Project

General

Profile

Bug #371 » reproducer1_simplified.c

Sven Eckelmann, 12/31/2018 10:22 PM

 
1
// autogenerated by syzkaller (https://github.com/google/syzkaller)
2

    
3
#define _GNU_SOURCE
4

    
5
#include <endian.h>
6
#include <stdint.h>
7
#include <string.h>
8
#include <sys/syscall.h>
9
#include <unistd.h>
10
#include <sys/mman.h>
11

    
12
#include <stdio.h>
13
#include <sys/ioctl.h>
14
#include <net/if.h> 
15
#include <sys/types.h>
16
#include <sys/socket.h>
17
#include <netpacket/packet.h>
18
#include <net/ethernet.h>
19
#include <stdint.h>
20
#include <string.h>
21
#include <arpa/inet.h>
22
#include <unistd.h>
23

    
24

    
25
static void reset_test()
26
{
27
  int fd;
28
  for (fd = 3; fd < 30; fd++)
29
    close(fd);
30
}
31

    
32
void execute_one(void)
33
{
34
  uint8_t buf[] = "\x05\x03\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\xc5\x2c";
35
  struct ifreq req;
36
  int ifindex = 0;
37
  long res = 0;
38
  int sock;
39
  struct sockaddr_ll addr;
40
  int opt;
41

    
42
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
43

    
44
  sock = socket(PF_PACKET, SOCK_RAW, htons(0x1337));
45
  if (res == -1) {
46
    perror("socket");
47
    return;
48
  }
49

    
50
  strncpy(req.ifr_name, "batadv0", IFNAMSIZ);
51
  
52
  res = ioctl(sock, SIOCGIFINDEX, &req);
53
  if (res != -1)
54
    ifindex = req.ifr_ifindex;
55

    
56
  opt = 4;
57
  setsockopt(sock, SOL_PACKET, PACKET_QDISC_BYPASS, &opt, 4);
58

    
59

    
60
  addr.sll_family = AF_PACKET;
61
  addr.sll_protocol = 0;
62
  addr.sll_ifindex  = ifindex;
63

    
64
  bind(sock, (struct sockaddr *)&addr, sizeof(addr));
65
  sendto(sock, buf, sizeof(buf), 0, 0, 0);
66
}
67
int main(void)
68
{
69
  int iter;
70
  for (iter = 0;; iter++) {
71
      execute_one();
72
      reset_test();
73
  }
74
  return 0;
75
}
(3-3/3)