr_t[const[ETHTOOL_A_EEE_ENABLED, int16], bool8] { // nla_len: offsetof = 0x5 (2 bytes) // nla_type: const = 0x5 (2 bytes) // payload: int8 = 0x1 (1 bytes) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // } // } // } // len: len = 0x5f0 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x4 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x954 (8 bytes) // ] NONFAILING(*(uint64_t*)0x200000000240 = 0); NONFAILING(*(uint32_t*)0x200000000248 = 0); NONFAILING(*(uint64_t*)0x200000000250 = 0x2000000001c0); NONFAILING(*(uint64_t*)0x2000000001c0 = 0x2000000003c0); NONFAILING(*(uint32_t*)0x2000000003c0 = 0x5f0); NONFAILING(*(uint16_t*)0x2000000003c4 = 0); NONFAILING(*(uint16_t*)0x2000000003c6 = 0x300); NONFAILING(*(uint32_t*)0x2000000003c8 = 0x70bd2c); NONFAILING(*(uint32_t*)0x2000000003cc = 0x25dfdbfd); NONFAILING(*(uint8_t*)0x2000000003d0 = 0x18); NONFAILING(*(uint8_t*)0x2000000003d1 = 0); NONFAILING(*(uint16_t*)0x2000000003d2 = 0); NONFAILING(*(uint16_t*)0x2000000003d4 = 0x5c4); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000000003d6, 2, 0, 14)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000000003d7, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000000003d7, 1, 7, 1)); NONFAILING(*(uint16_t*)0x2000000003d8 = 0x5bd); NONFAILING(*(uint16_t*)0x2000000003da = 4); NONFAILING(memcpy( (void*)0x2000000003dc, "\x37\x20\x6b\x61\x53\x6d\xd3\xcf\xbf\x98\x08\x22\xd5\x03\xb0\x3c\x79\xd5" "\xe8\xc8\xbc\x80\x8f\x47\xe5\x94\xd5\x80\xdd\x49\x66\x7b\xcc\xc4\xf4\x32" "\xea\xa2\x81\xfa\x9d\xc1\xa0\xc7\x19\x8b\x67\x91\x51\xe8\x27\xca\x1a\xf0" "\xce\x3a\xaa\x45\xc9\x46\x17\x7f\x69\x37\x67\x6a\xd6\xf0\x22\xda\x56\x9c" "\x4e\xc8\x86\x38\x9d\x26\x66\x4e\x4d\xac\x09\x73\xe8\xcd\x90\xc7\xaf\xd7" "\xd0\xd8\x83\x2b\x4f\xe9\x5f\xf4\x13\xc1\x9c\xeb\xbb\x76\x0d\xec\xb5\x3f" "\x57\x07\x75\xca\x0b\x25\x60\x99\xa1\xc9\x06\xe5\xff\x52\x86\xc9\x1d\xd2" "\x99\x50\x63\x29\xe4\x68\xca\xee\xbf\x76\x1d\xf2\x91\x1e\x84\x1d\xc1\x2f" "\x37\x11\x87\x99\xe7\x92\xca\x08\xb6\xb8\x58\xba\x4d\xef\xaf\x0c\xd6\x4e" "\xa1\x9e\x14\x6d\x89\x09\xdb\x57\x74\x32\x69\x09\x2d\x36\x12\x4b\x4c\x63" "\xf7\xc2\xeb\x7b\x7f\x59\x90\x8a\x82\xe6\x65\xc5\xf5\x62\xbd\xa7\xf2\x51" "\x92\x88\x04\x16\xdd\x08\x97\x8d\x94\x5e\xac\xc2\xa3\xd3\x84\x45\x91\x6f" "\xf0\x41\x8f\x80\x9b\xe8\x84\xb3\x03\x6d\x89\xb8\x75\x9b\x55\x58\xb1\xaa" "\x3e\xf4\xad\xb5\x75\x34\x86\x88\xf7\xfa\xa1\xf6\x8a\x17\xb6\x85\x54\xa9" "\xd8\x23\x20\x5e\x50\x15\x83\x34\xe4\x42\xde\xaa\x1a\x77\x6f\x23\xa1\xc2" "\xd2\x8e\xa8\xcd\x9d\x85\xfc\x7b\x82\xdf\x18\x5a\x40\x19\xe1\xe8\x83\x62" "\x88\x56\xb6\x76\xb6\xe6\x45\x94\x7a\xc3\xf9\xc1\x5b\xca\xea\xe6\x67\xf8" "\xe8\x7e\x6f\xfd\xba\xee\xde\xf9\x26\x02\x05\xaa\x7c\x37\xe5\x11\x07\x15" "\xbd\xb2\xf0\x5e\x25\x4d\x84\x76\xb3\xef\xdf\x1d\x92\xa8\xba\x32\x56\xe7" "\x23\x3b\xf9\xd2\xa1\x28\x94\xf9\xd4\xca\x09\xee\x5d\x02\x60\xa0\x0b\x43" "\x4e\xcc\xfc\xdb\xac\x11\xec\xc4\x41\xca\xa5\xe7\x01\xe5\x4f\x07\xfc\x53" "\x5c\xd7\x0e\xb6\xd4\x2e\x5a\x93\x8e\x50\x63\x6c\xa9\x30\x0b\xdc\x37\xd3" "\x89\xb9\x6a\x0a\x3e\x98\x7d\xd5\xa5\xaf\x7d\x0a\xf5\x1a\x8a\x34\x26\x38" "\xfd\xc9\x24\xf0\xdf\xa0\x9f\xef\xe2\x79\x5a\xef\xf4\x06\x4c\x6f\x65\x5e" "\x15\xa8\xa8\x64\x08\x31\xb4\x70\x3a\x45\xa4\xad\xa7\xe0\xc7\x52\x64\x4c" "\x1b\xb0\x6b\xb8\xb8\x21\x04\x2a\x86\xd4\xb0\xc5\x18\xa1\xfe\x9c\xe1\x2a" "\x29\x7a\xbf\xf4\x2a\x84\xc4\x97\xf9\x27\xc4\xa7\x05\xe0\xc7\x4b\x2e\x22" "\x61\x83\x3f\x5e\x74\x4a\x54\xeb\xf4\x20\xd8\x30\x87\x00\xf2\x8e\x48\xc5" "\x67\x18\xc9\xfd\x9c\x48\x00\x3e\x52\xa7\x64\xf9\x1d\xa2\xb7\xb7\x6a\x8d" "\x1a\x31\xae\xe2\x5c\x06\xc8\xe5\x08\xd7\x1d\x8b\xdf\xd4\xce\x44\x91\x5f" "\x87\xf7\xce\xcb\x21\x3c\x31\x34\xea\xf7\x41\xd6\xf0\x08\xd3\x1d\xa5\x36" "\xa6\x8b\xfd\x32\x85\xbb\xb5\x22\xd8\x54\x99\x56\x71\x9e\xe7\x67\x46\xa7" "\xbd\xc8\x0b\x6a\x96\xb1\xa2\x0e\xac\xc4\xd6\x05\x25\x60\x17\x29\x3a\x78" "\x32\x4c\x58\x2b\x8d\xd1\x9c\x5c\x23\xa8\x28\x05\xa9\x16\x3e\xfe\x0a\x0d" "\xa0\x2a\xb6\xe3\xd4\x02\xf5\x76\x2b\x44\x35\x4d\xa0\xf1\xb6\x1a\x83\xef" "\xe7\xf0\xd8\x24\x4d\xd9\x25\x13\x8c\xb9\x88\x36\xfd\x90\x89\x83\xdf\xed" "\xc8\x9d\x1b\x75\x62\x76\x47\x25\x16\x81\x5e\xa9\x40\x31\xa6\x54\x76\xd5" "\x23\x4f\x53\xf2\xf0\xd1\x75\x15\x88\xa0\xaf\xfc\x4b\xcb\xd2\x7b\x53\x28" "\x5a\x8d\x87\x4b\x76\x2d\x64\xc7\x6e\x30\xb7\x92\x51\x2b\xc7\x78\x32\x9b" "\x59\xc5\x52\x29\x69\x44\x50\xc4\xa7\xc1\x5c\xef\x84\xfb\xb5\x1c\xab\xd3" "\x77\xc4\xe5\xbc\x7a\x71\x9d\xb8\x74\x8a\xf4\xa3\xa6\x4a\x16\x7b\xca\xe3" "\x05\xac\x19\xe9\xf1\xdd\xe7\xbb\xa2\x49\xb5\xbb\x57\xfc\xb8\x8d\x7a\xae" "\xde\xf8\x2b\x18\x3b\x98\x18\xc1\x3a\x03\xf7\xca\x6e\x79\xcf\x9c\x6d\x7b" "\x98\x23\x1c\xdb\x4b\x33\x06\xc9\x7f\x12\x8a\x9f\x0a\x5b\xbb\x09\x1e\x37" "\x10\xfb\x18\x9d\x18\x13\xa7\x52\x68\x86\x8c\xfa\x29\xaf\x14\xe4\xea\xab" "\x4c\x29\xec\x1c\x55\x7a\x8d\xc4\x10\xb6\x79\x7c\x66\x32\x17\x7f\x89\x6e" "\x06\x29\xea\xaa\xf8\x87\xea\xfb\x57\x0a\x7a\x89\xfe\xd7\x4a\x1e\x54\x5d" "\x9c\xcd\x2f\xb4\xc3\xac\x61\x20\xc8\x59\x93\x00\x6e\xae\x28\x45\xbf\x68" "\x3f\xbe\xad\x17\x8f\x37\xd6\xa8\x49\x0c\x80\xc4\x6b\xfb\x93\x52\xe3\xdb" "\x83\x06\x88\x23\x09\xcf\x3d\x14\x1b\xd7\x5f\xaf\xa7\xbe\xa4\x57\x68\x6c" "\x00\xc8\x83\x62\xb4\xd1\xe5\xa8\xa3\x0f\xf9\xf4\xb2\x71\xb4\x6d\x8e\x44" "\x72\xbe\xe6\xee\x9f\x20\x20\xdf\xad\x2d\x37\x1e\x97\x1b\x5b\x31\x90\xcc" "\xa1\xfa\x4b\xd6\x3e\x32\x10\x83\x7a\x2f\x48\xdf\x87\xd3\x37\x45\x9e\x73" "\xa4\xe7\x22\x2f\x58\x90\x39\xd4\x30\xc4\x67\x79\x73\x06\x5e\x4d\x06\x74" "\x89\x1f\x5f\x9b\x8f\xf8\x10\x6b\x29\x9f\xcb\xa4\x15\xb8\xc6\x93\xb2\x89" "\x4a\x05\x66\x06\x15\x49\x28\x24\xa2\xa9\x94\xac\x5e\x7d\x5c\x11\x55\x55" "\x14\x48\xb8\xab\x5b\x96\xf3\xe6\xf7\x71\xf0\xc9\x81\xb3\x84\x7b\xec\x97" "\x2d\x1a\x9e\xc0\x72\x86\x07\x2f\x9e\x64\x30\xa0\x62\x0d\x73\x16\xdd\xd8" "\xcd\x22\xeb\xd2\x69\xc0\x89\xf2\x13\xce\x1c\xe3\x5f\xa5\x50\x76\x13\x74" "\x2b\x22\x61\x96\xcf\xc9\x63\x30\xb5\xa6\xee\x4a\xb0\xb6\x75\xe9\xa4\x3e" "\x68\xaf\x43\x46\x50\xb0\xc3\x5a\x5b\x54\x10\x3e\xd9\xda\xff\xa5\x90\x8c" "\xca\xde\x59\xfb\x4a\xc2\xdb\x80\x87\xdc\x8a\x9f\xcf\xe2\xa2\xc8\xd4\xe6" "\x66\x55\x9c\xee\x75\x93\xae\xe0\x4e\x18\xd8\x33\xe7\xae\x32\x1c\x90\x85" "\x4c\x87\x4d\x47\x96\xca\xa3\x6e\x0c\xa4\xec\xdb\x6b\x07\xbb\x3a\xc6\xb4" "\x8f\x14\x10\x6d\xfd\xca\xf9\xf9\xd8\x10\x32\xc0\x0e\x06\x3a\xa4\xf0\x29" "\x13\x1e\x8e\xd9\x1d\x1c\xb8\x25\x70\xcd\x10\xea\xb6\xb7\xbd\xbd\xdb\x4b" "\x1e\x30\x52\x1e\x83\xbd\xf4\xc5\x80\x38\x09\xe7\xa6\x69\x6a\xf0\x47\xe9" "\x03\x2c\x29\xc4\xa3\x74\xdb\xe8\x49\x4e\x81\x84\x3d\xe8\x09\x3d\xb6\x0c" "\x47\x93\xea\xd0\x2c\x58\x7c\xf8\x82\xf0\xee\xb4\xb3\x4f\x6a\x4b\x2a\xac" "\x27\x2b\x87\x16\xd8\xe7\xd1\x8d\x89\x9a\xef\x09\x8c\x93\x41\x31\x2e\x29" "\x09\xfa\xae\x61\x87\xc4\xaf\x56\x7a\xcf\x78\x19\x7f\xb7\xfb\xb2\x70\x4c" "\xe3\xca\x6a\x9c\xe8\x67\xa7\xa7\x62\xc5\x61\x4b\x9a\x4a\x56\x09\xfe\xfb" "\xa9\x50\x5e\x9c\x4a\x55\x53\xc3\xb1\xcf\xa7\xd1\xff\x8a\x65\xb5\x36\xdc" "\x5b\x2d\x9c\x74\xe3\x48\xc2\xee\xbc\x3f\x0f\xbf\xa1\x94\xa7\x45\x61\xcb" "\xe8\xb1\x2d\x9f\xad\x55\x39\x76\x13\x79\xac\x80\x8a\xf3\xf6\xc9\x9f\x66" "\xc6\x8b\xf9\x0b\xf8\xf8\x01\xa8\xac\x7c\xe7\xd5\x03\xef\x37\x04\xf2\x3a" "\x3d\xa9\x4d\x05\xe2\x51\xc6\xb8\x3c\xaa\x1c\xf5\x58\x22\xc3\xec\xbe\xed" "\xfb\xdb\xb0\xe5\x67\x26\x8e\x7f\xee\x6a\xe9\x6d\x4f\xe8\x2e\x00\x4c\x4a" "\x30\x38\xd7\xb5\x0d\xda\x42\xc0\x79\xb7\x53\xf6\x4f\x39\x04\x58\x24\x11" "\xb5\x54\x78\x9f\xcb\x8a\xe9\x64\xfd\x11\x79\x61\x7f\x39\xea\xf8\xb0\x33" "\x2c\xda\x25\x6a\x29\x09\x63\x1c\xf3\x03\x43\xc4\x2b\xac\xb8\xe5\x6c\x80" "\x69\x3d\x6c\xe6\x8a\xe6\x1f", 1465)); NONFAILING(*(uint16_t*)0x200000000998 = 8); NONFAILING(*(uint16_t*)0x20000000099a = 7); NONFAILING(*(uint32_t*)0x20000000099c = 0xef9); NONFAILING(*(uint16_t*)0x2000000009a0 = 8); NONFAILING(*(uint16_t*)0x2000000009a2 = 7); NONFAILING(*(uint32_t*)0x2000000009a4 = 0x7f); NONFAILING(*(uint16_t*)0x2000000009a8 = 5); NONFAILING(*(uint16_t*)0x2000000009aa = 5); NONFAILING(*(uint8_t*)0x2000000009ac = 1); NONFAILING(*(uint64_t*)0x2000000001c8 = 0x5f0); NONFAILING(*(uint64_t*)0x200000000258 = 1); NONFAILING(*(uint64_t*)0x200000000260 = 0); NONFAILING(*(uint64_t*)0x200000000268 = 0); NONFAILING(*(uint32_t*)0x200000000270 = 4); syscall(__NR_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0x200000000240ul, /*f=MSG_PROBE|MSG_DONTWAIT|MSG_DONTROUTE|MSG_CONFIRM|0x100*/ 0x954ul); // syz_usb_control_io arguments: [ // fd: fd_usb (resource) // descs: ptr[in, vusb_descriptors] { // vusb_descriptors { // len: len = 0x2c (4 bytes) // generic: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {00 00 02} (length 0x3) // } // } // } // string: nil // bos: nil // hub_hs: nil // hub_ss: nil // } // } // resps: nil // ] NONFAILING(*(uint32_t*)0x200000000080 = 0x2c); NONFAILING(*(uint64_t*)0x200000000084 = 0x200000000100); NONFAILING(memcpy((void*)0x200000000100, "\x00\x00\x02", 3)); NONFAILING(*(uint64_t*)0x20000000008c = 0); NONFAILING(*(uint64_t*)0x200000000094 = 0); NONFAILING(*(uint64_t*)0x20000000009c = 0); NONFAILING(*(uint64_t*)0x2000000000a4 = 0); NONFAILING( syz_usb_control_io(/*fd=*/r[0], /*descs=*/0x200000000080, /*resps=*/0)); // ioctl$SECCOMP_IOCTL_NOTIF_RECV arguments: [ // fd: fd_seccomp (resource) // cmd: const = 0xc0502100 (4 bytes) // arg: nil // ] syscall(__NR_ioctl, /*fd=*/(intptr_t)-1, /*cmd=*/0xc0502100, /*arg=*/0ul); // syz_usb_ep_write arguments: [ // fd: fd_usb (resource) // ep: int8 = 0x81 (1 bytes) // len: len = 0xffffff75 (8 bytes) // data: ptr[in, buffer] { // buffer: {b9 42 5b 44 65 1d d2 32 41 96 35 99 00 00 00 11 00 00 00 4a // 16 94 1f f5 f4 b4 f1 f0 ad d7 fc f2 b8 77 fc ea ff ff ff ff ff f1 ff // df 4c d9 f5 d3 96 98 90 52 2c 77 15 7d 88 01 00 00 00 3a 5b d5 53 1d // 45 9d ff ff 03 00 00 00 00 00 91 ff 00 00 00 e8 f5 b3 37 1d a3 63 5b // 8b 4f a6 37 13 58 00 00 1f 65 e4 b4 36 aa 9e 50 bc 0f 19 b7 d3 37 2f // f9 eb ce de 1f b5 e9 42 8f 54 d5 d1 f0 cc 75 2c f2 46 a5 d2 da 34 a5 // aa 97 dc 14 a4 69 c3 dd 3e 26 b4 1c 35 64 84 e4 6f d6 6e 3f 2c 78 07 // e8 77 3e ed 7b 94 fa 09 9a b8 4f ea de c2 ea 95 f6 5b ba 45 2e ae 5b // 09 00 f9 8a 97 9a 88 c5 17 a2 dc 36 0a 00 23 77 23 e2 f4 67 af 70 6e // a1 72 26 29 6b 3a 10 a3 51 cb 47 ab a2 c6 b8 36 c9 06 79 b4 dd 85 9d // dc 9e 48 00 44 8a ab 00 00 00 00 00 00 0d 75 f3 4b b5 0d 8d 70 84} // (length 0xf9) // } // ] NONFAILING(memcpy( (void*)0x2000000002c0, "\xb9\x42\x5b\x44\x65\x1d\xd2\x32\x41\x96\x35\x99\x00\x00\x00\x11\x00\x00" "\x00\x4a\x16\x94\x1f\xf5\xf4\xb4\xf1\xf0\xad\xd7\xfc\xf2\xb8\x77\xfc\xea" "\xff\xff\xff\xff\xff\xf1\xff\xdf\x4c\xd9\xf5\xd3\x96\x98\x90\x52\x2c\x77" "\x15\x7d\x88\x01\x00\x00\x00\x3a\x5b\xd5\x53\x1d\x45\x9d\xff\xff\x03\x00" "\x00\x00\x00\x00\x91\xff\x00\x00\x00\xe8\xf5\xb3\x37\x1d\xa3\x63\x5b\x8b" "\x4f\xa6\x37\x13\x58\x00\x00\x1f\x65\xe4\xb4\x36\xaa\x9e\x50\xbc\x0f\x19" "\xb7\xd3\x37\x2f\xf9\xeb\xce\xde\x1f\xb5\xe9\x42\x8f\x54\xd5\xd1\xf0\xcc" "\x75\x2c\xf2\x46\xa5\xd2\xda\x34\xa5\xaa\x97\xdc\x14\xa4\x69\xc3\xdd\x3e" "\x26\xb4\x1c\x35\x64\x84\xe4\x6f\xd6\x6e\x3f\x2c\x78\x07\xe8\x77\x3e\xed" "\x7b\x94\xfa\x09\x9a\xb8\x4f\xea\xde\xc2\xea\x95\xf6\x5b\xba\x45\x2e\xae" "\x5b\x09\x00\xf9\x8a\x97\x9a\x88\xc5\x17\xa2\xdc\x36\x0a\x00\x23\x77\x23" "\xe2\xf4\x67\xaf\x70\x6e\xa1\x72\x26\x29\x6b\x3a\x10\xa3\x51\xcb\x47\xab" "\xa2\xc6\xb8\x36\xc9\x06\x79\xb4\xdd\x85\x9d\xdc\x9e\x48\x00\x44\x8a\xab" "\x00\x00\x00\x00\x00\x00\x0d\x75\xf3\x4b\xb5\x0d\x8d\x70\x84", 249)); NONFAILING(syz_usb_ep_write(/*fd=*/r[0], /*ep=*/0x81, /*len=*/0xffffff75, /*data=*/0x2000000002c0)); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; install_segv_handler(); for (procid = 0; procid < 5; procid++) { if (fork() == 0) { do_sandbox_none(); } } sleep(1000000); return 0; }