// https://syzkaller.appspot.com/bug?id=3c2bd4bf2a0bd3c1f4e5ea85f73a90a13b4775f6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif static unsigned long long procid; static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } struct nlmsg { char* pos; int nesting; struct nlattr* nested[8]; char buf[4096]; }; static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, const void* data, int size) { memset(nlmsg, 0, sizeof(*nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; if (size > 0) memcpy(attr + 1, data, size); nlmsg->pos += NLMSG_ALIGN(attr->nla_len); } static void netlink_nest(struct nlmsg* nlmsg, int typ) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_type = typ; nlmsg->pos += sizeof(*attr); nlmsg->nested[nlmsg->nesting++] = attr; } static void netlink_done(struct nlmsg* nlmsg) { struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; attr->nla_len = nlmsg->pos - (char*)attr; } static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, int* reply_len, bool dofail) { if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != (ssize_t)hdr->nlmsg_len) { if (dofail) exit(1); return -1; } n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); if (reply_len) *reply_len = 0; if (n < 0) { if (dofail) exit(1); return -1; } if (n < (ssize_t)sizeof(struct nlmsghdr)) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type == NLMSG_DONE) return 0; if (reply_len && hdr->nlmsg_type == reply_type) { *reply_len = n; return 0; } if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type != NLMSG_ERROR) { errno = EINVAL; if (dofail) exit(1); return -1; } errno = -((struct nlmsgerr*)(hdr + 1))->error; return -errno; } static int netlink_send(struct nlmsg* nlmsg, int sock) { return netlink_send_ext(nlmsg, sock, 0, NULL, true); } static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = CTRL_CMD_GETFAMILY; netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); int n = 0; int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); if (err < 0) { return -1; } uint16_t id = 0; struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { id = *(uint16_t*)(attr + 1); break; } } if (!id) { errno = EINVAL; return -1; } recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); return id; } static int netlink_next_msg(struct nlmsg* nlmsg, unsigned int offset, unsigned int total_len) { struct nlmsghdr* hdr = (struct nlmsghdr*)(nlmsg->buf + offset); if (offset == total_len || offset + hdr->nlmsg_len > total_len) return -1; return hdr->nlmsg_len; } static unsigned int queue_count = 2; static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type, const char* name, bool up) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); if (name) netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); netlink_attr(nlmsg, IFLA_NUM_TX_QUEUES, &queue_count, sizeof(queue_count)); netlink_attr(nlmsg, IFLA_NUM_RX_QUEUES, &queue_count, sizeof(queue_count)); netlink_nest(nlmsg, IFLA_LINKINFO); netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type)); } static void netlink_add_device(struct nlmsg* nlmsg, int sock, const char* type, const char* name) { netlink_add_device_impl(nlmsg, type, name, false); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_veth(struct nlmsg* nlmsg, int sock, const char* name, const char* peer) { netlink_add_device_impl(nlmsg, "veth", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_nest(nlmsg, VETH_INFO_PEER); nlmsg->pos += sizeof(struct ifinfomsg); netlink_attr(nlmsg, IFLA_IFNAME, peer, strlen(peer)); netlink_attr(nlmsg, IFLA_NUM_TX_QUEUES, &queue_count, sizeof(queue_count)); netlink_attr(nlmsg, IFLA_NUM_RX_QUEUES, &queue_count, sizeof(queue_count)); netlink_done(nlmsg); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_xfrm(struct nlmsg* nlmsg, int sock, const char* name) { netlink_add_device_impl(nlmsg, "xfrm", name, true); netlink_nest(nlmsg, IFLA_INFO_DATA); int if_id = 1; netlink_attr(nlmsg, 2, &if_id, sizeof(if_id)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_hsr(struct nlmsg* nlmsg, int sock, const char* name, const char* slave1, const char* slave2) { netlink_add_device_impl(nlmsg, "hsr", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); int ifindex1 = if_nametoindex(slave1); netlink_attr(nlmsg, IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1)); int ifindex2 = if_nametoindex(slave2); netlink_attr(nlmsg, IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_linked(struct nlmsg* nlmsg, int sock, const char* type, const char* name, const char* link) { netlink_add_device_impl(nlmsg, type, name, false); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_vlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t id, uint16_t proto) { netlink_add_device_impl(nlmsg, "vlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_VLAN_ID, &id, sizeof(id)); netlink_attr(nlmsg, IFLA_VLAN_PROTOCOL, &proto, sizeof(proto)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_macvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link) { netlink_add_device_impl(nlmsg, "macvlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); uint32_t mode = MACVLAN_MODE_BRIDGE; netlink_attr(nlmsg, IFLA_MACVLAN_MODE, &mode, sizeof(mode)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_add_geneve(struct nlmsg* nlmsg, int sock, const char* name, uint32_t vni, struct in_addr* addr4, struct in6_addr* addr6) { netlink_add_device_impl(nlmsg, "geneve", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_GENEVE_ID, &vni, sizeof(vni)); if (addr4) netlink_attr(nlmsg, IFLA_GENEVE_REMOTE, addr4, sizeof(*addr4)); if (addr6) netlink_attr(nlmsg, IFLA_GENEVE_REMOTE6, addr6, sizeof(*addr6)); netlink_done(nlmsg); netlink_done(nlmsg); int err = netlink_send(nlmsg, sock); if (err < 0) { } } #define IFLA_IPVLAN_FLAGS 2 #define IPVLAN_MODE_L3S 2 #undef IPVLAN_F_VEPA #define IPVLAN_F_VEPA 2 static void netlink_add_ipvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t mode, uint16_t flags) { netlink_add_device_impl(nlmsg, "ipvlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA); netlink_attr(nlmsg, IFLA_IPVLAN_MODE, &mode, sizeof(mode)); netlink_attr(nlmsg, IFLA_IPVLAN_FLAGS, &flags, sizeof(flags)); netlink_done(nlmsg); netlink_done(nlmsg); int ifindex = if_nametoindex(link); netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up, const char* master, const void* mac, int macsize, const char* new_name) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; hdr.ifi_index = if_nametoindex(name); netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); if (master) { int ifindex = if_nametoindex(master); netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); } if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev, const void* addr, int addrsize) { struct ifaddrmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; hdr.ifa_scope = RT_SCOPE_UNIVERSE; hdr.ifa_index = if_nametoindex(dev); netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr)); netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); return netlink_send(nlmsg, sock); } static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in_addr in_addr; inet_pton(AF_INET, addr, &in_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); if (err < 0) { } } static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in6_addr in6_addr; inet_pton(AF_INET6, addr, &in6_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); if (err < 0) { } } static void netlink_add_neigh(struct nlmsg* nlmsg, int sock, const char* name, const void* addr, int addrsize, const void* mac, int macsize) { struct ndmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ndm_ifindex = if_nametoindex(name); hdr.ndm_state = NUD_PERMANENT; netlink_init(nlmsg, RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); netlink_attr(nlmsg, NDA_DST, addr, addrsize); netlink_attr(nlmsg, NDA_LLADDR, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static struct nlmsg nlmsg; static int tunfd = -1; #define TUN_IFACE "syz_tun" #define LOCAL_MAC 0xaaaaaaaaaaaa #define REMOTE_MAC 0xaaaaaaaaaabb #define LOCAL_IPV4 "172.20.20.170" #define REMOTE_IPV4 "172.20.20.187" #define LOCAL_IPV6 "fe80::aa" #define REMOTE_IPV6 "fe80::bb" #define IFF_NAPI 0x0010 static void correct_dev_net_tun(void) { struct stat st; if (stat("/dev/net/tun", &st) == 0) { if (S_ISCHR(st.st_mode) && major(st.st_rdev) == 10 && minor(st.st_rdev) == 200) return; if (unlink("/dev/net/tun")) { } } if (mkdir("/dev/net", 0755) && errno != EEXIST) { } if (mknod("/dev/net/tun", S_IFCHR | 0666, makedev(10, 200))) { } if (chmod("/dev/net/tun", 0666)) { } } static void initialize_tun(void) { correct_dev_net_tun(); tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); if (tunfd == -1) { printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n"); printf("otherwise fuzzing or reproducing might not work as intended\n"); return; } const int kTunFd = 200; if (dup2(tunfd, kTunFd) < 0) exit(1); close(tunfd); tunfd = kTunFd; struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ); ifr.ifr_flags = IFF_TAP | IFF_NO_PI; if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) { exit(1); } char sysctl[64]; sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE); write_file(sysctl, "0"); sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE); write_file(sysctl, "0"); int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); netlink_add_addr4(&nlmsg, sock, TUN_IFACE, LOCAL_IPV4); netlink_add_addr6(&nlmsg, sock, TUN_IFACE, LOCAL_IPV6); uint64_t macaddr = REMOTE_MAC; struct in_addr in_addr; inet_pton(AF_INET, REMOTE_IPV4, &in_addr); netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in_addr, sizeof(in_addr), &macaddr, ETH_ALEN); struct in6_addr in6_addr; inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr); netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), &macaddr, ETH_ALEN); macaddr = LOCAL_MAC; netlink_device_change(&nlmsg, sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN, NULL); close(sock); } #define DEVLINK_FAMILY_NAME "devlink" #define DEVLINK_CMD_PORT_GET 5 #define DEVLINK_ATTR_BUS_NAME 1 #define DEVLINK_ATTR_DEV_NAME 2 #define DEVLINK_ATTR_NETDEV_NAME 7 static struct nlmsg nlmsg2; static void initialize_devlink_ports(const char* bus_name, const char* dev_name, const char* netdev_prefix) { struct genlmsghdr genlhdr; int len, total_len, id, err, offset; uint16_t netdev_index; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock == -1) exit(1); int rtsock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (rtsock == -1) exit(1); id = netlink_query_family_id(&nlmsg, sock, DEVLINK_FAMILY_NAME, true); if (id == -1) goto error; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = DEVLINK_CMD_PORT_GET; netlink_init(&nlmsg, id, NLM_F_DUMP, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, DEVLINK_ATTR_BUS_NAME, bus_name, strlen(bus_name) + 1); netlink_attr(&nlmsg, DEVLINK_ATTR_DEV_NAME, dev_name, strlen(dev_name) + 1); err = netlink_send_ext(&nlmsg, sock, id, &total_len, true); if (err < 0) { goto error; } offset = 0; netdev_index = 0; while ((len = netlink_next_msg(&nlmsg, offset, total_len)) != -1) { struct nlattr* attr = (struct nlattr*)(nlmsg.buf + offset + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg.buf + offset + len; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == DEVLINK_ATTR_NETDEV_NAME) { char* port_name; char netdev_name[IFNAMSIZ]; port_name = (char*)(attr + 1); snprintf(netdev_name, sizeof(netdev_name), "%s%d", netdev_prefix, netdev_index); netlink_device_change(&nlmsg2, rtsock, port_name, true, 0, 0, 0, netdev_name); break; } } offset += len; netdev_index++; } error: close(rtsock); close(sock); } #define WIFI_INITIAL_DEVICE_COUNT 2 #define WIFI_MAC_BASE {0x08, 0x02, 0x11, 0x00, 0x00, 0x00} #define WIFI_IBSS_BSSID {0x50, 0x50, 0x50, 0x50, 0x50, 0x50} #define WIFI_IBSS_SSID {0x10, 0x10, 0x10, 0x10, 0x10, 0x10} #define WIFI_DEFAULT_FREQUENCY 2412 #define WIFI_DEFAULT_SIGNAL 0 #define WIFI_DEFAULT_RX_RATE 1 #define HWSIM_CMD_REGISTER 1 #define HWSIM_CMD_FRAME 2 #define HWSIM_CMD_NEW_RADIO 4 #define HWSIM_ATTR_SUPPORT_P2P_DEVICE 14 #define HWSIM_ATTR_PERM_ADDR 22 #define IF_OPER_UP 6 struct join_ibss_props { int wiphy_freq; bool wiphy_freq_fixed; uint8_t* mac; uint8_t* ssid; int ssid_len; }; static int set_interface_state(const char* interface_name, int on) { struct ifreq ifr; int sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { return -1; } memset(&ifr, 0, sizeof(ifr)); strcpy(ifr.ifr_name, interface_name); int ret = ioctl(sock, SIOCGIFFLAGS, &ifr); if (ret < 0) { close(sock); return -1; } if (on) ifr.ifr_flags |= IFF_UP; else ifr.ifr_flags &= ~IFF_UP; ret = ioctl(sock, SIOCSIFFLAGS, &ifr); close(sock); if (ret < 0) { return -1; } return 0; } static int nl80211_set_interface(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, uint32_t iftype, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL80211_CMD_SET_INTERFACE; netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(nlmsg, NL80211_ATTR_IFTYPE, &iftype, sizeof(iftype)); int err = netlink_send_ext(nlmsg, sock, 0, NULL, dofail); if (err < 0) { } return err; } static int nl80211_join_ibss(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, struct join_ibss_props* props, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL80211_CMD_JOIN_IBSS; netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(nlmsg, NL80211_ATTR_SSID, props->ssid, props->ssid_len); netlink_attr(nlmsg, NL80211_ATTR_WIPHY_FREQ, &(props->wiphy_freq), sizeof(props->wiphy_freq)); if (props->mac) netlink_attr(nlmsg, NL80211_ATTR_MAC, props->mac, ETH_ALEN); if (props->wiphy_freq_fixed) netlink_attr(nlmsg, NL80211_ATTR_FREQ_FIXED, NULL, 0); int err = netlink_send_ext(nlmsg, sock, 0, NULL, dofail); if (err < 0) { } return err; } static int get_ifla_operstate(struct nlmsg* nlmsg, int ifindex, bool dofail) { struct ifinfomsg info; memset(&info, 0, sizeof(info)); info.ifi_family = AF_UNSPEC; info.ifi_index = ifindex; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) { return -1; } netlink_init(nlmsg, RTM_GETLINK, 0, &info, sizeof(info)); int n; int err = netlink_send_ext(nlmsg, sock, RTM_NEWLINK, &n, dofail); close(sock); if (err) { return -1; } struct rtattr* attr = IFLA_RTA(NLMSG_DATA(nlmsg->buf)); for (; RTA_OK(attr, n); attr = RTA_NEXT(attr, n)) { if (attr->rta_type == IFLA_OPERSTATE) return *((int32_t*)RTA_DATA(attr)); } return -1; } static int await_ifla_operstate(struct nlmsg* nlmsg, char* interface, int operstate, bool dofail) { int ifindex = if_nametoindex(interface); while (true) { usleep(1000); int ret = get_ifla_operstate(nlmsg, ifindex, dofail); if (ret < 0) return ret; if (ret == operstate) return 0; } return 0; } static int nl80211_setup_ibss_interface(struct nlmsg* nlmsg, int sock, int nl80211_family_id, char* interface, struct join_ibss_props* ibss_props, bool dofail) { int ifindex = if_nametoindex(interface); if (ifindex == 0) { return -1; } int ret = nl80211_set_interface(nlmsg, sock, nl80211_family_id, ifindex, NL80211_IFTYPE_ADHOC, dofail); if (ret < 0) { return -1; } ret = set_interface_state(interface, 1); if (ret < 0) { return -1; } ret = nl80211_join_ibss(nlmsg, sock, nl80211_family_id, ifindex, ibss_props, dofail); if (ret < 0) { return -1; } return 0; } static int hwsim80211_create_device(struct nlmsg* nlmsg, int sock, int hwsim_family, uint8_t mac_addr[ETH_ALEN]) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = HWSIM_CMD_NEW_RADIO; netlink_init(nlmsg, hwsim_family, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, HWSIM_ATTR_SUPPORT_P2P_DEVICE, NULL, 0); netlink_attr(nlmsg, HWSIM_ATTR_PERM_ADDR, mac_addr, ETH_ALEN); int err = netlink_send(nlmsg, sock); if (err < 0) { } return err; } static void initialize_wifi_devices(void) { int rfkill = open("/dev/rfkill", O_RDWR); if (rfkill == -1) exit(1); struct rfkill_event event = {0}; event.type = RFKILL_TYPE_ALL; event.op = RFKILL_OP_CHANGE_ALL; if (write(rfkill, &event, sizeof(event)) != (ssize_t)(sizeof(event))) exit(1); close(rfkill); uint8_t mac_addr[6] = WIFI_MAC_BASE; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock < 0) exit(1); int hwsim_family_id = netlink_query_family_id(&nlmsg, sock, "MAC80211_HWSIM", true); int nl80211_family_id = netlink_query_family_id(&nlmsg, sock, "nl80211", true); if (hwsim_family_id < 0 || nl80211_family_id < 0) exit(1); uint8_t ssid[] = WIFI_IBSS_SSID; uint8_t bssid[] = WIFI_IBSS_BSSID; struct join_ibss_props ibss_props = {.wiphy_freq = WIFI_DEFAULT_FREQUENCY, .wiphy_freq_fixed = true, .mac = bssid, .ssid = ssid, .ssid_len = sizeof(ssid)}; for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) { mac_addr[5] = device_id; int ret = hwsim80211_create_device(&nlmsg, sock, hwsim_family_id, mac_addr); if (ret < 0) exit(1); char interface[6] = "wlan0"; interface[4] += device_id; if (nl80211_setup_ibss_interface(&nlmsg, sock, nl80211_family_id, interface, &ibss_props, true) < 0) exit(1); } for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) { char interface[6] = "wlan0"; interface[4] += device_id; int ret = await_ifla_operstate(&nlmsg, interface, IF_OPER_UP, true); if (ret < 0) exit(1); } close(sock); } static int runcmdline(char* cmdline) { int ret = system(cmdline); if (ret) { } return ret; } #define DEV_IPV4 "172.20.20.%d" #define DEV_IPV6 "fe80::%02x" #define DEV_MAC 0x00aaaaaaaaaa static void netdevsim_add(unsigned int addr, unsigned int port_count) { write_file("/sys/bus/netdevsim/del_device", "%u", addr); if (write_file("/sys/bus/netdevsim/new_device", "%u %u", addr, port_count)) { char buf[32]; snprintf(buf, sizeof(buf), "netdevsim%d", addr); initialize_devlink_ports("netdevsim", buf, "netdevsim"); } } #define WG_GENL_NAME "wireguard" enum wg_cmd { WG_CMD_GET_DEVICE, WG_CMD_SET_DEVICE, }; enum wgdevice_attribute { WGDEVICE_A_UNSPEC, WGDEVICE_A_IFINDEX, WGDEVICE_A_IFNAME, WGDEVICE_A_PRIVATE_KEY, WGDEVICE_A_PUBLIC_KEY, WGDEVICE_A_FLAGS, WGDEVICE_A_LISTEN_PORT, WGDEVICE_A_FWMARK, WGDEVICE_A_PEERS, }; enum wgpeer_attribute { WGPEER_A_UNSPEC, WGPEER_A_PUBLIC_KEY, WGPEER_A_PRESHARED_KEY, WGPEER_A_FLAGS, WGPEER_A_ENDPOINT, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, WGPEER_A_LAST_HANDSHAKE_TIME, WGPEER_A_RX_BYTES, WGPEER_A_TX_BYTES, WGPEER_A_ALLOWEDIPS, WGPEER_A_PROTOCOL_VERSION, }; enum wgallowedip_attribute { WGALLOWEDIP_A_UNSPEC, WGALLOWEDIP_A_FAMILY, WGALLOWEDIP_A_IPADDR, WGALLOWEDIP_A_CIDR_MASK, }; static void netlink_wireguard_setup(void) { const char ifname_a[] = "wg0"; const char ifname_b[] = "wg1"; const char ifname_c[] = "wg2"; const char private_a[] = "\xa0\x5c\xa8\x4f\x6c\x9c\x8e\x38\x53\xe2\xfd\x7a\x70\xae\x0f\xb2\x0f\xa1" "\x52\x60\x0c\xb0\x08\x45\x17\x4f\x08\x07\x6f\x8d\x78\x43"; const char private_b[] = "\xb0\x80\x73\xe8\xd4\x4e\x91\xe3\xda\x92\x2c\x22\x43\x82\x44\xbb\x88\x5c" "\x69\xe2\x69\xc8\xe9\xd8\x35\xb1\x14\x29\x3a\x4d\xdc\x6e"; const char private_c[] = "\xa0\xcb\x87\x9a\x47\xf5\xbc\x64\x4c\x0e\x69\x3f\xa6\xd0\x31\xc7\x4a\x15" "\x53\xb6\xe9\x01\xb9\xff\x2f\x51\x8c\x78\x04\x2f\xb5\x42"; const char public_a[] = "\x97\x5c\x9d\x81\xc9\x83\xc8\x20\x9e\xe7\x81\x25\x4b\x89\x9f\x8e\xd9\x25" "\xae\x9f\x09\x23\xc2\x3c\x62\xf5\x3c\x57\xcd\xbf\x69\x1c"; const char public_b[] = "\xd1\x73\x28\x99\xf6\x11\xcd\x89\x94\x03\x4d\x7f\x41\x3d\xc9\x57\x63\x0e" "\x54\x93\xc2\x85\xac\xa4\x00\x65\xcb\x63\x11\xbe\x69\x6b"; const char public_c[] = "\xf4\x4d\xa3\x67\xa8\x8e\xe6\x56\x4f\x02\x02\x11\x45\x67\x27\x08\x2f\x5c" "\xeb\xee\x8b\x1b\xf5\xeb\x73\x37\x34\x1b\x45\x9b\x39\x22"; const uint16_t listen_a = 20001; const uint16_t listen_b = 20002; const uint16_t listen_c = 20003; const uint16_t af_inet = AF_INET; const uint16_t af_inet6 = AF_INET6; const struct sockaddr_in endpoint_b_v4 = { .sin_family = AF_INET, .sin_port = htons(listen_b), .sin_addr = {htonl(INADDR_LOOPBACK)}}; const struct sockaddr_in endpoint_c_v4 = { .sin_family = AF_INET, .sin_port = htons(listen_c), .sin_addr = {htonl(INADDR_LOOPBACK)}}; struct sockaddr_in6 endpoint_a_v6 = {.sin6_family = AF_INET6, .sin6_port = htons(listen_a)}; endpoint_a_v6.sin6_addr = in6addr_loopback; struct sockaddr_in6 endpoint_c_v6 = {.sin6_family = AF_INET6, .sin6_port = htons(listen_c)}; endpoint_c_v6.sin6_addr = in6addr_loopback; const struct in_addr first_half_v4 = {0}; const struct in_addr second_half_v4 = {(uint32_t)htonl(128 << 24)}; const struct in6_addr first_half_v6 = {{{0}}}; const struct in6_addr second_half_v6 = {{{0x80}}}; const uint8_t half_cidr = 1; const uint16_t persistent_keepalives[] = {1, 3, 7, 9, 14, 19}; struct genlmsghdr genlhdr = {.cmd = WG_CMD_SET_DEVICE, .version = 1}; int sock; int id, err; sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock == -1) { return; } id = netlink_query_family_id(&nlmsg, sock, WG_GENL_NAME, true); if (id == -1) goto error; netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_a, strlen(ifname_a) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_a, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_a, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[0], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v6, sizeof(endpoint_c_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[1], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_b, strlen(ifname_b) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_b, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_b, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[2], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v4, sizeof(endpoint_c_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[3], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_c, strlen(ifname_c) + 1); netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_c, 32); netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_c, 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[4], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4)); netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[5], 2); netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_nest(&nlmsg, NLA_F_NESTED | 0); netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); netlink_done(&nlmsg); err = netlink_send(&nlmsg, sock); if (err < 0) { } error: close(sock); } static void initialize_netdevices(void) { char netdevsim[16]; sprintf(netdevsim, "netdevsim%d", (int)procid); struct { const char* type; const char* dev; } devtypes[] = { {"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"}, {"vcan", "vcan0"}, {"bond", "bond0"}, {"team", "team0"}, {"dummy", "dummy0"}, {"nlmon", "nlmon0"}, {"caif", "caif0"}, {"batadv", "batadv0"}, {"vxcan", "vxcan1"}, {"veth", 0}, {"wireguard", "wg0"}, {"wireguard", "wg1"}, {"wireguard", "wg2"}, }; const char* devmasters[] = {"bridge", "bond", "team", "batadv"}; struct { const char* name; int macsize; bool noipv6; } devices[] = { {"lo", ETH_ALEN}, {"sit0", 0}, {"bridge0", ETH_ALEN}, {"vcan0", 0, true}, {"tunl0", 0}, {"gre0", 0}, {"gretap0", ETH_ALEN}, {"ip_vti0", 0}, {"ip6_vti0", 0}, {"ip6tnl0", 0}, {"ip6gre0", 0}, {"ip6gretap0", ETH_ALEN}, {"erspan0", ETH_ALEN}, {"bond0", ETH_ALEN}, {"veth0", ETH_ALEN}, {"veth1", ETH_ALEN}, {"team0", ETH_ALEN}, {"veth0_to_bridge", ETH_ALEN}, {"veth1_to_bridge", ETH_ALEN}, {"veth0_to_bond", ETH_ALEN}, {"veth1_to_bond", ETH_ALEN}, {"veth0_to_team", ETH_ALEN}, {"veth1_to_team", ETH_ALEN}, {"veth0_to_hsr", ETH_ALEN}, {"veth1_to_hsr", ETH_ALEN}, {"hsr0", 0}, {"dummy0", ETH_ALEN}, {"nlmon0", 0}, {"vxcan0", 0, true}, {"vxcan1", 0, true}, {"caif0", ETH_ALEN}, {"batadv0", ETH_ALEN}, {netdevsim, ETH_ALEN}, {"xfrm0", ETH_ALEN}, {"veth0_virt_wifi", ETH_ALEN}, {"veth1_virt_wifi", ETH_ALEN}, {"virt_wifi0", ETH_ALEN}, {"veth0_vlan", ETH_ALEN}, {"veth1_vlan", ETH_ALEN}, {"vlan0", ETH_ALEN}, {"vlan1", ETH_ALEN}, {"macvlan0", ETH_ALEN}, {"macvlan1", ETH_ALEN}, {"ipvlan0", ETH_ALEN}, {"ipvlan1", ETH_ALEN}, {"veth0_macvtap", ETH_ALEN}, {"veth1_macvtap", ETH_ALEN}, {"macvtap0", ETH_ALEN}, {"macsec0", ETH_ALEN}, {"veth0_to_batadv", ETH_ALEN}, {"veth1_to_batadv", ETH_ALEN}, {"batadv_slave_0", ETH_ALEN}, {"batadv_slave_1", ETH_ALEN}, {"geneve0", ETH_ALEN}, {"geneve1", ETH_ALEN}, {"wg0", 0}, {"wg1", 0}, {"wg2", 0}, }; int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) netlink_add_device(&nlmsg, sock, devtypes[i].type, devtypes[i].dev); for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) { char master[32], slave0[32], veth0[32], slave1[32], veth1[32]; sprintf(slave0, "%s_slave_0", devmasters[i]); sprintf(veth0, "veth0_to_%s", devmasters[i]); netlink_add_veth(&nlmsg, sock, slave0, veth0); sprintf(slave1, "%s_slave_1", devmasters[i]); sprintf(veth1, "veth1_to_%s", devmasters[i]); netlink_add_veth(&nlmsg, sock, slave1, veth1); sprintf(master, "%s0", devmasters[i]); netlink_device_change(&nlmsg, sock, slave0, false, master, 0, 0, NULL); netlink_device_change(&nlmsg, sock, slave1, false, master, 0, 0, NULL); } netlink_add_xfrm(&nlmsg, sock, "xfrm0"); netlink_device_change(&nlmsg, sock, "bridge_slave_0", true, 0, 0, 0, NULL); netlink_device_change(&nlmsg, sock, "bridge_slave_1", true, 0, 0, 0, NULL); netlink_add_veth(&nlmsg, sock, "hsr_slave_0", "veth0_to_hsr"); netlink_add_veth(&nlmsg, sock, "hsr_slave_1", "veth1_to_hsr"); netlink_add_hsr(&nlmsg, sock, "hsr0", "hsr_slave_0", "hsr_slave_1"); netlink_device_change(&nlmsg, sock, "hsr_slave_0", true, 0, 0, 0, NULL); netlink_device_change(&nlmsg, sock, "hsr_slave_1", true, 0, 0, 0, NULL); netlink_add_veth(&nlmsg, sock, "veth0_virt_wifi", "veth1_virt_wifi"); netlink_add_linked(&nlmsg, sock, "virt_wifi", "virt_wifi0", "veth1_virt_wifi"); netlink_add_veth(&nlmsg, sock, "veth0_vlan", "veth1_vlan"); netlink_add_vlan(&nlmsg, sock, "vlan0", "veth0_vlan", 0, htons(ETH_P_8021Q)); netlink_add_vlan(&nlmsg, sock, "vlan1", "veth0_vlan", 1, htons(ETH_P_8021AD)); netlink_add_macvlan(&nlmsg, sock, "macvlan0", "veth1_vlan"); netlink_add_macvlan(&nlmsg, sock, "macvlan1", "veth1_vlan"); netlink_add_ipvlan(&nlmsg, sock, "ipvlan0", "veth0_vlan", IPVLAN_MODE_L2, 0); netlink_add_ipvlan(&nlmsg, sock, "ipvlan1", "veth0_vlan", IPVLAN_MODE_L3S, IPVLAN_F_VEPA); netlink_add_veth(&nlmsg, sock, "veth0_macvtap", "veth1_macvtap"); netlink_add_linked(&nlmsg, sock, "macvtap", "macvtap0", "veth0_macvtap"); netlink_add_linked(&nlmsg, sock, "macsec", "macsec0", "veth1_macvtap"); char addr[32]; sprintf(addr, DEV_IPV4, 14 + 10); struct in_addr geneve_addr4; if (inet_pton(AF_INET, addr, &geneve_addr4) <= 0) exit(1); struct in6_addr geneve_addr6; if (inet_pton(AF_INET6, "fc00::01", &geneve_addr6) <= 0) exit(1); netlink_add_geneve(&nlmsg, sock, "geneve0", 0, &geneve_addr4, 0); netlink_add_geneve(&nlmsg, sock, "geneve1", 1, 0, &geneve_addr6); netdevsim_add((int)procid, 4); netlink_wireguard_setup(); for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) { char addr[32]; sprintf(addr, DEV_IPV4, i + 10); netlink_add_addr4(&nlmsg, sock, devices[i].name, addr); if (!devices[i].noipv6) { sprintf(addr, DEV_IPV6, i + 10); netlink_add_addr6(&nlmsg, sock, devices[i].name, addr); } uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40); netlink_device_change(&nlmsg, sock, devices[i].name, true, 0, &macaddr, devices[i].macsize, NULL); } close(sock); } static void initialize_netdevices_init(void) { int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); struct { const char* type; int macsize; bool noipv6; bool noup; } devtypes[] = { {"nr", 7, true}, {"rose", 5, true, true}, }; unsigned i; for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) { char dev[32], addr[32]; sprintf(dev, "%s%d", devtypes[i].type, (int)procid); sprintf(addr, "172.30.%d.%d", i, (int)procid + 1); netlink_add_addr4(&nlmsg, sock, dev, addr); if (!devtypes[i].noipv6) { sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1); netlink_add_addr6(&nlmsg, sock, dev, addr); } int macsize = devtypes[i].macsize; uint64_t macaddr = 0xbbbbbb + ((unsigned long long)i << (8 * (macsize - 2))) + (procid << (8 * (macsize - 1))); netlink_device_change(&nlmsg, sock, dev, !devtypes[i].noup, 0, &macaddr, macsize, NULL); } close(sock); } static void setup_gadgetfs(); static void setup_binderfs(); static void setup_fusectl(); static void sandbox_common_mount_tmpfs(void) { write_file("/proc/sys/fs/mount-max", "100000"); if (mkdir("./syz-tmp", 0777)) exit(1); if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot", 0777)) exit(1); if (mkdir("./syz-tmp/newroot/dev", 0700)) exit(1); unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE; if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/proc", 0700)) exit(1); if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/selinux", 0700)) exit(1); const char* selinux_path = "./syz-tmp/newroot/selinux"; if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) { if (errno != ENOENT) exit(1); if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); } if (mkdir("./syz-tmp/newroot/sys", 0700)) exit(1); if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL)) exit(1); if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/newroot/syz-inputs", 0700)) exit(1); if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, bind_mount_flags | MS_RDONLY, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/pivot", 0777)) exit(1); if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { if (chdir("./syz-tmp")) exit(1); } else { if (chdir("/")) exit(1); if (umount2("./pivot", MNT_DETACH)) exit(1); } if (chroot("./newroot")) exit(1); if (chdir("/")) exit(1); setup_gadgetfs(); setup_binderfs(); setup_fusectl(); } static void setup_gadgetfs() { if (mkdir("/dev/gadgetfs", 0777)) { } if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) { } } static void setup_fusectl() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void setup_binderfs() { if (mkdir("/dev/binderfs", 0777)) { } if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { } if (symlink("/dev/binderfs", "./binderfs")) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); if (getppid() == 1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); sandbox_common(); drop_caps(); initialize_netdevices_init(); if (unshare(CLONE_NEWNET)) { } write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); initialize_tun(); initialize_netdevices(); initialize_wifi_devices(); sandbox_common_mount_tmpfs(); loop(); exit(1); } static const char* setup_binfmt_misc() { if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0) && errno != EBUSY) { return NULL; } if (!write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:") || !write_file("/proc/sys/fs/binfmt_misc/register", ":syz1:M:1:\x02::./file0:POC")) return "write(/proc/sys/fs/binfmt_misc/register) failed"; return NULL; } static void setup_sysctl() { int cad_pid = fork(); if (cad_pid < 0) exit(1); if (cad_pid == 0) { for (;;) sleep(100); } char tmppid[32]; snprintf(tmppid, sizeof(tmppid), "%d", cad_pid); struct { const char* name; const char* data; } files[] = { {"/sys/kernel/debug/x86/nmi_longest_ns", "10000000000"}, {"/proc/sys/kernel/hung_task_check_interval_secs", "20"}, {"/proc/sys/net/core/bpf_jit_kallsyms", "1"}, {"/proc/sys/net/core/bpf_jit_harden", "0"}, {"/proc/sys/kernel/kptr_restrict", "0"}, {"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"}, {"/proc/sys/fs/mount-max", "100"}, {"/proc/sys/vm/oom_dump_tasks", "0"}, {"/proc/sys/debug/exception-trace", "0"}, {"/proc/sys/kernel/printk", "7 4 1 3"}, {"/proc/sys/kernel/keys/gc_delay", "1"}, {"/proc/sys/vm/oom_kill_allocating_task", "1"}, {"/sys/kernel/debug/failslab/task-filter", "Y"}, {"/sys/kernel/debug/fail_page_alloc/task-filter", "Y"}, {"/sys/kernel/debug/fail_futex/task-filter", "Y"}, {"/sys/kernel/debug/fail_usercopy/task-filter", "Y"}, {"/sys/kernel/debug/fail_make_request/task-filter", "Y"}, {"/sys/kernel/debug/fail_io_timeout/task-filter", "Y"}, {"/sys/kernel/debug/fail_iommufd/task-filter", "Y"}, {"/proc/sys/kernel/ctrl-alt-del", "0"}, {"/proc/sys/kernel/cad_pid", tmppid}, }; for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) { if (!write_file(files[i].name, files[i].data)) { } } kill(cad_pid, SIGKILL); while (waitpid(cad_pid, NULL, 0) != cad_pid) ; } #define NL802154_CMD_SET_SHORT_ADDR 11 #define NL802154_ATTR_IFINDEX 3 #define NL802154_ATTR_SHORT_ADDR 10 static const char* setup_802154() { const char* error = NULL; int sock_generic = -1; int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock_route == -1) { error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) failed"; goto fail; } sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock_generic == -1) { error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) failed"; goto fail; } { int nl802154_family_id = netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true); if (nl802154_family_id < 0) { error = "netlink_query_family_id failed"; goto fail; } for (int i = 0; i < 2; i++) { char devname[] = "wpan0"; devname[strlen(devname) - 1] += i; uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8); uint16_t shortaddr = 0xaaa0 + i; int ifindex = if_nametoindex(devname); struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR; netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr, sizeof(shortaddr)); if (netlink_send(&nlmsg, sock_generic) < 0) { error = "NL802154_CMD_SET_SHORT_ADDR failed"; goto fail; } netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr, sizeof(hwaddr), 0); if (i == 0) { netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false); netlink_done(&nlmsg); netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); if (netlink_send(&nlmsg, sock_route) < 0) { error = "netlink: adding device lowpan0 type lowpan link wpan0"; goto fail; } } } } fail: close(sock_route); close(sock_generic); return error; } #define SWAP_FILE "./swap-file" #define SWAP_FILE_SIZE (128 * 1000 * 1000) static const char* setup_swap() { swapoff(SWAP_FILE); unlink(SWAP_FILE); int fd = open(SWAP_FILE, O_CREAT | O_WRONLY | O_CLOEXEC, 0600); if (fd == -1) return "swap file open failed"; fallocate(fd, FALLOC_FL_ZERO_RANGE, 0, SWAP_FILE_SIZE); close(fd); char cmdline[64]; sprintf(cmdline, "mkswap %s", SWAP_FILE); if (runcmdline(cmdline)) return "mkswap failed"; if (swapon(SWAP_FILE, SWAP_FLAG_PREFER) == 1) return "swapon failed"; return NULL; } uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void loop(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0x7 (4 bytes) // ninsn: bytesize8 = 0x8 (4 bytes) // insns: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 18 12 00 00} (length 0x14) // } // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // union ANYUNION { // ANYBLOB: buffer: {00 00 00 00 00 00 00 00 b7 03 00 00 02 00 00 // 00 85 00 00 00 1b 00 00 00 b7 00 00 00 00 00 00 00 95} (length // 0x21) // } // } // } // license: nil // loglev: int32 = 0x0 (4 bytes) // logsize: len = 0x0 (4 bytes) // log: nil // kern_version: bpf_kern_version = 0x41000 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // fallback: bpf_attach_types = 0x20 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x0 (4 bytes) // func_info: nil // func_info_cnt: len = 0x0 (4 bytes) // line_info_rec_size: const = 0x0 (4 bytes) // line_info: nil // line_info_cnt: len = 0x0 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x0 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x94 (8 bytes) // ] // returns fd_bpf_prog NONFAILING(*(uint32_t*)0x200000000680 = 7); NONFAILING(*(uint32_t*)0x200000000684 = 8); NONFAILING(*(uint64_t*)0x200000000688 = 0x200000000080); NONFAILING(memcpy((void*)0x200000000080, "\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x18\x12\x00\x00", 20)); NONFAILING(*(uint32_t*)0x200000000094 = -1); NONFAILING(memcpy( (void*)0x200000000098, "\x00\x00\x00\x00\x00\x00\x00\x00\xb7\x03\x00\x00\x02\x00\x00\x00\x85\x00" "\x00\x00\x1b\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x95", 33)); NONFAILING(*(uint64_t*)0x200000000690 = 0); NONFAILING(*(uint32_t*)0x200000000698 = 0); NONFAILING(*(uint32_t*)0x20000000069c = 0); NONFAILING(*(uint64_t*)0x2000000006a0 = 0); NONFAILING(*(uint32_t*)0x2000000006a8 = 0x41000); NONFAILING(*(uint32_t*)0x2000000006ac = 0); NONFAILING(memset((void*)0x2000000006b0, 0, 16)); NONFAILING(*(uint32_t*)0x2000000006c0 = 0); NONFAILING(*(uint32_t*)0x2000000006c4 = 0x20); NONFAILING(*(uint32_t*)0x2000000006c8 = 0); NONFAILING(*(uint32_t*)0x2000000006cc = 0); NONFAILING(*(uint64_t*)0x2000000006d0 = 0); NONFAILING(*(uint32_t*)0x2000000006d8 = 0); NONFAILING(*(uint32_t*)0x2000000006dc = 0); NONFAILING(*(uint64_t*)0x2000000006e0 = 0); NONFAILING(*(uint32_t*)0x2000000006e8 = 0); NONFAILING(*(uint32_t*)0x2000000006ec = 0); NONFAILING(*(uint32_t*)0x2000000006f0 = 0); NONFAILING(*(uint32_t*)0x2000000006f4 = 0); NONFAILING(*(uint64_t*)0x2000000006f8 = 0); NONFAILING(*(uint64_t*)0x200000000700 = 0); NONFAILING(*(uint32_t*)0x200000000708 = 0); NONFAILING(*(uint32_t*)0x20000000070c = 0); NONFAILING(*(uint32_t*)0x200000000710 = 0); syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000680ul, /*size=*/0x94ul); // bpf$MAP_CREATE arguments: [ // cmd: const = 0x0 (8 bytes) // arg: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {07 00 00 00 04 00 00 00 00 01 00 00 03 00 00 00 // 28 00 00 00} (length 0x14) // } // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // union ANYUNION { // ANYBLOB: buffer: {} (length 0x0) // } // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // union ANYUNION { // ANYBLOB: buffer: {} (length 0x0) // } // } // } // size: len = 0x50 (8 bytes) // ] // returns fd_bpf_map NONFAILING(memcpy((void*)0x2000000000c0, "\x07\x00\x00\x00\x04\x00\x00\x00\x00\x01\x00\x00\x03\x00" "\x00\x00\x28\x00\x00\x00", 20)); NONFAILING(*(uint32_t*)0x2000000000d4 = -1); NONFAILING(*(uint32_t*)0x2000000000d8 = 0); NONFAILING(*(uint32_t*)0x2000000000dc = -1); res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x2000000000c0ul, /*size=*/0x50ul); if (res != -1) r[0] = res; // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0x7 (4 bytes) // ninsn: bytesize8 = 0x8 (4 bytes) // insns: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 18 12 00 00} (length 0x14) // } // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // } // } // license: ptr[in, buffer] { // buffer: {47 50 4c 00} (length 0x4) // } // loglev: int32 = 0x0 (4 bytes) // logsize: len = 0x0 (4 bytes) // log: nil // kern_version: bpf_kern_version = 0x41000 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // fallback: bpf_attach_types = 0x20 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x0 (4 bytes) // func_info: nil // func_info_cnt: len = 0x0 (4 bytes) // line_info_rec_size: const = 0x0 (4 bytes) // line_info: nil // line_info_cnt: len = 0x0 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x0 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x94 (8 bytes) // ] // returns fd_bpf_prog NONFAILING(*(uint32_t*)0x200000000680 = 7); NONFAILING(*(uint32_t*)0x200000000684 = 8); NONFAILING(*(uint64_t*)0x200000000688 = 0x200000000080); NONFAILING(memcpy((void*)0x200000000080, "\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x18\x12\x00\x00", 20)); NONFAILING(*(uint32_t*)0x200000000094 = r[0]); NONFAILING(*(uint64_t*)0x200000000690 = 0x200000000780); NONFAILING(memcpy((void*)0x200000000780, "GPL\000", 4)); NONFAILING(*(uint32_t*)0x200000000698 = 0); NONFAILING(*(uint32_t*)0x20000000069c = 0); NONFAILING(*(uint64_t*)0x2000000006a0 = 0); NONFAILING(*(uint32_t*)0x2000000006a8 = 0x41000); NONFAILING(*(uint32_t*)0x2000000006ac = 0); NONFAILING(memset((void*)0x2000000006b0, 0, 16)); NONFAILING(*(uint32_t*)0x2000000006c0 = 0); NONFAILING(*(uint32_t*)0x2000000006c4 = 0x20); NONFAILING(*(uint32_t*)0x2000000006c8 = 0); NONFAILING(*(uint32_t*)0x2000000006cc = 0); NONFAILING(*(uint64_t*)0x2000000006d0 = 0); NONFAILING(*(uint32_t*)0x2000000006d8 = 0); NONFAILING(*(uint32_t*)0x2000000006dc = 0); NONFAILING(*(uint64_t*)0x2000000006e0 = 0); NONFAILING(*(uint32_t*)0x2000000006e8 = 0); NONFAILING(*(uint32_t*)0x2000000006ec = 0); NONFAILING(*(uint32_t*)0x2000000006f0 = 0); NONFAILING(*(uint32_t*)0x2000000006f4 = 0); NONFAILING(*(uint64_t*)0x2000000006f8 = 0); NONFAILING(*(uint64_t*)0x200000000700 = 0); NONFAILING(*(uint32_t*)0x200000000708 = 0); NONFAILING(*(uint32_t*)0x20000000070c = 0); NONFAILING(*(uint32_t*)0x200000000710 = 0); res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000680ul, /*size=*/0x94ul); if (res != -1) r[1] = res; // perf_event_open arguments: [ // attr: ptr[in, perf_event_attr] { // perf_event_attr { // type: perf_event_type = 0x1 (4 bytes) // size: len = 0x80 (4 bytes) // config0: int8 = 0x2 (1 bytes) // config1: int8 = 0x0 (1 bytes) // config2: int8 = 0x0 (1 bytes) // config3: int8 = 0x0 (1 bytes) // config4: const = 0x0 (4 bytes) // sample_freq: int64 = 0x400 (8 bytes) // sample_type: perf_sample_type = 0x66137 (8 bytes) // read_format: perf_read_format = 0x0 (8 bytes) // disabled: int64 = 0x0 (0 bytes) // inherit: int64 = 0x0 (0 bytes) // pinned: int64 = 0x0 (0 bytes) // exclusive: int64 = 0x0 (0 bytes) // exclude_user: int64 = 0x0 (0 bytes) // exclude_kernel: int64 = 0x0 (0 bytes) // exclude_hv: int64 = 0x0 (0 bytes) // exclude_idle: int64 = 0x0 (0 bytes) // mmap: int64 = 0x0 (0 bytes) // comm: int64 = 0x0 (0 bytes) // freq: int64 = 0x0 (0 bytes) // inherit_stat: int64 = 0x0 (0 bytes) // enable_on_exec: int64 = 0x0 (0 bytes) // task: int64 = 0x0 (0 bytes) // watermark: int64 = 0x0 (0 bytes) // precise_ip: int64 = 0x0 (0 bytes) // mmap_data: int64 = 0x0 (0 bytes) // sample_id_all: int64 = 0x0 (0 bytes) // exclude_host: int64 = 0x0 (0 bytes) // exclude_guest: int64 = 0x0 (0 bytes) // exclude_callchain_kernel: int64 = 0x0 (0 bytes) // exclude_callchain_user: int64 = 0x0 (0 bytes) // mmap2: int64 = 0x0 (0 bytes) // comm_exec: int64 = 0x0 (0 bytes) // use_clockid: int64 = 0x0 (0 bytes) // context_switch: int64 = 0x0 (0 bytes) // write_backward: int64 = 0x0 (0 bytes) // namespaces: int64 = 0x0 (0 bytes) // ksymbol: int64 = 0x0 (0 bytes) // bpf_event: int64 = 0x0 (0 bytes) // aux_output: int64 = 0x0 (0 bytes) // cgroup: int64 = 0x0 (0 bytes) // text_poke: int64 = 0x0 (0 bytes) // build_id: int64 = 0x0 (0 bytes) // inherit_thread: int64 = 0x0 (0 bytes) // remove_on_exec: int64 = 0x0 (0 bytes) // sigtrap: int64 = 0x0 (0 bytes) // __reserved_1: const = 0x0 (8 bytes) // wakeup_events: int32 = 0x24000000 (4 bytes) // bp_type: perf_bp_type = 0x0 (4 bytes) // bp_config: union perf_bp_config { // perf_bp: perf_bp { // bp_addr: nil // bp_len: perf_bp_lens = 0x8 (8 bytes) // } // } // branch_sample_type: perf_branch_sample_type = 0x0 (8 bytes) // sample_regs_user: int64 = 0x0 (8 bytes) // sample_stack_user: int32 = 0x0 (4 bytes) // clockid: clock_type = 0x0 (4 bytes) // sample_regs_intr: int64 = 0x7 (8 bytes) // aux_watermark: int32 = 0x0 (4 bytes) // sample_max_stack: int16 = 0x0 (2 bytes) // __reserved_2: const = 0x0 (2 bytes) // aux_sample_size: int32 = 0x0 (4 bytes) // __reserved_3: const = 0x0 (4 bytes) // sig_data: int64 = 0x0 (8 bytes) // } // } // pid: pid (resource) // cpu: intptr = 0xffefffffffffffff (8 bytes) // group: fd_perf (resource) // flags: perf_flags = 0x0 (8 bytes) // ] // returns fd_perf NONFAILING(*(uint32_t*)0x200000000fc0 = 1); NONFAILING(*(uint32_t*)0x200000000fc4 = 0x80); NONFAILING(*(uint8_t*)0x200000000fc8 = 2); NONFAILING(*(uint8_t*)0x200000000fc9 = 0); NONFAILING(*(uint8_t*)0x200000000fca = 0); NONFAILING(*(uint8_t*)0x200000000fcb = 0); NONFAILING(*(uint32_t*)0x200000000fcc = 0); NONFAILING(*(uint64_t*)0x200000000fd0 = 0x400); NONFAILING(*(uint64_t*)0x200000000fd8 = 0x66137); NONFAILING(*(uint64_t*)0x200000000fe0 = 0); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 0, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 1, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 2, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 4, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 5, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 7, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 8, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 9, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 10, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 11, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 12, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 13, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 14, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 15, 2)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 17, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 18, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 19, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 20, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 21, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 22, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 23, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 24, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 25, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 26, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 27, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 28, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 29, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 30, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 31, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 32, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 33, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 34, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 35, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 36, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 37, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 38, 26)); NONFAILING(*(uint32_t*)0x200000000ff0 = 0x24000000); NONFAILING(*(uint32_t*)0x200000000ff4 = 0); NONFAILING(*(uint64_t*)0x200000000ff8 = 0); NONFAILING(*(uint64_t*)0x200000001000 = 8); NONFAILING(*(uint64_t*)0x200000001008 = 0); NONFAILING(*(uint64_t*)0x200000001010 = 0); NONFAILING(*(uint32_t*)0x200000001018 = 0); NONFAILING(*(uint32_t*)0x20000000101c = 0); NONFAILING(*(uint64_t*)0x200000001020 = 7); NONFAILING(*(uint32_t*)0x200000001028 = 0); NONFAILING(*(uint16_t*)0x20000000102c = 0); NONFAILING(*(uint16_t*)0x20000000102e = 0); NONFAILING(*(uint32_t*)0x200000001030 = 0); NONFAILING(*(uint32_t*)0x200000001034 = 0); NONFAILING(*(uint64_t*)0x200000001038 = 0); res = syscall(__NR_perf_event_open, /*attr=*/0x200000000fc0ul, /*pid=*/0, /*cpu=*/0xffeffffffffffffful, /*group=*/(intptr_t)-1, /*flags=*/0ul); if (res != -1) r[2] = res; // ioctl$PERF_EVENT_IOC_SET_BPF arguments: [ // fd: fd_perf (resource) // cmd: const = 0x40042408 (4 bytes) // prog: fd_bpf_prog (resource) // ] syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0x40042408, /*prog=*/r[1]); // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0x5 (4 bytes) // ninsn: bytesize8 = 0x3 (4 bytes) // insns: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {85 00 00 00 ae 00 00 00 25 00 00 00 ff ff ff // af 95 00 00 00 00 00 00 00 af cd 48 d6 49 37 90 71 00 00 00 00 // 00 08 00 00 b2 c6 16 1d ba 39 21 76 dd 29 63 03 8e 1d 69 ba 7e // a9 4c 50 0d c4 ef 2f ad 96 ed 40 6f 21 ca f5 ad cf 92 05 69 c0 // 0c c1 19 96 84 fa 7c 93 83 6d 9e a2 cf b0 e6 04 36 e0 54 25 cc // 46 86 b0 66 70 7d e9 4a 4f 4d 5f c7 9c 98 7d 66 9f 38 1f ac a0 // f9 d9 92 4b e4 1a 91 69 bd fa f1 6d a9 15 b2 e2 49 f2 1c 6e ee // 84 30 9e 7a 23 c1 9a 39 48 30 f2 53 9f cb 4e 0b 6e ab 1a a7 d5 // 55 45 a3 4e ff a0 77 fa a5 5c 59 e8 82 54 f5 40 77 f7 99 bf 16 // 83 01 00 00 00 bf b1 c0 e6 b1 24 4d 35 b2 13 bd a8 4c c1 72 af // cc 2e 47 a7 d8 b8 5a 5e 3d 77 ac 46 39 20 e2 31 b7 ae 0d a8 61 // 6d 2b 79 58 f9 1f 5d a6 c0 25 d0 60 ab 18 6d 94 af 98 af 1d a2 // b5 95 2e b1 58 55 93 3a 21 23 04 e0 35 f7 a3 5d fc 72 c8 12 56 // a5 5a 25 f8 fe 3b 28 d7 e5 3c 78 fb b8 88 b0 25 5f 34 71 60 ec // 83 07 00 00 00 00 00 00 40 15 cf 10 45 3f 6c 0b 97 3b 81 a4 84 // eb ad 04 85 9d 92 83 65 a7 ea 3f ab 2e 4b 38 0a 00 d7 2b c0 48 // 0f 94 47 97 57 30 67 20 39 93 79 d9 27 1c f5 55 c1 4d 56 b5 1c // 22 98 23 7b eb fc 08 e0 d5 97 6a 94 2b 84 41 39 f1 11 1f 2d c5 // e4 6a c1 c6 0a 9b 03 00 74 bf bc d4 b0 90 12 17 54 84 13 5f 0e // 51 9f 0b 1e 4a aa 02 6d 57 0e cb 5e 8c dd be d6 5f f7 02 00 00 // 00 a3 ff 4f 8a 4c f7 96 b0 7a 6f f6 1c 55 52 41 7f d7 03 f7 f1 // 4d 8b 78 a6 02 ca 3c df 6a 66 2d 8b c9 c8 9c 91 20 07 2a 5d 00 // dc dd 85 95 35 6c 9b 24 92 aa f1 26 4d 4e f4 a4 10 c8 82 83 48 // 67 bc d2 b6 e5 58 d1 78 79 57 0c 8a d9 43 e3 92 95 5f 4f 97 9e // a1 32 01 ba fe 4f 0f 6e a5 08 00 00 00 a0 c5 48 55 2b 57 1b ed // 56 47 32 34 78 a9 96 81 00 00 00 05 71 cb b1 7d 9f 37 28 24 62 // f0 e9 c1 47 c0 d4 97 c6 14 33 c6 cc c3 56 01 ee f9 7e e6 11 be // 8c 97 f4 15 1f cd a6 cb 79 9c 6e 92 49 66 a7 f9 0b f8 fd 1e 75 // ee 76 bd 72 34 6c fb b5 26 89 4a a7 fe 5e 68 94 9a 3b 30 47 23 // 17 7d 35 6c 46 04 bc a4 92 ec ec 37 e8 3e fc ee fd 78 a2 53 36 // 59 ed c8 be f9 cb 85 45 1c 6a 14 50 74 34 3c ae a5 c4 bf 69 04 // 41 97 4b 15 5f 5a dc 68 1a 03 c0 bb b8 35 88 56 17 5e 2c e8 b0 // cb bb e3 c0 33 e5 4f fc eb de 1d 9d 3d 35 00 00 00 00 00 00 00 // 00 e0 f2 09 15 0a 07 68 2c 4e 14 e3 a8 35 58 df 6f 3f c9 7f 17 // 30 a1 36 bd ee 07 e9 8c b9 84 b2 e2 30 4a 1b 63 af ef db 63 6e // 56 bb aa e4 e6 21 36 57 4b c6 37 1a 0b b2 be 1a 96 2a ae 9c 12 // 58 da 6e f5 90 e1 d8 5e a9 e1 2b 30 25 f4 3e 7e 08 cc ff c5 06 // 4d ea 4c 39 cf 4b 98 e1 fc 6e fb 59 78 f5 1e 16 b6 78 ec a0 b6 // 58 a5 60 08 94 8e 5a 61 56 1a 98 45 e4 ff 29 e2 bd 43 b5 b9 23 // b2 72 34 1c 5e 09 3f d6 6a 29 46 50 15 59 33 57 81 09 2c f8 ce // 98 7c 56 cd 31 12 16 24 d7 45 5f 2a 36 66 27 6c 3c 0e 81 2b 28 // e2 f3 0d 03 5c ee 5d 0e 77 a3 c7 22 08 ec 65 1c c0 ae 63 7f a4 // 74 81 6b c5 9d 2e 2a 00 09 24 19 30 4b 33 8a 98 7e 9d 30 44 d8 // 56 ce 24 f3 70 03 0b e3 b5 f7 9f 03 0b 8d 3e bc ef 5a f4 69 ab // e7 53 31 4f ae 31 a0 9c 3a 04 1a 1e 7b 55 c4 e8 1d ba 1e 12 28 // 9e e3 44 63 aa f2 83 45 bd e0 c1 95 bc 9f 02 2c a8 ce 37 ed 85 // 46 4c 31 67 90 53 e7 f9 d0 4b b5 cb 51 da 0b 79 58 98 9f d7 0f // 24 12 62 d0 af 32 46 eb 4f c4 bd a3 45 36 02 00 00 00 01 fb dd // ea cd 3a da a4 d2 71 5e 21 c7 72 cc d4 43 41 f7 fd 53 df 58 ae // 79 1e e8 b4 89 a7 c9 ef e3 62 5a 9d 97 1b 59 97 48 5d 6a 06 3d // c6 f7 35 9e 2e cc c2 fb 39 d4 19 de 1a 7b 5c 9d c2 2c 96 29 5a // 06 00 ad f5 9d 44 e5 8e b1 c6 0b 34 75 be 31 a9 b7 cf 42 b6 40 // 23 12 d2 72 5b 8d 9f a7 00 00 08 00 00 00 00 00 00 11 7c a6 5f // c8 6c 2d ce 97 aa 03 27 9a 66 ec 87 12 22 19 b0 f7 96 ab 92 b1 // ad ec ae 50 fd b4 08 c8 a8 0f 7f 02 f7 50 d6 c9 77 a1 91 9f 9f // 69 a6 cf ef df 87 9d 44 7d f5 3f 3b 9b 70 d1 03 55 b0 74 66 d1 // ef 00 56 b5 af 55 3d 18 a6 cd 50 fe eb 7b fa d9 b7 be 32 83 b6 // 45 0d 34 26 4e 77 12 d2 f1 d7 00 45 48 b1 91 62 ce f0 4d 18 d4 // f5 98 7b aa b9 7a 9b fb d8 f1 85 b5 a7 1e 0d 76 96 ca ba 17 27 // 45 c7 dd 91 9f fb 63 18 20 42 0b 75 b6 52 2c 0e 21 c8 82 c6 6f // 4f 25 ff b6 d9 5e 07 e0 68 00 00 00 00 00 00 eb 5b 63 e4 5d 5d // 80 fe 52 73 40 93 ae 5a a3 c0 b4 f3 f4 5b ff f2 01 00 00 00 00 // 00 00 00 2e 31 56 0e 5b 74 14 45 ea 2a 1a ce e2 e9 8c 9f 34 27 // 83 4b a0 a7 65 d2 0b 30 f8 7a f9 76 a4 6f 9a 9a 1a c7 de a1 ea // 68 45 f9 aa 66 23 7e 0d ac c1 07 f5 32 34 8c c2 11 64 73 38 1e // 96 1f 3d 9c 8c 21 57 8f e3 24 50 97 c2 80 ab e5 14 27 b9 f6 cd // 72 b5 da 6d 02 52 80 3c 66 73 0c d5 ea c9 07 f0 9b 96 95 90 63 // 13 f8 87 35 22 60 8c 6f 01 00 00 00 00 00 00 00 f7 21 30 3e 6b // 89 e5 c5 4d 68 0a c6 6d 09 af 90 db f5 0e e6 9a 39 26 59 64 27 // 9d 17 4b 00 00 00 00 00 00 00 00 00 00 00 fa 08 ad 07 31 ba 49 // fb f9 81 f8 26 5e 7f 1f 4c 2d 97 f4 68 0b 13 5f 87 c2 28 ce 69 // 41 8a 28 2b 6c aa 24 81 a0 df 17 74 fa 7d 94 94 4b b9 2d 2b 89 // f7 3f 0e 8b 63 f6 31 6c 57 62 f3 28 8b c9 70 72 0f 48 b5 64 7d // d1 77 db 68 10 fa e0 53 34 96 b6 d5 8d a5 0e e8 0a 6b 9a 74 38 // 97 8c 54 65 11 3f 66 8e b4 48 43 50 04 82 89 d0 7d be f3 25 d3 // 22 1a 7c b3 5f 81 2f 25 79 41 a9 78 1e 32 14 c2 a3 dc f8 9d 99 // 84 4b 76 2a 9c f1 75 48 c5 4f cc ad 2c 7a e8 07 2b 82 e0 88 08 // 15 da f9 66 bd 53 43 c1 63 5e 12 3f 86 8a 71 67 cf cf f3 33 20 // 25 3a f5 70 f4 ef 9c 02 54 af dd 89 ac 39 43 56 2b 53 0d d8 8d // a8 a9 40 13 bb af 20 4b eb c3 80 55 ad c3 9f 07 f7 c2 27 11 f4 // d1 f6 dc c9 28 d1 57 8a 09 3c 07 2e 0b 92 ba bc 76 f4 7e e3 67 // e7 45 a0 24 a2 27 83 19 d9 a4 d1 37 84 82 b7 4c 51 66 47 65 2b // fb 6e 93 00 24 94 a5 cd 74 e2 a9 a4 73 44 87 06 24 37 da 23 e1 // ef a6 ef 76 74 10 8a aa 3f fa c8 59 c3 57 7c 26 37 bb 3b dc 69 // bc 36 5b 1f 20 db a9 6b 8a cc a6 2f 3f 80 04 53 18 de 0f ac f2 // ed 44 b8 14 e8 42 c2 a5 20 15 9b b6 c3 20 ce c0 91 0c 0b 8b d3 // d5 47 bd fb a2 e0 9d 24 d1 17 ed 03 88 af d3 7a ff ba d2 f9 c7 // 7c 9c 13 14 a1 6f fe 64 f5 e3 74 4a 2f ff d7 03 96 70 f5 70 6e // 58 9a 4c 38 68 db 06 fd 89 2d 68 a5 47 47 7f 8e f6 86 ff 0d ba // 7b 8c 18 c9 4d 5a 89 b0 56 7a 85 17 50 a3 5d 9c c2 21 7d b8 90 // d8 93 85 fc aa 00 f0 f2 e5 24 67 2e 6f 4c 8b ed fd 5d a5 b1 57 // 70 9b 82 65 cf 51 1d c5 84 6a b1 d8 59 16 c4 a6 b2 d1 b4 08 57 // 59 82 e1 12 30 cb ac 0a 9c 6e aa 03 c9 45 64 55 81 f6 78 40 3c // 2a 93 6c 53 ae 72 94 0a a9 2b cf 22 b8 2c 6b c0 28 e0 ac dd df // 9f ef 59 5f 0f 7a 9f 80 c0 e4 c6 59 ce d7 69 ec 46 3d 26 a8 1e // 46 88 46 76 1a 8e 1e fd 6a 03 1a b7 ad c8 66 5e 26 7b e0 06 5c // c3 15 aa 23 01 24 23 ec 8b 84 92 d9 b5 0f a4 d8 c5 89 19 59 b7 // 61 ee c6 dc 98 85 32 78 2f da 13 23 9c 94 8e 27 85 36 06 e2 62 // 25 c7 96 b7 9c c0 4f 3d 1a 5a 13 00 00 00 00 1e 30 1d 82 a2 70 // 10 d3 ac 61 19 d2 b1 2c af 28 24 13 67 2d 20 c8 52 c5 00 84 d7 // b2 d5 07 54 77 5e d6 3b c1 80 23 c3 13 51 af 76 e2 47 88 d9 61 // 03 45 56 93 b3 4e 09 a1 63 a9 f6 13 a7 e5 53 02 22 ce bd 7f a0 // fb ff 32 dc 98 08 8f 9f ab 33 64 8c c3 8e 87 dd 2d d6 ee 15 7f // 5f 01 87 02 69 69 15 66 17 15 c9 79 b7 79 6d 4f 10 1a 25 76 88 // af 7c 14 8e 86 15 c9 38 c4 ca 8a 69 f6 fc 58 5e c1 dd 18 57 a5 // 01 f9 0b 16 1e ff 23 18 1a 11 a2 b0 da 4c 58 d4 59 cb f9 db} // (length 0x8ab) // } // } // } // license: ptr[in, buffer] { // buffer: {47 50 4c 00} (length 0x4) // } // loglev: int32 = 0x5 (4 bytes) // logsize: len = 0x252 (4 bytes) // log: ptr[out, buffer] { // buffer: (DirOut) // } // kern_version: bpf_kern_version = 0x0 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // fallback: bpf_attach_types = 0x0 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x8 (4 bytes) // func_info: nil // func_info_cnt: len = 0x0 (4 bytes) // line_info_rec_size: const = 0x10 (4 bytes) // line_info: nil // line_info_cnt: len = 0x0 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x10 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x48 (8 bytes) // ] // returns fd_bpf_prog NONFAILING(*(uint32_t*)0x200000000080 = 5); NONFAILING(*(uint32_t*)0x200000000084 = 3); NONFAILING(*(uint64_t*)0x200000000088 = 0x200000000b00); NONFAILING(memcpy( (void*)0x200000000b00, "\x85\x00\x00\x00\xae\x00\x00\x00\x25\x00\x00\x00\xff\xff\xff\xaf\x95\x00" "\x00\x00\x00\x00\x00\x00\xaf\xcd\x48\xd6\x49\x37\x90\x71\x00\x00\x00\x00" "\x00\x08\x00\x00\xb2\xc6\x16\x1d\xba\x39\x21\x76\xdd\x29\x63\x03\x8e\x1d" "\x69\xba\x7e\xa9\x4c\x50\x0d\xc4\xef\x2f\xad\x96\xed\x40\x6f\x21\xca\xf5" "\xad\xcf\x92\x05\x69\xc0\x0c\xc1\x19\x96\x84\xfa\x7c\x93\x83\x6d\x9e\xa2" "\xcf\xb0\xe6\x04\x36\xe0\x54\x25\xcc\x46\x86\xb0\x66\x70\x7d\xe9\x4a\x4f" "\x4d\x5f\xc7\x9c\x98\x7d\x66\x9f\x38\x1f\xac\xa0\xf9\xd9\x92\x4b\xe4\x1a" "\x91\x69\xbd\xfa\xf1\x6d\xa9\x15\xb2\xe2\x49\xf2\x1c\x6e\xee\x84\x30\x9e" "\x7a\x23\xc1\x9a\x39\x48\x30\xf2\x53\x9f\xcb\x4e\x0b\x6e\xab\x1a\xa7\xd5" "\x55\x45\xa3\x4e\xff\xa0\x77\xfa\xa5\x5c\x59\xe8\x82\x54\xf5\x40\x77\xf7" "\x99\xbf\x16\x83\x01\x00\x00\x00\xbf\xb1\xc0\xe6\xb1\x24\x4d\x35\xb2\x13" "\xbd\xa8\x4c\xc1\x72\xaf\xcc\x2e\x47\xa7\xd8\xb8\x5a\x5e\x3d\x77\xac\x46" "\x39\x20\xe2\x31\xb7\xae\x0d\xa8\x61\x6d\x2b\x79\x58\xf9\x1f\x5d\xa6\xc0" "\x25\xd0\x60\xab\x18\x6d\x94\xaf\x98\xaf\x1d\xa2\xb5\x95\x2e\xb1\x58\x55" "\x93\x3a\x21\x23\x04\xe0\x35\xf7\xa3\x5d\xfc\x72\xc8\x12\x56\xa5\x5a\x25" "\xf8\xfe\x3b\x28\xd7\xe5\x3c\x78\xfb\xb8\x88\xb0\x25\x5f\x34\x71\x60\xec" "\x83\x07\x00\x00\x00\x00\x00\x00\x40\x15\xcf\x10\x45\x3f\x6c\x0b\x97\x3b" "\x81\xa4\x84\xeb\xad\x04\x85\x9d\x92\x83\x65\xa7\xea\x3f\xab\x2e\x4b\x38" "\x0a\x00\xd7\x2b\xc0\x48\x0f\x94\x47\x97\x57\x30\x67\x20\x39\x93\x79\xd9" "\x27\x1c\xf5\x55\xc1\x4d\x56\xb5\x1c\x22\x98\x23\x7b\xeb\xfc\x08\xe0\xd5" "\x97\x6a\x94\x2b\x84\x41\x39\xf1\x11\x1f\x2d\xc5\xe4\x6a\xc1\xc6\x0a\x9b" "\x03\x00\x74\xbf\xbc\xd4\xb0\x90\x12\x17\x54\x84\x13\x5f\x0e\x51\x9f\x0b" "\x1e\x4a\xaa\x02\x6d\x57\x0e\xcb\x5e\x8c\xdd\xbe\xd6\x5f\xf7\x02\x00\x00" "\x00\xa3\xff\x4f\x8a\x4c\xf7\x96\xb0\x7a\x6f\xf6\x1c\x55\x52\x41\x7f\xd7" "\x03\xf7\xf1\x4d\x8b\x78\xa6\x02\xca\x3c\xdf\x6a\x66\x2d\x8b\xc9\xc8\x9c" "\x91\x20\x07\x2a\x5d\x00\xdc\xdd\x85\x95\x35\x6c\x9b\x24\x92\xaa\xf1\x26" "\x4d\x4e\xf4\xa4\x10\xc8\x82\x83\x48\x67\xbc\xd2\xb6\xe5\x58\xd1\x78\x79" "\x57\x0c\x8a\xd9\x43\xe3\x92\x95\x5f\x4f\x97\x9e\xa1\x32\x01\xba\xfe\x4f" "\x0f\x6e\xa5\x08\x00\x00\x00\xa0\xc5\x48\x55\x2b\x57\x1b\xed\x56\x47\x32" "\x34\x78\xa9\x96\x81\x00\x00\x00\x05\x71\xcb\xb1\x7d\x9f\x37\x28\x24\x62" "\xf0\xe9\xc1\x47\xc0\xd4\x97\xc6\x14\x33\xc6\xcc\xc3\x56\x01\xee\xf9\x7e" "\xe6\x11\xbe\x8c\x97\xf4\x15\x1f\xcd\xa6\xcb\x79\x9c\x6e\x92\x49\x66\xa7" "\xf9\x0b\xf8\xfd\x1e\x75\xee\x76\xbd\x72\x34\x6c\xfb\xb5\x26\x89\x4a\xa7" "\xfe\x5e\x68\x94\x9a\x3b\x30\x47\x23\x17\x7d\x35\x6c\x46\x04\xbc\xa4\x92" "\xec\xec\x37\xe8\x3e\xfc\xee\xfd\x78\xa2\x53\x36\x59\xed\xc8\xbe\xf9\xcb" "\x85\x45\x1c\x6a\x14\x50\x74\x34\x3c\xae\xa5\xc4\xbf\x69\x04\x41\x97\x4b" "\x15\x5f\x5a\xdc\x68\x1a\x03\xc0\xbb\xb8\x35\x88\x56\x17\x5e\x2c\xe8\xb0" "\xcb\xbb\xe3\xc0\x33\xe5\x4f\xfc\xeb\xde\x1d\x9d\x3d\x35\x00\x00\x00\x00" "\x00\x00\x00\x00\xe0\xf2\x09\x15\x0a\x07\x68\x2c\x4e\x14\xe3\xa8\x35\x58" "\xdf\x6f\x3f\xc9\x7f\x17\x30\xa1\x36\xbd\xee\x07\xe9\x8c\xb9\x84\xb2\xe2" "\x30\x4a\x1b\x63\xaf\xef\xdb\x63\x6e\x56\xbb\xaa\xe4\xe6\x21\x36\x57\x4b" "\xc6\x37\x1a\x0b\xb2\xbe\x1a\x96\x2a\xae\x9c\x12\x58\xda\x6e\xf5\x90\xe1" "\xd8\x5e\xa9\xe1\x2b\x30\x25\xf4\x3e\x7e\x08\xcc\xff\xc5\x06\x4d\xea\x4c" "\x39\xcf\x4b\x98\xe1\xfc\x6e\xfb\x59\x78\xf5\x1e\x16\xb6\x78\xec\xa0\xb6" "\x58\xa5\x60\x08\x94\x8e\x5a\x61\x56\x1a\x98\x45\xe4\xff\x29\xe2\xbd\x43" "\xb5\xb9\x23\xb2\x72\x34\x1c\x5e\x09\x3f\xd6\x6a\x29\x46\x50\x15\x59\x33" "\x57\x81\x09\x2c\xf8\xce\x98\x7c\x56\xcd\x31\x12\x16\x24\xd7\x45\x5f\x2a" "\x36\x66\x27\x6c\x3c\x0e\x81\x2b\x28\xe2\xf3\x0d\x03\x5c\xee\x5d\x0e\x77" "\xa3\xc7\x22\x08\xec\x65\x1c\xc0\xae\x63\x7f\xa4\x74\x81\x6b\xc5\x9d\x2e" "\x2a\x00\x09\x24\x19\x30\x4b\x33\x8a\x98\x7e\x9d\x30\x44\xd8\x56\xce\x24" "\xf3\x70\x03\x0b\xe3\xb5\xf7\x9f\x03\x0b\x8d\x3e\xbc\xef\x5a\xf4\x69\xab" "\xe7\x53\x31\x4f\xae\x31\xa0\x9c\x3a\x04\x1a\x1e\x7b\x55\xc4\xe8\x1d\xba" "\x1e\x12\x28\x9e\xe3\x44\x63\xaa\xf2\x83\x45\xbd\xe0\xc1\x95\xbc\x9f\x02" "\x2c\xa8\xce\x37\xed\x85\x46\x4c\x31\x67\x90\x53\xe7\xf9\xd0\x4b\xb5\xcb" "\x51\xda\x0b\x79\x58\x98\x9f\xd7\x0f\x24\x12\x62\xd0\xaf\x32\x46\xeb\x4f" "\xc4\xbd\xa3\x45\x36\x02\x00\x00\x00\x01\xfb\xdd\xea\xcd\x3a\xda\xa4\xd2" "\x71\x5e\x21\xc7\x72\xcc\xd4\x43\x41\xf7\xfd\x53\xdf\x58\xae\x79\x1e\xe8" "\xb4\x89\xa7\xc9\xef\xe3\x62\x5a\x9d\x97\x1b\x59\x97\x48\x5d\x6a\x06\x3d" "\xc6\xf7\x35\x9e\x2e\xcc\xc2\xfb\x39\xd4\x19\xde\x1a\x7b\x5c\x9d\xc2\x2c" "\x96\x29\x5a\x06\x00\xad\xf5\x9d\x44\xe5\x8e\xb1\xc6\x0b\x34\x75\xbe\x31" "\xa9\xb7\xcf\x42\xb6\x40\x23\x12\xd2\x72\x5b\x8d\x9f\xa7\x00\x00\x08\x00" "\x00\x00\x00\x00\x00\x11\x7c\xa6\x5f\xc8\x6c\x2d\xce\x97\xaa\x03\x27\x9a" "\x66\xec\x87\x12\x22\x19\xb0\xf7\x96\xab\x92\xb1\xad\xec\xae\x50\xfd\xb4" "\x08\xc8\xa8\x0f\x7f\x02\xf7\x50\xd6\xc9\x77\xa1\x91\x9f\x9f\x69\xa6\xcf" "\xef\xdf\x87\x9d\x44\x7d\xf5\x3f\x3b\x9b\x70\xd1\x03\x55\xb0\x74\x66\xd1" "\xef\x00\x56\xb5\xaf\x55\x3d\x18\xa6\xcd\x50\xfe\xeb\x7b\xfa\xd9\xb7\xbe" "\x32\x83\xb6\x45\x0d\x34\x26\x4e\x77\x12\xd2\xf1\xd7\x00\x45\x48\xb1\x91" "\x62\xce\xf0\x4d\x18\xd4\xf5\x98\x7b\xaa\xb9\x7a\x9b\xfb\xd8\xf1\x85\xb5" "\xa7\x1e\x0d\x76\x96\xca\xba\x17\x27\x45\xc7\xdd\x91\x9f\xfb\x63\x18\x20" "\x42\x0b\x75\xb6\x52\x2c\x0e\x21\xc8\x82\xc6\x6f\x4f\x25\xff\xb6\xd9\x5e" "\x07\xe0\x68\x00\x00\x00\x00\x00\x00\xeb\x5b\x63\xe4\x5d\x5d\x80\xfe\x52" "\x73\x40\x93\xae\x5a\xa3\xc0\xb4\xf3\xf4\x5b\xff\xf2\x01\x00\x00\x00\x00" "\x00\x00\x00\x2e\x31\x56\x0e\x5b\x74\x14\x45\xea\x2a\x1a\xce\xe2\xe9\x8c" "\x9f\x34\x27\x83\x4b\xa0\xa7\x65\xd2\x0b\x30\xf8\x7a\xf9\x76\xa4\x6f\x9a" "\x9a\x1a\xc7\xde\xa1\xea\x68\x45\xf9\xaa\x66\x23\x7e\x0d\xac\xc1\x07\xf5" "\x32\x34\x8c\xc2\x11\x64\x73\x38\x1e\x96\x1f\x3d\x9c\x8c\x21\x57\x8f\xe3" "\x24\x50\x97\xc2\x80\xab\xe5\x14\x27\xb9\xf6\xcd\x72\xb5\xda\x6d\x02\x52" "\x80\x3c\x66\x73\x0c\xd5\xea\xc9\x07\xf0\x9b\x96\x95\x90\x63\x13\xf8\x87" "\x35\x22\x60\x8c\x6f\x01\x00\x00\x00\x00\x00\x00\x00\xf7\x21\x30\x3e\x6b" "\x89\xe5\xc5\x4d\x68\x0a\xc6\x6d\x09\xaf\x90\xdb\xf5\x0e\xe6\x9a\x39\x26" "\x59\x64\x27\x9d\x17\x4b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfa" "\x08\xad\x07\x31\xba\x49\xfb\xf9\x81\xf8\x26\x5e\x7f\x1f\x4c\x2d\x97\xf4" "\x68\x0b\x13\x5f\x87\xc2\x28\xce\x69\x41\x8a\x28\x2b\x6c\xaa\x24\x81\xa0" "\xdf\x17\x74\xfa\x7d\x94\x94\x4b\xb9\x2d\x2b\x89\xf7\x3f\x0e\x8b\x63\xf6" "\x31\x6c\x57\x62\xf3\x28\x8b\xc9\x70\x72\x0f\x48\xb5\x64\x7d\xd1\x77\xdb" "\x68\x10\xfa\xe0\x53\x34\x96\xb6\xd5\x8d\xa5\x0e\xe8\x0a\x6b\x9a\x74\x38" "\x97\x8c\x54\x65\x11\x3f\x66\x8e\xb4\x48\x43\x50\x04\x82\x89\xd0\x7d\xbe" "\xf3\x25\xd3\x22\x1a\x7c\xb3\x5f\x81\x2f\x25\x79\x41\xa9\x78\x1e\x32\x14" "\xc2\xa3\xdc\xf8\x9d\x99\x84\x4b\x76\x2a\x9c\xf1\x75\x48\xc5\x4f\xcc\xad" "\x2c\x7a\xe8\x07\x2b\x82\xe0\x88\x08\x15\xda\xf9\x66\xbd\x53\x43\xc1\x63" "\x5e\x12\x3f\x86\x8a\x71\x67\xcf\xcf\xf3\x33\x20\x25\x3a\xf5\x70\xf4\xef" "\x9c\x02\x54\xaf\xdd\x89\xac\x39\x43\x56\x2b\x53\x0d\xd8\x8d\xa8\xa9\x40" "\x13\xbb\xaf\x20\x4b\xeb\xc3\x80\x55\xad\xc3\x9f\x07\xf7\xc2\x27\x11\xf4" "\xd1\xf6\xdc\xc9\x28\xd1\x57\x8a\x09\x3c\x07\x2e\x0b\x92\xba\xbc\x76\xf4" "\x7e\xe3\x67\xe7\x45\xa0\x24\xa2\x27\x83\x19\xd9\xa4\xd1\x37\x84\x82\xb7" "\x4c\x51\x66\x47\x65\x2b\xfb\x6e\x93\x00\x24\x94\xa5\xcd\x74\xe2\xa9\xa4" "\x73\x44\x87\x06\x24\x37\xda\x23\xe1\xef\xa6\xef\x76\x74\x10\x8a\xaa\x3f" "\xfa\xc8\x59\xc3\x57\x7c\x26\x37\xbb\x3b\xdc\x69\xbc\x36\x5b\x1f\x20\xdb" "\xa9\x6b\x8a\xcc\xa6\x2f\x3f\x80\x04\x53\x18\xde\x0f\xac\xf2\xed\x44\xb8" "\x14\xe8\x42\xc2\xa5\x20\x15\x9b\xb6\xc3\x20\xce\xc0\x91\x0c\x0b\x8b\xd3" "\xd5\x47\xbd\xfb\xa2\xe0\x9d\x24\xd1\x17\xed\x03\x88\xaf\xd3\x7a\xff\xba" "\xd2\xf9\xc7\x7c\x9c\x13\x14\xa1\x6f\xfe\x64\xf5\xe3\x74\x4a\x2f\xff\xd7" "\x03\x96\x70\xf5\x70\x6e\x58\x9a\x4c\x38\x68\xdb\x06\xfd\x89\x2d\x68\xa5" "\x47\x47\x7f\x8e\xf6\x86\xff\x0d\xba\x7b\x8c\x18\xc9\x4d\x5a\x89\xb0\x56" "\x7a\x85\x17\x50\xa3\x5d\x9c\xc2\x21\x7d\xb8\x90\xd8\x93\x85\xfc\xaa\x00" "\xf0\xf2\xe5\x24\x67\x2e\x6f\x4c\x8b\xed\xfd\x5d\xa5\xb1\x57\x70\x9b\x82" "\x65\xcf\x51\x1d\xc5\x84\x6a\xb1\xd8\x59\x16\xc4\xa6\xb2\xd1\xb4\x08\x57" "\x59\x82\xe1\x12\x30\xcb\xac\x0a\x9c\x6e\xaa\x03\xc9\x45\x64\x55\x81\xf6" "\x78\x40\x3c\x2a\x93\x6c\x53\xae\x72\x94\x0a\xa9\x2b\xcf\x22\xb8\x2c\x6b" "\xc0\x28\xe0\xac\xdd\xdf\x9f\xef\x59\x5f\x0f\x7a\x9f\x80\xc0\xe4\xc6\x59" "\xce\xd7\x69\xec\x46\x3d\x26\xa8\x1e\x46\x88\x46\x76\x1a\x8e\x1e\xfd\x6a" "\x03\x1a\xb7\xad\xc8\x66\x5e\x26\x7b\xe0\x06\x5c\xc3\x15\xaa\x23\x01\x24" "\x23\xec\x8b\x84\x92\xd9\xb5\x0f\xa4\xd8\xc5\x89\x19\x59\xb7\x61\xee\xc6" "\xdc\x98\x85\x32\x78\x2f\xda\x13\x23\x9c\x94\x8e\x27\x85\x36\x06\xe2\x62" "\x25\xc7\x96\xb7\x9c\xc0\x4f\x3d\x1a\x5a\x13\x00\x00\x00\x00\x1e\x30\x1d" "\x82\xa2\x70\x10\xd3\xac\x61\x19\xd2\xb1\x2c\xaf\x28\x24\x13\x67\x2d\x20" "\xc8\x52\xc5\x00\x84\xd7\xb2\xd5\x07\x54\x77\x5e\xd6\x3b\xc1\x80\x23\xc3" "\x13\x51\xaf\x76\xe2\x47\x88\xd9\x61\x03\x45\x56\x93\xb3\x4e\x09\xa1\x63" "\xa9\xf6\x13\xa7\xe5\x53\x02\x22\xce\xbd\x7f\xa0\xfb\xff\x32\xdc\x98\x08" "\x8f\x9f\xab\x33\x64\x8c\xc3\x8e\x87\xdd\x2d\xd6\xee\x15\x7f\x5f\x01\x87" "\x02\x69\x69\x15\x66\x17\x15\xc9\x79\xb7\x79\x6d\x4f\x10\x1a\x25\x76\x88" "\xaf\x7c\x14\x8e\x86\x15\xc9\x38\xc4\xca\x8a\x69\xf6\xfc\x58\x5e\xc1\xdd" "\x18\x57\xa5\x01\xf9\x0b\x16\x1e\xff\x23\x18\x1a\x11\xa2\xb0\xda\x4c\x58" "\xd4\x59\xcb\xf9\xdb", 2219)); NONFAILING(*(uint64_t*)0x200000000090 = 0x200000000000); NONFAILING(memcpy((void*)0x200000000000, "GPL\000", 4)); NONFAILING(*(uint32_t*)0x200000000098 = 5); NONFAILING(*(uint32_t*)0x20000000009c = 0x252); NONFAILING(*(uint64_t*)0x2000000000a0 = 0x20000000cf3d); NONFAILING(*(uint32_t*)0x2000000000a8 = 0); NONFAILING(*(uint32_t*)0x2000000000ac = 0); NONFAILING(memset((void*)0x2000000000b0, 0, 16)); NONFAILING(*(uint32_t*)0x2000000000c0 = 0); NONFAILING(*(uint32_t*)0x2000000000c4 = 0); NONFAILING(*(uint32_t*)0x2000000000c8 = -1); NONFAILING(*(uint32_t*)0x2000000000cc = 8); NONFAILING(*(uint64_t*)0x2000000000d0 = 0); NONFAILING(*(uint32_t*)0x2000000000d8 = 0); NONFAILING(*(uint32_t*)0x2000000000dc = 0x10); NONFAILING(*(uint64_t*)0x2000000000e0 = 0); NONFAILING(*(uint32_t*)0x2000000000e8 = 0); NONFAILING(*(uint32_t*)0x2000000000ec = 0); NONFAILING(*(uint32_t*)0x2000000000f0 = -1); NONFAILING(*(uint32_t*)0x2000000000f4 = 0); NONFAILING(*(uint64_t*)0x2000000000f8 = 0); NONFAILING(*(uint64_t*)0x200000000100 = 0); NONFAILING(*(uint32_t*)0x200000000108 = 0x10); NONFAILING(*(uint32_t*)0x20000000010c = 0); NONFAILING(*(uint32_t*)0x200000000110 = 0); syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000080ul, /*size=*/0x48ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); setup_sysctl(); const char* reason; (void)reason; if ((reason = setup_binfmt_misc())) printf("the reproducer may not work as expected: binfmt_misc setup failed: " "%s\n", reason); if ((reason = setup_802154())) printf("the reproducer may not work as expected: 802154 injection setup " "failed: %s\n", reason); if ((reason = setup_swap())) printf("the reproducer may not work as expected: swap setup failed: %s\n", reason); install_segv_handler(); do_sandbox_none(); return 0; }