syzkaller-repros/linux/3e99f9b4ca4807bb541159f3cd1c0776f6598ee8.c

// WARNING: kernel stack regs has bad value
// https://syzkaller.appspot.com/bug?id=3e99f9b4ca4807bb541159f3cd1c0776f6598ee8
// status:dup
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <sys/syscall.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}
#include <errno.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

static void fail(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

static __thread int skip_segv;
static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* uctx)
{
  uintptr_t addr = (uintptr_t)info->si_addr;
  const uintptr_t prog_start = 1 << 20;
  const uintptr_t prog_end = 100 << 20;
  if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
      (addr < prog_start || addr > prog_end)) {
    _longjmp(segv_env, 1);
  }
  doexit(sig);
}

static void install_segv_handler()
{
  struct sigaction sa;

  memset(&sa, 0, sizeof(sa));
  sa.sa_handler = SIG_IGN;
  syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
  syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);

  memset(&sa, 0, sizeof(sa));
  sa.sa_sigaction = segv_handler;
  sa.sa_flags = SA_NODEFER | SA_SIGINFO;
  sigaction(SIGSEGV, &sa, NULL);
  sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...)                                                        \
  {                                                                            \
    __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
    if (_setjmp(segv_env) == 0) {                                              \
      __VA_ARGS__;                                                             \
    }                                                                          \
    __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
  }

static void use_temporary_dir()
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    fail("failed to mkdtemp");
  if (chmod(tmpdir, 0777))
    fail("failed to chmod");
  if (chdir(tmpdir))
    fail("failed to chdir");
}

static void execute_one();
extern unsigned long long procid;

void loop()
{
  while (1) {
    execute_one();
  }
}

uint64_t r[4] = {0x0, 0x0, 0x0, 0x0};
void execute_one()
{
  long res = 0;
  NONFAILING(memcpy((void*)0x20000000, "keyring", 8));
  NONFAILING(*(uint8_t*)0x20000080 = 0x73);
  NONFAILING(*(uint8_t*)0x20000081 = 0x79);
  NONFAILING(*(uint8_t*)0x20000082 = 0x7a);
  NONFAILING(*(uint8_t*)0x20000083 = 0);
  NONFAILING(*(uint8_t*)0x20000084 = 0);
  res = syscall(__NR_add_key, 0x20000000, 0x20000080, 0, 0, -1);
  if (res != -1)
    r[0] = res;
  NONFAILING(memcpy((void*)0x200000c0, "keyring", 8));
  NONFAILING(*(uint8_t*)0x20000180 = 0x73);
  NONFAILING(*(uint8_t*)0x20000181 = 0x79);
  NONFAILING(*(uint8_t*)0x20000182 = 0x7a);
  NONFAILING(*(uint8_t*)0x20000183 = 0);
  NONFAILING(*(uint8_t*)0x20000184 = 0);
  res = syscall(__NR_add_key, 0x200000c0, 0x20000180, 0, 0, r[0]);
  if (res != -1)
    r[1] = res;
  NONFAILING(memcpy((void*)0x203bd000, "user", 5));
  NONFAILING(*(uint8_t*)0x20000040 = 0x73);
  NONFAILING(*(uint8_t*)0x20000041 = 0x79);
  NONFAILING(*(uint8_t*)0x20000042 = 0x7a);
  NONFAILING(*(uint8_t*)0x20000043 = 0);
  NONFAILING(*(uint8_t*)0x20000044 = 0);
  NONFAILING(memcpy((void*)0x20facfff, "\x06", 1));
  res = syscall(__NR_add_key, 0x203bd000, 0x20000040, 0x20facfff, 1, r[1]);
  if (res != -1)
    r[2] = res;
  NONFAILING(memcpy((void*)0x20fc0ffb, "user", 5));
  NONFAILING(*(uint8_t*)0x20752ffb = 0x73);
  NONFAILING(*(uint8_t*)0x20752ffc = 0x79);
  NONFAILING(*(uint8_t*)0x20752ffd = 0x7a);
  NONFAILING(*(uint8_t*)0x20752ffe = 0x23);
  NONFAILING(*(uint8_t*)0x20752fff = 0);
  NONFAILING(memcpy((void*)0x203eb000, "\xb3", 1));
  res = syscall(__NR_add_key, 0x20fc0ffb, 0x20752ffb, 0x203eb000, 1, r[1]);
  if (res != -1)
    r[3] = res;
  NONFAILING(memcpy(
      (void*)0x200004c0,
      "\xdf\x02\x75\x46\x77\x21\x2d\xfc\x3e\x2a\xbc\xb2\x44\x73\xe8\xe1\xcf\xef"
      "\x09\x74\x22\x58\xcb\xae\x7b\x26\xfd\xc3\xff\xa6\x15\xd9\xda\x49\x41\x37"
      "\xe1\x75\xe9\xf2\x78\x0a\xc5\xe2\xa0\x9f\x43\xa1\xfc\xeb\xf2\x72\xa5\xa1"
      "\x35\xde\x92\xbf\x4a\x90\x33\x93\x38\x24\xf6\xe6\xaa\x02\x38\x01\x4e\x32"
      "\x93\x53\x5d\x1c\x00\x66\xd2\x8e\x0f\x27\x51\x88\xb4\xb4\xc1\x87\xe1\x87"
      "\x74\xfc\x22\x27\xcb\xb6\x61\x0f\xc6\x69\x7f\x53\x37\x72\x61\x64\xc8\xfb"
      "\xe1\x18\x1e\x6d\x50\x98\x6c\xd9\x8a\x5c\x44\xac\x0e\xc3\x75\xde\xb2\x7e"
      "\xaf\xcf\x7d\x06\x43\x8f\x25\x25\x10\x04\x00\x00\x00\x03\xe7\xdc\x2f\x8f"
      "\xd8\x5a\xdc\xd8\x8c\xa3\x0e\x75\xb1\xe1\x43\x26\x2d\x94\xde\xfa\x18\x7e"
      "\x48\x2a\x9b\x9a\x9a\x38\x73\x53\xdf\x7a\x21\xaf\xfc\xe4\xe9\x14\x9e\x04"
      "\x00\x00\x00\x00\x00\x00\x00\x65\xaf\xd9\x79\xe9",
      192));
  syscall(__NR_keyctl, 2, r[3], 0x200004c0, 0xc0);
  NONFAILING(*(uint32_t*)0x20000100 = r[2]);
  NONFAILING(*(uint32_t*)0x20000104 = r[3]);
  NONFAILING(*(uint32_t*)0x20000108 = r[3]);
  NONFAILING(*(uint64_t*)0x20000240 = 0x20a3dffa);
  NONFAILING(memcpy((void*)0x20a3dffa,
                    "\x73\x68\x61\x33\x2d\x33\x38\x34\x00\x30\x00\x00\x00\x00"
                    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                    "\x00\x00\x00\x00\x00\x00\x00\x00",
                    64));
  NONFAILING(*(uint64_t*)0x20000248 = 0);
  NONFAILING(*(uint32_t*)0x20000250 = 0);
  NONFAILING(*(uint32_t*)0x20000254 = 0);
  NONFAILING(*(uint32_t*)0x20000258 = 0);
  NONFAILING(*(uint32_t*)0x2000025c = 0);
  NONFAILING(*(uint32_t*)0x20000260 = 0);
  NONFAILING(*(uint32_t*)0x20000264 = 0);
  NONFAILING(*(uint32_t*)0x20000268 = 0);
  NONFAILING(*(uint32_t*)0x2000026c = 0);
  NONFAILING(*(uint32_t*)0x20000270 = 0);
  syscall(__NR_keyctl, 0x17, 0x20000100, 0x20a53ffb, 0x2dd, 0x20000240);
}

int main()
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  install_segv_handler();
  char* cwd = get_current_dir_name();
  for (;;) {
    if (chdir(cwd))
      fail("failed to chdir");
    use_temporary_dir();
    loop();
  }
}