Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- // autogenerated by syzkaller (http://github.com/google/syzkaller)
- #define _GNU_SOURCE
- #include <sys/syscall.h>
- #include <unistd.h>
- #include <errno.h>
- #include <signal.h>
- #include <stdarg.h>
- #include <stdio.h>
- #include <sys/time.h>
- #include <sys/wait.h>
- #include <time.h>
- #include <sys/prctl.h>
- __attribute__((noreturn)) static void doexit(int status)
- {
- volatile unsigned i;
- syscall(__NR_exit_group, status);
- for (i = 0;; i++) {
- }
- }
- #define NORETURN __attribute__((noreturn))
- #include <stdint.h>
- #include <string.h>
- const int kFailStatus = 67;
- const int kRetryStatus = 69;
- NORETURN static void fail(const char* msg, ...)
- {
- int e = errno;
- fflush(stdout);
- va_list args;
- va_start(args, msg);
- vfprintf(stderr, msg, args);
- va_end(args);
- fprintf(stderr, " (errno %d)\n", e);
- doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
- }
- NORETURN static void exitf(const char* msg, ...)
- {
- int e = errno;
- fflush(stdout);
- va_list args;
- va_start(args, msg);
- vfprintf(stderr, msg, args);
- va_end(args);
- fprintf(stderr, " (errno %d)\n", e);
- doexit(kRetryStatus);
- }
- static uint64_t current_time_ms()
- {
- struct timespec ts;
- if (clock_gettime(CLOCK_MONOTONIC, &ts))
- fail("clock_gettime failed");
- return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
- }
- static void test();
- void loop()
- {
- int iter;
- for (iter = 0;; iter++) {
- int pid = fork();
- if (pid < 0)
- fail("clone failed");
- if (pid == 0) {
- prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
- setpgrp();
- test();
- doexit(0);
- }
- int status = 0;
- uint64_t start = current_time_ms();
- for (;;) {
- int res = waitpid(-1, &status, __WALL | WNOHANG);
- if (res == pid)
- break;
- usleep(1000);
- if (current_time_ms() - start > 5 * 1000) {
- kill(-pid, SIGKILL);
- kill(pid, SIGKILL);
- while (waitpid(-1, &status, __WALL) != pid) {
- }
- break;
- }
- }
- }
- }
- long r[28];
- void test()
- {
- memset(r, -1, sizeof(r));
- r[0] = syscall(__NR_mmap, 0x20000000ul, 0x3b8000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul);
- r[1] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul);
- *(uint16_t*)0x200007b6 = (uint16_t)0x2;
- *(uint16_t*)0x200007b8 = (uint16_t)0x234e;
- *(uint32_t*)0x200007ba = (uint32_t)0x0;
- *(uint8_t*)0x200007be = (uint8_t)0x0;
- *(uint8_t*)0x200007bf = (uint8_t)0x0;
- *(uint8_t*)0x200007c0 = (uint8_t)0x0;
- *(uint8_t*)0x200007c1 = (uint8_t)0x0;
- *(uint8_t*)0x200007c2 = (uint8_t)0x0;
- *(uint8_t*)0x200007c3 = (uint8_t)0x0;
- *(uint8_t*)0x200007c4 = (uint8_t)0x0;
- *(uint8_t*)0x200007c5 = (uint8_t)0x0;
- r[13] = syscall(__NR_bind, r[1], 0x200007b6ul, 0x10ul);
- r[14] = syscall(__NR_listen, r[1], 0x0ul);
- r[15] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul);
- *(uint16_t*)0x200008e6 = (uint16_t)0x2;
- *(uint16_t*)0x200008e8 = (uint16_t)0x234e;
- *(uint32_t*)0x200008ea = (uint32_t)0x100007f;
- *(uint8_t*)0x200008ee = (uint8_t)0x0;
- *(uint8_t*)0x200008ef = (uint8_t)0x0;
- *(uint8_t*)0x200008f0 = (uint8_t)0x0;
- *(uint8_t*)0x200008f1 = (uint8_t)0x0;
- *(uint8_t*)0x200008f2 = (uint8_t)0x0;
- *(uint8_t*)0x200008f3 = (uint8_t)0x0;
- *(uint8_t*)0x200008f4 = (uint8_t)0x0;
- *(uint8_t*)0x200008f5 = (uint8_t)0x0;
- r[27] = syscall(__NR_connect, r[15], 0x200008e6ul, 0x10ul);
- }
- int main()
- {
- int i; for (i = 0; i < 8; i++) {
- if (fork() == 0) {
- loop();
- return 0;
- }
- }
- sleep(1000000);
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement