// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include static long syz_open_procfs(volatile long a0, volatile long a1) { char buf[128]; memset(buf, 0, sizeof(buf)); if (a0 == 0) { snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1); } else if (a0 == -1) { snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1); } else { snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0, (char*)a1); } int fd = open(buf, O_RDWR); if (fd == -1) fd = open(buf, O_RDONLY); return fd; } static inline long write_sysctl(const char* path, long value) { int fd = open(path, O_WRONLY); if (fd < 0) return -errno; char buf[64]; int n = snprintf(buf, sizeof(buf), "%ld", value); if (n < 0) { int e = errno; close(fd); return -e; } ssize_t w = write(fd, buf, (size_t)n); if (w != n) { int e = errno; close(fd); return -e; } close(fd); return 0; } static long syz_proc_sys_generated_322( volatile long net_ipv4_neigh_br_750d3ac76d5c_proxy_qlen, volatile long kernel_printk_ratelimit, volatile long net_ipv4_tcp_max_orphans, volatile long net_ipv4_conf_veth60b1cb7_promote_secondaries, volatile long net_ipv6_conf_veth233afe3_temp_valid_lft) { (void)write_sysctl("/proc/sys/net/ipv4/neigh/br-750d3ac76d5c/proxy_qlen", (long)net_ipv4_neigh_br_750d3ac76d5c_proxy_qlen); (void)write_sysctl("/proc/sys/kernel/printk_ratelimit", (long)kernel_printk_ratelimit); (void)write_sysctl("/proc/sys/net/ipv4/tcp_max_orphans", (long)net_ipv4_tcp_max_orphans); (void)write_sysctl("/proc/sys/net/ipv4/conf/veth60b1cb7/promote_secondaries", (long)net_ipv4_conf_veth60b1cb7_promote_secondaries); (void)write_sysctl("/proc/sys/net/ipv6/conf/veth233afe3/temp_valid_lft", (long)net_ipv6_conf_veth233afe3_temp_valid_lft); return 0; } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } syz_proc_sys_generated_322( /*net_ipv4_neigh_br_750d3ac76d5c_proxy_qlen=*/0x10c, /*kernel_printk_ratelimit=*/-1, /*net_ipv4_tcp_max_orphans=*/0x1fe6c2, /*net_ipv4_conf_veth60b1cb7_promote_secondaries=*/0, /*net_ipv6_conf_veth233afe3_temp_valid_lft=*/0x4145ee); memcpy((void*)0x200000000100, "map_files\000", 10); res = -1; res = syz_open_procfs(/*pid=*/0, /*file=*/0x200000000100); if (res != -1) r[0] = res; syscall(__NR_fcntl, /*fd=*/r[0], /*cmd=*/0x402ul, /*typ=DN_CREATE|DN_MODIFY|DN_ACCESS|DN_MULTISHOT*/ 0x80000007ul); return 0; }