// https://syzkaller.appspot.com/bug?id=706b6c9eabd4ae705fd39d2ea2581f696ebd0a38 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_mkdirat #define __NR_mkdirat 34 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_mount #define __NR_mount 40 #endif #ifndef __NR_mount_setattr #define __NR_mount_setattr 442 #endif #ifndef __NR_openat #define __NR_openat 56 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 211 #endif #ifndef __NR_sendto #define __NR_sendto 206 #endif #ifndef __NR_socket #define __NR_socket 198 #endif static __thread int clone_ongoing; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { exit(sig); } uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; int valid = addr < prog_start || addr > prog_end; if (skip && valid) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ ({ \ int ok = 1; \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } else \ ok = 0; \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ ok; \ }) static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } struct nlmsg { char* pos; int nesting; struct nlattr* nested[8]; char buf[4096]; }; static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, const void* data, int size) { memset(nlmsg, 0, sizeof(*nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; if (size > 0) memcpy(hdr + 1, data, size); nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; if (size > 0) memcpy(attr + 1, data, size); nlmsg->pos += NLMSG_ALIGN(attr->nla_len); } static void netlink_nest(struct nlmsg* nlmsg, int typ) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_type = typ; nlmsg->pos += sizeof(*attr); nlmsg->nested[nlmsg->nesting++] = attr; } static void netlink_done(struct nlmsg* nlmsg) { struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; attr->nla_len = nlmsg->pos - (char*)attr; } static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, int* reply_len, bool dofail) { if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != (ssize_t)hdr->nlmsg_len) { if (dofail) exit(1); return -1; } n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); if (reply_len) *reply_len = 0; if (n < 0) { if (dofail) exit(1); return -1; } if (n < (ssize_t)sizeof(struct nlmsghdr)) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type == NLMSG_DONE) return 0; if (reply_len && hdr->nlmsg_type == reply_type) { *reply_len = n; return 0; } if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type != NLMSG_ERROR) { errno = EINVAL; if (dofail) exit(1); return -1; } errno = -((struct nlmsgerr*)(hdr + 1))->error; return -errno; } static int netlink_send(struct nlmsg* nlmsg, int sock) { return netlink_send_ext(nlmsg, sock, 0, NULL, true); } static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = CTRL_CMD_GETFAMILY; netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); int n = 0; int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); if (err < 0) { return -1; } uint16_t id = 0; struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { id = *(uint16_t*)(attr + 1); break; } } if (!id) { errno = EINVAL; return -1; } recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); return id; } static unsigned int queue_count = 2; static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type, const char* name, bool up) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); if (name) netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); netlink_attr(nlmsg, IFLA_NUM_TX_QUEUES, &queue_count, sizeof(queue_count)); netlink_attr(nlmsg, IFLA_NUM_RX_QUEUES, &queue_count, sizeof(queue_count)); netlink_nest(nlmsg, IFLA_LINKINFO); netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type)); } static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up, const char* master, const void* mac, int macsize, const char* new_name) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; hdr.ifi_index = if_nametoindex(name); netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); if (master) { int ifindex = if_nametoindex(master); netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); } if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static struct nlmsg nlmsg; static void setup_sysctl() { int cad_pid = fork(); if (cad_pid < 0) exit(1); if (cad_pid == 0) { for (;;) sleep(100); } char tmppid[32]; snprintf(tmppid, sizeof(tmppid), "%d", cad_pid); struct { const char* name; const char* data; } files[] = { {"/proc/sys/kernel/hung_task_check_interval_secs", "20"}, {"/proc/sys/net/core/bpf_jit_kallsyms", "1"}, {"/proc/sys/net/core/bpf_jit_harden", "0"}, {"/proc/sys/kernel/kptr_restrict", "0"}, {"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"}, {"/proc/sys/fs/mount-max", "100"}, {"/proc/sys/vm/oom_dump_tasks", "0"}, {"/proc/sys/debug/exception-trace", "0"}, {"/proc/sys/kernel/printk", "7 4 1 3"}, {"/proc/sys/kernel/keys/gc_delay", "1"}, {"/proc/sys/vm/oom_kill_allocating_task", "1"}, {"/sys/kernel/debug/failslab/task-filter", "Y"}, {"/sys/kernel/debug/fail_page_alloc/task-filter", "Y"}, {"/sys/kernel/debug/fail_futex/task-filter", "Y"}, {"/sys/kernel/debug/fail_usercopy/task-filter", "Y"}, {"/sys/kernel/debug/fail_make_request/task-filter", "Y"}, {"/sys/kernel/debug/fail_io_timeout/task-filter", "Y"}, {"/sys/kernel/debug/fail_iommufd/task-filter", "Y"}, {"/proc/sys/kernel/ctrl-alt-del", "0"}, {"/proc/sys/kernel/cad_pid", tmppid}, }; for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) { if (!write_file(files[i].name, files[i].data)) { } } kill(cad_pid, SIGKILL); while (waitpid(cad_pid, NULL, 0) != cad_pid) ; } #define NL802154_CMD_SET_SHORT_ADDR 11 #define NL802154_ATTR_IFINDEX 3 #define NL802154_ATTR_SHORT_ADDR 10 static const char* setup_802154() { const char* error = NULL; int sock_generic = -1; int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock_route == -1) { error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) failed"; goto fail; } sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock_generic == -1) { error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) failed"; goto fail; } { int nl802154_family_id = netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true); if (nl802154_family_id < 0) { error = "netlink_query_family_id failed"; goto fail; } for (int i = 0; i < 2; i++) { char devname[] = "wpan0"; devname[strlen(devname) - 1] += i; uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8); uint16_t shortaddr = 0xaaa0 + i; int ifindex = if_nametoindex(devname); struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR; netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr, sizeof(shortaddr)); if (netlink_send(&nlmsg, sock_generic) < 0) { error = "NL802154_CMD_SET_SHORT_ADDR failed"; goto fail; } netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr, sizeof(hwaddr), 0); if (i == 0) { netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false); netlink_done(&nlmsg); netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); if (netlink_send(&nlmsg, sock_route) < 0) { error = "netlink: adding device lowpan0 type lowpan link wpan0"; goto fail; } } } } fail: close(sock_route); close(sock_generic); return error; } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); setup_sysctl(); const char* reason; (void)reason; if ((reason = setup_802154())) printf("the reproducer may not work as expected: 802154 injection setup " "failed: %s\n", reason); install_segv_handler(); use_temporary_dir(); intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // mkdirat arguments: [ // fd: fd_dir (resource) // path: ptr[in, buffer] { // buffer: {2e 2f 73 79 73 00} (length 0x6) // } // mode: open_mode = 0x71 (8 bytes) // ] NONFAILING(memcpy((void*)0x200002c0, "./sys\000", 6)); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200002c0ul, /*mode=S_IXOTH|S_IWGRP|S_IRGRP|S_IXUSR*/ 0x71ul); // mount arguments: [ // src: nil // dst: ptr[in, buffer] { // buffer: {2e 2f 73 79 73 00} (length 0x6) // } // type: ptr[in, buffer] { // buffer: {73 79 73 66 73 00} (length 0x6) // } // flags: mount_flags = 0x0 (8 bytes) // data: nil // ] NONFAILING(memcpy((void*)0x20000300, "./sys\000", 6)); NONFAILING(memcpy((void*)0x20000340, "sysfs\000", 6)); syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x20000300ul, /*type=*/0x20000340ul, /*flags=*/0ul, /*data=*/0ul); // openat arguments: [ // fd: fd_dir (resource) // file: ptr[in, buffer] { // buffer: {2e 2f 73 79 73 2f 62 75 73 2f 70 63 69 2f 64 65 76 69 63 65 // 73 2f 30 30 30 30 3a 30 30 3a 30 32 2e 30 2f 72 65 73 6f 75 72 63 65 // 30 00} (length 0x2d) // } // flags: open_flags = 0x2 (4 bytes) // mode: open_mode = 0x0 (2 bytes) // ] // returns fd NONFAILING(memcpy((void*)0x20000380, "./sys/bus/pci/devices/0000:00:02.0/resource0\000", 45)); res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000380ul, /*flags=O_RDWR*/ 2, /*mode=*/0); if (res != -1) r[0] = res; // mmap arguments: [ // addr: VMA[0x2000] // len: len = 0x2000 (4 bytes) // prot: mmap_prot = 0x3 (8 bytes) // flags: mmap_flags = 0x11 (8 bytes) // fd: fd (resource) // offset: intptr = 0x0 (8 bytes) // ] syscall(__NR_mmap, /*addr=*/0x20001000ul, /*len=*/0x2000, /*prot=PROT_WRITE|PROT_READ*/ 3ul, /*flags=MAP_FIXED|MAP_SHARED*/ 0x11ul, /*fd=*/r[0], /*offset=*/0ul); // mount_setattr arguments: [ // dfd: fd_dir (resource) // filename: nil // flags: mount_setattr_flags = 0x0 (8 bytes) // args: nil // size: bytesize = 0x0 (8 bytes) // ] syscall(__NR_mount_setattr, /*dfd=*/(intptr_t)-1, /*filename=*/0ul, /*flags=*/0ul, /*args=*/0ul, /*size=*/0ul); // sendmsg$nl_route_sched arguments: [ // fd: sock_nl_route (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] { // msghdr_netlink[netlink_msg_route_sched] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_route_sched]] { // iovec[in, netlink_msg_route_sched] { // addr: ptr[in, netlink_msg_route_sched] { // union netlink_msg_route_sched { // delchain: netlink_msg_t[const[RTM_DELCHAIN, int16], // tcmsg[AF_UNSPEC], filter_policy] { // len: len = 0x214 (4 bytes) // type: const = 0x65 (2 bytes) // flags: netlink_msg_flags = 0x100 (2 bytes) // seq: int32 = 0x70bd29 (4 bytes) // pid: int32 = 0x25dfdbff (4 bytes) // payload: tcmsg[AF_UNSPEC] { // family: const = 0x0 (1 bytes) // tcm__pad1: const = 0x0 (1 bytes) // tcm__pad2: const = 0x0 (2 bytes) // ifindex: ifindex (resource) // tcm_handle: tcm_handle { // minor: tcm_handle_offsets = 0xd (2 bytes) // major: tcm_handle_offsets = 0x1 (2 bytes) // } // tcm_parent: tcm_handle { // minor: tcm_handle_offsets = 0xe (2 bytes) // major: tcm_handle_offsets = 0xd (2 bytes) // } // tcm_info: tcm_handle { // minor: tcm_handle_offsets = 0x5 (2 bytes) // major: tcm_handle_offsets = 0x0 (2 bytes) // } // } // attrs: array[filter_policy] { // union filter_policy { // TCA_CHAIN: nlattr_t[const[TCA_CHAIN, int16], int32] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0xb (2 bytes) // payload: int32 = 0x8 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union filter_policy { // TCA_RATE: nlattr_t[const[TCA_RATE, int16], // tc_estimator] { // nla_len: offsetof = 0x6 (2 bytes) // nla_type: const = 0x5 (2 bytes) // payload: tc_estimator { // interval: int8 = 0x6 (1 bytes) // ewma_log: int8 = 0xbe (1 bytes) // } // size: buffer: {} (length 0x0) // pad = 0x0 (2 bytes) // } // } // union filter_policy { // filter_kind_options: union filter_kind_options { // f_bpf: tca_kind_options_t["bpf", array[bpf_policy]] // { // TCA_KIND: nlattr_t[const[TCA_KIND, int16], // string["bpf"]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {62 70 66 00} (length 0x4) // size: buffer: {} (length 0x0) // } // TCA_OPTIONS: nlattr_t[const[TCA_OPTIONS, int16], // array[bpf_policy]] { // nla_len: offsetof = 0x1c8 (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: array[bpf_policy] { // union bpf_policy { // TCA_BPF_OPS: bpf_policy$ops { // TCA_BPF_OPS_LEN: // nlattr_t[const[TCA_BPF_OPS_LEN, int16], // len[bpf_policy$ops:TCA_BPF_OPS:payload, // int16]] { // nla_len: offsetof = 0x6 (2 bytes) // nla_type: const = 0x4 (2 bytes) // payload: len = 0x0 (2 bytes) // size: buffer: {} (length 0x0) // pad = 0x0 (2 bytes) // } // TCA_BPF_OPS: nlattr_t[const[TCA_BPF_OPS, // int16], array[sock_filter]] { // nla_len: offsetof = 0x4 (2 bytes) // nla_type: const = 0x5 (2 bytes) // payload: array[sock_filter] { // } // size: buffer: {} (length 0x0) // } // } // } // union bpf_policy { // TCA_BPF_ACT: nlattr_t[const[TCA_BPF_ACT, // int16], array[tca_actions]] { // nla_len: offsetof = 0x1ac (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: array[tca_actions] { // union tca_actions { // m_gact: // nlattr_tt[int16:14[0:TCA_ACT_MAX_PRIO], // 0, 0, tcf_action_policy["gact", // gact_policy]] { // nla_len: offsetof = 0x108 (2 bytes) // nla_type: int16 = 0x4 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 // bytes) NLA_F_NESTED: const = 0x0 (1 // bytes) payload: // tcf_action_policy["gact", // gact_policy] { // TCA_ACT_KIND: // nlattr_t[const[TCA_ACT_KIND, // int16], string["gact"]] { // nla_len: offsetof = 0x9 (2 // bytes) nla_type: const = 0x1 (2 // bytes) payload: buffer: {67 61 // 63 74 00} (length 0x5) size: // buffer: {} (length 0x0) pad = // 0x0 (3 bytes) // } // TCA_ACT_OPTIONS: // nlattr_tt[const[TCA_ACT_OPTIONS, // int16:14], 0, 1, // array[gact_policy]] { // nla_len: offsetof = 0x70 (2 // bytes) nla_type: const = 0x2 (1 // bytes) NLA_F_NET_BYTEORDER: // const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 // bytes) payload: // array[gact_policy] { // union gact_policy { // TCA_GACT_PARMS: // nlattr_t[const[TCA_GACT_PARMS, // int16], tc_gen] { // nla_len: offsetof = 0x18 // (2 bytes) nla_type: const // = 0x2 (2 bytes) payload: // tc_gen { // index: int32 = 0x6 (4 // bytes) capab: int32 = // 0x8 (4 bytes) action: // tc_actions = 0x4 (4 // bytes) refcnt: int32 = // 0x5 (4 bytes) bindcnt: // int32 = 0x6 (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // union gact_policy { // TCA_GACT_PROB: // nlattr_t[const[TCA_GACT_PROB, // int16], tc_gact_p] { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = // 0x3 (2 bytes) payload: // tc_gact_p { // ptype: tc_pgact_flags = // 0x0 (2 bytes) pval: // int16 = 0x1fd1 (2 bytes) // paction: tc_actions = // 0x6 (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // union gact_policy { // TCA_GACT_PROB: // nlattr_t[const[TCA_GACT_PROB, // int16], tc_gact_p] { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = // 0x3 (2 bytes) payload: // tc_gact_p { // ptype: tc_pgact_flags = // 0x2 (2 bytes) pval: // int16 = 0x1572 (2 bytes) // paction: tc_actions = // 0x6 (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // union gact_policy { // TCA_GACT_PARMS: // nlattr_t[const[TCA_GACT_PARMS, // int16], tc_gen] { // nla_len: offsetof = 0x18 // (2 bytes) nla_type: const // = 0x2 (2 bytes) payload: // tc_gen { // index: int32 = 0x1 (4 // bytes) capab: int32 = // 0x140 (4 bytes) action: // tc_actions = 0x0 (4 // bytes) refcnt: int32 = // 0x9 (4 bytes) bindcnt: // int32 = 0xf4c (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // union gact_policy { // TCA_GACT_PROB: // nlattr_t[const[TCA_GACT_PROB, // int16], tc_gact_p] { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = // 0x3 (2 bytes) payload: // tc_gact_p { // ptype: tc_pgact_flags = // 0x2 (2 bytes) pval: // int16 = 0x2383 (2 bytes) // paction: tc_actions = // 0x3 (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // union gact_policy { // TCA_GACT_PROB: // nlattr_t[const[TCA_GACT_PROB, // int16], tc_gact_p] { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = // 0x3 (2 bytes) payload: // tc_gact_p { // ptype: tc_pgact_flags = // 0x0 (2 bytes) pval: // int16 = 0x1a23 (2 bytes) // paction: tc_actions = // 0x3 (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // union gact_policy { // TCA_GACT_PROB: // nlattr_t[const[TCA_GACT_PROB, // int16], tc_gact_p] { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = // 0x3 (2 bytes) payload: // tc_gact_p { // ptype: tc_pgact_flags = // 0x0 (2 bytes) pval: // int16 = 0x535 (2 bytes) // paction: tc_actions = // 0x20000006 (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // TCA_ACT_COOKIE: // nlattr_t[const[TCA_ACT_COOKIE, // int16], array[int8]] { // nla_len: offsetof = 0x6d (2 // bytes) nla_type: const = 0x6 (2 // bytes) payload: buffer: {96 c1 // 38 9a e5 87 63 f2 7f a4 76 63 cd // fb 86 98 c4 55 9f 4c 87 7e 82 0a // 0c c3 bd 0e 4c 01 dc 38 6f 0f 6e // 58 38 20 b0 93 8e e5 82 a8 85 d5 // 72 be 35 9a ac db 1b aa e0 7a 17 // d7 e8 ff 95 e0 32 c4 5d 09 d5 18 // 58 11 12 b5 06 5f 9c 05 d1 37 44 // cc b7 3a a5 d9 04 53 d5 70 a4 47 // ea 0c 0d 3b f4 7a 02 61 72 4d 4c // 83 39 63 3c} (length 0x69) size: // buffer: {} (length 0x0) // } // TCA_ACT_FLAGS: // nlattr_t[const[TCA_ACT_FLAGS, // int16], // nla_bitfield32[tcf_action_policy_flags]] // { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = 0x7 (2 // bytes) payload: // nla_bitfield32[tcf_action_policy_flags] // { // value: tcf_action_policy_flags // = 0x1 (4 bytes) selector: // tcf_action_policy_flags = 0x1 // (4 bytes) // } // size: buffer: {} (length 0x0) // } // TCA_ACT_HW_STATS: // nlattr_t[const[TCA_ACT_HW_STATS, // int16], // nla_bitfield32[tcf_action_policy_hw_stats]] // { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = 0x8 (2 // bytes) payload: // nla_bitfield32[tcf_action_policy_hw_stats] // { // value: // tcf_action_policy_hw_stats = // 0x1 (4 bytes) selector: // tcf_action_policy_hw_stats = // 0x2 (4 bytes) // } // size: buffer: {} (length 0x0) // } // } // size: buffer: {} (length 0x0) // } // } // union tca_actions { // m_skbedit: // nlattr_tt[int16:14[0:TCA_ACT_MAX_PRIO], // 0, 0, tcf_action_policy["skbedit", // skbedit_policy]] { // nla_len: offsetof = 0xa0 (2 bytes) // nla_type: int16 = 0x18 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 // bytes) NLA_F_NESTED: const = 0x0 (1 // bytes) payload: // tcf_action_policy["skbedit", // skbedit_policy] { // TCA_ACT_KIND: // nlattr_t[const[TCA_ACT_KIND, // int16], string["skbedit"]] { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = 0x1 (2 // bytes) payload: buffer: {73 6b // 62 65 64 69 74 00} (length 0x8) // size: buffer: {} (length 0x0) // } // TCA_ACT_OPTIONS: // nlattr_tt[const[TCA_ACT_OPTIONS, // int16:14], 0, 1, // array[skbedit_policy]] { // nla_len: offsetof = 0x74 (2 // bytes) nla_type: const = 0x2 (1 // bytes) NLA_F_NET_BYTEORDER: // const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 // bytes) payload: // array[skbedit_policy] { // union skbedit_policy { // TCA_SKBEDIT_PARMS: // nlattr_t[const[TCA_SKBEDIT_PARMS, // int16], tc_gen] { // nla_len: offsetof = 0x18 // (2 bytes) nla_type: const // = 0x2 (2 bytes) payload: // tc_gen { // index: int32 = 0x2 (4 // bytes) capab: int32 = // 0x7 (4 bytes) action: // tc_actions = // 0xffffffffffffffff (4 // bytes) refcnt: int32 = // 0x401 (4 bytes) bindcnt: // int32 = 0xfffffffe (4 // bytes) // } // size: buffer: {} (length // 0x0) // } // } // union skbedit_policy { // TCA_SKBEDIT_PRIORITY: // nlattr_t[const[TCA_SKBEDIT_PRIORITY, // int16], tcm_handle] { // nla_len: offsetof = 0x8 (2 // bytes) nla_type: const = // 0x3 (2 bytes) payload: // tcm_handle { // minor: // tcm_handle_offsets = 0xc // (2 bytes) major: // tcm_handle_offsets = 0x8 // (2 bytes) // } // size: buffer: {} (length // 0x0) // } // } // union skbedit_policy { // TCA_SKBEDIT_PARMS: // nlattr_t[const[TCA_SKBEDIT_PARMS, // int16], tc_gen] { // nla_len: offsetof = 0x18 // (2 bytes) nla_type: const // = 0x2 (2 bytes) payload: // tc_gen { // index: int32 = 0x8 (4 // bytes) capab: int32 = // 0x4 (4 bytes) action: // tc_actions = 0x1 (4 // bytes) refcnt: int32 = // 0x2 (4 bytes) bindcnt: // int32 = 0x6 (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // union skbedit_policy { // TCA_SKBEDIT_PTYPE: // nlattr_t[const[TCA_SKBEDIT_PTYPE, // int16], flags[packet_types, // int16]] { // nla_len: offsetof = 0x6 (2 // bytes) nla_type: const = // 0x7 (2 bytes) payload: // packet_types = 0x0 (2 // bytes) size: buffer: {} // (length 0x0) pad = 0x0 (2 // bytes) // } // } // union skbedit_policy { // TCA_SKBEDIT_MARK: // nlattr_t[const[TCA_SKBEDIT_MARK, // int16], int32] { // nla_len: offsetof = 0x8 (2 // bytes) nla_type: const = // 0x5 (2 bytes) payload: // int32 = 0x10 (4 bytes) // size: buffer: {} (length // 0x0) // } // } // union skbedit_policy { // TCA_SKBEDIT_QUEUE_MAPPING: // nlattr_t[const[TCA_SKBEDIT_QUEUE_MAPPING, // int16], int16] { // nla_len: offsetof = 0x6 (2 // bytes) nla_type: const = // 0x4 (2 bytes) payload: // int16 = 0x7 (2 bytes) // size: buffer: {} (length // 0x0) pad = 0x0 (2 bytes) // } // } // union skbedit_policy { // TCA_SKBEDIT_MARK: // nlattr_t[const[TCA_SKBEDIT_MARK, // int16], int32] { // nla_len: offsetof = 0x8 (2 // bytes) nla_type: const = // 0x5 (2 bytes) payload: // int32 = 0x2c2 (4 bytes) // size: buffer: {} (length // 0x0) // } // } // union skbedit_policy { // TCA_SKBEDIT_PARMS: // nlattr_t[const[TCA_SKBEDIT_PARMS, // int16], tc_gen] { // nla_len: offsetof = 0x18 // (2 bytes) nla_type: const // = 0x2 (2 bytes) payload: // tc_gen { // index: int32 = 0xff (4 // bytes) capab: int32 = // 0x5 (4 bytes) action: // tc_actions = // 0xffffffffffffffff (4 // bytes) refcnt: int32 = // 0x8 (4 bytes) bindcnt: // int32 = 0x3 (4 bytes) // } // size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // TCA_ACT_COOKIE: // nlattr_t[const[TCA_ACT_COOKIE, // int16], array[int8]] { // nla_len: offsetof = 0x4 (2 // bytes) nla_type: const = 0x6 (2 // bytes) payload: buffer: {} // (length 0x0) size: buffer: {} // (length 0x0) // } // TCA_ACT_FLAGS: // nlattr_t[const[TCA_ACT_FLAGS, // int16], // nla_bitfield32[tcf_action_policy_flags]] // { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = 0x7 (2 // bytes) payload: // nla_bitfield32[tcf_action_policy_flags] // { // value: tcf_action_policy_flags // = 0x1 (4 bytes) selector: // tcf_action_policy_flags = 0x0 // (4 bytes) // } // size: buffer: {} (length 0x0) // } // TCA_ACT_HW_STATS: // nlattr_t[const[TCA_ACT_HW_STATS, // int16], // nla_bitfield32[tcf_action_policy_hw_stats]] // { // nla_len: offsetof = 0xc (2 // bytes) nla_type: const = 0x8 (2 // bytes) payload: // nla_bitfield32[tcf_action_policy_hw_stats] // { // value: // tcf_action_policy_hw_stats = // 0x2 (4 bytes) selector: // tcf_action_policy_hw_stats = // 0x0 (4 bytes) // } // size: buffer: {} (length 0x0) // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // union bpf_policy { // TCA_BPF_FLAGS_GEN: // nlattr_t[const[TCA_BPF_FLAGS_GEN, int16], // int32[0:8]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x9 (2 bytes) // payload: int32 = 0x6 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union bpf_policy { // TCA_BPF_ACT: nlattr_t[const[TCA_BPF_ACT, // int16], array[tca_actions]] { // nla_len: offsetof = 0x4 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: array[tca_actions] { // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // } // union filter_policy { // TCA_CHAIN: nlattr_t[const[TCA_CHAIN, int16], int32] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0xb (2 bytes) // payload: int32 = 0x2 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union filter_policy { // TCA_CHAIN: nlattr_t[const[TCA_CHAIN, int16], int32] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0xb (2 bytes) // payload: int32 = 0x6 (4 bytes) // size: buffer: {} (length 0x0) // } // } // } // } // } // } // len: len = 0x214 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x8001 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x1 (8 bytes) // ] NONFAILING(*(uint64_t*)0x20004ac0 = 0); NONFAILING(*(uint32_t*)0x20004ac8 = 0); NONFAILING(*(uint64_t*)0x20004ad0 = 0x20004a80); NONFAILING(*(uint64_t*)0x20004a80 = 0x20001e00); NONFAILING(*(uint32_t*)0x20001e00 = 0x214); NONFAILING(*(uint16_t*)0x20001e04 = 0x65); NONFAILING(*(uint16_t*)0x20001e06 = 0x100); NONFAILING(*(uint32_t*)0x20001e08 = 0x70bd29); NONFAILING(*(uint32_t*)0x20001e0c = 0x25dfdbff); NONFAILING(*(uint8_t*)0x20001e10 = 0); NONFAILING(*(uint8_t*)0x20001e11 = 0); NONFAILING(*(uint16_t*)0x20001e12 = 0); NONFAILING(*(uint32_t*)0x20001e14 = 0); NONFAILING(*(uint16_t*)0x20001e18 = 0xd); NONFAILING(*(uint16_t*)0x20001e1a = 1); NONFAILING(*(uint16_t*)0x20001e1c = 0xe); NONFAILING(*(uint16_t*)0x20001e1e = 0xd); NONFAILING(*(uint16_t*)0x20001e20 = 5); NONFAILING(*(uint16_t*)0x20001e22 = 0); NONFAILING(*(uint16_t*)0x20001e24 = 8); NONFAILING(*(uint16_t*)0x20001e26 = 0xb); NONFAILING(*(uint32_t*)0x20001e28 = 8); NONFAILING(*(uint16_t*)0x20001e2c = 6); NONFAILING(*(uint16_t*)0x20001e2e = 5); NONFAILING(*(uint8_t*)0x20001e30 = 6); NONFAILING(*(uint8_t*)0x20001e31 = 0xbe); NONFAILING(*(uint16_t*)0x20001e34 = 8); NONFAILING(*(uint16_t*)0x20001e36 = 1); NONFAILING(memcpy((void*)0x20001e38, "bpf\000", 4)); NONFAILING(*(uint16_t*)0x20001e3c = 0x1c8); NONFAILING(*(uint16_t*)0x20001e3e = 2); NONFAILING(*(uint16_t*)0x20001e40 = 6); NONFAILING(*(uint16_t*)0x20001e42 = 4); NONFAILING(*(uint16_t*)0x20001e44 = 0); NONFAILING(*(uint16_t*)0x20001e48 = 4); NONFAILING(*(uint16_t*)0x20001e4a = 5); NONFAILING(*(uint16_t*)0x20001e4c = 0x1ac); NONFAILING(*(uint16_t*)0x20001e4e = 1); NONFAILING(*(uint16_t*)0x20001e50 = 0x108); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001e52, 4, 0, 14)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001e53, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001e53, 0, 7, 1)); NONFAILING(*(uint16_t*)0x20001e54 = 9); NONFAILING(*(uint16_t*)0x20001e56 = 1); NONFAILING(memcpy((void*)0x20001e58, "gact\000", 5)); NONFAILING(*(uint16_t*)0x20001e60 = 0x70); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001e62, 2, 0, 14)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001e63, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001e63, 1, 7, 1)); NONFAILING(*(uint16_t*)0x20001e64 = 0x18); NONFAILING(*(uint16_t*)0x20001e66 = 2); NONFAILING(*(uint32_t*)0x20001e68 = 6); NONFAILING(*(uint32_t*)0x20001e6c = 8); NONFAILING(*(uint32_t*)0x20001e70 = 4); NONFAILING(*(uint32_t*)0x20001e74 = 5); NONFAILING(*(uint32_t*)0x20001e78 = 6); NONFAILING(*(uint16_t*)0x20001e7c = 0xc); NONFAILING(*(uint16_t*)0x20001e7e = 3); NONFAILING(*(uint16_t*)0x20001e80 = 0); NONFAILING(*(uint16_t*)0x20001e82 = 0x1fd1); NONFAILING(*(uint32_t*)0x20001e84 = 6); NONFAILING(*(uint16_t*)0x20001e88 = 0xc); NONFAILING(*(uint16_t*)0x20001e8a = 3); NONFAILING(*(uint16_t*)0x20001e8c = 2); NONFAILING(*(uint16_t*)0x20001e8e = 0x1572); NONFAILING(*(uint32_t*)0x20001e90 = 6); NONFAILING(*(uint16_t*)0x20001e94 = 0x18); NONFAILING(*(uint16_t*)0x20001e96 = 2); NONFAILING(*(uint32_t*)0x20001e98 = 1); NONFAILING(*(uint32_t*)0x20001e9c = 0x140); NONFAILING(*(uint32_t*)0x20001ea0 = 0); NONFAILING(*(uint32_t*)0x20001ea4 = 9); NONFAILING(*(uint32_t*)0x20001ea8 = 0xf4c); NONFAILING(*(uint16_t*)0x20001eac = 0xc); NONFAILING(*(uint16_t*)0x20001eae = 3); NONFAILING(*(uint16_t*)0x20001eb0 = 2); NONFAILING(*(uint16_t*)0x20001eb2 = 0x2383); NONFAILING(*(uint32_t*)0x20001eb4 = 3); NONFAILING(*(uint16_t*)0x20001eb8 = 0xc); NONFAILING(*(uint16_t*)0x20001eba = 3); NONFAILING(*(uint16_t*)0x20001ebc = 0); NONFAILING(*(uint16_t*)0x20001ebe = 0x1a23); NONFAILING(*(uint32_t*)0x20001ec0 = 3); NONFAILING(*(uint16_t*)0x20001ec4 = 0xc); NONFAILING(*(uint16_t*)0x20001ec6 = 3); NONFAILING(*(uint16_t*)0x20001ec8 = 0); NONFAILING(*(uint16_t*)0x20001eca = 0x535); NONFAILING(*(uint32_t*)0x20001ecc = 0x20000006); NONFAILING(*(uint16_t*)0x20001ed0 = 0x6d); NONFAILING(*(uint16_t*)0x20001ed2 = 6); NONFAILING(memcpy( (void*)0x20001ed4, "\x96\xc1\x38\x9a\xe5\x87\x63\xf2\x7f\xa4\x76\x63\xcd\xfb\x86\x98\xc4\x55" "\x9f\x4c\x87\x7e\x82\x0a\x0c\xc3\xbd\x0e\x4c\x01\xdc\x38\x6f\x0f\x6e\x58" "\x38\x20\xb0\x93\x8e\xe5\x82\xa8\x85\xd5\x72\xbe\x35\x9a\xac\xdb\x1b\xaa" "\xe0\x7a\x17\xd7\xe8\xff\x95\xe0\x32\xc4\x5d\x09\xd5\x18\x58\x11\x12\xb5" "\x06\x5f\x9c\x05\xd1\x37\x44\xcc\xb7\x3a\xa5\xd9\x04\x53\xd5\x70\xa4\x47" "\xea\x0c\x0d\x3b\xf4\x7a\x02\x61\x72\x4d\x4c\x83\x39\x63\x3c", 105)); NONFAILING(*(uint16_t*)0x20001f40 = 0xc); NONFAILING(*(uint16_t*)0x20001f42 = 7); NONFAILING(*(uint32_t*)0x20001f44 = 1); NONFAILING(*(uint32_t*)0x20001f48 = 1); NONFAILING(*(uint16_t*)0x20001f4c = 0xc); NONFAILING(*(uint16_t*)0x20001f4e = 8); NONFAILING(*(uint32_t*)0x20001f50 = 1); NONFAILING(*(uint32_t*)0x20001f54 = 2); NONFAILING(*(uint16_t*)0x20001f58 = 0xa0); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001f5a, 0x18, 0, 14)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001f5b, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001f5b, 0, 7, 1)); NONFAILING(*(uint16_t*)0x20001f5c = 0xc); NONFAILING(*(uint16_t*)0x20001f5e = 1); NONFAILING(memcpy((void*)0x20001f60, "skbedit\000", 8)); NONFAILING(*(uint16_t*)0x20001f68 = 0x74); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001f6a, 2, 0, 14)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001f6b, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20001f6b, 1, 7, 1)); NONFAILING(*(uint16_t*)0x20001f6c = 0x18); NONFAILING(*(uint16_t*)0x20001f6e = 2); NONFAILING(*(uint32_t*)0x20001f70 = 2); NONFAILING(*(uint32_t*)0x20001f74 = 7); NONFAILING(*(uint32_t*)0x20001f78 = -1); NONFAILING(*(uint32_t*)0x20001f7c = 0x401); NONFAILING(*(uint32_t*)0x20001f80 = 0xfffffffe); NONFAILING(*(uint16_t*)0x20001f84 = 8); NONFAILING(*(uint16_t*)0x20001f86 = 3); NONFAILING(*(uint16_t*)0x20001f88 = 0xc); NONFAILING(*(uint16_t*)0x20001f8a = 8); NONFAILING(*(uint16_t*)0x20001f8c = 0x18); NONFAILING(*(uint16_t*)0x20001f8e = 2); NONFAILING(*(uint32_t*)0x20001f90 = 8); NONFAILING(*(uint32_t*)0x20001f94 = 4); NONFAILING(*(uint32_t*)0x20001f98 = 1); NONFAILING(*(uint32_t*)0x20001f9c = 2); NONFAILING(*(uint32_t*)0x20001fa0 = 6); NONFAILING(*(uint16_t*)0x20001fa4 = 6); NONFAILING(*(uint16_t*)0x20001fa6 = 7); NONFAILING(*(uint16_t*)0x20001fa8 = 0); NONFAILING(*(uint16_t*)0x20001fac = 8); NONFAILING(*(uint16_t*)0x20001fae = 5); NONFAILING(*(uint32_t*)0x20001fb0 = 0x10); NONFAILING(*(uint16_t*)0x20001fb4 = 6); NONFAILING(*(uint16_t*)0x20001fb6 = 4); NONFAILING(*(uint16_t*)0x20001fb8 = 7); NONFAILING(*(uint16_t*)0x20001fbc = 8); NONFAILING(*(uint16_t*)0x20001fbe = 5); NONFAILING(*(uint32_t*)0x20001fc0 = 0x2c2); NONFAILING(*(uint16_t*)0x20001fc4 = 0x18); NONFAILING(*(uint16_t*)0x20001fc6 = 2); NONFAILING(*(uint32_t*)0x20001fc8 = 0xff); NONFAILING(*(uint32_t*)0x20001fcc = 5); NONFAILING(*(uint32_t*)0x20001fd0 = -1); NONFAILING(*(uint32_t*)0x20001fd4 = 8); NONFAILING(*(uint32_t*)0x20001fd8 = 3); NONFAILING(*(uint16_t*)0x20001fdc = 4); NONFAILING(*(uint16_t*)0x20001fde = 6); NONFAILING(*(uint16_t*)0x20001fe0 = 0xc); NONFAILING(*(uint16_t*)0x20001fe2 = 7); NONFAILING(*(uint32_t*)0x20001fe4 = 1); NONFAILING(*(uint32_t*)0x20001fe8 = 0); NONFAILING(*(uint16_t*)0x20001fec = 0xc); NONFAILING(*(uint16_t*)0x20001fee = 8); NONFAILING(*(uint32_t*)0x20001ff0 = 2); NONFAILING(*(uint32_t*)0x20001ff4 = 0); NONFAILING(*(uint16_t*)0x20001ff8 = 8); NONFAILING(*(uint16_t*)0x20001ffa = 9); NONFAILING(*(uint32_t*)0x20001ffc = 6); NONFAILING(*(uint16_t*)0x20002000 = 4); NONFAILING(*(uint16_t*)0x20002002 = 1); NONFAILING(*(uint16_t*)0x20002004 = 8); NONFAILING(*(uint16_t*)0x20002006 = 0xb); NONFAILING(*(uint32_t*)0x20002008 = 2); NONFAILING(*(uint16_t*)0x2000200c = 8); NONFAILING(*(uint16_t*)0x2000200e = 0xb); NONFAILING(*(uint32_t*)0x20002010 = 6); NONFAILING(*(uint64_t*)0x20004a88 = 0x214); NONFAILING(*(uint64_t*)0x20004ad8 = 1); NONFAILING(*(uint64_t*)0x20004ae0 = 0); NONFAILING(*(uint64_t*)0x20004ae8 = 0); NONFAILING(*(uint32_t*)0x20004af0 = 0x8001); syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x20004ac0ul, /*f=MSG_OOB*/ 1ul); // socket$inet6_tcp arguments: [ // domain: const = 0xa (8 bytes) // type: const = 0x1 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_tcp6 syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0); // sendto$inet6 arguments: [ // fd: sock_in6 (resource) // buf: nil // len: len = 0x0 (8 bytes) // f: send_flags = 0x24040014 (8 bytes) // addr: nil // addrlen: len = 0x0 (8 bytes) // ] syscall(__NR_sendto, /*fd=*/(intptr_t)-1, /*buf=*/0ul, /*len=*/0ul, /*f=MSG_ZEROCOPY|MSG_FASTOPEN|MSG_BATCH|MSG_PROBE|MSG_DONTROUTE*/ 0x24040014ul, /*addr=*/0ul, /*addrlen=*/0ul); return 0; }