-
-
Save xrivendell7/0dbaa3529a9845b008c31e0bc6c29236 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
================================================================== | |
BUG: KASAN: slab-out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] | |
BUG: KASAN: slab-out-of-bounds in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] | |
BUG: KASAN: slab-out-of-bounds in __refcount_add include/linux/refcount.h:193 [inline] | |
BUG: KASAN: slab-out-of-bounds in __refcount_inc include/linux/refcount.h:250 [inline] | |
BUG: KASAN: slab-out-of-bounds in refcount_inc include/linux/refcount.h:267 [inline] | |
BUG: KASAN: slab-out-of-bounds in sock_hold include/net/sock.h:777 [inline] | |
BUG: KASAN: slab-out-of-bounds in sco_sock_timeout+0x72/0x300 net/bluetooth/sco.c:88 | |
Write of size 4 at addr ffff888153491080 by task kworker/2:2/797 | |
CPU: 2 PID: 797 Comm: kworker/2:2 Not tainted 6.6.0-rc6-g1b70ac811a14-dirty #1 | |
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 | |
Workqueue: events sco_sock_timeout | |
Call Trace: | |
<TASK> | |
__dump_stack lib/dump_stack.c:88 [inline] | |
dump_stack_lvl+0xee/0x1e0 lib/dump_stack.c:106 | |
print_address_description mm/kasan/report.c:364 [inline] | |
print_report+0xc4/0x620 mm/kasan/report.c:475 | |
kasan_report+0xda/0x110 mm/kasan/report.c:588 | |
check_region_inline mm/kasan/generic.c:181 [inline] | |
kasan_check_range+0xef/0x190 mm/kasan/generic.c:187 | |
instrument_atomic_read_write include/linux/instrumented.h:96 [inline] | |
atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] | |
__refcount_add include/linux/refcount.h:193 [inline] | |
__refcount_inc include/linux/refcount.h:250 [inline] | |
refcount_inc include/linux/refcount.h:267 [inline] | |
sock_hold include/net/sock.h:777 [inline] | |
sco_sock_timeout+0x72/0x300 net/bluetooth/sco.c:88 | |
process_one_work+0x8ab/0x1730 kernel/workqueue.c:2630 | |
process_scheduled_works kernel/workqueue.c:2703 [inline] | |
worker_thread+0x931/0x1380 kernel/workqueue.c:2784 | |
kthread+0x2d3/0x3b0 kernel/kthread.c:388 | |
ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:147 | |
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 | |
</TASK> | |
Allocated by task 4550: | |
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 | |
kasan_set_track+0x25/0x30 mm/kasan/common.c:52 | |
__kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328 | |
kasan_slab_alloc include/linux/kasan.h:188 [inline] | |
slab_post_alloc_hook mm/slab.h:762 [inline] | |
slab_alloc_node mm/slub.c:3478 [inline] | |
slab_alloc mm/slub.c:3486 [inline] | |
__kmem_cache_alloc_lru mm/slub.c:3493 [inline] | |
kmem_cache_alloc+0x16c/0x320 mm/slub.c:3502 | |
getname_flags.part.0+0x55/0x510 fs/namei.c:140 | |
getname_flags include/linux/audit.h:321 [inline] | |
getname+0x99/0xf0 fs/namei.c:219 | |
do_sys_openat2+0x109/0x1f0 fs/open.c:1416 | |
do_sys_open fs/open.c:1437 [inline] | |
__do_sys_openat fs/open.c:1453 [inline] | |
__se_sys_openat fs/open.c:1448 [inline] | |
__x64_sys_openat+0x182/0x220 fs/open.c:1448 | |
do_syscall_x64 arch/x86/entry/common.c:50 [inline] | |
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 | |
entry_SYSCALL_64_after_hwframe+0x63/0xcd | |
Freed by task 4550: | |
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 | |
kasan_set_track+0x25/0x30 mm/kasan/common.c:52 | |
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522 | |
____kasan_slab_free mm/kasan/common.c:236 [inline] | |
____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200 | |
kasan_slab_free include/linux/kasan.h:164 [inline] | |
slab_free_hook mm/slub.c:1800 [inline] | |
slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826 | |
slab_free mm/slub.c:3809 [inline] | |
kmem_cache_free+0xf0/0x490 mm/slub.c:3831 | |
putname+0x13d/0x180 fs/namei.c:274 | |
do_sys_openat2+0x169/0x1f0 fs/open.c:1430 | |
do_sys_open fs/open.c:1437 [inline] | |
__do_sys_openat fs/open.c:1453 [inline] | |
__se_sys_openat fs/open.c:1448 [inline] | |
__x64_sys_openat+0x182/0x220 fs/open.c:1448 | |
do_syscall_x64 arch/x86/entry/common.c:50 [inline] | |
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 | |
entry_SYSCALL_64_after_hwframe+0x63/0xcd | |
The buggy address belongs to the object at ffff888153490000 | |
which belongs to the cache names_cache of size 4096 | |
The buggy address is located 128 bytes to the right of | |
allocated 4096-byte region [ffff888153490000, ffff888153491000) | |
The buggy address belongs to the physical page: | |
page:ffffea00054d2400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x153490 | |
head:ffffea00054d2400 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 | |
flags: 0x57ff00000000840(slab|head|node=1|zone=2|lastcpupid=0x7ff) | |
page_type: 0xffffffff() | |
raw: 057ff00000000840 ffff8880156412c0 dead000000000122 0000000000000000 | |
raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 | |
page dumped because: kasan: bad access detected | |
page_owner tracks the page as allocated | |
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4550, tgid 4550 (systemd-udevd), ts 591677584025, free_ts 571452115729 | |
set_page_owner include/linux/page_owner.h:31 [inline] | |
post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1536 | |
prep_new_page mm/page_alloc.c:1543 [inline] | |
get_page_from_freelist+0xee2/0x2f30 mm/page_alloc.c:3170 | |
__alloc_pages+0x22e/0x2420 mm/page_alloc.c:4426 | |
alloc_pages+0x1ba/0x280 mm/mempolicy.c:2297 | |
alloc_slab_page mm/slub.c:1870 [inline] | |
allocate_slab mm/slub.c:2017 [inline] | |
new_slab+0x283/0x3c0 mm/slub.c:2070 | |
___slab_alloc+0x884/0x1390 mm/slub.c:3223 | |
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322 | |
__slab_alloc_node mm/slub.c:3375 [inline] | |
slab_alloc_node mm/slub.c:3468 [inline] | |
slab_alloc mm/slub.c:3486 [inline] | |
__kmem_cache_alloc_lru mm/slub.c:3493 [inline] | |
kmem_cache_alloc+0x30c/0x320 mm/slub.c:3502 | |
getname_flags.part.0+0x55/0x510 fs/namei.c:140 | |
getname_flags include/linux/audit.h:321 [inline] | |
getname+0x99/0xf0 fs/namei.c:219 | |
do_sys_openat2+0x109/0x1f0 fs/open.c:1416 | |
do_sys_open fs/open.c:1437 [inline] | |
__do_sys_openat fs/open.c:1453 [inline] | |
__se_sys_openat fs/open.c:1448 [inline] | |
__x64_sys_openat+0x182/0x220 fs/open.c:1448 | |
do_syscall_x64 arch/x86/entry/common.c:50 [inline] | |
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 | |
entry_SYSCALL_64_after_hwframe+0x63/0xcd | |
page last free stack trace: | |
reset_page_owner include/linux/page_owner.h:24 [inline] | |
free_pages_prepare mm/page_alloc.c:1136 [inline] | |
free_unref_page_prepare+0x478/0xa50 mm/page_alloc.c:2312 | |
free_unref_page+0x33/0x3b0 mm/page_alloc.c:2405 | |
qlink_free mm/kasan/quarantine.c:166 [inline] | |
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:185 | |
kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:292 | |
__kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305 | |
kasan_slab_alloc include/linux/kasan.h:188 [inline] | |
slab_post_alloc_hook mm/slab.h:762 [inline] | |
slab_alloc_node mm/slub.c:3478 [inline] | |
slab_alloc mm/slub.c:3486 [inline] | |
__kmem_cache_alloc_lru mm/slub.c:3493 [inline] | |
kmem_cache_alloc+0x16c/0x320 mm/slub.c:3502 | |
getname_flags.part.0+0x55/0x510 fs/namei.c:140 | |
getname_flags+0xa5/0xf0 include/linux/audit.h:321 | |
vfs_fstatat+0xa5/0x160 fs/stat.c:294 | |
vfs_stat include/linux/fs.h:3042 [inline] | |
__do_sys_newstat+0x94/0x110 fs/stat.c:432 | |
do_syscall_x64 arch/x86/entry/common.c:50 [inline] | |
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 | |
entry_SYSCALL_64_after_hwframe+0x63/0xcd | |
Memory state around the buggy address: | |
ffff888153490f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb | |
ffff888153491000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc | |
>ffff888153491080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc | |
^ | |
ffff888153491100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb | |
ffff888153491180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb | |
================================================================== |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// autogenerated by syzkaller (https://github.com/google/syzkaller) | |
#define _GNU_SOURCE | |
#include <arpa/inet.h> | |
#include <dirent.h> | |
#include <endian.h> | |
#include <errno.h> | |
#include <fcntl.h> | |
#include <linux/capability.h> | |
#include <linux/falloc.h> | |
#include <linux/futex.h> | |
#include <linux/genetlink.h> | |
#include <linux/if_addr.h> | |
#include <linux/if_link.h> | |
#include <linux/in6.h> | |
#include <linux/neighbour.h> | |
#include <linux/net.h> | |
#include <linux/netlink.h> | |
#include <linux/rfkill.h> | |
#include <linux/rtnetlink.h> | |
#include <linux/veth.h> | |
#include <net/if.h> | |
#include <netinet/in.h> | |
#include <pthread.h> | |
#include <sched.h> | |
#include <setjmp.h> | |
#include <signal.h> | |
#include <stdarg.h> | |
#include <stdbool.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <sys/epoll.h> | |
#include <sys/ioctl.h> | |
#include <sys/mount.h> | |
#include <sys/prctl.h> | |
#include <sys/resource.h> | |
#include <sys/socket.h> | |
#include <sys/stat.h> | |
#include <sys/swap.h> | |
#include <sys/syscall.h> | |
#include <sys/time.h> | |
#include <sys/types.h> | |
#include <sys/uio.h> | |
#include <sys/wait.h> | |
#include <time.h> | |
#include <unistd.h> | |
static __thread int clone_ongoing; | |
static __thread int skip_segv; | |
static __thread jmp_buf segv_env; | |
static void segv_handler(int sig, siginfo_t* info, void* ctx) { | |
if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { | |
exit(sig); | |
} | |
uintptr_t addr = (uintptr_t)info->si_addr; | |
const uintptr_t prog_start = 1 << 20; | |
const uintptr_t prog_end = 100 << 20; | |
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; | |
int valid = addr < prog_start || addr > prog_end; | |
if (skip && valid) { | |
_longjmp(segv_env, 1); | |
} | |
exit(sig); | |
} | |
static void install_segv_handler(void) { | |
struct sigaction sa; | |
memset(&sa, 0, sizeof(sa)); | |
sa.sa_handler = SIG_IGN; | |
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); | |
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); | |
memset(&sa, 0, sizeof(sa)); | |
sa.sa_sigaction = segv_handler; | |
sa.sa_flags = SA_NODEFER | SA_SIGINFO; | |
sigaction(SIGSEGV, &sa, NULL); | |
sigaction(SIGBUS, &sa, NULL); | |
} | |
#define NONFAILING(...) \ | |
({ \ | |
int ok = 1; \ | |
__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ | |
if (_setjmp(segv_env) == 0) { \ | |
__VA_ARGS__; \ | |
} else \ | |
ok = 0; \ | |
__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ | |
ok; \ | |
}) | |
static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } | |
static uint64_t current_time_ms(void) { | |
struct timespec ts; | |
if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); | |
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; | |
} | |
static void thread_start(void* (*fn)(void*), void* arg) { | |
pthread_t th; | |
pthread_attr_t attr; | |
pthread_attr_init(&attr); | |
pthread_attr_setstacksize(&attr, 128 << 10); | |
int i = 0; | |
for (; i < 100; i++) { | |
if (pthread_create(&th, &attr, fn, arg) == 0) { | |
pthread_attr_destroy(&attr); | |
return; | |
} | |
if (errno == EAGAIN) { | |
usleep(50); | |
continue; | |
} | |
break; | |
} | |
exit(1); | |
} | |
typedef struct { | |
int state; | |
} event_t; | |
static void event_init(event_t* ev) { ev->state = 0; } | |
static void event_reset(event_t* ev) { ev->state = 0; } | |
static void event_set(event_t* ev) { | |
if (ev->state) exit(1); | |
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); | |
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000); | |
} | |
static void event_wait(event_t* ev) { | |
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) | |
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); | |
} | |
static int event_isset(event_t* ev) { | |
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); | |
} | |
static int event_timedwait(event_t* ev, uint64_t timeout) { | |
uint64_t start = current_time_ms(); | |
uint64_t now = start; | |
for (;;) { | |
uint64_t remain = timeout - (now - start); | |
struct timespec ts; | |
ts.tv_sec = remain / 1000; | |
ts.tv_nsec = (remain % 1000) * 1000 * 1000; | |
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); | |
if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) return 1; | |
now = current_time_ms(); | |
if (now - start > timeout) return 0; | |
} | |
} | |
static bool write_file(const char* file, const char* what, ...) { | |
char buf[1024]; | |
va_list args; | |
va_start(args, what); | |
vsnprintf(buf, sizeof(buf), what, args); | |
va_end(args); | |
buf[sizeof(buf) - 1] = 0; | |
int len = strlen(buf); | |
int fd = open(file, O_WRONLY | O_CLOEXEC); | |
if (fd == -1) return false; | |
if (write(fd, buf, len) != len) { | |
int err = errno; | |
close(fd); | |
errno = err; | |
return false; | |
} | |
close(fd); | |
return true; | |
} | |
struct nlmsg { | |
char* pos; | |
int nesting; | |
struct nlattr* nested[8]; | |
char buf[4096]; | |
}; | |
static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, | |
const void* data, int size) { | |
memset(nlmsg, 0, sizeof(*nlmsg)); | |
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; | |
hdr->nlmsg_type = typ; | |
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; | |
memcpy(hdr + 1, data, size); | |
nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); | |
} | |
static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, | |
int size) { | |
struct nlattr* attr = (struct nlattr*)nlmsg->pos; | |
attr->nla_len = sizeof(*attr) + size; | |
attr->nla_type = typ; | |
if (size > 0) memcpy(attr + 1, data, size); | |
nlmsg->pos += NLMSG_ALIGN(attr->nla_len); | |
} | |
static void netlink_nest(struct nlmsg* nlmsg, int typ) { | |
struct nlattr* attr = (struct nlattr*)nlmsg->pos; | |
attr->nla_type = typ; | |
nlmsg->pos += sizeof(*attr); | |
nlmsg->nested[nlmsg->nesting++] = attr; | |
} | |
static void netlink_done(struct nlmsg* nlmsg) { | |
struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; | |
attr->nla_len = nlmsg->pos - (char*)attr; | |
} | |
static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, | |
int* reply_len, bool dofail) { | |
if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); | |
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; | |
hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; | |
struct sockaddr_nl addr; | |
memset(&addr, 0, sizeof(addr)); | |
addr.nl_family = AF_NETLINK; | |
ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, | |
(struct sockaddr*)&addr, sizeof(addr)); | |
if (n != (ssize_t)hdr->nlmsg_len) { | |
if (dofail) exit(1); | |
return -1; | |
} | |
n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); | |
if (reply_len) *reply_len = 0; | |
if (n < 0) { | |
if (dofail) exit(1); | |
return -1; | |
} | |
if (n < (ssize_t)sizeof(struct nlmsghdr)) { | |
errno = EINVAL; | |
if (dofail) exit(1); | |
return -1; | |
} | |
if (hdr->nlmsg_type == NLMSG_DONE) return 0; | |
if (reply_len && hdr->nlmsg_type == reply_type) { | |
*reply_len = n; | |
return 0; | |
} | |
if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { | |
errno = EINVAL; | |
if (dofail) exit(1); | |
return -1; | |
} | |
if (hdr->nlmsg_type != NLMSG_ERROR) { | |
errno = EINVAL; | |
if (dofail) exit(1); | |
return -1; | |
} | |
errno = -((struct nlmsgerr*)(hdr + 1))->error; | |
return -errno; | |
} | |
static int netlink_send(struct nlmsg* nlmsg, int sock) { | |
return netlink_send_ext(nlmsg, sock, 0, NULL, true); | |
} | |
static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, | |
const char* family_name, bool dofail) { | |
struct genlmsghdr genlhdr; | |
memset(&genlhdr, 0, sizeof(genlhdr)); | |
genlhdr.cmd = CTRL_CMD_GETFAMILY; | |
netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); | |
netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, | |
strnlen(family_name, GENL_NAMSIZ - 1) + 1); | |
int n = 0; | |
int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); | |
if (err < 0) { | |
return -1; | |
} | |
uint16_t id = 0; | |
struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + | |
NLMSG_ALIGN(sizeof(genlhdr))); | |
for (; (char*)attr < nlmsg->buf + n; | |
attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { | |
if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { | |
id = *(uint16_t*)(attr + 1); | |
break; | |
} | |
} | |
if (!id) { | |
errno = EINVAL; | |
return -1; | |
} | |
recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); | |
return id; | |
} | |
static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type, | |
const char* name, bool up) { | |
struct ifinfomsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; | |
netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, | |
sizeof(hdr)); | |
if (name) netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); | |
netlink_nest(nlmsg, IFLA_LINKINFO); | |
netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type)); | |
} | |
static void netlink_device_change(struct nlmsg* nlmsg, int sock, | |
const char* name, bool up, const char* master, | |
const void* mac, int macsize, | |
const char* new_name) { | |
struct ifinfomsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; | |
hdr.ifi_index = if_nametoindex(name); | |
netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); | |
if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); | |
if (master) { | |
int ifindex = if_nametoindex(master); | |
netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); | |
} | |
if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static struct nlmsg nlmsg; | |
const int kInitNetNsFd = 201; | |
static int runcmdline(char* cmdline) { | |
int ret = system(cmdline); | |
if (ret) { | |
} | |
return ret; | |
} | |
#define MAX_FDS 30 | |
static long syz_init_net_socket(volatile long domain, volatile long type, | |
volatile long proto) { | |
int netns = open("/proc/self/ns/net", O_RDONLY); | |
if (netns == -1) return netns; | |
if (setns(kInitNetNsFd, 0)) return -1; | |
int sock = syscall(__NR_socket, domain, type, proto); | |
int err = errno; | |
if (setns(netns, 0)) exit(1); | |
close(netns); | |
errno = err; | |
return sock; | |
} | |
#define BTPROTO_HCI 1 | |
#define ACL_LINK 1 | |
#define SCAN_PAGE 2 | |
typedef struct { | |
uint8_t b[6]; | |
} __attribute__((packed)) bdaddr_t; | |
#define HCI_COMMAND_PKT 1 | |
#define HCI_EVENT_PKT 4 | |
#define HCI_VENDOR_PKT 0xff | |
struct hci_command_hdr { | |
uint16_t opcode; | |
uint8_t plen; | |
} __attribute__((packed)); | |
struct hci_event_hdr { | |
uint8_t evt; | |
uint8_t plen; | |
} __attribute__((packed)); | |
#define HCI_EV_CONN_COMPLETE 0x03 | |
struct hci_ev_conn_complete { | |
uint8_t status; | |
uint16_t handle; | |
bdaddr_t bdaddr; | |
uint8_t link_type; | |
uint8_t encr_mode; | |
} __attribute__((packed)); | |
#define HCI_EV_CONN_REQUEST 0x04 | |
struct hci_ev_conn_request { | |
bdaddr_t bdaddr; | |
uint8_t dev_class[3]; | |
uint8_t link_type; | |
} __attribute__((packed)); | |
#define HCI_EV_REMOTE_FEATURES 0x0b | |
struct hci_ev_remote_features { | |
uint8_t status; | |
uint16_t handle; | |
uint8_t features[8]; | |
} __attribute__((packed)); | |
#define HCI_EV_CMD_COMPLETE 0x0e | |
struct hci_ev_cmd_complete { | |
uint8_t ncmd; | |
uint16_t opcode; | |
} __attribute__((packed)); | |
#define HCI_OP_WRITE_SCAN_ENABLE 0x0c1a | |
#define HCI_OP_READ_BUFFER_SIZE 0x1005 | |
struct hci_rp_read_buffer_size { | |
uint8_t status; | |
uint16_t acl_mtu; | |
uint8_t sco_mtu; | |
uint16_t acl_max_pkt; | |
uint16_t sco_max_pkt; | |
} __attribute__((packed)); | |
#define HCI_OP_READ_BD_ADDR 0x1009 | |
struct hci_rp_read_bd_addr { | |
uint8_t status; | |
bdaddr_t bdaddr; | |
} __attribute__((packed)); | |
#define HCI_EV_LE_META 0x3e | |
struct hci_ev_le_meta { | |
uint8_t subevent; | |
} __attribute__((packed)); | |
#define HCI_EV_LE_CONN_COMPLETE 0x01 | |
struct hci_ev_le_conn_complete { | |
uint8_t status; | |
uint16_t handle; | |
uint8_t role; | |
uint8_t bdaddr_type; | |
bdaddr_t bdaddr; | |
uint16_t interval; | |
uint16_t latency; | |
uint16_t supervision_timeout; | |
uint8_t clk_accurancy; | |
} __attribute__((packed)); | |
struct hci_dev_req { | |
uint16_t dev_id; | |
uint32_t dev_opt; | |
}; | |
struct vhci_vendor_pkt_request { | |
uint8_t type; | |
uint8_t opcode; | |
} __attribute__((packed)); | |
struct vhci_pkt { | |
uint8_t type; | |
union { | |
struct { | |
uint8_t opcode; | |
uint16_t id; | |
} __attribute__((packed)) vendor_pkt; | |
struct hci_command_hdr command_hdr; | |
}; | |
} __attribute__((packed)); | |
#define HCIDEVUP _IOW('H', 201, int) | |
#define HCISETSCAN _IOW('H', 221, int) | |
static int vhci_fd = -1; | |
static void rfkill_unblock_all() { | |
int fd = open("/dev/rfkill", O_WRONLY); | |
if (fd < 0) exit(1); | |
struct rfkill_event event = {0}; | |
event.idx = 0; | |
event.type = RFKILL_TYPE_ALL; | |
event.op = RFKILL_OP_CHANGE_ALL; | |
event.soft = 0; | |
event.hard = 0; | |
if (write(fd, &event, sizeof(event)) < 0) exit(1); | |
close(fd); | |
} | |
static void hci_send_event_packet(int fd, uint8_t evt, void* data, | |
size_t data_len) { | |
struct iovec iv[3]; | |
struct hci_event_hdr hdr; | |
hdr.evt = evt; | |
hdr.plen = data_len; | |
uint8_t type = HCI_EVENT_PKT; | |
iv[0].iov_base = &type; | |
iv[0].iov_len = sizeof(type); | |
iv[1].iov_base = &hdr; | |
iv[1].iov_len = sizeof(hdr); | |
iv[2].iov_base = data; | |
iv[2].iov_len = data_len; | |
if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0) exit(1); | |
} | |
static void hci_send_event_cmd_complete(int fd, uint16_t opcode, void* data, | |
size_t data_len) { | |
struct iovec iv[4]; | |
struct hci_event_hdr hdr; | |
hdr.evt = HCI_EV_CMD_COMPLETE; | |
hdr.plen = sizeof(struct hci_ev_cmd_complete) + data_len; | |
struct hci_ev_cmd_complete evt_hdr; | |
evt_hdr.ncmd = 1; | |
evt_hdr.opcode = opcode; | |
uint8_t type = HCI_EVENT_PKT; | |
iv[0].iov_base = &type; | |
iv[0].iov_len = sizeof(type); | |
iv[1].iov_base = &hdr; | |
iv[1].iov_len = sizeof(hdr); | |
iv[2].iov_base = &evt_hdr; | |
iv[2].iov_len = sizeof(evt_hdr); | |
iv[3].iov_base = data; | |
iv[3].iov_len = data_len; | |
if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0) exit(1); | |
} | |
static bool process_command_pkt(int fd, char* buf, ssize_t buf_size) { | |
struct hci_command_hdr* hdr = (struct hci_command_hdr*)buf; | |
if (buf_size < (ssize_t)sizeof(struct hci_command_hdr) || | |
hdr->plen != buf_size - sizeof(struct hci_command_hdr)) | |
exit(1); | |
switch (hdr->opcode) { | |
case HCI_OP_WRITE_SCAN_ENABLE: { | |
uint8_t status = 0; | |
hci_send_event_cmd_complete(fd, hdr->opcode, &status, sizeof(status)); | |
return true; | |
} | |
case HCI_OP_READ_BD_ADDR: { | |
struct hci_rp_read_bd_addr rp = {0}; | |
rp.status = 0; | |
memset(&rp.bdaddr, 0xaa, 6); | |
hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp)); | |
return false; | |
} | |
case HCI_OP_READ_BUFFER_SIZE: { | |
struct hci_rp_read_buffer_size rp = {0}; | |
rp.status = 0; | |
rp.acl_mtu = 1021; | |
rp.sco_mtu = 96; | |
rp.acl_max_pkt = 4; | |
rp.sco_max_pkt = 6; | |
hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp)); | |
return false; | |
} | |
} | |
char dummy[0xf9] = {0}; | |
hci_send_event_cmd_complete(fd, hdr->opcode, dummy, sizeof(dummy)); | |
return false; | |
} | |
static void* event_thread(void* arg) { | |
while (1) { | |
char buf[1024] = {0}; | |
ssize_t buf_size = read(vhci_fd, buf, sizeof(buf)); | |
if (buf_size < 0) exit(1); | |
if (buf_size > 0 && buf[0] == HCI_COMMAND_PKT) { | |
if (process_command_pkt(vhci_fd, buf + 1, buf_size - 1)) break; | |
} | |
} | |
return NULL; | |
} | |
#define HCI_HANDLE_1 200 | |
#define HCI_HANDLE_2 201 | |
#define HCI_PRIMARY 0 | |
#define HCI_OP_RESET 0x0c03 | |
static void initialize_vhci() { | |
int hci_sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI); | |
if (hci_sock < 0) exit(1); | |
vhci_fd = open("/dev/vhci", O_RDWR); | |
if (vhci_fd == -1) exit(1); | |
const int kVhciFd = 202; | |
if (dup2(vhci_fd, kVhciFd) < 0) exit(1); | |
close(vhci_fd); | |
vhci_fd = kVhciFd; | |
struct vhci_vendor_pkt_request vendor_pkt_req = {HCI_VENDOR_PKT, HCI_PRIMARY}; | |
if (write(vhci_fd, &vendor_pkt_req, sizeof(vendor_pkt_req)) != | |
sizeof(vendor_pkt_req)) | |
exit(1); | |
struct vhci_pkt vhci_pkt; | |
if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt)) exit(1); | |
if (vhci_pkt.type == HCI_COMMAND_PKT && | |
vhci_pkt.command_hdr.opcode == HCI_OP_RESET) { | |
char response[1] = {0}; | |
hci_send_event_cmd_complete(vhci_fd, HCI_OP_RESET, response, | |
sizeof(response)); | |
if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt)) exit(1); | |
} | |
if (vhci_pkt.type != HCI_VENDOR_PKT) exit(1); | |
int dev_id = vhci_pkt.vendor_pkt.id; | |
pthread_t th; | |
if (pthread_create(&th, NULL, event_thread, NULL)) exit(1); | |
int ret = ioctl(hci_sock, HCIDEVUP, dev_id); | |
if (ret) { | |
if (errno == ERFKILL) { | |
rfkill_unblock_all(); | |
ret = ioctl(hci_sock, HCIDEVUP, dev_id); | |
} | |
if (ret && errno != EALREADY) exit(1); | |
} | |
struct hci_dev_req dr = {0}; | |
dr.dev_id = dev_id; | |
dr.dev_opt = SCAN_PAGE; | |
if (ioctl(hci_sock, HCISETSCAN, &dr)) exit(1); | |
struct hci_ev_conn_request request; | |
memset(&request, 0, sizeof(request)); | |
memset(&request.bdaddr, 0xaa, 6); | |
*(uint8_t*)&request.bdaddr.b[5] = 0x10; | |
request.link_type = ACL_LINK; | |
hci_send_event_packet(vhci_fd, HCI_EV_CONN_REQUEST, &request, | |
sizeof(request)); | |
struct hci_ev_conn_complete complete; | |
memset(&complete, 0, sizeof(complete)); | |
complete.status = 0; | |
complete.handle = HCI_HANDLE_1; | |
memset(&complete.bdaddr, 0xaa, 6); | |
*(uint8_t*)&complete.bdaddr.b[5] = 0x10; | |
complete.link_type = ACL_LINK; | |
complete.encr_mode = 0; | |
hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete, | |
sizeof(complete)); | |
struct hci_ev_remote_features features; | |
memset(&features, 0, sizeof(features)); | |
features.status = 0; | |
features.handle = HCI_HANDLE_1; | |
hci_send_event_packet(vhci_fd, HCI_EV_REMOTE_FEATURES, &features, | |
sizeof(features)); | |
struct { | |
struct hci_ev_le_meta le_meta; | |
struct hci_ev_le_conn_complete le_conn; | |
} le_conn; | |
memset(&le_conn, 0, sizeof(le_conn)); | |
le_conn.le_meta.subevent = HCI_EV_LE_CONN_COMPLETE; | |
memset(&le_conn.le_conn.bdaddr, 0xaa, 6); | |
*(uint8_t*)&le_conn.le_conn.bdaddr.b[5] = 0x11; | |
le_conn.le_conn.role = 1; | |
le_conn.le_conn.handle = HCI_HANDLE_2; | |
hci_send_event_packet(vhci_fd, HCI_EV_LE_META, &le_conn, sizeof(le_conn)); | |
pthread_join(th, NULL); | |
close(hci_sock); | |
} | |
static void setup_common() { | |
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { | |
} | |
} | |
static void setup_binderfs() { | |
if (mkdir("/dev/binderfs", 0777)) { | |
} | |
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { | |
} | |
if (symlink("/dev/binderfs", "./binderfs")) { | |
} | |
} | |
static void loop(); | |
static void sandbox_common() { | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setsid(); | |
int netns = open("/proc/self/ns/net", O_RDONLY); | |
if (netns == -1) exit(1); | |
if (dup2(netns, kInitNetNsFd) < 0) exit(1); | |
close(netns); | |
struct rlimit rlim; | |
rlim.rlim_cur = rlim.rlim_max = (200 << 20); | |
setrlimit(RLIMIT_AS, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 32 << 20; | |
setrlimit(RLIMIT_MEMLOCK, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 136 << 20; | |
setrlimit(RLIMIT_FSIZE, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 1 << 20; | |
setrlimit(RLIMIT_STACK, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 128 << 20; | |
setrlimit(RLIMIT_CORE, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 256; | |
setrlimit(RLIMIT_NOFILE, &rlim); | |
if (unshare(CLONE_NEWNS)) { | |
} | |
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { | |
} | |
if (unshare(CLONE_NEWIPC)) { | |
} | |
if (unshare(0x02000000)) { | |
} | |
if (unshare(CLONE_NEWUTS)) { | |
} | |
if (unshare(CLONE_SYSVSEM)) { | |
} | |
typedef struct { | |
const char* name; | |
const char* value; | |
} sysctl_t; | |
static const sysctl_t sysctls[] = { | |
{"/proc/sys/kernel/shmmax", "16777216"}, | |
{"/proc/sys/kernel/shmall", "536870912"}, | |
{"/proc/sys/kernel/shmmni", "1024"}, | |
{"/proc/sys/kernel/msgmax", "8192"}, | |
{"/proc/sys/kernel/msgmni", "1024"}, | |
{"/proc/sys/kernel/msgmnb", "1024"}, | |
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, | |
}; | |
unsigned i; | |
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) | |
write_file(sysctls[i].name, sysctls[i].value); | |
} | |
static int wait_for_loop(int pid) { | |
if (pid < 0) exit(1); | |
int status = 0; | |
while (waitpid(-1, &status, __WALL) != pid) { | |
} | |
return WEXITSTATUS(status); | |
} | |
static void drop_caps(void) { | |
struct __user_cap_header_struct cap_hdr = {}; | |
struct __user_cap_data_struct cap_data[2] = {}; | |
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; | |
cap_hdr.pid = getpid(); | |
if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); | |
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); | |
cap_data[0].effective &= ~drop; | |
cap_data[0].permitted &= ~drop; | |
cap_data[0].inheritable &= ~drop; | |
if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); | |
} | |
static int do_sandbox_none(void) { | |
if (unshare(CLONE_NEWPID)) { | |
} | |
int pid = fork(); | |
if (pid != 0) return wait_for_loop(pid); | |
setup_common(); | |
initialize_vhci(); | |
sandbox_common(); | |
drop_caps(); | |
if (unshare(CLONE_NEWNET)) { | |
} | |
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); | |
setup_binderfs(); | |
loop(); | |
exit(1); | |
} | |
static void kill_and_wait(int pid, int* status) { | |
kill(-pid, SIGKILL); | |
kill(pid, SIGKILL); | |
for (int i = 0; i < 100; i++) { | |
if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; | |
usleep(1000); | |
} | |
DIR* dir = opendir("/sys/fs/fuse/connections"); | |
if (dir) { | |
for (;;) { | |
struct dirent* ent = readdir(dir); | |
if (!ent) break; | |
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) | |
continue; | |
char abort[300]; | |
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", | |
ent->d_name); | |
int fd = open(abort, O_WRONLY); | |
if (fd == -1) { | |
continue; | |
} | |
if (write(fd, abort, 1) < 0) { | |
} | |
close(fd); | |
} | |
closedir(dir); | |
} else { | |
} | |
while (waitpid(-1, status, __WALL) != pid) { | |
} | |
} | |
static void setup_test() { | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setpgrp(); | |
write_file("/proc/self/oom_score_adj", "1000"); | |
} | |
static void close_fds() { | |
for (int fd = 3; fd < MAX_FDS; fd++) close(fd); | |
} | |
static void setup_binfmt_misc() { | |
if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) { | |
} | |
write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:"); | |
write_file("/proc/sys/fs/binfmt_misc/register", | |
":syz1:M:1:\x02::./file0:POC"); | |
} | |
#define NL802154_CMD_SET_SHORT_ADDR 11 | |
#define NL802154_ATTR_IFINDEX 3 | |
#define NL802154_ATTR_SHORT_ADDR 10 | |
static void setup_802154() { | |
int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); | |
if (sock_route == -1) exit(1); | |
int sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); | |
if (sock_generic < 0) exit(1); | |
int nl802154_family_id = | |
netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true); | |
for (int i = 0; i < 2; i++) { | |
char devname[] = "wpan0"; | |
devname[strlen(devname) - 1] += i; | |
uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8); | |
uint16_t shortaddr = 0xaaa0 + i; | |
int ifindex = if_nametoindex(devname); | |
struct genlmsghdr genlhdr; | |
memset(&genlhdr, 0, sizeof(genlhdr)); | |
genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR; | |
netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr)); | |
netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex)); | |
netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr, | |
sizeof(shortaddr)); | |
int err = netlink_send(&nlmsg, sock_generic); | |
if (err < 0) { | |
} | |
netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr, | |
sizeof(hwaddr), 0); | |
if (i == 0) { | |
netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false); | |
netlink_done(&nlmsg); | |
netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); | |
int err = netlink_send(&nlmsg, sock_route); | |
if (err < 0) { | |
} | |
} | |
} | |
close(sock_route); | |
close(sock_generic); | |
} | |
#define SWAP_FILE "./swap-file" | |
#define SWAP_FILE_SIZE (128 * 1000 * 1000) | |
static void setup_swap() { | |
swapoff(SWAP_FILE); | |
unlink(SWAP_FILE); | |
int fd = open(SWAP_FILE, O_CREAT | O_WRONLY | O_CLOEXEC, 0600); | |
if (fd == -1) { | |
exit(1); | |
return; | |
} | |
fallocate(fd, FALLOC_FL_ZERO_RANGE, 0, SWAP_FILE_SIZE); | |
close(fd); | |
char cmdline[64]; | |
sprintf(cmdline, "mkswap %s", SWAP_FILE); | |
if (runcmdline(cmdline)) { | |
exit(1); | |
return; | |
} | |
if (swapon(SWAP_FILE, SWAP_FLAG_PREFER) == 1) { | |
exit(1); | |
return; | |
} | |
} | |
struct thread_t { | |
int created, call; | |
event_t ready, done; | |
}; | |
static struct thread_t threads[16]; | |
static void execute_call(int call); | |
static int running; | |
static void* thr(void* arg) { | |
struct thread_t* th = (struct thread_t*)arg; | |
for (;;) { | |
event_wait(&th->ready); | |
event_reset(&th->ready); | |
execute_call(th->call); | |
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); | |
event_set(&th->done); | |
} | |
return 0; | |
} | |
static void execute_one(void) { | |
int i, call, thread; | |
for (call = 0; call < 5; call++) { | |
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); | |
thread++) { | |
struct thread_t* th = &threads[thread]; | |
if (!th->created) { | |
th->created = 1; | |
event_init(&th->ready); | |
event_init(&th->done); | |
event_set(&th->done); | |
thread_start(thr, th); | |
} | |
if (!event_isset(&th->done)) continue; | |
event_reset(&th->done); | |
th->call = call; | |
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); | |
event_set(&th->ready); | |
if (call == 1) break; | |
event_timedwait(&th->done, 50); | |
break; | |
} | |
} | |
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) | |
sleep_ms(1); | |
close_fds(); | |
} | |
static void execute_one(void); | |
#define WAIT_FLAGS __WALL | |
static void loop(void) { | |
int iter = 0; | |
for (;; iter++) { | |
int pid = fork(); | |
if (pid < 0) exit(1); | |
if (pid == 0) { | |
setup_test(); | |
execute_one(); | |
exit(0); | |
} | |
int status = 0; | |
uint64_t start = current_time_ms(); | |
for (;;) { | |
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; | |
sleep_ms(1); | |
if (current_time_ms() - start < 5000) continue; | |
kill_and_wait(pid, &status); | |
break; | |
} | |
} | |
} | |
uint64_t r[1] = {0xffffffffffffffff}; | |
void execute_call(int call) { | |
intptr_t res = 0; | |
switch (call) { | |
case 0: | |
res = -1; | |
NONFAILING( | |
res = syz_init_net_socket(/*fam=*/0x1f, /*type=*/5, /*proto=*/2)); | |
if (res != -1) r[0] = res; | |
break; | |
case 1: | |
NONFAILING(*(uint16_t*)0x20000040 = 0x1f); | |
NONFAILING(memset((void*)0x20000042, 170, 5)); | |
NONFAILING(*(uint8_t*)0x20000047 = 0); | |
syscall(__NR_connect, /*fd=*/r[0], /*addr=*/0x20000040ul, | |
/*addrlen=*/8ul); | |
break; | |
case 2: | |
NONFAILING(*(uint16_t*)0x20000000 = 0x1f); | |
NONFAILING(memset((void*)0x20000002, 0, 6)); | |
syscall(__NR_connect, /*fd=*/r[0], /*addr=*/0x20000000ul, | |
/*addrlen=*/8ul); | |
break; | |
case 3: | |
syscall(__NR_sendmsg, /*fd=*/-1, /*msg=*/0ul, /*f=*/0x48005ul); | |
break; | |
case 4: | |
syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x8933, /*arg=*/0ul); | |
break; | |
} | |
} | |
int main(void) { | |
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
setup_binfmt_misc(); | |
setup_802154(); | |
setup_swap(); | |
install_segv_handler(); | |
do_sandbox_none(); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) | |
connect$bt_sco(r0, &(0x7f0000000040)={0x1f, @fixed}, 0x8) (async) | |
connect$bt_sco(r0, &(0x7f0000000000), 0x8) | |
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x48005) | |
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment