// https://syzkaller.appspot.com/bug?id=d38ed0177151ca71af235c613ab4897461cf9ff3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 2, 1, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20d06000 = 1; syscall(__NR_setsockopt, r[0], 6, 0x10000000013, 0x20d06000, 4); *(uint32_t*)0x200000c0 = 1; syscall(__NR_setsockopt, r[0], 6, 0x4000000000014, 0x200000c0, 0x240); *(uint16_t*)0x20000200 = 2; *(uint16_t*)0x20000202 = htobe16(0); *(uint8_t*)0x20000204 = 0xac; *(uint8_t*)0x20000205 = 0x14; *(uint8_t*)0x20000206 = 0x14; *(uint8_t*)0x20000207 = 0xbb; *(uint8_t*)0x20000208 = 0; *(uint8_t*)0x20000209 = 0; *(uint8_t*)0x2000020a = 0; *(uint8_t*)0x2000020b = 0; *(uint8_t*)0x2000020c = 0; *(uint8_t*)0x2000020d = 0; *(uint8_t*)0x2000020e = 0; *(uint8_t*)0x2000020f = 0; syscall(__NR_connect, r[0], 0x20000200, 0x10); *(uint64_t*)0x20001000 = 0x20000140; *(uint16_t*)0x20000140 = 0; *(uint16_t*)0x20000142 = 0; *(uint32_t*)0x20000144 = 0; *(uint32_t*)0x20000148 = 0; *(uint32_t*)0x20001008 = 0x80; *(uint64_t*)0x20001010 = 0x200001c0; *(uint64_t*)0x200001c0 = 0x20000a00; memcpy((void*)0x20000a00, "\x87\xb3\x95\x5e\x60\xd8\x47\x37\x57\xe2\xf3\xb1\xfb\xfe\x0a\xbf\x8e" "\xea\x82\x5f\x08\xd5\x44\xaa\xab\x2a\x6b\x61\xb6\xf8\x77\xe2\x1d\x86" "\x18\x1c\xd0\x5d\x8f\xfe\x4c\x9f\x9f\xaa\xf6\x5b\xc0\x60\x28\x97\x4a" "\xe6\x45\xc2\x2c\xaa\x53\x30\xe7\x35\xd1\x98\x27\x95\xa0\x21\xef\x5a" "\xb6\x37\x3b\xac\xea\xfa\x59\xfd\x1e\x04\x51\x73\x61\x75\x0b\x3f\x37" "\x88\x19\x12\x78\x2c\x5f\x7e\x2d\xee\xac\x49\xcf\x07\x31\x8f\x3b\x6b" "\x76\xcd\xf0\xaa\x32\xa3\x94\x55\x42\x4b\x5e\x97\x48\x99\xf8\xb5\xfa" "\xec\x50\x63\xc2\x14\x40\xf9\x78\x21\x1b\x61\x98\x82\xd6\xb8\xc4\x40" "\xf2\x43\xc7\xa1\x9b\x3a\xde\xf5\xf9\xf3\x29\x62\x0b\x32\xd1\x76\x32" "\x92\x4e\x10\x59\x30\x1d\x5c\x3e\x23\xdb\xe6\xc2\x53\x07\x06\x59\xe6" "\x42\x03\x2b\xf6\x95\xfc\x41\x26\x56\xe7\xf5\x0e\xec\xad\x72\x33\x8f" "\x21\xd5\x52\x9c\xf3\xe5\xff\x73\x89\xce\xee\xd8\x8b\x9d\x84\x49\x89" "\x0b\x08\xe7\x57\xc4\xaf\xb7\xf8\x58\xad\xf7\x2a\xe3\xc5\x66\x7d\xca" "\xd9\x34\xa1\x30\x55\x2d\x42\xe5\x30\xdd\xf2", 232); *(uint64_t*)0x200001c8 = 0xe8; *(uint64_t*)0x200001d0 = 0x20000b00; *(uint64_t*)0x200001d8 = 0; *(uint64_t*)0x20001018 = 2; *(uint64_t*)0x20001020 = 0x20000b80; *(uint64_t*)0x20000b80 = 0x10; *(uint32_t*)0x20000b88 = 0; *(uint32_t*)0x20000b8c = 5; *(uint64_t*)0x20000b90 = 0x10; *(uint32_t*)0x20000b98 = 0; *(uint32_t*)0x20000b9c = 0xe5; *(uint64_t*)0x20000ba0 = 0x10; *(uint32_t*)0x20000ba8 = 0x117; *(uint32_t*)0x20000bac = 1; *(uint64_t*)0x20000bb0 = 0x10; *(uint32_t*)0x20000bb8 = 0x10b; *(uint32_t*)0x20000bbc = 0xff; *(uint64_t*)0x20000bc0 = 0x10; *(uint32_t*)0x20000bc8 = 0x11f; *(uint32_t*)0x20000bcc = 0; *(uint64_t*)0x20000bd0 = 0x10; *(uint32_t*)0x20000bd8 = 0x117; *(uint32_t*)0x20000bdc = 0x893a; *(uint64_t*)0x20000be0 = 0x10; *(uint32_t*)0x20000be8 = 0x1ff; *(uint32_t*)0x20000bec = 3; *(uint64_t*)0x20000bf0 = 0x10; *(uint32_t*)0x20000bf8 = 0; *(uint32_t*)0x20000bfc = 5; *(uint64_t*)0x20000c00 = 0x10; *(uint32_t*)0x20000c08 = 0x115; *(uint32_t*)0x20000c0c = 4; *(uint64_t*)0x20001028 = 0x90; *(uint32_t*)0x20001030 = 0; syscall(__NR_sendmsg, r[0], 0x20001000, 0x40000); syscall(__NR_sendto, r[0], 0x20000100, 0xffffffffffffff1f, 0, 0, 0xfffffe55); return 0; }