// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include <endian.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/syscall.h> #include <sys/types.h> #include <unistd.h> #ifndef __NR_memfd_secret #define __NR_memfd_secret 447 #endif #define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {} *(uint32_t*)0x200000c0 = 5; *(uint32_t*)0x200000c4 = 0x80; *(uint8_t*)0x200000c8 = 0x84; *(uint8_t*)0x200000c9 = 3; *(uint8_t*)0x200000ca = 9; *(uint8_t*)0x200000cb = 0xdf; *(uint32_t*)0x200000cc = 0; *(uint64_t*)0x200000d0 = 0x2000; *(uint64_t*)0x200000d8 = 0x110ba; *(uint64_t*)0x200000e0 = 4; STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 0, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 1, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 2, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 3, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 4, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 5, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 6, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 7, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 8, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 9, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 10, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 11, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 12, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 13, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 14, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 2, 15, 2); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 17, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 18, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 19, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 20, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 21, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 22, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 23, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 24, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 25, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 26, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 27, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 28, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 29, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 30, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 31, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 32, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 33, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 34, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 1, 35, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 36, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 37, 1); STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 38, 26); *(uint32_t*)0x200000f0 = 4; *(uint32_t*)0x200000f4 = 4; *(uint64_t*)0x200000f8 = 0x7fffffffefff; *(uint64_t*)0x20000100 = 8; *(uint64_t*)0x20000108 = 0x622; *(uint64_t*)0x20000110 = 8; *(uint32_t*)0x20000118 = 0x20003; *(uint32_t*)0x2000011c = 9; *(uint64_t*)0x20000120 = 7; *(uint32_t*)0x20000128 = 0x80000005; *(uint16_t*)0x2000012c = 6; *(uint16_t*)0x2000012e = 0; *(uint32_t*)0x20000130 = 0; *(uint32_t*)0x20000134 = 0; *(uint64_t*)0x20000138 = 0x8000000000000002; syscall(__NR_perf_event_open, /*attr=*/0x200000c0ul, /*pid=*/0, /*cpu=*/1ul, /*group=*/-1, /*flags=PERF_FLAG_FD_CLOEXEC*/8ul); res = syscall(__NR_socket, /*domain=*/0x25ul, /*type=*/5ul, /*proto=*/5); if (res != -1) r[0] = res; syscall(__NR_close, /*fd=*/r[0]); res = syscall(__NR_memfd_secret, /*flags=O_CLOEXEC*/0x80000ul); if (res != -1) r[1] = res; syscall(__NR_mmap, /*addr=*/0x20001000ul, /*len=*/0x1000ul, /*prot=*/1ul, /*flags=*/0x11ul, /*fd=*/r[1], /*offset=*/0ul); syscall(__NR_ftruncate, /*fd=*/r[0], /*len=*/0xcul); syscall(__NR_mount, /*src=*/0ul, /*dst=*/0ul, /*type=*/0ul, /*flags=MS_RDONLY*/1ul, /*opts=*/0x20000140ul); syscall(__NR_mmap, /*addr=*/0x20ffa000ul, /*len=*/0x3000ul, /*prot=PROT_READ*/1ul, /*flags=MAP_FIXED|MAP_SHARED*/0x11ul, /*fd=*/r[0], /*offset=*/0x5e0a6000ul); return 0; }