API tools faq
paste
zzqq0103

Untitled

zzqq0103
Mar 15th, 2024
210
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.41 KB | None | 0 0
raw download clone embed print report
  1. #define _GNU_SOURCE
  2.  
  3. #include <arpa/inet.h>
  4. #include <dirent.h>
  5. #include <endian.h>
  6. #include <errno.h>
  7. #include <fcntl.h>
  8. #include <net/if.h>
  9. #include <netinet/in.h>
  10. #include <setjmp.h>
  11. #include <signal.h>
  12. #include <stdarg.h>
  13. #include <stdbool.h>
  14. #include <stdint.h>
  15. #include <stdio.h>
  16. #include <stdlib.h>
  17. #include <string.h>
  18. #include <sys/ioctl.h>
  19. #include <sys/mount.h>
  20. #include <sys/prctl.h>
  21. #include <sys/socket.h>
  22. #include <sys/stat.h>
  23. #include <sys/syscall.h>
  24. #include <sys/types.h>
  25. #include <sys/wait.h>
  26. #include <time.h>
  27. #include <unistd.h>
  28.  
  29. #include <linux/genetlink.h>
  30. #include <linux/if_addr.h>
  31. #include <linux/if_link.h>
  32. #include <linux/in6.h>
  33. #include <linux/neighbour.h>
  34. #include <linux/net.h>
  35. #include <linux/netlink.h>
  36. #include <linux/rtnetlink.h>
  37. #include <linux/veth.h>
  38.  
  39. static unsigned long long procid;
  40.  
  41. static __thread int clone_ongoing;
  42. static __thread int skip_segv;
  43. static __thread jmp_buf segv_env;
  44.  
  45. static void segv_handler(int sig, siginfo_t* info, void* ctx)
  46. {
  47. if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
  48. exit(sig);
  49. }
  50. uintptr_t addr = (uintptr_t)info->si_addr;
  51. const uintptr_t prog_start = 1 << 20;
  52. const uintptr_t prog_end = 100 << 20;
  53. int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
  54. int valid = addr < prog_start || addr > prog_end;
  55. if (skip && valid) {
  56. _longjmp(segv_env, 1);
  57. }
  58. exit(sig);
  59. }
  60.  
  61. static void install_segv_handler(void)
  62. {
  63. struct sigaction sa;
  64. memset(&sa, 0, sizeof(sa));
  65. sa.sa_handler = SIG_IGN;
  66. syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
  67. syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
  68. memset(&sa, 0, sizeof(sa));
  69. sa.sa_sigaction = segv_handler;
  70. sa.sa_flags = SA_NODEFER | SA_SIGINFO;
  71. sigaction(SIGSEGV, &sa, NULL);
  72. sigaction(SIGBUS, &sa, NULL);
  73. }
  74.  
  75. #define NONFAILING(...) \
  76. ({ \
  77. int ok = 1; \
  78. __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
  79. if (_setjmp(segv_env) == 0) { \
  80. __VA_ARGS__; \
  81. } else \
  82. ok = 0; \
  83. __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
  84. ok; \
  85. })
  86.  
  87. static void sleep_ms(uint64_t ms)
  88. {
  89. usleep(ms * 1000);
  90. }
  91.  
  92. static uint64_t current_time_ms(void)
  93. {
  94. struct timespec ts;
  95. if (clock_gettime(CLOCK_MONOTONIC, &ts))
  96. exit(1);
  97. return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
  98. }
  99.  
  100. static void use_temporary_dir(void)
  101. {
  102. char tmpdir_template[] = "./syzkaller.XXXXXX";
  103. char* tmpdir = mkdtemp(tmpdir_template);
  104. if (!tmpdir)
  105. exit(1);
  106. if (chmod(tmpdir, 0777))
  107. exit(1);
  108. if (chdir(tmpdir))
  109. exit(1);
  110. }
  111.  
  112. #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
  113. #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \
  114. *(type*)(addr) = \
  115. htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \
  116. (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
  117.  
  118. static bool write_file(const char* file, const char* what, ...)
  119. {
  120. char buf[1024];
  121. va_list args;
  122. va_start(args, what);
  123. vsnprintf(buf, sizeof(buf), what, args);
  124. va_end(args);
  125. buf[sizeof(buf) - 1] = 0;
  126. int len = strlen(buf);
  127. int fd = open(file, O_WRONLY | O_CLOEXEC);
  128. if (fd == -1)
  129. return false;
  130. if (write(fd, buf, len) != len) {
  131. int err = errno;
  132. close(fd);
  133. errno = err;
  134. return false;
  135. }
  136. close(fd);
  137. return true;
  138. }
  139.  
  140. struct nlmsg {
  141. char* pos;
  142. int nesting;
  143. struct nlattr* nested[8];
  144. char buf[4096];
  145. };
  146.  
  147. static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
  148. const void* data, int size)
  149. {
  150. memset(nlmsg, 0, sizeof(*nlmsg));
  151. struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  152. hdr->nlmsg_type = typ;
  153. hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
  154. memcpy(hdr + 1, data, size);
  155. nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
  156. }
  157.  
  158. static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data,
  159. int size)
  160. {
  161. struct nlattr* attr = (struct nlattr*)nlmsg->pos;
  162. attr->nla_len = sizeof(*attr) + size;
  163. attr->nla_type = typ;
  164. if (size > 0)
  165. memcpy(attr + 1, data, size);
  166. nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
  167. }
  168.  
  169. static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type,
  170. int* reply_len, bool dofail)
  171. {
  172. if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
  173. exit(1);
  174. struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  175. hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
  176. struct sockaddr_nl addr;
  177. memset(&addr, 0, sizeof(addr));
  178. addr.nl_family = AF_NETLINK;
  179. ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0,
  180. (struct sockaddr*)&addr, sizeof(addr));
  181. if (n != (ssize_t)hdr->nlmsg_len) {
  182. if (dofail)
  183. exit(1);
  184. return -1;
  185. }
  186. n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  187. if (reply_len)
  188. *reply_len = 0;
  189. if (n < 0) {
  190. if (dofail)
  191. exit(1);
  192. return -1;
  193. }
  194. if (n < (ssize_t)sizeof(struct nlmsghdr)) {
  195. errno = EINVAL;
  196. if (dofail)
  197. exit(1);
  198. return -1;
  199. }
  200. if (hdr->nlmsg_type == NLMSG_DONE)
  201. return 0;
  202. if (reply_len && hdr->nlmsg_type == reply_type) {
  203. *reply_len = n;
  204. return 0;
  205. }
  206. if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
  207. errno = EINVAL;
  208. if (dofail)
  209. exit(1);
  210. return -1;
  211. }
  212. if (hdr->nlmsg_type != NLMSG_ERROR) {
  213. errno = EINVAL;
  214. if (dofail)
  215. exit(1);
  216. return -1;
  217. }
  218. errno = -((struct nlmsgerr*)(hdr + 1))->error;
  219. return -errno;
  220. }
  221.  
  222. static int netlink_query_family_id(struct nlmsg* nlmsg, int sock,
  223. const char* family_name, bool dofail)
  224. {
  225. struct genlmsghdr genlhdr;
  226. memset(&genlhdr, 0, sizeof(genlhdr));
  227. genlhdr.cmd = CTRL_CMD_GETFAMILY;
  228. netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
  229. netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name,
  230. strnlen(family_name, GENL_NAMSIZ - 1) + 1);
  231. int n = 0;
  232. int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
  233. if (err < 0) {
  234. return -1;
  235. }
  236. uint16_t id = 0;
  237. struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN +
  238. NLMSG_ALIGN(sizeof(genlhdr)));
  239. for (; (char*)attr < nlmsg->buf + n;
  240. attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
  241. if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
  242. id = *(uint16_t*)(attr + 1);
  243. break;
  244. }
  245. }
  246. if (!id) {
  247. errno = EINVAL;
  248. return -1;
  249. }
  250. recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  251. return id;
  252. }
  253.  
  254. static long syz_genetlink_get_family_id(volatile long name,
  255. volatile long sock_arg)
  256. {
  257. int fd = sock_arg;
  258. if (fd < 0) {
  259. fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
  260. if (fd == -1) {
  261. return -1;
  262. }
  263. }
  264. struct nlmsg nlmsg_tmp;
  265. int ret = netlink_query_family_id(&nlmsg_tmp, fd, (char*)name, false);
  266. if ((int)sock_arg < 0)
  267. close(fd);
  268. if (ret < 0) {
  269. return -1;
  270. }
  271. return ret;
  272. }
  273.  
  274. #define FS_IOC_SETFLAGS _IOW('f', 2, long)
  275. static void remove_dir(const char* dir)
  276. {
  277. int iter = 0;
  278. DIR* dp = 0;
  279. retry:
  280. while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
  281. }
  282. dp = opendir(dir);
  283. if (dp == NULL) {
  284. if (errno == EMFILE) {
  285. exit(1);
  286. }
  287. exit(1);
  288. }
  289. struct dirent* ep = 0;
  290. while ((ep = readdir(dp))) {
  291. if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
  292. continue;
  293. char filename[FILENAME_MAX];
  294. snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
  295. while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
  296. }
  297. struct stat st;
  298. if (lstat(filename, &st))
  299. exit(1);
  300. if (S_ISDIR(st.st_mode)) {
  301. remove_dir(filename);
  302. continue;
  303. }
  304. int i;
  305. for (i = 0;; i++) {
  306. if (unlink(filename) == 0)
  307. break;
  308. if (errno == EPERM) {
  309. int fd = open(filename, O_RDONLY);
  310. if (fd != -1) {
  311. long flags = 0;
  312. if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
  313. }
  314. close(fd);
  315. continue;
  316. }
  317. }
  318. if (errno == EROFS) {
  319. break;
  320. }
  321. if (errno != EBUSY || i > 100)
  322. exit(1);
  323. if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW))
  324. exit(1);
  325. }
  326. }
  327. closedir(dp);
  328. for (int i = 0;; i++) {
  329. if (rmdir(dir) == 0)
  330. break;
  331. if (i < 100) {
  332. if (errno == EPERM) {
  333. int fd = open(dir, O_RDONLY);
  334. if (fd != -1) {
  335. long flags = 0;
  336. if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
  337. }
  338. close(fd);
  339. continue;
  340. }
  341. }
  342. if (errno == EROFS) {
  343. break;
  344. }
  345. if (errno == EBUSY) {
  346. if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW))
  347. exit(1);
  348. continue;
  349. }
  350. if (errno == ENOTEMPTY) {
  351. if (iter < 100) {
  352. iter++;
  353. goto retry;
  354. }
  355. }
  356. }
  357. exit(1);
  358. }
  359. }
  360.  
  361. static void kill_and_wait(int pid, int* status)
  362. {
  363. kill(-pid, SIGKILL);
  364. kill(pid, SIGKILL);
  365. for (int i = 0; i < 100; i++) {
  366. if (waitpid(-1, status, WNOHANG | __WALL) == pid)
  367. return;
  368. usleep(1000);
  369. }
  370. DIR* dir = opendir("/sys/fs/fuse/connections");
  371. if (dir) {
  372. for (;;) {
  373. struct dirent* ent = readdir(dir);
  374. if (!ent)
  375. break;
  376. if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
  377. continue;
  378. char abort[300];
  379. snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
  380. ent->d_name);
  381. int fd = open(abort, O_WRONLY);
  382. if (fd == -1) {
  383. continue;
  384. }
  385. if (write(fd, abort, 1) < 0) {
  386. }
  387. close(fd);
  388. }
  389. closedir(dir);
  390. } else {
  391. }
  392. while (waitpid(-1, status, __WALL) != pid) {
  393. }
  394. }
  395.  
  396. static void setup_test()
  397. {
  398. prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  399. setpgrp();
  400. write_file("/proc/self/oom_score_adj", "1000");
  401. if (symlink("/dev/binderfs", "./binderfs")) {
  402. }
  403. }
  404.  
  405. static void setup_sysctl()
  406. {
  407. char mypid[32];
  408. snprintf(mypid, sizeof(mypid), "%d", getpid());
  409. struct {
  410. const char* name;
  411. const char* data;
  412. } files[] = {
  413. {"/sys/kernel/debug/x86/nmi_longest_ns", "10000000000"},
  414. {"/proc/sys/kernel/hung_task_check_interval_secs", "20"},
  415. {"/proc/sys/net/core/bpf_jit_kallsyms", "1"},
  416. {"/proc/sys/net/core/bpf_jit_harden", "0"},
  417. {"/proc/sys/kernel/kptr_restrict", "0"},
  418. {"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"},
  419. {"/proc/sys/fs/mount-max", "100"},
  420. {"/proc/sys/vm/oom_dump_tasks", "0"},
  421. {"/proc/sys/debug/exception-trace", "0"},
  422. {"/proc/sys/kernel/printk", "7 4 1 3"},
  423. {"/proc/sys/kernel/keys/gc_delay", "1"},
  424. {"/proc/sys/vm/oom_kill_allocating_task", "1"},
  425. {"/proc/sys/kernel/ctrl-alt-del", "0"},
  426. {"/proc/sys/kernel/cad_pid", mypid},
  427. };
  428. for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
  429. if (!write_file(files[i].name, files[i].data))
  430. printf("write to %s failed: %s\n", files[i].name, strerror(errno));
  431. }
  432. }
  433.  
  434. static void execute_one(void);
  435.  
  436. #define WAIT_FLAGS __WALL
  437.  
  438. static void loop(void)
  439. {
  440. int iter = 0;
  441. for (;; iter++) {
  442. char cwdbuf[32];
  443. sprintf(cwdbuf, "./%d", iter);
  444. if (mkdir(cwdbuf, 0777))
  445. exit(1);
  446. int pid = fork();
  447. if (pid < 0)
  448. exit(1);
  449. if (pid == 0) {
  450. if (chdir(cwdbuf))
  451. exit(1);
  452. setup_test();
  453. execute_one();
  454. exit(0);
  455. }
  456. int status = 0;
  457. uint64_t start = current_time_ms();
  458. for (;;) {
  459. if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
  460. break;
  461. sleep_ms(1);
  462. if (current_time_ms() - start < 5000)
  463. continue;
  464. kill_and_wait(pid, &status);
  465. break;
  466. }
  467. remove_dir(cwdbuf);
  468. }
  469. }
  470.  
  471. uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0};
  472.  
  473. void execute_one(void)
  474. {
  475. intptr_t res = 0;
  476. NONFAILING(memcpy((void*)0x20000000, "/dev/sr0\000", 9));
  477. res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000000ul,
  478. /*flags=O_TRUNC|O_NONBLOCK|O_NOATIME|O_RDWR*/ 0x40a02ul,
  479. /*mode=*/0ul);
  480. if (res != -1)
  481. r[0] = res;
  482. NONFAILING(memcpy((void*)0x200000c0, "IPVS\000", 5));
  483. res = -1;
  484. NONFAILING(res =
  485. syz_genetlink_get_family_id(/*name=*/0x200000c0, /*fd=*/r[0]));
  486. if (res != -1)
  487. r[1] = res;
  488. NONFAILING(*(uint64_t*)0x20000180 = 0x20000080);
  489. NONFAILING(*(uint16_t*)0x20000080 = 0x10);
  490. NONFAILING(*(uint16_t*)0x20000082 = 0);
  491. NONFAILING(*(uint32_t*)0x20000084 = 0);
  492. NONFAILING(*(uint32_t*)0x20000088 = 2);
  493. NONFAILING(*(uint32_t*)0x20000188 = 0xc);
  494. NONFAILING(*(uint64_t*)0x20000190 = 0x20000140);
  495. NONFAILING(*(uint64_t*)0x20000140 = 0x200001c0);
  496. NONFAILING(memset((void*)0x200001c0, 0, 4));
  497. NONFAILING(*(uint16_t*)0x200001c4 = r[1]);
  498. NONFAILING(memcpy(
  499. (void*)0x200001c6,
  500. "\x00\x01\x2b\xbd\x70\x00\xfe\xdb\xdf\x25\x11\x00\x00\x00\x08\x00\x04\x00"
  501. "\x4e\x0f\x00\x00\x08\x00\x04\x00\xff\x0f\x00\x00\x0c\x00\x03\x80\x08\x00"
  502. "\x05\x00\x00\x00\x00\x00\x08\x00\x06\x00\x05\x00\x00\x00",
  503. 50));
  504. NONFAILING(*(uint64_t*)0x20000148 = 0x38);
  505. NONFAILING(*(uint64_t*)0x20000198 = 1);
  506. NONFAILING(*(uint64_t*)0x200001a0 = 0);
  507. NONFAILING(*(uint64_t*)0x200001a8 = 0);
  508. NONFAILING(*(uint32_t*)0x200001b0 = 0x4000000);
  509. syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x20000180ul, /*f=*/0ul);
  510. NONFAILING(*(uint64_t*)0x20000640 = 0);
  511. NONFAILING(*(uint64_t*)0x20000648 = 4);
  512. NONFAILING(*(uint64_t*)0x20000650 = 0xffffffffffffffe1);
  513. NONFAILING(*(uint64_t*)0x20000658 = 0x45c);
  514. NONFAILING(*(uint64_t*)0x20000660 = 0x80);
  515. NONFAILING(*(uint64_t*)0x20000668 = 0x32ce);
  516. NONFAILING(*(uint64_t*)0x20000670 = 0x80000001);
  517. NONFAILING(*(uint32_t*)0x20000678 = 0x20);
  518. NONFAILING(*(uint32_t*)0x2000067c = 3);
  519. NONFAILING(*(uint32_t*)0x20000680 = 0x80000001);
  520. NONFAILING(*(uint32_t*)0x20000684 = 7);
  521. NONFAILING(*(uint64_t*)0x20000688 = 1);
  522. NONFAILING(*(uint64_t*)0x20000690 = 3);
  523. NONFAILING(*(uint64_t*)0x20000698 = 0x800);
  524. NONFAILING(*(uint64_t*)0x200006a0 = 0x80000000);
  525. NONFAILING(*(uint64_t*)0x200006a8 = 8);
  526. NONFAILING(*(uint64_t*)0x200006b0 = 0);
  527. syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc0709411, /*arg=*/0x20000640ul);
  528. res = -1;
  529. NONFAILING(res = syz_genetlink_get_family_id(/*name=*/0, /*fd=*/r[0]));
  530. if (res != -1)
  531. r[2] = res;
  532. NONFAILING(*(uint64_t*)0x20000400 = 0x20000100);
  533. NONFAILING(*(uint16_t*)0x20000100 = 0x10);
  534. NONFAILING(*(uint16_t*)0x20000102 = 0);
  535. NONFAILING(*(uint32_t*)0x20000104 = 0);
  536. NONFAILING(*(uint32_t*)0x20000108 = 0x1000000);
  537. NONFAILING(*(uint32_t*)0x20000408 = 0xc);
  538. NONFAILING(*(uint64_t*)0x20000410 = 0x200003c0);
  539. NONFAILING(*(uint64_t*)0x200003c0 = 0x20000240);
  540. NONFAILING(*(uint32_t*)0x20000240 = 0x174);
  541. NONFAILING(*(uint16_t*)0x20000244 = r[2]);
  542. NONFAILING(*(uint16_t*)0x20000246 = 0x100);
  543. NONFAILING(*(uint32_t*)0x20000248 = 0);
  544. NONFAILING(*(uint32_t*)0x2000024c = 0x25dfdbfd);
  545. NONFAILING(*(uint8_t*)0x20000250 = 7);
  546. NONFAILING(*(uint8_t*)0x20000251 = 0);
  547. NONFAILING(*(uint16_t*)0x20000252 = 0);
  548. NONFAILING(*(uint16_t*)0x20000254 = 0xb0);
  549. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000256, 2, 0, 14));
  550. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000257, 0, 6, 1));
  551. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000257, 1, 7, 1));
  552. NONFAILING(*(uint16_t*)0x20000258 = 4);
  553. NONFAILING(*(uint16_t*)0x2000025a = 4);
  554. NONFAILING(*(uint16_t*)0x2000025c = 0x3c);
  555. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000025e, 3, 0, 14));
  556. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000025f, 0, 6, 1));
  557. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000025f, 1, 7, 1));
  558. NONFAILING(*(uint16_t*)0x20000260 = 8);
  559. NONFAILING(*(uint16_t*)0x20000262 = 2);
  560. NONFAILING(*(uint32_t*)0x20000264 = 0x81);
  561. NONFAILING(*(uint16_t*)0x20000268 = 8);
  562. NONFAILING(*(uint16_t*)0x2000026a = 2);
  563. NONFAILING(*(uint32_t*)0x2000026c = 0x1ff);
  564. NONFAILING(*(uint16_t*)0x20000270 = 8);
  565. NONFAILING(*(uint16_t*)0x20000272 = 2);
  566. NONFAILING(*(uint32_t*)0x20000274 = 7);
  567. NONFAILING(*(uint16_t*)0x20000278 = 8);
  568. NONFAILING(*(uint16_t*)0x2000027a = 2);
  569. NONFAILING(*(uint32_t*)0x2000027c = 0x79df);
  570. NONFAILING(*(uint16_t*)0x20000280 = 8);
  571. NONFAILING(*(uint16_t*)0x20000282 = 2);
  572. NONFAILING(*(uint32_t*)0x20000284 = 7);
  573. NONFAILING(*(uint16_t*)0x20000288 = 8);
  574. NONFAILING(*(uint16_t*)0x2000028a = 2);
  575. NONFAILING(*(uint32_t*)0x2000028c = 8);
  576. NONFAILING(*(uint16_t*)0x20000290 = 8);
  577. NONFAILING(*(uint16_t*)0x20000292 = 2);
  578. NONFAILING(*(uint32_t*)0x20000294 = 0x1000);
  579. NONFAILING(*(uint16_t*)0x20000298 = 8);
  580. NONFAILING(*(uint16_t*)0x2000029a = 1);
  581. NONFAILING(*(uint32_t*)0x2000029c = 9);
  582. NONFAILING(*(uint16_t*)0x200002a0 = 8);
  583. NONFAILING(*(uint16_t*)0x200002a2 = 2);
  584. NONFAILING(*(uint32_t*)0x200002a4 = 0xdcb);
  585. NONFAILING(*(uint16_t*)0x200002a8 = 4);
  586. NONFAILING(*(uint16_t*)0x200002aa = 4);
  587. NONFAILING(*(uint16_t*)0x200002ac = 8);
  588. NONFAILING(*(uint16_t*)0x200002ae = 1);
  589. NONFAILING(*(uint32_t*)0x200002b0 = 0x7f);
  590. NONFAILING(*(uint16_t*)0x200002b4 = 0x3c);
  591. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x200002b6, 3, 0, 14));
  592. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x200002b7, 0, 6, 1));
  593. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x200002b7, 1, 7, 1));
  594. NONFAILING(*(uint16_t*)0x200002b8 = 8);
  595. NONFAILING(*(uint16_t*)0x200002ba = 2);
  596. NONFAILING(*(uint32_t*)0x200002bc = 2);
  597. NONFAILING(*(uint16_t*)0x200002c0 = 8);
  598. NONFAILING(*(uint16_t*)0x200002c2 = 2);
  599. NONFAILING(*(uint32_t*)0x200002c4 = 6);
  600. NONFAILING(*(uint16_t*)0x200002c8 = 8);
  601. NONFAILING(*(uint16_t*)0x200002ca = 1);
  602. NONFAILING(*(uint32_t*)0x200002cc = 6);
  603. NONFAILING(*(uint16_t*)0x200002d0 = 8);
  604. NONFAILING(*(uint16_t*)0x200002d2 = 1);
  605. NONFAILING(*(uint32_t*)0x200002d4 = 0x238);
  606. NONFAILING(*(uint16_t*)0x200002d8 = 8);
  607. NONFAILING(*(uint16_t*)0x200002da = 1);
  608. NONFAILING(*(uint32_t*)0x200002dc = 8);
  609. NONFAILING(*(uint16_t*)0x200002e0 = 8);
  610. NONFAILING(*(uint16_t*)0x200002e2 = 1);
  611. NONFAILING(*(uint32_t*)0x200002e4 = 0xa2);
  612. NONFAILING(*(uint16_t*)0x200002e8 = 8);
  613. NONFAILING(*(uint16_t*)0x200002ea = 1);
  614. NONFAILING(*(uint32_t*)0x200002ec = 0x81);
  615. NONFAILING(*(uint16_t*)0x200002f0 = 8);
  616. NONFAILING(*(uint16_t*)0x200002f2 = 2);
  617. NONFAILING(*(uint32_t*)0x200002f4 = 5);
  618. NONFAILING(*(uint16_t*)0x200002f8 = 4);
  619. NONFAILING(*(uint16_t*)0x200002fa = 4);
  620. NONFAILING(*(uint16_t*)0x200002fc = 8);
  621. NONFAILING(*(uint16_t*)0x200002fe = 2);
  622. NONFAILING(*(uint32_t*)0x20000300 = 1);
  623. NONFAILING(*(uint16_t*)0x20000304 = 0xc);
  624. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000306, 6, 0, 14));
  625. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000307, 0, 6, 1));
  626. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000307, 1, 7, 1));
  627. NONFAILING(*(uint16_t*)0x20000308 = 4);
  628. NONFAILING(*(uint16_t*)0x2000030a = 3);
  629. NONFAILING(*(uint16_t*)0x2000030c = 4);
  630. NONFAILING(*(uint16_t*)0x2000030e = 2);
  631. NONFAILING(*(uint16_t*)0x20000310 = 0x24);
  632. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000312, 4, 0, 14));
  633. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000313, 0, 6, 1));
  634. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000313, 1, 7, 1));
  635. NONFAILING(*(uint16_t*)0x20000314 = 0x13);
  636. NONFAILING(*(uint16_t*)0x20000316 = 1);
  637. NONFAILING(memcpy((void*)0x20000318, "broadcast-link\000", 15));
  638. NONFAILING(*(uint16_t*)0x20000328 = 9);
  639. NONFAILING(*(uint16_t*)0x2000032a = 1);
  640. NONFAILING(memcpy((void*)0x2000032c, "syz1\000", 5));
  641. NONFAILING(*(uint16_t*)0x20000334 = 8);
  642. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000336, 6, 0, 14));
  643. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000337, 0, 6, 1));
  644. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000337, 1, 7, 1));
  645. NONFAILING(*(uint16_t*)0x20000338 = 4);
  646. NONFAILING(*(uint16_t*)0x2000033a = 2);
  647. NONFAILING(*(uint16_t*)0x2000033c = 0x78);
  648. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000033e, 2, 0, 14));
  649. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000033f, 0, 6, 1));
  650. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x2000033f, 1, 7, 1));
  651. NONFAILING(*(uint16_t*)0x20000340 = 0x54);
  652. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000342, 3, 0, 14));
  653. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000343, 0, 6, 1));
  654. NONFAILING(STORE_BY_BITMASK(uint16_t, , 0x20000343, 1, 7, 1));
  655. NONFAILING(*(uint16_t*)0x20000344 = 8);
  656. NONFAILING(*(uint16_t*)0x20000346 = 1);
  657. NONFAILING(*(uint32_t*)0x20000348 = 8);
  658. NONFAILING(*(uint16_t*)0x2000034c = 8);
  659. NONFAILING(*(uint16_t*)0x2000034e = 2);
  660. NONFAILING(*(uint32_t*)0x20000350 = 0);
  661. NONFAILING(*(uint16_t*)0x20000354 = 8);
  662. NONFAILING(*(uint16_t*)0x20000356 = 1);
  663. NONFAILING(*(uint32_t*)0x20000358 = 7);
  664. NONFAILING(*(uint16_t*)0x2000035c = 8);
  665. NONFAILING(*(uint16_t*)0x2000035e = 1);
  666. NONFAILING(*(uint32_t*)0x20000360 = 3);
  667. NONFAILING(*(uint16_t*)0x20000364 = 8);
  668. NONFAILING(*(uint16_t*)0x20000366 = 2);
  669. NONFAILING(*(uint32_t*)0x20000368 = 0);
  670. NONFAILING(*(uint16_t*)0x2000036c = 8);
  671. NONFAILING(*(uint16_t*)0x2000036e = 1);
  672. NONFAILING(*(uint32_t*)0x20000370 = 0);
  673. NONFAILING(*(uint16_t*)0x20000374 = 8);
  674. NONFAILING(*(uint16_t*)0x20000376 = 2);
  675. NONFAILING(*(uint32_t*)0x20000378 = 0);
  676. NONFAILING(*(uint16_t*)0x2000037c = 8);
  677. NONFAILING(*(uint16_t*)0x2000037e = 2);
  678. NONFAILING(*(uint32_t*)0x20000380 = 0xb);
  679. NONFAILING(*(uint16_t*)0x20000384 = 8);
  680. NONFAILING(*(uint16_t*)0x20000386 = 2);
  681. NONFAILING(*(uint32_t*)0x20000388 = 4);
  682. NONFAILING(*(uint16_t*)0x2000038c = 8);
  683. NONFAILING(*(uint16_t*)0x2000038e = 2);
  684. NONFAILING(*(uint32_t*)0x20000390 = 3);
  685. NONFAILING(*(uint16_t*)0x20000394 = 8);
  686. NONFAILING(*(uint16_t*)0x20000396 = 1);
  687. NONFAILING(*(uint32_t*)0x20000398 = 4);
  688. NONFAILING(*(uint16_t*)0x2000039c = 4);
  689. NONFAILING(*(uint16_t*)0x2000039e = 4);
  690. NONFAILING(*(uint16_t*)0x200003a0 = 8);
  691. NONFAILING(*(uint16_t*)0x200003a2 = 1);
  692. NONFAILING(*(uint32_t*)0x200003a4 = 0xe1);
  693. NONFAILING(*(uint16_t*)0x200003a8 = 4);
  694. NONFAILING(*(uint16_t*)0x200003aa = 4);
  695. NONFAILING(*(uint16_t*)0x200003ac = 8);
  696. NONFAILING(*(uint16_t*)0x200003ae = 1);
  697. NONFAILING(*(uint32_t*)0x200003b0 = 7);
  698. NONFAILING(*(uint64_t*)0x200003c8 = 0x174);
  699. NONFAILING(*(uint64_t*)0x20000418 = 1);
  700. NONFAILING(*(uint64_t*)0x20000420 = 0);
  701. NONFAILING(*(uint64_t*)0x20000428 = 0);
  702. NONFAILING(*(uint32_t*)0x20000430 = 0x800);
  703. syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x20000400ul,
  704. /*f=MSG_ZEROCOPY|MSG_FASTOPEN*/ 0x24000000ul);
  705. NONFAILING(*(uint8_t*)0x20000040 = 0);
  706. NONFAILING(memcpy((void*)0x20000041, "freezer", 7));
  707. NONFAILING(*(uint8_t*)0x20000048 = 0x20);
  708. syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x20000040ul, /*len=*/0xfffffec2ul);
  709. }
  710. int main(void)
  711. {
  712. syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  713. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  714. /*offset=*/0ul);
  715. syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul,
  716. /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
  717. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  718. /*offset=*/0ul);
  719. syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  720. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  721. /*offset=*/0ul);
  722. setup_sysctl();
  723. install_segv_handler();
  724. for (procid = 0; procid < 3; procid++) {
  725. if (fork() == 0) {
  726. use_temporary_dir();
  727. loop();
  728. }
  729. }
  730. sleep(1000000);
  731. return 0;
  732. }
  733.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!