// https://syzkaller.appspot.com/bug?id=30f2bfc80fcbf62ef1dd020c7813a30eed81a676 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } memcpy((void*)0x200000000a80, "raw\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000", 32); *(uint32_t*)0x200000000aa0 = 8; *(uint32_t*)0x200000000aa4 = 3; *(uint32_t*)0x200000000aa8 = 0x4c0; *(uint32_t*)0x200000000aac = 0; *(uint32_t*)0x200000000ab0 = 0x11; *(uint32_t*)0x200000000ab4 = 0x148; *(uint32_t*)0x200000000ab8 = 0x340; *(uint32_t*)0x200000000abc = 0; *(uint32_t*)0x200000000ac0 = 0x428; *(uint32_t*)0x200000000ac4 = 0x2a8; *(uint32_t*)0x200000000ac8 = 0x2a8; *(uint32_t*)0x200000000acc = 0x428; *(uint32_t*)0x200000000ad0 = 0x2a8; *(uint32_t*)0x200000000ad4 = 3; *(uint64_t*)0x200000000ad8 = 0; memset((void*)0x200000000ae0, 0, 84); *(uint32_t*)0x200000000b34 = 0; *(uint16_t*)0x200000000b38 = 0x2f8; *(uint16_t*)0x200000000b3a = 0x340; *(uint32_t*)0x200000000b3c = 0; *(uint64_t*)0x200000000b40 = 0; *(uint64_t*)0x200000000b48 = 0; *(uint16_t*)0x200000000b50 = 0x58; memcpy((void*)0x200000000b52, "hashlimit\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000", 29); *(uint8_t*)0x200000000b6f = 1; memcpy((void*)0x200000000b70, "ip_vti0\000\000\000\000\000\000\000\000\000", 16); *(uint32_t*)0x200000000b80 = 0; *(uint32_t*)0x200000000b84 = 0; *(uint32_t*)0x200000000b88 = 0x3f; *(uint32_t*)0x200000000b8c = 0; *(uint32_t*)0x200000000b90 = 0x20000000; *(uint32_t*)0x200000000b94 = 3; *(uint32_t*)0x200000000b98 = 7; *(uint8_t*)0x200000000b9c = 0; *(uint8_t*)0x200000000b9d = 0; *(uint64_t*)0x200000000ba0 = 0; *(uint16_t*)0x200000000ba8 = 0x230; memcpy((void*)0x200000000baa, "bpf\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200000000bc7 = 1; *(uint16_t*)0x200000000bc8 = 0; *(uint16_t*)0x200000000bca = 0x26; *(uint32_t*)0x200000000bcc = 0; *(uint16_t*)0x200000000bd0 = 3; *(uint8_t*)0x200000000bd2 = -1; *(uint8_t*)0x200000000bd3 = 1; *(uint32_t*)0x200000000bd4 = 0xfff; *(uint16_t*)0x200000000bd8 = 6; *(uint8_t*)0x200000000bda = 0x8c; *(uint8_t*)0x200000000bdb = 3; *(uint32_t*)0x200000000bdc = 8; *(uint16_t*)0x200000000be0 = 9; *(uint8_t*)0x200000000be2 = 2; *(uint8_t*)0x200000000be3 = 0xe; *(uint32_t*)0x200000000be4 = 3; *(uint16_t*)0x200000000be8 = 0xfaf; *(uint8_t*)0x200000000bea = 2; *(uint8_t*)0x200000000beb = 1; *(uint32_t*)0x200000000bec = 0xec; *(uint16_t*)0x200000000bf0 = 9; *(uint8_t*)0x200000000bf2 = 9; *(uint8_t*)0x200000000bf3 = 0xe; *(uint32_t*)0x200000000bf4 = 0x7f; *(uint16_t*)0x200000000bf8 = 0xf523; *(uint8_t*)0x200000000bfa = 7; *(uint8_t*)0x200000000bfb = 0xf; *(uint32_t*)0x200000000bfc = 2; *(uint16_t*)0x200000000c00 = 0x7ed; *(uint8_t*)0x200000000c02 = 1; *(uint8_t*)0x200000000c03 = 6; *(uint32_t*)0x200000000c04 = 0x58; *(uint16_t*)0x200000000c08 = 0xbbd5; *(uint8_t*)0x200000000c0a = 0x82; *(uint8_t*)0x200000000c0b = 9; *(uint32_t*)0x200000000c0c = 0x81; *(uint16_t*)0x200000000c10 = 9; *(uint8_t*)0x200000000c12 = 1; *(uint8_t*)0x200000000c13 = 0; *(uint32_t*)0x200000000c14 = 0xff9; *(uint16_t*)0x200000000c18 = 5; *(uint8_t*)0x200000000c1a = 5; *(uint8_t*)0x200000000c1b = 1; *(uint32_t*)0x200000000c1c = 5; *(uint16_t*)0x200000000c20 = 8; *(uint8_t*)0x200000000c22 = 3; *(uint8_t*)0x200000000c23 = 4; *(uint32_t*)0x200000000c24 = 8; *(uint16_t*)0x200000000c28 = 7; *(uint8_t*)0x200000000c2a = 8; *(uint8_t*)0x200000000c2b = 5; *(uint32_t*)0x200000000c2c = 0; *(uint16_t*)0x200000000c30 = 0xc; *(uint8_t*)0x200000000c32 = 0xe7; *(uint8_t*)0x200000000c33 = 0xa; *(uint32_t*)0x200000000c34 = 0x66; *(uint16_t*)0x200000000c38 = 5; *(uint8_t*)0x200000000c3a = 1; *(uint8_t*)0x200000000c3b = 5; *(uint32_t*)0x200000000c3c = 0; *(uint16_t*)0x200000000c40 = 0x623a; *(uint8_t*)0x200000000c42 = 0; *(uint8_t*)0x200000000c43 = 8; *(uint32_t*)0x200000000c44 = 8; *(uint16_t*)0x200000000c48 = 2; *(uint8_t*)0x200000000c4a = 7; *(uint8_t*)0x200000000c4b = 0xa5; *(uint32_t*)0x200000000c4c = 7; *(uint16_t*)0x200000000c50 = 7; *(uint8_t*)0x200000000c52 = 7; *(uint8_t*)0x200000000c53 = 6; *(uint32_t*)0x200000000c54 = 8; *(uint16_t*)0x200000000c58 = 0x81; *(uint8_t*)0x200000000c5a = 4; *(uint8_t*)0x200000000c5b = 1; *(uint32_t*)0x200000000c5c = 0xa; *(uint16_t*)0x200000000c60 = 5; *(uint8_t*)0x200000000c62 = 0xdc; *(uint8_t*)0x200000000c63 = 7; *(uint32_t*)0x200000000c64 = 0; *(uint16_t*)0x200000000c68 = 0; *(uint8_t*)0x200000000c6a = -1; *(uint8_t*)0x200000000c6b = 0xe7; *(uint32_t*)0x200000000c6c = 3; *(uint16_t*)0x200000000c70 = 7; *(uint8_t*)0x200000000c72 = 5; *(uint8_t*)0x200000000c73 = 0x8f; *(uint32_t*)0x200000000c74 = 0xce; *(uint16_t*)0x200000000c78 = 1; *(uint8_t*)0x200000000c7a = 1; *(uint8_t*)0x200000000c7b = 9; *(uint32_t*)0x200000000c7c = 3; *(uint16_t*)0x200000000c80 = 0xfff8; *(uint8_t*)0x200000000c82 = 5; *(uint8_t*)0x200000000c83 = 0x80; *(uint32_t*)0x200000000c84 = 1; *(uint16_t*)0x200000000c88 = 0x4d42; *(uint8_t*)0x200000000c8a = 0x7a; *(uint8_t*)0x200000000c8b = 9; *(uint32_t*)0x200000000c8c = 5; *(uint16_t*)0x200000000c90 = 4; *(uint8_t*)0x200000000c92 = 5; *(uint8_t*)0x200000000c93 = 9; *(uint32_t*)0x200000000c94 = 0x80; *(uint16_t*)0x200000000c98 = 0x9f; *(uint8_t*)0x200000000c9a = 2; *(uint8_t*)0x200000000c9b = 0xde; *(uint32_t*)0x200000000c9c = 8; *(uint16_t*)0x200000000ca0 = 0; *(uint8_t*)0x200000000ca2 = 2; *(uint8_t*)0x200000000ca3 = 0x51; *(uint32_t*)0x200000000ca4 = 4; *(uint16_t*)0x200000000ca8 = 6; *(uint8_t*)0x200000000caa = 5; *(uint8_t*)0x200000000cab = 5; *(uint32_t*)0x200000000cac = 0x20a; *(uint16_t*)0x200000000cb0 = 0x800; *(uint8_t*)0x200000000cb2 = 0x40; *(uint8_t*)0x200000000cb3 = 0x80; *(uint32_t*)0x200000000cb4 = 0x953; *(uint16_t*)0x200000000cb8 = 4; *(uint8_t*)0x200000000cba = 0x2e; *(uint8_t*)0x200000000cbb = 0xb; *(uint32_t*)0x200000000cbc = 0x10; *(uint16_t*)0x200000000cc0 = 0; *(uint8_t*)0x200000000cc2 = 3; *(uint8_t*)0x200000000cc3 = 0x6b; *(uint32_t*)0x200000000cc4 = 0; *(uint16_t*)0x200000000cc8 = 8; *(uint8_t*)0x200000000cca = 4; *(uint8_t*)0x200000000ccb = 5; *(uint32_t*)0x200000000ccc = 6; *(uint16_t*)0x200000000cd0 = 2; *(uint8_t*)0x200000000cd2 = 0xc3; *(uint8_t*)0x200000000cd3 = 7; *(uint32_t*)0x200000000cd4 = 0x1a17; *(uint16_t*)0x200000000cd8 = 0x3bc4; *(uint8_t*)0x200000000cda = 8; *(uint8_t*)0x200000000cdb = 0xf; *(uint32_t*)0x200000000cdc = 2; *(uint16_t*)0x200000000ce0 = 0x7ff; *(uint8_t*)0x200000000ce2 = 0xcb; *(uint8_t*)0x200000000ce3 = 0xc; *(uint32_t*)0x200000000ce4 = 0x1ff; *(uint16_t*)0x200000000ce8 = 7; *(uint8_t*)0x200000000cea = 0x79; *(uint8_t*)0x200000000ceb = 4; *(uint32_t*)0x200000000cec = 1; *(uint16_t*)0x200000000cf0 = 6; *(uint8_t*)0x200000000cf2 = 9; *(uint8_t*)0x200000000cf3 = 0x97; *(uint32_t*)0x200000000cf4 = 0x10000; *(uint16_t*)0x200000000cf8 = 0x3ff; *(uint8_t*)0x200000000cfa = 0xc; *(uint8_t*)0x200000000cfb = -1; *(uint32_t*)0x200000000cfc = 2; *(uint16_t*)0x200000000d00 = 3; *(uint8_t*)0x200000000d02 = 0xf; *(uint8_t*)0x200000000d03 = 0; *(uint32_t*)0x200000000d04 = 3; *(uint16_t*)0x200000000d08 = 2; *(uint8_t*)0x200000000d0a = 0xc0; *(uint8_t*)0x200000000d0b = 4; *(uint32_t*)0x200000000d0c = 0; *(uint16_t*)0x200000000d10 = 6; *(uint8_t*)0x200000000d12 = 0; *(uint8_t*)0x200000000d13 = 6; *(uint32_t*)0x200000000d14 = 0x8001; *(uint16_t*)0x200000000d18 = 6; *(uint8_t*)0x200000000d1a = 6; *(uint8_t*)0x200000000d1b = -1; *(uint32_t*)0x200000000d1c = 8; *(uint16_t*)0x200000000d20 = 0x92; *(uint8_t*)0x200000000d22 = 0xf7; *(uint8_t*)0x200000000d23 = 3; *(uint32_t*)0x200000000d24 = 0x3ff; *(uint16_t*)0x200000000d28 = 2; *(uint8_t*)0x200000000d2a = 0xfd; *(uint8_t*)0x200000000d2b = 0xd; *(uint32_t*)0x200000000d2c = 0xfffffff8; *(uint16_t*)0x200000000d30 = 0xfde1; *(uint8_t*)0x200000000d32 = 6; *(uint8_t*)0x200000000d33 = 0; *(uint32_t*)0x200000000d34 = 8; *(uint16_t*)0x200000000d38 = 5; *(uint8_t*)0x200000000d3a = 1; *(uint8_t*)0x200000000d3b = 6; *(uint32_t*)0x200000000d3c = 9; *(uint16_t*)0x200000000d40 = 0xc0; *(uint8_t*)0x200000000d42 = 5; *(uint8_t*)0x200000000d43 = 3; *(uint32_t*)0x200000000d44 = 0x1000; *(uint16_t*)0x200000000d48 = 0; *(uint8_t*)0x200000000d4a = 6; *(uint8_t*)0x200000000d4b = 2; *(uint32_t*)0x200000000d4c = 1; *(uint16_t*)0x200000000d50 = 0; *(uint8_t*)0x200000000d52 = 8; *(uint8_t*)0x200000000d53 = 0; *(uint32_t*)0x200000000d54 = 6; *(uint16_t*)0x200000000d58 = 1; *(uint8_t*)0x200000000d5a = 7; *(uint8_t*)0x200000000d5b = 9; *(uint32_t*)0x200000000d5c = 3; *(uint16_t*)0x200000000d60 = 0xc000; *(uint8_t*)0x200000000d62 = 0; *(uint8_t*)0x200000000d63 = 8; *(uint32_t*)0x200000000d64 = 1; *(uint16_t*)0x200000000d68 = 9; *(uint8_t*)0x200000000d6a = 7; *(uint8_t*)0x200000000d6b = -1; *(uint32_t*)0x200000000d6c = 0x401; *(uint16_t*)0x200000000d70 = 0xb1aa; *(uint8_t*)0x200000000d72 = 3; *(uint8_t*)0x200000000d73 = 0xd4; *(uint32_t*)0x200000000d74 = 0; *(uint16_t*)0x200000000d78 = 3; *(uint8_t*)0x200000000d7a = 0x87; *(uint8_t*)0x200000000d7b = 0xbf; *(uint32_t*)0x200000000d7c = 0; *(uint16_t*)0x200000000d80 = 0xa; *(uint8_t*)0x200000000d82 = 7; *(uint8_t*)0x200000000d83 = 0xf; *(uint32_t*)0x200000000d84 = 0xfffffffd; *(uint16_t*)0x200000000d88 = 0xf; *(uint8_t*)0x200000000d8a = 4; *(uint8_t*)0x200000000d8b = 1; *(uint32_t*)0x200000000d8c = 0; *(uint16_t*)0x200000000d90 = 9; *(uint8_t*)0x200000000d92 = 0x10; *(uint8_t*)0x200000000d93 = 2; *(uint32_t*)0x200000000d94 = 0xfffffff7; *(uint16_t*)0x200000000d98 = 3; *(uint8_t*)0x200000000d9a = 0x43; *(uint8_t*)0x200000000d9b = 7; *(uint32_t*)0x200000000d9c = 8; *(uint16_t*)0x200000000da0 = 9; *(uint8_t*)0x200000000da2 = 0xe0; *(uint8_t*)0x200000000da3 = 0xad; *(uint32_t*)0x200000000da4 = 0; *(uint16_t*)0x200000000da8 = 8; *(uint8_t*)0x200000000daa = 0x10; *(uint8_t*)0x200000000dab = 0x40; *(uint32_t*)0x200000000dac = 0xffff; *(uint16_t*)0x200000000db0 = 6; *(uint8_t*)0x200000000db2 = 2; *(uint8_t*)0x200000000db3 = 9; *(uint32_t*)0x200000000db4 = 4; *(uint16_t*)0x200000000db8 = 6; *(uint8_t*)0x200000000dba = 7; *(uint8_t*)0x200000000dbb = 0xe; *(uint32_t*)0x200000000dbc = 0xfffffffb; *(uint16_t*)0x200000000dc0 = 0x40; *(uint8_t*)0x200000000dc2 = 7; *(uint8_t*)0x200000000dc3 = 0xe2; *(uint32_t*)0x200000000dc4 = 8; *(uint16_t*)0x200000000dc8 = 0x200; *(uint8_t*)0x200000000dca = 0x7f; *(uint8_t*)0x200000000dcb = 9; *(uint32_t*)0x200000000dcc = 0xedd; *(uint64_t*)0x200000000dd0 = 0xfffffffffffffffb; *(uint16_t*)0x200000000dd8 = 0x48; memcpy((void*)0x200000000dda, "CT\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200000000df7 = 0; *(uint16_t*)0x200000000df8 = 0; *(uint16_t*)0x200000000dfa = 0; *(uint32_t*)0x200000000dfc = 0; *(uint32_t*)0x200000000e00 = 0; memset((void*)0x200000000e04, 0, 16); *(uint64_t*)0x200000000e18 = 0; *(uint32_t*)0x200000000e20 = htobe32(0xe0000002); *(uint32_t*)0x200000000e24 = htobe32(0); *(uint32_t*)0x200000000e28 = htobe32(0); *(uint32_t*)0x200000000e2c = htobe32(0); memcpy((void*)0x200000000e30, "vlan0\000\000\000\000\000\000\000\000\000\000\000", 16); memcpy((void*)0x200000000e40, "netdevsim0\000\000\000\000\000\000", 16); *(uint8_t*)0x200000000e50 = 0; *(uint8_t*)0x200000000e60 = 0; *(uint16_t*)0x200000000e70 = 0x33; *(uint8_t*)0x200000000e72 = 0; *(uint8_t*)0x200000000e73 = 0; *(uint32_t*)0x200000000e74 = 0; *(uint16_t*)0x200000000e78 = 0xc0; *(uint16_t*)0x200000000e7a = 0xe8; *(uint32_t*)0x200000000e7c = 0; *(uint64_t*)0x200000000e80 = 0; *(uint64_t*)0x200000000e88 = 0; *(uint16_t*)0x200000000e90 = 0x28; memcpy((void*)0x200000000e92, "rpfilter\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000", 29); *(uint8_t*)0x200000000eaf = 0; *(uint8_t*)0x200000000eb0 = 0; *(uint16_t*)0x200000000eb8 = 0x28; memcpy((void*)0x200000000eba, "ttl\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200000000ed7 = 0; *(uint8_t*)0x200000000ed8 = 2; *(uint8_t*)0x200000000ed9 = 0xa0; *(uint16_t*)0x200000000ee0 = 0x28; memcpy((void*)0x200000000ee2, "SET\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200000000eff = 1; *(uint16_t*)0x200000000f00 = 3; *(uint8_t*)0x200000000f02 = 4; *(uint8_t*)0x200000000f03 = 2; *(uint16_t*)0x200000000f04 = 3; *(uint8_t*)0x200000000f06 = 3; *(uint8_t*)0x200000000f07 = 4; memset((void*)0x200000000f08, 0, 84); *(uint32_t*)0x200000000f5c = 0; *(uint16_t*)0x200000000f60 = 0x70; *(uint16_t*)0x200000000f62 = 0x98; *(uint32_t*)0x200000000f64 = 0; *(uint64_t*)0x200000000f68 = 0; *(uint64_t*)0x200000000f70 = 0; *(uint16_t*)0x200000000f78 = 0x28; memset((void*)0x200000000f7a, 0, 29); *(uint8_t*)0x200000000f97 = 0; *(uint32_t*)0x200000000f98 = 0xfffffffe; syscall(__NR_setsockopt, /*fd=*/(intptr_t)-1, /*level=*/0, /*opt=*/0x40, /*val=*/0x200000000a80ul, /*len=*/0x520ul); memcpy((void*)0x200000000040, "/dev/comedi2\000", 13); res = syscall(__NR_openat, /*fd=*/0xffffff9cul, /*file=*/0x200000000040ul, /*flags=O_LARGEFILE|FASYNC|O_APPEND*/ 0xa400, /*mode=*/0); if (res != -1) r[0] = res; memcpy((void*)0x200000000140, "aio_iiro_16\000\000\000\000\000\000\000\000\000", 20); *(uint32_t*)0x200000000154 = 0x9e1; *(uint32_t*)0x200000000158 = 0x2166; *(uint32_t*)0x20000000015c = 0; *(uint32_t*)0x200000000160 = 0x100004; *(uint32_t*)0x200000000164 = 0x88d7; *(uint32_t*)0x200000000168 = 3; *(uint32_t*)0x20000000016c = 1; *(uint32_t*)0x200000000170 = 0x10; *(uint32_t*)0x200000000174 = 0x1002; *(uint32_t*)0x200000000178 = -1; *(uint32_t*)0x20000000017c = 3; *(uint32_t*)0x200000000180 = 8; *(uint32_t*)0x200000000184 = 0x344; *(uint32_t*)0x200000000188 = 1; *(uint32_t*)0x20000000018c = 7; *(uint32_t*)0x200000000190 = 1; *(uint32_t*)0x200000000194 = 8; *(uint32_t*)0x200000000198 = 0x5fa3; *(uint32_t*)0x20000000019c = 9; *(uint32_t*)0x2000000001a0 = 0xe; *(uint32_t*)0x2000000001a4 = 0x100; *(uint32_t*)0x2000000001a8 = 3; *(uint32_t*)0x2000000001ac = 7; *(uint32_t*)0x2000000001b0 = 0xa; *(uint32_t*)0x2000000001b4 = 5; *(uint32_t*)0x2000000001b8 = 1; *(uint32_t*)0x2000000001bc = 0xb0c4; *(uint32_t*)0x2000000001c0 = 0x7df; *(uint32_t*)0x2000000001c4 = 8; *(uint32_t*)0x2000000001c8 = 0x400007; *(uint32_t*)0x2000000001cc = 1; *(uint32_t*)0x2000000001d0 = 0; syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40946400, /*arg=*/0x200000000140ul); return 0; }