// https://syzkaller.appspot.com/bug?id=9c557bdc7328e1ab4f0325699da821c22e47ab93 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[10]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfd3000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul); r[2] = syscall(__NR_pipe, 0x209e8000ul); if (r[2] != -1) r[3] = *(uint32_t*)0x209e8000; if (r[2] != -1) r[4] = *(uint32_t*)0x209e8004; *(uint64_t*)0x2011bf70 = (uint64_t)0x20fc7fff; *(uint64_t*)0x2011bf78 = (uint64_t)0x1; memcpy((void*)0x20fc7fff, "\x75", 1); r[8] = syscall(__NR_vmsplice, r[4], 0x2011bf70ul, 0x1ul, 0x0ul); r[9] = syscall(__NR_splice, r[3], 0x0ul, r[1], 0x0ul, 0x800000004ul, 0x6ul); } int main() { loop(); return 0; }