// https://syzkaller.appspot.com/bug?id=e4aaa78795e490421c79f76ec3679006c8ff4cf0 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; memcpy((void*)0x20000000, "/dev/autofs\000", 12); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000000ul, 0ul, 0ul); if (res != -1) r[0] = res; *(uint32_t*)0x200010c0 = 1; *(uint32_t*)0x200010c4 = 1; *(uint32_t*)0x200010c8 = 0x18; *(uint32_t*)0x200010cc = r[0]; memcpy((void*)0x200010d8, "./file0\000", 8); syscall(__NR_ioctl, r[0], 0xc0189375, 0x200010c0ul); memcpy((void*)0x20004780, "./file0\000", 8); syscall(__NR_creat, 0x20004780ul, 0ul); *(uint32_t*)0x20000080 = 0x4000; *(uint32_t*)0x20000084 = 1; *(uint32_t*)0x20000088 = 0x18; *(uint32_t*)0x2000008c = -1; memcpy((void*)0x20000098, "./file0\000", 8); syscall(__NR_ioctl, r[0], 0x40086602, 0x20000080ul); memcpy((void*)0x20000000, "./file0\000", 8); res = syscall(__NR_openat, 0xffffff9c, 0x20000000ul, 0ul, 0ul); if (res != -1) r[1] = res; *(uint32_t*)0x20000140 = 2; *(uint32_t*)0x20000144 = 0xdc; memcpy((void*)0x20000148, "i\262\366\355\356\347 \314\340Wy7\353\212gQ", 16); memset((void*)0x20000158, 0, 16); memset((void*)0x2000016c, 0, 20); syscall(__NR_ioctl, r[1], 0x4004662b, 0x20000140ul); return 0; }