// autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include __attribute__((noreturn)) static void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } } #include #include const int kFailStatus = 67; const int kRetryStatus = 69; static void exitf(const char* msg, ...) { int e = errno; va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit(kRetryStatus); } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { close(fd); return false; } close(fd); return true; } static int inject_fault(int nth) { int fd; char buf[16]; fd = open("/proc/thread-self/fail-nth", O_RDWR); if (fd == -1) exitf("failed to open /proc/thread-self/fail-nth"); sprintf(buf, "%d", nth + 1); if (write(fd, buf, strlen(buf)) != (ssize_t)strlen(buf)) exitf("failed to write /proc/thread-self/fail-nth"); return fd; } void loop() { syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); *(uint32_t*)0x2001d000 = (uint32_t)0x2; *(uint32_t*)0x2001d004 = (uint32_t)0x78; *(uint8_t*)0x2001d008 = (uint8_t)0xe3; *(uint8_t*)0x2001d009 = (uint8_t)0x0; *(uint8_t*)0x2001d00a = (uint8_t)0x0; *(uint8_t*)0x2001d00b = (uint8_t)0x0; *(uint32_t*)0x2001d00c = (uint32_t)0x0; *(uint64_t*)0x2001d010 = (uint64_t)0x0; *(uint64_t*)0x2001d018 = (uint64_t)0x0; *(uint64_t*)0x2001d020 = (uint64_t)0x0; *(uint8_t*)0x2001d028 = (uint8_t)0x80000040fe; *(uint8_t*)0x2001d029 = (uint8_t)0x0; *(uint8_t*)0x2001d02a = (uint8_t)0x0; *(uint8_t*)0x2001d02b = (uint8_t)0x0; *(uint32_t*)0x2001d02c = (uint32_t)0x0; *(uint32_t*)0x2001d030 = (uint32_t)0x0; *(uint32_t*)0x2001d034 = (uint32_t)0x0; *(uint64_t*)0x2001d038 = (uint64_t)0x0; *(uint64_t*)0x2001d040 = (uint64_t)0x0; *(uint64_t*)0x2001d048 = (uint64_t)0x0; *(uint64_t*)0x2001d050 = (uint64_t)0x0; *(uint64_t*)0x2001d058 = (uint64_t)0x0; *(uint32_t*)0x2001d060 = (uint32_t)0x0; *(uint64_t*)0x2001d068 = (uint64_t)0x0; *(uint32_t*)0x2001d070 = (uint32_t)0x0; *(uint16_t*)0x2001d074 = (uint16_t)0x0; *(uint16_t*)0x2001d076 = (uint16_t)0x0; syscall(__NR_perf_event_open, 0x2001d000ul, 0x0ul, 0x0ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x20f84000, "./file0", 8); syscall(__NR_creat, 0x20f84000ul, 0x0ul); memcpy((void*)0x206eaff8, "./file0", 8); memcpy((void*)0x206c6000, "./file0", 8); memcpy((void*)0x209aaffa, "tmpfs", 6); write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N"); write_file("/sys/kernel/debug/fail_futex/ignore-private", "N"); inject_fault(13); syscall(__NR_mount, 0x206eaff8ul, 0x206c6000ul, 0x209aaffaul, 0x200002ul, 0x20be9f95ul); } int main() { loop(); return 0; }