// https://syzkaller.appspot.com/bug?id=16e717b9497aaf186cee38a42d4bfc14ad3ffa99 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #define __syscall syscall uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); intptr_t res = 0; memcpy((void*)0x20000000, "/dev/pf\000", 8); res = syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000000ul, 2ul, 0ul); if (res != -1) r[0] = res; *(uint32_t*)0x20000240 = 1; syscall(SYS_ioctl, r[0], 0xcd60441aul, 0x20000240ul); memcpy((void*)0x20000200, "/dev/pf\000", 8); res = syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000200ul, 2ul, 0ul); if (res != -1) r[1] = res; *(uint32_t*)0x20000280 = 0; *(uint32_t*)0x20000284 = 0; *(uint32_t*)0x20000288 = 0; *(uint32_t*)0x2000028c = 0; *(uint32_t*)0x20000290 = 0; *(uint32_t*)0x20000294 = 0; *(uint32_t*)0x20000298 = 0; *(uint32_t*)0x2000029c = 0x10; *(uint32_t*)0x200002a0 = 0; *(uint32_t*)0x200002a4 = 0; *(uint32_t*)0x200002a8 = 0; *(uint32_t*)0x200002ac = 0; *(uint32_t*)0x200002b0 = 0; *(uint32_t*)0x200002b4 = 0; *(uint32_t*)0x200002b8 = 0; *(uint32_t*)0x200002bc = 0; *(uint32_t*)0x200002c0 = 0; *(uint32_t*)0x200002c4 = 0; *(uint32_t*)0x200002c8 = 0; *(uint32_t*)0x200002cc = 0; *(uint32_t*)0x200002d0 = 0; *(uint32_t*)0x200002d4 = 0; *(uint32_t*)0x200002d8 = 0; *(uint32_t*)0x200002dc = 0; *(uint32_t*)0x200002e0 = 0; *(uint32_t*)0x200002e4 = 0; *(uint32_t*)0x200002e8 = 0; *(uint32_t*)0x200002ec = 0; *(uint32_t*)0x200002f0 = 0; *(uint32_t*)0x200002f4 = 0; *(uint32_t*)0x200002f8 = 0; *(uint32_t*)0x200002fc = -1; *(uint32_t*)0x20000300 = 0; *(uint32_t*)0x20000304 = 0; *(uint32_t*)0x20000308 = 0; *(uint32_t*)0x2000030c = 0; *(uint32_t*)0x20000310 = 0; *(uint32_t*)0x20000314 = 0; *(uint32_t*)0x20000318 = 0; *(uint32_t*)0x2000031c = 0; *(uint32_t*)0x20000320 = 0; *(uint32_t*)0x20000324 = 0; *(uint32_t*)0x20000328 = 0; *(uint32_t*)0x2000032c = 2; *(uint32_t*)0x20000330 = 0; *(uint32_t*)0x20000334 = 0; *(uint32_t*)0x20000338 = 0xffffffe1; *(uint32_t*)0x2000033c = 0; *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = 0; *(uint32_t*)0x20000348 = 0; *(uint32_t*)0x2000034c = 0; *(uint32_t*)0x20000350 = 0; *(uint32_t*)0x20000354 = 0; *(uint32_t*)0x20000358 = 0; *(uint32_t*)0x2000035c = 0; *(uint32_t*)0x20000360 = 0; *(uint32_t*)0x20000364 = 0; *(uint32_t*)0x20000368 = 0; *(uint32_t*)0x2000036c = 0; *(uint32_t*)0x20000370 = 0; *(uint32_t*)0x20000374 = 0; *(uint32_t*)0x20000378 = 0; *(uint32_t*)0x2000037c = 0; *(uint32_t*)0x20000380 = 0; *(uint32_t*)0x20000384 = 0; *(uint32_t*)0x20000388 = 0; *(uint32_t*)0x2000038c = 0; *(uint32_t*)0x20000390 = 0; *(uint32_t*)0x20000394 = 0; *(uint32_t*)0x20000398 = 0; *(uint32_t*)0x2000039c = 0; syscall(SYS_ioctl, -1, 0x81205724ul, 0x20000280ul); *(uint32_t*)0x20000240 = 0; syscall(SYS_ioctl, r[1], 0xc1084425ul, 0x20000240ul); return 0; }