// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0xf, 3, 2); *(uint32_t*)0x205f5000 = 0; *(uint32_t*)0x205f5004 = 0; *(uint32_t*)0x205f5008 = 0x208feff0; *(uint32_t*)0x205f500c = 1; *(uint32_t*)0x205f5010 = 0; *(uint32_t*)0x205f5014 = 0; *(uint32_t*)0x205f5018 = 0; *(uint32_t*)0x208feff0 = 0x20d4cea8; *(uint32_t*)0x208feff4 = 0x70; *(uint8_t*)0x20d4cea8 = 2; *(uint8_t*)0x20d4cea9 = 3; *(uint8_t*)0x20d4ceaa = 0; *(uint8_t*)0x20d4ceab = 9; *(uint16_t*)0x20d4ceac = 0xe; *(uint16_t*)0x20d4ceae = 0; *(uint32_t*)0x20d4ceb0 = 0x70bd25; *(uint32_t*)0x20d4ceb4 = 0x25dfdbfb; *(uint16_t*)0x20d4ceb8 = 5; *(uint16_t*)0x20d4ceba = 6; *(uint8_t*)0x20d4cebc = 0; *(uint8_t*)0x20d4cebd = 0; *(uint16_t*)0x20d4cebe = 0; *(uint16_t*)0x20d4cec0 = 0xa; *(uint16_t*)0x20d4cec2 = htobe16(0x4e20); *(uint32_t*)0x20d4cec4 = 0; *(uint64_t*)0x20d4cec8 = htobe64(0); *(uint64_t*)0x20d4ced0 = htobe64(1); *(uint32_t*)0x20d4ced8 = 0; *(uint16_t*)0x20d4cee0 = 2; *(uint16_t*)0x20d4cee2 = 1; *(uint32_t*)0x20d4cee4 = htobe32(0x4d2); *(uint8_t*)0x20d4cee8 = 0; *(uint8_t*)0x20d4cee9 = 0; *(uint8_t*)0x20d4ceea = 0; *(uint8_t*)0x20d4ceeb = 2; *(uint32_t*)0x20d4ceec = 0; *(uint16_t*)0x20d4cef0 = 5; *(uint16_t*)0x20d4cef2 = 5; *(uint8_t*)0x20d4cef4 = 0; *(uint8_t*)0x20d4cef5 = 0; *(uint16_t*)0x20d4cef6 = 0; *(uint16_t*)0x20d4cef8 = 0xa; *(uint16_t*)0x20d4cefa = htobe16(0x4e20); *(uint32_t*)0x20d4cefc = 0; *(uint8_t*)0x20d4cf00 = 0xfe; *(uint8_t*)0x20d4cf01 = 0x80; *(uint8_t*)0x20d4cf02 = 0; *(uint8_t*)0x20d4cf03 = 0; *(uint8_t*)0x20d4cf04 = 0; *(uint8_t*)0x20d4cf05 = 0; *(uint8_t*)0x20d4cf06 = 0; *(uint8_t*)0x20d4cf07 = 0; *(uint8_t*)0x20d4cf08 = 0; *(uint8_t*)0x20d4cf09 = 0; *(uint8_t*)0x20d4cf0a = 0; *(uint8_t*)0x20d4cf0b = 0; *(uint8_t*)0x20d4cf0c = 0; *(uint8_t*)0x20d4cf0d = 0; *(uint8_t*)0x20d4cf0e = 0; *(uint8_t*)0x20d4cf0f = 0xbb; *(uint32_t*)0x20d4cf10 = 0; syscall(__NR_sendmsg, r[0], 0x205f5000, 0); } int main() { for (;;) { loop(); } }