#define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include // derived from https://github.com/oracle/kernel-fuzzing/blob/master/include/mount.hh static void activity(char *mpoint) { char *foo_bar_baz; char *foo_baz; char *xattr; char *hln; char *sln; int err; static int buf[8192]; memset(buf, 0, sizeof(buf)); err = asprintf(&foo_bar_baz, "%s/foo/bar/baz", mpoint); err = asprintf(&foo_baz, "%s/foo/baz", mpoint); err = asprintf(&xattr, "%s/foo/bar/xattr", mpoint); err = asprintf(&hln, "%s/foo/bar/hln", mpoint); err = asprintf(&sln, "%s/foo/bar/sln", mpoint); // opendir / readdir DIR *dir = (DIR *)opendir(mpoint); if (dir) { readdir(dir); closedir(dir); } // open / mmap / read // mmap MAP_SHARED? int fd = open(foo_bar_baz, O_RDONLY, 0); if (fd >= 0) { void *mem = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE | MAP_POPULATE, fd, 0); if (mem != MAP_FAILED) munmap(mem, 4096); read(fd, (char *)buf, 11); read(fd, (char *)buf, 11); close(fd); } // open / write / read fd = open(foo_bar_baz, O_RDWR | O_TRUNC, 0777); if (fd >= 0) { write(fd, (char *)buf, 517); write(fd, (char *)buf, sizeof(buf)); fdatasync(fd); fsync(fd); lseek(fd, 0, SEEK_SET); read(fd, (char *)buf, sizeof(buf)); lseek(fd, 1234, SEEK_SET); read(fd, (char *)buf, 517); close(fd); } // open / lseek / write / fallocate fd = open(foo_bar_baz, O_RDWR | O_TRUNC, 0777); if (fd >= 0) { lseek(fd, 1024 - 33, SEEK_SET); write(fd, (char *)buf, sizeof(buf)); lseek(fd, 1024 * 1024 + 67, SEEK_SET); write(fd, (char *)buf, sizeof(buf)); lseek(fd, 1024 * 1024 * 1024 - 113, SEEK_SET); write(fd, (char *)buf, sizeof(buf)); lseek(fd, 0, SEEK_SET); write(fd, (char *)buf, sizeof(buf)); fallocate(fd, 0, 0, 123871237); fallocate(fd, 0, -13123, 123); fallocate(fd, 0, 234234, -45897); fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, 0, 4243261); fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, -95713, 38447); fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, 18237, -9173); close(fd); } // rename rename(foo_bar_baz, foo_baz); // stat struct stat st; memset(&st, 0, sizeof(st)); stat(foo_baz, &st); // chmod / chown chmod(foo_baz, 0000); chmod(foo_baz, 1777); chmod(foo_baz, 3777); chmod(foo_baz, 7777); chown(foo_baz, 0, 0); chown(foo_baz, 1, 1); // unlink unlink(foo_bar_baz); unlink(foo_baz); // mknod mknod(foo_baz, 0777, makedev(0, 0)); // xattr char buf2[113]; memset(buf2, 0, sizeof(buf2)); listxattr(xattr, buf2, sizeof(buf2)); removexattr(xattr, "user.mime_type"); setxattr(xattr, "user.md5", buf2, sizeof(buf2), XATTR_CREATE); setxattr(xattr, "user.md5", buf2, sizeof(buf2), XATTR_REPLACE); // link readlink(sln, buf2, sizeof(buf2)); } int main(int argc, char *argv[]) { activity(argv[1]); return 0; }