// https://syzkaller.appspot.com/bug?id=50bbf37c6f09e730fc77feea35b20652a5f3d61b // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i = 0; for (; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { int state; } event_t; static void event_init(event_t* ev) { ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { if (ev->state) exit(1); __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000); } static void event_wait(event_t* ev) { while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); } static int event_isset(event_t* ev) { return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; for (;;) { uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) return 1; now = current_time_ms(); if (now - start > timeout) return 0; } } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } int i, call, thread; for (call = 0; call < 19; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 50); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[4] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: // bind$inet6 arguments: [ // fd: sock_in6 (resource) // addr: ptr[in, sockaddr_in6] { // sockaddr_in6 { // family: const = 0xa (2 bytes) // port: int16be = 0x2 (2 bytes) // flow: int32be = 0x200 (4 bytes) // addr: union ipv6_addr { // loopback: ipv6_addr_loopback { // a0: const = 0x0 (8 bytes) // a1: const = 0x1 (8 bytes) // } // } // scope: int32 = 0x7 (4 bytes) // } // } // addrlen: len = 0x1c (8 bytes) // ] NONFAILING(*(uint16_t*)0x200000000080 = 0xa); NONFAILING(*(uint16_t*)0x200000000082 = htobe16(2)); NONFAILING(*(uint32_t*)0x200000000084 = htobe32(0x200)); NONFAILING(*(uint64_t*)0x200000000088 = htobe64(0)); NONFAILING(*(uint64_t*)0x200000000090 = htobe64(1)); NONFAILING(*(uint32_t*)0x200000000098 = 7); syscall(__NR_bind, /*fd=*/(intptr_t)-1, /*addr=*/0x200000000080ul, /*addrlen=*/0x1cul); break; case 1: // setsockopt$inet6_tcp_int arguments: [ // fd: sock_tcp6 (resource) // level: const = 0x6 (4 bytes) // optname: tcp_option_types_int = 0x2000000000000022 (4 bytes) // optval: nil // optlen: len = 0x0 (8 bytes) // ] syscall(__NR_setsockopt, /*fd=*/(intptr_t)-1, /*level=*/6, /*optname=TCP_FASTOPEN_NO_COOKIE*/ 0x22, /*optval=*/0ul, /*optlen=*/0ul); break; case 2: // openat$uinput arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2f 64 65 76 2f 75 69 6e 70 75 74 00} (length 0xc) // } // flags: uinput_open_flags = 0x2 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_uinput NONFAILING(memcpy((void*)0x2000000000c0, "/dev/uinput\000", 12)); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x2000000000c0ul, /*flags=O_RDWR*/ 2, /*mode=*/0); if (res != -1) r[0] = res; break; case 3: // write$uinput_user_dev arguments: [ // fd: fd_uinput (resource) // data: ptr[in, uinput_user_dev] { // uinput_user_dev { // name: buffer: {73 79 7a 31 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length // 0x50) id: input_id { // bustype: int16 = 0x6ec9 (2 bytes) // vendor: int16 = 0x7 (2 bytes) // product: int16 = 0x5 (2 bytes) // version: int16 = 0x5 (2 bytes) // } // ff_effects_max: int32 = 0x3e (4 bytes) // absmax: array[int32] { // int32 = 0x9 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x5334 (4 bytes) // int32 = 0x400 (4 bytes) // int32 = 0x80000000 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x6 (4 bytes) // int32 = 0xf5 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x39 (4 bytes) // int32 = 0x747d5a13 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0xfffffb9a (4 bytes) // int32 = 0xfffffffc (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0xfffffffb (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0xf252 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x800 (4 bytes) // int32 = 0x300000 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0xe (4 bytes) // int32 = 0x4623b (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x1ff (4 bytes) // int32 = 0x8000 (4 bytes) // int32 = 0x3ff (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0xd (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0xba55 (4 bytes) // int32 = 0x1000 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x200 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x400008 (4 bytes) // int32 = 0xe (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0x199f (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x6 (4 bytes) // int32 = 0x1000 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x40 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x5 (4 bytes) // } // absmin: array[int32] { // int32 = 0x6 (4 bytes) // int32 = 0x1e (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x8000 (4 bytes) // int32 = 0xfffffffe (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0xfffffffc (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x7fff (4 bytes) // int32 = 0x72c (4 bytes) // int32 = 0x1c32 (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x10000 (4 bytes) // int32 = 0xf7 (4 bytes) // int32 = 0x8001 (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0x297 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x981 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x100 (4 bytes) // int32 = 0x3ff (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0xfffffffe (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x1000001 (4 bytes) // int32 = 0x12 (4 bytes) // int32 = 0xfffffff9 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0xffffffff (4 bytes) // int32 = 0x6 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x800 (4 bytes) // int32 = 0xffff (4 bytes) // int32 = 0x6 (4 bytes) // int32 = 0x96 (4 bytes) // int32 = 0xfffffffd (4 bytes) // int32 = 0x101 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x401 (4 bytes) // int32 = 0xc (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x379 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x200 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x6 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x6 (4 bytes) // int32 = 0x200 (4 bytes) // int32 = 0x3 (4 bytes) // } // absfuzz: array[int32] { // int32 = 0x401 (4 bytes) // int32 = 0xc584 (4 bytes) // int32 = 0xffff (4 bytes) // int32 = 0xcd5 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x20 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x437 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0xe8b (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x80000001 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0xffffffff (4 bytes) // int32 = 0x1000 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x10 (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0xfffffff9 (4 bytes) // int32 = 0xe55 (4 bytes) // int32 = 0x10 (4 bytes) // int32 = 0x80000001 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0xf5e (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x20000005 (4 bytes) // int32 = 0x80 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x47 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x6d7e (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x8001 (4 bytes) // int32 = 0xbf23 (4 bytes) // int32 = 0x6 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x95a (4 bytes) // int32 = 0xffffffff (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x6 (4 bytes) // int32 = 0x100fffe (4 bytes) // int32 = 0x2005 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0xea (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0xd9 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x7ff (4 bytes) // int32 = 0x401 (4 bytes) // int32 = 0x5 (4 bytes) // } // absflat: array[int32] { // int32 = 0x108e (4 bytes) // int32 = 0x7fff (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x88 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x9 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x50 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x763 (4 bytes) // int32 = 0xb (4 bytes) // int32 = 0x402 (4 bytes) // int32 = 0x800 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x1000 (4 bytes) // int32 = 0x7f (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x3fa6 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x1e0 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0xe47 (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x3 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x200 (4 bytes) // int32 = 0x1000 (4 bytes) // int32 = 0x403e (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x5 (4 bytes) // int32 = 0x800 (4 bytes) // int32 = 0xa80a (4 bytes) // int32 = 0x65f413f9 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x8 (4 bytes) // int32 = 0x8a8 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x40 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x2 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x4 (4 bytes) // int32 = 0x10 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x7fff (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0xfffffff8 (4 bytes) // int32 = 0x401 (4 bytes) // int32 = 0x1 (4 bytes) // int32 = 0x200 (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0x4edf (4 bytes) // int32 = 0xfffffffd (4 bytes) // int32 = 0x7 (4 bytes) // int32 = 0xe (4 bytes) // int32 = 0xffffffff (4 bytes) // int32 = 0xe (4 bytes) // int32 = 0xf (4 bytes) // int32 = 0x133 (4 bytes) // int32 = 0x6 (4 bytes) // } // } // } // len: len = 0x45c (8 bytes) // ] NONFAILING(memcpy( (void*)0x200000000a00, "syz1\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000", 80)); NONFAILING(*(uint16_t*)0x200000000a50 = 0x6ec9); NONFAILING(*(uint16_t*)0x200000000a52 = 7); NONFAILING(*(uint16_t*)0x200000000a54 = 5); NONFAILING(*(uint16_t*)0x200000000a56 = 5); NONFAILING(*(uint32_t*)0x200000000a58 = 0x3e); NONFAILING(*(uint32_t*)0x200000000a5c = 9); NONFAILING(*(uint32_t*)0x200000000a60 = 2); NONFAILING(*(uint32_t*)0x200000000a64 = 8); NONFAILING(*(uint32_t*)0x200000000a68 = 2); NONFAILING(*(uint32_t*)0x200000000a6c = 0x5334); NONFAILING(*(uint32_t*)0x200000000a70 = 0x400); NONFAILING(*(uint32_t*)0x200000000a74 = 0x80000000); NONFAILING(*(uint32_t*)0x200000000a78 = 5); NONFAILING(*(uint32_t*)0x200000000a7c = 8); NONFAILING(*(uint32_t*)0x200000000a80 = 0); NONFAILING(*(uint32_t*)0x200000000a84 = 6); NONFAILING(*(uint32_t*)0x200000000a88 = 0xf5); NONFAILING(*(uint32_t*)0x200000000a8c = 9); NONFAILING(*(uint32_t*)0x200000000a90 = 0x39); NONFAILING(*(uint32_t*)0x200000000a94 = 0x747d5a13); NONFAILING(*(uint32_t*)0x200000000a98 = 8); NONFAILING(*(uint32_t*)0x200000000a9c = 0xfffffb9a); NONFAILING(*(uint32_t*)0x200000000aa0 = 0xfffffffc); NONFAILING(*(uint32_t*)0x200000000aa4 = 4); NONFAILING(*(uint32_t*)0x200000000aa8 = 0xfffffffb); NONFAILING(*(uint32_t*)0x200000000aac = 4); NONFAILING(*(uint32_t*)0x200000000ab0 = 3); NONFAILING(*(uint32_t*)0x200000000ab4 = 4); NONFAILING(*(uint32_t*)0x200000000ab8 = 0xf252); NONFAILING(*(uint32_t*)0x200000000abc = 4); NONFAILING(*(uint32_t*)0x200000000ac0 = 0x800); NONFAILING(*(uint32_t*)0x200000000ac4 = 0x300000); NONFAILING(*(uint32_t*)0x200000000ac8 = 7); NONFAILING(*(uint32_t*)0x200000000acc = 0xe); NONFAILING(*(uint32_t*)0x200000000ad0 = 0x4623b); NONFAILING(*(uint32_t*)0x200000000ad4 = 0); NONFAILING(*(uint32_t*)0x200000000ad8 = 0); NONFAILING(*(uint32_t*)0x200000000adc = 0x1ff); NONFAILING(*(uint32_t*)0x200000000ae0 = 0x8000); NONFAILING(*(uint32_t*)0x200000000ae4 = 0x3ff); NONFAILING(*(uint32_t*)0x200000000ae8 = 3); NONFAILING(*(uint32_t*)0x200000000aec = 0xd); NONFAILING(*(uint32_t*)0x200000000af0 = 3); NONFAILING(*(uint32_t*)0x200000000af4 = 0xba55); NONFAILING(*(uint32_t*)0x200000000af8 = 0x1000); NONFAILING(*(uint32_t*)0x200000000afc = 2); NONFAILING(*(uint32_t*)0x200000000b00 = 0x200); NONFAILING(*(uint32_t*)0x200000000b04 = 2); NONFAILING(*(uint32_t*)0x200000000b08 = 0x400008); NONFAILING(*(uint32_t*)0x200000000b0c = 0xe); NONFAILING(*(uint32_t*)0x200000000b10 = 4); NONFAILING(*(uint32_t*)0x200000000b14 = 2); NONFAILING(*(uint32_t*)0x200000000b18 = 0); NONFAILING(*(uint32_t*)0x200000000b1c = 8); NONFAILING(*(uint32_t*)0x200000000b20 = 9); NONFAILING(*(uint32_t*)0x200000000b24 = 1); NONFAILING(*(uint32_t*)0x200000000b28 = 0x199f); NONFAILING(*(uint32_t*)0x200000000b2c = 8); NONFAILING(*(uint32_t*)0x200000000b30 = 2); NONFAILING(*(uint32_t*)0x200000000b34 = 9); NONFAILING(*(uint32_t*)0x200000000b38 = 1); NONFAILING(*(uint32_t*)0x200000000b3c = 4); NONFAILING(*(uint32_t*)0x200000000b40 = 6); NONFAILING(*(uint32_t*)0x200000000b44 = 0x1000); NONFAILING(*(uint32_t*)0x200000000b48 = 5); NONFAILING(*(uint32_t*)0x200000000b4c = 0x40); NONFAILING(*(uint32_t*)0x200000000b50 = 9); NONFAILING(*(uint32_t*)0x200000000b54 = 7); NONFAILING(*(uint32_t*)0x200000000b58 = 5); NONFAILING(*(uint32_t*)0x200000000b5c = 6); NONFAILING(*(uint32_t*)0x200000000b60 = 0x1e); NONFAILING(*(uint32_t*)0x200000000b64 = 3); NONFAILING(*(uint32_t*)0x200000000b68 = 0x8000); NONFAILING(*(uint32_t*)0x200000000b6c = 0xfffffffe); NONFAILING(*(uint32_t*)0x200000000b70 = 3); NONFAILING(*(uint32_t*)0x200000000b74 = 0); NONFAILING(*(uint32_t*)0x200000000b78 = 5); NONFAILING(*(uint32_t*)0x200000000b7c = 7); NONFAILING(*(uint32_t*)0x200000000b80 = 0xfffffffc); NONFAILING(*(uint32_t*)0x200000000b84 = 4); NONFAILING(*(uint32_t*)0x200000000b88 = 0x7fff); NONFAILING(*(uint32_t*)0x200000000b8c = 0x72c); NONFAILING(*(uint32_t*)0x200000000b90 = 0x1c32); NONFAILING(*(uint32_t*)0x200000000b94 = 3); NONFAILING(*(uint32_t*)0x200000000b98 = 9); NONFAILING(*(uint32_t*)0x200000000b9c = 0x10000); NONFAILING(*(uint32_t*)0x200000000ba0 = 0xf7); NONFAILING(*(uint32_t*)0x200000000ba4 = 0x8001); NONFAILING(*(uint32_t*)0x200000000ba8 = 3); NONFAILING(*(uint32_t*)0x200000000bac = 1); NONFAILING(*(uint32_t*)0x200000000bb0 = 0x297); NONFAILING(*(uint32_t*)0x200000000bb4 = 5); NONFAILING(*(uint32_t*)0x200000000bb8 = 0); NONFAILING(*(uint32_t*)0x200000000bbc = 0x981); NONFAILING(*(uint32_t*)0x200000000bc0 = 4); NONFAILING(*(uint32_t*)0x200000000bc4 = 0x100); NONFAILING(*(uint32_t*)0x200000000bc8 = 0x3ff); NONFAILING(*(uint32_t*)0x200000000bcc = 0); NONFAILING(*(uint32_t*)0x200000000bd0 = 0xfffffffe); NONFAILING(*(uint32_t*)0x200000000bd4 = 0); NONFAILING(*(uint32_t*)0x200000000bd8 = 0x1000001); NONFAILING(*(uint32_t*)0x200000000bdc = 0x12); NONFAILING(*(uint32_t*)0x200000000be0 = 0xfffffff9); NONFAILING(*(uint32_t*)0x200000000be4 = 0); NONFAILING(*(uint32_t*)0x200000000be8 = 5); NONFAILING(*(uint32_t*)0x200000000bec = 1); NONFAILING(*(uint32_t*)0x200000000bf0 = -1); NONFAILING(*(uint32_t*)0x200000000bf4 = 6); NONFAILING(*(uint32_t*)0x200000000bf8 = 5); NONFAILING(*(uint32_t*)0x200000000bfc = 0x800); NONFAILING(*(uint32_t*)0x200000000c00 = 0xffff); NONFAILING(*(uint32_t*)0x200000000c04 = 6); NONFAILING(*(uint32_t*)0x200000000c08 = 0x96); NONFAILING(*(uint32_t*)0x200000000c0c = 0xfffffffd); NONFAILING(*(uint32_t*)0x200000000c10 = 0x101); NONFAILING(*(uint32_t*)0x200000000c14 = 0); NONFAILING(*(uint32_t*)0x200000000c18 = 2); NONFAILING(*(uint32_t*)0x200000000c1c = 0x401); NONFAILING(*(uint32_t*)0x200000000c20 = 0xc); NONFAILING(*(uint32_t*)0x200000000c24 = 3); NONFAILING(*(uint32_t*)0x200000000c28 = 0x379); NONFAILING(*(uint32_t*)0x200000000c2c = 9); NONFAILING(*(uint32_t*)0x200000000c30 = 0x200); NONFAILING(*(uint32_t*)0x200000000c34 = 5); NONFAILING(*(uint32_t*)0x200000000c38 = 7); NONFAILING(*(uint32_t*)0x200000000c3c = 6); NONFAILING(*(uint32_t*)0x200000000c40 = 2); NONFAILING(*(uint32_t*)0x200000000c44 = 1); NONFAILING(*(uint32_t*)0x200000000c48 = 1); NONFAILING(*(uint32_t*)0x200000000c4c = 8); NONFAILING(*(uint32_t*)0x200000000c50 = 6); NONFAILING(*(uint32_t*)0x200000000c54 = 0x200); NONFAILING(*(uint32_t*)0x200000000c58 = 3); NONFAILING(*(uint32_t*)0x200000000c5c = 0x401); NONFAILING(*(uint32_t*)0x200000000c60 = 0xc584); NONFAILING(*(uint32_t*)0x200000000c64 = 0xffff); NONFAILING(*(uint32_t*)0x200000000c68 = 0xcd5); NONFAILING(*(uint32_t*)0x200000000c6c = 7); NONFAILING(*(uint32_t*)0x200000000c70 = 0x20); NONFAILING(*(uint32_t*)0x200000000c74 = 7); NONFAILING(*(uint32_t*)0x200000000c78 = 4); NONFAILING(*(uint32_t*)0x200000000c7c = 8); NONFAILING(*(uint32_t*)0x200000000c80 = 0x437); NONFAILING(*(uint32_t*)0x200000000c84 = 7); NONFAILING(*(uint32_t*)0x200000000c88 = 9); NONFAILING(*(uint32_t*)0x200000000c8c = 0xe8b); NONFAILING(*(uint32_t*)0x200000000c90 = 5); NONFAILING(*(uint32_t*)0x200000000c94 = 0x80000001); NONFAILING(*(uint32_t*)0x200000000c98 = 8); NONFAILING(*(uint32_t*)0x200000000c9c = -1); NONFAILING(*(uint32_t*)0x200000000ca0 = 0x1000); NONFAILING(*(uint32_t*)0x200000000ca4 = 2); NONFAILING(*(uint32_t*)0x200000000ca8 = 0x10); NONFAILING(*(uint32_t*)0x200000000cac = 1); NONFAILING(*(uint32_t*)0x200000000cb0 = 0xfffffff9); NONFAILING(*(uint32_t*)0x200000000cb4 = 0xe55); NONFAILING(*(uint32_t*)0x200000000cb8 = 0x10); NONFAILING(*(uint32_t*)0x200000000cbc = 0x80000001); NONFAILING(*(uint32_t*)0x200000000cc0 = 4); NONFAILING(*(uint32_t*)0x200000000cc4 = 0xf5e); NONFAILING(*(uint32_t*)0x200000000cc8 = 5); NONFAILING(*(uint32_t*)0x200000000ccc = 9); NONFAILING(*(uint32_t*)0x200000000cd0 = 2); NONFAILING(*(uint32_t*)0x200000000cd4 = 0x20000005); NONFAILING(*(uint32_t*)0x200000000cd8 = 0x80); NONFAILING(*(uint32_t*)0x200000000cdc = 9); NONFAILING(*(uint32_t*)0x200000000ce0 = 9); NONFAILING(*(uint32_t*)0x200000000ce4 = 0x47); NONFAILING(*(uint32_t*)0x200000000ce8 = 2); NONFAILING(*(uint32_t*)0x200000000cec = 3); NONFAILING(*(uint32_t*)0x200000000cf0 = 4); NONFAILING(*(uint32_t*)0x200000000cf4 = 7); NONFAILING(*(uint32_t*)0x200000000cf8 = 0x6d7e); NONFAILING(*(uint32_t*)0x200000000cfc = 3); NONFAILING(*(uint32_t*)0x200000000d00 = 4); NONFAILING(*(uint32_t*)0x200000000d04 = 0x8001); NONFAILING(*(uint32_t*)0x200000000d08 = 0xbf23); NONFAILING(*(uint32_t*)0x200000000d0c = 6); NONFAILING(*(uint32_t*)0x200000000d10 = 8); NONFAILING(*(uint32_t*)0x200000000d14 = 0x95a); NONFAILING(*(uint32_t*)0x200000000d18 = -1); NONFAILING(*(uint32_t*)0x200000000d1c = 4); NONFAILING(*(uint32_t*)0x200000000d20 = 3); NONFAILING(*(uint32_t*)0x200000000d24 = 6); NONFAILING(*(uint32_t*)0x200000000d28 = 0x100fffe); NONFAILING(*(uint32_t*)0x200000000d2c = 0x2005); NONFAILING(*(uint32_t*)0x200000000d30 = 7); NONFAILING(*(uint32_t*)0x200000000d34 = 4); NONFAILING(*(uint32_t*)0x200000000d38 = 0xea); NONFAILING(*(uint32_t*)0x200000000d3c = 9); NONFAILING(*(uint32_t*)0x200000000d40 = 5); NONFAILING(*(uint32_t*)0x200000000d44 = 2); NONFAILING(*(uint32_t*)0x200000000d48 = 0xd9); NONFAILING(*(uint32_t*)0x200000000d4c = 0); NONFAILING(*(uint32_t*)0x200000000d50 = 0x7ff); NONFAILING(*(uint32_t*)0x200000000d54 = 0x401); NONFAILING(*(uint32_t*)0x200000000d58 = 5); NONFAILING(*(uint32_t*)0x200000000d5c = 0x108e); NONFAILING(*(uint32_t*)0x200000000d60 = 0x7fff); NONFAILING(*(uint32_t*)0x200000000d64 = 3); NONFAILING(*(uint32_t*)0x200000000d68 = 3); NONFAILING(*(uint32_t*)0x200000000d6c = 0x88); NONFAILING(*(uint32_t*)0x200000000d70 = 2); NONFAILING(*(uint32_t*)0x200000000d74 = 9); NONFAILING(*(uint32_t*)0x200000000d78 = 4); NONFAILING(*(uint32_t*)0x200000000d7c = 0x50); NONFAILING(*(uint32_t*)0x200000000d80 = 8); NONFAILING(*(uint32_t*)0x200000000d84 = 0x763); NONFAILING(*(uint32_t*)0x200000000d88 = 0xb); NONFAILING(*(uint32_t*)0x200000000d8c = 0x402); NONFAILING(*(uint32_t*)0x200000000d90 = 0x800); NONFAILING(*(uint32_t*)0x200000000d94 = 2); NONFAILING(*(uint32_t*)0x200000000d98 = 0x1000); NONFAILING(*(uint32_t*)0x200000000d9c = 0x7f); NONFAILING(*(uint32_t*)0x200000000da0 = 5); NONFAILING(*(uint32_t*)0x200000000da4 = 0x3fa6); NONFAILING(*(uint32_t*)0x200000000da8 = 4); NONFAILING(*(uint32_t*)0x200000000dac = 0); NONFAILING(*(uint32_t*)0x200000000db0 = 5); NONFAILING(*(uint32_t*)0x200000000db4 = 0x1e0); NONFAILING(*(uint32_t*)0x200000000db8 = 4); NONFAILING(*(uint32_t*)0x200000000dbc = 0xe47); NONFAILING(*(uint32_t*)0x200000000dc0 = 3); NONFAILING(*(uint32_t*)0x200000000dc4 = 3); NONFAILING(*(uint32_t*)0x200000000dc8 = 4); NONFAILING(*(uint32_t*)0x200000000dcc = 0x200); NONFAILING(*(uint32_t*)0x200000000dd0 = 0x1000); NONFAILING(*(uint32_t*)0x200000000dd4 = 0x403e); NONFAILING(*(uint32_t*)0x200000000dd8 = 2); NONFAILING(*(uint32_t*)0x200000000ddc = 5); NONFAILING(*(uint32_t*)0x200000000de0 = 0x800); NONFAILING(*(uint32_t*)0x200000000de4 = 0xa80a); NONFAILING(*(uint32_t*)0x200000000de8 = 0x65f413f9); NONFAILING(*(uint32_t*)0x200000000dec = 4); NONFAILING(*(uint32_t*)0x200000000df0 = 8); NONFAILING(*(uint32_t*)0x200000000df4 = 0x8a8); NONFAILING(*(uint32_t*)0x200000000df8 = 2); NONFAILING(*(uint32_t*)0x200000000dfc = 0x40); NONFAILING(*(uint32_t*)0x200000000e00 = 7); NONFAILING(*(uint32_t*)0x200000000e04 = 2); NONFAILING(*(uint32_t*)0x200000000e08 = 4); NONFAILING(*(uint32_t*)0x200000000e0c = 4); NONFAILING(*(uint32_t*)0x200000000e10 = 0x10); NONFAILING(*(uint32_t*)0x200000000e14 = 0); NONFAILING(*(uint32_t*)0x200000000e18 = 0); NONFAILING(*(uint32_t*)0x200000000e1c = 0x7fff); NONFAILING(*(uint32_t*)0x200000000e20 = 1); NONFAILING(*(uint32_t*)0x200000000e24 = 0xfffffff8); NONFAILING(*(uint32_t*)0x200000000e28 = 0x401); NONFAILING(*(uint32_t*)0x200000000e2c = 1); NONFAILING(*(uint32_t*)0x200000000e30 = 0x200); NONFAILING(*(uint32_t*)0x200000000e34 = 7); NONFAILING(*(uint32_t*)0x200000000e38 = 0x4edf); NONFAILING(*(uint32_t*)0x200000000e3c = 0xfffffffd); NONFAILING(*(uint32_t*)0x200000000e40 = 7); NONFAILING(*(uint32_t*)0x200000000e44 = 0xe); NONFAILING(*(uint32_t*)0x200000000e48 = -1); NONFAILING(*(uint32_t*)0x200000000e4c = 0xe); NONFAILING(*(uint32_t*)0x200000000e50 = 0xf); NONFAILING(*(uint32_t*)0x200000000e54 = 0x133); NONFAILING(*(uint32_t*)0x200000000e58 = 6); syscall(__NR_write, /*fd=*/r[0], /*data=*/0x200000000a00ul, /*len=*/0x45cul); break; case 4: // ioctl$UI_DEV_CREATE arguments: [ // fd: fd_uinput (resource) // cmd: const = 0x5501 (4 bytes) // ] syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x5501, 0); break; case 5: // timer_create arguments: [ // id: clock_id = 0x0 (8 bytes) // ev: ptr[in, sigevent] { // sigevent { // val: const = 0x0 (8 bytes) // signo: int32 = 0x21 (4 bytes) // notify: sigev_notify = 0x2 (4 bytes) // u: union sigevent_u { // thr: sigevent_thread { // func: nil // attr: nil // } // } // pad = 0x0 (32 bytes) // } // } // timerid: ptr[out, timerid] { // timerid (resource) // } // ] NONFAILING(*(uint64_t*)0x2000000000c0 = 0); NONFAILING(*(uint32_t*)0x2000000000c8 = 0x21); NONFAILING(*(uint32_t*)0x2000000000cc = 2); NONFAILING(*(uint64_t*)0x2000000000d0 = 0); NONFAILING(*(uint64_t*)0x2000000000d8 = 0); res = syscall(__NR_timer_create, /*id=*/0ul, /*ev=*/0x2000000000c0ul, /*timerid=*/0x200000000300ul); if (res != -1) NONFAILING(r[1] = *(uint32_t*)0x200000000300); break; case 6: // fcntl$lock arguments: [ // fd: fd (resource) // cmd: fcntl_lock = 0x24 (8 bytes) // lock: ptr[in, flock] { // flock { // type: flock_type = 0x0 (2 bytes) // whence: seek_whence = 0x0 (2 bytes) // pad = 0x0 (4 bytes) // start: intptr = 0x10001 (8 bytes) // len: intptr = 0x5 (8 bytes) // pid: pid (resource) // pad = 0x0 (4 bytes) // } // } // ] NONFAILING(*(uint16_t*)0x200000000040 = 0); NONFAILING(*(uint16_t*)0x200000000042 = 0); NONFAILING(*(uint64_t*)0x200000000048 = 0x10001); NONFAILING(*(uint64_t*)0x200000000050 = 5); NONFAILING(*(uint32_t*)0x200000000058 = 0); syscall(__NR_fcntl, /*fd=*/(intptr_t)-1, /*cmd=F_OFD_GETLK*/ 0x24ul, /*lock=*/0x200000000040ul); break; case 7: // mprotect arguments: [ // addr: VMA[0xf000] // len: len = 0xf000 (8 bytes) // prot: mmap_prot = 0x1 (8 bytes) // ] syscall(__NR_mprotect, /*addr=*/0x200000000000ul, /*len=*/0xf000ul, /*prot=PROT_READ*/ 1ul); break; case 8: // timer_settime arguments: [ // timerid: timerid (resource) // flags: timer_flags = 0x1 (8 bytes) // new: ptr[in, itimerspec] { // itimerspec { // interv: timespec { // sec: time_sec (resource) // nsec: time_nsec (resource) // } // value: timespec { // sec: time_sec (resource) // nsec: time_nsec (resource) // } // } // } // old: nil // ] NONFAILING(*(uint64_t*)0x200000000040 = 0); NONFAILING(*(uint64_t*)0x200000000048 = 0); NONFAILING(*(uint64_t*)0x200000000050 = 0); NONFAILING(*(uint64_t*)0x200000000058 = 0x989680); syscall(__NR_timer_settime, /*timerid=*/r[1], /*flags=TIMER_ABSTIME*/ 1ul, /*new=*/0x200000000040ul, /*old=*/0ul); break; case 9: // mmap arguments: [ // addr: VMA[0x200000] // len: len = 0x200000 (8 bytes) // prot: mmap_prot = 0x300000b (8 bytes) // flags: mmap_flags = 0x204031 (8 bytes) // fd: fd (resource) // offset: intptr = 0xec776000 (8 bytes) // ] syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x200000ul, /*prot=PROT_GROWSUP|PROT_GROWSDOWN|PROT_SEM|PROT_WRITE|PROT_READ*/ 0x300000bul, /*flags=MAP_NORESERVE|MAP_FIXED|MAP_ANONYMOUS|MAP_SHARED|0x200000*/ 0x204031ul, /*fd=*/(intptr_t)-1, /*offset=*/0xec776000ul); break; case 10: // prlimit64 arguments: [ // pid: pid (resource) // res: rlimit_type = 0xe (8 bytes) // new: ptr[in, rlimit] { // rlimit { // soft: intptr = 0x8 (8 bytes) // hard: intptr = 0x80000100008b (8 bytes) // } // } // old: nil // ] NONFAILING(*(uint64_t*)0x200000000100 = 8); NONFAILING(*(uint64_t*)0x200000000108 = 0x80000100008b); syscall(__NR_prlimit64, /*pid=*/0, /*res=RLIMIT_RTPRIO*/ 0xeul, /*new=*/0x200000000100ul, /*old=*/0ul); break; case 11: // sched_setscheduler arguments: [ // pid: pid (resource) // policy: sched_policy = 0x1 (8 bytes) // prio: ptr[in, int32] { // int32 = 0x7 (4 bytes) // } // ] NONFAILING(*(uint32_t*)0x200000000300 = 7); syscall(__NR_sched_setscheduler, /*pid=*/0, /*policy=SCHED_FIFO*/ 1ul, /*prio=*/0x200000000300ul); break; case 12: // readv arguments: [ // fd: fd (resource) // vec: ptr[in, array[iovec[out, array[int8]]]] { // array[iovec[out, array[int8]]] { // iovec[out, array[int8]] { // addr: ptr[out, buffer] { // buffer: (DirOut) // } // len: len = 0x18 (8 bytes) // } // } // } // vlen: len = 0x1 (8 bytes) // ] NONFAILING(*(uint64_t*)0x200000000140 = 0x200000000040); NONFAILING(*(uint64_t*)0x200000000148 = 0x18); syscall(__NR_readv, /*fd=*/r[0], /*vec=*/0x200000000140ul, /*vlen=*/1ul); break; case 13: // ioctl$TIOCSETD arguments: [ // fd: fd_tty (resource) // cmd: const = 0x5423 (4 bytes) // arg: nil // ] syscall(__NR_ioctl, /*fd=*/(intptr_t)-1, /*cmd=*/0x5423, /*arg=*/0ul); break; case 14: // socket$inet6_sctp arguments: [ // domain: const = 0xa (8 bytes) // type: sctp_socket_type = 0x5 (8 bytes) // proto: const = 0x84 (4 bytes) // ] // returns sock_sctp6 res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_SEQPACKET*/ 5ul, /*proto=*/0x84); if (res != -1) r[2] = res; break; case 15: // getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3 arguments: [ // fd: sock_sctp6 (resource) // level: const = 0x84 (4 bytes) // opt: const = 0x6f (4 bytes) // val: nil // len: nil // ] syscall(__NR_getsockopt, /*fd=*/(intptr_t)-1, /*level=*/0x84, /*opt=*/0x6f, /*val=*/0ul, /*len=*/0ul); break; case 16: // getsockopt$inet_sctp6_SCTP_STATUS arguments: [ // fd: sock_sctp6 (resource) // level: const = 0x84 (4 bytes) // opt: const = 0xe (4 bytes) // val: ptr[inout, sctp_status] { // sctp_status { // sstat_assoc_id: assoc_id (resource) // sstat_state: int32 = 0x3ff (4 bytes) // sstat_rwnd: int32 = 0x1 (4 bytes) // sstat_unackdata: int16 = 0x1437 (2 bytes) // sstat_penddata: int16 = 0x7 (2 bytes) // sstat_instrms: int16 = 0x0 (2 bytes) // sstat_outstrms: int16 = 0x87 (2 bytes) // sstat_fragmentation_p: int32 = 0x0 (4 bytes) // sstat_primary: sctp_paddrinfo { // spinfo_assoc_id: assoc_id (resource) // spinfo_address: union sockaddr_storage_sctp { // in: sockaddr_storage_in { // addr: sockaddr_in { // family: const = 0x2 (2 bytes) // port: int16be = 0x4e20 (2 bytes) // addr: union ipv4_addr { // private: int32be = 0xa010101 (4 bytes) // } // pad = 0x0 (8 bytes) // } // pad = 0x0 (112 bytes) // } // } // spinfo_state: int32 = 0x4 (4 bytes) // spinfo_cwnd: int32 = 0x3 (4 bytes) // spinfo_srtt: int32 = 0x0 (4 bytes) // spinfo_rto: int32 = 0x800 (4 bytes) // spinfo_mtu: int32 = 0x7 (4 bytes) // } // } // } // len: ptr[inout, len] { // len = 0xb0 (4 bytes) // } // ] NONFAILING(*(uint32_t*)0x2000000000c0 = 0); NONFAILING(*(uint32_t*)0x2000000000c4 = 0x3ff); NONFAILING(*(uint32_t*)0x2000000000c8 = 1); NONFAILING(*(uint16_t*)0x2000000000cc = 0x1437); NONFAILING(*(uint16_t*)0x2000000000ce = 7); NONFAILING(*(uint16_t*)0x2000000000d0 = 0); NONFAILING(*(uint16_t*)0x2000000000d2 = 0x87); NONFAILING(*(uint32_t*)0x2000000000d4 = 0); NONFAILING(*(uint32_t*)0x2000000000d8 = 0); NONFAILING(*(uint16_t*)0x2000000000dc = 2); NONFAILING(*(uint16_t*)0x2000000000de = htobe16(0x4e20)); NONFAILING(*(uint32_t*)0x2000000000e0 = htobe32(0xa010101)); NONFAILING(*(uint32_t*)0x20000000015c = 4); NONFAILING(*(uint32_t*)0x200000000160 = 3); NONFAILING(*(uint32_t*)0x200000000164 = 0); NONFAILING(*(uint32_t*)0x200000000168 = 0x800); NONFAILING(*(uint32_t*)0x20000000016c = 7); NONFAILING(*(uint32_t*)0x200000000180 = 0xb0); syscall(__NR_getsockopt, /*fd=*/r[2], /*level=*/0x84, /*opt=*/0xe, /*val=*/0x2000000000c0ul, /*len=*/0x200000000180ul); break; case 17: // socket$inet_udp arguments: [ // domain: const = 0x2 (8 bytes) // type: const = 0x2 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_udp res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0); if (res != -1) r[3] = res; break; case 18: // setsockopt$IPT_SO_SET_REPLACE arguments: [ // fd: sock_in (resource) // level: const = 0x0 (4 bytes) // opt: const = 0x40 (4 bytes) // val: ptr[in, ipt_replace] { // union ipt_replace { // raw: ipt_replace_t["raw", 2, 3, IPT_RAW_VALID_HOOKS, // ipt_raw_matches, ipt_raw_targets, ipt_hook, ipt_unused, // ipt_unused, ipt_hook, ipt_unused, ipt_hook, ipt_unused, // ipt_unused, ipt_hook, ipt_unused] { // name: buffer: {72 61 77 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x20) // valid_hooks: const = 0x9 (4 bytes) // num_entries: const = 0x3 (4 bytes) // size: bytesize = 0x290 (4 bytes) // hook_pre_routing: const = 0xd0 (4 bytes) // hook_local_in: const = 0xffffffff (4 bytes) // hook_forward: const = 0xffffffff (4 bytes) // hook_local_out: const = 0x0 (4 bytes) // hook_post_routing: const = 0xffffffff (4 bytes) // underflow_pre_routing: const = 0x1f8 (4 bytes) // underflow_local_in: const = 0xffffffff (4 bytes) // underflow_forward: const = 0xffffffff (4 bytes) // underflow_local_out: const = 0x1f8 (4 bytes) // underflow_post_routing: const = 0xffffffff (4 bytes) // num_counters: const = 0x3 (4 bytes) // counters: nil // entries: ipt_replace_entries[2, ipt_raw_matches, // ipt_raw_targets] { // entries: array[ipt_entry[ipt_raw_matches, ipt_raw_targets]] { // ipt_entry[ipt_raw_matches, ipt_raw_targets] { // matches: ipt_entry_matches[ipt_raw_matches] { // ip: union ipt_ip_or_uncond { // uncond: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x54) // } // nfcache: const = 0x0 (4 bytes) // target_offset: len = 0x70 (2 bytes) // next_offset: len = 0xd0 (2 bytes) // comefrom: const = 0x0 (4 bytes) // counters: xt_counters { // pcnt: const = 0x0 (8 bytes) // bcnt: const = 0x0 (8 bytes) // } // matches: array[ipt_raw_matches] { // } // } // target: union ipt_raw_targets { // common: union ipt_targets { // CLUSTERIP: xt_target_t["CLUSTERIP", // ipt_clusterip_tgt_info, 0] { // target_size: len = 0x60 (2 bytes) // name: buffer: {43 4c 55 53 54 45 52 49 50 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x1d) revision: const = 0x0 (1 bytes) data: // ipt_clusterip_tgt_info { // flags: int32 = 0x0 (4 bytes) // clustermac: union mac_addr { // random: buffer: {d3 2b 3c 31 1e 5c} (length 0x6) // } // num_total_nodes: int16 = 0xfe01 (2 bytes) // num_local_nodes: int16 = 0x4 (2 bytes) // local_nodes: array[int16] { // int16 = 0x2f (2 bytes) // int16 = 0xb (2 bytes) // int16 = 0x1a (2 bytes) // int16 = 0x0 (2 bytes) // int16 = 0x14 (2 bytes) // int16 = 0x22 (2 bytes) // int16 = 0x4 (2 bytes) // int16 = 0x39 (2 bytes) // int16 = 0x2 (2 bytes) // int16 = 0x29 (2 bytes) // int16 = 0x1b (2 bytes) // int16 = 0x16 (2 bytes) // int16 = 0x3 (2 bytes) // int16 = 0x2c (2 bytes) // int16 = 0x0 (2 bytes) // int16 = 0x2 (2 bytes) // } // pad = 0x0 (2 bytes) // hash_mode: ipt_clusterip_hash_mode = 0x1 (4 bytes) // hash_initval: int32 = 0x9 (4 bytes) // config: intptr = 0x2 (8 bytes) // } // } // } // } // } // ipt_entry[ipt_raw_matches, ipt_raw_targets] { // matches: ipt_entry_matches[ipt_raw_matches] { // ip: union ipt_ip_or_uncond { // ip: ipt_ip { // src: union ipv4_addr { // remote: ipv4_addr_t[const[187, int8]] { // a0: const = 0xac (1 bytes) // a1: const = 0x14 (1 bytes) // a2: const = 0x14 (1 bytes) // a3: const = 0xbb (1 bytes) // } // } // dst: union ipv4_addr { // broadcast: const = 0xffffffff (4 bytes) // } // smsk: ipv4_addr_mask_vals = 0xff (4 bytes) // dmsk: ipv4_addr_mask_vals = 0xff000000 (4 bytes) // iniface: buffer: {76 65 74 68 31 5f 74 6f 5f 74 65 // 61 6d 00 00 00} (length 0x10) outiface: buffer: {70 // 69 6d 72 65 67 00 00 00 00 00 00 00 00 00 00} // (length 0x10) iniface_mask: devname_mask { // lo: devname_mask_values = 0xff (1 bytes) // pad = 0x0 (15 bytes) // } // outiface_mask: devname_mask { // lo: devname_mask_values = 0xff (1 bytes) // pad = 0x0 (15 bytes) // } // proto: ipv4_types = 0x88 (2 bytes) // flags: ipt_ip_flags = 0x2 (1 bytes) // invflags: ipt_ip_invflags = 0x8 (1 bytes) // } // } // nfcache: const = 0x0 (4 bytes) // target_offset: len = 0xc0 (2 bytes) // next_offset: len = 0x128 (2 bytes) // comefrom: const = 0x0 (4 bytes) // counters: xt_counters { // pcnt: const = 0x0 (8 bytes) // bcnt: const = 0x0 (8 bytes) // } // matches: array[ipt_raw_matches] { // union ipt_raw_matches { // common: union ipt_matches { // inet: union xt_inet_matches { // socket1: xt_entry_match_t["socket", // flags[xt_socket_flags_v1, int8], 1] { // header: xt_entry_match["socket", 1] { // match_size: len = 0x28 (2 bytes) // name: buffer: {73 6f 63 6b 65 74 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00} (length 0x1d) revision: const = // 0x1 (1 bytes) // } // data: xt_socket_flags_v1 = 0x1 (1 bytes) // pad = 0x0 (7 bytes) // } // } // } // } // union ipt_raw_matches { // inet: union xt_inet_raw_matches { // rpfilter: xt_entry_match_t["rpfilter", // xt_rpfilter_info, 0] { // header: xt_entry_match["rpfilter", 0] { // match_size: len = 0x28 (2 bytes) // name: buffer: {72 70 66 69 6c 74 65 72 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00} (length 0x1d) revision: const = // 0x0 (1 bytes) // } // data: xt_rpfilter_info { // flags: xt_rpfilter_flags = 0x9 (1 bytes) // } // pad = 0x0 (7 bytes) // } // } // } // } // } // target: union ipt_raw_targets { // unspec: union xt_unspec_raw_targets { // CT1: xt_target_t["CT", xt_ct_target_info_v1, 1] { // target_size: len = 0x68 (2 bytes) // name: buffer: {43 54 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x1d) revision: const = 0x1 (1 bytes) data: // xt_ct_target_info_v1 { // flags: xt_ct_flags = 0x0 (2 bytes) // zone: int16 = 0x7 (2 bytes) // ct_events: int32 = 0xfffffff9 (4 bytes) // exp_events: int32 = 0x9 (4 bytes) // helper: buffer: {73 79 7a 31 00 00 00 00 00 00 00 // 00 00 00 00 00} (length 0x10) timeout: buffer: {73 // 79 7a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length // 0x20) pad = 0x0 (4 bytes) ct: align64[intptr] { // v: intptr = 0xfc8 (8 bytes) // } // } // } // } // } // } // } // underflow: ipt_entry_underflow { // matches: ipt_entry_underflow_matches { // ip: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x54) // nfcache: const = 0x0 (4 bytes) // target_offset: len = 0x70 (2 bytes) // next_offset: len = 0x98 (2 bytes) // comefrom: const = 0x0 (4 bytes) // counters: xt_counters { // pcnt: const = 0x0 (8 bytes) // bcnt: const = 0x0 (8 bytes) // } // } // target: xt_target_t["", const[NF_ACCEPT_VERDICT, int32], 0] // { // target_size: len = 0x28 (2 bytes) // name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length // 0x1d) revision: const = 0x0 (1 bytes) data: const = // 0xfffffffe (4 bytes) pad = 0x0 (4 bytes) // } // } // } // } // } // } // len: len = 0x2f0 (8 bytes) // ] NONFAILING( memcpy((void*)0x200000000780, "raw\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 32)); NONFAILING(*(uint32_t*)0x2000000007a0 = 9); NONFAILING(*(uint32_t*)0x2000000007a4 = 3); NONFAILING(*(uint32_t*)0x2000000007a8 = 0x290); NONFAILING(*(uint32_t*)0x2000000007ac = 0xd0); NONFAILING(*(uint32_t*)0x2000000007b0 = -1); NONFAILING(*(uint32_t*)0x2000000007b4 = -1); NONFAILING(*(uint32_t*)0x2000000007b8 = 0); NONFAILING(*(uint32_t*)0x2000000007bc = -1); NONFAILING(*(uint32_t*)0x2000000007c0 = 0x1f8); NONFAILING(*(uint32_t*)0x2000000007c4 = -1); NONFAILING(*(uint32_t*)0x2000000007c8 = -1); NONFAILING(*(uint32_t*)0x2000000007cc = 0x1f8); NONFAILING(*(uint32_t*)0x2000000007d0 = -1); NONFAILING(*(uint32_t*)0x2000000007d4 = 3); NONFAILING(*(uint64_t*)0x2000000007d8 = 0); NONFAILING(memset((void*)0x2000000007e0, 0, 84)); NONFAILING(*(uint32_t*)0x200000000834 = 0); NONFAILING(*(uint16_t*)0x200000000838 = 0x70); NONFAILING(*(uint16_t*)0x20000000083a = 0xd0); NONFAILING(*(uint32_t*)0x20000000083c = 0); NONFAILING(*(uint64_t*)0x200000000840 = 0); NONFAILING(*(uint64_t*)0x200000000848 = 0); NONFAILING(*(uint16_t*)0x200000000850 = 0x60); NONFAILING(memcpy((void*)0x200000000852, "CLUSTERIP\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000", 29)); NONFAILING(*(uint8_t*)0x20000000086f = 0); NONFAILING(*(uint32_t*)0x200000000870 = 0); NONFAILING(memcpy((void*)0x200000000874, "\xd3\x2b\x3c\x31\x1e\x5c", 6)); NONFAILING(*(uint16_t*)0x20000000087a = 0xfe01); NONFAILING(*(uint16_t*)0x20000000087c = 4); NONFAILING(*(uint16_t*)0x20000000087e = 0x2f); NONFAILING(*(uint16_t*)0x200000000880 = 0xb); NONFAILING(*(uint16_t*)0x200000000882 = 0x1a); NONFAILING(*(uint16_t*)0x200000000884 = 0); NONFAILING(*(uint16_t*)0x200000000886 = 0x14); NONFAILING(*(uint16_t*)0x200000000888 = 0x22); NONFAILING(*(uint16_t*)0x20000000088a = 4); NONFAILING(*(uint16_t*)0x20000000088c = 0x39); NONFAILING(*(uint16_t*)0x20000000088e = 2); NONFAILING(*(uint16_t*)0x200000000890 = 0x29); NONFAILING(*(uint16_t*)0x200000000892 = 0x1b); NONFAILING(*(uint16_t*)0x200000000894 = 0x16); NONFAILING(*(uint16_t*)0x200000000896 = 3); NONFAILING(*(uint16_t*)0x200000000898 = 0x2c); NONFAILING(*(uint16_t*)0x20000000089a = 0); NONFAILING(*(uint16_t*)0x20000000089c = 2); NONFAILING(*(uint32_t*)0x2000000008a0 = 1); NONFAILING(*(uint32_t*)0x2000000008a4 = 9); NONFAILING(*(uint64_t*)0x2000000008a8 = 2); NONFAILING(*(uint8_t*)0x2000000008b0 = 0xac); NONFAILING(*(uint8_t*)0x2000000008b1 = 0x14); NONFAILING(*(uint8_t*)0x2000000008b2 = 0x14); NONFAILING(*(uint8_t*)0x2000000008b3 = 0xbb); NONFAILING(*(uint32_t*)0x2000000008b4 = htobe32(-1)); NONFAILING(*(uint32_t*)0x2000000008b8 = htobe32(0xff)); NONFAILING(*(uint32_t*)0x2000000008bc = htobe32(0xff000000)); NONFAILING(memcpy((void*)0x2000000008c0, "veth1_to_team\000\000\000", 16)); NONFAILING(memcpy((void*)0x2000000008d0, "pimreg\000\000\000\000\000\000\000\000\000\000", 16)); NONFAILING(*(uint8_t*)0x2000000008e0 = -1); NONFAILING(*(uint8_t*)0x2000000008f0 = -1); NONFAILING(*(uint16_t*)0x200000000900 = 0x88); NONFAILING(*(uint8_t*)0x200000000902 = 2); NONFAILING(*(uint8_t*)0x200000000903 = 8); NONFAILING(*(uint32_t*)0x200000000904 = 0); NONFAILING(*(uint16_t*)0x200000000908 = 0xc0); NONFAILING(*(uint16_t*)0x20000000090a = 0x128); NONFAILING(*(uint32_t*)0x20000000090c = 0); NONFAILING(*(uint64_t*)0x200000000910 = 0); NONFAILING(*(uint64_t*)0x200000000918 = 0); NONFAILING(*(uint16_t*)0x200000000920 = 0x28); NONFAILING(memcpy((void*)0x200000000922, "socket\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 29)); NONFAILING(*(uint8_t*)0x20000000093f = 1); NONFAILING(*(uint8_t*)0x200000000940 = 1); NONFAILING(*(uint16_t*)0x200000000948 = 0x28); NONFAILING(memcpy((void*)0x20000000094a, "rpfilter\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000", 29)); NONFAILING(*(uint8_t*)0x200000000967 = 0); NONFAILING(*(uint8_t*)0x200000000968 = 9); NONFAILING(*(uint16_t*)0x200000000970 = 0x68); NONFAILING( memcpy((void*)0x200000000972, "CT\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000", 29)); NONFAILING(*(uint8_t*)0x20000000098f = 1); NONFAILING(*(uint16_t*)0x200000000990 = 0); NONFAILING(*(uint16_t*)0x200000000992 = 7); NONFAILING(*(uint32_t*)0x200000000994 = 0xfffffff9); NONFAILING(*(uint32_t*)0x200000000998 = 9); NONFAILING(memcpy((void*)0x20000000099c, "syz1\000\000\000\000\000\000\000\000\000\000\000\000", 16)); NONFAILING( memcpy((void*)0x2000000009ac, "syz0\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 32)); NONFAILING(*(uint64_t*)0x2000000009d0 = 0xfc8); NONFAILING(memset((void*)0x2000000009d8, 0, 84)); NONFAILING(*(uint32_t*)0x200000000a2c = 0); NONFAILING(*(uint16_t*)0x200000000a30 = 0x70); NONFAILING(*(uint16_t*)0x200000000a32 = 0x98); NONFAILING(*(uint32_t*)0x200000000a34 = 0); NONFAILING(*(uint64_t*)0x200000000a38 = 0); NONFAILING(*(uint64_t*)0x200000000a40 = 0); NONFAILING(*(uint16_t*)0x200000000a48 = 0x28); NONFAILING(memset((void*)0x200000000a4a, 0, 29)); NONFAILING(*(uint8_t*)0x200000000a67 = 0); NONFAILING(*(uint32_t*)0x200000000a68 = 0xfffffffe); syscall(__NR_setsockopt, /*fd=*/r[3], /*level=*/0, /*opt=*/0x40, /*val=*/0x200000000780ul, /*len=*/0x2f0ul); break; } } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; install_segv_handler(); for (procid = 0; procid < 4; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; }