API tools faq
paste
Advertisement
xiaoy1

Untitled

xiaoy1
May 19th, 2025
34
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 20.82 KB | None | 0 0
raw download clone embed print report
  1. // autogenerated by syzkaller (https://github.com/google/syzkaller)
  2.  
  3. #define _GNU_SOURCE
  4.  
  5. #include <endian.h>
  6. #include <fcntl.h>
  7. #include <stdint.h>
  8. #include <stdio.h>
  9. #include <stdlib.h>
  10. #include <string.h>
  11. #include <sys/stat.h>
  12. #include <sys/syscall.h>
  13. #include <sys/types.h>
  14. #include <unistd.h>
  15. #ifndef __NR_membarrier
  16. #define __NR_membarrier 324
  17. #endif
  18.  
  19. #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
  20. #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \
  21. *(type*)(addr) = \
  22. htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \
  23. (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
  24.  
  25. static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
  26. {
  27. if (a0 == 0xc || a0 == 0xb) {
  28. char buf[128];
  29. sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
  30. (uint8_t)a2);
  31. return open(buf, O_RDWR, 0);
  32. } else {
  33. char buf[1024];
  34. char* hash;
  35. strncpy(buf, (char*)a0, sizeof(buf) - 1);
  36. buf[sizeof(buf) - 1] = 0;
  37. while ((hash = strchr(buf, '#'))) {
  38. *hash = '0' + (char)(a1 % 10);
  39. a1 /= 10;
  40. }
  41. return open(buf, a2, 0);
  42. }
  43. }
  44. static long syz_sysconfig_set__proc_sys_vm_percpu_pagelist_high_fraction(volatile long val)
  45. {
  46. char command[256];
  47. sprintf(command, "echo %ld > /proc/sys/vm/percpu_pagelist_high_fraction", val);
  48. int ret = system(command);
  49. if (ret != 0) {
  50. return 0;
  51. }
  52. return 0;
  53. }
  54. static long syz_sysconfig_reset__proc_sys_vm_percpu_pagelist_high_fraction()
  55. {
  56. char command[256];
  57. sprintf(command, "echo 0 > /proc/sys/vm/percpu_pagelist_high_fraction");
  58. int ret = system(command);
  59. if (ret != 0) {
  60. return 0;
  61. }
  62. return 0;
  63. }
  64. static long syz_sysconfig_set__proc_sys_vm_numa_stat(volatile long val)
  65. {
  66. char command[256];
  67. sprintf(command, "echo %ld > /proc/sys/vm/numa_stat", val);
  68. int ret = system(command);
  69. if (ret != 0) {
  70. return 0;
  71. }
  72. return 0;
  73. }
  74.  
  75. static long syz_sysconfig_reset__proc_sys_vm_numa_stat()
  76. {
  77. char command[256];
  78. sprintf(command, "echo 1 > /proc/sys/vm/numa_stat");
  79. int ret = system(command);
  80. if (ret != 0) {
  81. return 0;
  82. }
  83. return 0;
  84. }
  85. uint64_t r[10] = {0xffffffffffffffff,
  86. 0xffffffffffffffff,
  87. 0xffffffffffffffff,
  88. 0xffffffffffffffff,
  89. 0xffffffffffffffff,
  90. 0xffffffffffffffff,
  91. 0x0,
  92. 0xffffffffffffffff,
  93. 0xffffffffffffffff,
  94. 0xffffffffffffffff};
  95.  
  96. int main(void)
  97. {
  98. syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  99. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  100. /*offset=*/0ul);
  101. syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul,
  102. /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
  103. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  104. /*offset=*/0ul);
  105. syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
  106. /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
  107. /*offset=*/0ul);
  108. intptr_t res = 0;
  109. res = syscall(__NR_pipe, /*pipefd=*/0x20000180ul);
  110. if (res != -1) {
  111. r[0] = *(uint32_t*)0x20000180;
  112. r[1] = *(uint32_t*)0x20000184;
  113. }
  114. memcpy((void*)0x20000000, "\x24\x00\x00\x00\x52\x00\x1f", 7);
  115. syscall(__NR_write, /*fd=*/-1, /*buf=*/0x20000000ul, /*count=*/7ul);
  116. syz_sysconfig_set__proc_sys_vm_percpu_pagelist_high_fraction(/*val=*/0x800);
  117. syscall(__NR_write, /*fd=*/r[1], /*data=*/0x20000000ul, /*len=*/0xfffffeccul);
  118. res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=SOCK_DGRAM*/ 2ul,
  119. /*proto=*/0);
  120. if (res != -1)
  121. r[2] = res;
  122. *(uint16_t*)0x20000240 = 2;
  123. *(uint64_t*)0x20000248 = 0x20000080;
  124. *(uint16_t*)0x20000080 = 0x40;
  125. *(uint8_t*)0x20000082 = 0;
  126. *(uint8_t*)0x20000083 = 0;
  127. *(uint32_t*)0x20000084 = 0xfff00001;
  128. *(uint16_t*)0x20000088 = 0x16;
  129. *(uint8_t*)0x2000008a = 0;
  130. *(uint8_t*)0x2000008b = 0;
  131. *(uint32_t*)0x2000008c = 0;
  132. syscall(__NR_setsockopt, /*fd=*/r[2], /*level=*/1, /*optname=*/0x1a,
  133. /*optval=*/0x20000240ul, /*optlen=*/0x10ul);
  134. syscall(__NR_splice, /*fdin=*/r[0], /*offin=*/0ul, /*fdout=*/r[2],
  135. /*offout=*/0ul, /*len=*/0x8000000004ffe0ul, /*f=*/0ul);
  136. *(uint32_t*)0x20000080 = 5;
  137. *(uint32_t*)0x20000084 = 0x80;
  138. *(uint8_t*)0x20000088 = 3;
  139. *(uint8_t*)0x20000089 = 0;
  140. *(uint8_t*)0x2000008a = 8;
  141. *(uint8_t*)0x2000008b = 0x9e;
  142. *(uint32_t*)0x2000008c = 0;
  143. *(uint64_t*)0x20000090 = 0;
  144. *(uint64_t*)0x20000098 = 8;
  145. *(uint64_t*)0x200000a0 = 0;
  146. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 0, 1);
  147. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 1, 1);
  148. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 2, 1);
  149. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 3, 1);
  150. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 4, 1);
  151. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 5, 1);
  152. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 6, 1);
  153. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 7, 1);
  154. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 8, 1);
  155. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 9, 1);
  156. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 10, 1);
  157. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 11, 1);
  158. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 12, 1);
  159. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 13, 1);
  160. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 14, 1);
  161. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 15, 2);
  162. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 17, 1);
  163. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 18, 1);
  164. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 19, 1);
  165. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 20, 1);
  166. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 21, 1);
  167. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 22, 1);
  168. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 23, 1);
  169. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 24, 1);
  170. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 25, 1);
  171. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 26, 1);
  172. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 27, 1);
  173. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 28, 1);
  174. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 29, 1);
  175. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 30, 1);
  176. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 31, 1);
  177. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 32, 1);
  178. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 33, 1);
  179. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 34, 1);
  180. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 35, 1);
  181. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 36, 1);
  182. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 37, 1);
  183. STORE_BY_BITMASK(uint64_t, , 0x200000a8, 0, 38, 26);
  184. *(uint32_t*)0x200000b0 = 0;
  185. *(uint32_t*)0x200000b4 = 1;
  186. *(uint64_t*)0x200000b8 = 0x20000000;
  187. *(uint64_t*)0x200000c0 = 0;
  188. *(uint64_t*)0x200000c8 = 0x10823;
  189. *(uint64_t*)0x200000d0 = 0;
  190. *(uint32_t*)0x200000d8 = 0;
  191. *(uint32_t*)0x200000dc = 3;
  192. *(uint64_t*)0x200000e0 = 0x100000000;
  193. *(uint32_t*)0x200000e8 = 0;
  194. *(uint16_t*)0x200000ec = 0x400;
  195. *(uint16_t*)0x200000ee = 0;
  196. *(uint32_t*)0x200000f0 = 0;
  197. *(uint32_t*)0x200000f4 = 0;
  198. *(uint64_t*)0x200000f8 = 0;
  199. res = syscall(__NR_perf_event_open, /*attr=*/0x20000080ul, /*pid=*/0,
  200. /*cpu=*/-1, /*group=*/-1, /*flags=*/0ul);
  201. if (res != -1)
  202. r[3] = res;
  203. *(uint32_t*)0x2025c000 = 1;
  204. *(uint32_t*)0x2025c004 = 0x70;
  205. *(uint8_t*)0x2025c008 = 0;
  206. *(uint8_t*)0x2025c009 = 0;
  207. *(uint8_t*)0x2025c00a = 0;
  208. *(uint8_t*)0x2025c00b = 0;
  209. *(uint32_t*)0x2025c00c = 0;
  210. *(uint64_t*)0x2025c010 = 0;
  211. *(uint64_t*)0x2025c018 = 0;
  212. *(uint64_t*)0x2025c020 = 0;
  213. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 0, 1);
  214. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 1, 1);
  215. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 2, 1);
  216. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 3, 1);
  217. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 4, 1);
  218. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 5, 1);
  219. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 6, 1);
  220. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 7, 1);
  221. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 8, 1);
  222. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 9, 1);
  223. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 10, 1);
  224. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 11, 1);
  225. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 12, 1);
  226. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 13, 1);
  227. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 14, 1);
  228. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 15, 2);
  229. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 17, 1);
  230. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 18, 1);
  231. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 19, 1);
  232. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 20, 1);
  233. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 21, 1);
  234. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 22, 1);
  235. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 23, 1);
  236. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 24, 1);
  237. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 25, 1);
  238. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 26, 1);
  239. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 27, 1);
  240. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 28, 1);
  241. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 29, 1);
  242. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 30, 1);
  243. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 31, 1);
  244. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 32, 1);
  245. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 33, 1);
  246. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 34, 1);
  247. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 35, 1);
  248. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 36, 1);
  249. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 37, 1);
  250. STORE_BY_BITMASK(uint64_t, , 0x2025c028, 0, 38, 26);
  251. *(uint32_t*)0x2025c030 = 0;
  252. *(uint32_t*)0x2025c034 = 0;
  253. *(uint64_t*)0x2025c038 = 0x20000000;
  254. *(uint64_t*)0x2025c040 = 0;
  255. *(uint64_t*)0x2025c048 = 0;
  256. *(uint64_t*)0x2025c050 = 0;
  257. *(uint32_t*)0x2025c058 = 0;
  258. *(uint32_t*)0x2025c05c = 0;
  259. *(uint64_t*)0x2025c060 = 0;
  260. *(uint32_t*)0x2025c068 = 0;
  261. *(uint16_t*)0x2025c06c = 0;
  262. *(uint16_t*)0x2025c06e = 0;
  263. *(uint32_t*)0x2025c070 = 0;
  264. *(uint32_t*)0x2025c074 = 0;
  265. *(uint64_t*)0x2025c078 = 0;
  266. syscall(__NR_perf_event_open, /*attr=*/0x2025c000ul, /*pid=*/0, /*cpu=*/-1,
  267. /*group=*/r[3], /*flags=*/0ul);
  268. *(uint32_t*)0x2001d000 = 1;
  269. *(uint32_t*)0x2001d004 = 0x70;
  270. *(uint8_t*)0x2001d008 = 0;
  271. *(uint8_t*)0x2001d009 = 0;
  272. *(uint8_t*)0x2001d00a = 0;
  273. *(uint8_t*)0x2001d00b = 0;
  274. *(uint32_t*)0x2001d00c = 0;
  275. *(uint64_t*)0x2001d010 = 0;
  276. *(uint64_t*)0x2001d018 = 0;
  277. *(uint64_t*)0x2001d020 = 0;
  278. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 0, 1);
  279. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 1, 1);
  280. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 2, 1);
  281. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 3, 1);
  282. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 4, 1);
  283. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 5, 1);
  284. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 6, 1);
  285. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 7, 1);
  286. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 8, 1);
  287. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 9, 1);
  288. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 10, 1);
  289. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 11, 1);
  290. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 12, 1);
  291. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 13, 1);
  292. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 14, 1);
  293. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 15, 2);
  294. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 17, 1);
  295. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 18, 1);
  296. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 19, 1);
  297. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 20, 1);
  298. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 21, 1);
  299. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 22, 1);
  300. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 23, 1);
  301. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 24, 1);
  302. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 25, 1);
  303. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 26, 1);
  304. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 27, 1);
  305. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 28, 1);
  306. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 29, 1);
  307. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 30, 1);
  308. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 31, 1);
  309. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 32, 1);
  310. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 33, 1);
  311. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 34, 1);
  312. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 35, 1);
  313. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 36, 1);
  314. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 37, 1);
  315. STORE_BY_BITMASK(uint64_t, , 0x2001d028, 0, 38, 26);
  316. *(uint32_t*)0x2001d030 = 0;
  317. *(uint32_t*)0x2001d034 = 0;
  318. *(uint64_t*)0x2001d038 = 0x20000000;
  319. *(uint64_t*)0x2001d040 = 0;
  320. *(uint64_t*)0x2001d048 = 0;
  321. *(uint64_t*)0x2001d050 = 0;
  322. *(uint32_t*)0x2001d058 = 0;
  323. *(uint32_t*)0x2001d05c = 0;
  324. *(uint64_t*)0x2001d060 = 0;
  325. *(uint32_t*)0x2001d068 = 0;
  326. *(uint16_t*)0x2001d06c = 0;
  327. *(uint16_t*)0x2001d06e = 0;
  328. *(uint32_t*)0x2001d070 = 0;
  329. *(uint32_t*)0x2001d074 = 0;
  330. *(uint64_t*)0x2001d078 = 0;
  331. res = syscall(__NR_perf_event_open, /*attr=*/0x2001d000ul, /*pid=*/0,
  332. /*cpu=*/-1, /*group=*/r[3], /*flags=*/0ul);
  333. if (res != -1)
  334. r[4] = res;
  335. syscall(__NR_dup3, /*oldfd=*/r[4], /*newfd=*/r[3], /*flags=*/0ul);
  336. syz_sysconfig_reset__proc_sys_vm_percpu_pagelist_high_fraction();
  337. res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_STREAM*/ 1ul,
  338. /*proto=*/0);
  339. if (res != -1)
  340. r[5] = res;
  341. res = syscall(__NR_io_setup, /*n=*/8, /*ctx=*/0x20000180ul);
  342. if (res != -1)
  343. r[6] = *(uint64_t*)0x20000180;
  344. res = syscall(__NR_fcntl, /*fd=*/-1, /*cmd=*/0ul, /*arg=*/r[5]);
  345. if (res != -1)
  346. r[7] = res;
  347. memcpy((void*)0x20000000, "/dev/loop#\000", 11);
  348. res = -1;
  349. res = syz_open_dev(/*dev=*/0x20000000, /*id=*/0, /*flags=*/0);
  350. if (res != -1)
  351. r[8] = res;
  352. syscall(__NR_epoll_create, /*size=*/0x15cfcc4f);
  353. memcpy((void*)0x20000040, "/\351%\000", 4);
  354. *(uint64_t*)0x20000080 = 0xffffffffffffffd5;
  355. *(uint64_t*)0x20000088 = 0x2698;
  356. *(uint64_t*)0x20000090 = 0xffffffff80000001;
  357. *(uint64_t*)0x20000098 = 2;
  358. memset((void*)0x200000a0, 0, 32);
  359. res = syscall(__NR_mq_open, /*name=*/0x20000040ul, /*flags=O_CREAT*/ 0x40ul,
  360. /*mode=S_IWGRP*/ 0x10ul, /*attr=*/0x20000080ul);
  361. if (res != -1)
  362. r[9] = res;
  363. *(uint64_t*)0x20000580 = 0x200000c0;
  364. *(uint64_t*)0x200000c0 = 0;
  365. *(uint32_t*)0x200000c8 = 0;
  366. *(uint32_t*)0x200000cc = 0;
  367. *(uint16_t*)0x200000d0 = 7;
  368. *(uint16_t*)0x200000d2 = 6;
  369. *(uint32_t*)0x200000d4 = r[9];
  370. *(uint64_t*)0x200000d8 = 0x200001c0;
  371. memcpy((void*)0x200001c0,
  372. "\x43\x5c\xd5\xbe\xe3\xff\x82\xca\x72\xee\xc5\xae\x0d\x3d\xb8\x96\xb2"
  373. "\x74\x77\x4e\x46\xa1\xb5\x43\xe1\x90\x0a\xd9\xce\xbb\x10\x2c\x39\xd0"
  374. "\xfc\x9a\x46\x91\x63\xe5\x14\x5f\x82\x31\x21\xef\x75\x83\x53\x4d\x5b"
  375. "\xd7\xf9\x59\xa7\x56\x4b\xe4\xb5\x0a\x62\xa7\x57\x05\xb2\xba\xf1\xaa"
  376. "\x1e\xb2\x02\xf1\x86\x86\x30\x3e\x85\x4a\x73\x60\x58\x16\x1a\x18\x6a"
  377. "\xd0\xea\x46\x69\xb4\xe2\x1b\x0f\xe7\xdd\x9c\xad\x9f\x24\xf2\xc0\x02"
  378. "\x50\x7f\x78\x42\x9a\xab\xaf\xd2\x83\xa2\xbf\x72\xf1\x5f\x04\x61\x49"
  379. "\xcd\x8e\x05\x11\x6b\xb4\x54\x99\xe5\xfc\xf0\xcf\x11\x95\xc7\xac\xf5"
  380. "\x75\x3b\xce\x2e\x61\xb2\xde\x42\x78\x71\x20\x77\x17\x74\xa2\x3a\x8e"
  381. "\x1a\xc7\x05\x23\xe5\x8a\x3d\x1a\xfc\xc3\x9b\x94\xe3\xd3\x2b\x79\x3c"
  382. "\x13\x50\xa4\x28\x8d\x8c\x6a\xa5\xef\x98\xaa\x81\x8a\x49\x43\x0f\xf3"
  383. "\x15\xe2\x24\xfe\xd8\x4f\x5f\x91\xee\x60\x84\x1c\x3a\x1d\x45\x95",
  384. 203);
  385. *(uint64_t*)0x200000e0 = 0xcb;
  386. *(uint64_t*)0x200000e8 = 0x100000001;
  387. *(uint64_t*)0x200000f0 = 0;
  388. *(uint32_t*)0x200000f8 = 2;
  389. *(uint32_t*)0x200000fc = r[7];
  390. *(uint64_t*)0x20000588 = 0x20000100;
  391. *(uint64_t*)0x20000100 = 0;
  392. *(uint32_t*)0x20000108 = 0;
  393. *(uint32_t*)0x2000010c = 0;
  394. *(uint16_t*)0x20000110 = 7;
  395. *(uint16_t*)0x20000112 = 8;
  396. *(uint32_t*)0x20000114 = r[5];
  397. *(uint64_t*)0x20000118 = 0x200002c0;
  398. memcpy((void*)0x200002c0,
  399. "\x1d\x3c\x5c\x40\xf0\xc3\x24\x6b\x3a\x04\x79\xb7\x77\x6b\xe1\xaa\xfc"
  400. "\x81\xeb\x5c\xda\xe8\xb2\x9d\x56\x19\xc2\xd5\x8e\xd5\xec\x87\xf1\x71"
  401. "\xcc\x95\x08\x49\x7c\x0c\x2d\xa3\x9f\x83\xa4\x62\x01\x7d\x91\xd0\x15"
  402. "\x54\x3e\x3e\x5e\x6b\x69\xe4\x51\x1e\xab\x23\x96\xf0\x19\x18\xc3\x61"
  403. "\xb3\xbd\xb3\x37\x1d\xdd\x71\x49\x31\x64\x54\x1e\xb0\x40\x86\x74\xa4"
  404. "\x01\xd2\xb8\x23\x77\xe1\xf9\x63\x23\x08\x26\xb8\x8a\xfd\x96\x1c\xb7"
  405. "\x9d\x4d\x55\xe1\x1d\x5e\x28\x44\x82\xbe\x81\xe5\x20\xb3\xa2\xff\xa9"
  406. "\xc9\xd4\x16\x00\x14\xcb\x39\xb3\xdd\xea\x2a\x97\x18\x1c\xa2\x75\x18"
  407. "\x6a\xa1\xfa\x9e\x6a\x69\xc9\xd6\x5c\x14\xdc",
  408. 147);
  409. *(uint64_t*)0x20000120 = 0x93;
  410. *(uint64_t*)0x20000128 = 7;
  411. *(uint64_t*)0x20000130 = 0;
  412. *(uint32_t*)0x20000138 = 0;
  413. *(uint32_t*)0x2000013c = r[7];
  414. *(uint64_t*)0x20000590 = 0x20000140;
  415. *(uint64_t*)0x20000140 = 0;
  416. *(uint32_t*)0x20000148 = 0;
  417. *(uint32_t*)0x2000014c = 0;
  418. *(uint16_t*)0x20000150 = 0xa;
  419. *(uint16_t*)0x20000152 = 8;
  420. *(uint32_t*)0x20000154 = r[7];
  421. *(uint64_t*)0x20000158 = 0x20000380;
  422. memcpy((void*)0x20000380,
  423. "\xac\x38\x28\x14\xef\xab\xb0\x77\x2e\x3e\xd4\x3f\x47\xe7\xf0\x38\x01"
  424. "\x09\xf0\x5f\x9c\x84\x40\x30\xb8\x97\x0b\x65\xa9\x55\x37\x16\x20\xab"
  425. "\x5e\x88\xad\x75\xe4\xe0\x84\x2b\x6f\x0b\x66\x62\x01\x12\xaf\x2e\x27"
  426. "\x18\xfa\xa7\x25\xcc\xb0\xd5\xf7\x28\xb4\x4a\xa3\x61\xd0\x44\x83\x5a"
  427. "\x90\x06\x30\x33\x51\x00\x09\xa8\xfb\x64\x20\xc0\xa1\x10\x9e\x16\xad"
  428. "\xc7\x15\x4b\x84\x01\x0b\xa9\x69\x85\xfa\x6d\xf4\x8f\x49\x40\x69\xbc"
  429. "\x93\xe4\xde\xe4\x19\x4b\x26\x67\xf7\x1e\x2b\xe4\x50\x66\xf6\x8d\xf7"
  430. "\xf0\xdd\x47\x0e\xf7\xbc\xb7\x8b\x9a\x15\x58\x17\x51\x3e\x68\x0c\xa8"
  431. "\xfd\x48\xd9\x12\x5d\xa0\xbe\x96\x77\x5c\x1b\xc2\xbb\x90\x2e\xe8\x60"
  432. "\x25\x3e\x63\x56\x53\x8c\x29\xaa\x11\xdd\xce\xcf\xa8\xdb\xa3\x35\xb1"
  433. "\x0c\x9b\xf8\x7d\xde\x2a\x9e\xfc\x80\x4d\x9f\xdc\x63\xa6\xd2\x99\xa7"
  434. "\x4f\xac\xa4\x59\x6f\x34\x00\xca\x58\x6b\xa4\xc9\xfa\xc6\x9f\x12\xef"
  435. "\xf9\x81\x5e\x10\xd5\x03\xa5\x13\x9a\x5a\x5d\x9d\x98\xf2\x49\xad\xc9"
  436. "\x3a\x0c\x18\xf9\x6c\xb8\xfd\xd1\x98\xc4\x10\x1f\x22\x40\xca\xe6\x58"
  437. "\xde\xf0\x29\x5c\xe5\x99\xdf\x3c\x63\x51\xb7\x2e\xdd\xae\xcc\x65\x58",
  438. 255);
  439. *(uint64_t*)0x20000160 = 0xff;
  440. *(uint64_t*)0x20000168 = 9;
  441. *(uint64_t*)0x20000170 = 0;
  442. *(uint32_t*)0x20000178 = 0;
  443. *(uint32_t*)0x2000017c = -1;
  444. *(uint64_t*)0x20000598 = 0x20000540;
  445. *(uint64_t*)0x20000540 = 0;
  446. *(uint32_t*)0x20000548 = 0;
  447. *(uint32_t*)0x2000054c = 0;
  448. *(uint16_t*)0x20000550 = 0;
  449. *(uint16_t*)0x20000552 = 2;
  450. *(uint32_t*)0x20000554 = r[8];
  451. *(uint64_t*)0x20000558 = 0x20000480;
  452. memcpy(
  453. (void*)0x20000480,
  454. "\x01\xf7\xa7\x80\x6e\xea\xf7\xba\x74\xdb\xc0\x7b\xe1\xbe\xa0\xe6\x89\xfd"
  455. "\x47\x9c\x1c\xd1\x5e\xaa\xd0\xfc\x1c\x9b\x2d\x99\x42\x3d\x91\xd5\xf9\x67"
  456. "\x3d\x3a\xc8\x15\xe0\x55\x27\xa0\x48\x8f\x11\x1c\xc8\x06\x3e\xf0\xbf\x2d"
  457. "\xd8\x2f\x2e\x9f\xeb\x41\x46\xf5\x24\xe9\x04\x5f\xcb\x3c\x1c\xf9\xa0\x8d"
  458. "\xad\x4d\x0c\xb5\x8d\xaf\x58\x49\x9f\x95\xc8\x10\xfe\xbe\x4b\xaa\xf9\x46"
  459. "\x43\xee\xda\x2e\xca\x40\xaf\x1f\xfc\x2a\xaf\x9e\x48\x45\x54\xd1\x15\xe8"
  460. "\x82\x6b\x2b\xdf\x44\x66\x19\xc9\x02\x46\x48\xab\x96\xd5\x8c\x5d\xec\x1c"
  461. "\x3f\xe0\x48\xa4\x45\xf8\x52\x2c\xe1\x89\x16\x02\x74\x1a\xed\x39\xf1\x3b"
  462. "\xc1\x06\x9c\x82\x7f\x54\x19\x78\xf8\x64\xaf\x8a\x95\x45\x3b\x89\x85\xa0"
  463. "\xb7\x9d\x68\x75\xe0\x2f\x7c\x80\xb8\xbf\x55\xdc",
  464. 174);
  465. *(uint64_t*)0x20000560 = 0xae;
  466. *(uint64_t*)0x20000568 = 0x10001;
  467. *(uint64_t*)0x20000570 = 0;
  468. *(uint32_t*)0x20000578 = 0x24a6ec91;
  469. *(uint32_t*)0x2000057c = -1;
  470. syscall(__NR_io_submit, /*ctx=*/r[6], /*nr=*/4ul, /*iocbpp=*/0x20000580ul);
  471. *(uint32_t*)0x20000000 = 0x80000008;
  472. syscall(__NR_setsockopt, /*fd=*/r[5], /*level=*/0x29,
  473. /*optname=IPV6_RECVPKTINFO*/ 0x31, /*optval=*/0x20000000ul,
  474. /*optlen=*/4ul);
  475. syscall(__NR_ioperm, /*from=*/0ul, /*num=*/6ul, /*on=*/8ul);
  476. syscall(__NR_membarrier, /*cmd=MEMBARRIER_CMD_GLOBAL_EXPEDITED*/ 2ul,
  477. /*flags=*/0ul);
  478. syz_sysconfig_set__proc_sys_vm_numa_stat(/*val=*/6);
  479. *(uint16_t*)0x2006ffe4 = 0xa;
  480. *(uint16_t*)0x2006ffe6 = htobe16(0);
  481. *(uint32_t*)0x2006ffe8 = htobe32(0);
  482. memset((void*)0x2006ffec, 0, 16);
  483. *(uint32_t*)0x2006fffc = 0;
  484. syscall(
  485. __NR_sendto, /*fd=*/r[5], /*buf=*/0ul, /*len=*/0ul,
  486. /*f=MSG_ZEROCOPY|MSG_PROBE|MSG_OOB|MSG_NOSIGNAL|MSG_DONTROUTE|MSG_CONFIRM|0xfffffeff9bfb372a*/
  487. 0xfffffeff9ffb7f3ful, /*addr=*/0x2006ffe4ul, /*addrlen=*/0x1cul);
  488. syz_sysconfig_reset__proc_sys_vm_numa_stat();
  489. return 0;
  490. }
  491.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!