// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 6); *(uint64_t*)0x2000b000 = 0x2000f000; *(uint32_t*)0x2000b008 = 0xc; *(uint64_t*)0x2000b010 = 0x205a6ff0; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; *(uint16_t*)0x2000f000 = 0x10; *(uint16_t*)0x2000f002 = 0; *(uint32_t*)0x2000f004 = 0; *(uint32_t*)0x2000f008 = 0; *(uint64_t*)0x205a6ff0 = 0x20ee8ff0; *(uint64_t*)0x205a6ff8 = 0x140; *(uint32_t*)0x20ee8ff0 = 0x140; *(uint16_t*)0x20ee8ff4 = 0x10; *(uint16_t*)0x20ee8ff6 = 0x713; *(uint32_t*)0x20ee8ff8 = 0; *(uint32_t*)0x20ee8ffc = 0; *(uint8_t*)0x20ee9000 = -1; *(uint8_t*)0x20ee9001 = 1; *(uint8_t*)0x20ee9002 = 0; *(uint8_t*)0x20ee9003 = 0; *(uint8_t*)0x20ee9004 = 0; *(uint8_t*)0x20ee9005 = 0; *(uint8_t*)0x20ee9006 = 0; *(uint8_t*)0x20ee9007 = 0; *(uint8_t*)0x20ee9008 = 0; *(uint8_t*)0x20ee9009 = 0; *(uint8_t*)0x20ee900a = 0; *(uint8_t*)0x20ee900b = 0; *(uint8_t*)0x20ee900c = 0; *(uint8_t*)0x20ee900d = 0; *(uint8_t*)0x20ee900e = 0; *(uint8_t*)0x20ee900f = 1; *(uint8_t*)0x20ee9010 = 0xfe; *(uint8_t*)0x20ee9011 = 0x80; *(uint8_t*)0x20ee9012 = 0; *(uint8_t*)0x20ee9013 = 0; *(uint8_t*)0x20ee9014 = 0; *(uint8_t*)0x20ee9015 = 0; *(uint8_t*)0x20ee9016 = 0; *(uint8_t*)0x20ee9017 = 0; *(uint8_t*)0x20ee9018 = 0; *(uint8_t*)0x20ee9019 = 0; *(uint8_t*)0x20ee901a = 0; *(uint8_t*)0x20ee901b = 0; *(uint8_t*)0x20ee901c = 0; *(uint8_t*)0x20ee901d = 0; *(uint8_t*)0x20ee901e = 0; *(uint8_t*)0x20ee901f = 0; *(uint16_t*)0x20ee9020 = 0; *(uint16_t*)0x20ee9022 = htobe16(0); *(uint16_t*)0x20ee9024 = 0; *(uint16_t*)0x20ee9026 = htobe16(0); *(uint16_t*)0x20ee9028 = 0; *(uint8_t*)0x20ee902a = 0; *(uint8_t*)0x20ee902b = 0; *(uint8_t*)0x20ee902c = 0; *(uint32_t*)0x20ee9030 = 0; *(uint32_t*)0x20ee9034 = 0; *(uint32_t*)0x20ee9038 = htobe32(0); *(uint32_t*)0x20ee9048 = 0; *(uint8_t*)0x20ee904c = 0x6c; *(uint64_t*)0x20ee9050 = htobe64(0); *(uint64_t*)0x20ee9058 = htobe64(1); *(uint64_t*)0x20ee9060 = 0; *(uint64_t*)0x20ee9068 = 0; *(uint64_t*)0x20ee9070 = 0; *(uint64_t*)0x20ee9078 = 0; *(uint64_t*)0x20ee9080 = 0; *(uint64_t*)0x20ee9088 = 0; *(uint64_t*)0x20ee9090 = 0; *(uint64_t*)0x20ee9098 = 0; *(uint64_t*)0x20ee90a0 = 0; *(uint64_t*)0x20ee90a8 = 0; *(uint64_t*)0x20ee90b0 = 0; *(uint64_t*)0x20ee90b8 = 0; *(uint32_t*)0x20ee90c0 = 0; *(uint32_t*)0x20ee90c4 = 0; *(uint32_t*)0x20ee90c8 = 0; *(uint32_t*)0x20ee90cc = 0; *(uint32_t*)0x20ee90d0 = 0; *(uint16_t*)0x20ee90d4 = 2; *(uint8_t*)0x20ee90d6 = 0; *(uint8_t*)0x20ee90d7 = 0; *(uint8_t*)0x20ee90d8 = 0; *(uint16_t*)0x20ee90e0 = 8; *(uint16_t*)0x20ee90e2 = 0x1d; *(uint32_t*)0x20ee90e4 = 0; *(uint16_t*)0x20ee90e8 = 0x48; *(uint16_t*)0x20ee90ea = 3; memcpy((void*)0x20ee90ec, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x20ee912c = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); } int main() { for (;;) { loop(); } }