// https://syzkaller.appspot.com/bug?id=67a6d3f5c4269572078a14e41d3069533b340643 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 0x10ul, 3ul, 0xc); if (res != -1) r[0] = res; *(uint64_t*)0x20000300 = 0; *(uint32_t*)0x20000308 = 0; *(uint64_t*)0x20000310 = 0x200000c0; *(uint64_t*)0x200000c0 = 0x20000600; *(uint32_t*)0x20000600 = 0x7c; *(uint8_t*)0x20000604 = 0; *(uint8_t*)0x20000605 = 1; *(uint16_t*)0x20000606 = 0x401; *(uint32_t*)0x20000608 = 0; *(uint32_t*)0x2000060c = 0; *(uint8_t*)0x20000610 = 0x18; *(uint8_t*)0x20000611 = 0; *(uint16_t*)0x20000612 = htobe16(0); *(uint16_t*)0x20000614 = 0x24; STORE_BY_BITMASK(uint16_t, , 0x20000616, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000617, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000617, 1, 7, 1); *(uint16_t*)0x20000618 = 0x14; STORE_BY_BITMASK(uint16_t, , 0x2000061a, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000061b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000061b, 1, 7, 1); *(uint16_t*)0x2000061c = 8; *(uint16_t*)0x2000061e = 1; *(uint32_t*)0x20000620 = htobe32(0xe0000001); *(uint16_t*)0x20000624 = 8; *(uint16_t*)0x20000626 = 2; *(uint8_t*)0x20000628 = 0xac; *(uint8_t*)0x20000629 = 0x14; *(uint8_t*)0x2000062a = 0x14; *(uint8_t*)0x2000062b = 0; *(uint16_t*)0x2000062c = 0xc; STORE_BY_BITMASK(uint16_t, , 0x2000062e, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000062f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000062f, 1, 7, 1); *(uint16_t*)0x20000630 = 5; *(uint16_t*)0x20000632 = 1; *(uint8_t*)0x20000634 = 0; *(uint16_t*)0x20000638 = 0x18; STORE_BY_BITMASK(uint16_t, , 0x2000063a, 6, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000063b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000063b, 1, 7, 1); *(uint16_t*)0x2000063c = 8; *(uint16_t*)0x2000063e = 1; *(uint32_t*)0x20000640 = htobe32(0xe0000001); *(uint16_t*)0x20000644 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x20000646, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000647, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000647, 1, 7, 1); *(uint16_t*)0x20000648 = 4; *(uint16_t*)0x2000064a = 2; *(uint16_t*)0x2000064c = htobe16(0); *(uint16_t*)0x20000650 = 0x24; STORE_BY_BITMASK(uint16_t, , 0x20000652, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000653, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000653, 1, 7, 1); *(uint16_t*)0x20000654 = 0x14; STORE_BY_BITMASK(uint16_t, , 0x20000656, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000657, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000657, 1, 7, 1); *(uint16_t*)0x20000658 = 8; *(uint16_t*)0x2000065a = 1; *(uint8_t*)0x2000065c = 0xac; *(uint8_t*)0x2000065d = 0x14; *(uint8_t*)0x2000065e = 0x14; *(uint8_t*)0x2000065f = 0; *(uint16_t*)0x20000660 = 8; *(uint16_t*)0x20000662 = 2; *(uint32_t*)0x20000664 = htobe32(-1); *(uint16_t*)0x20000668 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x2000066a, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000066b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000066b, 1, 7, 1); *(uint16_t*)0x2000066c = 5; *(uint16_t*)0x2000066e = 1; *(uint8_t*)0x20000670 = 0; *(uint16_t*)0x20000674 = 8; STORE_BY_BITMASK(uint16_t, , 0x20000676, 7, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000677, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000677, 0, 7, 1); *(uint32_t*)0x20000678 = htobe32(0); *(uint64_t*)0x200000c8 = 0x7c; *(uint64_t*)0x20000318 = 1; *(uint64_t*)0x20000320 = 0; *(uint64_t*)0x20000328 = 0; *(uint32_t*)0x20000330 = 0; syscall(__NR_sendmsg, r[0], 0x20000300ul, 0ul); return 0; }