netfilter: nft_fib: NULL-ptr-deref (GPF) in nft_fib6_eval on netdev egress hook
Subsystems (2)
Hi!
A fib' expression in a netdev egress' base chain dereferences the input device nft_in(pkt), which is NULL on the transmit path, so any IPv6 packet leaving the chain's device hits a GPF / KASAN NULL-ptr-deref. An unprivileged user can set this up in a user+net namespace.
The bug was found with a custom syzkaller-based fuzzer.
Environment:
- Kernel: reproduced on mainline v7.1.0 (commit f0e6f20cb52b) and linux-next next-20260409; gcc 11.4.0.
- Vanilla kernel, untainted.
- Arch: x86_64; guest is QEMU (i440FX) under KVM.
- Config: CONFIG_NF_TABLES_NETDEV=y, CONFIG_NETFILTER_INGRESS=y, CONFIG_NETFILTER_EGRESS=y, CONFIG_IPV6=y, CONFIG_KASAN=y. Built with CONFIG_DEBUG_INFO=y and CONFIG_KALLSYMS=y.
Crash stack-trace:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000016: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] CPU: 0 UID: 0 PID: 482 Comm: repro_bugA Not tainted 7.1.0-gf0e6f20cb52b #1 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:nft_fib_is_loopback include/net/netfilter/nft_fib.h:19 [inline] RIP: 0010:nft_fib_can_skip include/net/netfilter/nft_fib.h:40 [inline] RIP: 0010:nft_fib6_eval+0x433/0x1060 net/ipv6/netfilter/nft_fib_ipv6.c:219 Code: d3 20 27 fd 0f b6 44 24 30 3c 05 74 4c e8 15 2c 27 fd 49 8d bf b0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ad 08 00 00 41 8b 87 b0 00 00 RSP: 0018:ffff8880099ae470 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: ffff8880099ae930 RCX: ffffffff8dc9cebb RDX: 0000000000000016 RSI: 0000000000000005 RDI: 00000000000000b0 RBP: ffff88800e0c5780 R08: ffff8880099ae8d0 R09: 000000000000003c R10: 0000000000000000 R11: 000000000003b819 R12: ffff88800e79f458 R13: ffff8880099aeb68 R14: ffff88800e79f460 R15: 0000000000000000 FS: 00007fb3a83926c0(0000) GS:ffff8880dc124000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000003100 CR3: 0000000003a3f000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> nft_fib_netdev_eval+0x146/0x280 net/netfilter/nft_fib_netdev.c:43 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x28b/0x1740 net/netfilter/nf_tables_core.c:285 nft_do_chain_netdev+0x76a/0xf40 net/netfilter/nft_chain_filter.c:307 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xcc/0x220 net/netfilter/core.c:619 nf_hook_egress include/linux/netfilter_netdev.h:108 [inline] __dev_queue_xmit+0x1f12/0x3440 net/core/dev.c:4801 dev_queue_xmit include/linux/netdevice.h:3436 [inline] neigh_resolve_output net/core/neighbour.c:1616 [inline] neigh_resolve_output+0x44c/0x780 net/core/neighbour.c:1596 neigh_output include/net/neighbour.h:560 [inline] ip6_finish_output2+0x981/0x17c0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x446/0x7b0 net/ipv6/ip6_output.c:208 ip6_finish_output net/ipv6/ip6_output.c:219 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x23b/0x480 net/ipv6/ip6_output.c:246 dst_output include/net/dst.h:470 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ip6_xmit+0xc9e/0x1a50 net/ipv6/ip6_output.c:379 tcp_v6_send_response+0xe5d/0x1cb0 net/ipv6/tcp_ipv6.c:992 tcp_v6_send_reset+0x508/0xda0 net/ipv6/tcp_ipv6.c:1127 tcp_v6_rcv+0x124c/0x3760 net/ipv6/tcp_ipv6.c:1929 ip6_protocol_deliver_rcu+0x315/0x10a0 net/ipv6/ip6_input.c:479 ip6_input_finish+0x1b8/0x3c0 net/ipv6/ip6_input.c:534 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ip6_input+0xcd/0x200 net/ipv6/ip6_input.c:545 dst_input include/net/dst.h:480 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:119 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:109 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x244/0x2c0 net/ipv6/ip6_input.c:351 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6206 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6319 netif_receive_skb_internal net/core/dev.c:6405 [inline] netif_receive_skb+0x8f/0x480 net/core/dev.c:6464 tun_rx_batched drivers/net/tun.c:1518 [inline] tun_get_user+0x2b96/0x3b00 drivers/net/tun.c:1986 tun_chr_write_iter+0x172/0x2b0 drivers/net/tun.c:2032 new_sync_write fs/read_write.c:595 [inline] vfs_write+0xa5c/0xd30 fs/read_write.c:687 ksys_write+0x124/0x240 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10c/0x5b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---
Root cause:nft_fib_is_loopback() reads in->flags without a NULL check (include/net/netfilter/nft_fib.h):
static inline bool
nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in)
{
return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK;
}nft_fib_can_skip() calls it with indev = nft_in(pkt):
static inline bool nft_fib_can_skip(const struct nft_pktinfo *pkt)
{
const struct net_device *indev = nft_in(pkt);
const struct sock *sk;
switch (nft_hook(pkt)) {
case NF_INET_PRE_ROUTING:
case NF_INET_INGRESS:
case NF_INET_LOCAL_IN:
break;
default:
return false;
}
sk = pkt->skb->sk;
if (sk && sk_fullsock(sk))
return sk->sk_rx_dst_ifindex == indev->ifindex;
return nft_fib_is_loopback(pkt->skb, indev);
}On the netdev egress hook nft_in(pkt) is NULL (there is no RX device on TX; nf_hook_egress initializes the hook state with in = NULL). Both the sk_fullsock branch (indev->ifindex) and the final nft_fib_is_loopback() call dereference indev. The switch is supposed to exclude such hooks, but a hook-number collision between two separate enums defeats it (include/uapi/linux/netfilter.h):
enum nf_inet_hooks { NF_INET_PRE_ROUTING=0, NF_INET_LOCAL_IN=1, ... };
enum nf_dev_hooks { NF_NETDEV_INGRESS=0, NF_NETDEV_EGRESS=1 };NF_NETDEV_EGRESS and NF_INET_LOCAL_IN are both 1. So a netdev egress chain (chain->ops.hooknum == NF_NETDEV_EGRESS) matches case NF_INET_LOCAL_IN and reaches the indev deref.
The same collision gets it past creation-time validation. nft_fib_validate() (net/netfilter/nft_fib.c) gates the hook with NF_INET_* bit masks, e.g. for oif/oifname:
hooks = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) |
(1 << NF_INET_FORWARD);
return nft_chain_validate_hooks(ctx->chain, hooks);(1 << NF_INET_LOCAL_IN) is bit 1, and the netdev egress chain's hooknum is also 1, so nft_chain_validate_hooks() accepts the rule. Nothing special-cases NFPROTO_NETDEV, so fib is allowed on the netdev egress hook and then crashes at eval.
This is not IPv6-specific. nft_fib_netdev_eval() routes ETH_P_IP the same way to nft_fib4_eval(), which also calls the shared nft_fib_can_skip(), so an IPv4 packet egressing the hooked device faults identically. The IPv6 splat above is just what the reproducer hit first.
Reproducer:
syz and standalone C reproducers are attached. The shape is:
table netdev t {
chain c {
type filter hook egress device "lo" priority 0;
fib daddr oif <reg> # any fib with result oif/oifname
}
}
# then send an IPv6 packet out loSteps:
1. Open a netlink netfilter socket and send one nfnetlink batch creating a netdev table plus an egress/device "lo" base chain holding a fib (oif) rule.
2. Send an IPv6 packet out lo. The attached C reproducer injects a TCP segment via a tun device whose RST egresses lo.
Reproduction is intermittent; loop the reproducer. Both the syz and C reproducers triggered the crash in a KVM VM.
Possible fix:
fib has no input device on the netdev egress hook, so it should be rejected there rather than faulting. Two options, both used elsewhere in nft:
- restrict fib on NFPROTO_NETDEV to NF_NETDEV_INGRESS in nft_fib_validate() (cf. nft_reject_netdev.c, which validates against (1 << NF_NETDEV_INGRESS) rather than NF_INET_* masks); and/or
- guard with if (!nft_in(pkt))' before the deref (cf. nft_socket.c, which does if (!indev) return NULL;').
I am not sure which approach is the best, so I have not sent a patch.
Also, there is a similar open syzbot report "KASAN: slab-out-of-bounds Read in nft_fib6_eval"
(syzkaller-upstream-moderation thread uuxFZL40IOo) but so far I consider it to be a
different bug: a heap OOB read in nft_fib6_info_nh_uses_dev (inet path), no reproducer.
This is a NULL deref in nft_fib_can_skip on the netdev egress path, with a reproducer.
Thanks,
Theodor Arsenij Larionov
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syza\x00'}]}, @NFT_MSG_NEWCHAIN={0x60, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syzb\x00'}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'filter\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x12c}, @NFTA_HOOK_DEV={0x14, 0x3, 'lo\x00'}]}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syze\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syzb\x00'}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_COUNTER_BYTES={0xc}]}]}, @NFT_MSG_NEWRULE={0xc8, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syze\x00'}, @NFTA_RULE_EXPRESSIONS={0x9c, 0x4, 0x0, 0x1, [{0x68, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_INNER_NUM={0x8}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x1f}, @NFTA_INNER_EXPR={0x34, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}}}, {0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}]}]}}}]}]}, @NFT_MSG_NEWCHAIN={0x30, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syze\x00'}, @NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x18, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}}}]}]}, @NFT_MSG_NEWCHAIN={0x30, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syzb\x00'}, @NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x18, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}}}]}]}, @NFT_MSG_NEWRULE={0x100, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syzb\x00'}, @NFTA_RULE_EXPRESSIONS={0xd4, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x30}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}}}, {0x2c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_IMMEDIATE_DATA={0xc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "21bb"}]}]}}}, {0x4c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_OP={0x8}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "ae4a"}]}, @NFTA_BITWISE_XOR={0xc, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "0440"}]}]}}}]}]}, @NFT_MSG_NEWRULE={0xb8, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syza\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syzb\x00'}, @NFTA_RULE_EXPRESSIONS={0x8c, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_INNER_NUM={0x8}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_INNER_HDRSIZE={0x8}, @NFTA_INNER_EXPR={0x24, 0x5, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}}}, {0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}]}]}]}}}]}]}], {0x14}}, 0x4cc}, 0x1, 0x0, 0x0, 0x4040}, 0x4000000) syz_emit_ethernet(0x4a, &(0x7f0000003100)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x5, 0x6, "bd1f5a", 0x14, 0x6, 0x1, @local, @local, {[], {{0x4e21, 0x4e22, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x40, 0x0, 0x0, 0x2}}}}}}}, 0x0)
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/sysmacros.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/capability.h>
#include <linux/futex.h>
#include <linux/genetlink.h>
#include <linux/if_addr.h>
#include <linux/if_ether.h>
#include <linux/if_link.h>
#include <linux/if_tun.h>
#include <linux/in6.h>
#include <linux/ip.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/tcp.h>
#include <linux/veth.h>
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}static void thread_start(void* (*fn)(void*), void* arg) {
pthread_t th;
pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break; }
exit(1);
}
#define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \
*(type*)(addr) = \
htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \
(((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))struct csum_inet {
uint32_t acc;
};
static void csum_inet_init(struct csum_inet* csum) {
csum->acc = 0;
}
static void csum_inet_update(struct csum_inet* csum, const uint8_t* data,
size_t length)
{
if (length == 0)
return;
size_t i = 0;
for (; i < length - 1; i += 2)
csum->acc += *(uint16_t*)&data[i];
if (length & 1)
csum->acc += le16toh((uint16_t)data[length - 1]);
while (csum->acc > 0xffff)
csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16);
}static uint16_t csum_inet_digest(struct csum_inet* csum) {
return ~csum->acc;
}
typedef struct {
int state;
} event_t;
static void event_init(event_t* ev)
{
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
if (ev->state)
exit(1);
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}
static void event_wait(event_t* ev)
{
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); }
static int event_isset(event_t* ev)
{
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}
static int event_timedwait(event_t* ev, uint64_t timeout) {
uint64_t start = current_time_ms();
uint64_t now = start;
for (;;) {
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
return 1;
now = current_time_ms();
if (now - start > timeout)
return 0; }
}
static bool write_file(const char* file, const char* what, ...) {
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args); va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false; }
close(fd);
return true;
}
struct nlmsg {
char* pos;
int nesting;
struct nlattr* nested[8];
char buf[4096];
};
static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
const void* data, int size)
{
memset(nlmsg, 0, sizeof(*nlmsg));
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size);
nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}
static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data,
int size)
{
struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size;
attr->nla_type = typ;
if (size > 0)
memcpy(attr + 1, data, size);
nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
}
static void netlink_nest(struct nlmsg* nlmsg, int typ) {
struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_type = typ;
nlmsg->pos += sizeof(*attr); nlmsg->nested[nlmsg->nesting++] = attr;
}
static void netlink_done(struct nlmsg* nlmsg)
{
struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; attr->nla_len = nlmsg->pos - (char*)attr;
}
static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type,
int* reply_len, bool dofail)
{
if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
exit(1);
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
struct sockaddr_nl addr;
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0,
(struct sockaddr*)&addr, sizeof(addr));
if (n != (ssize_t)hdr->nlmsg_len) {
if (dofail)
exit(1);
return -1;
}
n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
if (reply_len)
*reply_len = 0;
if (n < 0) {
if (dofail)
exit(1);
return -1;
}
if (n < (ssize_t)sizeof(struct nlmsghdr)) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
if (hdr->nlmsg_type == NLMSG_DONE)
return 0;
if (reply_len && hdr->nlmsg_type == reply_type) {
*reply_len = n;
return 0;
}
if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
if (hdr->nlmsg_type != NLMSG_ERROR) {
errno = EINVAL;
if (dofail)
exit(1);
return -1; }
errno = -((struct nlmsgerr*)(hdr + 1))->error;
return -errno;
}
static int netlink_send(struct nlmsg* nlmsg, int sock) {
return netlink_send_ext(nlmsg, sock, 0, NULL, true);
}
static int netlink_query_family_id(struct nlmsg* nlmsg, int sock,
const char* family_name, bool dofail)
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = CTRL_CMD_GETFAMILY;
netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name,
strnlen(family_name, GENL_NAMSIZ - 1) + 1);
int n = 0;
int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
if (err < 0) {
return -1;
}
uint16_t id = 0;
struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN +
NLMSG_ALIGN(sizeof(genlhdr)));
for (; (char*)attr < nlmsg->buf + n;
attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
id = *(uint16_t*)(attr + 1);
break;
}
}
if (!id) {
errno = EINVAL;
return -1; }
recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
return id;
}
static int netlink_next_msg(struct nlmsg* nlmsg, unsigned int offset,
unsigned int total_len)
{
struct nlmsghdr* hdr = (struct nlmsghdr*)(nlmsg->buf + offset); if (offset == total_len || offset + hdr->nlmsg_len > total_len)
return -1;
return hdr->nlmsg_len;
}
static unsigned int queue_count = 2;
static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type,
const char* name, bool up)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr,
sizeof(hdr));
if (name)
netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); netlink_attr(nlmsg, IFLA_NUM_TX_QUEUES, &queue_count, sizeof(queue_count)); netlink_attr(nlmsg, IFLA_NUM_RX_QUEUES, &queue_count, sizeof(queue_count)); netlink_nest(nlmsg, IFLA_LINKINFO);
netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type));
}
static void netlink_add_device(struct nlmsg* nlmsg, int sock, const char* type,
const char* name)
{
netlink_add_device_impl(nlmsg, type, name, false); netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_veth(struct nlmsg* nlmsg, int sock, const char* name,
const char* peer)
{
netlink_add_device_impl(nlmsg, "veth", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_nest(nlmsg, VETH_INFO_PEER);
nlmsg->pos += sizeof(struct ifinfomsg);
netlink_attr(nlmsg, IFLA_IFNAME, peer, strlen(peer)); netlink_attr(nlmsg, IFLA_NUM_TX_QUEUES, &queue_count, sizeof(queue_count)); netlink_attr(nlmsg, IFLA_NUM_RX_QUEUES, &queue_count, sizeof(queue_count)); netlink_done(nlmsg);
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_xfrm(struct nlmsg* nlmsg, int sock, const char* name) {
netlink_add_device_impl(nlmsg, "xfrm", name, true); netlink_nest(nlmsg, IFLA_INFO_DATA);
int if_id = 1;
netlink_attr(nlmsg, 2, &if_id, sizeof(if_id)); netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_hsr(struct nlmsg* nlmsg, int sock, const char* name,
const char* slave1, const char* slave2)
{
netlink_add_device_impl(nlmsg, "hsr", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA);
int ifindex1 = if_nametoindex(slave1);
netlink_attr(nlmsg, IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1)); int ifindex2 = if_nametoindex(slave2);
netlink_attr(nlmsg, IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2)); netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_linked(struct nlmsg* nlmsg, int sock, const char* type,
const char* name, const char* link)
{
netlink_add_device_impl(nlmsg, type, name, false); netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_vlan(struct nlmsg* nlmsg, int sock, const char* name,
const char* link, uint16_t id, uint16_t proto)
{
netlink_add_device_impl(nlmsg, "vlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_VLAN_ID, &id, sizeof(id)); netlink_attr(nlmsg, IFLA_VLAN_PROTOCOL, &proto, sizeof(proto)); netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_macvlan(struct nlmsg* nlmsg, int sock, const char* name,
const char* link)
{
netlink_add_device_impl(nlmsg, "macvlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA);
uint32_t mode = MACVLAN_MODE_BRIDGE;
netlink_attr(nlmsg, IFLA_MACVLAN_MODE, &mode, sizeof(mode)); netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_geneve(struct nlmsg* nlmsg, int sock, const char* name,
uint32_t vni, struct in_addr* addr4, struct in6_addr* addr6)
{
netlink_add_device_impl(nlmsg, "geneve", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_GENEVE_ID, &vni, sizeof(vni));
if (addr4)
netlink_attr(nlmsg, IFLA_GENEVE_REMOTE, addr4, sizeof(*addr4));
if (addr6)
netlink_attr(nlmsg, IFLA_GENEVE_REMOTE6, addr6, sizeof(*addr6)); netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
#define IFLA_IPVLAN_FLAGS 2
#define IPVLAN_MODE_L3S 2
#undef IPVLAN_F_VEPA
#define IPVLAN_F_VEPA 2
static void netlink_add_ipvlan(struct nlmsg* nlmsg, int sock, const char* name,
const char* link, uint16_t mode, uint16_t flags)
{
netlink_add_device_impl(nlmsg, "ipvlan", name, false); netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_IPVLAN_MODE, &mode, sizeof(mode)); netlink_attr(nlmsg, IFLA_IPVLAN_FLAGS, &flags, sizeof(flags)); netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_device_change(struct nlmsg* nlmsg, int sock,
const char* name, bool up, const char* master, const void* mac, int macsize, const char* new_name)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
hdr.ifi_index = if_nametoindex(name);
netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr));
if (new_name)
netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name));
if (master) {
int ifindex = if_nametoindex(master);
netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex));
}
if (macsize)
netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev,
const void* addr, int addrsize)
{
struct ifaddrmsg hdr;
memset(&hdr, 0, sizeof(hdr));
hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120;
hdr.ifa_scope = RT_SCOPE_UNIVERSE;
hdr.ifa_index = if_nametoindex(dev);
netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr,
sizeof(hdr));
netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); return netlink_send(nlmsg, sock);
}
static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, const char* dev,
const char* addr)
{
struct in_addr in_addr;
inet_pton(AF_INET, addr, &in_addr);
int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); if (err < 0) {
}
}
static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, const char* dev,
const char* addr)
{
struct in6_addr in6_addr;
inet_pton(AF_INET6, addr, &in6_addr);
int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); if (err < 0) {
}
}
static void netlink_add_neigh(struct nlmsg* nlmsg, int sock, const char* name,
const void* addr, int addrsize, const void* mac, int macsize)
{
struct ndmsg hdr;
memset(&hdr, 0, sizeof(hdr));
hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ndm_ifindex = if_nametoindex(name);
hdr.ndm_state = NUD_PERMANENT;
netlink_init(nlmsg, RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr,
sizeof(hdr));
netlink_attr(nlmsg, NDA_DST, addr, addrsize);
netlink_attr(nlmsg, NDA_LLADDR, mac, macsize);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static struct nlmsg nlmsg;
static int tunfd = -1;
#define TUN_IFACE "syz_tun"
#define LOCAL_MAC 0xaaaaaaaaaaaa
#define REMOTE_MAC 0xaaaaaaaaaabb
#define LOCAL_IPV4 "172.20.20.170"
#define REMOTE_IPV4 "172.20.20.187"
#define LOCAL_IPV6 "fe80::aa"
#define REMOTE_IPV6 "fe80::bb"
#define IFF_NAPI 0x0010
static void correct_dev_net_tun(void)
{
struct stat st;
if (stat("/dev/net/tun", &st) == 0) {
if (S_ISCHR(st.st_mode) && major(st.st_rdev) == 10 &&
minor(st.st_rdev) == 200)
return;
if (unlink("/dev/net/tun")) {
} }
if (mkdir("/dev/net", 0755) && errno != EEXIST) {
}
if (mknod("/dev/net/tun", S_IFCHR | 0666, makedev(10, 200))) { }
if (chmod("/dev/net/tun", 0666)) {
}
}
static void initialize_tun(void)
{
correct_dev_net_tun();
tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
if (tunfd == -1) {
printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n");
printf("otherwise fuzzing or reproducing might not work as intended\n");
return;
}
const int kTunFd = 200;
if (dup2(tunfd, kTunFd) < 0)
exit(1);
close(tunfd);
tunfd = kTunFd;
struct ifreq ifr;
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ);
ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) {
exit(1);
}
char sysctl[64];
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE);
write_file(sysctl, "0");
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE);
write_file(sysctl, "0");
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
netlink_add_addr4(&nlmsg, sock, TUN_IFACE, LOCAL_IPV4);
netlink_add_addr6(&nlmsg, sock, TUN_IFACE, LOCAL_IPV6);
uint64_t macaddr = REMOTE_MAC;
struct in_addr in_addr;
inet_pton(AF_INET, REMOTE_IPV4, &in_addr);
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in_addr, sizeof(in_addr),
&macaddr, ETH_ALEN);
struct in6_addr in6_addr;
inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr);
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in6_addr, sizeof(in6_addr),
&macaddr, ETH_ALEN);
macaddr = LOCAL_MAC;
netlink_device_change(&nlmsg, sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN,
NULL); close(sock);
}
#define DEVLINK_FAMILY_NAME "devlink"
#define DEVLINK_CMD_PORT_GET 5
#define DEVLINK_ATTR_BUS_NAME 1
#define DEVLINK_ATTR_DEV_NAME 2
#define DEVLINK_ATTR_NETDEV_NAME 7
static struct nlmsg nlmsg2;
static void initialize_devlink_ports(const char* bus_name, const char* dev_name,
const char* netdev_prefix)
{
struct genlmsghdr genlhdr;
int len, total_len, id, err, offset;
uint16_t netdev_index;
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock == -1)
exit(1);
int rtsock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (rtsock == -1)
exit(1);
id = netlink_query_family_id(&nlmsg, sock, DEVLINK_FAMILY_NAME, true);
if (id == -1)
goto error;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = DEVLINK_CMD_PORT_GET;
netlink_init(&nlmsg, id, NLM_F_DUMP, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, DEVLINK_ATTR_BUS_NAME, bus_name, strlen(bus_name) + 1);
netlink_attr(&nlmsg, DEVLINK_ATTR_DEV_NAME, dev_name, strlen(dev_name) + 1);
err = netlink_send_ext(&nlmsg, sock, id, &total_len, true);
if (err < 0) {
goto error;
}
offset = 0;
netdev_index = 0;
while ((len = netlink_next_msg(&nlmsg, offset, total_len)) != -1) {
struct nlattr* attr = (struct nlattr*)(nlmsg.buf + offset + NLMSG_HDRLEN +
NLMSG_ALIGN(sizeof(genlhdr)));
for (; (char*)attr < nlmsg.buf + offset + len;
attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
if (attr->nla_type == DEVLINK_ATTR_NETDEV_NAME) {
char* port_name;
char netdev_name[IFNAMSIZ];
port_name = (char*)(attr + 1);
snprintf(netdev_name, sizeof(netdev_name), "%s%d", netdev_prefix,
netdev_index);
netlink_device_change(&nlmsg2, rtsock, port_name, true, 0, 0, 0,
netdev_name);
break;
}
}
offset += len;
netdev_index++; }
error:
close(rtsock);
close(sock);
}
#define DEV_IPV4 "172.20.20.%d"
#define DEV_IPV6 "fe80::%02x"
#define DEV_MAC 0x00aaaaaaaaaa
static void netdevsim_add(unsigned int addr, unsigned int port_count) {
write_file("/sys/bus/netdevsim/del_device", "%u", addr);
if (write_file("/sys/bus/netdevsim/new_device", "%u %u", addr, port_count)) {
char buf[32];
snprintf(buf, sizeof(buf), "netdevsim%d", addr);
initialize_devlink_ports("netdevsim", buf, "netdevsim"); }
}
#define WG_GENL_NAME "wireguard"
enum wg_cmd {
WG_CMD_GET_DEVICE,
WG_CMD_SET_DEVICE,
};
enum wgdevice_attribute {
WGDEVICE_A_UNSPEC,
WGDEVICE_A_IFINDEX,
WGDEVICE_A_IFNAME,
WGDEVICE_A_PRIVATE_KEY,
WGDEVICE_A_PUBLIC_KEY,
WGDEVICE_A_FLAGS,
WGDEVICE_A_LISTEN_PORT,
WGDEVICE_A_FWMARK,
WGDEVICE_A_PEERS,
};
enum wgpeer_attribute {
WGPEER_A_UNSPEC,
WGPEER_A_PUBLIC_KEY,
WGPEER_A_PRESHARED_KEY,
WGPEER_A_FLAGS,
WGPEER_A_ENDPOINT,
WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
WGPEER_A_LAST_HANDSHAKE_TIME,
WGPEER_A_RX_BYTES,
WGPEER_A_TX_BYTES,
WGPEER_A_ALLOWEDIPS,
WGPEER_A_PROTOCOL_VERSION,
};
enum wgallowedip_attribute {
WGALLOWEDIP_A_UNSPEC,
WGALLOWEDIP_A_FAMILY,
WGALLOWEDIP_A_IPADDR,
WGALLOWEDIP_A_CIDR_MASK,
};
static void netlink_wireguard_setup(void)
{
const char ifname_a[] = "wg0";
const char ifname_b[] = "wg1";
const char ifname_c[] = "wg2";
const char private_a[] =
"\xa0\x5c\xa8\x4f\x6c\x9c\x8e\x38\x53\xe2\xfd\x7a\x70\xae\x0f\xb2\x0f\xa1"
"\x52\x60\x0c\xb0\x08\x45\x17\x4f\x08\x07\x6f\x8d\x78\x43";
const char private_b[] =
"\xb0\x80\x73\xe8\xd4\x4e\x91\xe3\xda\x92\x2c\x22\x43\x82\x44\xbb\x88\x5c"
"\x69\xe2\x69\xc8\xe9\xd8\x35\xb1\x14\x29\x3a\x4d\xdc\x6e";
const char private_c[] =
"\xa0\xcb\x87\x9a\x47\xf5\xbc\x64\x4c\x0e\x69\x3f\xa6\xd0\x31\xc7\x4a\x15"
"\x53\xb6\xe9\x01\xb9\xff\x2f\x51\x8c\x78\x04\x2f\xb5\x42";
const char public_a[] =
"\x97\x5c\x9d\x81\xc9\x83\xc8\x20\x9e\xe7\x81\x25\x4b\x89\x9f\x8e\xd9\x25"
"\xae\x9f\x09\x23\xc2\x3c\x62\xf5\x3c\x57\xcd\xbf\x69\x1c";
const char public_b[] =
"\xd1\x73\x28\x99\xf6\x11\xcd\x89\x94\x03\x4d\x7f\x41\x3d\xc9\x57\x63\x0e"
"\x54\x93\xc2\x85\xac\xa4\x00\x65\xcb\x63\x11\xbe\x69\x6b";
const char public_c[] =
"\xf4\x4d\xa3\x67\xa8\x8e\xe6\x56\x4f\x02\x02\x11\x45\x67\x27\x08\x2f\x5c"
"\xeb\xee\x8b\x1b\xf5\xeb\x73\x37\x34\x1b\x45\x9b\x39\x22";
const uint16_t listen_a = 20001;
const uint16_t listen_b = 20002;
const uint16_t listen_c = 20003;
const uint16_t af_inet = AF_INET;
const uint16_t af_inet6 = AF_INET6;
const struct sockaddr_in endpoint_b_v4 = {
.sin_family = AF_INET,
.sin_port = htons(listen_b),
.sin_addr = {htonl(INADDR_LOOPBACK)}};
const struct sockaddr_in endpoint_c_v4 = {
.sin_family = AF_INET,
.sin_port = htons(listen_c),
.sin_addr = {htonl(INADDR_LOOPBACK)}};
struct sockaddr_in6 endpoint_a_v6 = {.sin6_family = AF_INET6,
.sin6_port = htons(listen_a)};
endpoint_a_v6.sin6_addr = in6addr_loopback;
struct sockaddr_in6 endpoint_c_v6 = {.sin6_family = AF_INET6,
.sin6_port = htons(listen_c)};
endpoint_c_v6.sin6_addr = in6addr_loopback;
const struct in_addr first_half_v4 = {0};
const struct in_addr second_half_v4 = {(uint32_t)htonl(128 << 24)};
const struct in6_addr first_half_v6 = {{{0}}};
const struct in6_addr second_half_v6 = {{{0x80}}};
const uint8_t half_cidr = 1;
const uint16_t persistent_keepalives[] = {1, 3, 7, 9, 14, 19};
struct genlmsghdr genlhdr = {.cmd = WG_CMD_SET_DEVICE, .version = 1};
int sock;
int id, err;
sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock == -1) {
return;
}
id = netlink_query_family_id(&nlmsg, sock, WG_GENL_NAME, true);
if (id == -1)
goto error;
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_a, strlen(ifname_a) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_a, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_a, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4,
sizeof(endpoint_b_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
&persistent_keepalives[0], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4,
sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6,
sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v6,
sizeof(endpoint_c_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
&persistent_keepalives[1], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4,
sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6,
sizeof(second_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_b, strlen(ifname_b) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_b, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_b, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6,
sizeof(endpoint_a_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
&persistent_keepalives[2], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4,
sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6,
sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v4,
sizeof(endpoint_c_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
&persistent_keepalives[3], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4,
sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6,
sizeof(second_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_c, strlen(ifname_c) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_c, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_c, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6,
sizeof(endpoint_a_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
&persistent_keepalives[4], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4,
sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6,
sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4,
sizeof(endpoint_b_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
&persistent_keepalives[5], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4,
sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6,
sizeof(second_half_v6)); netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
error:
close(sock);
}
static void initialize_netdevices(void)
{
char netdevsim[16];
sprintf(netdevsim, "netdevsim%d", (int)procid);
struct {
const char* type;
const char* dev;
} devtypes[] = {
{"ip6gretap", "ip6gretap0"}, {"bridge", "bridge0"}, {"vcan", "vcan0"},
{"bond", "bond0"}, {"team", "team0"}, {"dummy", "dummy0"},
{"nlmon", "nlmon0"}, {"caif", "caif0"}, {"batadv", "batadv0"},
{"vxcan", "vxcan1"}, {"veth", 0}, {"wireguard", "wg0"},
{"wireguard", "wg1"}, {"wireguard", "wg2"},
};
const char* devmasters[] = {"bridge", "bond", "team", "batadv"};
struct {
const char* name;
int macsize;
bool noipv6;
} devices[] = {
{"lo", ETH_ALEN},
{"sit0", 0},
{"bridge0", ETH_ALEN},
{"vcan0", 0, true},
{"tunl0", 0},
{"gre0", 0},
{"gretap0", ETH_ALEN},
{"ip_vti0", 0},
{"ip6_vti0", 0},
{"ip6tnl0", 0},
{"ip6gre0", 0},
{"ip6gretap0", ETH_ALEN},
{"erspan0", ETH_ALEN},
{"bond0", ETH_ALEN},
{"veth0", ETH_ALEN},
{"veth1", ETH_ALEN},
{"team0", ETH_ALEN},
{"veth0_to_bridge", ETH_ALEN},
{"veth1_to_bridge", ETH_ALEN},
{"veth0_to_bond", ETH_ALEN},
{"veth1_to_bond", ETH_ALEN},
{"veth0_to_team", ETH_ALEN},
{"veth1_to_team", ETH_ALEN},
{"veth0_to_hsr", ETH_ALEN},
{"veth1_to_hsr", ETH_ALEN},
{"hsr0", 0},
{"dummy0", ETH_ALEN},
{"nlmon0", 0},
{"vxcan0", 0, true},
{"vxcan1", 0, true},
{"caif0", ETH_ALEN},
{"batadv0", ETH_ALEN},
{netdevsim, ETH_ALEN},
{"xfrm0", ETH_ALEN},
{"veth0_virt_wifi", ETH_ALEN},
{"veth1_virt_wifi", ETH_ALEN},
{"virt_wifi0", ETH_ALEN},
{"veth0_vlan", ETH_ALEN},
{"veth1_vlan", ETH_ALEN},
{"vlan0", ETH_ALEN},
{"vlan1", ETH_ALEN},
{"macvlan0", ETH_ALEN},
{"macvlan1", ETH_ALEN},
{"ipvlan0", ETH_ALEN},
{"ipvlan1", ETH_ALEN},
{"veth0_macvtap", ETH_ALEN},
{"veth1_macvtap", ETH_ALEN},
{"macvtap0", ETH_ALEN},
{"macsec0", ETH_ALEN},
{"veth0_to_batadv", ETH_ALEN},
{"veth1_to_batadv", ETH_ALEN},
{"batadv_slave_0", ETH_ALEN},
{"batadv_slave_1", ETH_ALEN},
{"geneve0", ETH_ALEN},
{"geneve1", ETH_ALEN},
{"wg0", 0},
{"wg1", 0},
{"wg2", 0},
};
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
unsigned i;
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++)
netlink_add_device(&nlmsg, sock, devtypes[i].type, devtypes[i].dev);
for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) {
char master[32], slave0[32], veth0[32], slave1[32], veth1[32];
sprintf(slave0, "%s_slave_0", devmasters[i]);
sprintf(veth0, "veth0_to_%s", devmasters[i]);
netlink_add_veth(&nlmsg, sock, slave0, veth0);
sprintf(slave1, "%s_slave_1", devmasters[i]);
sprintf(veth1, "veth1_to_%s", devmasters[i]);
netlink_add_veth(&nlmsg, sock, slave1, veth1);
sprintf(master, "%s0", devmasters[i]);
netlink_device_change(&nlmsg, sock, slave0, false, master, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, slave1, false, master, 0, 0, NULL);
}
netlink_add_xfrm(&nlmsg, sock, "xfrm0");
netlink_device_change(&nlmsg, sock, "bridge_slave_0", true, 0, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, "bridge_slave_1", true, 0, 0, 0, NULL);
netlink_add_veth(&nlmsg, sock, "hsr_slave_0", "veth0_to_hsr");
netlink_add_veth(&nlmsg, sock, "hsr_slave_1", "veth1_to_hsr");
netlink_add_hsr(&nlmsg, sock, "hsr0", "hsr_slave_0", "hsr_slave_1");
netlink_device_change(&nlmsg, sock, "hsr_slave_0", true, 0, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, "hsr_slave_1", true, 0, 0, 0, NULL);
netlink_add_veth(&nlmsg, sock, "veth0_virt_wifi", "veth1_virt_wifi");
netlink_add_linked(&nlmsg, sock, "virt_wifi", "virt_wifi0",
"veth1_virt_wifi");
netlink_add_veth(&nlmsg, sock, "veth0_vlan", "veth1_vlan");
netlink_add_vlan(&nlmsg, sock, "vlan0", "veth0_vlan", 0, htons(ETH_P_8021Q));
netlink_add_vlan(&nlmsg, sock, "vlan1", "veth0_vlan", 1, htons(ETH_P_8021AD));
netlink_add_macvlan(&nlmsg, sock, "macvlan0", "veth1_vlan");
netlink_add_macvlan(&nlmsg, sock, "macvlan1", "veth1_vlan");
netlink_add_ipvlan(&nlmsg, sock, "ipvlan0", "veth0_vlan", IPVLAN_MODE_L2, 0);
netlink_add_ipvlan(&nlmsg, sock, "ipvlan1", "veth0_vlan", IPVLAN_MODE_L3S,
IPVLAN_F_VEPA);
netlink_add_veth(&nlmsg, sock, "veth0_macvtap", "veth1_macvtap");
netlink_add_linked(&nlmsg, sock, "macvtap", "macvtap0", "veth0_macvtap");
netlink_add_linked(&nlmsg, sock, "macsec", "macsec0", "veth1_macvtap");
char addr[32];
sprintf(addr, DEV_IPV4, 14 + 10);
struct in_addr geneve_addr4;
if (inet_pton(AF_INET, addr, &geneve_addr4) <= 0)
exit(1);
struct in6_addr geneve_addr6;
if (inet_pton(AF_INET6, "fc00::01", &geneve_addr6) <= 0)
exit(1);
netlink_add_geneve(&nlmsg, sock, "geneve0", 0, &geneve_addr4, 0);
netlink_add_geneve(&nlmsg, sock, "geneve1", 1, 0, &geneve_addr6);
netdevsim_add((int)procid, 4);
netlink_wireguard_setup();
for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) {
char addr[32];
sprintf(addr, DEV_IPV4, i + 10);
netlink_add_addr4(&nlmsg, sock, devices[i].name, addr);
if (!devices[i].noipv6) {
sprintf(addr, DEV_IPV6, i + 10);
netlink_add_addr6(&nlmsg, sock, devices[i].name, addr);
}
uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40);
netlink_device_change(&nlmsg, sock, devices[i].name, true, 0, &macaddr,
devices[i].macsize, NULL); }
close(sock);
}
static void initialize_netdevices_init(void)
{
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1)
exit(1);
struct {
const char* type;
int macsize;
bool noipv6;
bool noup;
} devtypes[] = {
{"nr", 7, true},
{"rose", 5, true, true},
};
unsigned i;
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) {
char dev[32], addr[32];
sprintf(dev, "%s%d", devtypes[i].type, (int)procid);
sprintf(addr, "172.30.%d.%d", i, (int)procid + 1);
netlink_add_addr4(&nlmsg, sock, dev, addr);
if (!devtypes[i].noipv6) {
sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1);
netlink_add_addr6(&nlmsg, sock, dev, addr);
}
int macsize = devtypes[i].macsize;
uint64_t macaddr = 0xbbbbbb +
((unsigned long long)i << (8 * (macsize - 2))) +
(procid << (8 * (macsize - 1)));
netlink_device_change(&nlmsg, sock, dev, !devtypes[i].noup, 0, &macaddr,
macsize, NULL); }
close(sock);
}
static int read_tun(char* data, int size)
{
if (tunfd < 0)
return -1;
int rv = read(tunfd, data, size);
if (rv < 0) {
if (errno == EAGAIN || errno == EBADF || errno == EBADFD)
return -1;
exit(1); }
return rv;
}
static long syz_emit_ethernet(volatile long a0, volatile long a1,
volatile long a2)
{
if (tunfd < 0)
return (uintptr_t)-1;
uint32_t length = a0;
char* data = (char*)a1;
return write(tunfd, data, length);
}
static void flush_tun()
{
char data[1000];
while (read_tun(&data[0], sizeof(data)) != -1) { }
}
static void setup_gadgetfs();
static void setup_binderfs();
static void setup_fusectl();
static void sandbox_common_mount_tmpfs(void)
{
write_file("/proc/sys/fs/mount-max", "100000");
if (mkdir("./syz-tmp", 0777))
exit(1);
if (mount("", "./syz-tmp", "tmpfs", 0, NULL))
exit(1);
if (mkdir("./syz-tmp/newroot", 0777))
exit(1);
if (mkdir("./syz-tmp/newroot/dev", 0700))
exit(1);
unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE;
if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL))
exit(1);
if (mkdir("./syz-tmp/newroot/proc", 0700))
exit(1);
if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL))
exit(1);
if (mkdir("./syz-tmp/newroot/selinux", 0700))
exit(1);
const char* selinux_path = "./syz-tmp/newroot/selinux";
if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) {
if (errno != ENOENT)
exit(1);
if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) &&
errno != ENOENT)
exit(1);
}
if (mkdir("./syz-tmp/newroot/sys", 0700))
exit(1);
if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL))
exit(1);
if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL,
bind_mount_flags, NULL) &&
errno != ENOENT)
exit(1);
if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL,
bind_mount_flags, NULL) &&
errno != ENOENT)
exit(1);
if (mount("/proc/sys/fs/binfmt_misc",
"./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags,
NULL) &&
errno != ENOENT)
exit(1);
if (mkdir("./syz-tmp/newroot/syz-inputs", 0700))
exit(1);
if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL,
bind_mount_flags | MS_RDONLY, NULL) &&
errno != ENOENT)
exit(1);
if (mkdir("./syz-tmp/pivot", 0777))
exit(1);
if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) {
if (chdir("./syz-tmp"))
exit(1);
} else {
if (chdir("/"))
exit(1);
if (umount2("./pivot", MNT_DETACH))
exit(1);
}
if (chroot("./newroot"))
exit(1);
if (chdir("/"))
exit(1); setup_gadgetfs();
setup_binderfs();
setup_fusectl();
}
static void setup_gadgetfs()
{
if (mkdir("/dev/gadgetfs", 0777)) {
}
if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) { }
}
static void setup_fusectl()
{
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { }
}
static void setup_binderfs()
{
if (mkdir("/dev/binderfs", 0777)) {
}
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { }
}
static void loop();
static void sandbox_common()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
if (getppid() == 1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = (200 << 20);
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 32 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 136 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
if (unshare(CLONE_NEWNS)) {
}
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
}
if (unshare(CLONE_NEWIPC)) {
}
if (unshare(0x02000000)) {
}
if (unshare(CLONE_NEWUTS)) {
}
if (unshare(CLONE_SYSVSEM)) {
}
typedef struct {
const char* name;
const char* value;
} sysctl_t;
static const sysctl_t sysctls[] = {
{"/proc/sys/kernel/shmmax", "16777216"},
{"/proc/sys/kernel/shmall", "536870912"},
{"/proc/sys/kernel/shmmni", "1024"},
{"/proc/sys/kernel/msgmax", "8192"},
{"/proc/sys/kernel/msgmni", "1024"},
{"/proc/sys/kernel/msgmnb", "1024"},
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
};
unsigned i;
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
write_file(sysctls[i].name, sysctls[i].value);
}static int wait_for_loop(int pid)
{
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, __WALL) != pid) {
}
return WEXITSTATUS(status);
}
static void drop_caps(void)
{
struct __user_cap_header_struct cap_hdr = {};
struct __user_cap_data_struct cap_data[2] = {};
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
cap_hdr.pid = getpid();
if (syscall(SYS_capget, &cap_hdr, &cap_data))
exit(1);
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
cap_data[0].effective &= ~drop;
cap_data[0].permitted &= ~drop;
cap_data[0].inheritable &= ~drop;
if (syscall(SYS_capset, &cap_hdr, &cap_data))
exit(1);
}static int real_uid;
static int real_gid;__attribute__((aligned(64 << 10))) static char sandbox_stack[1 << 20];
static int namespace_sandbox_proc(void* arg)
{
sandbox_common(); write_file("/proc/self/setgroups", "deny");
if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid))
exit(1);
if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid))
exit(1);
initialize_netdevices_init();
if (unshare(CLONE_NEWNET))
exit(1); write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); initialize_tun();
initialize_netdevices(); sandbox_common_mount_tmpfs();
drop_caps();
loop();
exit(1);
}
static int do_sandbox_namespace(void)
{
real_uid = getuid();
real_gid = getgid();
mprotect(sandbox_stack, 4096, PROT_NONE);
int pid =
clone(namespace_sandbox_proc, &sandbox_stack[sizeof(sandbox_stack) - 64],
CLONE_NEWUSER | CLONE_NEWPID, 0);
return wait_for_loop(pid);
}
#define FS_IOC_SETFLAGS _IOW('f', 2, long) static void remove_dir(const char* dir)
{
int iter = 0;
DIR* dp = 0;
const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW;
retry:
while (umount2(dir, umount_flags) == 0) {
}
dp = opendir(dir);
if (dp == NULL) {
if (errno == EMFILE) {
exit(1);
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
while (umount2(filename, umount_flags) == 0) {
}
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
int i;
for (i = 0;; i++) {
if (unlink(filename) == 0)
break;
if (errno == EPERM) {
int fd = open(filename, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno != EBUSY || i > 100)
exit(1);
if (umount2(filename, umount_flags))
exit(1);
}
}
closedir(dp);
for (int i = 0;; i++) {
if (rmdir(dir) == 0)
break;
if (i < 100) {
if (errno == EPERM) {
int fd = open(dir, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno == EBUSY) {
if (umount2(dir, umount_flags))
exit(1);
continue;
}
if (errno == ENOTEMPTY) {
if (iter < 100) {
iter++;
goto retry;
}
}
}
exit(1); }
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir); } else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
flush_tun();
if (symlink("/dev/binderfs", "./binderfs")) {
}
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done); }
return 0;
}
static void execute_one(void)
{
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { }
int i, call, thread;
for (call = 0; call < 5; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
if (call == 1)
break;
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
sleep_ms(10);
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf); }
}
uint64_t r[1] = {0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
// socket$nl_netfilter arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0xc (4 bytes)
// ]
// returns sock_nl_netfilter
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc);
if (res != -1)
r[0] = res;
break;
case 1:
// syz_emit_ethernet arguments: [
// len: len = 0x3a (8 bytes)
// packet: ptr[in, eth_packet] {
// eth_packet {
// dst_mac: union mac_addr {
// local: mac_addr_t[const[0xaa, int8]] {
// a0: buffer: {aa aa aa aa aa} (length 0x5)
// a1: const = 0xaa (1 bytes)
// }
// }
// src_mac: union mac_addr {
// random: buffer: {cd 7c 1e 70 5d 31} (length 0x6)
// }
// vtag: union optional[vlan_tag] {
// void: buffer: {} (length 0x0)
// }
// payload: eth_payload {
// eth2: union eth2_packet {
// ipv4: eth2_packet_t[ETH_P_IP, ipv4_packet] {
// etype: const = 0x800 (2 bytes)
// payload: union ipv4_packet {
// udp: ipv4_packet_t[const[IPPROTO_UDP, int8], udp_packet] {
// header: ipv4_header[const[IPPROTO_UDP, int8]] {
// ihl: bytesize4 = 0x5 (0 bytes)
// version: const = 0x4 (1 bytes)
// ecn: int8 = 0x0 (0 bytes)
// dscp: int8 = 0x35 (1 bytes)
// total_len: len = 0x2c (2 bytes)
// id: int16be = 0x66 (2 bytes)
// frag_off: int16be = 0x0 (2 bytes)
// ttl: int8 = 0x8 (1 bytes)
// protocol: const = 0x11 (1 bytes)
// csum: csum = 0x0 (2 bytes)
// src_ip: union ipv4_addr {
// rand_addr: int32be = 0x64010101 (4 bytes)
// }
// dst_ip: union ipv4_addr {
// local: ipv4_addr_t[const[170, int8]] {
// a0: const = 0xac (1 bytes)
// a1: const = 0x14 (1 bytes)
// a2: const = 0x14 (1 bytes)
// a3: const = 0xaa (1 bytes)
// }
// }
// options: ipv4_options {
// options: array[ipv4_option] {
// }
// }
// }
// payload: udp_packet {
// src_port: int16be = 0x4e21 (2 bytes)
// dst_port: int16be = 0x4e24 (2 bytes)
// length: len = 0x18 (2 bytes)
// csum: csum = 0x0 (2 bytes)
// payload: union udp_payload {
// wg: union wg_packet {
// data: message_data {
// type: const = 0x4 (4 bytes)
// key_idx: int32 = 0x9 (4 bytes)
// counter: int64 = 0x1800000000 (8 bytes)
// encrypted_data: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// }
// }
// }
// }
// }
// frags: nil
// ]
memset((void*)0x2000000006c0, 170, 5);
*(uint8_t*)0x2000000006c5 = 0xaa;
memcpy((void*)0x2000000006c6, "\xcd\x7c\x1e\x70\x5d\x31", 6);
*(uint16_t*)0x2000000006cc = htobe16(0x800);
STORE_BY_BITMASK(uint8_t, , 0x2000000006ce, 5, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000006ce, 4, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000006cf, 0, 0, 2);
STORE_BY_BITMASK(uint8_t, , 0x2000000006cf, 0x35, 2, 6);
*(uint16_t*)0x2000000006d0 = htobe16(0x2c);
*(uint16_t*)0x2000000006d2 = htobe16(0x66);
*(uint16_t*)0x2000000006d4 = htobe16(0);
*(uint8_t*)0x2000000006d6 = 8;
*(uint8_t*)0x2000000006d7 = 0x11;
*(uint16_t*)0x2000000006d8 = htobe16(0);
*(uint32_t*)0x2000000006da = htobe32(0x64010101);
*(uint8_t*)0x2000000006de = 0xac;
*(uint8_t*)0x2000000006df = 0x14;
*(uint8_t*)0x2000000006e0 = 0x14;
*(uint8_t*)0x2000000006e1 = 0xaa;
*(uint16_t*)0x2000000006e2 = htobe16(0x4e21);
*(uint16_t*)0x2000000006e4 = htobe16(0x4e24);
*(uint16_t*)0x2000000006e6 = htobe16(0x18);
*(uint16_t*)0x2000000006e8 = htobe16(0);
*(uint32_t*)0x2000000006ea = 4;
*(uint32_t*)0x2000000006ee = 9;
*(uint64_t*)0x2000000006f2 = 0x1800000000;
struct csum_inet csum_1;
csum_inet_init(&csum_1);
csum_inet_update(&csum_1, (const uint8_t*)0x2000000006da, 4);
csum_inet_update(&csum_1, (const uint8_t*)0x2000000006de, 4);
uint16_t csum_1_chunk_2 = 0x1100;
csum_inet_update(&csum_1, (const uint8_t*)&csum_1_chunk_2, 2);
uint16_t csum_1_chunk_3 = 0x1800;
csum_inet_update(&csum_1, (const uint8_t*)&csum_1_chunk_3, 2);
csum_inet_update(&csum_1, (const uint8_t*)0x2000000006e2, 24);
*(uint16_t*)0x2000000006e8 = csum_inet_digest(&csum_1);
struct csum_inet csum_2;
csum_inet_init(&csum_2);
csum_inet_update(&csum_2, (const uint8_t*)0x2000000006ce, 20);
*(uint16_t*)0x2000000006d8 = csum_inet_digest(&csum_2);
syz_emit_ethernet(/*len=*/0x3a, /*packet=*/0x2000000006c0, /*frags=*/0);
break;
case 2:
// syz_emit_ethernet arguments: [
// len: len = 0x3a (8 bytes)
// packet: ptr[in, eth_packet] {
// eth_packet {
// dst_mac: union mac_addr {
// local: mac_addr_t[const[0xaa, int8]] {
// a0: buffer: {aa aa aa aa aa} (length 0x5)
// a1: const = 0xaa (1 bytes)
// }
// }
// src_mac: union mac_addr {
// random: buffer: {cd 7c 1e 70 5d 31} (length 0x6)
// }
// vtag: union optional[vlan_tag] {
// void: buffer: {} (length 0x0)
// }
// payload: eth_payload {
// eth2: union eth2_packet {
// ipv4: eth2_packet_t[ETH_P_IP, ipv4_packet] {
// etype: const = 0x800 (2 bytes)
// payload: union ipv4_packet {
// udp: ipv4_packet_t[const[IPPROTO_UDP, int8], udp_packet] {
// header: ipv4_header[const[IPPROTO_UDP, int8]] {
// ihl: bytesize4 = 0x5 (0 bytes)
// version: const = 0x4 (1 bytes)
// ecn: int8 = 0x0 (0 bytes)
// dscp: int8 = 0x35 (1 bytes)
// total_len: len = 0x2c (2 bytes)
// id: int16be = 0x66 (2 bytes)
// frag_off: int16be = 0x0 (2 bytes)
// ttl: int8 = 0x8 (1 bytes)
// protocol: const = 0x11 (1 bytes)
// csum: csum = 0x0 (2 bytes)
// src_ip: union ipv4_addr {
// rand_addr: int32be = 0x64010101 (4 bytes)
// }
// dst_ip: union ipv4_addr {
// local: ipv4_addr_t[const[170, int8]] {
// a0: const = 0xac (1 bytes)
// a1: const = 0x14 (1 bytes)
// a2: const = 0x14 (1 bytes)
// a3: const = 0xaa (1 bytes)
// }
// }
// options: ipv4_options {
// options: array[ipv4_option] {
// }
// }
// }
// payload: udp_packet {
// src_port: int16be = 0x4e21 (2 bytes)
// dst_port: int16be = 0x4e24 (2 bytes)
// length: len = 0x18 (2 bytes)
// csum: csum = 0x0 (2 bytes)
// payload: union udp_payload {
// wg: union wg_packet {
// data: message_data {
// type: const = 0x4 (4 bytes)
// key_idx: int32 = 0x9 (4 bytes)
// counter: int64 = 0x1800000000 (8 bytes)
// encrypted_data: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// }
// }
// }
// }
// }
// frags: nil
// ]
memset((void*)0x2000000006c0, 170, 5);
*(uint8_t*)0x2000000006c5 = 0xaa;
memcpy((void*)0x2000000006c6, "\xcd\x7c\x1e\x70\x5d\x31", 6);
*(uint16_t*)0x2000000006cc = htobe16(0x800);
STORE_BY_BITMASK(uint8_t, , 0x2000000006ce, 5, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000006ce, 4, 4, 4);
STORE_BY_BITMASK(uint8_t, , 0x2000000006cf, 0, 0, 2);
STORE_BY_BITMASK(uint8_t, , 0x2000000006cf, 0x35, 2, 6);
*(uint16_t*)0x2000000006d0 = htobe16(0x2c);
*(uint16_t*)0x2000000006d2 = htobe16(0x66);
*(uint16_t*)0x2000000006d4 = htobe16(0);
*(uint8_t*)0x2000000006d6 = 8;
*(uint8_t*)0x2000000006d7 = 0x11;
*(uint16_t*)0x2000000006d8 = htobe16(0);
*(uint32_t*)0x2000000006da = htobe32(0x64010101);
*(uint8_t*)0x2000000006de = 0xac;
*(uint8_t*)0x2000000006df = 0x14;
*(uint8_t*)0x2000000006e0 = 0x14;
*(uint8_t*)0x2000000006e1 = 0xaa;
*(uint16_t*)0x2000000006e2 = htobe16(0x4e21);
*(uint16_t*)0x2000000006e4 = htobe16(0x4e24);
*(uint16_t*)0x2000000006e6 = htobe16(0x18);
*(uint16_t*)0x2000000006e8 = htobe16(0);
*(uint32_t*)0x2000000006ea = 4;
*(uint32_t*)0x2000000006ee = 9;
*(uint64_t*)0x2000000006f2 = 0x1800000000;
struct csum_inet csum_3;
csum_inet_init(&csum_3);
csum_inet_update(&csum_3, (const uint8_t*)0x2000000006da, 4);
csum_inet_update(&csum_3, (const uint8_t*)0x2000000006de, 4);
uint16_t csum_3_chunk_2 = 0x1100;
csum_inet_update(&csum_3, (const uint8_t*)&csum_3_chunk_2, 2);
uint16_t csum_3_chunk_3 = 0x1800;
csum_inet_update(&csum_3, (const uint8_t*)&csum_3_chunk_3, 2);
csum_inet_update(&csum_3, (const uint8_t*)0x2000000006e2, 24);
*(uint16_t*)0x2000000006e8 = csum_inet_digest(&csum_3);
struct csum_inet csum_4;
csum_inet_init(&csum_4);
csum_inet_update(&csum_4, (const uint8_t*)0x2000000006ce, 20);
*(uint16_t*)0x2000000006d8 = csum_inet_digest(&csum_4);
syz_emit_ethernet(/*len=*/0x3a, /*packet=*/0x2000000006c0, /*frags=*/0);
break;
case 3:
// sendmsg$NFT_BATCH arguments: [
// fd: sock_nl_netfilter (resource)
// msg: ptr[in, msghdr_netlink[nft_batch_msg]] {
// msghdr_netlink[nft_batch_msg] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, nft_batch_msg]] {
// iovec[in, nft_batch_msg] {
// addr: ptr[in, nft_batch_msg] {
// nft_batch_msg {
// begin: nft_nlmsghdr[NFNL_MSG_BATCH_BEGIN] {
// nlmsg_len: len = 0x14 (4 bytes)
// nlmsg_type: const = 0x10 (2 bytes)
// nlmsg_flags: const = 0x1 (2 bytes)
// nlmsg_seq: const = 0x0 (4 bytes)
// nlmsg_pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg_nft {
// nfgen_family: families = 0x0 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: const = 0xa (2 bytes)
// }
// }
// msgs: array[nft_batch_message] {
// union nft_batch_message {
// NFT_MSG_NEWTABLE:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWTABLE, array[nft_table_policy]] {
// len: len = 0x20 (4 bytes)
// type: const = 0x0 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_table_policy] {
// union nft_table_policy {
// NFTA_TABLE_NAME: nlattr_t[const[NFTA_TABLE_NAME,
// int16], string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWCHAIN:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWCHAIN, array[nft_chain_policy]] {
// len: len = 0x60 (4 bytes)
// type: const = 0x3 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_chain_policy] {
// union nft_chain_policy {
// NFTA_CHAIN_TABLE:
// nlattr_t[const[NFTA_CHAIN_TABLE, int16],
// string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_NAME: nlattr_t[const[NFTA_CHAIN_NAME,
// int16], string[nft_chain_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x3 (2 bytes)
// payload: buffer: {73 79 7a 62 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_TYPE: nlattr_t[const[NFTA_CHAIN_TYPE,
// int16], string[nft_chain_type]] {
// nla_len: offsetof = 0xa (2 bytes)
// nla_type: const = 0x7 (2 bytes)
// payload: buffer: {66 69 6c 74 65 72 00}
// (length 0x7) size: buffer: {} (length 0x0)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_HOOK:
// nlattr_tt[const[NFTA_CHAIN_HOOK, int16:14], 0,
// 1, array[nft_hook_policy]] {
// nla_len: offsetof = 0x28 (2 bytes)
// nla_type: const = 0x4 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nft_hook_policy] {
// union nft_hook_policy {
// NFTA_HOOK_HOOKNUM:
// nlattr_tt[const[NFTA_HOOK_HOOKNUM,
// int16:14], 1, 0, flags[nf_inet_hooks,
// int32be]] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x1 (0
// bytes) NLA_F_NESTED: const = 0x0 (1
// bytes) payload: nf_inet_hooks = 0x1 (4
// bytes) size: buffer: {} (length 0x0)
// }
// }
// union nft_hook_policy {
// NFTA_HOOK_PRIORITY:
// nlattr_tt[const[NFTA_HOOK_PRIORITY,
// int16:14], 1, 0,
// int32be[NF_IP_PRI_CONNTRACK:NF_IP_PRI_LAST]]
// {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x1 (0
// bytes) NLA_F_NESTED: const = 0x0 (1
// bytes) payload: int32be = 0x12c (4
// bytes) size: buffer: {} (length 0x0)
// }
// }
// union nft_hook_policy {
// NFTA_HOOK_DEV:
// nlattr_t[const[NFTA_HOOK_DEV, int16],
// devname] {
// nla_len: offsetof = 0x14 (2 bytes)
// nla_type: const = 0x3 (2 bytes)
// payload: buffer: {6c 6f 00 00 00 00 00
// 00 00 00 00 00 00 00 00 00} (length
// 0x10) size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWCHAIN:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWCHAIN, array[nft_chain_policy]] {
// len: len = 0x2c (4 bytes)
// type: const = 0x3 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_chain_policy] {
// union nft_chain_policy {
// NFTA_CHAIN_TABLE:
// nlattr_t[const[NFTA_CHAIN_TABLE, int16],
// string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_NAME: nlattr_t[const[NFTA_CHAIN_NAME,
// int16], string[nft_chain_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x3 (2 bytes)
// payload: buffer: {73 79 7a 65 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWCHAIN:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWCHAIN, array[nft_chain_policy]] {
// len: len = 0x48 (4 bytes)
// type: const = 0x3 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_chain_policy] {
// union nft_chain_policy {
// NFTA_CHAIN_TABLE:
// nlattr_t[const[NFTA_CHAIN_TABLE, int16],
// string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_NAME: nlattr_t[const[NFTA_CHAIN_NAME,
// int16], string[nft_chain_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x3 (2 bytes)
// payload: buffer: {73 79 7a 62 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_COUNTERS:
// nlattr_tt[const[NFTA_CHAIN_COUNTERS, int16:14],
// 0, 1, array[nft_counter_policy]] {
// nla_len: offsetof = 0x1c (2 bytes)
// nla_type: const = 0x8 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nft_counter_policy] {
// union nft_counter_policy {
// NFTA_COUNTER_PACKETS:
// nlattr_tt[const[NFTA_COUNTER_PACKETS,
// int16:14], 1, 0, int64be] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x1 (0
// bytes) NLA_F_NESTED: const = 0x0 (1
// bytes) payload: int64be =
// 0xffffffffffffffff (8 bytes) size:
// buffer: {} (length 0x0)
// }
// }
// union nft_counter_policy {
// NFTA_COUNTER_BYTES:
// nlattr_tt[const[NFTA_COUNTER_BYTES,
// int16:14], 1, 0, int64be] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x1 (0
// bytes) NLA_F_NESTED: const = 0x0 (1
// bytes) payload: int64be = 0x0 (8 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWRULE:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWRULE, array[nft_rule_policy]] {
// len: len = 0xc8 (4 bytes)
// type: const = 0x6 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_rule_policy] {
// union nft_rule_policy {
// NFTA_RULE_TABLE: nlattr_t[const[NFTA_RULE_TABLE,
// int16], string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_CHAIN: nlattr_t[const[NFTA_RULE_CHAIN,
// int16], string[nft_chain_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: buffer: {73 79 7a 65 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_EXPRESSIONS:
// nlattr_tt[const[NFTA_RULE_EXPRESSIONS,
// int16:14], 0, 1, array[nlnest[NFTA_LIST_ELEM,
// nft_expr_policy]]] {
// nla_len: offsetof = 0x9c (2 bytes)
// nla_type: const = 0x4 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[NFTA_LIST_ELEM,
// int16:14], 0, 1, nft_expr_policy]] {
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x68 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// inner: nft_expr_policy_t["inner",
// nft_inner_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["inner"]] {
// nla_len: offsetof = 0xa (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {69 6e 6e 65 72 00}
// (length 0x6) size: buffer: {}
// (length 0x0) pad = 0x0 (2 bytes)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_inner_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_inner_policy]] {
// nla_len: offsetof = 0x58 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_inner_policy] {
// union nft_inner_policy {
// NFTA_INNER_NUM:
// nlattr_tt[const[NFTA_INNER_NUM,
// int16:14], 1, 0, int32be[0]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: int32be = 0x0 (4
// bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_inner_policy {
// NFTA_INNER_TYPE:
// nlattr_tt[const[NFTA_INNER_TYPE,
// int16:14], 1, 0,
// int32be[0:255]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: int32be = 0x2 (4
// bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_inner_policy {
// NFTA_INNER_FLAGS:
// nlattr_tt[const[NFTA_INNER_FLAGS,
// int16:14], 1, 0,
// flags[nft_inner_flags,
// int32be]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x3
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_inner_flags =
// 0x9 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_inner_policy {
// NFTA_INNER_HDRSIZE:
// nlattr_tt[const[NFTA_INNER_HDRSIZE,
// int16:14], 1, 0,
// int32be[0:64]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x4
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: int32be = 0x1f (4
// bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_inner_policy {
// NFTA_INNER_EXPR:
// nlattr_tt[const[NFTA_INNER_EXPR,
// int16:14], 0, 1,
// nft_expr_policy_inner] {
// nla_len: offsetof = 0x34 (2
// bytes) nla_type: const = 0x5
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload: union
// nft_expr_policy_inner {
// payload:
// nft_expr_policy_t["payload",
// nft_payload_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME,
// int16],
// string["payload"]] {
// nla_len: offsetof =
// 0xc (2 bytes)
// nla_type: const = 0x1
// (2 bytes) payload:
// buffer: {70 61 79 6c
// 6f 61 64 00} (length
// 0x8) size: buffer: {}
// (length 0x0)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_payload_policy]]]
// {
// val:
// nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_payload_policy]]
// {
// nla_len: offsetof =
// 0x24 (2 bytes)
// nla_type: const =
// 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0
// bytes) NLA_F_NESTED:
// const = 0x1 (1
// bytes) payload:
// array[nft_payload_policy]
// {
// union
// nft_payload_policy
// {
// NFTA_PAYLOAD_BASE:
// nlattr_tt[const[NFTA_PAYLOAD_BASE,
// int16:14], 1, 0,
// flags[nft_payload_bases,
// int32be]] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type:
// const = 0x2 (1
// bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x1 (0
// bytes)
// NLA_F_NESTED:
// const = 0x0 (1
// bytes)
// payload:
// nft_payload_bases
// = 0x2 (4
// bytes) size:
// buffer: {}
// (length 0x0)
// }
// }
// union
// nft_payload_policy
// {
// NFTA_PAYLOAD_OFFSET:
// nlattr_tt[const[NFTA_PAYLOAD_OFFSET,
// int16:14], 1, 0,
// int32be[0:255]]
// {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type:
// const = 0x3 (1
// bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x1 (0
// bytes)
// NLA_F_NESTED:
// const = 0x0 (1
// bytes)
// payload:
// int32be = 0x4
// (4 bytes)
// size: buffer:
// {} (length
// 0x0)
// }
// }
// union
// nft_payload_policy
// {
// NFTA_PAYLOAD_LEN:
// nlattr_tt[const[NFTA_PAYLOAD_LEN,
// int16:14], 1, 0,
// int32be[0:255]]
// {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type:
// const = 0x4 (1
// bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x1 (0
// bytes)
// NLA_F_NESTED:
// const = 0x0 (1
// bytes)
// payload:
// int32be = 0x1
// (4 bytes)
// size: buffer:
// {} (length
// 0x0)
// }
// }
// union
// nft_payload_policy
// {
// NFTA_PAYLOAD_DREG:
// nlattr_tt[const[NFTA_PAYLOAD_DREG,
// int16:14], 1, 0,
// flags[nft_registers,
// int32be]] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type:
// const = 0x1 (1
// bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x1 (0
// bytes)
// NLA_F_NESTED:
// const = 0x0 (1
// bytes)
// payload:
// nft_registers
// = 0x1 (4
// bytes) size:
// buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {}
// (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x30 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// immediate:
// nft_expr_policy_t["immediate",
// nft_immediate_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["immediate"]] {
// nla_len: offsetof = 0xe (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {69 6d 6d 65 64 69
// 61 74 65 00} (length 0xa) size:
// buffer: {} (length 0x0) pad = 0x0 (2
// bytes)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_immediate_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_immediate_policy]] {
// nla_len: offsetof = 0x1c (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_immediate_policy] {
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DREG:
// nlattr_tt[const[NFTA_IMMEDIATE_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers = 0x0
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DATA:
// nlattr_tt[const[NFTA_IMMEDIATE_DATA,
// int16:14], 0, 1,
// array[nft_data_policy]] {
// nla_len: offsetof = 0x10 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload:
// array[nft_data_policy] {
// union nft_data_policy {
// NFTA_DATA_VERDICT:
// nlattr_tt[const[NFTA_DATA_VERDICT,
// int16:14], 0, 1,
// array[nft_verdict_policy]]
// {
// nla_len: offsetof =
// 0xc (2 bytes)
// nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0 bytes)
// NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_verdict_policy]
// {
// union
// nft_verdict_policy {
// NFTA_VERDICT_CODE:
// nlattr_tt[const[NFTA_VERDICT_CODE,
// int16:14], 0, 1,
// flags[nft_verdicts,
// int32be]] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type: const
// = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0
// bytes)
// NLA_F_NESTED:
// const = 0x1 (1
// bytes) payload:
// nft_verdicts =
// 0xfffffffffffffffb
// (4 bytes) size:
// buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWCHAIN:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWCHAIN, array[nft_chain_policy]] {
// len: len = 0x30 (4 bytes)
// type: const = 0x3 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_chain_policy] {
// union nft_chain_policy {
// NFTA_CHAIN_TABLE:
// nlattr_t[const[NFTA_CHAIN_TABLE, int16],
// string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_ID: nlattr_tt[const[NFTA_CHAIN_ID,
// int16:14], 1, 0, nft_chain_id] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0xb (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes)
// NLA_F_NESTED: const = 0x0 (1 bytes)
// payload: int32be = 0x1 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_FLAGS:
// nlattr_tt[const[NFTA_CHAIN_FLAGS, int16:14], 1,
// 0, flags[nft_chain_flags, int32be]] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0xa (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes)
// NLA_F_NESTED: const = 0x0 (1 bytes)
// payload: nft_chain_flags = 0x4 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWRULE:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWRULE, array[nft_rule_policy]] {
// len: len = 0x68 (4 bytes)
// type: const = 0x6 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_rule_policy] {
// union nft_rule_policy {
// NFTA_RULE_TABLE: nlattr_t[const[NFTA_RULE_TABLE,
// int16], string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_CHAIN: nlattr_t[const[NFTA_RULE_CHAIN,
// int16], string[nft_chain_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: buffer: {73 79 7a 65 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_EXPRESSIONS:
// nlattr_tt[const[NFTA_RULE_EXPRESSIONS,
// int16:14], 0, 1, array[nlnest[NFTA_LIST_ELEM,
// nft_expr_policy]]] {
// nla_len: offsetof = 0x3c (2 bytes)
// nla_type: const = 0x4 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[NFTA_LIST_ELEM,
// int16:14], 0, 1, nft_expr_policy]] {
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x38 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// immediate:
// nft_expr_policy_t["immediate",
// nft_immediate_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["immediate"]] {
// nla_len: offsetof = 0xe (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {69 6d 6d 65 64 69
// 61 74 65 00} (length 0xa) size:
// buffer: {} (length 0x0) pad = 0x0 (2
// bytes)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_immediate_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_immediate_policy]] {
// nla_len: offsetof = 0x24 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_immediate_policy] {
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DREG:
// nlattr_tt[const[NFTA_IMMEDIATE_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers = 0x0
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DATA:
// nlattr_tt[const[NFTA_IMMEDIATE_DATA,
// int16:14], 0, 1,
// array[nft_data_policy]] {
// nla_len: offsetof = 0x18 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload:
// array[nft_data_policy] {
// union nft_data_policy {
// NFTA_DATA_VERDICT:
// nlattr_tt[const[NFTA_DATA_VERDICT,
// int16:14], 0, 1,
// array[nft_verdict_policy]]
// {
// nla_len: offsetof =
// 0x14 (2 bytes)
// nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0 bytes)
// NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_verdict_policy]
// {
// union
// nft_verdict_policy {
// NFTA_VERDICT_CODE:
// nlattr_tt[const[NFTA_VERDICT_CODE,
// int16:14], 0, 1,
// flags[nft_verdicts,
// int32be]] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type: const
// = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0
// bytes)
// NLA_F_NESTED:
// const = 0x1 (1
// bytes) payload:
// nft_verdicts =
// 0xfffffffffffffffd
// (4 bytes) size:
// buffer: {}
// (length 0x0)
// }
// }
// union
// nft_verdict_policy {
// NFTA_VERDICT_CHAIN_ID:
// nlattr_tt[const[NFTA_VERDICT_CHAIN_ID,
// int16:14], 1, 0,
// nft_chain_id] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type: const
// = 0x3 (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x1 (0
// bytes)
// NLA_F_NESTED:
// const = 0x0 (1
// bytes) payload:
// int32be = 0x1 (4
// bytes) size:
// buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWCHAIN:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWCHAIN, array[nft_chain_policy]] {
// len: len = 0x30 (4 bytes)
// type: const = 0x3 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_chain_policy] {
// union nft_chain_policy {
// NFTA_CHAIN_TABLE:
// nlattr_t[const[NFTA_CHAIN_TABLE, int16],
// string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_ID: nlattr_tt[const[NFTA_CHAIN_ID,
// int16:14], 1, 0, nft_chain_id] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0xb (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes)
// NLA_F_NESTED: const = 0x0 (1 bytes)
// payload: int32be = 0x2 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// union nft_chain_policy {
// NFTA_CHAIN_FLAGS:
// nlattr_tt[const[NFTA_CHAIN_FLAGS, int16:14], 1,
// 0, flags[nft_chain_flags, int32be]] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0xa (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes)
// NLA_F_NESTED: const = 0x0 (1 bytes)
// payload: nft_chain_flags = 0x4 (4 bytes)
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWRULE:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWRULE, array[nft_rule_policy]] {
// len: len = 0x68 (4 bytes)
// type: const = 0x6 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_rule_policy] {
// union nft_rule_policy {
// NFTA_RULE_TABLE: nlattr_t[const[NFTA_RULE_TABLE,
// int16], string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_CHAIN: nlattr_t[const[NFTA_RULE_CHAIN,
// int16], string[nft_chain_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: buffer: {73 79 7a 62 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_EXPRESSIONS:
// nlattr_tt[const[NFTA_RULE_EXPRESSIONS,
// int16:14], 0, 1, array[nlnest[NFTA_LIST_ELEM,
// nft_expr_policy]]] {
// nla_len: offsetof = 0x3c (2 bytes)
// nla_type: const = 0x4 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[NFTA_LIST_ELEM,
// int16:14], 0, 1, nft_expr_policy]] {
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x38 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// immediate:
// nft_expr_policy_t["immediate",
// nft_immediate_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["immediate"]] {
// nla_len: offsetof = 0xe (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {69 6d 6d 65 64 69
// 61 74 65 00} (length 0xa) size:
// buffer: {} (length 0x0) pad = 0x0 (2
// bytes)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_immediate_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_immediate_policy]] {
// nla_len: offsetof = 0x24 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_immediate_policy] {
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DREG:
// nlattr_tt[const[NFTA_IMMEDIATE_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers = 0x0
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DATA:
// nlattr_tt[const[NFTA_IMMEDIATE_DATA,
// int16:14], 0, 1,
// array[nft_data_policy]] {
// nla_len: offsetof = 0x18 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload:
// array[nft_data_policy] {
// union nft_data_policy {
// NFTA_DATA_VERDICT:
// nlattr_tt[const[NFTA_DATA_VERDICT,
// int16:14], 0, 1,
// array[nft_verdict_policy]]
// {
// nla_len: offsetof =
// 0x14 (2 bytes)
// nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0 bytes)
// NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_verdict_policy]
// {
// union
// nft_verdict_policy {
// NFTA_VERDICT_CODE:
// nlattr_tt[const[NFTA_VERDICT_CODE,
// int16:14], 0, 1,
// flags[nft_verdicts,
// int32be]] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type: const
// = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0
// bytes)
// NLA_F_NESTED:
// const = 0x1 (1
// bytes) payload:
// nft_verdicts =
// 0xfffffffffffffffc
// (4 bytes) size:
// buffer: {}
// (length 0x0)
// }
// }
// union
// nft_verdict_policy {
// NFTA_VERDICT_CHAIN_ID:
// nlattr_tt[const[NFTA_VERDICT_CHAIN_ID,
// int16:14], 1, 0,
// nft_chain_id] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type: const
// = 0x3 (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x1 (0
// bytes)
// NLA_F_NESTED:
// const = 0x0 (1
// bytes) payload:
// int32be = 0x2 (4
// bytes) size:
// buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWRULE:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWRULE, array[nft_rule_policy]] {
// len: len = 0x100 (4 bytes)
// type: const = 0x6 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_rule_policy] {
// union nft_rule_policy {
// NFTA_RULE_TABLE: nlattr_t[const[NFTA_RULE_TABLE,
// int16], string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_CHAIN: nlattr_t[const[NFTA_RULE_CHAIN,
// int16], string[nft_chain_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: buffer: {73 79 7a 62 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_EXPRESSIONS:
// nlattr_tt[const[NFTA_RULE_EXPRESSIONS,
// int16:14], 0, 1, array[nlnest[NFTA_LIST_ELEM,
// nft_expr_policy]]] {
// nla_len: offsetof = 0xd4 (2 bytes)
// nla_type: const = 0x4 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[NFTA_LIST_ELEM,
// int16:14], 0, 1, nft_expr_policy]] {
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x58 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// fib: nft_expr_policy_t["fib",
// nft_fib_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["fib"]] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {66 69 62 00}
// (length 0x4) size: buffer: {}
// (length 0x0)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_fib_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_fib_policy]] {
// nla_len: offsetof = 0x4c (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_fib_policy] {
// union nft_fib_policy {
// NFTA_FIB_DREG:
// nlattr_tt[const[NFTA_FIB_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers = 0x0
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_fib_policy {
// NFTA_FIB_DREG:
// nlattr_tt[const[NFTA_FIB_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers =
// 0x14 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_fib_policy {
// NFTA_FIB_DREG:
// nlattr_tt[const[NFTA_FIB_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers =
// 0x11 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_fib_policy {
// NFTA_FIB_FLAGS:
// nlattr_tt[const[NFTA_FIB_FLAGS,
// int16:14], 1, 0,
// flags[nft_fib_flags, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x3
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_fib_flags = 0x8
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_fib_policy {
// NFTA_FIB_RESULT:
// nlattr_tt[const[NFTA_FIB_RESULT,
// int16:14], 1, 0,
// flags[nft_fib_result,
// int32be]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_fib_result =
// 0x1 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_fib_policy {
// NFTA_FIB_RESULT:
// nlattr_tt[const[NFTA_FIB_RESULT,
// int16:14], 1, 0,
// flags[nft_fib_result,
// int32be]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_fib_result =
// 0x3 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_fib_policy {
// NFTA_FIB_RESULT:
// nlattr_tt[const[NFTA_FIB_RESULT,
// int16:14], 1, 0,
// flags[nft_fib_result,
// int32be]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_fib_result =
// 0x2 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_fib_policy {
// NFTA_FIB_FLAGS:
// nlattr_tt[const[NFTA_FIB_FLAGS,
// int16:14], 1, 0,
// flags[nft_fib_flags, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x3
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_fib_flags =
// 0x30 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_fib_policy {
// NFTA_FIB_FLAGS:
// nlattr_tt[const[NFTA_FIB_FLAGS,
// int16:14], 1, 0,
// flags[nft_fib_flags, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x3
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_fib_flags = 0x1
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x2c (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// immediate:
// nft_expr_policy_t["immediate",
// nft_immediate_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["immediate"]] {
// nla_len: offsetof = 0xe (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {69 6d 6d 65 64 69
// 61 74 65 00} (length 0xa) size:
// buffer: {} (length 0x0) pad = 0x0 (2
// bytes)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_immediate_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_immediate_policy]] {
// nla_len: offsetof = 0x18 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_immediate_policy] {
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DREG:
// nlattr_tt[const[NFTA_IMMEDIATE_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers = 0x1
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DATA:
// nlattr_tt[const[NFTA_IMMEDIATE_DATA,
// int16:14], 0, 1,
// array[nft_data_policy]] {
// nla_len: offsetof = 0xc (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload:
// array[nft_data_policy] {
// union nft_data_policy {
// NFTA_DATA_VALUE:
// nlattr_t[const[NFTA_DATA_VALUE,
// int16], array[int8]] {
// nla_len: offsetof =
// 0x6 (2 bytes)
// nla_type: const = 0x1
// (2 bytes) payload:
// buffer: {21 bb}
// (length 0x2) size:
// buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x4c (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// bitwise: nft_expr_policy_t["bitwise",
// nft_bitwise_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["bitwise"]] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {62 69 74 77 69 73
// 65 00} (length 0x8) size: buffer: {}
// (length 0x0)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_bitwise_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_bitwise_policy]] {
// nla_len: offsetof = 0x3c (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_bitwise_policy] {
// union nft_bitwise_policy {
// NFTA_BITWISE_SREG:
// nlattr_tt[const[NFTA_BITWISE_SREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers = 0x1
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_bitwise_policy {
// NFTA_BITWISE_DREG:
// nlattr_tt[const[NFTA_BITWISE_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers = 0x2
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_bitwise_policy {
// NFTA_BITWISE_LEN:
// nlattr_tt[const[NFTA_BITWISE_LEN,
// int16:14], 1, 0, int32be] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x3
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: int32be = 0x2 (4
// bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_bitwise_policy {
// NFTA_BITWISE_OP:
// nlattr_tt[const[NFTA_BITWISE_OP,
// int16:14], 1, 0,
// flags[nft_bitwise_ops,
// int32be]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x6
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_bitwise_ops =
// 0x0 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_bitwise_policy {
// NFTA_BITWISE_MASK:
// nlattr_tt[const[NFTA_BITWISE_MASK,
// int16:14], 0, 1,
// array[nft_data_policy]] {
// nla_len: offsetof = 0xc (2
// bytes) nla_type: const = 0x4
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload:
// array[nft_data_policy] {
// union nft_data_policy {
// NFTA_DATA_VALUE:
// nlattr_t[const[NFTA_DATA_VALUE,
// int16], array[int8]] {
// nla_len: offsetof =
// 0x6 (2 bytes)
// nla_type: const = 0x1
// (2 bytes) payload:
// buffer: {ae 4a}
// (length 0x2) size:
// buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// union nft_bitwise_policy {
// NFTA_BITWISE_XOR:
// nlattr_tt[const[NFTA_BITWISE_XOR,
// int16:14], 0, 1,
// array[nft_data_policy]] {
// nla_len: offsetof = 0xc (2
// bytes) nla_type: const = 0x5
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload:
// array[nft_data_policy] {
// union nft_data_policy {
// NFTA_DATA_VALUE:
// nlattr_t[const[NFTA_DATA_VALUE,
// int16], array[int8]] {
// nla_len: offsetof =
// 0x6 (2 bytes)
// nla_type: const = 0x1
// (2 bytes) payload:
// buffer: {04 40}
// (length 0x2) size:
// buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// union nft_batch_message {
// NFT_MSG_NEWRULE:
// netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES,
// NFT_MSG_NEWRULE, array[nft_rule_policy]] {
// len: len = 0xb8 (4 bytes)
// type: const = 0x6 (1 bytes)
// subsys: const = 0xa (1 bytes)
// flags: netlink_netfilter_msg_flags = 0x401 (2 bytes)
// seq: const = 0x0 (4 bytes)
// pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg {
// nfgen_family: nfproto = 0x5 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: int16be = 0x0 (2 bytes)
// }
// attrs: array[nft_rule_policy] {
// union nft_rule_policy {
// NFTA_RULE_TABLE: nlattr_t[const[NFTA_RULE_TABLE,
// int16], string[nft_table_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {73 79 7a 61 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_CHAIN: nlattr_t[const[NFTA_RULE_CHAIN,
// int16], string[nft_chain_name]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x2 (2 bytes)
// payload: buffer: {73 79 7a 62 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// union nft_rule_policy {
// NFTA_RULE_EXPRESSIONS:
// nlattr_tt[const[NFTA_RULE_EXPRESSIONS,
// int16:14], 0, 1, array[nlnest[NFTA_LIST_ELEM,
// nft_expr_policy]]] {
// nla_len: offsetof = 0x8c (2 bytes)
// nla_type: const = 0x4 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[nlattr_tt[const[NFTA_LIST_ELEM,
// int16:14], 0, 1, nft_expr_policy]] {
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x58 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// inner: nft_expr_policy_t["inner",
// nft_inner_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["inner"]] {
// nla_len: offsetof = 0xa (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {69 6e 6e 65 72 00}
// (length 0x6) size: buffer: {}
// (length 0x0) pad = 0x0 (2 bytes)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_inner_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_inner_policy]] {
// nla_len: offsetof = 0x48 (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_inner_policy] {
// union nft_inner_policy {
// NFTA_INNER_NUM:
// nlattr_tt[const[NFTA_INNER_NUM,
// int16:14], 1, 0, int32be[0]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: int32be = 0x0 (4
// bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_inner_policy {
// NFTA_INNER_TYPE:
// nlattr_tt[const[NFTA_INNER_TYPE,
// int16:14], 1, 0,
// int32be[0:255]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: int32be = 0x1 (4
// bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_inner_policy {
// NFTA_INNER_FLAGS:
// nlattr_tt[const[NFTA_INNER_FLAGS,
// int16:14], 1, 0,
// flags[nft_inner_flags,
// int32be]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x3
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_inner_flags =
// 0x2 (4 bytes) size: buffer:
// {} (length 0x0)
// }
// }
// union nft_inner_policy {
// NFTA_INNER_HDRSIZE:
// nlattr_tt[const[NFTA_INNER_HDRSIZE,
// int16:14], 1, 0,
// int32be[0:64]] {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x4
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: int32be = 0x0 (4
// bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_inner_policy {
// NFTA_INNER_EXPR:
// nlattr_tt[const[NFTA_INNER_EXPR,
// int16:14], 0, 1,
// nft_expr_policy_inner] {
// nla_len: offsetof = 0x24 (2
// bytes) nla_type: const = 0x5
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload: union
// nft_expr_policy_inner {
// meta:
// nft_expr_policy_t["meta",
// nft_meta_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME,
// int16], string["meta"]]
// {
// nla_len: offsetof =
// 0x9 (2 bytes)
// nla_type: const = 0x1
// (2 bytes) payload:
// buffer: {6d 65 74 61
// 00} (length 0x5) size:
// buffer: {} (length
// 0x0) pad = 0x0 (3
// bytes)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_meta_policy]]]
// {
// val:
// nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_meta_policy]]
// {
// nla_len: offsetof =
// 0x14 (2 bytes)
// nla_type: const =
// 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0
// bytes) NLA_F_NESTED:
// const = 0x1 (1
// bytes) payload:
// array[nft_meta_policy]
// {
// union
// nft_meta_policy {
// NFTA_META_KEY:
// nlattr_tt[const[NFTA_META_KEY,
// int16:14], 1, 0,
// int32be[NFT_META_LEN:NFT_META_BRI_BROUTE]]
// {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type:
// const = 0x2 (1
// bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x1 (0
// bytes)
// NLA_F_NESTED:
// const = 0x0 (1
// bytes)
// payload:
// int32be = 0x1
// (4 bytes)
// size: buffer:
// {} (length
// 0x0)
// }
// }
// union
// nft_meta_policy {
// NFTA_META_DREG:
// nlattr_tt[const[NFTA_META_DREG,
// int16:14], 1, 0,
// flags[nft_registers,
// int32be]] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type:
// const = 0x1 (1
// bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x1 (0
// bytes)
// NLA_F_NESTED:
// const = 0x0 (1
// bytes)
// payload:
// nft_registers
// = 0x1 (4
// bytes) size:
// buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {}
// (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// nlattr_tt[const[NFTA_LIST_ELEM, int16:14],
// 0, 1, nft_expr_policy] {
// nla_len: offsetof = 0x30 (2 bytes)
// nla_type: const = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union nft_expr_policy {
// immediate:
// nft_expr_policy_t["immediate",
// nft_immediate_policy] {
// NFTA_EXPR_NAME:
// nlattr_t[const[NFTA_EXPR_NAME, int16],
// string["immediate"]] {
// nla_len: offsetof = 0xe (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {69 6d 6d 65 64 69
// 61 74 65 00} (length 0xa) size:
// buffer: {} (length 0x0) pad = 0x0 (2
// bytes)
// }
// NFTA_EXPR_DATA: union
// optional[nlnest[NFTA_EXPR_DATA,
// array[nft_immediate_policy]]] {
// val: nlattr_tt[const[NFTA_EXPR_DATA,
// int16:14], 0, 1,
// array[nft_immediate_policy]] {
// nla_len: offsetof = 0x1c (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0
// (0 bytes) NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_immediate_policy] {
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DREG:
// nlattr_tt[const[NFTA_IMMEDIATE_DREG,
// int16:14], 1, 0,
// flags[nft_registers, int32be]]
// {
// nla_len: offsetof = 0x8 (2
// bytes) nla_type: const = 0x1
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x1 (0 bytes) NLA_F_NESTED:
// const = 0x0 (1 bytes)
// payload: nft_registers = 0x0
// (4 bytes) size: buffer: {}
// (length 0x0)
// }
// }
// union nft_immediate_policy {
// NFTA_IMMEDIATE_DATA:
// nlattr_tt[const[NFTA_IMMEDIATE_DATA,
// int16:14], 0, 1,
// array[nft_data_policy]] {
// nla_len: offsetof = 0x10 (2
// bytes) nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER: const =
// 0x0 (0 bytes) NLA_F_NESTED:
// const = 0x1 (1 bytes)
// payload:
// array[nft_data_policy] {
// union nft_data_policy {
// NFTA_DATA_VERDICT:
// nlattr_tt[const[NFTA_DATA_VERDICT,
// int16:14], 0, 1,
// array[nft_verdict_policy]]
// {
// nla_len: offsetof =
// 0xc (2 bytes)
// nla_type: const = 0x2
// (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0 bytes)
// NLA_F_NESTED: const =
// 0x1 (1 bytes) payload:
// array[nft_verdict_policy]
// {
// union
// nft_verdict_policy {
// NFTA_VERDICT_CODE:
// nlattr_tt[const[NFTA_VERDICT_CODE,
// int16:14], 0, 1,
// flags[nft_verdicts,
// int32be]] {
// nla_len:
// offsetof = 0x8
// (2 bytes)
// nla_type: const
// = 0x1 (1 bytes)
// NLA_F_NET_BYTEORDER:
// const = 0x0 (0
// bytes)
// NLA_F_NESTED:
// const = 0x1 (1
// bytes) payload:
// nft_verdicts =
// 0x1 (4 bytes)
// size: buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {}
// (length 0x0)
// }
// }
// }
// size: buffer: {} (length
// 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// end: nft_nlmsghdr[NFNL_MSG_BATCH_END] {
// nlmsg_len: len = 0x14 (4 bytes)
// nlmsg_type: const = 0x11 (2 bytes)
// nlmsg_flags: const = 0x1 (2 bytes)
// nlmsg_seq: const = 0x0 (4 bytes)
// nlmsg_pid: const = 0x0 (4 bytes)
// hdr: nfgenmsg_nft {
// nfgen_family: families = 0x0 (1 bytes)
// version: const = 0x0 (1 bytes)
// res_id: const = 0xa (2 bytes)
// }
// }
// }
// }
// len: len = 0x4cc (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x4040 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: nft_batch_send_flags = 0x4000000 (8 bytes)
// ]
*(uint64_t*)0x200000001140 = 0;
*(uint32_t*)0x200000001148 = 0;
*(uint64_t*)0x200000001150 = 0x200000001100;
*(uint64_t*)0x200000001100 = 0x200000000000;
*(uint32_t*)0x200000000000 = 0x14;
*(uint16_t*)0x200000000004 = 0x10;
*(uint16_t*)0x200000000006 = 1;
*(uint32_t*)0x200000000008 = 0;
*(uint32_t*)0x20000000000c = 0;
*(uint8_t*)0x200000000010 = 0;
*(uint8_t*)0x200000000011 = 0;
*(uint16_t*)0x200000000012 = htobe16(0xa);
*(uint32_t*)0x200000000014 = 0x20;
*(uint8_t*)0x200000000018 = 0;
*(uint8_t*)0x200000000019 = 0xa;
*(uint16_t*)0x20000000001a = 0x401;
*(uint32_t*)0x20000000001c = 0;
*(uint32_t*)0x200000000020 = 0;
*(uint8_t*)0x200000000024 = 5;
*(uint8_t*)0x200000000025 = 0;
*(uint16_t*)0x200000000026 = htobe16(0);
*(uint16_t*)0x200000000028 = 9;
*(uint16_t*)0x20000000002a = 1;
memcpy((void*)0x20000000002c, "syza\000", 5);
*(uint32_t*)0x200000000034 = 0x60;
*(uint8_t*)0x200000000038 = 3;
*(uint8_t*)0x200000000039 = 0xa;
*(uint16_t*)0x20000000003a = 0x401;
*(uint32_t*)0x20000000003c = 0;
*(uint32_t*)0x200000000040 = 0;
*(uint8_t*)0x200000000044 = 5;
*(uint8_t*)0x200000000045 = 0;
*(uint16_t*)0x200000000046 = htobe16(0);
*(uint16_t*)0x200000000048 = 9;
*(uint16_t*)0x20000000004a = 1;
memcpy((void*)0x20000000004c, "syza\000", 5);
*(uint16_t*)0x200000000054 = 9;
*(uint16_t*)0x200000000056 = 3;
memcpy((void*)0x200000000058, "syzb\000", 5);
*(uint16_t*)0x200000000060 = 0xa;
*(uint16_t*)0x200000000062 = 7;
memcpy((void*)0x200000000064, "filter\000", 7);
*(uint16_t*)0x20000000006c = 0x28;
STORE_BY_BITMASK(uint16_t, , 0x20000000006e, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000006f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000006f, 1, 7, 1);
*(uint16_t*)0x200000000070 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000072, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000073, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000073, 0, 7, 1);
*(uint32_t*)0x200000000074 = htobe32(1);
*(uint16_t*)0x200000000078 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000007a, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000007b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000007b, 0, 7, 1);
*(uint32_t*)0x20000000007c = htobe32(0x12c);
*(uint16_t*)0x200000000080 = 0x14;
*(uint16_t*)0x200000000082 = 3;
memcpy((void*)0x200000000084,
"lo\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16);
*(uint32_t*)0x200000000094 = 0x2c;
*(uint8_t*)0x200000000098 = 3;
*(uint8_t*)0x200000000099 = 0xa;
*(uint16_t*)0x20000000009a = 0x401;
*(uint32_t*)0x20000000009c = 0;
*(uint32_t*)0x2000000000a0 = 0;
*(uint8_t*)0x2000000000a4 = 5;
*(uint8_t*)0x2000000000a5 = 0;
*(uint16_t*)0x2000000000a6 = htobe16(0);
*(uint16_t*)0x2000000000a8 = 9;
*(uint16_t*)0x2000000000aa = 1;
memcpy((void*)0x2000000000ac, "syza\000", 5);
*(uint16_t*)0x2000000000b4 = 9;
*(uint16_t*)0x2000000000b6 = 3;
memcpy((void*)0x2000000000b8, "syze\000", 5);
*(uint32_t*)0x2000000000c0 = 0x48;
*(uint8_t*)0x2000000000c4 = 3;
*(uint8_t*)0x2000000000c5 = 0xa;
*(uint16_t*)0x2000000000c6 = 0x401;
*(uint32_t*)0x2000000000c8 = 0;
*(uint32_t*)0x2000000000cc = 0;
*(uint8_t*)0x2000000000d0 = 5;
*(uint8_t*)0x2000000000d1 = 0;
*(uint16_t*)0x2000000000d2 = htobe16(0);
*(uint16_t*)0x2000000000d4 = 9;
*(uint16_t*)0x2000000000d6 = 1;
memcpy((void*)0x2000000000d8, "syza\000", 5);
*(uint16_t*)0x2000000000e0 = 9;
*(uint16_t*)0x2000000000e2 = 3;
memcpy((void*)0x2000000000e4, "syzb\000", 5);
*(uint16_t*)0x2000000000ec = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x2000000000ee, 8, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000000ef, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000000ef, 1, 7, 1);
*(uint16_t*)0x2000000000f0 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x2000000000f2, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000000f3, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000000f3, 0, 7, 1);
*(uint64_t*)0x2000000000f4 = htobe64(-1);
*(uint16_t*)0x2000000000fc = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x2000000000fe, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000000ff, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000000ff, 0, 7, 1);
*(uint64_t*)0x200000000100 = htobe64(0);
*(uint32_t*)0x200000000108 = 0xc8;
*(uint8_t*)0x20000000010c = 6;
*(uint8_t*)0x20000000010d = 0xa;
*(uint16_t*)0x20000000010e = 0x401;
*(uint32_t*)0x200000000110 = 0;
*(uint32_t*)0x200000000114 = 0;
*(uint8_t*)0x200000000118 = 5;
*(uint8_t*)0x200000000119 = 0;
*(uint16_t*)0x20000000011a = htobe16(0);
*(uint16_t*)0x20000000011c = 9;
*(uint16_t*)0x20000000011e = 1;
memcpy((void*)0x200000000120, "syza\000", 5);
*(uint16_t*)0x200000000128 = 9;
*(uint16_t*)0x20000000012a = 2;
memcpy((void*)0x20000000012c, "syze\000", 5);
*(uint16_t*)0x200000000134 = 0x9c;
STORE_BY_BITMASK(uint16_t, , 0x200000000136, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000137, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000137, 1, 7, 1);
*(uint16_t*)0x200000000138 = 0x68;
STORE_BY_BITMASK(uint16_t, , 0x20000000013a, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000013b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000013b, 1, 7, 1);
*(uint16_t*)0x20000000013c = 0xa;
*(uint16_t*)0x20000000013e = 1;
memcpy((void*)0x200000000140, "inner\000", 6);
*(uint16_t*)0x200000000148 = 0x58;
STORE_BY_BITMASK(uint16_t, , 0x20000000014a, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000014b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000014b, 1, 7, 1);
*(uint16_t*)0x20000000014c = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000014e, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000014f, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000014f, 0, 7, 1);
*(uint32_t*)0x200000000150 = htobe32(0);
*(uint16_t*)0x200000000154 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000156, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000157, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000157, 0, 7, 1);
*(uint32_t*)0x200000000158 = htobe32(2);
*(uint16_t*)0x20000000015c = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000015e, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000015f, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000015f, 0, 7, 1);
*(uint32_t*)0x200000000160 = htobe32(9);
*(uint16_t*)0x200000000164 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000166, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000167, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000167, 0, 7, 1);
*(uint32_t*)0x200000000168 = htobe32(0x1f);
*(uint16_t*)0x20000000016c = 0x34;
STORE_BY_BITMASK(uint16_t, , 0x20000000016e, 5, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000016f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000016f, 1, 7, 1);
*(uint16_t*)0x200000000170 = 0xc;
*(uint16_t*)0x200000000172 = 1;
memcpy((void*)0x200000000174, "payload\000", 8);
*(uint16_t*)0x20000000017c = 0x24;
STORE_BY_BITMASK(uint16_t, , 0x20000000017e, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000017f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000017f, 1, 7, 1);
*(uint16_t*)0x200000000180 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000182, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000183, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000183, 0, 7, 1);
*(uint32_t*)0x200000000184 = htobe32(2);
*(uint16_t*)0x200000000188 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000018a, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000018b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000018b, 0, 7, 1);
*(uint32_t*)0x20000000018c = htobe32(4);
*(uint16_t*)0x200000000190 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000192, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000193, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000193, 0, 7, 1);
*(uint32_t*)0x200000000194 = htobe32(1);
*(uint16_t*)0x200000000198 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000019a, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000019b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000019b, 0, 7, 1);
*(uint32_t*)0x20000000019c = htobe32(1);
*(uint16_t*)0x2000000001a0 = 0x30;
STORE_BY_BITMASK(uint16_t, , 0x2000000001a2, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000001a3, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000001a3, 1, 7, 1);
*(uint16_t*)0x2000000001a4 = 0xe;
*(uint16_t*)0x2000000001a6 = 1;
memcpy((void*)0x2000000001a8, "immediate\000", 10);
*(uint16_t*)0x2000000001b4 = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x2000000001b6, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000001b7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000001b7, 1, 7, 1);
*(uint16_t*)0x2000000001b8 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000001ba, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000001bb, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000001bb, 0, 7, 1);
*(uint32_t*)0x2000000001bc = htobe32(0);
*(uint16_t*)0x2000000001c0 = 0x10;
STORE_BY_BITMASK(uint16_t, , 0x2000000001c2, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000001c3, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000001c3, 1, 7, 1);
*(uint16_t*)0x2000000001c4 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x2000000001c6, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000001c7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000001c7, 1, 7, 1);
*(uint16_t*)0x2000000001c8 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000001ca, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000001cb, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000001cb, 1, 7, 1);
*(uint32_t*)0x2000000001cc = htobe32(0xfffffffb);
*(uint32_t*)0x2000000001d0 = 0x30;
*(uint8_t*)0x2000000001d4 = 3;
*(uint8_t*)0x2000000001d5 = 0xa;
*(uint16_t*)0x2000000001d6 = 0x401;
*(uint32_t*)0x2000000001d8 = 0;
*(uint32_t*)0x2000000001dc = 0;
*(uint8_t*)0x2000000001e0 = 5;
*(uint8_t*)0x2000000001e1 = 0;
*(uint16_t*)0x2000000001e2 = htobe16(0);
*(uint16_t*)0x2000000001e4 = 9;
*(uint16_t*)0x2000000001e6 = 1;
memcpy((void*)0x2000000001e8, "syza\000", 5);
*(uint16_t*)0x2000000001f0 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000001f2, 0xb, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000001f3, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000001f3, 0, 7, 1);
*(uint32_t*)0x2000000001f4 = htobe32(1);
*(uint16_t*)0x2000000001f8 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000001fa, 0xa, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000001fb, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000001fb, 0, 7, 1);
*(uint32_t*)0x2000000001fc = htobe32(4);
*(uint32_t*)0x200000000200 = 0x68;
*(uint8_t*)0x200000000204 = 6;
*(uint8_t*)0x200000000205 = 0xa;
*(uint16_t*)0x200000000206 = 0x401;
*(uint32_t*)0x200000000208 = 0;
*(uint32_t*)0x20000000020c = 0;
*(uint8_t*)0x200000000210 = 5;
*(uint8_t*)0x200000000211 = 0;
*(uint16_t*)0x200000000212 = htobe16(0);
*(uint16_t*)0x200000000214 = 9;
*(uint16_t*)0x200000000216 = 1;
memcpy((void*)0x200000000218, "syza\000", 5);
*(uint16_t*)0x200000000220 = 9;
*(uint16_t*)0x200000000222 = 2;
memcpy((void*)0x200000000224, "syze\000", 5);
*(uint16_t*)0x20000000022c = 0x3c;
STORE_BY_BITMASK(uint16_t, , 0x20000000022e, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000022f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000022f, 1, 7, 1);
*(uint16_t*)0x200000000230 = 0x38;
STORE_BY_BITMASK(uint16_t, , 0x200000000232, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000233, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000233, 1, 7, 1);
*(uint16_t*)0x200000000234 = 0xe;
*(uint16_t*)0x200000000236 = 1;
memcpy((void*)0x200000000238, "immediate\000", 10);
*(uint16_t*)0x200000000244 = 0x24;
STORE_BY_BITMASK(uint16_t, , 0x200000000246, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000247, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000247, 1, 7, 1);
*(uint16_t*)0x200000000248 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000024a, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000024b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000024b, 0, 7, 1);
*(uint32_t*)0x20000000024c = htobe32(0);
*(uint16_t*)0x200000000250 = 0x18;
STORE_BY_BITMASK(uint16_t, , 0x200000000252, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000253, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000253, 1, 7, 1);
*(uint16_t*)0x200000000254 = 0x14;
STORE_BY_BITMASK(uint16_t, , 0x200000000256, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000257, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000257, 1, 7, 1);
*(uint16_t*)0x200000000258 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000025a, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000025b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000025b, 1, 7, 1);
*(uint32_t*)0x20000000025c = htobe32(0xfffffffd);
*(uint16_t*)0x200000000260 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000262, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000263, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000263, 0, 7, 1);
*(uint32_t*)0x200000000264 = htobe32(1);
*(uint32_t*)0x200000000268 = 0x30;
*(uint8_t*)0x20000000026c = 3;
*(uint8_t*)0x20000000026d = 0xa;
*(uint16_t*)0x20000000026e = 0x401;
*(uint32_t*)0x200000000270 = 0;
*(uint32_t*)0x200000000274 = 0;
*(uint8_t*)0x200000000278 = 5;
*(uint8_t*)0x200000000279 = 0;
*(uint16_t*)0x20000000027a = htobe16(0);
*(uint16_t*)0x20000000027c = 9;
*(uint16_t*)0x20000000027e = 1;
memcpy((void*)0x200000000280, "syza\000", 5);
*(uint16_t*)0x200000000288 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000028a, 0xb, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000028b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000028b, 0, 7, 1);
*(uint32_t*)0x20000000028c = htobe32(2);
*(uint16_t*)0x200000000290 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000292, 0xa, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000293, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000293, 0, 7, 1);
*(uint32_t*)0x200000000294 = htobe32(4);
*(uint32_t*)0x200000000298 = 0x68;
*(uint8_t*)0x20000000029c = 6;
*(uint8_t*)0x20000000029d = 0xa;
*(uint16_t*)0x20000000029e = 0x401;
*(uint32_t*)0x2000000002a0 = 0;
*(uint32_t*)0x2000000002a4 = 0;
*(uint8_t*)0x2000000002a8 = 5;
*(uint8_t*)0x2000000002a9 = 0;
*(uint16_t*)0x2000000002aa = htobe16(0);
*(uint16_t*)0x2000000002ac = 9;
*(uint16_t*)0x2000000002ae = 1;
memcpy((void*)0x2000000002b0, "syza\000", 5);
*(uint16_t*)0x2000000002b8 = 9;
*(uint16_t*)0x2000000002ba = 2;
memcpy((void*)0x2000000002bc, "syzb\000", 5);
*(uint16_t*)0x2000000002c4 = 0x3c;
STORE_BY_BITMASK(uint16_t, , 0x2000000002c6, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000002c7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000002c7, 1, 7, 1);
*(uint16_t*)0x2000000002c8 = 0x38;
STORE_BY_BITMASK(uint16_t, , 0x2000000002ca, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000002cb, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000002cb, 1, 7, 1);
*(uint16_t*)0x2000000002cc = 0xe;
*(uint16_t*)0x2000000002ce = 1;
memcpy((void*)0x2000000002d0, "immediate\000", 10);
*(uint16_t*)0x2000000002dc = 0x24;
STORE_BY_BITMASK(uint16_t, , 0x2000000002de, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000002df, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000002df, 1, 7, 1);
*(uint16_t*)0x2000000002e0 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000002e2, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000002e3, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000002e3, 0, 7, 1);
*(uint32_t*)0x2000000002e4 = htobe32(0);
*(uint16_t*)0x2000000002e8 = 0x18;
STORE_BY_BITMASK(uint16_t, , 0x2000000002ea, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000002eb, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000002eb, 1, 7, 1);
*(uint16_t*)0x2000000002ec = 0x14;
STORE_BY_BITMASK(uint16_t, , 0x2000000002ee, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000002ef, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000002ef, 1, 7, 1);
*(uint16_t*)0x2000000002f0 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000002f2, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000002f3, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000002f3, 1, 7, 1);
*(uint32_t*)0x2000000002f4 = htobe32(0xfffffffc);
*(uint16_t*)0x2000000002f8 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000002fa, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000002fb, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000002fb, 0, 7, 1);
*(uint32_t*)0x2000000002fc = htobe32(2);
*(uint32_t*)0x200000000300 = 0x100;
*(uint8_t*)0x200000000304 = 6;
*(uint8_t*)0x200000000305 = 0xa;
*(uint16_t*)0x200000000306 = 0x401;
*(uint32_t*)0x200000000308 = 0;
*(uint32_t*)0x20000000030c = 0;
*(uint8_t*)0x200000000310 = 5;
*(uint8_t*)0x200000000311 = 0;
*(uint16_t*)0x200000000312 = htobe16(0);
*(uint16_t*)0x200000000314 = 9;
*(uint16_t*)0x200000000316 = 1;
memcpy((void*)0x200000000318, "syza\000", 5);
*(uint16_t*)0x200000000320 = 9;
*(uint16_t*)0x200000000322 = 2;
memcpy((void*)0x200000000324, "syzb\000", 5);
*(uint16_t*)0x20000000032c = 0xd4;
STORE_BY_BITMASK(uint16_t, , 0x20000000032e, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000032f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000032f, 1, 7, 1);
*(uint16_t*)0x200000000330 = 0x58;
STORE_BY_BITMASK(uint16_t, , 0x200000000332, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000333, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000333, 1, 7, 1);
*(uint16_t*)0x200000000334 = 8;
*(uint16_t*)0x200000000336 = 1;
memcpy((void*)0x200000000338, "fib\000", 4);
*(uint16_t*)0x20000000033c = 0x4c;
STORE_BY_BITMASK(uint16_t, , 0x20000000033e, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000033f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000033f, 1, 7, 1);
*(uint16_t*)0x200000000340 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000342, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000343, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000343, 0, 7, 1);
*(uint32_t*)0x200000000344 = htobe32(0);
*(uint16_t*)0x200000000348 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000034a, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000034b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000034b, 0, 7, 1);
*(uint32_t*)0x20000000034c = htobe32(0x14);
*(uint16_t*)0x200000000350 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000352, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000353, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000353, 0, 7, 1);
*(uint32_t*)0x200000000354 = htobe32(0x11);
*(uint16_t*)0x200000000358 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000035a, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000035b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000035b, 0, 7, 1);
*(uint32_t*)0x20000000035c = htobe32(8);
*(uint16_t*)0x200000000360 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000362, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000363, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000363, 0, 7, 1);
*(uint32_t*)0x200000000364 = htobe32(1);
*(uint16_t*)0x200000000368 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000036a, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000036b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000036b, 0, 7, 1);
*(uint32_t*)0x20000000036c = htobe32(3);
*(uint16_t*)0x200000000370 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000372, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000373, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000373, 0, 7, 1);
*(uint32_t*)0x200000000374 = htobe32(2);
*(uint16_t*)0x200000000378 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000037a, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000037b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000037b, 0, 7, 1);
*(uint32_t*)0x20000000037c = htobe32(0x30);
*(uint16_t*)0x200000000380 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000382, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000383, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000383, 0, 7, 1);
*(uint32_t*)0x200000000384 = htobe32(1);
*(uint16_t*)0x200000000388 = 0x2c;
STORE_BY_BITMASK(uint16_t, , 0x20000000038a, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000038b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000038b, 1, 7, 1);
*(uint16_t*)0x20000000038c = 0xe;
*(uint16_t*)0x20000000038e = 1;
memcpy((void*)0x200000000390, "immediate\000", 10);
*(uint16_t*)0x20000000039c = 0x18;
STORE_BY_BITMASK(uint16_t, , 0x20000000039e, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000039f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000039f, 1, 7, 1);
*(uint16_t*)0x2000000003a0 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000003a2, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003a3, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003a3, 0, 7, 1);
*(uint32_t*)0x2000000003a4 = htobe32(1);
*(uint16_t*)0x2000000003a8 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x2000000003aa, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003ab, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003ab, 1, 7, 1);
*(uint16_t*)0x2000000003ac = 6;
*(uint16_t*)0x2000000003ae = 1;
memcpy((void*)0x2000000003b0, "\x21\xbb", 2);
*(uint16_t*)0x2000000003b4 = 0x4c;
STORE_BY_BITMASK(uint16_t, , 0x2000000003b6, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003b7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003b7, 1, 7, 1);
*(uint16_t*)0x2000000003b8 = 0xc;
*(uint16_t*)0x2000000003ba = 1;
memcpy((void*)0x2000000003bc, "bitwise\000", 8);
*(uint16_t*)0x2000000003c4 = 0x3c;
STORE_BY_BITMASK(uint16_t, , 0x2000000003c6, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003c7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003c7, 1, 7, 1);
*(uint16_t*)0x2000000003c8 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000003ca, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003cb, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003cb, 0, 7, 1);
*(uint32_t*)0x2000000003cc = htobe32(1);
*(uint16_t*)0x2000000003d0 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000003d2, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003d3, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003d3, 0, 7, 1);
*(uint32_t*)0x2000000003d4 = htobe32(2);
*(uint16_t*)0x2000000003d8 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000003da, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003db, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003db, 0, 7, 1);
*(uint32_t*)0x2000000003dc = htobe32(2);
*(uint16_t*)0x2000000003e0 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000003e2, 6, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003e3, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003e3, 0, 7, 1);
*(uint32_t*)0x2000000003e4 = htobe32(0);
*(uint16_t*)0x2000000003e8 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x2000000003ea, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003eb, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003eb, 1, 7, 1);
*(uint16_t*)0x2000000003ec = 6;
*(uint16_t*)0x2000000003ee = 1;
memcpy((void*)0x2000000003f0, "\xae\x4a", 2);
*(uint16_t*)0x2000000003f4 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x2000000003f6, 5, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000003f7, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000003f7, 1, 7, 1);
*(uint16_t*)0x2000000003f8 = 6;
*(uint16_t*)0x2000000003fa = 1;
memcpy((void*)0x2000000003fc, "\x04\x40", 2);
*(uint32_t*)0x200000000400 = 0xb8;
*(uint8_t*)0x200000000404 = 6;
*(uint8_t*)0x200000000405 = 0xa;
*(uint16_t*)0x200000000406 = 0x401;
*(uint32_t*)0x200000000408 = 0;
*(uint32_t*)0x20000000040c = 0;
*(uint8_t*)0x200000000410 = 5;
*(uint8_t*)0x200000000411 = 0;
*(uint16_t*)0x200000000412 = htobe16(0);
*(uint16_t*)0x200000000414 = 9;
*(uint16_t*)0x200000000416 = 1;
memcpy((void*)0x200000000418, "syza\000", 5);
*(uint16_t*)0x200000000420 = 9;
*(uint16_t*)0x200000000422 = 2;
memcpy((void*)0x200000000424, "syzb\000", 5);
*(uint16_t*)0x20000000042c = 0x8c;
STORE_BY_BITMASK(uint16_t, , 0x20000000042e, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000042f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000042f, 1, 7, 1);
*(uint16_t*)0x200000000430 = 0x58;
STORE_BY_BITMASK(uint16_t, , 0x200000000432, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000433, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000433, 1, 7, 1);
*(uint16_t*)0x200000000434 = 0xa;
*(uint16_t*)0x200000000436 = 1;
memcpy((void*)0x200000000438, "inner\000", 6);
*(uint16_t*)0x200000000440 = 0x48;
STORE_BY_BITMASK(uint16_t, , 0x200000000442, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000443, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000443, 1, 7, 1);
*(uint16_t*)0x200000000444 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000446, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000447, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000447, 0, 7, 1);
*(uint32_t*)0x200000000448 = htobe32(0);
*(uint16_t*)0x20000000044c = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000044e, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000044f, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000044f, 0, 7, 1);
*(uint32_t*)0x200000000450 = htobe32(1);
*(uint16_t*)0x200000000454 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000456, 3, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000457, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000457, 0, 7, 1);
*(uint32_t*)0x200000000458 = htobe32(2);
*(uint16_t*)0x20000000045c = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000045e, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000045f, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000045f, 0, 7, 1);
*(uint32_t*)0x200000000460 = htobe32(0);
*(uint16_t*)0x200000000464 = 0x24;
STORE_BY_BITMASK(uint16_t, , 0x200000000466, 5, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000467, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000467, 1, 7, 1);
*(uint16_t*)0x200000000468 = 9;
*(uint16_t*)0x20000000046a = 1;
memcpy((void*)0x20000000046c, "meta\000", 5);
*(uint16_t*)0x200000000474 = 0x14;
STORE_BY_BITMASK(uint16_t, , 0x200000000476, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000477, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000477, 1, 7, 1);
*(uint16_t*)0x200000000478 = 8;
STORE_BY_BITMASK(uint16_t, , 0x20000000047a, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000047b, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000047b, 0, 7, 1);
*(uint32_t*)0x20000000047c = htobe32(1);
*(uint16_t*)0x200000000480 = 8;
STORE_BY_BITMASK(uint16_t, , 0x200000000482, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200000000483, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200000000483, 0, 7, 1);
*(uint32_t*)0x200000000484 = htobe32(1);
*(uint16_t*)0x200000000488 = 0x30;
STORE_BY_BITMASK(uint16_t, , 0x20000000048a, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000048b, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000048b, 1, 7, 1);
*(uint16_t*)0x20000000048c = 0xe;
*(uint16_t*)0x20000000048e = 1;
memcpy((void*)0x200000000490, "immediate\000", 10);
*(uint16_t*)0x20000000049c = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x20000000049e, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000000049f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000000049f, 1, 7, 1);
*(uint16_t*)0x2000000004a0 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000004a2, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000004a3, 1, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000004a3, 0, 7, 1);
*(uint32_t*)0x2000000004a4 = htobe32(0);
*(uint16_t*)0x2000000004a8 = 0x10;
STORE_BY_BITMASK(uint16_t, , 0x2000000004aa, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000004ab, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000004ab, 1, 7, 1);
*(uint16_t*)0x2000000004ac = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x2000000004ae, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000004af, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000004af, 1, 7, 1);
*(uint16_t*)0x2000000004b0 = 8;
STORE_BY_BITMASK(uint16_t, , 0x2000000004b2, 1, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000000004b3, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000000004b3, 1, 7, 1);
*(uint32_t*)0x2000000004b4 = htobe32(1);
*(uint32_t*)0x2000000004b8 = 0x14;
*(uint16_t*)0x2000000004bc = 0x11;
*(uint16_t*)0x2000000004be = 1;
*(uint32_t*)0x2000000004c0 = 0;
*(uint32_t*)0x2000000004c4 = 0;
*(uint8_t*)0x2000000004c8 = 0;
*(uint8_t*)0x2000000004c9 = 0;
*(uint16_t*)0x2000000004ca = htobe16(0xa);
*(uint64_t*)0x200000001108 = 0x4cc;
*(uint64_t*)0x200000001158 = 1;
*(uint64_t*)0x200000001160 = 0;
*(uint64_t*)0x200000001168 = 0;
*(uint32_t*)0x200000001170 = 0x4040;
syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x200000001140ul,
/*f=MSG_ZEROCOPY*/ 0x4000000ul);
break;
case 4:
// syz_emit_ethernet arguments: [
// len: len = 0x4a (8 bytes)
// packet: ptr[in, eth_packet] {
// eth_packet {
// dst_mac: union mac_addr {
// local: mac_addr_t[const[0xaa, int8]] {
// a0: buffer: {aa aa aa aa aa} (length 0x5)
// a1: const = 0xaa (1 bytes)
// }
// }
// src_mac: union mac_addr {
// local: mac_addr_t[const[0xaa, int8]] {
// a0: buffer: {aa aa aa aa aa} (length 0x5)
// a1: const = 0xaa (1 bytes)
// }
// }
// vtag: union optional[vlan_tag] {
// void: buffer: {} (length 0x0)
// }
// payload: eth_payload {
// eth2: union eth2_packet {
// ipv6: eth2_packet_t[ETH_P_IPV6, ipv6_packet] {
// etype: const = 0x86dd (2 bytes)
// payload: union ipv6_packet {
// tcp: ipv6_packet_t[const[IPPROTO_TCP, int8], tcp_packet] {
// priority: int8 = 0x5 (0 bytes)
// version: const = 0x6 (1 bytes)
// flow_label: buffer: {bd 1f 5a} (length 0x3)
// length: len = 0x14 (2 bytes)
// next_header: const = 0x6 (1 bytes)
// hop_limit: hop_limits = 0x1 (1 bytes)
// src_ip: union ipv6_addr {
// local: ipv6_addr_t[const[0xaa, int8]] {
// a0: const = 0xfe (1 bytes)
// a1: const = 0x80 (1 bytes)
// a2: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00}
// (length 0xd) a3: const = 0xaa (1 bytes)
// }
// }
// dst_ip: union ipv6_addr {
// local: ipv6_addr_t[const[0xaa, int8]] {
// a0: const = 0xfe (1 bytes)
// a1: const = 0x80 (1 bytes)
// a2: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00}
// (length 0xd) a3: const = 0xaa (1 bytes)
// }
// }
// payload: ipv6_packet_payload[tcp_packet] {
// ext_headers: array[ipv6_ext_header] {
// }
// payload: tcp_packet {
// header: tcp_header {
// src_port: int16be = 0x4e21 (2 bytes)
// dst_port: int16be = 0x4e22 (2 bytes)
// seq_num: tcp_seq_num (resource)
// ack_num: tcp_seq_num (resource)
// ns: int8 = 0x1 (0 bytes)
// reserved: const = 0x0 (0 bytes)
// data_off: bytesize4 = 0x5 (1 bytes)
// flags: tcp_flags = 0x40 (1 bytes)
// window_size: int16be = 0x0 (2 bytes)
// csum: csum = 0x0 (2 bytes)
// urg_ptr: int16be = 0x2 (2 bytes)
// options: tcp_options {
// options: array[tcp_option] {
// }
// }
// }
// payload: tcp_payload {
// payload: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// }
// }
// }
// }
// frags: nil
// ]
memset((void*)0x200000003100, 170, 5);
*(uint8_t*)0x200000003105 = 0xaa;
memset((void*)0x200000003106, 170, 5);
*(uint8_t*)0x20000000310b = 0xaa;
*(uint16_t*)0x20000000310c = htobe16(0x86dd);
STORE_BY_BITMASK(uint8_t, , 0x20000000310e, 5, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x20000000310e, 6, 4, 4);
memcpy((void*)0x20000000310f, "\xbd\x1f\x5a", 3);
*(uint16_t*)0x200000003112 = htobe16(0x14);
*(uint8_t*)0x200000003114 = 6;
*(uint8_t*)0x200000003115 = 1;
*(uint8_t*)0x200000003116 = 0xfe;
*(uint8_t*)0x200000003117 = 0x80;
memset((void*)0x200000003118, 0, 13);
*(uint8_t*)0x200000003125 = 0xaa;
*(uint8_t*)0x200000003126 = 0xfe;
*(uint8_t*)0x200000003127 = 0x80;
memset((void*)0x200000003128, 0, 13);
*(uint8_t*)0x200000003135 = 0xaa;
*(uint16_t*)0x200000003136 = htobe16(0x4e21);
*(uint16_t*)0x200000003138 = htobe16(0x4e22);
*(uint32_t*)0x20000000313a = 0x41424344;
*(uint32_t*)0x20000000313e = 0x41424344;
STORE_BY_BITMASK(uint8_t, , 0x200000003142, 1, 0, 1);
STORE_BY_BITMASK(uint8_t, , 0x200000003142, 0, 1, 3);
STORE_BY_BITMASK(uint8_t, , 0x200000003142, 5, 4, 4);
*(uint8_t*)0x200000003143 = 0x40;
*(uint16_t*)0x200000003144 = htobe16(0);
*(uint16_t*)0x200000003146 = htobe16(0);
*(uint16_t*)0x200000003148 = htobe16(2);
struct csum_inet csum_5;
csum_inet_init(&csum_5);
csum_inet_update(&csum_5, (const uint8_t*)0x200000003116, 16);
csum_inet_update(&csum_5, (const uint8_t*)0x200000003126, 16);
uint32_t csum_5_chunk_2 = 0x14000000;
csum_inet_update(&csum_5, (const uint8_t*)&csum_5_chunk_2, 4);
uint32_t csum_5_chunk_3 = 0x6000000;
csum_inet_update(&csum_5, (const uint8_t*)&csum_5_chunk_3, 4);
csum_inet_update(&csum_5, (const uint8_t*)0x200000003136, 20);
*(uint16_t*)0x200000003146 = csum_inet_digest(&csum_5);
syz_emit_ethernet(/*len=*/0x4a, /*packet=*/0x200000003100, /*frags=*/0);
break; }
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
for (procid = 0; procid < 4; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_namespace();
} }
sleep(1000000);
return 0;
}
cSeaBIOS (version rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org)
iPXE (http://ipxe.org) 00:03.0 CA00 PCI2.10 PnP PMM+7EFD1C10+7EF31C10 CA00 Press Ctrl-B to configure iPXE (PCI 00:03.0)...
Booting from ROM...
c[ 0.000000] Linux version 7.1.0-gf0e6f20cb52b (gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #1 SMP PREEMPT_DYNAMIC Wed Jun 24 21:45:00 MSK 2026
[ 0.000000] Command line: root=/dev/sda console=ttyS0 net.ifnames=0 [ 0.000000] BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] System RAM [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] device reserved [ 0.000000] BIOS-e820: [gap 0x00000000000a0000-0x00000000000effff] [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] device reserved [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000007ffdffff] System RAM [ 0.000000] BIOS-e820: [mem 0x000000007ffe0000-0x000000007fffffff] device reserved [ 0.000000] BIOS-e820: [gap 0x0000000080000000-0x00000000feffbfff] [ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] device reserved [ 0.000000] BIOS-e820: [gap 0x00000000ff000000-0x00000000fffbffff] [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] device reserved [ 0.000000] BIOS-e820: [gap 0x0000000100000000-0x000000fcffffffff] [ 0.000000] BIOS-e820: [mem 0x000000fd00000000-0x000000ffffffffff] device reserved [ 0.000000] NX (Execute Disable) protection: active [ 0.000000] APIC: Static calls initialized [ 0.000000] DMI: SMBIOS 2.8 present. [ 0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 0.000000] DMI: Memory slots populated: 1/1 [ 0.000000] Hypervisor detected: KVM [ 0.000000] last_pfn = 0x7ffe0 max_arch_pfn = 0x400000000 [ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00 [ 0.000001] kvm-clock: using sched offset of 673225673 cycles [ 0.000006] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns [ 0.000014] tsc: Detected 3193.984 MHz processor [ 0.005248] last_pfn = 0x7ffe0 max_arch_pfn = 0x400000000 [ 0.005287] MTRR map: 4 entries (3 fixed + 1 variable; max 19), built from 8 variable MTRRs [ 0.005294] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT [ 0.008028] found SMP MP-table at [mem 0x000f54b0-0x000f54bf] [ 0.008056] Using GB pages for direct mapping [ 0.009453] ACPI: Early table checksum verification disabled [ 0.009460] ACPI: RSDP 0x00000000000F52D0 000014 (v00 BOCHS ) [ 0.009477] ACPI: RSDT 0x000000007FFE2389 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001) [ 0.009493] ACPI: FACP 0x000000007FFE2235 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001) [ 0.009511] ACPI: DSDT 0x000000007FFE0040 0021F5 (v01 BOCHS BXPC 00000001 BXPC 00000001) [ 0.009523] ACPI: FACS 0x000000007FFE0000 000040 [ 0.009532] ACPI: APIC 0x000000007FFE22A9 000080 (v03 BOCHS BXPC 00000001 BXPC 00000001) [ 0.009543] ACPI: HPET 0x000000007FFE2329 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) [ 0.009555] ACPI: WAET 0x000000007FFE2361 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001) [ 0.009565] ACPI: Reserving FACP table memory at [mem 0x7ffe2235-0x7ffe22a8] [ 0.009570] ACPI: Reserving DSDT table memory at [mem 0x7ffe0040-0x7ffe2234] [ 0.009575] ACPI: Reserving FACS table memory at [mem 0x7ffe0000-0x7ffe003f] [ 0.009579] ACPI: Reserving APIC table memory at [mem 0x7ffe22a9-0x7ffe2328] [ 0.009583] ACPI: Reserving HPET table memory at [mem 0x7ffe2329-0x7ffe2360] [ 0.009588] ACPI: Reserving WAET table memory at [mem 0x7ffe2361-0x7ffe2388] [ 0.010339] No NUMA configuration found [ 0.010343] Faking a node at [mem 0x0000000000000000-0x000000007ffdffff] [ 0.010353] NODE_DATA(0) allocated [mem 0x7ffdc680-0x7ffdffff] [ 0.268430] KernelAddressSanitizer initialized (generic) [ 0.268815] ACPI: PM-Timer IO Port: 0x608 [ 0.268850] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) [ 0.268900] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23 [ 0.268913] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) [ 0.268922] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level) [ 0.268927] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level) [ 0.268934] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level) [ 0.268940] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level) [ 0.268954] ACPI: Using ACPI (MADT) for SMP configuration information [ 0.268958] ACPI: HPET id: 0x8086a201 base: 0xfed00000 [ 0.268971] TSC deadline timer available [ 0.268980] CPU topo: Max. logical packages: 1 [ 0.268984] CPU topo: Max. logical nodes: 1 [ 0.268986] CPU topo: Num. nodes per package: 1 [ 0.268993] CPU topo: Max. logical dies: 1 [ 0.268996] CPU topo: Max. dies per package: 1 [ 0.269006] CPU topo: Max. threads per core: 1 [ 0.269009] CPU topo: Num. cores per package: 2 [ 0.269012] CPU topo: Num. threads per package: 2 [ 0.269014] CPU topo: Allowing 2 present CPUs plus 0 hotplug CPUs [ 0.269062] kvm-guest: APIC: eoi() replaced with kvm_guest_apic_eoi_write() [ 0.269101] kvm-guest: KVM setup pv remote TLB flush [ 0.269106] kvm-guest: setup PV sched yield [ 0.269151] PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff] [ 0.269158] PM: hibernation: Registered nosave memory: [mem 0x0009f000-0x000fffff] [ 0.269167] [gap 0x80000000-0xfeffbfff] available for PCI devices [ 0.269173] Booting paravirtualized kernel on KVM [ 0.269182] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns [ 0.283994] Zone ranges: [ 0.284002] DMA [mem 0x0000000000001000-0x0000000000ffffff] [ 0.284010] DMA32 [mem 0x0000000001000000-0x000000007ffdffff] [ 0.284016] Normal empty [ 0.284019] Movable zone start for each node [ 0.284022] Early memory node ranges [ 0.284023] node 0: [mem 0x0000000000001000-0x000000000009efff] [ 0.284029] node 0: [mem 0x0000000000100000-0x000000007ffdffff] [ 0.284035] Initmem setup node 0 [mem 0x0000000000001000-0x000000007ffdffff] [ 0.284068] On node 0, zone DMA: 1 pages in unavailable ranges [ 0.284438] On node 0, zone DMA: 97 pages in unavailable ranges [ 0.337404] On node 0, zone DMA32: 32 pages in unavailable ranges [ 0.337428] setup_percpu: NR_CPUS:64 nr_cpumask_bits:2 nr_cpu_ids:2 nr_node_ids:1 [ 0.339309] percpu: Embedded 65 pages/cpu s225624 r8192 d32424 u1048576 [ 0.339497] Kernel command line: net.ifnames=0 root=/dev/sda console=ttyS0 net.ifnames=0 [ 0.339694] random: crng init done [ 0.339698] printk: log buffer data + meta data: 262144 + 917504 = 1179648 bytes [ 0.341610] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear) [ 0.342582] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear) [ 0.342981] Fallback order for Node 0: 0 [ 0.342995] Built 1 zonelists, mobility grouping on. Total pages: 524158 [ 0.343002] Policy zone: DMA32 [ 0.343010] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.343016] stackdepot: allocating hash table via alloc_large_system_hash [ 0.343028] stackdepot hash table entries: 1048576 (order: 12, 16777216 bytes, linear) [ 0.359568] stackdepot: allocating space for 8192 stack pools via memblock [ 0.404243] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 [ 0.404641] Dynamic Preempt: full [ 0.404900] rcu: Preemptible hierarchical RCU implementation. [ 0.404903] rcu: RCU event tracing is enabled. [ 0.404905] rcu: RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=2. [ 0.404911] Trampoline variant of Tasks RCU enabled. [ 0.404913] Tracing variant of Tasks RCU enabled. [ 0.404916] rcu: RCU calculated value of scheduler-enlistment delay is 100 jiffies. [ 0.404920] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2 [ 0.404963] RCU Tasks: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2. [ 0.447737] NR_IRQS: 4352, nr_irqs: 440, preallocated irqs: 16 [ 0.448115] rcu: srcu_init: Setting srcu_struct sizes based on contention. [ 0.448132] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns [ 0.452893] Console: colour VGA+ 80x25 [ 0.453070] printk: legacy console [ttyS0] enabled [ 0.549803] ACPI: Core revision 20260408 [ 0.550712] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns [ 0.551988] APIC: Switch to symmetric I/O mode setup [ 0.552825] x2apic enabled [ 0.553683] APIC: Switched APIC routing to: physical x2apic [ 0.554572] kvm-guest: APIC: send_IPI_mask() replaced with kvm_send_ipi_mask() [ 0.555692] kvm-guest: APIC: send_IPI_mask_allbutself() replaced with kvm_send_ipi_mask_allbutself() [ 0.556900] kvm-guest: setup PV IPIs [ 0.558898] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1 [ 0.559841] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x2e0a16d682b, max_idle_ns: 440795210620 ns [ 0.561308] Calibrating delay loop (skipped) preset value.. 6387.96 BogoMIPS (lpj=3193984) [ 0.562422] x86/cpu: User Mode Instruction Prevention (UMIP) activated [ 0.563417] Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127 [ 0.564301] Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0 [ 0.565308] mitigations: Enabled attack vectors: user_kernel, user_user, SMT mitigations: auto [ 0.566304] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl [ 0.567302] Speculative Return Stack Overflow: IBPB-extending microcode not applied! [ 0.568300] Speculative Return Stack Overflow: WARNING: See https://kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html for mitigation options. [ 0.568305] Transient Scheduler Attacks: Vulnerable: No microcode [ 0.570303] Spectre V2 : Mitigation: Retpolines [ 0.571307] Speculative Return Stack Overflow: Vulnerable: Safe RET, no microcode [ 0.572301] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization [ 0.573303] Spectre V2 : Spectre v2 / SpectreRSB: Filling RSB on context switch and VMEXIT [ 0.574301] Spectre V2 : Enabling Restricted Speculation for firmware calls [ 0.575313] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier [ 0.576307] active return thunk: srso_alias_return_thunk [ 0.577337] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' [ 0.578301] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' [ 0.579300] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' [ 0.580300] x86/fpu: Supporting XSAVE feature 0x200: 'Protection Keys User registers' [ 0.581306] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 [ 0.582302] x86/fpu: xstate_offset[9]: 832, xstate_sizes[9]: 8 [ 0.583300] x86/fpu: Enabled xstate features 0x207, context size is 840 bytes, using 'compacted' format. [ 0.683643] pid_max: default: 32768 minimum: 301 [ 0.684767] SELinux: Initializing. [ 0.686876] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear) [ 0.687315] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear) [ 0.689682] VFS: Finished mounting rootfs on nullfs [ 0.692066] smpboot: CPU0: AMD Ryzen 7 5800HS with Radeon Graphics (family: 0x19, model: 0x50, stepping: 0x0) [ 0.693131] Performance Events: Fam17h+ core perfctr, AMD PMU driver. [ 0.693309] ... version: 0 [ 0.693897] ... bit width: 48 [ 0.694307] ... generic counters: 6 [ 0.694877] ... generic bitmap: 000000000000003f [ 0.695307] ... fixed-purpose counters: 0 [ 0.695885] ... fixed-purpose bitmap: 0000000000000000 [ 0.696304] ... value mask: 0000ffffffffffff [ 0.697049] ... max period: 00007fffffffffff [ 0.697304] ... global_ctrl mask: 000000000000003f [ 0.698657] signal: max sigframe size: 3376 [ 0.699390] rcu: Hierarchical SRCU implementation. [ 0.700215] rcu: Max phase no-delay instances is 400. [ 0.700574] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level [ 0.729644] smp: Bringing up secondary CPUs ... [ 0.730744] smpboot: x86: Booting SMP configuration: [ 0.731317] .... node #0, CPUs: #1 [ 0.731442] smp: Brought up 1 node, 2 CPUs [ 0.732840] smpboot: Total of 2 processors activated (12775.93 BogoMIPS) [ 0.733792] Memory: 1655840K/2096632K available (60933K kernel code, 9815K rwdata, 13360K rodata, 10624K init, 840K bss, 435640K reserved, 0K cma-reserved) [ 0.734703] devtmpfs: initialized [ 0.744347] posixtimers hash table entries: 1024 (order: 2, 16384 bytes, linear) [ 0.745334] futex hash table entries: 512 (32768 bytes on 1 NUMA nodes, total 32 KiB, linear). [ 0.747223] PM: RTC time: 18:46:30, date: 2026-06-24 [ 0.748292] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.750708] audit: initializing netlink subsys (disabled) [ 0.752390] audit: type=2000 audit(1782326790.342:1): state=initialized audit_enabled=0 res=1 [ 0.753655] thermal_sys: Registered thermal governor 'step_wise' [ 0.753784] cpuidle: using governor menu [ 0.755703] Freeing SMP alternatives memory: 56K [ 0.757253] PCI: Using configuration type 1 for base access [ 0.757306] PCI: Using configuration type 1 for extended access [ 0.758835] kprobes: kprobe jump-optimization is enabled. All kprobes are optimized if possible. [ 0.761415] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages [ 0.762308] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page [ 0.765869] ACPI: Added _OSI(Module Device) [ 0.766321] ACPI: Added _OSI(Processor Device) [ 0.766966] ACPI: Added _OSI(Processor Aggregator Device) [ 0.814081] ACPI: 1 ACPI AML tables successfully acquired and loaded [ 0.820515] ACPI: \_SB_: platform _OSC: OS support mask [002a7eee] [ 0.826167] ACPI: Interpreter enabled [ 0.826791] ACPI: PM: (supports S0 S3 S4 S5) [ 0.827311] ACPI: Using IOAPIC for interrupt routing [ 0.828305] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug [ 0.829305] PCI: Using E820 reservations for host bridge windows [ 0.832768] ACPI: Enabled 2 GPEs in block 00 to 0F [ 0.913002] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) [ 0.913390] acpi PNP0A03:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3] [ 0.914528] acpi PNP0A03:00: _OSC: OS requested [PME PCIeCapability LTR] [ 0.915321] acpi PNP0A03:00: _OSC: platform willing to grant [PME PCIeCapability LTR] [ 0.916311] acpi PNP0A03:00: _OSC: platform retains control of PCIe features (AE_ERROR) [ 0.919490] PCI host bridge to bus 0000:00 [ 0.920234] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] [ 0.920325] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] [ 0.921317] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] [ 0.922320] pci_bus 0000:00: root bus resource [mem 0x80000000-0xfebfffff window] [ 0.923326] pci_bus 0000:00: root bus resource [mem 0x100000000-0x17fffffff window] [ 0.924345] pci_bus 0000:00: root bus resource [bus 00-ff] [ 0.925539] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 0.929019] pci 0000:00:01.0: [8086:7000] type 00 class 0x060100 conventional PCI endpoint [ 0.931709] pci 0000:00:01.1: [8086:7010] type 00 class 0x010180 conventional PCI endpoint [ 0.933389] pci 0000:00:01.1: BAR 4 [io 0xc080-0xc08f] [ 0.934245] pci 0000:00:01.1: BAR 0 [io 0x01f0-0x01f7]: legacy IDE quirk [ 0.934312] pci 0000:00:01.1: BAR 1 [io 0x03f6]: legacy IDE quirk [ 0.935315] pci 0000:00:01.1: BAR 2 [io 0x0170-0x0177]: legacy IDE quirk [ 0.936281] pci 0000:00:01.1: BAR 3 [io 0x0376]: legacy IDE quirk [ 0.940050] pci 0000:00:01.3: [8086:7113] type 00 class 0x068000 conventional PCI endpoint [ 0.940713] pci 0000:00:01.3: quirk: [io 0x0600-0x063f] claimed by PIIX4 ACPI [ 0.941321] pci 0000:00:01.3: quirk: [io 0x0700-0x070f] claimed by PIIX4 SMB [ 0.944738] pci 0000:00:02.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 0.947245] pci 0000:00:02.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 0.948284] pci 0000:00:02.0: BAR 2 [mem 0xfebf0000-0xfebf0fff] [ 0.949297] pci 0000:00:02.0: ROM [mem 0xfebe0000-0xfebeffff pref] [ 0.950982] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 0.954095] pci 0000:00:03.0: [8086:100e] type 00 class 0x020000 conventional PCI endpoint [ 0.955317] pci 0000:00:03.0: BAR 0 [mem 0xfebc0000-0xfebdffff] [ 0.956149] pci 0000:00:03.0: BAR 1 [io 0xc000-0xc03f] [ 0.956350] pci 0000:00:03.0: ROM [mem 0xfeb80000-0xfebbffff pref] [ 0.986934] pci 0000:00:04.0: [1af4:1009] type 00 class 0x000200 conventional PCI endpoint [ 0.989011] pci 0000:00:04.0: BAR 0 [io 0xc040-0xc07f] [ 0.989317] pci 0000:00:04.0: BAR 1 [mem 0xfebf1000-0xfebf1fff] [ 0.990154] pci 0000:00:04.0: BAR 4 [mem 0xfe000000-0xfe003fff 64bit pref] [ 1.028794] ACPI: PCI: Interrupt link LNKA configured for IRQ 10 [ 1.031862] ACPI: PCI: Interrupt link LNKB configured for IRQ 10 [ 1.034815] ACPI: PCI: Interrupt link LNKC configured for IRQ 11 [ 1.038123] ACPI: PCI: Interrupt link LNKD configured for IRQ 11 [ 1.039341] ACPI: PCI: Interrupt link LNKS configured for IRQ 9 [ 1.049932] iommu: Default domain type: Translated [ 1.050309] iommu: DMA domain TLB invalidation policy: lazy mode [ 1.052923] SCSI subsystem initialized [ 1.054692] ACPI: bus type USB registered [ 1.055755] usbcore: registered new interface driver usbfs [ 1.056516] usbcore: registered new interface driver hub [ 1.057417] usbcore: registered new device driver usb [ 1.058556] pps_core: LinuxPPS API ver. 1 registered [ 1.059290] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <[email protected]> [ 1.060374] PTP clock support registered [ 1.062955] Advanced Linux Sound Architecture Driver Initialized. [ 1.066724] NetLabel: Initializing [ 1.067308] NetLabel: domain hash size = 128 [ 1.067937] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO [ 1.068655] NetLabel: unlabeled traffic allowed by default [ 1.070252] PCI: Using ACPI for IRQ routing [ 1.070481] e820: register RAM buffer resource [mem 0x0009fc00-0x0009ffff] [ 1.071335] e820: register RAM buffer resource [mem 0x7ffe0000-0x7fffffff] [ 1.072687] pci 0000:00:02.0: vgaarb: setting as boot VGA device [ 1.073297] pci 0000:00:02.0: vgaarb: bridge control possible [ 1.073297] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 1.073311] vgaarb: loaded [ 1.074783] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0 [ 1.075304] hpet0: 3 comparators, 64-bit 100.000000 MHz counter [ 1.079626] clocksource: Switched to clocksource kvm-clock [ 1.081994] VFS: Disk quotas dquot_6.6.0 [ 1.082681] VFS: Dquot-cache hash table entries: 512 (4096 bytes) [ 1.087146] pnp: PnP ACPI init [ 1.094159] pnp: PnP ACPI: found 5 devices [ 1.118667] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns [ 1.120462] NET: Registered PF_INET protocol family [ 1.121509] IP idents hash table entries: 32768 (order: 6, 262144 bytes, linear) [ 1.125142] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear) [ 1.126560] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 1.127856] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear) [ 1.129772] TCP bind hash table entries: 16384 (order: 7, 524288 bytes, linear) [ 1.131684] TCP: Hash tables configured (established 16384 bind 16384) [ 1.133209] UDP hash table entries: 1024 (order: 4, 65536 bytes, linear) [ 1.134994] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 1.137188] RPC: Registered named UNIX socket transport module. [ 1.138075] RPC: Registered udp transport module. [ 1.138761] RPC: Registered tcp transport module. [ 1.139432] RPC: Registered tcp-with-tls transport module. [ 1.140182] RPC: Registered tcp NFSv4.1 backchannel transport module. [ 1.145328] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] [ 1.146235] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window] [ 1.147098] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window] [ 1.148056] pci_bus 0000:00: resource 7 [mem 0x80000000-0xfebfffff window] [ 1.149022] pci_bus 0000:00: resource 8 [mem 0x100000000-0x17fffffff window] [ 1.150718] pci 0000:00:01.0: PIIX3: Enabling Passive Release [ 1.151538] pci 0000:00:00.0: Limiting direct PCI/PCI transfers [ 1.152654] PCI: CLS 0 bytes, default 64 [ 1.153726] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x2e0a16d682b, max_idle_ns: 440795210620 ns [ 1.165723] Initialise system trusted keyrings [ 1.166738] workingset: timestamp_bits=40 (anon: 35) max_order=19 bucket_order=0 (anon: 0) [ 1.171126] NFS: Registering the id_resolver key type [ 1.171884] Key type id_resolver registered [ 1.172479] Key type id_legacy registered [ 1.173057] nfs4filelayout_init: NFSv4 File Layout Driver Registering... [ 1.174090] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering... [ 1.175942] 9p: Installing v9fs 9p2000 file system support [ 1.208579] Key type asymmetric registered [ 1.209217] Asymmetric key parser 'x509' registered [ 1.210540] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251) [ 1.211749] io scheduler mq-deadline registered [ 1.212383] io scheduler kyber registered [ 1.215714] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0 [ 1.217224] ACPI: button: Power Button [PWRF] [ 1.259827] ACPI: \_SB_.LNKD: Enabled at IRQ 11 [ 1.263037] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 1.265675] 00:04: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A [ 1.277076] Non-volatile memory driver v1.3 [ 1.278836] ACPI: bus type drm_connector registered [ 1.297152] loop: module loaded [ 1.304497] scsi host0: ata_piix [ 1.308863] scsi host1: ata_piix [ 1.309882] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc080 irq 14 lpm-pol 0 [ 1.310948] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc088 irq 15 lpm-pol 0 [ 1.318427] tun: Universal TUN/TAP device driver, 1.6 [ 1.319803] e100: Intel(R) PRO/100 Network Driver [ 1.320466] e100: Copyright(c) 1999-2006 Intel Corporation [ 1.321386] e1000: Intel(R) PRO/1000 Network Driver [ 1.322054] e1000: Copyright (c) 1999-2006 Intel Corporation. [ 1.362563] ACPI: \_SB_.LNKC: Enabled at IRQ 10 [ 1.466402] ata1: found unknown device (class 0) [ 1.468808] ata2: found unknown device (class 0) [ 1.470353] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100 [ 1.471385] ata1.00: Model 'QEMU HARDDISK', rev '2.5+', applying quirks: bridgeok [ 1.473903] ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100 [ 1.474724] ata1.00: 4194304 sectors, multi 16: LBA48 [ 1.479999] scsi 0:0:0:0: Direct-Access ATA QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5 [ 1.486747] sd 0:0:0:0: Attached scsi generic sg0 type 0 [ 1.487649] sd 0:0:0:0: [sda] 4194304 512-byte logical blocks: (2.15 GB/2.00 GiB) [ 1.490761] sd 0:0:0:0: [sda] Write Protect is off [ 1.493535] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5 [ 1.494832] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 1.498071] sd 0:0:0:0: [sda] Preferred minimum I/O size 512 bytes [ 1.512975] sd 0:0:0:0: [sda] Attached SCSI disk [ 1.516825] sr 1:0:0:0: [sr0] scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray [ 1.528968] cdrom: Uniform CD-ROM driver Revision: 3.20 [ 1.543403] sr 1:0:0:0: Attached scsi generic sg1 type 5 [ 1.667232] e1000 0000:00:03.0 eth0: (PCI:33MHz:32-bit) 52:54:00:12:34:56 [ 1.668242] e1000 0000:00:03.0 eth0: Intel(R) PRO/1000 Network Connection [ 1.669414] e1000e: Intel(R) PRO/1000 Network Driver [ 1.670080] e1000e: Copyright(c) 1999 - 2015 Intel Corporation. [ 1.671117] sky2: driver version 1.30 [ 1.673771] usbcore: registered new interface driver usblp [ 1.674691] usbcore: registered new interface driver usb-storage [ 1.675910] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12 [ 1.678058] serio: i8042 KBD port at 0x60,0x64 irq 1 [ 1.679109] serio: i8042 AUX port at 0x60,0x64 irq 12 [ 1.682038] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1 [ 1.683314] rtc_cmos PNP0B00:00: RTC can wake from S4 [ 1.686557] rtc_cmos PNP0B00:00: registered as rtc0 [ 1.687530] rtc_cmos PNP0B00:00: alarms up to one day, y3k, 242 bytes nvram, hpet irqs [ 1.693085] device-mapper: ioctl: 4.50.0-ioctl (2025-04-28) initialised: [email protected] [ 1.694431] amd_pstate: The CPPC feature is supported but currently disabled by the BIOS. [ 1.694431] Please enable it if your BIOS has the CPPC option. [ 1.696351] amd_pstate: the _CPC object is not present in SBIOS or ACPI disabled [ 1.697913] hid: raw HID events driver (C) Jiri Kosina [ 1.701590] usbcore: registered new interface driver usbhid [ 1.702380] usbhid: USB HID core driver [ 1.707654] Initializing XFRM netlink socket [ 1.708557] NET: Registered PF_INET6 protocol family [ 1.711926] Segment Routing with IPv6 [ 1.712598] In-situ OAM (IOAM) with IPv6 [ 1.713362] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver [ 1.715858] NET: Registered PF_PACKET protocol family [ 1.716818] 8021q: 802.1Q VLAN Support v1.8 [ 1.717584] 9pnet: Installing 9P2000 support [ 1.719953] Key type dns_resolver registered [ 1.722209] IPI shorthand broadcast: enabled [ 1.784140] sched_clock: Marking stable (1677003577, 106165972)->(1840780998, -57611449) [ 1.786367] registered taskstats version 1 [ 1.786925] Loading compiled-in X.509 certificates [ 1.836502] Demotion targets for Node 0: null [ 1.837760] PM: Magic number: 14:948:797 [ 1.838545] netconsole: network logging started [ 1.839758] cfg80211: Loading compiled-in X.509 certificates for regulatory database [ 1.841532] kworker/u8:2 (60) used greatest stack depth: 29312 bytes left [ 1.843333] cryptomgr_probe (62) used greatest stack depth: 29136 bytes left [ 1.845590] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7' [ 1.848249] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600' [ 1.849547] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2 [ 1.850803] cfg80211: failed to load regulatory.db [ 2.107745] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input3 [ 6.602002] ALSA device list: [ 6.602521] No soundcards found. [ 6.603607] md: Waiting for all devices to be available before autodetect [ 6.604412] md: If you don't use raid, use raid=noautodetect [ 6.605054] md: Autodetecting RAID arrays. [ 6.605559] md: autorun ... [ 6.605899] md: ... autorun DONE. [ 6.612873] EXT4-fs (sda): INFO: recovery required on readonly filesystem [ 6.613860] EXT4-fs (sda): write access will be enabled during recovery [ 6.654971] EXT4-fs (sda): recovery complete [ 6.656773] EXT4-fs (sda): mounted filesystem 1ad6e232-a749-44cb-8d6a-dabbf94e2ee4 ro with ordered data mode. Quota mode: none. [ 6.658085] VFS: Mounted root (ext4 filesystem) readonly on device 8:0. [ 6.659664] devtmpfs: mounted [ 6.660149] VFS: Pivoted into new rootfs [ 6.670153] Freeing unused kernel image (initmem) memory: 10624K [ 6.671118] Write protecting the kernel read-only data: 75776k [ 6.674026] Freeing unused kernel image (text/rodata gap) memory: 504K [ 6.676062] Freeing unused kernel image (rodata/data gap) memory: 976K [ 6.915262] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 6.915973] Run /sbin/init as init process [ 7.518504] SELinux: Permission firmware_load in class system not defined in policy. [ 7.519330] SELinux: Permission kexec_image_load in class system not defined in policy. [ 7.520126] SELinux: Permission kexec_initramfs_load in class system not defined in policy. [ 7.520973] SELinux: Permission policy_load in class system not defined in policy. [ 7.521770] SELinux: Permission x509_certificate_load in class system not defined in policy. [ 7.522729] SELinux: Permission watch_mountns in class file not defined in policy. [ 7.523552] SELinux: Permission watch_mountns in class dir not defined in policy. [ 7.524338] SELinux: Permission watch_mountns in class lnk_file not defined in policy. [ 7.525126] SELinux: Permission watch_mountns in class chr_file not defined in policy. [ 7.526052] SELinux: Permission watch_mountns in class blk_file not defined in policy. [ 7.526988] SELinux: Permission watch_mountns in class sock_file not defined in policy. [ 7.527929] SELinux: Permission watch_mountns in class fifo_file not defined in policy. [ 7.529348] SELinux: Permission map_create_as in class bpf not defined in policy. [ 7.530218] SELinux: Permission prog_load_as in class bpf not defined in policy. [ 7.531020] SELinux: Permission watch_mountns in class anon_inode not defined in policy. [ 7.531914] SELinux: Permission allowed in class io_uring not defined in policy. [ 7.532680] SELinux: Class memfd_file not defined in policy. [ 7.533307] SELinux: the above unknown classes and permissions will be allowed [ 7.577111] SELinux: policy capability network_peer_controls=1 [ 7.577781] SELinux: policy capability open_perms=1 [ 7.578298] SELinux: policy capability extended_socket_class=1 [ 7.578907] SELinux: policy capability always_check_network=0 [ 7.579505] SELinux: policy capability cgroup_seclabel=1 [ 7.580060] SELinux: policy capability nnp_nosuid_transition=1 [ 7.580679] SELinux: policy capability genfs_seclabel_symlinks=0 [ 7.581310] SELinux: policy capability ioctl_skip_cloexec=0 [ 7.581876] SELinux: policy capability userspace_initial_context=0 [ 7.582520] SELinux: policy capability netlink_xperm=0 [ 7.583055] SELinux: policy capability netif_wildcard=0 [ 7.583608] SELinux: policy capability genfs_seclabel_wildcard=0 [ 7.584229] SELinux: policy capability functionfs_seclabel=0 [ 7.584814] SELinux: policy capability memfd_class=0 [ 7.585336] SELinux: policy capability bpf_token_perms=0 [ 7.611391] audit: type=1403 audit(1782326797.200:2): auid=4294967295 ses=4294967295 lsm=selinux res=1 [ 7.616798] systemd[1]: Successfully loaded SELinux policy in 591.933ms. [ 7.754149] systemd[1]: Relabeled /dev/, /dev/shm/, /run/ in 47.677ms. [!p]104[ 7.771080] systemd[1]: systemd 257.9-1~deb13u1 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF -XKBCOMMON -UTMP +SYSVINIT +LIBARCHIVE) [ 7.774883] systemd[1]: Detected virtualization kvm. [ 7.775759] systemd[1]: Detected architecture x86-64.
Welcome to Debian GNU/Linux 13 (trixie)!
[ 7.780252] systemd[1]: Hostname set to <syzkaller>.
[ 7.810049] systemd[1]: bpf-restrict-fs: BPF LSM hook not enabled in the kernel, BPF LSM not supported.
[ 7.887394] selinuxenabled (75) used greatest stack depth: 26624 bytes left
[ 7.924749] systemd-debug-g (70) used greatest stack depth: 25888 bytes left
[ 7.954615] grep (78) used greatest stack depth: 25712 bytes left
[ 7.961975] systemd-fstab-g (71) used greatest stack depth: 25616 bytes left
[ 8.056978] systemd-ssh-gen (79) used greatest stack depth: 25488 bytes left
[ 8.260128] systemd[1]: Queued start job for default target graphical.target.
[ 8.306889] systemd[1]: Created slice system-getty.slice - Slice /system/getty.
[ OK ] Created slice system-getty.slice - Slice /system/getty.
[ 8.322978] systemd[1]: Created slice system-modprobe.slice - Slice /system/modprobe.
[ OK ] Created slice system-modprobe.slice - Slice /system/modprobe.
[ 8.338479] systemd[1]: Created slice system-serial\x2dgetty.slice - Slice /system/serial-getty.
[ OK ] Created slice system-serial\x2dget…slice - Slice /system/serial-getty.
[ 8.353710] systemd[1]: Created slice user.slice - User and Session Slice.
[ OK ] Created slice user.slice - User and Session Slice.
[ 8.356242] systemd[1]: Started systemd-ask-password-console.path - Dispatch Password Requests to Console Directory Watch.
[ OK ] Started systemd-ask-password-conso…equests to Console Directory Watch.
[ 8.359342] systemd[1]: Started systemd-ask-password-wall.path - Forward Password Requests to Wall Directory Watch.
[ OK ] Started systemd-ask-password-wall.…d Requests to Wall Directory Watch.
[ 8.363902] systemd[1]: Set up automount proc-sys-fs-binfmt_misc.automount - Arbitrary Executable File Formats File System Automount Point.
[ OK ] Set up automount proc-sys-fs-binfm…ormats File System Automount Point.
[ 8.366601] systemd[1]: Expecting device dev-ttyS0.device - /dev/ttyS0...
Expecting device dev-ttyS0.device - /dev/ttyS0...
[ 8.368387] systemd[1]: Reached target paths.target - Path Units.
[ OK ] Reached target paths.target - Path Units.
[ 8.370046] systemd[1]: Reached target remote-fs.target - Remote File Systems.
[ OK ] Reached target remote-fs.target - Remote File Systems.
[ 8.371949] systemd[1]: Reached target slices.target - Slice Units.
[ OK ] Reached target slices.target - Slice Units.
[ 8.373674] systemd[1]: Reached target swap.target - Swaps.
[ OK ] Reached target swap.target - Swaps.
[ 8.378637] systemd[1]: Listening on systemd-creds.socket - Credential Encryption/Decryption.
[ OK ] Listening on systemd-creds.socket - Credential Encryption/Decryption.
[ 8.381811] systemd[1]: Listening on systemd-initctl.socket - initctl Compatibility Named Pipe.
[ OK ] Listening on systemd-initctl.socke…- initctl Compatibility Named Pipe.
[ 8.387292] systemd[1]: Listening on systemd-journald-dev-log.socket - Journal Socket (/dev/log).
[ OK ] Listening on systemd-journald-dev-…socket - Journal Socket (/dev/log).
[ 8.391700] systemd[1]: Listening on systemd-journald.socket - Journal Sockets.
[ OK ] Listening on systemd-journald.socket - Journal Sockets.
[ 8.393968] systemd[1]: systemd-pcrextend.socket - TPM PCR Measurements was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[ 8.395517] systemd[1]: systemd-pcrlock.socket - Make TPM PCR Policy was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[ 8.401047] systemd[1]: Listening on systemd-udevd-control.socket - udev Control Socket.
[ OK ] Listening on systemd-udevd-control.socket - udev Control Socket.
[ 8.404556] systemd[1]: Listening on systemd-udevd-kernel.socket - udev Kernel Socket.
[ OK ] Listening on systemd-udevd-kernel.socket - udev Kernel Socket.
[ 8.424456] systemd[1]: Mounting dev-hugepages.mount - Huge Pages File System...
Mounting dev-hugepages.mount - Huge Pages File System...
[ 8.443210] systemd[1]: Mounting dev-mqueue.mount - POSIX Message Queue File System...
Mounting dev-mqueue.mount - POSIX Message Queue File System...
[ 8.463768] systemd[1]: Mounting proc-sys-fs-binfmt_misc.mount - /proc/sys/fs/binfmt_misc...
Mounting proc-sys-fs-binfmt_misc.mount - /proc/sys/fs/binfmt_misc...
[ 8.498459] systemd[1]: Mounting run-lock.mount - Legacy Locks Directory /run/lock...
Mounting run-lock.mount - Legacy Locks Directory /run/lock...
[ 8.541243] systemd[1]: Mounting sys-kernel-config.mount - /sys/kernel/config...
Mounting sys-kernel-config.mount - /sys/kernel/config...
[ 8.566370] systemd[1]: Mounting sys-kernel-debug.mount - /sys/kernel/debug...
Mounting sys-kernel-debug.mount - /sys/kernel/debug...
[ 8.587331] systemd[1]: Mounting sys-kernel-tracing.mount - Kernel Trace File System...
Mounting sys-kernel-tracing.mount - Kernel Trace File System...
[ 8.617415] systemd[1]: Mounting tmp.mount - Temporary Directory /tmp...
Mounting tmp.mount - Temporary Directory /tmp...
[ 8.620392] systemd[1]: kmod-static-nodes.service - Create List of Static Device Nodes was skipped because of an unmet condition check (ConditionFileNotEmpty=/lib/modules/7.1.0-gf0e6f20cb52b/modules.devname).
[ 8.649776] systemd[1]: Starting [email protected] - Load Kernel Module drm...
Starting [email protected] - Load Kernel Module drm...
[ 8.669710] systemd[1]: Starting modprobe@efi_pstore.service - Load Kernel Module efi_pstore...
Starting modprobe@efi_pstore.servi… - Load Kernel Module efi_pstore...
[ 8.702137] systemd[1]: Starting [email protected] - Load Kernel Module fuse...
Starting [email protected] - Load Kernel Module fuse...
[ 8.706385] systemd[1]: systemd-hibernate-clear.service - Clear Stale Hibernate Storage Info was skipped because of an unmet condition check (ConditionPathExists=/sys/firmware/efi/efivars/HibernateLocation-8cf2644b-4b0b-428f-9387-6d876050dc67).
[ 8.711609] systemd[1]: systemd-journald.service: unit configures an IP firewall, but the local system does not support BPF/cgroup firewalling.
[ 8.714196] systemd[1]: systemd-journald.service: (This warning is only shown for the first unit using IP firewalling.)
[ 8.740407] systemd[1]: Starting systemd-journald.service - Journal Service...
Starting systemd-journald.service - Journal Service...
[ 8.773683] systemd[1]: Starting systemd-modules-load.service - Load Kernel Modules...
Starting systemd-modules-load.service - Load Kernel Modules...
[ 8.778323] systemd[1]: systemd-pcrmachine.service - TPM PCR Machine ID Measurement was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[ 8.820377] systemd[1]: Starting systemd-remount-fs.service - Remount Root and Kernel File Systems...
Starting systemd-remount-fs.servic…unt Root and Kernel File Systems...
[ 8.863032] systemd[1]: Starting systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully...
Starting systemd-tmpfiles-setup-de… Device Nodes in /dev gracefully...
[ 8.871801] systemd[1]: systemd-tpm2-setup-early.service - Early TPM SRK Setup was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[ 8.910703] systemd[1]: Starting systemd-udev-load-credentials.service - Load udev Rules from Credentials...
Starting systemd-udev-load-credent…Load udev Rules from Credentials...
[ 8.950009] systemd-journald[96]: Collecting audit messages is disabled.
[ 8.955912] EXT4-fs (sda): re-mounted 1ad6e232-a749-44cb-8d6a-dabbf94e2ee4 r/w.
[ 8.976049] systemd[1]: Starting systemd-udev-trigger.service - Coldplug All udev Devices...
Starting systemd-udev-trigger.service - Coldplug All udev Devices...
[ 9.024298] systemd[1]: Mounted dev-hugepages.mount - Huge Pages File System.
[ OK ] Mounted dev-hugepages.mount - Huge Pages File System.
[ 9.034493] systemd[1]: Mounted dev-mqueue.mount - POSIX Message Queue File System.
[ OK ] Mounted dev-mqueue.mount - POSIX Message Queue File System.
[ 9.052258] systemd[1]: Mounted proc-sys-fs-binfmt_misc.mount - /proc/sys/fs/binfmt_misc.
[ OK ] Mounted proc-sys-fs-binfmt_misc.mount - /proc/sys/fs/binfmt_misc.
[ 9.065081] systemd[1]: Mounted run-lock.mount - Legacy Locks Directory /run/lock.
[ OK ] Mounted run-lock.mount - Legacy Locks Directory /run/lock.
[ 9.076504] systemd[1]: Mounted sys-kernel-config.mount - /sys/kernel/config.
[ OK ] Mounted sys-kernel-config.mount - /sys/kernel/config.
[ 9.084975] systemd[1]: Mounted sys-kernel-debug.mount - /sys/kernel/debug.
[ OK ] Mounted sys-kernel-debug.mount - /sys/kernel/debug.
[ 9.097520] systemd[1]: Mounted sys-kernel-tracing.mount - Kernel Trace File System.
[ OK ] Mounted sys-kernel-tracing.mount - Kernel Trace File System.
[ 9.106908] systemd[1]: Mounted tmp.mount - Temporary Directory /tmp.
[ OK ] Mounted tmp.mount - Temporary Directory /tmp.
[ 9.117927] systemd[1]: [email protected]: Deactivated successfully.
[ 9.124090] systemd[1]: Finished [email protected] - Load Kernel Module drm.
[ OK ] Finished [email protected] - Load Kernel Module drm.
[ 9.133725] systemd[1]: modprobe@efi_pstore.service: Deactivated successfully.
[ 9.140156] systemd[1]: Finished modprobe@efi_pstore.service - Load Kernel Module efi_pstore.
[ OK ] Finished modprobe@efi_pstore.service - Load Kernel Module efi_pstore.
[ 9.148791] systemd[1]: [email protected]: Deactivated successfully.
[ 9.152131] systemd[1]: Finished [email protected] - Load Kernel Module fuse.
[ OK ] Finished [email protected] - Load Kernel Module fuse.
[ 9.166533] systemd[1]: Finished systemd-modules-load.service - Load Kernel Modules.
[ OK ] Finished systemd-modules-load.service - Load Kernel Modules.
[ 9.178390] systemd[1]: Finished systemd-remount-fs.service - Remount Root and Kernel File Systems.
[ OK ] Finished systemd-remount-fs.servic…mount Root and Kernel File Systems.
[ 9.191527] systemd[1]: Finished systemd-udev-load-credentials.service - Load udev Rules from Credentials.
[ OK ] Finished systemd-udev-load-credent…- Load udev Rules from Credentials.
[ 9.208782] systemd[1]: Finished systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully.
[ OK ] Finished systemd-tmpfiles-setup-de…ic Device Nodes in /dev gracefully.
[ 9.216800] systemd[1]: sys-fs-fuse-connections.mount - FUSE Control File System was skipped because of an unmet condition check (ConditionPathExists=/sys/fs/fuse/connections).
[ 9.220438] systemd[1]: systemd-hwdb-update.service - Rebuild Hardware Database was skipped because of an unmet condition check (ConditionNeedsUpdate=/etc).
[ 9.223534] systemd[1]: systemd-pstore.service - Platform Persistent Storage Archival was skipped because of an unmet condition check (ConditionDirectoryNotEmpty=/sys/fs/pstore).
[ 9.262081] systemd[1]: Starting systemd-random-seed.service - Load/Save OS Random Seed...
Starting systemd-random-seed.service - Load/Save OS Random Seed...
[ 9.298381] systemd[1]: Starting systemd-sysctl.service - Apply Kernel Variables...
Starting systemd-sysctl.service - Apply Kernel Variables...
[ 9.303690] systemd[1]: systemd-sysusers.service - Create System Users was skipped because no trigger condition checks were met.
[ 9.345123] systemd[1]: Starting systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev...
Starting systemd-tmpfiles-setup-de…eate Static Device Nodes in /dev...
[ 9.351759] systemd[1]: systemd-tpm2-setup.service - TPM SRK Setup was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[ 9.358415] systemd[1]: Started systemd-journald.service - Journal Service.
[ OK ] Started systemd-journald.service - Journal Service.
[ OK ] Finished systemd-random-seed.service - Load/Save OS Random Seed.
[ OK ] Finished systemd-sysctl.service - Apply Kernel Variables.
Starting systemd-journal-flush.ser…sh Journal to Persistent Storage...
[ 9.628988] systemd-tmpfile (111) used greatest stack depth: 25224 bytes left
[ OK ] Finished systemd-tmpfiles-setup-de…Create Static Device Nodes in /dev.
[ OK ] Reached target local-fs-pre.target…Preparation for Local File Systems.
[ OK ] Reached target local-fs.target - Local File Systems.
[ OK ] Listening on systemd-sysext.socket… System Extension Image Management.
Starting systemd-udevd.service - R…ager for Device Events and Files...
[ 9.710111] systemd-journald[96]: Received client request to flush runtime journal.
[ 9.743800] systemd-journald[96]: File /var/log/journal/b5db384d8695460380fbd9e772939801/system.journal corrupted or uncleanly shut down, renaming and replacing.
[ OK ] Finished systemd-journal-flush.ser…lush Journal to Persistent Storage.
Starting systemd-tmpfiles-setup.se…ate System Files and Directories...
[ OK ] Started systemd-udevd.service - Ru…anager for Device Events and Files.
[ OK ] Finished systemd-tmpfiles-setup.se…reate System Files and Directories.
[ OK ] Found device dev-ttyS0.device - /dev/ttyS0.
[ OK ] Finished systemd-udev-trigger.service - Coldplug All udev Devices.
[ OK ] Reached target sysinit.target - System Initialization.
[ OK ] Started apt-daily.timer - Daily apt download activities.
[ OK ] Started apt-daily-upgrade.timer - …y apt upgrade and clean activities.
[ OK ] Started dpkg-db-backup.timer - Daily dpkg database backup timer.
[ 10.712642] systemd-sysctl (170) used greatest stack depth: 25136 bytes left
[ OK ] Started e2scrub_all.timer - Period…Metadata Check for All Filesystems.
[ OK ] Started fstrim.timer - Discard unused filesystem blocks once a week.
[ OK ] Started logrotate.timer - Daily rotation of log files.
[ OK ] Started systemd-tmpfiles-clean.tim…y Cleanup of Temporary Directories.
[ OK ] Reached target timers.target - Timer Units.
[ OK ] Listening on sshd-unix-local.socke…temd-ssh-generator, AF_UNIX Local).
[ OK ] Listening on systemd-hostnamed.socket - Hostname Service Socket.
[ OK ] Reached target sockets.target - Socket Units.
Starting ifupdown-pre.service - He…synchronize boot up for ifupdown...
[ OK ] Reached target basic.target - Basic System.
[ OK ] Started cron.service - Regular background program processing daemon.
Starting e2scrub_reap.service - Re…ne ext4 Metadata Check Snapshots...
Starting getty-static.service - ge…bus and logind are not available...
Starting dpkg-db-backup.service - …ily dpkg database backup service...
[ 11.287269] audit: type=1107 audit(1782326800.871:3): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/[email protected]" cmdline="" function="bus_unit_method_start_generic" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=service permissive=1 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
[ 11.314512] audit: type=1107 audit(1782326800.893:4): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg='avc: denied { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/[email protected]" cmdline="" function="reply_unit_path" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=service permissive=1 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
[ OK ] Finished ifupdown-pre.service - He…o synchronize boot up for ifupdown.
[ OK ] Listening on systemd-rfkill.socket…ll Switch Status /dev/rfkill Watch.
Starting networking.service - Raise network interfaces...
[ OK ] Finished getty-static.service - ge… dbus and logind are not available.
[ OK ] Finished e2scrub_reap.service - Re…line ext4 Metadata Check Snapshots.
[ 11.792266] 8021q: adding VLAN 0 to HW filter on device eth0
[ 11.792896] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
[ OK ] Finished dpkg-db-backup.service - Daily dpkg database backup service.
[* ] Job networking.service/start running (5s / 5min 3s)
M[** ] Job networking.service/start running (6s / 5min 3s)
M[*** ] Job networking.service/start running (7s / 5min 3s)
M[ *** ] Job networking.service/start running (7s / 5min 3s)M[ *** ] Job networking.service/start running (8s / 5min 3s)
M[ ***] Job networking.service/start running (8s / 5min 3s)
M[ **] Job networking.service/start running (9s / 5min 3s)
M[ *] Job networking.service/start running (10s / 5min 3s)
M Starting e2scrub_all.service - Onl…tadata Check for All Filesystems...
[ OK ] Finished e2scrub_all.service - Onl…Metadata Check for All Filesystems.
[ OK ] Finished networking.service - Raise network interfaces.
[ OK ] Reached target network.target - Network.
Starting ssh.service - OpenBSD Secure Shell server...
Starting systemd-user-sessions.service - Permit User Sessions...
[ OK ] Finished systemd-user-sessions.service - Permit User Sessions.
[ OK ] Started [email protected] - Getty on tty1.
[ OK ] Started [email protected] - Getty on tty2.
[ OK ] Started [email protected] - Getty on tty3.
[ OK ] Started [email protected] - Getty on tty4.
[ OK ] Started [email protected] - Getty on tty5.
[ OK ] Started [email protected] - Getty on tty6.
[ OK ] Started [email protected] - Serial Getty on ttyS0.
[ OK ] Reached target getty.target - Login Prompts.
[ OK ] Started ssh.service - OpenBSD Secure Shell server.
[ OK ] Reached target multi-user.target - Multi-User System.
[ OK ] Reached target graphical.target - Graphical Interface.[!p]104[!p]104
Debian GNU/Linux 13 syzkaller ttyS0
syzkaller login: root
root
Linux syzkaller 7.1.0-gf0e6f20cb52b #1 SMP PREEMPT_DYNAMIC Wed Jun 24 21:45:00 MSK 2026 x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
A valid context for root could not be obtained.
root@syzkaller:~# mount -t 9p -o trans=virtio,version=9p2000.L hostshare /mnt && echo MNT_OK mount -t 9p -o trans=virtio,version=9p2000.L hostshare /mnt && echo MNT_OK/mnt/repro_bugA & echo REPRO_RUNNING
MNT_OK
root@syzkaller:~# /mnt/repro_bugA & echo REPRO_RUNNING
[1] 374
REPRO_RUNNING
root@syzkaller:~# [ 21.292790] audit: type=1400 audit(1782326810.881:5): avc: denied { execmem } for pid=374 comm="repro_bugA" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[ 21.545957] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.546919] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.547940] bridge_slave_0: entered allmulticast mode
[ 21.549297] bridge_slave_0: entered promiscuous mode
[ 21.554046] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.554794] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.555471] bridge_slave_1: entered allmulticast mode
[ 21.556370] bridge_slave_1: entered promiscuous mode
[ 21.572361] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.573061] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.573874] bridge_slave_0: entered allmulticast mode
[ 21.574784] bridge_slave_0: entered promiscuous mode
[ 21.578532] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.579424] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.580227] bridge_slave_0: entered allmulticast mode
[ 21.581161] bridge_slave_0: entered promiscuous mode
[ 21.585049] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.585790] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.586539] bridge_slave_1: entered allmulticast mode
[ 21.587479] bridge_slave_1: entered promiscuous mode
[ 21.591030] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.591850] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.592606] bridge_slave_1: entered allmulticast mode
[ 21.593533] bridge_slave_1: entered promiscuous mode
[ 21.594370] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.595048] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.595759] bridge_slave_0: entered allmulticast mode
[ 21.596657] bridge_slave_0: entered promiscuous mode
[ 21.613295] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.613936] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.614605] bridge_slave_1: entered allmulticast mode
[ 21.616197] bridge_slave_1: entered promiscuous mode
[ 21.933913] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.934888] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 21.935911] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.936777] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 21.941843] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.942634] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 21.943529] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.944410] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 21.969865] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.970632] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 21.971531] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.972376] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 21.981138] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.981823] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 21.982548] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.983198] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 21.988743] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.989732] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.990521] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.991522] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.992302] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.993259] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.994134] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.995053] bridge0: port 2(bridge_slave_1) entered disabled state
[ 22.003498] bridge0: port 1(bridge_slave_0) entered blocking state
[ 22.004335] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 22.009290] bridge0: port 2(bridge_slave_1) entered blocking state
[ 22.010044] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 22.018272] bridge0: port 1(bridge_slave_0) entered blocking state
[ 22.019029] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 22.020211] bridge0: port 2(bridge_slave_1) entered blocking state
[ 22.021027] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 22.047915] bridge0: port 1(bridge_slave_0) entered blocking state
[ 22.048589] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 22.051571] bridge0: port 2(bridge_slave_1) entered blocking state
[ 22.052232] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 22.058072] bridge0: port 1(bridge_slave_0) entered blocking state
[ 22.058890] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 22.064430] bridge0: port 2(bridge_slave_1) entered blocking state
[ 22.065141] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 22.108107] veth0_vlan: entered promiscuous mode
[ 22.122278] veth0_vlan: entered promiscuous mode
[ 22.150859] veth0_vlan: entered promiscuous mode
[ 22.155618] veth0_vlan: entered promiscuous mode
executing program
[ 22.238473] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000016: 0000 [#1] SMP KASAN NOPTI
[ 22.239839] KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7]
[ 22.240790] CPU: 0 UID: 0 PID: 482 Comm: repro_bugA Not tainted 7.1.0-gf0e6f20cb52b #1 PREEMPT(full)
[ 22.241797] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[ 22.242933] RIP: 0010:nft_fib6_eval+0x433/0x1060
[ 22.243577] Code: d3 20 27 fd 0f b6 44 24 30 3c 05 74 4c e8 15 2c 27 fd 49 8d bf b0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ad 08 00 00 41 8b 87 b0 00 00
[ 22.245385] RSP: 0018:ffff8880099ae470 EFLAGS: 00010212
[ 22.245920] RAX: dffffc0000000000 RBX: ffff8880099ae930 RCX: ffffffff8dc9cebb
[ 22.246626] RDX: 0000000000000016 RSI: 0000000000000005 RDI: 00000000000000b0
[ 22.247335] RBP: ffff88800e0c5780 R08: ffff8880099ae8d0 R09: 000000000000003c
[ 22.248036] R10: 0000000000000000 R11: 000000000003b819 R12: ffff88800e79f458
[ 22.248748] R13: ffff8880099aeb68 R14: ffff88800e79f460 R15: 0000000000000000
[ 22.249455] FS: 00007fb3a83926c0(0000) GS:ffff8880dc124000(0000) knlGS:0000000000000000
[ 22.250252] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 22.250855] CR2: 0000200000003100 CR3: 0000000003a3f000 CR4: 0000000000750ef0
[ 22.251578] PKRU: 55555554
[ 22.251866] Call Trace:
[ 22.252124] <TASK>
[ 22.252373] ? __pfx_nft_fib6_eval+0x10/0x10
[ 22.252829] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.253360] ? nft_inner_eval+0x40a/0xa90
[ 22.253809] nft_fib_netdev_eval+0x146/0x280
[ 22.254285] ? __pfx_nft_fib_netdev_eval+0x10/0x10
[ 22.254887] nft_do_chain+0x28b/0x1740
[ 22.255411] ? __pfx_nft_do_chain+0x10/0x10
[ 22.255968] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.256592] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 22.257198] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.257709] ? ipv6_find_hdr+0x45f/0xc60
[ 22.258127] ? __pfx_ipv6_find_hdr+0x10/0x10
[ 22.258585] ? unwind_next_frame+0x362/0x2560
[ 22.259051] ? arch_stack_walk+0x62/0xf0
[ 22.259489] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.259991] ? __is_insn_slot_addr+0xbd/0x100
[ 22.260470] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.260968] ? kernel_text_address+0x5b/0xc0
[ 22.261442] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.261944] ? __kernel_text_address+0xd/0x40
[ 22.262410] nft_do_chain_netdev+0x76a/0xf40
[ 22.262918] ? __pfx_nft_do_chain_netdev+0x10/0x10
[ 22.263468] ? _raw_spin_lock_irqsave+0x85/0xe0
[ 22.264037] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.264623] ? stack_trace_save+0x8e/0xc0
[ 22.265063] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.265579] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.266085] ? kasan_save_stack+0x34/0x50
[ 22.266540] ? kasan_save_stack+0x24/0x50
[ 22.267094] ? kasan_save_track+0x14/0x30
[ 22.267617] ? __kasan_kmalloc+0x7f/0x90
[ 22.268101] ? __kmalloc_noprof+0x1d5/0x510
[ 22.268634] ? ___neigh_create+0x130/0x2450
[ 22.269195] ? ip6_finish_output2+0x9f0/0x17c0
[ 22.270006] nf_hook_slow+0xcc/0x220
[ 22.270511] ? ip6_input+0xcd/0x200
[ 22.270987] __dev_queue_xmit+0x1f12/0x3440
[ 22.271573] ? arch_stack_walk+0x62/0xf0
[ 22.272182] ? __pfx___rmqueue_pcplist+0x10/0x10
[ 22.273090] ? __pfx__raw_spin_trylock+0x10/0x10
[ 22.273724] ? __pfx___dev_queue_xmit+0x10/0x10
[ 22.274314] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.274869] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.275392] ? kasan_unpoison+0x27/0x60
[ 22.275824] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.276334] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.276835] ? get_page_from_freelist+0x1129/0x3b10
[ 22.277360] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 22.277879] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.278381] ? kasan_save_track+0x14/0x30
[ 22.278805] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.279300] ? _raw_spin_lock_bh+0x83/0xe0
[ 22.279735] ? __pfx__raw_spin_lock_bh+0x10/0x10
[ 22.280212] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.280726] ? _raw_write_lock_bh+0x83/0xe0
[ 22.281170] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.281686] ? skb_push+0x9b/0xf0
[ 22.282115] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.282697] ? eth_header+0x16f/0x200
[ 22.283134] neigh_resolve_output+0x44c/0x780
[ 22.283620] ip6_finish_output2+0x981/0x17c0
[ 22.284086] ? __pfx_ip6_finish_output2+0x10/0x10
[ 22.284592] ? __pfx_fib6_table_lookup+0x10/0x10
[ 22.285174] ? tcp_v6_rcv+0x124c/0x3760
[ 22.285659] ? ip6_protocol_deliver_rcu+0x250/0x10a0
[ 22.286237] ? ip6_input_finish+0x1b8/0x3c0
[ 22.286699] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 22.287261] __ip6_finish_output+0x446/0x7b0
[ 22.287740] ip6_output+0x23b/0x480
[ 22.288119] ? __pfx_ip6_output+0x10/0x10
[ 22.288551] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.289053] ? __pfx_ip6_finish_output+0x10/0x10
[ 22.289561] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.290062] ? nf_hook_slow+0x13e/0x220
[ 22.290494] ? __pfx_ip6_output+0x10/0x10
[ 22.291044] ip6_xmit+0xc9e/0x1a50
[ 22.291561] ? __pfx_ip6_xmit+0x10/0x10
[ 22.292113] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.292754] ? inet6_sk_rebuild_header+0x493/0xa60
[ 22.293265] ? __pfx_dst_output+0x10/0x10
[ 22.293707] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.294203] ? xfrm_lookup_route+0x69/0x1b0
[ 22.294668] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.295171] tcp_v6_send_response+0xe5d/0x1cb0
[ 22.295644] ? __pfx_tcp_v6_send_response+0x10/0x10
[ 22.296154] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.296687] ? kasan_save_stack+0x34/0x50
[ 22.297113] ? __netif_receive_skb+0x1d/0x160
[ 22.297585] ? netif_receive_skb+0x8f/0x480
[ 22.298032] ? tun_get_user+0x2b96/0x3b00
[ 22.298529] ? tun_chr_write_iter+0x172/0x2b0
[ 22.299159] ? vfs_write+0xa5c/0xd30
[ 22.299591] ? ksys_write+0x124/0x240
[ 22.300007] ? do_syscall_64+0x10c/0x5b0
[ 22.300462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 22.301078] tcp_v6_send_reset+0x508/0xda0
[ 22.301628] ? __pfx_tcp_v6_send_reset+0x10/0x10
[ 22.302380] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.303041] ? inet6_lookup_listener+0x17c/0x350
[ 22.303578] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.304110] ? __xfrm_policy_check2.constprop.0+0x353/0x5d0
[ 22.304786] tcp_v6_rcv+0x124c/0x3760
[ 22.305242] ? __pfx_tcp_v6_rcv+0x10/0x10
[ 22.305700] ? kasan_save_stack+0x34/0x50
[ 22.306122] ? kasan_save_stack+0x24/0x50
[ 22.306551] ? kasan_save_track+0x14/0x30
[ 22.306982] ? __build_skb+0x40/0xa0
[ 22.307383] ? build_skb+0x1e/0x210
[ 22.307764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.308279] ? raw6_local_deliver+0x314/0x720
[ 22.308803] ? ksys_write+0x124/0x240
[ 22.309289] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.309964] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 22.310531] ? __pfx_tcp_v6_rcv+0x10/0x10
[ 22.310986] ip6_protocol_deliver_rcu+0x315/0x10a0
[ 22.311615] ip6_input_finish+0x1b8/0x3c0
[ 22.312170] ip6_input+0xcd/0x200
[ 22.312553] ? __pfx_ip6_input+0x10/0x10
[ 22.312980] ? sock_wfree+0x11c/0x5a0
[ 22.313395] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.313895] ? ip6_rcv_finish_core.constprop.0+0xd9/0xc70
[ 22.314463] ? __pfx_ip6_input+0x10/0x10
[ 22.314889] ipv6_rcv+0x244/0x2c0
[ 22.315256] ? __pfx_ipv6_rcv+0x10/0x10
[ 22.315680] ? __build_skb+0x83/0xa0
[ 22.316069] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.316584] ? tun_build_skb+0x9df/0x1140
[ 22.317010] ? __pfx_ipv6_rcv+0x10/0x10
[ 22.317431] __netif_receive_skb_one_core+0x12d/0x1e0
[ 22.318050] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 22.318774] ? __pfx_tun_build_skb+0x10/0x10
[ 22.319288] ? __pfx_get_page_from_freelist+0x10/0x10
[ 22.319816] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.320318] ? __virtio_net_hdr_to_skb+0x72d/0x13c0
[ 22.320917] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.321566] __netif_receive_skb+0x1d/0x160
[ 22.322122] netif_receive_skb+0x8f/0x480
[ 22.322561] ? __pfx_netif_receive_skb+0x10/0x10
[ 22.323042] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.323569] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.324074] tun_get_user+0x2b96/0x3b00
[ 22.324533] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 22.325143] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.325663] ? __pfx_tun_get_user+0x10/0x10
[ 22.326107] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 22.326658] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.327164] ? __folio_batch_add_and_move+0x188/0x220
[ 22.327737] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.328247] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.328816] ? folio_add_lru_vma+0x18b/0x200
[ 22.329282] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.329821] ? folio_add_new_anon_rmap+0x281/0x620
[ 22.330407] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.330915] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.331420] ? selinux_file_permission+0x11c/0x600
[ 22.331960] ? tun_chr_write_iter+0x172/0x2b0
[ 22.332458] tun_chr_write_iter+0x172/0x2b0
[ 22.332951] vfs_write+0xa5c/0xd30
[ 22.333365] ? __pfx_tun_chr_write_iter+0x10/0x10
[ 22.333864] ? __pfx_vfs_write+0x10/0x10
[ 22.334289] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.334812] ? fdget_pos+0x1ff/0x580
[ 22.335224] ksys_write+0x124/0x240
[ 22.335649] ? __pfx_ksys_write+0x10/0x10
[ 22.336099] ? fpregs_assert_state_consistent+0x10a/0x150
[ 22.336689] ? srso_alias_return_thunk+0x5/0xfbef5
[ 22.337184] ? irqentry_exit+0x43/0x790
[ 22.337606] do_syscall_64+0x10c/0x5b0
[ 22.338020] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 22.338542] RIP: 0033:0x7fb3a84309ee
[ 22.338942] Code: 08 0f 85 f5 4b ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 22.340825] RSP: 002b:00007fb3a8391df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 22.341676] RAX: ffffffffffffffda RBX: 00007fb3a83926c0 RCX: 00007fb3a84309ee
[ 22.342412] RDX: 000000000000004a RSI: 0000200000003100 RDI: 00000000000000c8
[ 22.343123] RBP: 0000560e4cd7a82c R08: 0000000000000000 R09: 0000000000000000
[ 22.343874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000560e4cd9002c
[ 22.344611] R13: 0000560e4cd90028 R14: 0000200000003136 R15: 0000200000003126
[ 22.345339] </TASK>
[ 22.345577] Modules linked in:
[ 22.345962] ---[ end trace 0000000000000000 ]---
[ 22.346469] RIP: 0010:nft_fib6_eval+0x433/0x1060
[ 22.346965] Code: d3 20 27 fd 0f b6 44 24 30 3c 05 74 4c e8 15 2c 27 fd 49 8d bf b0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ad 08 00 00 41 8b 87 b0 00 00
[ 22.348809] RSP: 0018:ffff8880099ae470 EFLAGS: 00010212
[ 22.349367] RAX: dffffc0000000000 RBX: ffff8880099ae930 RCX: ffffffff8dc9cebb
[ 22.350083] RDX: 0000000000000016 RSI: 0000000000000005 RDI: 00000000000000b0
[ 22.350813] RBP: ffff88800e0c5780 R08: ffff8880099ae8d0 R09: 000000000000003c
[ 22.351558] R10: 0000000000000000 R11: 000000000003b819 R12: ffff88800e79f458
[ 22.352292] R13: ffff8880099aeb68 R14: ffff88800e79f460 R15: 0000000000000000
[ 22.353026] FS: 00007fb3a83926c0(0000) GS:ffff8880dc124000(0000) knlGS:0000000000000000
[ 22.353911] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 22.354542] CR2: 0000200000003100 CR3: 0000000003a3f000 CR4: 0000000000750ef0
executing progra[ 22.355265] PKRU: 55555554
m[ 2
2.355732] Kernel panic - not syncing: Fatal exception in interrupt
[ 22.356579] Kernel Offset: 0x9800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 22.357881] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---Florian Westphal
maintainerQuoted 4 lines · Theodor Arsenij Larionov-Trichkine
A
fib' expression in a netdevegress' base chain dereferences the input devicenft_in(pkt), which is NULL on the transmit path, so any IPv6 packet leaving the chain's device hits a GPF / KASAN NULL-ptr-deref. An unprivileged user can set this up in a user+net namespace.
Please just send a patch to disable fib on egress.
Pablo Neira Ayuso
maintainerQuoted 7 lines · Florian Westphal
Quoted 4 lines · Theodor Arsenij Larionov-Trichkine
A
fib' expression in a netdevegress' base chain dereferences the input devicenft_in(pkt), which is NULL on the transmit path, so any IPv6 packet leaving the chain's device hits a GPF / KASAN NULL-ptr-deref. An unprivileged user can set this up in a user+net namespace.Please just send a patch to disable fib on egress.
I'd suggest nft_fib_netdev needs a nft_fib_netdev_validate().
And nft_fib_validate() need to be restricted to NFPROTO_IPV4, _IPV6 and _INET from ctx->family PoV.
Florian Westphal
maintainerQuoted 7 lines · Pablo Neira Ayuso
Quoted 6 lines · Florian Westphal
Quoted 4 lines · Theodor Arsenij Larionov-Trichkine
A
fib' expression in a netdevegress' base chain dereferences the input devicenft_in(pkt), which is NULL on the transmit path, so any IPv6 packet leaving the chain's device hits a GPF / KASAN NULL-ptr-deref. An unprivileged user can set this up in a user+net namespace.
Quoted 6 lines
Quoted 1 line
Please just send a patch to disable fib on egress.
I'd suggest
nft_fib_netdevneeds anft_fib_netdev_validate().And
nft_fib_validate()need to be restricted toNFPROTO_IPV4,_IPV6and_INETfromctx->familyPoV.
Makes sense. Theodor, would you make a patch?
PATCH 1/1 netfilter: nft_fib: reject fib expression on the netdev egress hook
A fib expression in a netdev egress base chain dereferences the input device nft_in(pkt), which is NULL on the transmit path, causing a NULL-ptr-deref at eval. nft_fib_validate() gates the chain hook with NF_INET_* masks, but a netdev chain's hook numbers come from a separate enum that aliases them (NF_NETDEV_EGRESS == NF_INET_LOCAL_IN == 1), so a netdev egress chain passes validation and then faults. Add a dedicated nft_fib_netdev_validate() restricting the netdev fib expression to NF_NETDEV_INGRESS, the only netdev hook with an input device, and restrict nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* hook masks are never applied to another family's hook numbering.
Fixes 42df6e1d221d ("netfilter: Introduce egress hook")
Signed-off-by Theodor Arsenij Larionov-Trichkine <[email protected]>
--- net/netfilter/nft_fib.c | 9 +++++++++ net/netfilter/nft_fib_netdev.c | 8 +++++++- 2 files changed, 16 insertions(+), 1 deletion(-)
net/netfilter/nft_fib.c +9 -0
@@ -31,6 +31,15 @@ int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)const struct nft_fib *priv =nft_expr_priv (expr);unsigned int hooks; +switch (ctx->family) { +case NFPROTO_IPV4 : +case NFPROTO_IPV6 : +case NFPROTO_INET : +break ; +default : +return -EOPNOTSUPP ; + } +switch (priv->result) {case NFT_FIB_RESULT_OIF :case NFT_FIB_RESULT_OIFNAME :
net/netfilter/nft_fib_netdev.c +7 -1
@@ -50,6 +50,12 @@ static void nft_fib_netdev_eval(const struct nft_expr *expr, regs->verdict.code =NFT_BREAK ; } +static int nft_fib_netdev_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +return nft_chain_validate_hooks (ctx->chain,1 <<NF_NETDEV_INGRESS ); +} +static struct nft_expr_type nft_fib_netdev_type;static const struct nft_expr_ops nft_fib_netdev_ops = { .type = &nft_fib_netdev_type,
@@ -57,7 +63,7 @@ static const struct nft_expr_ops nft_fib_netdev_ops = { .eval = nft_fib_netdev_eval, .init = nft_fib_init, .dump = nft_fib_dump, - .validate = nft_fib_validate, + .validate = nft_fib_netdev_validate, };static struct nft_expr_type nft_fib_netdev_type__read_mostly = {
Signature · 1 line
2.34.1
Pablo Neira Ayuso
maintainerRe: [PATCH nf] netfilter: nft_fib: reject fib expression on the netdev egress hook
Hi,
Comments below.
Quoted 44 lines · Theodor Arsenij Larionov-Trichkine
A fib expression in a netdev egress base chain dereferences the input device
nft_in(pkt), which is NULL on the transmit path, causing a NULL-ptr-deref at eval.nft_fib_validate()gates the chain hook with NF_INET_* masks, but a netdev chain's hook numbers come from a separate enum that aliases them (NF_NETDEV_EGRESS==NF_INET_LOCAL_IN== 1), so a netdev egress chain passes validation and then faults. Add a dedicatednft_fib_netdev_validate()restricting the netdev fib expression toNF_NETDEV_INGRESS, the only netdev hook with an input device, and restrictnft_fib_validate()to NFPROTO_IPV4/IPV6/INET so its NF_INET_* hook masks are never applied to another family's hook numbering.Fixes 42df6e1d221d ("netfilter: Introduce egress hook")Signed-off-by Theodor Arsenij Larionov-Trichkine <[email protected]>--- net/netfilter/nft_fib.c | 9 +++++++++ net/netfilter/nft_fib_netdev.c | 8 +++++++- 2 files changed, 16 insertions(+), 1 deletion(-)net/netfilter/nft_fib.c +9
-0@@ -31,6 +31,15 @@ int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)const struct nft_fib *priv =nft_expr_priv (expr);unsigned int hooks; +switch (ctx->family) { +case NFPROTO_IPV4 : +case NFPROTO_IPV6 : +case NFPROTO_INET : +break ; +default : +return -EOPNOTSUPP ; + } +switch (priv->result) {case NFT_FIB_RESULT_OIF :case NFT_FIB_RESULT_OIFNAME :net/netfilter/nft_fib_netdev.c +0
-0
net/netfilter/nft_fib_netdev.c static void nft_fib_netdev_eval(const struct nft_expr *expr, · line 55
Quoted 6 lines
net/netfilter/nft_fib_netdev.c +3
-0@@ -50,6 +50,12 @@ static void nft_fib_netdev_eval(const struct nft_expr *expr, regs->verdict.code =NFT_BREAK ; } +static int nft_fib_netdev_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{
Maybe this is missing:
switch (priv->result) {
case NFT_FIB_RESULT_OIF:
case NFT_FIB_RESULT_OIFNAME:
hooks = (1 << NF_NETDEV_INGRESS);
break;
case NFT_FIB_RESULT_ADDRTYPE:
if (priv->flags & NFTA_FIB_F_IIF)
hooks = (1 << NF_NETDEV_INGRESS);
else if (priv->flags & NFTA_FIB_F_OIF)
hooks = (1 << NF_NETDEV_EGRESS);
else
hooks = (1 << NF_NETDEV_INGRESS) |
(1 << NF_NETDEV_EGRESS);
break;
default:
return -EINVAL;
}Quoted 18 lines
net/netfilter/nft_fib_netdev.c +4
-1+return nft_chain_validate_hooks (ctx->chain,1 <<NF_NETDEV_INGRESS ); +} +static struct nft_expr_type nft_fib_netdev_type;static const struct nft_expr_ops nft_fib_netdev_ops = { .type = &nft_fib_netdev_type,@@ -57,7 +63,7 @@ static const struct nft_expr_ops nft_fib_netdev_ops = { .eval = nft_fib_netdev_eval, .init = nft_fib_init, .dump = nft_fib_dump, - .validate = nft_fib_validate, + .validate = nft_fib_netdev_validate, };static struct nft_expr_type nft_fib_netdev_type__read_mostly = {Signature · 1 line
2.34.1
PATCH v2 1/1 netfilter: nft_fib: reject fib expression on the netdev egress hook
A fib expression in a netdev egress base chain dereferences nft_in(pkt), NULL on the transmit path, causing a NULL pointer dereference at eval. nft_fib_validate() masks the hook with NF_INET_* values, but netdev hook numbers are a separate enum that aliases them (NF_NETDEV_EGRESS == NF_INET_LOCAL_IN), so an egress chain passes validation and then faults.
Add nft_fib_netdev_validate() that limits each result/flag to the netdev hook where the device it reads exists: the input-device cases (OIF, OIFNAME, ADDRTYPE with F_IIF) to ingress, the output-device case (ADDRTYPE with F_OIF) to egress, ADDRTYPE with no device flag to both. Also restrict nft_fib_validate() to NFPROTO_IPV4/IPV6/INET so its NF_INET_* masks are not applied to another family's hooks.
Fixes 42df6e1d221d ("netfilter: Introduce egress hook")
Signed-off-by Theodor Arsenij Larionov-Trichkine <[email protected]>
--- net/netfilter/nft_fib.c | 9 +++++++++ net/netfilter/nft_fib_netdev.c | 29 ++++++++++++++++++++++++++++- 2 files changed, 37 insertions(+), 1 deletion(-)
net/netfilter/nft_fib.c +9 -0
@@ -31,6 +31,15 @@ int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)const struct nft_fib *priv =nft_expr_priv (expr);unsigned int hooks; +switch (ctx->family) { +case NFPROTO_IPV4 : +case NFPROTO_IPV6 : +case NFPROTO_INET : +break ; +default : +return -EOPNOTSUPP ; + } +switch (priv->result) {case NFT_FIB_RESULT_OIF :case NFT_FIB_RESULT_OIFNAME :
net/netfilter/nft_fib_netdev.c +28 -1
@@ -50,6 +50,33 @@ static void nft_fib_netdev_eval(const struct nft_expr *expr, regs->verdict.code =NFT_BREAK ; } +static int nft_fib_netdev_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr) +{ +const struct nft_fib *priv =nft_expr_priv (expr); +unsigned int hooks; + +switch (priv->result) { +case NFT_FIB_RESULT_OIF : +case NFT_FIB_RESULT_OIFNAME : + hooks = (1 <<NF_NETDEV_INGRESS ); +break ; +case NFT_FIB_RESULT_ADDRTYPE : +if (priv->flags &NFTA_FIB_F_IIF ) + hooks = (1 <<NF_NETDEV_INGRESS ); +else if (priv->flags &NFTA_FIB_F_OIF ) + hooks = (1 <<NF_NETDEV_EGRESS ); +else + hooks = (1 <<NF_NETDEV_INGRESS ) | + (1 <<NF_NETDEV_EGRESS ); +break ; +default : +return -EINVAL ; + } + +return nft_chain_validate_hooks (ctx->chain, hooks); +} +static struct nft_expr_type nft_fib_netdev_type;static const struct nft_expr_ops nft_fib_netdev_ops = { .type = &nft_fib_netdev_type,
@@ -57,7 +84,7 @@ static const struct nft_expr_ops nft_fib_netdev_ops = { .eval = nft_fib_netdev_eval, .init = nft_fib_init, .dump = nft_fib_dump, - .validate = nft_fib_validate, + .validate = nft_fib_netdev_validate, };static struct nft_expr_type nft_fib_netdev_type__read_mostly = {
Signature · 1 line
2.34.1