// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20007cc0 = 0x20000000; *(uint16_t*)0x20000000 = 1; memcpy((void*)0x20000002, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x20007cc8 = 0x80; *(uint64_t*)0x20007cd0 = 0x20002400; *(uint64_t*)0x20002400 = 0x20000080; *(uint64_t*)0x20002408 = 0; *(uint64_t*)0x20002410 = 0x20000180; *(uint64_t*)0x20002418 = 0; *(uint64_t*)0x20002420 = 0x200001c0; *(uint64_t*)0x20002428 = 0; *(uint64_t*)0x20002430 = 0x200011c0; *(uint64_t*)0x20002438 = 0; *(uint64_t*)0x20002440 = 0x20001280; *(uint64_t*)0x20002448 = 0; *(uint64_t*)0x20002450 = 0x20002280; *(uint64_t*)0x20002458 = 0; *(uint64_t*)0x20002460 = 0x20002380; *(uint64_t*)0x20002468 = 0; *(uint64_t*)0x20007cd8 = 7; *(uint64_t*)0x20007ce0 = 0x20007e40; *(uint64_t*)0x20007ce8 = 0; *(uint32_t*)0x20007cf0 = 0x8054; *(uint32_t*)0x20007cf8 = 0xf2f; *(uint64_t*)0x20007d00 = 0x200028c0; *(uint16_t*)0x200028c0 = 0x1f; *(uint16_t*)0x200028c2 = 3; *(uint8_t*)0x200028c4 = 5; *(uint8_t*)0x200028c5 = 8; *(uint8_t*)0x200028c6 = 0x14; *(uint8_t*)0x200028c7 = 1; *(uint8_t*)0x200028c8 = 0xc5; *(uint8_t*)0x200028c9 = 1; *(uint16_t*)0x200028ca = 0; *(uint8_t*)0x200028cc = 1; *(uint32_t*)0x20007d08 = 0x80; *(uint64_t*)0x20007d10 = 0x20004c00; *(uint64_t*)0x20004c00 = 0x20002940; *(uint64_t*)0x20004c08 = 0; *(uint64_t*)0x20004c10 = 0x20003940; *(uint64_t*)0x20004c18 = 0; *(uint64_t*)0x20004c20 = 0x20003980; *(uint64_t*)0x20004c28 = 0; *(uint64_t*)0x20004c30 = 0x20003a80; *(uint64_t*)0x20004c38 = 0; *(uint64_t*)0x20004c40 = 0x20003b80; *(uint64_t*)0x20004c48 = 0; *(uint64_t*)0x20004c50 = 0x20003c00; *(uint64_t*)0x20004c58 = 0; *(uint64_t*)0x20007d18 = 6; *(uint64_t*)0x20007d20 = 0x20004c80; *(uint64_t*)0x20004c80 = 0x10; *(uint32_t*)0x20004c88 = 0x112; *(uint32_t*)0x20004c8c = 5; *(uint64_t*)0x20004c90 = 0x10; *(uint32_t*)0x20004c98 = 0x114; *(uint32_t*)0x20004c9c = 3; *(uint64_t*)0x20004ca0 = 0x10; *(uint32_t*)0x20004ca8 = 0x117; *(uint32_t*)0x20004cac = 7; *(uint64_t*)0x20004cb0 = 0x10; *(uint32_t*)0x20004cb8 = 0x111; *(uint32_t*)0x20004cbc = 0xb23; *(uint64_t*)0x20004cc0 = 0x10; *(uint32_t*)0x20004cc8 = 0; *(uint32_t*)0x20004ccc = 0x27; *(uint64_t*)0x20004cd0 = 0x10; *(uint32_t*)0x20004cd8 = 0; *(uint32_t*)0x20004cdc = 6; *(uint64_t*)0x20004ce0 = 0x10; *(uint32_t*)0x20004ce8 = 0x11; *(uint32_t*)0x20004cec = 1; *(uint64_t*)0x20004cf0 = 0x10; *(uint32_t*)0x20004cf8 = 0x108; *(uint32_t*)0x20004cfc = 0x602c3739; *(uint64_t*)0x20004d00 = 0x10; *(uint32_t*)0x20004d08 = 0x11; *(uint32_t*)0x20004d0c = 1; *(uint64_t*)0x20007d28 = 0x90; *(uint32_t*)0x20007d30 = 0x4000000; *(uint32_t*)0x20007d38 = 9; *(uint64_t*)0x20007d40 = 0x200061c0; *(uint16_t*)0x200061c0 = 0x28; *(uint16_t*)0x200061c2 = 0; *(uint32_t*)0x200061c4 = 0x2710; *(uint32_t*)0x200061c8 = 2; *(uint32_t*)0x200061cc = 0; *(uint32_t*)0x20007d48 = 0x80; *(uint64_t*)0x20007d50 = 0x20006580; *(uint64_t*)0x20006580 = 0x20006240; *(uint64_t*)0x20006588 = 0; *(uint64_t*)0x20006590 = 0x20006280; *(uint64_t*)0x20006598 = 0; *(uint64_t*)0x200065a0 = 0x20006340; *(uint64_t*)0x200065a8 = 0; *(uint64_t*)0x200065b0 = 0x200063c0; *(uint64_t*)0x200065b8 = 0; *(uint64_t*)0x200065c0 = 0x200064c0; *(uint64_t*)0x200065c8 = 0; *(uint64_t*)0x200065d0 = 0x20006540; *(uint64_t*)0x200065d8 = 0; *(uint64_t*)0x20007d58 = 6; *(uint64_t*)0x20007d60 = 0x20006600; *(uint64_t*)0x20007d68 = 0; *(uint32_t*)0x20007d70 = 0x20000001; *(uint32_t*)0x20007d78 = 3; *(uint64_t*)0x20007d80 = 0x20006840; *(uint16_t*)0x20006840 = 0x1f; *(uint8_t*)0x20006842 = 9; *(uint8_t*)0x20006843 = 0xa3; *(uint8_t*)0x20006844 = 6; *(uint8_t*)0x20006845 = 0x7e; *(uint8_t*)0x20006846 = 3; *(uint8_t*)0x20006847 = 5; *(uint32_t*)0x20007d88 = 0x80; *(uint64_t*)0x20007d90 = 0x20007c40; *(uint64_t*)0x20007c40 = 0x200068c0; *(uint64_t*)0x20007c48 = 0; *(uint64_t*)0x20007c50 = 0x20006900; *(uint64_t*)0x20007c58 = 0; *(uint64_t*)0x20007c60 = 0x200069c0; *(uint64_t*)0x20007c68 = 0; *(uint64_t*)0x20007c70 = 0x20006a40; *(uint64_t*)0x20007c78 = 0; *(uint64_t*)0x20007c80 = 0x20006ac0; *(uint64_t*)0x20007c88 = 0; *(uint64_t*)0x20007c90 = 0x20006b00; *(uint64_t*)0x20007c98 = 0; *(uint64_t*)0x20007ca0 = 0x20006b40; *(uint64_t*)0x20007ca8 = 0; *(uint64_t*)0x20007cb0 = 0x20007b40; *(uint64_t*)0x20007cb8 = 0; *(uint64_t*)0x20007d98 = 8; *(uint64_t*)0x20007da0 = 0; *(uint64_t*)0x20007da8 = 0; *(uint32_t*)0x20007db0 = 0x10; *(uint32_t*)0x20007db8 = 2; syscall(__NR_sendmmsg, r[0], 0x20007cc0, 4, 0x24000090); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }