// https://syzkaller.appspot.com/bug?id=5fb5b4dc16f711b2b5660e71c454d9015f9da58d // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // mode: open_mode = 0xc0 (8 bytes) // ] memcpy((void*)0x200000000000, "./file0\000", 8); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000000ul, /*mode=S_IXUSR|S_IWUSR*/ 0xc0ul); // mount$incfs arguments: [ // src: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // dst: ptr[in, buffer] { // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) // } // type: ptr[in, buffer] { // buffer: {69 6e 63 72 65 6d 65 6e 74 61 6c 2d 66 73 00} (length 0xf) // } // flags: mount_flags = 0x200c04 (8 bytes) // opts: ptr[in, fs_options[incfs_options]] { // fs_options[incfs_options] { // elems: array[fs_opt_elem[incfs_options]] { // fs_opt_elem[incfs_options] { // elem: union incfs_options { // rlog_pages: fs_opt["rlog_pages", fmt[dec, int32]] { // name: buffer: {72 6c 6f 67 5f 70 61 67 65 73} (length 0xa) // eq: const = 0x3d (1 bytes) // val: int32 = 0xfffffffffffffff8 (20 bytes) // } // } // comma: const = 0x2c (1 bytes) // } // } // common: array[fs_opt_elem[fs_options_common]] { // } // null: const = 0x0 (1 bytes) // } // } // ] memcpy((void*)0x200000000040, "./file0\000", 8); memcpy((void*)0x200000000140, "./file0\000", 8); memcpy((void*)0x2000000000c0, "incremental-fs\000", 15); memcpy((void*)0x200000000100, "rlog_pages", 10); *(uint8_t*)0x20000000010a = 0x3d; sprintf((char*)0x20000000010b, "%020llu", (long long)0xfffffffffffffff8); *(uint8_t*)0x20000000011f = 0x2c; *(uint8_t*)0x200000000120 = 0; syscall(__NR_mount, /*src=*/0x200000000040ul, /*dst=*/0x200000000140ul, /*type=*/0x2000000000c0ul, /*flags=MS_RELATIME|MS_NODIRATIME|MS_NODEV|MS_NOATIME*/ 0x200c04ul, /*opts=*/0x200000000100ul); return 0; }