// https://syzkaller.appspot.com/bug?id=7a78cd89e4233c25bdd2616116d1b2a5d2e24f5f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // openat$tun arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2f 64 65 76 2f 6e 65 74 2f 74 75 6e 00} (length 0xd) // } // flags: open_flags = 0x1c1341 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_tun memcpy((void*)0x200000000040, "/dev/net/tun\000", 13); res = syscall( __NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000040ul, /*flags=O_TRUNC|O_SYNC|O_NOCTTY|O_NOATIME|O_CREAT|O_CLOEXEC|0x1*/ 0x1c1341, /*mode=*/0); if (res != -1) r[0] = res; // ioctl$TUNSETIFF arguments: [ // fd: fd_tun (resource) // cmd: const = 0x400454ca (4 bytes) // arg: ptr[in, ifreq_dev_t[devnames, flags[tun_setiff_flags, int16]]] { // ifreq_dev_t[devnames, flags[tun_setiff_flags, int16]] { // ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 30 00 00 00 00 00 00} // (length 0x10) elem: tun_setiff_flags = 0x84aebfbd634936f2 (2 bytes) // pad = 0x0 (22 bytes) // } // } // ] memcpy((void*)0x2000000000c0, "syzkaller0\000\000\000\000\000\000", 16); *(uint16_t*)0x2000000000d0 = 0x36f2; syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x400454ca, /*arg=*/0x2000000000c0ul); // openat$tun arguments: [ // fd: const = 0xffffffffffffff9c (8 bytes) // file: ptr[in, buffer] { // buffer: {2f 64 65 76 2f 6e 65 74 2f 74 75 6e 00} (length 0xd) // } // flags: open_flags = 0x1a3081 (4 bytes) // mode: const = 0x0 (2 bytes) // ] // returns fd_tun memcpy((void*)0x2000000003c0, "/dev/net/tun\000", 13); res = syscall( __NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x2000000003c0ul, /*flags=O_SYNC|O_NOFOLLOW|O_EXCL|O_CLOEXEC|FASYNC|0x1*/ 0x1a3081, /*mode=*/0); if (res != -1) r[1] = res; // close arguments: [ // fd: fd (resource) // ] syscall(__NR_close, /*fd=*/r[1]); // socket$nl_route arguments: [ // domain: const = 0x10 (8 bytes) // type: const = 0x3 (8 bytes) // proto: const = 0x0 (4 bytes) // ] // returns sock_nl_route res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0); if (res != -1) r[2] = res; // ioctl$sock_SIOCGIFINDEX arguments: [ // fd: sock (resource) // cmd: const = 0x8933 (4 bytes) // arg: ptr[out, ifreq_dev_t[devnames, ifindex]] { // ifreq_dev_t[devnames, ifindex] { // ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 30 00 00 00 00 00 00} // (length 0x10) elem: ifindex (resource) pad = 0x0 (20 bytes) // } // } // ] memcpy((void*)0x2000000001c0, "syzkaller0\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0x8933, /*arg=*/0x2000000001c0ul); if (res != -1) r[3] = *(uint32_t*)0x2000000001d0; // sendmsg$nl_route_sched arguments: [ // fd: sock_nl_route (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] { // msghdr_netlink[netlink_msg_route_sched] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_route_sched]] { // iovec[in, netlink_msg_route_sched] { // addr: ptr[in, netlink_msg_route_sched] { // union netlink_msg_route_sched { // newqdisc: netlink_msg_t[const[RTM_NEWQDISC, int16], // tcmsg[AF_UNSPEC], rtm_tca_policy] { // len: len = 0x30 (4 bytes) // type: const = 0x24 (2 bytes) // flags: netlink_msg_flags = 0x401 (2 bytes) // seq: int32 = 0x2000 (4 bytes) // pid: int32 = 0x0 (4 bytes) // payload: tcmsg[AF_UNSPEC] { // family: const = 0x0 (1 bytes) // tcm__pad1: const = 0x0 (1 bytes) // tcm__pad2: const = 0x0 (2 bytes) // ifindex: ifindex (resource) // tcm_handle: tcm_handle { // minor: tcm_handle_offsets = 0x0 (2 bytes) // major: tcm_handle_offsets = 0xffff (2 bytes) // } // tcm_parent: tcm_handle { // minor: tcm_handle_offsets = 0xfff1 (2 bytes) // major: tcm_handle_offsets = 0xffff (2 bytes) // } // tcm_info: tcm_handle { // minor: tcm_handle_offsets = 0x0 (2 bytes) // major: tcm_handle_offsets = 0x0 (2 bytes) // } // } // attrs: array[rtm_tca_policy] { // union rtm_tca_policy { // qdisc_kind_options: union qdisc_kind_options { // q_ingress: nlattr_t[const[TCA_KIND, int16], // string["ingress"]] { // nla_len: offsetof = 0xc (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {69 6e 67 72 65 73 73 00} (length // 0x8) size: buffer: {} (length 0x0) // } // } // } // } // } // } // } // len: len = 0x30 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000340 = 0; *(uint32_t*)0x200000000348 = 0; *(uint64_t*)0x200000000350 = 0x200000000380; *(uint64_t*)0x200000000380 = 0x200000000400; *(uint32_t*)0x200000000400 = 0x30; *(uint16_t*)0x200000000404 = 0x24; *(uint16_t*)0x200000000406 = 0x401; *(uint32_t*)0x200000000408 = 0x2000; *(uint32_t*)0x20000000040c = 0; *(uint8_t*)0x200000000410 = 0; *(uint8_t*)0x200000000411 = 0; *(uint16_t*)0x200000000412 = 0; *(uint32_t*)0x200000000414 = r[3]; *(uint16_t*)0x200000000418 = 0; *(uint16_t*)0x20000000041a = -1; *(uint16_t*)0x20000000041c = 0xfff1; *(uint16_t*)0x20000000041e = -1; *(uint16_t*)0x200000000420 = 0; *(uint16_t*)0x200000000422 = 0; *(uint16_t*)0x200000000424 = 0xc; *(uint16_t*)0x200000000426 = 1; memcpy((void*)0x200000000428, "ingress\000", 8); *(uint64_t*)0x200000000388 = 0x30; *(uint64_t*)0x200000000358 = 1; *(uint64_t*)0x200000000360 = 0; *(uint64_t*)0x200000000368 = 0; *(uint32_t*)0x200000000370 = 0; syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x200000000340ul, /*f=*/0ul); // sendmsg$nl_route_sched arguments: [ // fd: sock_nl_route (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] { // msghdr_netlink[netlink_msg_route_sched] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_route_sched]] { // iovec[in, netlink_msg_route_sched] { // addr: ptr[in, netlink_msg_route_sched] { // union netlink_msg_route_sched { // newtfilter: netlink_msg_t[const[RTM_NEWTFILTER, int16], // tcmsg[AF_UNSPEC], filter_policy] { // len: len = 0x64 (4 bytes) // type: const = 0x2c (2 bytes) // flags: netlink_msg_flags = 0x401 (2 bytes) // seq: int32 = 0x0 (4 bytes) // pid: int32 = 0x0 (4 bytes) // payload: tcmsg[AF_UNSPEC] { // family: const = 0x0 (1 bytes) // tcm__pad1: const = 0x0 (1 bytes) // tcm__pad2: const = 0x0 (2 bytes) // ifindex: ifindex (resource) // tcm_handle: tcm_handle { // minor: tcm_handle_offsets = 0x1 (2 bytes) // major: tcm_handle_offsets = 0x9 (2 bytes) // } // tcm_parent: tcm_handle { // minor: tcm_handle_offsets = 0xffff (2 bytes) // major: tcm_handle_offsets = 0xffff (2 bytes) // } // tcm_info: tcm_handle { // minor: tcm_handle_offsets = 0x300 (2 bytes) // major: tcm_handle_offsets = 0x1 (2 bytes) // } // } // attrs: array[filter_policy] { // union filter_policy { // filter_kind_options: union filter_kind_options { // f_basic: tca_kind_options_t["basic", // array[basic_policy]] { // TCA_KIND: nlattr_t[const[TCA_KIND, int16], // string["basic"]] { // nla_len: offsetof = 0xa (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {62 61 73 69 63 00} (length // 0x6) size: buffer: {} (length 0x0) pad = 0x0 (2 // bytes) // } // TCA_OPTIONS: nlattr_t[const[TCA_OPTIONS, int16], // array[basic_policy]] { // nla_len: offsetof = 0x34 (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: array[basic_policy] { // union basic_policy { // TCA_BASIC_EMATCHES: // nlattr_tt[const[TCA_BASIC_EMATCHES, // int16:14], 0, 1, array[em_policy]] { // nla_len: offsetof = 0x30 (2 bytes) // nla_type: const = 0x2 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[em_policy] { // union em_policy { // TCA_EMATCH_TREE_HDR: // nlattr_t[const[TCA_EMATCH_TREE_HDR, // int16], tcf_ematch_tree_hdr] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: tcf_ematch_tree_hdr { // nmatches: int16 = 0x1 (2 bytes) // progid: const = 0x0 (2 bytes) // } // size: buffer: {} (length 0x0) // } // } // union em_policy { // TCA_EMATCH_TREE_LIST: // nlattr_tt[const[TCA_EMATCH_TREE_LIST, // int16:14], 0, 1, // array[tca_ematch_tree_list]] { // nla_len: offsetof = 0x24 (2 bytes) // nla_type: const = 0x2 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 // bytes) NLA_F_NESTED: const = 0x1 (1 // bytes) payload: // array[tca_ematch_tree_list] { // union tca_ematch_tree_list { // TCF_EM_META: // nlattr_tt[int16:14[1:3], 0, 0, // tcf_ematch_hdr_t[TCF_EM_META, // array[meta_policy]]] { // nla_len: offsetof = 0x20 (2 // bytes) nla_type: int16 = 0x1 // (1 bytes) NLA_F_NET_BYTEORDER: // const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 // bytes) payload: // tcf_ematch_hdr_t[TCF_EM_META, // array[meta_policy]] { // header: // tcf_ematch_hdr[TCF_EM_META] // { // matchid: int16 = 0x0 (2 // bytes) kind: const = 0x4 // (2 bytes) flags: int16 = // 0x0 (2 bytes) pad: const = // 0x0 (2 bytes) // } // payload: array[meta_policy] // { // union meta_policy { // TCA_EM_META_HDR: // nlattr_t[const[TCA_EM_META_HDR, // int16], tcf_meta_hdr] { // nla_len: offsetof = // 0xc (2 bytes) // nla_type: const = 0x1 // (2 bytes) payload: // tcf_meta_hdr { // left: tcf_meta_val { // kind: int16 = // 0x1002 (2 bytes) // shift: int8 = 0xfc // (1 bytes) op: // tcf_em_opnds = 0x0 // (1 bytes) // } // right: tcf_meta_val // { // kind: int16 = // 0x1004 (2 bytes) // shift: int8 = 0x0 // (1 bytes) op: // tcf_em_opnds = 0x0 // (1 bytes) // } // } // size: buffer: {} // (length 0x0) // } // } // union meta_policy { // TCA_EM_META_RVALUE: // nlattr_t[const[TCA_EM_META_RVALUE, // int16], // array[tcf_em_meta_int_var]] // { // nla_len: offsetof = // 0x8 (2 bytes) // nla_type: const = 0x3 // (2 bytes) payload: // array[tcf_em_meta_int_var] // { // union // tcf_em_meta_int_var // { // TCF_META_TYPE_INT: // int32 = 0x4 (4 // bytes) // } // } // size: buffer: {} // (length 0x0) // } // } // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // } // } // } // } // } // len: len = 0x64 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000440 = 0; *(uint32_t*)0x200000000448 = 0; *(uint64_t*)0x200000000450 = 0x200000000480; *(uint64_t*)0x200000000480 = 0x200000000540; *(uint32_t*)0x200000000540 = 0x64; *(uint16_t*)0x200000000544 = 0x2c; *(uint16_t*)0x200000000546 = 0x401; *(uint32_t*)0x200000000548 = 0; *(uint32_t*)0x20000000054c = 0; *(uint8_t*)0x200000000550 = 0; *(uint8_t*)0x200000000551 = 0; *(uint16_t*)0x200000000552 = 0; *(uint32_t*)0x200000000554 = r[3]; *(uint16_t*)0x200000000558 = 1; *(uint16_t*)0x20000000055a = 9; *(uint16_t*)0x20000000055c = -1; *(uint16_t*)0x20000000055e = -1; *(uint16_t*)0x200000000560 = 0x300; *(uint16_t*)0x200000000562 = 1; *(uint16_t*)0x200000000564 = 0xa; *(uint16_t*)0x200000000566 = 1; memcpy((void*)0x200000000568, "basic\000", 6); *(uint16_t*)0x200000000570 = 0x34; *(uint16_t*)0x200000000572 = 2; *(uint16_t*)0x200000000574 = 0x30; STORE_BY_BITMASK(uint16_t, , 0x200000000576, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000577, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000577, 1, 7, 1); *(uint16_t*)0x200000000578 = 8; *(uint16_t*)0x20000000057a = 1; *(uint16_t*)0x20000000057c = 1; *(uint16_t*)0x20000000057e = 0; *(uint16_t*)0x200000000580 = 0x24; STORE_BY_BITMASK(uint16_t, , 0x200000000582, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000583, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000583, 1, 7, 1); *(uint16_t*)0x200000000584 = 0x20; STORE_BY_BITMASK(uint16_t, , 0x200000000586, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000587, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000587, 0, 7, 1); *(uint16_t*)0x200000000588 = 0; *(uint16_t*)0x20000000058a = 4; *(uint16_t*)0x20000000058c = 0; *(uint16_t*)0x20000000058e = 0; *(uint16_t*)0x200000000590 = 0xc; *(uint16_t*)0x200000000592 = 1; *(uint16_t*)0x200000000594 = 0x1002; *(uint8_t*)0x200000000596 = 0xfc; *(uint8_t*)0x200000000597 = 0; *(uint16_t*)0x200000000598 = 0x1004; *(uint8_t*)0x20000000059a = 0; *(uint8_t*)0x20000000059b = 0; *(uint16_t*)0x20000000059c = 8; *(uint16_t*)0x20000000059e = 3; *(uint32_t*)0x2000000005a0 = 4; *(uint64_t*)0x200000000488 = 0x64; *(uint64_t*)0x200000000458 = 1; *(uint64_t*)0x200000000460 = 0; *(uint64_t*)0x200000000468 = 0; *(uint32_t*)0x200000000470 = 0; syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x200000000440ul, /*f=*/0ul); // ioctl$SIOCSIFHWADDR arguments: [ // fd: fd_tun (resource) // cmd: const = 0x8914 (4 bytes) // arg: ptr[in, ifreq_dev_t[devnames, mac_addr]] { // ifreq_dev_t[devnames, mac_addr] { // ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 30 00 00 00 00 00 00} // (length 0x10) elem: union mac_addr { // multicast: buffer: {bb bb bb bb bb bb} (length 0x6) // } // pad = 0x0 (18 bytes) // } // } // ] memcpy((void*)0x200000000500, "syzkaller0\000\000\000\000\000\000", 16); memset((void*)0x200000000510, 187, 6); syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x8914, /*arg=*/0x200000000500ul); // write$cgroup_subtree arguments: [ // fd: fd_cgroup_subtree (resource) // buf: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // } // } // len: bytesize = 0x66 (8 bytes) // ] syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000000ul, /*len=*/0x66ul); return 0; }