// https://syzkaller.appspot.com/bug?id=3c2bd4bf2a0bd3c1f4e5ea85f73a90a13b4775f6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0x7 (4 bytes) // ninsn: bytesize8 = 0x8 (4 bytes) // insns: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 18 12 00 00} (length 0x14) // } // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // union ANYUNION { // ANYBLOB: buffer: {00 00 00 00 00 00 00 00 b7 03 00 00 02 00 00 // 00 85 00 00 00 1b 00 00 00 b7 00 00 00 00 00 00 00 95} (length // 0x21) // } // } // } // license: nil // loglev: int32 = 0x0 (4 bytes) // logsize: len = 0x0 (4 bytes) // log: nil // kern_version: bpf_kern_version = 0x41000 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // fallback: bpf_attach_types = 0x20 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x0 (4 bytes) // func_info: nil // func_info_cnt: len = 0x0 (4 bytes) // line_info_rec_size: const = 0x0 (4 bytes) // line_info: nil // line_info_cnt: len = 0x0 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x0 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x94 (8 bytes) // ] // returns fd_bpf_prog *(uint32_t*)0x200000000680 = 7; *(uint32_t*)0x200000000684 = 8; *(uint64_t*)0x200000000688 = 0x200000000080; memcpy((void*)0x200000000080, "\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18" "\x12\x00\x00", 20); *(uint32_t*)0x200000000094 = -1; memcpy((void*)0x200000000098, "\x00\x00\x00\x00\x00\x00\x00\x00\xb7\x03\x00\x00\x02\x00\x00\x00\x85" "\x00\x00\x00\x1b\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x95", 33); *(uint64_t*)0x200000000690 = 0; *(uint32_t*)0x200000000698 = 0; *(uint32_t*)0x20000000069c = 0; *(uint64_t*)0x2000000006a0 = 0; *(uint32_t*)0x2000000006a8 = 0x41000; *(uint32_t*)0x2000000006ac = 0; memset((void*)0x2000000006b0, 0, 16); *(uint32_t*)0x2000000006c0 = 0; *(uint32_t*)0x2000000006c4 = 0x20; *(uint32_t*)0x2000000006c8 = 0; *(uint32_t*)0x2000000006cc = 0; *(uint64_t*)0x2000000006d0 = 0; *(uint32_t*)0x2000000006d8 = 0; *(uint32_t*)0x2000000006dc = 0; *(uint64_t*)0x2000000006e0 = 0; *(uint32_t*)0x2000000006e8 = 0; *(uint32_t*)0x2000000006ec = 0; *(uint32_t*)0x2000000006f0 = 0; *(uint32_t*)0x2000000006f4 = 0; *(uint64_t*)0x2000000006f8 = 0; *(uint64_t*)0x200000000700 = 0; *(uint32_t*)0x200000000708 = 0; *(uint32_t*)0x20000000070c = 0; *(uint32_t*)0x200000000710 = 0; syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000680ul, /*size=*/0x94ul); // bpf$MAP_CREATE arguments: [ // cmd: const = 0x0 (8 bytes) // arg: ptr[in, bpf_map_create_arg] { // union bpf_map_create_arg { // base: bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, // int32, flags[map_flags, int32], const[0, int64]] { // type: bpf_map_type = 0x7 (4 bytes) // ksize: int32 = 0x4 (4 bytes) // vsize: int32 = 0x100 (4 bytes) // max: int32 = 0x3 (4 bytes) // flags: map_flags = 0x28 (4 bytes) // inner: fd_bpf_map (resource) // node: int32 = 0x0 (4 bytes) // map_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00} (length 0x10) map_ifindex: ifindex (resource) btf_fd: fd_btf // (resource) btf_key_type_id: int32 = 0x0 (4 bytes) // btf_value_type_id: int32 = 0x0 (4 bytes) // btf_vmlinux_type_id: int32 = 0x0 (4 bytes) // map_extra: const = 0x0 (8 bytes) // value_type_btf_obj_fd: union // _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, // int32, flags[map_flags, int32], const[0, // int64]]_value_type_btf_obj_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad1: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], // int32, int32, int32, flags[map_flags, int32], const[0, // int64]]_pad1_wrapper { // value: const = 0x0 (4 bytes) // } // map_token_fd: union _bpf_map_create_arg_t[flags[bpf_map_type, // int32], int32, int32, int32, flags[map_flags, int32], const[0, // int64]]_map_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad2: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], // int32, int32, int32, flags[map_flags, int32], const[0, // int64]]_pad2_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // } // size: len = 0x50 (8 bytes) // ] // returns fd_bpf_map *(uint32_t*)0x200000000280 = 7; *(uint32_t*)0x200000000284 = 4; *(uint32_t*)0x200000000288 = 0x100; *(uint32_t*)0x20000000028c = 3; *(uint32_t*)0x200000000290 = 0x28; *(uint32_t*)0x200000000294 = -1; *(uint32_t*)0x200000000298 = 0; memset((void*)0x20000000029c, 0, 16); *(uint32_t*)0x2000000002ac = 0; *(uint32_t*)0x2000000002b0 = -1; *(uint32_t*)0x2000000002b4 = 0; *(uint32_t*)0x2000000002b8 = 0; *(uint32_t*)0x2000000002bc = 0; *(uint64_t*)0x2000000002c0 = 0; *(uint32_t*)0x2000000002c8 = 0; *(uint32_t*)0x2000000002cc = 0; res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200000000280ul, /*size=*/0x50ul); if (res != -1) r[0] = res; // bpf$PROG_LOAD arguments: [ // cmd: const = 0x5 (8 bytes) // arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] { // bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, // bpf_btf_id[opt], fd_bpf_prog[opt]] { // type: bpf_prog_type = 0x7 (4 bytes) // ninsn: bytesize8 = 0x8 (4 bytes) // insns: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 18 12 00 00} (length 0x14) // } // union ANYUNION { // ANYRES32: ANYRES32 (resource) // } // } // } // license: ptr[in, buffer] { // buffer: {47 50 4c 00} (length 0x4) // } // loglev: int32 = 0x0 (4 bytes) // logsize: len = 0x0 (4 bytes) // log: nil // kern_version: bpf_kern_version = 0x41000 (4 bytes) // flags: bpf_prog_load_flags = 0x0 (4 bytes) // prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type: // union bpf_prog_attach_types { // fallback: bpf_attach_types = 0x20 (4 bytes) // } // btf_fd: fd_btf (resource) // func_info_rec_size: const = 0x0 (4 bytes) // func_info: nil // func_info_cnt: len = 0x0 (4 bytes) // line_info_rec_size: const = 0x0 (4 bytes) // line_info: nil // line_info_cnt: len = 0x0 (4 bytes) // attach_btf_id: bpf_btf_id (resource) // attach_prog_fd: fd_bpf_prog (resource) // core_relo_cnt: len = 0x0 (4 bytes) // fd_array: nil // core_relos: nil // core_relo_rec_size: const = 0x0 (4 bytes) // log_true_size: int32 = 0x0 (4 bytes) // prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_prog_token_fd_wrapper { // void: buffer: {} (length 0x0) // } // pad: union _bpf_prog_t[flags[bpf_prog_type, int32], // bpf_prog_attach_types, bpf_btf_id[opt], // fd_bpf_prog[opt]]_pad_wrapper { // value: const = 0x0 (4 bytes) // } // } // } // size: len = 0x94 (8 bytes) // ] // returns fd_bpf_prog *(uint32_t*)0x200000000680 = 7; *(uint32_t*)0x200000000684 = 8; *(uint64_t*)0x200000000688 = 0x200000000080; memcpy((void*)0x200000000080, "\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18" "\x12\x00\x00", 20); *(uint32_t*)0x200000000094 = r[0]; *(uint64_t*)0x200000000690 = 0x200000000780; memcpy((void*)0x200000000780, "GPL\000", 4); *(uint32_t*)0x200000000698 = 0; *(uint32_t*)0x20000000069c = 0; *(uint64_t*)0x2000000006a0 = 0; *(uint32_t*)0x2000000006a8 = 0x41000; *(uint32_t*)0x2000000006ac = 0; memset((void*)0x2000000006b0, 0, 16); *(uint32_t*)0x2000000006c0 = 0; *(uint32_t*)0x2000000006c4 = 0x20; *(uint32_t*)0x2000000006c8 = 0; *(uint32_t*)0x2000000006cc = 0; *(uint64_t*)0x2000000006d0 = 0; *(uint32_t*)0x2000000006d8 = 0; *(uint32_t*)0x2000000006dc = 0; *(uint64_t*)0x2000000006e0 = 0; *(uint32_t*)0x2000000006e8 = 0; *(uint32_t*)0x2000000006ec = 0; *(uint32_t*)0x2000000006f0 = 0; *(uint32_t*)0x2000000006f4 = 0; *(uint64_t*)0x2000000006f8 = 0; *(uint64_t*)0x200000000700 = 0; *(uint32_t*)0x200000000708 = 0; *(uint32_t*)0x20000000070c = 0; *(uint32_t*)0x200000000710 = 0; res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000680ul, /*size=*/0x94ul); if (res != -1) r[1] = res; // perf_event_open arguments: [ // attr: ptr[in, perf_event_attr] { // perf_event_attr { // type: perf_event_type = 0x1 (4 bytes) // size: len = 0x80 (4 bytes) // config0: int8 = 0x2 (1 bytes) // config1: int8 = 0x0 (1 bytes) // config2: int8 = 0x0 (1 bytes) // config3: int8 = 0x0 (1 bytes) // config4: const = 0x0 (4 bytes) // sample_freq: int64 = 0x400 (8 bytes) // sample_type: perf_sample_type = 0x66137 (8 bytes) // read_format: perf_read_format = 0x0 (8 bytes) // disabled: int64 = 0x0 (0 bytes) // inherit: int64 = 0x0 (0 bytes) // pinned: int64 = 0x0 (0 bytes) // exclusive: int64 = 0x0 (0 bytes) // exclude_user: int64 = 0x0 (0 bytes) // exclude_kernel: int64 = 0x0 (0 bytes) // exclude_hv: int64 = 0x0 (0 bytes) // exclude_idle: int64 = 0x0 (0 bytes) // mmap: int64 = 0x0 (0 bytes) // comm: int64 = 0x0 (0 bytes) // freq: int64 = 0x0 (0 bytes) // inherit_stat: int64 = 0x0 (0 bytes) // enable_on_exec: int64 = 0x0 (0 bytes) // task: int64 = 0x0 (0 bytes) // watermark: int64 = 0x0 (0 bytes) // precise_ip: int64 = 0x0 (0 bytes) // mmap_data: int64 = 0x0 (0 bytes) // sample_id_all: int64 = 0x0 (0 bytes) // exclude_host: int64 = 0x0 (0 bytes) // exclude_guest: int64 = 0x0 (0 bytes) // exclude_callchain_kernel: int64 = 0x0 (0 bytes) // exclude_callchain_user: int64 = 0x0 (0 bytes) // mmap2: int64 = 0x0 (0 bytes) // comm_exec: int64 = 0x0 (0 bytes) // use_clockid: int64 = 0x0 (0 bytes) // context_switch: int64 = 0x0 (0 bytes) // write_backward: int64 = 0x0 (0 bytes) // namespaces: int64 = 0x0 (0 bytes) // ksymbol: int64 = 0x0 (0 bytes) // bpf_event: int64 = 0x0 (0 bytes) // aux_output: int64 = 0x0 (0 bytes) // cgroup: int64 = 0x0 (0 bytes) // text_poke: int64 = 0x0 (0 bytes) // build_id: int64 = 0x0 (0 bytes) // inherit_thread: int64 = 0x0 (0 bytes) // remove_on_exec: int64 = 0x0 (0 bytes) // sigtrap: int64 = 0x0 (0 bytes) // __reserved_1: const = 0x0 (8 bytes) // wakeup_events: int32 = 0x24000000 (4 bytes) // bp_type: perf_bp_type = 0x0 (4 bytes) // bp_config: union perf_bp_config { // perf_bp: perf_bp { // bp_addr: nil // bp_len: perf_bp_lens = 0x8 (8 bytes) // } // } // branch_sample_type: perf_branch_sample_type = 0x0 (8 bytes) // sample_regs_user: int64 = 0x0 (8 bytes) // sample_stack_user: int32 = 0x0 (4 bytes) // clockid: clock_type = 0x0 (4 bytes) // sample_regs_intr: int64 = 0x7 (8 bytes) // aux_watermark: int32 = 0x0 (4 bytes) // sample_max_stack: int16 = 0x0 (2 bytes) // __reserved_2: const = 0x0 (2 bytes) // aux_sample_size: int32 = 0x0 (4 bytes) // __reserved_3: const = 0x0 (4 bytes) // sig_data: int64 = 0x0 (8 bytes) // } // } // pid: pid (resource) // cpu: intptr = 0xffefffffffffffff (8 bytes) // group: fd_perf (resource) // flags: perf_flags = 0x0 (8 bytes) // ] // returns fd_perf *(uint32_t*)0x200000000fc0 = 1; *(uint32_t*)0x200000000fc4 = 0x80; *(uint8_t*)0x200000000fc8 = 2; *(uint8_t*)0x200000000fc9 = 0; *(uint8_t*)0x200000000fca = 0; *(uint8_t*)0x200000000fcb = 0; *(uint32_t*)0x200000000fcc = 0; *(uint64_t*)0x200000000fd0 = 0x400; *(uint64_t*)0x200000000fd8 = 0x66137; *(uint64_t*)0x200000000fe0 = 0; STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 0, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 1, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 2, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 3, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 4, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 5, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 6, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 7, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 8, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 9, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 10, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 11, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 12, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 13, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 14, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 15, 2); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 17, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 18, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 19, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 20, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 21, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 22, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 23, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 24, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 25, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 26, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 27, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 28, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 29, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 30, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 31, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 32, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 33, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 34, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 35, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 36, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 37, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000fe8, 0, 38, 26); *(uint32_t*)0x200000000ff0 = 0x24000000; *(uint32_t*)0x200000000ff4 = 0; *(uint64_t*)0x200000000ff8 = 0; *(uint64_t*)0x200000001000 = 8; *(uint64_t*)0x200000001008 = 0; *(uint64_t*)0x200000001010 = 0; *(uint32_t*)0x200000001018 = 0; *(uint32_t*)0x20000000101c = 0; *(uint64_t*)0x200000001020 = 7; *(uint32_t*)0x200000001028 = 0; *(uint16_t*)0x20000000102c = 0; *(uint16_t*)0x20000000102e = 0; *(uint32_t*)0x200000001030 = 0; *(uint32_t*)0x200000001034 = 0; *(uint64_t*)0x200000001038 = 0; res = syscall(__NR_perf_event_open, /*attr=*/0x200000000fc0ul, /*pid=*/0, /*cpu=*/0xffeffffffffffffful, /*group=*/(intptr_t)-1, /*flags=*/0ul); if (res != -1) r[2] = res; // ioctl$PERF_EVENT_IOC_SET_BPF arguments: [ // fd: fd_perf (resource) // cmd: const = 0x40042408 (4 bytes) // prog: fd_bpf_prog (resource) // ] syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0x40042408, /*prog=*/r[1]); // socketpair$unix arguments: [ // domain: const = 0x1 (8 bytes) // type: unix_socket_type = 0x5 (8 bytes) // proto: const = 0x0 (4 bytes) // fds: ptr[out, unix_pair] { // unix_pair { // fd0: sock_unix (resource) // fd1: sock_unix (resource) // } // } // ] res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul, /*proto=*/0, /*fds=*/0x200000000200ul); if (res != -1) r[3] = *(uint32_t*)0x200000000204; // sendmsg$inet arguments: [ // fd: sock (resource) // msg: ptr[in, msghdr_inet] { // msghdr_inet { // msg_name: nil // msg_namelen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // msg_iov: ptr[in, array[iovec[in, array[int8]]]] { // array[iovec[in, array[int8]]] { // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {25 b0 96 f6 81 cd 73 1c 3f 3a 9b ad c4 e3 cf 5e de // ae 1f 3b 50 82 d7 ab 3a 97 c0 53 df 68 74 4e 7c 7e 24 d0 b5 // 99 97 ba b4 bc cf f8 36 3b 27 5d e3 51 0b 0e be 42 75 d8 d2 // f1 53 39 56 68 e3 d6 08 e3 58 fc 22 94 26 3c 03 f8 dc 4f 8b // f1 94 e4 fd e4 60 0a 2d ec 2f 48 3a 91 4e 2f de 0c bc 34 4a // 2b 9f c1 8d d1 98 96 60 45 a6 d4 d4 eb 85 71 e8 bb 69 e6 72 // 4e 37 fc ba a6 e4 c6 40 50 b4 72 56 b9 bb 17 f5 c0 aa 51 01 // e0 15 ec dc b6 2f ec 46 fc 02 05 51 25 35} (length 0x97) // } // len: len = 0x97 (8 bytes) // } // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {d3 a8 8b ea 59 16 e3 13 72 9a 39 89 39 3c ac a7 0c // 74 cd 74 e6 2e 52 4b dd 37 be 13 1a d8 27 f9 11 02 7e 70 cc // f6 79 d8 e7 c0 cd 33 33 09 5f 83 d6 d4 73 db 34 5d ed 2a c8 // ac aa 87 50 3d e7 4c 82 43 17 58 e8 e1 1e 3e cb 7b ce 02 d6 // cd 65 f4 eb 88 cc 49 ce b9 e3 9f 71 17 eb 0f 62 32 3d c9 b8 // 0d ea 44 7b 0c 96 a3 83 f1 42 81 bb 87 b0 9d e0 a6 15 3c ee // aa e2 b5 0a 2b 0f 0f 41 81 0f 37 9f 9c 3a 1f 39 38 46 18 29 // d7 16 a4 bd a8 6a b1 1b 41 f7 54 bc 15 d7 1b} (length 0x98) // } // len: len = 0xfed0 (8 bytes) // } // } // } // msg_iovlen: len = 0x2 (8 bytes) // msg_control: nil // msg_controllen: bytesize = 0x0 (8 bytes) // msg_flags: const = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000180 = 0; *(uint32_t*)0x200000000188 = 0; *(uint64_t*)0x200000000190 = 0x200000000100; *(uint64_t*)0x200000000100 = 0x200000000340; memcpy((void*)0x200000000340, "\x25\xb0\x96\xf6\x81\xcd\x73\x1c\x3f\x3a\x9b\xad\xc4\xe3\xcf\x5e\xde" "\xae\x1f\x3b\x50\x82\xd7\xab\x3a\x97\xc0\x53\xdf\x68\x74\x4e\x7c\x7e" "\x24\xd0\xb5\x99\x97\xba\xb4\xbc\xcf\xf8\x36\x3b\x27\x5d\xe3\x51\x0b" "\x0e\xbe\x42\x75\xd8\xd2\xf1\x53\x39\x56\x68\xe3\xd6\x08\xe3\x58\xfc" "\x22\x94\x26\x3c\x03\xf8\xdc\x4f\x8b\xf1\x94\xe4\xfd\xe4\x60\x0a\x2d" "\xec\x2f\x48\x3a\x91\x4e\x2f\xde\x0c\xbc\x34\x4a\x2b\x9f\xc1\x8d\xd1" "\x98\x96\x60\x45\xa6\xd4\xd4\xeb\x85\x71\xe8\xbb\x69\xe6\x72\x4e\x37" "\xfc\xba\xa6\xe4\xc6\x40\x50\xb4\x72\x56\xb9\xbb\x17\xf5\xc0\xaa\x51" "\x01\xe0\x15\xec\xdc\xb6\x2f\xec\x46\xfc\x02\x05\x51\x25\x35", 151); *(uint64_t*)0x200000000108 = 0x97; *(uint64_t*)0x200000000110 = 0x200000000280; memcpy((void*)0x200000000280, "\xd3\xa8\x8b\xea\x59\x16\xe3\x13\x72\x9a\x39\x89\x39\x3c\xac\xa7\x0c" "\x74\xcd\x74\xe6\x2e\x52\x4b\xdd\x37\xbe\x13\x1a\xd8\x27\xf9\x11\x02" "\x7e\x70\xcc\xf6\x79\xd8\xe7\xc0\xcd\x33\x33\x09\x5f\x83\xd6\xd4\x73" "\xdb\x34\x5d\xed\x2a\xc8\xac\xaa\x87\x50\x3d\xe7\x4c\x82\x43\x17\x58" "\xe8\xe1\x1e\x3e\xcb\x7b\xce\x02\xd6\xcd\x65\xf4\xeb\x88\xcc\x49\xce" "\xb9\xe3\x9f\x71\x17\xeb\x0f\x62\x32\x3d\xc9\xb8\x0d\xea\x44\x7b\x0c" "\x96\xa3\x83\xf1\x42\x81\xbb\x87\xb0\x9d\xe0\xa6\x15\x3c\xee\xaa\xe2" "\xb5\x0a\x2b\x0f\x0f\x41\x81\x0f\x37\x9f\x9c\x3a\x1f\x39\x38\x46\x18" "\x29\xd7\x16\xa4\xbd\xa8\x6a\xb1\x1b\x41\xf7\x54\xbc\x15\xd7\x1b", 152); *(uint64_t*)0x200000000118 = 0xfed0; *(uint64_t*)0x200000000198 = 2; *(uint64_t*)0x2000000001a0 = 0; *(uint64_t*)0x2000000001a8 = 0; *(uint32_t*)0x2000000001b0 = 0; syscall(__NR_sendmsg, /*fd=*/r[3], /*msg=*/0x200000000180ul, /*f=*/0ul); return 0; }