// https://syzkaller.appspot.com/bug?id=912f70e859dfffd2533b7cfcd2c71e0dd6f71e9d // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include long r[2]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 2, 1, 0); *(uint32_t*)0x201edffc = 0x23; syscall(__NR_getsockopt, r[0], 0, 0x30, 0x209a2000, 0x201edffc); r[1] = syscall(__NR_socket, 2, 0x803, 2); memcpy((void*)0x2000f000, "\x6e\x61\x74\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint32_t*)0x2000f020 = 0x1b; *(uint32_t*)0x2000f024 = 4; *(uint32_t*)0x2000f028 = 0x2a0; *(uint32_t*)0x2000f02c = 0; *(uint32_t*)0x2000f030 = 0; *(uint32_t*)0x2000f034 = -1; *(uint32_t*)0x2000f038 = 0; *(uint32_t*)0x2000f03c = 0; *(uint32_t*)0x2000f040 = 0; *(uint32_t*)0x2000f044 = 0; *(uint32_t*)0x2000f048 = -1; *(uint32_t*)0x2000f04c = 0; *(uint32_t*)0x2000f050 = 0; *(uint32_t*)0x2000f054 = 4; *(uint64_t*)0x2000f058 = 0x20003000; *(uint8_t*)0x2000f060 = 0; *(uint8_t*)0x2000f061 = 0; *(uint8_t*)0x2000f062 = 0; *(uint8_t*)0x2000f063 = 0; *(uint8_t*)0x2000f064 = 0; *(uint8_t*)0x2000f065 = 0; *(uint8_t*)0x2000f066 = 0; *(uint8_t*)0x2000f067 = 0; *(uint8_t*)0x2000f068 = 0; *(uint8_t*)0x2000f069 = 0; *(uint8_t*)0x2000f06a = 0; *(uint8_t*)0x2000f06b = 0; *(uint8_t*)0x2000f06c = 0; *(uint8_t*)0x2000f06d = 0; *(uint8_t*)0x2000f06e = 0; *(uint8_t*)0x2000f06f = 0; *(uint8_t*)0x2000f070 = 0; *(uint8_t*)0x2000f071 = 0; *(uint8_t*)0x2000f072 = 0; *(uint8_t*)0x2000f073 = 0; *(uint8_t*)0x2000f074 = 0; *(uint8_t*)0x2000f075 = 0; *(uint8_t*)0x2000f076 = 0; *(uint8_t*)0x2000f077 = 0; *(uint8_t*)0x2000f078 = 0; *(uint8_t*)0x2000f079 = 0; *(uint8_t*)0x2000f07a = 0; *(uint8_t*)0x2000f07b = 0; *(uint8_t*)0x2000f07c = 0; *(uint8_t*)0x2000f07d = 0; *(uint8_t*)0x2000f07e = 0; *(uint8_t*)0x2000f07f = 0; *(uint8_t*)0x2000f080 = 0; *(uint8_t*)0x2000f081 = 0; *(uint8_t*)0x2000f082 = 0; *(uint8_t*)0x2000f083 = 0; *(uint8_t*)0x2000f084 = 0; *(uint8_t*)0x2000f085 = 0; *(uint8_t*)0x2000f086 = 0; *(uint8_t*)0x2000f087 = 0; *(uint8_t*)0x2000f088 = 0; *(uint8_t*)0x2000f089 = 0; *(uint8_t*)0x2000f08a = 0; *(uint8_t*)0x2000f08b = 0; *(uint8_t*)0x2000f08c = 0; *(uint8_t*)0x2000f08d = 0; *(uint8_t*)0x2000f08e = 0; *(uint8_t*)0x2000f08f = 0; *(uint8_t*)0x2000f090 = 0; *(uint8_t*)0x2000f091 = 0; *(uint8_t*)0x2000f092 = 0; *(uint8_t*)0x2000f093 = 0; *(uint8_t*)0x2000f094 = 0; *(uint8_t*)0x2000f095 = 0; *(uint8_t*)0x2000f096 = 0; *(uint8_t*)0x2000f097 = 0; *(uint8_t*)0x2000f098 = 0; *(uint8_t*)0x2000f099 = 0; *(uint8_t*)0x2000f09a = 0; *(uint8_t*)0x2000f09b = 0; *(uint8_t*)0x2000f09c = 0; *(uint8_t*)0x2000f09d = 0; *(uint8_t*)0x2000f09e = 0; *(uint8_t*)0x2000f09f = 0; *(uint8_t*)0x2000f0a0 = 0; *(uint8_t*)0x2000f0a1 = 0; *(uint8_t*)0x2000f0a2 = 0; *(uint8_t*)0x2000f0a3 = 0; *(uint8_t*)0x2000f0a4 = 0; *(uint8_t*)0x2000f0a5 = 0; *(uint8_t*)0x2000f0a6 = 0; *(uint8_t*)0x2000f0a7 = 0; *(uint8_t*)0x2000f0a8 = 0; *(uint8_t*)0x2000f0a9 = 0; *(uint8_t*)0x2000f0aa = 0; *(uint8_t*)0x2000f0ab = 0; *(uint8_t*)0x2000f0ac = 0; *(uint8_t*)0x2000f0ad = 0; *(uint8_t*)0x2000f0ae = 0; *(uint8_t*)0x2000f0af = 0; *(uint8_t*)0x2000f0b0 = 0; *(uint8_t*)0x2000f0b1 = 0; *(uint8_t*)0x2000f0b2 = 0; *(uint8_t*)0x2000f0b3 = 0; *(uint32_t*)0x2000f0b4 = 0; *(uint16_t*)0x2000f0b8 = 0x70; *(uint16_t*)0x2000f0ba = 0x98; *(uint32_t*)0x2000f0bc = 0; *(uint64_t*)0x2000f0c0 = 0; *(uint64_t*)0x2000f0c8 = 0; *(uint16_t*)0x2000f0d0 = 0x28; memcpy((void*)0x2000f0d2, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x2000f0ef = 0; *(uint32_t*)0x2000f0f0 = 0xfffffffe; *(uint32_t*)0x2000f0f8 = htobe32(-1); *(uint8_t*)0x2000f0fc = 0xac; *(uint8_t*)0x2000f0fd = 0x14; *(uint8_t*)0x2000f0fe = 0; *(uint8_t*)0x2000f0ff = 0xaa; *(uint32_t*)0x2000f100 = htobe32(0); *(uint32_t*)0x2000f104 = htobe32(0); memcpy((void*)0x2000f108, "\x69\x70\x36\x67\x72\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); memcpy((void*)0x2000f118, "\x76\x63\x61\x6e\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint8_t*)0x2000f128 = 0; *(uint8_t*)0x2000f129 = 0; *(uint8_t*)0x2000f12a = 0; *(uint8_t*)0x2000f12b = 0; *(uint8_t*)0x2000f12c = 0; *(uint8_t*)0x2000f12d = 0; *(uint8_t*)0x2000f12e = 0; *(uint8_t*)0x2000f12f = 0; *(uint8_t*)0x2000f130 = 0; *(uint8_t*)0x2000f131 = 0; *(uint8_t*)0x2000f132 = 0; *(uint8_t*)0x2000f133 = 0; *(uint8_t*)0x2000f134 = 0; *(uint8_t*)0x2000f135 = 0; *(uint8_t*)0x2000f136 = 0; *(uint8_t*)0x2000f137 = 0; *(uint8_t*)0x2000f138 = 0; *(uint8_t*)0x2000f139 = 0; *(uint8_t*)0x2000f13a = 0; *(uint8_t*)0x2000f13b = 0; *(uint8_t*)0x2000f13c = 0; *(uint8_t*)0x2000f13d = 0; *(uint8_t*)0x2000f13e = 0; *(uint8_t*)0x2000f13f = 0; *(uint8_t*)0x2000f140 = 0; *(uint8_t*)0x2000f141 = 0; *(uint8_t*)0x2000f142 = 0; *(uint8_t*)0x2000f143 = 0; *(uint8_t*)0x2000f144 = 0; *(uint8_t*)0x2000f145 = 0; *(uint8_t*)0x2000f146 = 0; *(uint8_t*)0x2000f147 = 0; *(uint16_t*)0x2000f148 = 0; *(uint8_t*)0x2000f14a = 0; *(uint8_t*)0x2000f14b = 0; *(uint32_t*)0x2000f14c = 0; *(uint16_t*)0x2000f150 = 0x70; *(uint16_t*)0x2000f152 = 0xa8; *(uint32_t*)0x2000f154 = 0; *(uint64_t*)0x2000f158 = 0; *(uint64_t*)0x2000f160 = 0; *(uint16_t*)0x2000f168 = 0x38; memcpy((void*)0x2000f16a, "\x53\x4e\x41\x54\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x2000f187 = 0; *(uint32_t*)0x2000f188 = 1; *(uint32_t*)0x2000f18c = 0; *(uint32_t*)0x2000f190 = htobe32(0xe0000002); *(uint32_t*)0x2000f194 = htobe32(0xe0000001); *(uint16_t*)0x2000f198 = 0; *(uint16_t*)0x2000f19a = 0; *(uint8_t*)0x2000f1a0 = 0; *(uint8_t*)0x2000f1a1 = 0; *(uint8_t*)0x2000f1a2 = 0; *(uint8_t*)0x2000f1a3 = 0; *(uint8_t*)0x2000f1a4 = 0; *(uint8_t*)0x2000f1a5 = 0; *(uint8_t*)0x2000f1a6 = 0; *(uint8_t*)0x2000f1a7 = 0; *(uint8_t*)0x2000f1a8 = 0; *(uint8_t*)0x2000f1a9 = 0; *(uint8_t*)0x2000f1aa = 0; *(uint8_t*)0x2000f1ab = 0; *(uint8_t*)0x2000f1ac = 0; *(uint8_t*)0x2000f1ad = 0; *(uint8_t*)0x2000f1ae = 0; *(uint8_t*)0x2000f1af = 0; *(uint8_t*)0x2000f1b0 = 0; *(uint8_t*)0x2000f1b1 = 0; *(uint8_t*)0x2000f1b2 = 0; *(uint8_t*)0x2000f1b3 = 0; *(uint8_t*)0x2000f1b4 = 0; *(uint8_t*)0x2000f1b5 = 0; *(uint8_t*)0x2000f1b6 = 0; *(uint8_t*)0x2000f1b7 = 0; *(uint8_t*)0x2000f1b8 = 0; *(uint8_t*)0x2000f1b9 = 0; *(uint8_t*)0x2000f1ba = 0; *(uint8_t*)0x2000f1bb = 0; *(uint8_t*)0x2000f1bc = 0; *(uint8_t*)0x2000f1bd = 0; *(uint8_t*)0x2000f1be = 0; *(uint8_t*)0x2000f1bf = 0; *(uint8_t*)0x2000f1c0 = 0; *(uint8_t*)0x2000f1c1 = 0; *(uint8_t*)0x2000f1c2 = 0; *(uint8_t*)0x2000f1c3 = 0; *(uint8_t*)0x2000f1c4 = 0; *(uint8_t*)0x2000f1c5 = 0; *(uint8_t*)0x2000f1c6 = 0; *(uint8_t*)0x2000f1c7 = 0; *(uint8_t*)0x2000f1c8 = 0; *(uint8_t*)0x2000f1c9 = 0; *(uint8_t*)0x2000f1ca = 0; *(uint8_t*)0x2000f1cb = 0; *(uint8_t*)0x2000f1cc = 0; *(uint8_t*)0x2000f1cd = 0; *(uint8_t*)0x2000f1ce = 0; *(uint8_t*)0x2000f1cf = 0; *(uint8_t*)0x2000f1d0 = 0; *(uint8_t*)0x2000f1d1 = 0; *(uint8_t*)0x2000f1d2 = 0; *(uint8_t*)0x2000f1d3 = 0; *(uint8_t*)0x2000f1d4 = 0; *(uint8_t*)0x2000f1d5 = 0; *(uint8_t*)0x2000f1d6 = 0; *(uint8_t*)0x2000f1d7 = 0; *(uint8_t*)0x2000f1d8 = 0; *(uint8_t*)0x2000f1d9 = 0; *(uint8_t*)0x2000f1da = 0; *(uint8_t*)0x2000f1db = 0; *(uint8_t*)0x2000f1dc = 0; *(uint8_t*)0x2000f1dd = 0; *(uint8_t*)0x2000f1de = 0; *(uint8_t*)0x2000f1df = 0; *(uint8_t*)0x2000f1e0 = 0; *(uint8_t*)0x2000f1e1 = 0; *(uint8_t*)0x2000f1e2 = 0; *(uint8_t*)0x2000f1e3 = 0; *(uint8_t*)0x2000f1e4 = 0; *(uint8_t*)0x2000f1e5 = 0; *(uint8_t*)0x2000f1e6 = 0; *(uint8_t*)0x2000f1e7 = 0; *(uint8_t*)0x2000f1e8 = 0; *(uint8_t*)0x2000f1e9 = 0; *(uint8_t*)0x2000f1ea = 0; *(uint8_t*)0x2000f1eb = 0; *(uint8_t*)0x2000f1ec = 0; *(uint8_t*)0x2000f1ed = 0; *(uint8_t*)0x2000f1ee = 0; *(uint8_t*)0x2000f1ef = 0; *(uint8_t*)0x2000f1f0 = 0; *(uint8_t*)0x2000f1f1 = 0; *(uint8_t*)0x2000f1f2 = 0; *(uint8_t*)0x2000f1f3 = 0; *(uint32_t*)0x2000f1f4 = 0; *(uint16_t*)0x2000f1f8 = 0x70; *(uint16_t*)0x2000f1fa = 0xb8; *(uint32_t*)0x2000f1fc = 0; *(uint64_t*)0x2000f200 = 0; *(uint64_t*)0x2000f208 = 0; *(uint16_t*)0x2000f210 = 0x48; memcpy((void*)0x2000f212, "\x54\x45\x45\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x2000f22f = 1; *(uint32_t*)0x2000f230 = htobe32(0x7f000001); memcpy((void*)0x2000f240, "\x69\x70\x36\x74\x6e\x6c\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint64_t*)0x2000f250 = 0; *(uint32_t*)0x2000f258 = htobe32(0); *(uint32_t*)0x2000f25c = htobe32(0x7f000001); *(uint32_t*)0x2000f260 = htobe32(0); *(uint32_t*)0x2000f264 = htobe32(0); memcpy((void*)0x2000f268, "\xea\x06\xa2\x8f\x44\x7c\xd3\x66\xb4\xdb\x6f\x4f\x4a\x2d\x3f\x92", 16); *(uint8_t*)0x2000f278 = 0x73; *(uint8_t*)0x2000f279 = 0x79; *(uint8_t*)0x2000f27a = 0x7a; *(uint8_t*)0x2000f27b = 0; *(uint8_t*)0x2000f27c = 0; *(uint8_t*)0x2000f288 = 0; *(uint8_t*)0x2000f289 = 0; *(uint8_t*)0x2000f28a = 0; *(uint8_t*)0x2000f28b = 0; *(uint8_t*)0x2000f28c = 0; *(uint8_t*)0x2000f28d = 0; *(uint8_t*)0x2000f28e = 0; *(uint8_t*)0x2000f28f = 0; *(uint8_t*)0x2000f290 = 0; *(uint8_t*)0x2000f291 = 0; *(uint8_t*)0x2000f292 = 0; *(uint8_t*)0x2000f293 = 0; *(uint8_t*)0x2000f294 = 0; *(uint8_t*)0x2000f295 = 0; *(uint8_t*)0x2000f296 = 0; *(uint8_t*)0x2000f297 = 0; *(uint8_t*)0x2000f298 = 0; *(uint8_t*)0x2000f299 = 0; *(uint8_t*)0x2000f29a = 0; *(uint8_t*)0x2000f29b = 0; *(uint8_t*)0x2000f29c = 0; *(uint8_t*)0x2000f29d = 0; *(uint8_t*)0x2000f29e = 0; *(uint8_t*)0x2000f29f = 0; *(uint8_t*)0x2000f2a0 = 0; *(uint8_t*)0x2000f2a1 = 0; *(uint8_t*)0x2000f2a2 = 0; *(uint8_t*)0x2000f2a3 = 0; *(uint8_t*)0x2000f2a4 = 0; *(uint8_t*)0x2000f2a5 = 0; *(uint8_t*)0x2000f2a6 = 0; *(uint8_t*)0x2000f2a7 = 0; *(uint16_t*)0x2000f2a8 = 0; *(uint8_t*)0x2000f2aa = 0; *(uint8_t*)0x2000f2ab = 0; *(uint32_t*)0x2000f2ac = 0; *(uint16_t*)0x2000f2b0 = 0x70; *(uint16_t*)0x2000f2b2 = 0xa8; *(uint32_t*)0x2000f2b4 = 0; *(uint64_t*)0x2000f2b8 = 0; *(uint64_t*)0x2000f2c0 = 0; *(uint16_t*)0x2000f2c8 = 0x38; memcpy((void*)0x2000f2ca, "\x44\x4e\x41\x54\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x2000f2e7 = 0; *(uint32_t*)0x2000f2e8 = 1; *(uint32_t*)0x2000f2ec = 0; *(uint32_t*)0x2000f2f0 = htobe32(0xe0000002); *(uint32_t*)0x2000f2f4 = htobe32(0); *(uint16_t*)0x2000f2f8 = 0; *(uint16_t*)0x2000f2fa = 0; *(uint64_t*)0x20003000 = 0; *(uint64_t*)0x20003008 = 0; *(uint64_t*)0x20003010 = 0; *(uint64_t*)0x20003018 = 0; *(uint64_t*)0x20003020 = 0; *(uint64_t*)0x20003028 = 0; *(uint64_t*)0x20003030 = 0; *(uint64_t*)0x20003038 = 0; syscall(__NR_setsockopt, r[1], 0, 0x40, 0x2000f000, 0x300); } int main() { loop(); return 0; }