| // WARNING: refcount bug in put_pid_ns |
| // https://syzkaller.appspot.com/bug?id=17e202b4794da213570ba33ac2f70277ef1ce015 |
| // status:fixed |
| // autogenerated by syzkaller (http://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| #include <arpa/inet.h> |
| #include <endian.h> |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <linux/capability.h> |
| #include <linux/futex.h> |
| #include <linux/if.h> |
| #include <linux/if_ether.h> |
| #include <linux/if_tun.h> |
| #include <linux/ip.h> |
| #include <linux/tcp.h> |
| #include <net/if_arp.h> |
| #include <pthread.h> |
| #include <sched.h> |
| #include <signal.h> |
| #include <stdarg.h> |
| #include <stdbool.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <sys/ioctl.h> |
| #include <sys/mman.h> |
| #include <sys/mount.h> |
| #include <sys/prctl.h> |
| #include <sys/resource.h> |
| #include <sys/stat.h> |
| #include <sys/syscall.h> |
| #include <sys/time.h> |
| #include <sys/types.h> |
| #include <sys/uio.h> |
| #include <sys/wait.h> |
| #include <unistd.h> |
| |
| __attribute__((noreturn)) static void doexit(int status) |
| { |
| volatile unsigned i; |
| syscall(__NR_exit_group, status); |
| for (i = 0;; i++) { |
| } |
| } |
| #include <errno.h> |
| #include <setjmp.h> |
| #include <signal.h> |
| #include <stdarg.h> |
| #include <stdint.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <sys/stat.h> |
| |
| const int kFailStatus = 67; |
| const int kRetryStatus = 69; |
| |
| static void fail(const char* msg, ...) |
| { |
| int e = errno; |
| va_list args; |
| va_start(args, msg); |
| vfprintf(stderr, msg, args); |
| va_end(args); |
| fprintf(stderr, " (errno %d)\n", e); |
| doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus); |
| } |
| |
| static void exitf(const char* msg, ...) |
| { |
| int e = errno; |
| va_list args; |
| va_start(args, msg); |
| vfprintf(stderr, msg, args); |
| va_end(args); |
| fprintf(stderr, " (errno %d)\n", e); |
| doexit(kRetryStatus); |
| } |
| |
| static __thread int skip_segv; |
| static __thread jmp_buf segv_env; |
| |
| static void segv_handler(int sig, siginfo_t* info, void* uctx) |
| { |
| uintptr_t addr = (uintptr_t)info->si_addr; |
| const uintptr_t prog_start = 1 << 20; |
| const uintptr_t prog_end = 100 << 20; |
| if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && |
| (addr < prog_start || addr > prog_end)) { |
| _longjmp(segv_env, 1); |
| } |
| doexit(sig); |
| } |
| |
| static void install_segv_handler() |
| { |
| struct sigaction sa; |
| |
| memset(&sa, 0, sizeof(sa)); |
| sa.sa_handler = SIG_IGN; |
| syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); |
| syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); |
| |
| memset(&sa, 0, sizeof(sa)); |
| sa.sa_sigaction = segv_handler; |
| sa.sa_flags = SA_NODEFER | SA_SIGINFO; |
| sigaction(SIGSEGV, &sa, NULL); |
| sigaction(SIGBUS, &sa, NULL); |
| } |
| |
| #define NONFAILING(...) \ |
| { \ |
| __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ |
| if (_setjmp(segv_env) == 0) { \ |
| __VA_ARGS__; \ |
| } \ |
| __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ |
| } |
| |
| static void use_temporary_dir() |
| { |
| char tmpdir_template[] = "./syzkaller.XXXXXX"; |
| char* tmpdir = mkdtemp(tmpdir_template); |
| if (!tmpdir) |
| fail("failed to mkdtemp"); |
| if (chmod(tmpdir, 0777)) |
| fail("failed to chmod"); |
| if (chdir(tmpdir)) |
| fail("failed to chdir"); |
| } |
| |
| static void vsnprintf_check(char* str, size_t size, const char* format, |
| va_list args) |
| { |
| int rv; |
| |
| rv = vsnprintf(str, size, format, args); |
| if (rv < 0) |
| fail("tun: snprintf failed"); |
| if ((size_t)rv >= size) |
| fail("tun: string '%s...' doesn't fit into buffer", str); |
| } |
| |
| static void snprintf_check(char* str, size_t size, const char* format, ...) |
| { |
| va_list args; |
| |
| va_start(args, format); |
| vsnprintf_check(str, size, format, args); |
| va_end(args); |
| } |
| |
| #define COMMAND_MAX_LEN 128 |
| #define PATH_PREFIX \ |
| "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin " |
| #define PATH_PREFIX_LEN (sizeof(PATH_PREFIX) - 1) |
| |
| static void execute_command(bool panic, const char* format, ...) |
| { |
| va_list args; |
| char command[PATH_PREFIX_LEN + COMMAND_MAX_LEN]; |
| int rv; |
| |
| va_start(args, format); |
| memcpy(command, PATH_PREFIX, PATH_PREFIX_LEN); |
| vsnprintf_check(command + PATH_PREFIX_LEN, COMMAND_MAX_LEN, format, args); |
| rv = system(command); |
| if (panic && rv != 0) |
| fail("tun: command \"%s\" failed with code %d", &command[0], rv); |
| |
| va_end(args); |
| } |
| |
| static int tunfd = -1; |
| static int tun_frags_enabled; |
| |
| #define SYZ_TUN_MAX_PACKET_SIZE 1000 |
| |
| #define TUN_IFACE "syz_tun" |
| |
| #define LOCAL_MAC "aa:aa:aa:aa:aa:aa" |
| #define REMOTE_MAC "aa:aa:aa:aa:aa:bb" |
| |
| #define LOCAL_IPV4 "172.20.20.170" |
| #define REMOTE_IPV4 "172.20.20.187" |
| |
| #define LOCAL_IPV6 "fe80::aa" |
| #define REMOTE_IPV6 "fe80::bb" |
| |
| #define IFF_NAPI 0x0010 |
| #define IFF_NAPI_FRAGS 0x0020 |
| |
| static void initialize_tun(void) |
| { |
| tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); |
| if (tunfd == -1) { |
| printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n"); |
| printf("otherwise fuzzing or reproducing might not work as intended\n"); |
| return; |
| } |
| const int kTunFd = 252; |
| if (dup2(tunfd, kTunFd) < 0) |
| fail("dup2(tunfd, kTunFd) failed"); |
| close(tunfd); |
| tunfd = kTunFd; |
| |
| struct ifreq ifr; |
| memset(&ifr, 0, sizeof(ifr)); |
| strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ); |
| ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_NAPI | IFF_NAPI_FRAGS; |
| if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) { |
| ifr.ifr_flags = IFF_TAP | IFF_NO_PI; |
| if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) |
| fail("tun: ioctl(TUNSETIFF) failed"); |
| } |
| if (ioctl(tunfd, TUNGETIFF, (void*)&ifr) < 0) |
| fail("tun: ioctl(TUNGETIFF) failed"); |
| tun_frags_enabled = (ifr.ifr_flags & IFF_NAPI_FRAGS) != 0; |
| |
| execute_command(1, "sysctl -w net.ipv6.conf.%s.accept_dad=0", TUN_IFACE); |
| |
| execute_command(1, "sysctl -w net.ipv6.conf.%s.router_solicitations=0", |
| TUN_IFACE); |
| |
| execute_command(1, "ip link set dev %s address %s", TUN_IFACE, LOCAL_MAC); |
| execute_command(1, "ip addr add %s/24 dev %s", LOCAL_IPV4, TUN_IFACE); |
| execute_command(1, "ip -6 addr add %s/120 dev %s", LOCAL_IPV6, TUN_IFACE); |
| execute_command(1, "ip neigh add %s lladdr %s dev %s nud permanent", |
| REMOTE_IPV4, REMOTE_MAC, TUN_IFACE); |
| execute_command(1, "ip -6 neigh add %s lladdr %s dev %s nud permanent", |
| REMOTE_IPV6, REMOTE_MAC, TUN_IFACE); |
| execute_command(1, "ip link set dev %s up", TUN_IFACE); |
| } |
| |
| #define DEV_IPV4 "172.20.20.%d" |
| #define DEV_IPV6 "fe80::%02hx" |
| #define DEV_MAC "aa:aa:aa:aa:aa:%02hx" |
| |
| static void initialize_netdevices(void) |
| { |
| unsigned i; |
| const char* devtypes[] = {"ip6gretap", "bridge", "vcan", "bond", "veth"}; |
| const char* devnames[] = {"lo", "sit0", "bridge0", "vcan0", |
| "tunl0", "gre0", "gretap0", "ip_vti0", |
| "ip6_vti0", "ip6tnl0", "ip6gre0", "ip6gretap0", |
| "erspan0", "bond0", "veth0", "veth1"}; |
| |
| for (i = 0; i < sizeof(devtypes) / (sizeof(devtypes[0])); i++) |
| execute_command(0, "ip link add dev %s0 type %s", devtypes[i], devtypes[i]); |
| execute_command(0, "ip link add dev veth1 type veth"); |
| for (i = 0; i < sizeof(devnames) / (sizeof(devnames[0])); i++) { |
| char addr[32]; |
| snprintf_check(addr, sizeof(addr), DEV_IPV4, i + 10); |
| execute_command(0, "ip -4 addr add %s/24 dev %s", addr, devnames[i]); |
| snprintf_check(addr, sizeof(addr), DEV_IPV6, i + 10); |
| execute_command(0, "ip -6 addr add %s/120 dev %s", addr, devnames[i]); |
| snprintf_check(addr, sizeof(addr), DEV_MAC, i + 10); |
| execute_command(0, "ip link set dev %s address %s", devnames[i], addr); |
| execute_command(0, "ip link set dev %s up", devnames[i]); |
| } |
| } |
| |
| static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2) |
| { |
| if (a0 == 0xc || a0 == 0xb) { |
| char buf[128]; |
| sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, |
| (uint8_t)a2); |
| return open(buf, O_RDWR, 0); |
| } else { |
| char buf[1024]; |
| char* hash; |
| NONFAILING(strncpy(buf, (char*)a0, sizeof(buf))); |
| buf[sizeof(buf) - 1] = 0; |
| while ((hash = strchr(buf, '#'))) { |
| *hash = '0' + (char)(a1 % 10); |
| a1 /= 10; |
| } |
| return open(buf, a2, 0); |
| } |
| } |
| |
| static bool write_file(const char* file, const char* what, ...) |
| { |
| char buf[1024]; |
| va_list args; |
| va_start(args, what); |
| vsnprintf(buf, sizeof(buf), what, args); |
| va_end(args); |
| buf[sizeof(buf) - 1] = 0; |
| int len = strlen(buf); |
| |
| int fd = open(file, O_WRONLY | O_CLOEXEC); |
| if (fd == -1) |
| return false; |
| if (write(fd, buf, len) != len) { |
| int err = errno; |
| close(fd); |
| errno = err; |
| return false; |
| } |
| close(fd); |
| return true; |
| } |
| |
| static void loop(); |
| |
| static void sandbox_common() |
| { |
| prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); |
| setpgrp(); |
| setsid(); |
| |
| struct rlimit rlim; |
| rlim.rlim_cur = rlim.rlim_max = 128 << 20; |
| setrlimit(RLIMIT_AS, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 8 << 20; |
| setrlimit(RLIMIT_MEMLOCK, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 32 << 20; |
| setrlimit(RLIMIT_FSIZE, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 1 << 20; |
| setrlimit(RLIMIT_STACK, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 0; |
| setrlimit(RLIMIT_CORE, &rlim); |
| |
| if (unshare(CLONE_NEWNS)) { |
| } |
| if (unshare(CLONE_NEWIPC)) { |
| } |
| if (unshare(0x02000000)) { |
| } |
| if (unshare(CLONE_NEWUTS)) { |
| } |
| if (unshare(CLONE_SYSVSEM)) { |
| } |
| } |
| |
| static int real_uid; |
| static int real_gid; |
| __attribute__((aligned(64 << 10))) static char sandbox_stack[1 << 20]; |
| |
| static int namespace_sandbox_proc(void* arg) |
| { |
| sandbox_common(); |
| |
| write_file("/proc/self/setgroups", "deny"); |
| if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)) |
| fail("write of /proc/self/uid_map failed"); |
| if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) |
| fail("write of /proc/self/gid_map failed"); |
| |
| if (unshare(CLONE_NEWNET)) |
| fail("unshare(CLONE_NEWNET)"); |
| initialize_tun(); |
| initialize_netdevices(); |
| |
| if (mkdir("./syz-tmp", 0777)) |
| fail("mkdir(syz-tmp) failed"); |
| if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) |
| fail("mount(tmpfs) failed"); |
| if (mkdir("./syz-tmp/newroot", 0777)) |
| fail("mkdir failed"); |
| if (mkdir("./syz-tmp/newroot/dev", 0700)) |
| fail("mkdir failed"); |
| unsigned mount_flags = MS_BIND | MS_REC | MS_PRIVATE; |
| if (mount("/dev", "./syz-tmp/newroot/dev", NULL, mount_flags, NULL)) |
| fail("mount(dev) failed"); |
| if (mkdir("./syz-tmp/newroot/proc", 0700)) |
| fail("mkdir failed"); |
| if (mount(NULL, "./syz-tmp/newroot/proc", "proc", 0, NULL)) |
| fail("mount(proc) failed"); |
| if (mkdir("./syz-tmp/newroot/selinux", 0700)) |
| fail("mkdir failed"); |
| const char* selinux_path = "./syz-tmp/newroot/selinux"; |
| if (mount("/selinux", selinux_path, NULL, mount_flags, NULL)) { |
| if (errno != ENOENT) |
| fail("mount(/selinux) failed"); |
| if (mount("/sys/fs/selinux", selinux_path, NULL, mount_flags, NULL) && |
| errno != ENOENT) |
| fail("mount(/sys/fs/selinux) failed"); |
| } |
| if (mkdir("./syz-tmp/newroot/sys", 0700)) |
| fail("mkdir failed"); |
| if (mount(NULL, "./syz-tmp/newroot/sys", "sysfs", 0, NULL)) |
| fail("mount(sysfs) failed"); |
| if (mkdir("./syz-tmp/pivot", 0777)) |
| fail("mkdir failed"); |
| if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { |
| if (chdir("./syz-tmp")) |
| fail("chdir failed"); |
| } else { |
| if (chdir("/")) |
| fail("chdir failed"); |
| if (umount2("./pivot", MNT_DETACH)) |
| fail("umount failed"); |
| } |
| if (chroot("./newroot")) |
| fail("chroot failed"); |
| if (chdir("/")) |
| fail("chdir failed"); |
| |
| struct __user_cap_header_struct cap_hdr = {}; |
| struct __user_cap_data_struct cap_data[2] = {}; |
| cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; |
| cap_hdr.pid = getpid(); |
| if (syscall(SYS_capget, &cap_hdr, &cap_data)) |
| fail("capget failed"); |
| cap_data[0].effective &= ~(1 << CAP_SYS_PTRACE); |
| cap_data[0].permitted &= ~(1 << CAP_SYS_PTRACE); |
| cap_data[0].inheritable &= ~(1 << CAP_SYS_PTRACE); |
| if (syscall(SYS_capset, &cap_hdr, &cap_data)) |
| fail("capset failed"); |
| |
| loop(); |
| doexit(1); |
| } |
| |
| static int do_sandbox_namespace(void) |
| { |
| int pid; |
| |
| real_uid = getuid(); |
| real_gid = getgid(); |
| mprotect(sandbox_stack, 4096, PROT_NONE); |
| pid = |
| clone(namespace_sandbox_proc, &sandbox_stack[sizeof(sandbox_stack) - 64], |
| CLONE_NEWUSER | CLONE_NEWPID, 0); |
| if (pid < 0) |
| fail("sandbox clone failed"); |
| return pid; |
| } |
| |
| static int inject_fault(int nth) |
| { |
| int fd; |
| char buf[16]; |
| |
| fd = open("/proc/thread-self/fail-nth", O_RDWR); |
| if (fd == -1) |
| exitf("failed to open /proc/thread-self/fail-nth"); |
| sprintf(buf, "%d", nth + 1); |
| if (write(fd, buf, strlen(buf)) != (ssize_t)strlen(buf)) |
| exitf("failed to write /proc/thread-self/fail-nth"); |
| return fd; |
| } |
| |
| static void execute_one(); |
| extern unsigned long long procid; |
| |
| void loop() |
| { |
| while (1) { |
| execute_one(); |
| } |
| } |
| |
| struct thread_t { |
| int created, running, call; |
| pthread_t th; |
| }; |
| |
| static struct thread_t threads[16]; |
| static void execute_call(int call); |
| static int running; |
| static int collide; |
| |
| static void* thr(void* arg) |
| { |
| struct thread_t* th = (struct thread_t*)arg; |
| for (;;) { |
| while (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) |
| syscall(SYS_futex, &th->running, FUTEX_WAIT, 0, 0); |
| execute_call(th->call); |
| __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); |
| __atomic_store_n(&th->running, 0, __ATOMIC_RELEASE); |
| syscall(SYS_futex, &th->running, FUTEX_WAKE); |
| } |
| return 0; |
| } |
| |
| static void execute(int num_calls) |
| { |
| int call, thread; |
| running = 0; |
| for (call = 0; call < num_calls; call++) { |
| for (thread = 0; thread < sizeof(threads) / sizeof(threads[0]); thread++) { |
| struct thread_t* th = &threads[thread]; |
| if (!th->created) { |
| th->created = 1; |
| pthread_attr_t attr; |
| pthread_attr_init(&attr); |
| pthread_attr_setstacksize(&attr, 128 << 10); |
| pthread_create(&th->th, &attr, thr, th); |
| } |
| if (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) { |
| th->call = call; |
| __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); |
| __atomic_store_n(&th->running, 1, __ATOMIC_RELEASE); |
| syscall(SYS_futex, &th->running, FUTEX_WAKE); |
| if (collide && call % 2) |
| break; |
| struct timespec ts; |
| ts.tv_sec = 0; |
| ts.tv_nsec = 20 * 1000 * 1000; |
| syscall(SYS_futex, &th->running, FUTEX_WAIT, 1, &ts); |
| if (running) |
| usleep((call == num_calls - 1) ? 10000 : 1000); |
| break; |
| } |
| } |
| } |
| } |
| |
| uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, |
| 0x0, 0xffffffffffffffff}; |
| unsigned long long procid; |
| void execute_call(int call) |
| { |
| long res; |
| switch (call) { |
| case 0: |
| NONFAILING(memcpy((void*)0x200003c0, "/dev/loop#", 11)); |
| res = syz_open_dev(0x200003c0, 8, 0); |
| if (res != -1) |
| r[0] = res; |
| break; |
| case 1: |
| NONFAILING(*(uint64_t*)0x20000780 = 0x20000400); |
| NONFAILING(memcpy( |
| (void*)0x20000400, |
| "\x84\xd5\xae\xf1\x60\x3c\xb0\x20\xc5\xb2\x19\xfa\xa7\x57\x91\x3e\xc8" |
| "\x5e\xe7\x4a\x15\x5e\x1d\x63\x55\x66\x77\x7b\x78\x60\x0b\xc6\x5b\xf0" |
| "\x1c\xe3\x3d\xe9\xa6\xbc\x3a\x20\x41\x89\x0d\xf0\x92\x6f\x2c\xfc\x2a" |
| "\x7d\x63\x69\x0f\x6b\x55\x61\x05\x93\x77\x30\x41\x75\x5f\x61\xb0\x34" |
| "\xe3\xa6\x2a\x77\x08\x55\xb2\xc0\x48\x1d\xf2\x19\xef\xbf\xa8\xff\xd0" |
| "\xc6\x65\x43\x4a\x1d\xe0\x26\xbc\xfb\x65\x4d\x59\x7e\xf7\x7a\x7b\x23" |
| "\x1a\xa9\xef\xe4\x5c\x53\x81\x1c\x75\x91\xd5\x6f\x69\xe9\xc6\x23\x1e" |
| "\x6d\xa9\x93\xbb\xd2\xa6\x13\x38\x05\xbe\x0c\x18\xba\x11\x4c\xfe\x86" |
| "\x5e\x69\x30\x24\xa5\x6c\x33\x31\xb9\x3c\x03\xe2\x59\x27\xa5\x04\xd2" |
| "\x7a\xce\xbf\x7e\xec\xd3\x3d\x7c\x69\x35\x9e\x3c\xa3\x7d\xc5\x46\xc4" |
| "\xfc\x5b\xc6\x25\x96\xa9\x4c\xdc\x00\xf9\xb9\x73\x61\x6a\x9d\x2e\xba" |
| "\xd2\xd9\xb3\xe6\x02\x61\xae\x73\xb8\x39\x76\x94\xe1\xf0\x85\x14\x75" |
| "\xb4\x23\x6f\xb4\x79\x89\xe6\xbf\xd1\xad\x92\x6a\x01\x52\x3d\xf3\xf6" |
| "\x89\xdc\x26\x03\xa7\x6b\x5f\xc5\xe0\x23\xd5\x44\x9d\x06\x6d\x42\x4d" |
| "\x10\x01\xfe\xe5\xd6\x53\xc2\x1f\xdb\x75\x1e\x95\xff\x2b", |
| 252)); |
| NONFAILING(*(uint64_t*)0x20000788 = 0xfc); |
| syscall(__NR_pwritev, r[0], 0x20000780, 1, 0); |
| break; |
| case 2: |
| NONFAILING(memcpy((void*)0x200001c0, "/dev/snd/seq", 13)); |
| res = syz_open_dev(0x200001c0, 0, 0); |
| if (res != -1) |
| r[1] = res; |
| break; |
| case 3: |
| NONFAILING(*(uint32_t*)0x2019ffe9 = 0xc1); |
| NONFAILING(*(uint32_t*)0x2019fff1 = 0); |
| NONFAILING(*(uint8_t*)0x201a0001 = 0); |
| NONFAILING(*(uint8_t*)0x201a0002 = 0); |
| NONFAILING(*(uint8_t*)0x201a0003 = 0); |
| NONFAILING(*(uint8_t*)0x201a0004 = 0); |
| NONFAILING(*(uint32_t*)0x201a0005 = 0); |
| NONFAILING(*(uint8_t*)0x201a0009 = 0); |
| NONFAILING(*(uint32_t*)0x201a000d = 0); |
| NONFAILING(*(uint32_t*)0x201a0011 = 0); |
| NONFAILING(*(uint32_t*)0x201a0015 = 0); |
| NONFAILING(*(uint32_t*)0x201a0019 = 0); |
| NONFAILING(*(uint32_t*)0x201a001d = 0); |
| NONFAILING(*(uint32_t*)0x201a0021 = 0); |
| NONFAILING(*(uint32_t*)0x201a0025 = 0); |
| NONFAILING(*(uint32_t*)0x201a0029 = 0); |
| NONFAILING(*(uint32_t*)0x201a002d = 0); |
| NONFAILING(*(uint32_t*)0x201a0031 = 0); |
| syscall(__NR_ioctl, r[1], 0x4040534e, 0x2019ffe9); |
| break; |
| case 4: |
| NONFAILING(*(uint32_t*)0x20000180 = 0x80); |
| res = syscall(__NR_accept, -1, 0x20000080, 0x20000180); |
| if (res != -1) |
| r[2] = res; |
| break; |
| case 5: |
| NONFAILING(*(uint32_t*)0x20000280 = 0x3f); |
| syscall(__NR_ioctl, -1, 0x89e1, 0x20000280); |
| break; |
| case 6: |
| NONFAILING(*(uint64_t*)0x20000200 = 0x80); |
| NONFAILING(*(uint16_t*)0x20000208 = 2); |
| NONFAILING(*(uint16_t*)0x2000020a = htobe16(0x4e20)); |
| NONFAILING(*(uint8_t*)0x2000020c = 0xac); |
| NONFAILING(*(uint8_t*)0x2000020d = 0x14); |
| NONFAILING(*(uint8_t*)0x2000020e = 0x14); |
| NONFAILING(*(uint8_t*)0x2000020f = 0x19); |
| NONFAILING(*(uint8_t*)0x20000210 = 0); |
| NONFAILING(*(uint8_t*)0x20000211 = 0); |
| NONFAILING(*(uint8_t*)0x20000212 = 0); |
| NONFAILING(*(uint8_t*)0x20000213 = 0); |
| NONFAILING(*(uint8_t*)0x20000214 = 0); |
| NONFAILING(*(uint8_t*)0x20000215 = 0); |
| NONFAILING(*(uint8_t*)0x20000216 = 0); |
| NONFAILING(*(uint8_t*)0x20000217 = 0); |
| NONFAILING(*(uint16_t*)0x20000218 = 2); |
| NONFAILING(*(uint16_t*)0x2000021a = htobe16(0x4e21)); |
| NONFAILING(*(uint8_t*)0x2000021c = 0xac); |
| NONFAILING(*(uint8_t*)0x2000021d = 0x14); |
| NONFAILING(*(uint8_t*)0x2000021e = 0x14); |
| NONFAILING(*(uint8_t*)0x2000021f = 0xaa); |
| NONFAILING(*(uint8_t*)0x20000220 = 0); |
| NONFAILING(*(uint8_t*)0x20000221 = 0); |
| NONFAILING(*(uint8_t*)0x20000222 = 0); |
| NONFAILING(*(uint8_t*)0x20000223 = 0); |
| NONFAILING(*(uint8_t*)0x20000224 = 0); |
| NONFAILING(*(uint8_t*)0x20000225 = 0); |
| NONFAILING(*(uint8_t*)0x20000226 = 0); |
| NONFAILING(*(uint8_t*)0x20000227 = 0); |
| NONFAILING(*(uint16_t*)0x20000228 = 2); |
| NONFAILING(*(uint16_t*)0x2000022a = htobe16(0x4e23)); |
| NONFAILING(*(uint32_t*)0x2000022c = htobe32(0)); |
| NONFAILING(*(uint8_t*)0x20000230 = 0); |
| NONFAILING(*(uint8_t*)0x20000231 = 0); |
| NONFAILING(*(uint8_t*)0x20000232 = 0); |
| NONFAILING(*(uint8_t*)0x20000233 = 0); |
| NONFAILING(*(uint8_t*)0x20000234 = 0); |
| NONFAILING(*(uint8_t*)0x20000235 = 0); |
| NONFAILING(*(uint8_t*)0x20000236 = 0); |
| NONFAILING(*(uint8_t*)0x20000237 = 0); |
| NONFAILING(*(uint16_t*)0x20000238 = 0); |
| NONFAILING(*(uint16_t*)0x2000023a = 7); |
| NONFAILING(*(uint64_t*)0x20000240 = 1); |
| NONFAILING(*(uint64_t*)0x20000248 = 9); |
| NONFAILING(*(uint16_t*)0x20000250 = 9); |
| NONFAILING(*(uint64_t*)0x20000258 = 0); |
| NONFAILING(*(uint64_t*)0x20000260 = 0); |
| NONFAILING(*(uint64_t*)0x20000268 = 0); |
| NONFAILING(*(uint16_t*)0x20000270 = 0xfff7); |
| syscall(__NR_ioctl, r[2], 0x890d, 0x20000200); |
| break; |
| case 7: |
| NONFAILING(*(uint32_t*)0x20000ac0 = 0); |
| NONFAILING(*(uint16_t*)0x20000ac4 = 2); |
| NONFAILING(*(uint16_t*)0x20000ac6 = htobe16(0x4e20)); |
| NONFAILING(*(uint32_t*)0x20000ac8 = htobe32(0x7f000001)); |
| NONFAILING(*(uint8_t*)0x20000acc = 0); |
| NONFAILING(*(uint8_t*)0x20000acd = 0); |
| NONFAILING(*(uint8_t*)0x20000ace = 0); |
| NONFAILING(*(uint8_t*)0x20000acf = 0); |
| NONFAILING(*(uint8_t*)0x20000ad0 = 0); |
| NONFAILING(*(uint8_t*)0x20000ad1 = 0); |
| NONFAILING(*(uint8_t*)0x20000ad2 = 0); |
| NONFAILING(*(uint8_t*)0x20000ad3 = 0); |
| NONFAILING(*(uint32_t*)0x200002c0 = 0x84); |
| res = syscall(__NR_getsockopt, -1, 0x84, 6, 0x20000ac0, 0x200002c0); |
| if (res != -1) |
| NONFAILING(r[3] = *(uint32_t*)0x20000ac0); |
| break; |
| case 8: |
| NONFAILING(*(uint32_t*)0x20000300 = r[3]); |
| NONFAILING(*(uint32_t*)0x20000304 = 0x1c9); |
| syscall(__NR_setsockopt, r[2], 0x84, 0x76, 0x20000300, 8); |
| break; |
| case 9: |
| NONFAILING(memcpy((void*)0x20000700, "/dev/sg#", 9)); |
| syz_open_dev(0x20000700, 0xfffffffffffffff7, 0x800); |
| break; |
| case 10: |
| NONFAILING(memcpy( |
| (void*)0x20000800, |
| "\x97\xbb\x77\x03\x8a\xdd\x5d\xf9\xe9\xd4\xf9\x78\x3b\x82\xc5\x5f\xe5" |
| "\x9e\x5c\x0a\xcd\xbc\xfc\x9b\xcf\x92\xac\x0e\x1f\x1f\x3c\x19\x59\xc1" |
| "\xd2\x5d\xfa\xbf\x38\x49\x33\x6c\x7c\x85\xbe\x17\x4d\x77\x65\xb4\x7e" |
| "\x11\x36\x32\xae\xa5\x4b\x87\xe4\xd3\xf2\xc1\xdb\x09\xe6\xaa\x40\x40" |
| "\xb4\x3d\x17\x30\x8f\xb7\xe6\x2e\x80\x80\x67\xda\x2f\xff\x3c\xfd\x8e" |
| "\x4c\x03\x8c\x81\x4b\xbf\xc6\xbc\x49\xd8\xeb\xc8\x67\x1d\x82\x97\xe2" |
| "\xd3\x4d\xc6\x1f\x2d\x19\x4d\x2d\xbb\x8f\x59\xb4\xc8\x53\xe0\x71\x4d" |
| "\x3d\x4b\xb2\x9d\x12\x43\xfa\xc0\x1c\x86\xc8\xc4\xdd\x38\xda\xed\xab" |
| "\x3c\x6a\xd7\x3a\x72\xd3\xf6\xdd\x26\x84\xaa\x82\xe5\x28\x5e\xb8\x24" |
| "\x52\xc9\x84\x8b\x7b\xeb\x8b\xc5\x13\xba\x8c\x89\x73\xca\xd0\xbd\x59" |
| "\x26\x60\x48\x46\xb7\xf5\xd0\x39\x7b\xb1\x91\xc3\xbb\x6b", |
| 184)); |
| NONFAILING(memcpy( |
| (void*)0x20000940, |
| "\xed\x6c\x04\x41\x2e\x78\x2f\xe3\x95\xf0\x84\x74\x1e\x3d\x9f\xe4\x69" |
| "\xae\xbd\xe0\x9a\xcc\x8f\x8d\x8d\x84\xd1\xf0\x0f\x55\x73\xb0\x9a\xcb" |
| "\xa4\x87\x07\x7e\xbb\x90\x4c\xb1\xf3\xfe\xd5\x5f\x59\xd6\x77\xce\x24" |
| "\xbb\xd2\xa7\x50\x6d\xf8\xe1\xe0\xd0\xfc\x70\x9c\xb8\xc9\xf4\xab\x2a" |
| "\xee\xee\xbc\x5e\xf8\x79\x74\x2c\x1f\x76\x28\xf1\x86\x2c\x88\xb5\xb0" |
| "\xda\x89\xac\xbf\x43\xef\x12\xe4\x83\x94\x05\xb6\xa3\x43\x0d\x29\x6f" |
| "\xea\x06\xd2\xf3\xa8\x35\x6c\x57\xec\x99\x1e\x44\xee\x72", |
| 116)); |
| write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N"); |
| write_file("/sys/kernel/debug/fail_futex/ignore-private", "N"); |
| inject_fault(40); |
| syscall(__NR_clone, 0x2000c100, 0x20000800, 0x200008c0, 0x20000900, |
| 0x20000940); |
| break; |
| case 11: |
| NONFAILING(memcpy( |
| (void*)0x200009c0, |
| "\x69\x70\x36\x67\x72\x65\x74\x61\x70\x30\x00\x00\x00\x00\x00\x00", |
| 16)); |
| NONFAILING(*(uint16_t*)0x200009d0 = 2); |
| NONFAILING(*(uint16_t*)0x200009d2 = htobe16(0x4e24)); |
| NONFAILING(*(uint32_t*)0x200009d4 = htobe32(0)); |
| NONFAILING(*(uint8_t*)0x200009d8 = 0); |
| NONFAILING(*(uint8_t*)0x200009d9 = 0); |
| NONFAILING(*(uint8_t*)0x200009da = 0); |
| NONFAILING(*(uint8_t*)0x200009db = 0); |
| NONFAILING(*(uint8_t*)0x200009dc = 0); |
| NONFAILING(*(uint8_t*)0x200009dd = 0); |
| NONFAILING(*(uint8_t*)0x200009de = 0); |
| NONFAILING(*(uint8_t*)0x200009df = 0); |
| syscall(__NR_ioctl, r[2], 0x891c, 0x200009c0); |
| break; |
| case 12: |
| NONFAILING(*(uint8_t*)0x20ec6fb0 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fb1 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fb2 = 0x80); |
| NONFAILING(*(uint8_t*)0x20ec6fb3 = 0); |
| NONFAILING(*(uint32_t*)0x20ec6fb4 = 0); |
| NONFAILING(*(uint32_t*)0x20ec6fb8 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fbc = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fbd = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fbe = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fbf = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc0 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc1 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc2 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc3 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc4 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc5 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc6 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc7 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc8 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fc9 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fca = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fcb = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fcc = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fcd = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fce = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fcf = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd0 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd1 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd2 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd3 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd4 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd5 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd6 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd7 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd8 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fd9 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fda = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fdb = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fdc = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fdd = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fde = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fdf = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe0 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe1 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe2 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe3 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe4 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe5 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe6 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe7 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe8 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fe9 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fea = 0); |
| NONFAILING(*(uint8_t*)0x20ec6feb = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fec = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fed = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fee = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fef = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff0 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff1 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff2 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff3 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff4 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff5 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff6 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff7 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff8 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ff9 = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ffa = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ffb = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ffc = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ffd = 0); |
| NONFAILING(*(uint8_t*)0x20ec6ffe = 0); |
| NONFAILING(*(uint8_t*)0x20ec6fff = 0); |
| syscall(__NR_ioctl, r[1], 0x40505330, 0x20ec6fb0); |
| break; |
| case 13: |
| NONFAILING(*(uint32_t*)0x20000380 = 4); |
| syscall(__NR_getsockopt, r[2], 0x103, 1, 0x20000000, 0x20000380); |
| break; |
| case 14: |
| NONFAILING(memcpy((void*)0x20000600, "/dev/adsp#", 11)); |
| syz_open_dev(0x20000600, 0x100000000, 0x80000); |
| break; |
| case 15: |
| NONFAILING(memcpy( |
| (void*)0x20000500, |
| "\x67\xcd\xd9\x99\x4c\x47\xc3\x1d\x32\x5b\x06\x99\x24\xa7\x06\x4c\x15" |
| "\x7c\x2e\xc0\xb5\xb5\xdc\xa2\xfe\xeb\x7d\xab\xef\x3b\x7a\xf0\xd0\x2d" |
| "\x55\x9e\x29\x3f\xaa\x75\x9f\x2b\x3c\xb1\x2a\xea\x36\x0c\x2d\x49\x41" |
| "\xe4\x23\xb0\xc8\x15\xec\x14\x50\xa7\x77\x61\x4b\x02\x49\x6c\x5c\x4c" |
| "\xe5\x89\xc4\xe9\x0b\x88\xfe\xb6\x6f\x42\xe6\x32\x27\xae\xc8\xec\x98" |
| "\x3c\xb7\x0e\x64\xac\x04\xda\x22\xc9\x7d\x2b\x22", |
| 97)); |
| NONFAILING(memcpy( |
| (void*)0x20000a00, |
| "\x29\x85\x9f\xdd\xa9\xa1\x19\xe5\x4a\x27\xf9\xec\x76\xb4\xd6\x3a\x16" |
| "\xdc\x5b\xbd\xd3\x8c\x2f\xda\x0e\x5f\x4d\x8f\x83\x0c\xd9\x87\xec\x7d" |
| "\x3f\xfc\x66\xcf\x3d\xb8\x82\x09\x68\xfd\x89\xa1\xfb\xa8\xfe\x63\x52" |
| "\xa2\x9a\x27\xf3\xb0\x00\xbc\xdf\x23\x8f\x2c\x04\xb3\x58\xfc\x83\x10" |
| "\x25\x18\x0e\x0b\xe3\x13\xda\x41\xde\x63\x66\xc9\x4a\x1a\x0f\x86\xaa" |
| "\xff\xdf\x2c\x03\x91\x11\xb5\x52\x75\xc0\x54\xe1\x48\x19\xa8\x27\xfe" |
| "\x80\x92\x25\x24\x9a\x01\x94\x42\x63\xa2\xae\xc1\x5f\x64\xe7\x52\xe3" |
| "\x58\x92\xb1\xb8\xe7\xef\x1e\x0e\x91\x15", |
| 129)); |
| syscall(__NR_clone, 0, 0x20000500, 0x20000580, 0x200005c0, 0x20000a00); |
| break; |
| case 16: |
| NONFAILING(*(uint8_t*)0x20000b80 = 4); |
| NONFAILING(*(uint8_t*)0x20000b81 = 8); |
| NONFAILING(memcpy( |
| (void*)0x20000b82, |
| "\x70\x6f\x72\x74\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", |
| 64)); |
| NONFAILING(*(uint32_t*)0x20000bc4 = 0x80); |
| NONFAILING(*(uint32_t*)0x20000bc8 = 0x40); |
| NONFAILING(*(uint32_t*)0x20000bcc = 0x10000); |
| NONFAILING(*(uint32_t*)0x20000bd0 = 6); |
| NONFAILING(*(uint32_t*)0x20000bd4 = 2); |
| NONFAILING(*(uint32_t*)0x20000bd8 = 0x80); |
| NONFAILING(*(uint32_t*)0x20000bdc = 8); |
| NONFAILING(*(uint64_t*)0x20000be0 = 0); |
| NONFAILING(*(uint32_t*)0x20000be8 = 0); |
| NONFAILING(*(uint32_t*)0x20000bec = 0x3dec00); |
| NONFAILING(*(uint8_t*)0x20000bf0 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf1 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf2 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf3 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf4 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf5 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf6 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf7 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf8 = 0); |
| NONFAILING(*(uint8_t*)0x20000bf9 = 0); |
| NONFAILING(*(uint8_t*)0x20000bfa = 0); |
| NONFAILING(*(uint8_t*)0x20000bfb = 0); |
| NONFAILING(*(uint8_t*)0x20000bfc = 0); |
| NONFAILING(*(uint8_t*)0x20000bfd = 0); |
| NONFAILING(*(uint8_t*)0x20000bfe = 0); |
| NONFAILING(*(uint8_t*)0x20000bff = 0); |
| NONFAILING(*(uint8_t*)0x20000c00 = 0); |
| NONFAILING(*(uint8_t*)0x20000c01 = 0); |
| NONFAILING(*(uint8_t*)0x20000c02 = 0); |
| NONFAILING(*(uint8_t*)0x20000c03 = 0); |
| NONFAILING(*(uint8_t*)0x20000c04 = 0); |
| NONFAILING(*(uint8_t*)0x20000c05 = 0); |
| NONFAILING(*(uint8_t*)0x20000c06 = 0); |
| NONFAILING(*(uint8_t*)0x20000c07 = 0); |
| NONFAILING(*(uint8_t*)0x20000c08 = 0); |
| NONFAILING(*(uint8_t*)0x20000c09 = 0); |
| NONFAILING(*(uint8_t*)0x20000c0a = 0); |
| NONFAILING(*(uint8_t*)0x20000c0b = 0); |
| NONFAILING(*(uint8_t*)0x20000c0c = 0); |
| NONFAILING(*(uint8_t*)0x20000c0d = 0); |
| NONFAILING(*(uint8_t*)0x20000c0e = 0); |
| NONFAILING(*(uint8_t*)0x20000c0f = 0); |
| NONFAILING(*(uint8_t*)0x20000c10 = 0); |
| NONFAILING(*(uint8_t*)0x20000c11 = 0); |
| NONFAILING(*(uint8_t*)0x20000c12 = 0); |
| NONFAILING(*(uint8_t*)0x20000c13 = 0); |
| NONFAILING(*(uint8_t*)0x20000c14 = 0); |
| NONFAILING(*(uint8_t*)0x20000c15 = 0); |
| NONFAILING(*(uint8_t*)0x20000c16 = 0); |
| NONFAILING(*(uint8_t*)0x20000c17 = 0); |
| NONFAILING(*(uint8_t*)0x20000c18 = 0); |
| NONFAILING(*(uint8_t*)0x20000c19 = 0); |
| NONFAILING(*(uint8_t*)0x20000c1a = 0); |
| NONFAILING(*(uint8_t*)0x20000c1b = 0); |
| NONFAILING(*(uint8_t*)0x20000c1c = 0); |
| NONFAILING(*(uint8_t*)0x20000c1d = 0); |
| NONFAILING(*(uint8_t*)0x20000c1e = 0); |
| NONFAILING(*(uint8_t*)0x20000c1f = 0); |
| NONFAILING(*(uint8_t*)0x20000c20 = 0); |
| NONFAILING(*(uint8_t*)0x20000c21 = 0); |
| NONFAILING(*(uint8_t*)0x20000c22 = 0); |
| NONFAILING(*(uint8_t*)0x20000c23 = 0); |
| NONFAILING(*(uint8_t*)0x20000c24 = 0); |
| NONFAILING(*(uint8_t*)0x20000c25 = 0); |
| NONFAILING(*(uint8_t*)0x20000c26 = 0); |
| NONFAILING(*(uint8_t*)0x20000c27 = 0); |
| NONFAILING(*(uint8_t*)0x20000c28 = 0); |
| NONFAILING(*(uint8_t*)0x20000c29 = 0); |
| NONFAILING(*(uint8_t*)0x20000c2a = 0); |
| syscall(__NR_ioctl, r[1], 0x40a85321, 0x20000b80); |
| break; |
| case 17: |
| syscall(__NR_ioctl, r[1], 0x80045301, 0x20000340); |
| break; |
| case 18: |
| NONFAILING(memcpy((void*)0x20000040, "/dev/sequencer2", 16)); |
| res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000040, 0, 0); |
| if (res != -1) |
| r[4] = res; |
| break; |
| case 19: |
| NONFAILING(memcpy((void*)0x200006c0, "/dev/sequencer2", 16)); |
| syscall(__NR_openat, 0xffffffffffffff9c, 0x200006c0, 0x222081, 0); |
| break; |
| case 20: |
| NONFAILING(*(uint64_t*)0x20000100 = 0x20000680); |
| NONFAILING(*(uint64_t*)0x20000680 = 0x20000640); |
| NONFAILING(*(uint64_t*)0x20000640 = 0); |
| NONFAILING(*(uint64_t*)0x20000648 = 0); |
| syscall(__NR_ioctl, -1, 0x40085203, 0x20000100); |
| break; |
| case 21: |
| NONFAILING(*(uint16_t*)0x20000140 = 5); |
| NONFAILING(*(uint16_t*)0x20000142 = 1); |
| NONFAILING(*(uint16_t*)0x20000144 = 0); |
| NONFAILING(*(uint32_t*)0x20000148 = 8); |
| NONFAILING(*(uint32_t*)0x2000014c = 0); |
| NONFAILING(*(uint32_t*)0x20000150 = 7); |
| NONFAILING(*(uint32_t*)0x20000154 = 0x401); |
| NONFAILING(*(uint32_t*)0x20000158 = 0x1f); |
| NONFAILING(*(uint32_t*)0x2000015c = r[3]); |
| syscall(__NR_setsockopt, r[4], 0x84, 0xa, 0x20000140, 0x20); |
| break; |
| } |
| } |
| |
| void execute_one() |
| { |
| execute(22); |
| collide = 1; |
| execute(22); |
| } |
| |
| int main() |
| { |
| syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); |
| char* cwd = get_current_dir_name(); |
| for (procid = 0; procid < 8; procid++) { |
| if (fork() == 0) { |
| install_segv_handler(); |
| for (;;) { |
| if (chdir(cwd)) |
| fail("failed to chdir"); |
| use_temporary_dir(); |
| int pid = do_sandbox_namespace(); |
| int status = 0; |
| while (waitpid(pid, &status, __WALL) != pid) { |
| } |
| } |
| } |
| } |
| sleep(1000000); |
| return 0; |
| } |