// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } uint64_t r[1] = {0xffffffffffffffff}; void test() { long res; res = syscall(__NR_socket, 0x10, 3, 6); if (res != -1) r[0] = res; *(uint64_t*)0x2000b000 = 0x2000f000; *(uint16_t*)0x2000f000 = 0x10; *(uint16_t*)0x2000f002 = 0; *(uint32_t*)0x2000f004 = 0; *(uint32_t*)0x2000f008 = 0; *(uint32_t*)0x2000b008 = 0xc; *(uint64_t*)0x2000b010 = 0x205a6ff0; *(uint64_t*)0x205a6ff0 = 0x20ff4ea0; *(uint32_t*)0x20ff4ea0 = 0x144; *(uint16_t*)0x20ff4ea4 = 0x10; *(uint16_t*)0x20ff4ea6 = 0x713; *(uint32_t*)0x20ff4ea8 = 0; *(uint32_t*)0x20ff4eac = 0; *(uint8_t*)0x20ff4eb0 = 0; *(uint8_t*)0x20ff4eb1 = 0; *(uint8_t*)0x20ff4eb2 = 0; *(uint8_t*)0x20ff4eb3 = 0; *(uint8_t*)0x20ff4eb4 = 0; *(uint8_t*)0x20ff4eb5 = 0; *(uint8_t*)0x20ff4eb6 = 0; *(uint8_t*)0x20ff4eb7 = 0; *(uint8_t*)0x20ff4eb8 = 0; *(uint8_t*)0x20ff4eb9 = 0; *(uint8_t*)0x20ff4eba = 0; *(uint8_t*)0x20ff4ebb = 0; *(uint8_t*)0x20ff4ebc = 0; *(uint8_t*)0x20ff4ebd = 0; *(uint8_t*)0x20ff4ebe = 0; *(uint8_t*)0x20ff4ebf = 0; *(uint32_t*)0x20ff4ec0 = htobe32(0xe0000002); *(uint16_t*)0x20ff4ed0 = htobe16(0); *(uint16_t*)0x20ff4ed2 = htobe16(0); *(uint16_t*)0x20ff4ed4 = htobe16(0); *(uint16_t*)0x20ff4ed6 = htobe16(0); *(uint16_t*)0x20ff4ed8 = 0; *(uint8_t*)0x20ff4eda = 0; *(uint8_t*)0x20ff4edb = 0; *(uint8_t*)0x20ff4edc = 0; *(uint32_t*)0x20ff4ee0 = 0; *(uint32_t*)0x20ff4ee4 = 0; *(uint64_t*)0x20ff4ee8 = htobe64(0); *(uint64_t*)0x20ff4ef0 = htobe64(1); *(uint32_t*)0x20ff4ef8 = htobe32(0); *(uint8_t*)0x20ff4efc = 0x6c; *(uint64_t*)0x20ff4f00 = htobe64(0); *(uint64_t*)0x20ff4f08 = htobe64(1); *(uint64_t*)0x20ff4f10 = 0; *(uint64_t*)0x20ff4f18 = 0; *(uint64_t*)0x20ff4f20 = 0; *(uint64_t*)0x20ff4f28 = 0; *(uint64_t*)0x20ff4f30 = 0; *(uint64_t*)0x20ff4f38 = 0; *(uint64_t*)0x20ff4f40 = 0; *(uint64_t*)0x20ff4f48 = 0; *(uint64_t*)0x20ff4f50 = 0; *(uint64_t*)0x20ff4f58 = 0; *(uint64_t*)0x20ff4f60 = 0; *(uint64_t*)0x20ff4f68 = 0; *(uint32_t*)0x20ff4f70 = 0; *(uint32_t*)0x20ff4f74 = 0; *(uint32_t*)0x20ff4f78 = 0; *(uint32_t*)0x20ff4f7c = 0; *(uint32_t*)0x20ff4f80 = 0; *(uint16_t*)0x20ff4f84 = 2; *(uint8_t*)0x20ff4f86 = 0; *(uint8_t*)0x20ff4f87 = 0; *(uint8_t*)0x20ff4f88 = 0; *(uint16_t*)0x20ff4f90 = 0xc; *(uint16_t*)0x20ff4f92 = 0x15; *(uint32_t*)0x20ff4f94 = 0; *(uint32_t*)0x20ff4f98 = 0; *(uint16_t*)0x20ff4f9c = 0x48; *(uint16_t*)0x20ff4f9e = 3; memcpy((void*)0x20ff4fa0, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x20ff4fe0 = 0; *(uint64_t*)0x205a6ff8 = 0x144; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (;;) { loop(); } }