// https://syzkaller.appspot.com/bug?id=eea59e5cd607c0e9925a5351edd929b089c50d2b // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[28]; void test() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0xaul, 0x2ul, 0x0ul); r[2] = syscall(__NR_dup, r[1]); *(uint16_t*)0x20730fe4 = (uint16_t)0xa; *(uint16_t*)0x20730fe6 = (uint16_t)0x204e; *(uint32_t*)0x20730fe8 = (uint32_t)0x0; *(uint64_t*)0x20730fec = (uint64_t)0x0; *(uint64_t*)0x20730ff4 = (uint64_t)0x100000000000000; *(uint32_t*)0x20730ffc = (uint32_t)0x0; r[9] = syscall(__NR_bind, r[2], 0x20730fe4ul, 0x1cul); *(uint32_t*)0x20e4dffc = (uint32_t)0x6; r[11] = syscall(__NR_setsockopt, r[2], 0x1ul, 0x2aul, 0x20e4dffcul, 0x4ul); memcpy((void*)0x20431ff8, "\x7b\x5b\x22\x37\x17\xdb\xbc\x9a", 8); *(uint16_t*)0x202ecfe4 = (uint16_t)0xa; *(uint16_t*)0x202ecfe6 = (uint16_t)0x204e; *(uint32_t*)0x202ecfe8 = (uint32_t)0xcd2c; *(uint64_t*)0x202ecfec = (uint64_t)0x0; *(uint64_t*)0x202ecff4 = (uint64_t)0x100000000000000; *(uint32_t*)0x202ecffc = (uint32_t)0x1; r[19] = syscall(__NR_sendto, r[1], 0x20431ff8ul, 0x8ul, 0x40ul, 0x202ecfe4ul, 0x1cul); *(uint16_t*)0x2034eff6 = (uint16_t)0x0; *(uint8_t*)0x2034eff8 = (uint8_t)0x0; *(uint32_t*)0x2034effa = (uint32_t)0x4e20; r[23] = syscall(__NR_recvfrom, r[2], 0x207df000ul, 0x0ul, 0x20000043ul, 0x2034eff6ul, 0x8ul); r[24] = syscall(__NR_socket, 0x2ul, 0x80aul, 0x0ul); memcpy((void*)0x208a3fe0, "\x6c\x6f\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 16); *(uint16_t*)0x208a3ff0 = (uint16_t)0xfffffffffffffffd; r[27] = syscall(__NR_ioctl, r[24], 0x8914ul, 0x208a3fe0ul); } int main() { loop(); return 0; }