[Bug 238035] Divide by zero in kern_fcntl_freebsd

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238035

--- Comment #2 from Andrew Turner <Andrew at FreeBSD.org> ---
The reproducer Syzkaller found is below.

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <pwd.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <unistd.h>

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
  syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x1012, -1, 0);
  intptr_t res = 0;
  memcpy((void*)0x20000040, "/dev///\000", 8);
  res = syscall(SYS_openat, 0xffffffffffffff9c, 0x20000040, 0, 0);
  if (res != -1)
    r[0] = res;
  res = syscall(SYS_dup2, r[0], r[0]);
  if (res != -1)
    r[1] = res;
  syscall(SYS_fcntl, r[1], 0xf, 0);
  return 0;
}

-- 
You are receiving this mail because:
You are the assignee for the bug.