| // BUG: sleeping function called from invalid context at net/core/sock.c:LINE |
| // https://syzkaller.appspot.com/bug?id=c9f717b49aca3872ae156bace9e55918b9b65e59 |
| // status:fixed |
| // autogenerated by syzkaller (http://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| |
| #include <sys/syscall.h> |
| #include <unistd.h> |
| |
| #include <stdint.h> |
| #include <string.h> |
| |
| static void test(); |
| |
| void loop() |
| { |
| while (1) { |
| test(); |
| } |
| } |
| |
| long r[110]; |
| void test() |
| { |
| memset(r, -1, sizeof(r)); |
| r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, |
| 0xfffffffffffffffful, 0x0ul); |
| r[1] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul); |
| r[2] = syscall(__NR_close, r[1]); |
| r[3] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul); |
| *(uint16_t*)0x20c84000 = (uint16_t)0x26; |
| memcpy((void*)0x20c84002, |
| "\x61\x65\x61\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", |
| 14); |
| *(uint32_t*)0x20c84010 = (uint32_t)0x0; |
| *(uint32_t*)0x20c84014 = (uint32_t)0x0; |
| memcpy((void*)0x20c84018, |
| "\x67\x63\x6d\x28\x73\x65\x72\x70\x65\x6e\x74\x29\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00", |
| 64); |
| r[9] = syscall(__NR_bind, r[3], 0x20c84000ul, 0x58ul); |
| r[10] = syscall(__NR_setsockopt, r[3], 0x117ul, 0x1ul, 0x20001f3aul, |
| 0x0ul); |
| r[11] = syscall(__NR_accept, r[1], 0x0ul, 0x0ul); |
| *(uint64_t*)0x202fefc8 = (uint64_t)0x0; |
| *(uint32_t*)0x202fefd0 = (uint32_t)0x0; |
| *(uint64_t*)0x202fefd8 = (uint64_t)0x20985000; |
| *(uint64_t*)0x202fefe0 = (uint64_t)0x1; |
| *(uint64_t*)0x202fefe8 = (uint64_t)0x20632f70; |
| *(uint64_t*)0x202feff0 = (uint64_t)0x90; |
| *(uint32_t*)0x202feff8 = (uint32_t)0x1; |
| *(uint64_t*)0x20985000 = (uint64_t)0x206fdf9d; |
| *(uint64_t*)0x20985008 = (uint64_t)0x63; |
| memcpy((void*)0x206fdf9d, |
| "\x95\x76\xfb\x56\x78\xf4\xd8\xbb\x1b\x8c\x63\xa2\x29\xd9\xca" |
| "\x03\x84\x2c\x53\x28\x6f\x77\xe1\x6d\x66\x84\xd4\xbf\xd4\x3e" |
| "\x32\xc6\x5d\xf5\x59\x30\x02\x0d\x14\x66\xb3\xcc\xd5\x13\x5e" |
| "\xb5\xd1\x2d\x73\xc4\x34\x2f\x0d\x93\x0f\x34\x2f\x35\x2e\xdf" |
| "\x25\x04\x87\xca\x0f\x9f\x6c\xd1\xb1\xf4\x00\x17\x5c\x8b\x13" |
| "\x01\xac\x78\x25\x36\x1a\x7a\x63\xdf\xef\xcb\x7c\xb7\x1a\xe3" |
| "\x16\x8e\x99\x5a\xba\x77\xbd\x53\x3b", |
| 99); |
| *(uint64_t*)0x20632f70 = (uint64_t)0x18; |
| *(uint32_t*)0x20632f78 = (uint32_t)0x117; |
| *(uint32_t*)0x20632f7c = (uint32_t)0x3; |
| *(uint32_t*)0x20632f80 = (uint32_t)0x1; |
| *(uint64_t*)0x20632f88 = (uint64_t)0x18; |
| *(uint32_t*)0x20632f90 = (uint32_t)0x117; |
| *(uint32_t*)0x20632f94 = (uint32_t)0x3; |
| *(uint32_t*)0x20632f98 = (uint32_t)0x0; |
| *(uint64_t*)0x20632fa0 = (uint64_t)0x18; |
| *(uint32_t*)0x20632fa8 = (uint32_t)0x117; |
| *(uint32_t*)0x20632fac = (uint32_t)0x3; |
| *(uint32_t*)0x20632fb0 = (uint32_t)0x0; |
| *(uint64_t*)0x20632fb8 = (uint64_t)0x18; |
| *(uint32_t*)0x20632fc0 = (uint32_t)0x117; |
| *(uint32_t*)0x20632fc4 = (uint32_t)0x3; |
| *(uint32_t*)0x20632fc8 = (uint32_t)0x1; |
| *(uint64_t*)0x20632fd0 = (uint64_t)0x18; |
| *(uint32_t*)0x20632fd8 = (uint32_t)0x117; |
| *(uint32_t*)0x20632fdc = (uint32_t)0x4; |
| *(uint32_t*)0x20632fe0 = (uint32_t)0x100000000; |
| *(uint64_t*)0x20632fe8 = (uint64_t)0x18; |
| *(uint32_t*)0x20632ff0 = (uint32_t)0x117; |
| *(uint32_t*)0x20632ff4 = (uint32_t)0x4; |
| *(uint32_t*)0x20632ff8 = (uint32_t)0x3; |
| r[46] = syscall(__NR_sendmsg, r[11], 0x202fefc8ul, 0x1ul); |
| r[47] = syscall(__NR_io_setup, 0x1ul, 0x20e4b000ul); |
| if (r[47] != -1) |
| r[48] = *(uint64_t*)0x20e4b000; |
| *(uint64_t*)0x20bd9fe0 = (uint64_t)0x20617fc0; |
| *(uint64_t*)0x20bd9fe8 = (uint64_t)0x20121fc0; |
| *(uint64_t*)0x20bd9ff0 = (uint64_t)0x20097fc0; |
| *(uint64_t*)0x20bd9ff8 = (uint64_t)0x208b6000; |
| *(uint64_t*)0x20617fc0 = (uint64_t)0x0; |
| *(uint32_t*)0x20617fc8 = (uint32_t)0x0; |
| *(uint32_t*)0x20617fcc = (uint32_t)0x0; |
| *(uint16_t*)0x20617fd0 = (uint16_t)0x0; |
| *(uint16_t*)0x20617fd2 = (uint16_t)0x1; |
| *(uint32_t*)0x20617fd4 = r[11]; |
| *(uint64_t*)0x20617fd8 = (uint64_t)0x2007d000; |
| *(uint64_t*)0x20617fe0 = (uint64_t)0xad; |
| *(uint64_t*)0x20617fe8 = (uint64_t)0x0; |
| *(uint64_t*)0x20617ff0 = (uint64_t)0x0; |
| *(uint32_t*)0x20617ff8 = (uint32_t)0x0; |
| *(uint32_t*)0x20617ffc = (uint32_t)0xffffffffffffffff; |
| memcpy((void*)0x2007d000, |
| "\xb3\xb0\x39\x96\xff\x05\xab\xb1\xe8\xb1\xc2\x4b\x50\x89\x8d" |
| "\x8f\x9e\xad\x67\x39\x23\xf5\x7e\xea\x9c\x32\x35\x39\xf6\x10" |
| "\x98\xa6\x6e\x70\xe2\x1c\x7f\x41\xb2\x48\x34\x36\x90\xcd\xe4" |
| "\x38\x3c\x53\x8b\x17\x9b\x0f\x5d\xcc\xcf\x6b\xfa\xf8\x03\x1c" |
| "\xb0\x52\xad\x74\xa5\xa8\x3f\xad\xd0\x99\x55\xb1\x67\x6d\x37" |
| "\xe5\xe4\x5d\x50\x69\x7c\xe5\x3a\x58\x8a\xe0\xd5\xe6\xe2\x0d" |
| "\xf6\x1f\xeb\xd6\x65\xb5\x32\xe5\x79\x0c\x28\x39\xd3\xb8\x06" |
| "\x8a\x5d\xeb\x2c\x40\x8f\xc4\x82\xa0\x57\x1c\xd5\x48\xc8\xa8" |
| "\xb9\x04\x89\x61\xcc\xef\x04\x33\xf1\x84\x79\xdd\xd0\x92\x36" |
| "\xd4\x95\xea\xad\xd8\x35\xe6\x4b\x72\x8d\x0f\x8e\x60\xde\x4c" |
| "\x73\xd9\x0e\x62\x66\x41\x0f\xf6\x82\xff\x4b\x33\x8e\x62\xae" |
| "\xd8\x53\xf8\xf9\x0f\x83\x2b\xdc", |
| 173); |
| *(uint64_t*)0x20121fc0 = (uint64_t)0x0; |
| *(uint32_t*)0x20121fc8 = (uint32_t)0x0; |
| *(uint32_t*)0x20121fcc = (uint32_t)0x0; |
| *(uint16_t*)0x20121fd0 = (uint16_t)0x8; |
| *(uint16_t*)0x20121fd2 = (uint16_t)0x59; |
| *(uint32_t*)0x20121fd4 = (uint32_t)0xffffffffffffffff; |
| *(uint64_t*)0x20121fd8 = (uint64_t)0x203cd000; |
| *(uint64_t*)0x20121fe0 = (uint64_t)0x0; |
| *(uint64_t*)0x20121fe8 = (uint64_t)0x80000000; |
| *(uint64_t*)0x20121ff0 = (uint64_t)0x0; |
| *(uint32_t*)0x20121ff8 = (uint32_t)0x1; |
| *(uint32_t*)0x20121ffc = (uint32_t)0xffffffffffffffff; |
| *(uint64_t*)0x20097fc0 = (uint64_t)0x0; |
| *(uint32_t*)0x20097fc8 = (uint32_t)0x0; |
| *(uint32_t*)0x20097fcc = (uint32_t)0x0; |
| *(uint16_t*)0x20097fd0 = (uint16_t)0x7; |
| *(uint16_t*)0x20097fd2 = (uint16_t)0xca9; |
| *(uint32_t*)0x20097fd4 = r[3]; |
| *(uint64_t*)0x20097fd8 = (uint64_t)0x202b9000; |
| *(uint64_t*)0x20097fe0 = (uint64_t)0x0; |
| *(uint64_t*)0x20097fe8 = (uint64_t)0x10000; |
| *(uint64_t*)0x20097ff0 = (uint64_t)0x0; |
| *(uint32_t*)0x20097ff8 = (uint32_t)0x1; |
| *(uint32_t*)0x20097ffc = (uint32_t)0xffffffffffffffff; |
| *(uint64_t*)0x208b6000 = (uint64_t)0x0; |
| *(uint32_t*)0x208b6008 = (uint32_t)0x0; |
| *(uint32_t*)0x208b600c = (uint32_t)0x0; |
| *(uint16_t*)0x208b6010 = (uint16_t)0x1; |
| *(uint16_t*)0x208b6012 = (uint16_t)0x4; |
| *(uint32_t*)0x208b6014 = r[11]; |
| *(uint64_t*)0x208b6018 = (uint64_t)0x20e4a000; |
| *(uint64_t*)0x208b6020 = (uint64_t)0x0; |
| *(uint64_t*)0x208b6028 = (uint64_t)0x2; |
| *(uint64_t*)0x208b6030 = (uint64_t)0x0; |
| *(uint32_t*)0x208b6038 = (uint32_t)0x0; |
| *(uint32_t*)0x208b603c = r[3]; |
| r[102] = syscall(__NR_io_submit, r[48], 0x4ul, 0x20bd9fe0ul); |
| r[103] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul); |
| *(uint16_t*)0x20546fa8 = (uint16_t)0x26; |
| memcpy((void*)0x20546faa, |
| "\x61\x65\x61\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", |
| 14); |
| *(uint32_t*)0x20546fb8 = (uint32_t)0x0; |
| *(uint32_t*)0x20546fbc = (uint32_t)0x0; |
| memcpy((void*)0x20546fc0, |
| "\x70\x63\x72\x79\x70\x74\x28\x67\x63\x6d\x28\x73\x65\x72\x70" |
| "\x65\x6e\x74\x29\x29\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00", |
| 64); |
| r[109] = syscall(__NR_bind, r[103], 0x20546fa8ul, 0x58ul); |
| } |
| |
| int main() |
| { |
| loop(); |
| return 0; |
| } |
