map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
uint64_t r[1] = {0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// openat$ptmx arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 70 74 6d 78 00} (length 0xa)
// }
// flags: open_flags = 0x0 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_tty
memcpy((void*)0x200000000100, "/dev/ptmx\000", 10);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000100ul, /*flags=*/0, /*mode=*/0);
if (res != -1)
r[0] = res;
// ioctl$TIOCSETD arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x5423 (4 bytes)
// arg: ptr[in, int32] {
// int32 = 0x15 (4 bytes)
// }
// ]
*(uint32_t*)0x200000000140 = 0x15;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x5423, /*arg=*/0x200000000140ul);
// ioctl$TCFLSH arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x40204706 (4 bytes)
// arg: intptr = 0x20000000 (8 bytes)
// ]
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40204706, /*arg=*/0x20000000ul);
// ioctl$TCFLSH arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x40204706 (4 bytes)
// arg: intptr = 0x20000000 (8 bytes)
// ]
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40204706, /*arg=*/0x20000000ul);
return 0;
}
]