// https://syzkaller.appspot.com/bug?id=a74718ca902617e6aa7327aa008b25844eccf2d3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #define __syscall syscall static uintptr_t syz_open_pts(void) { int master, slave; if (openpty(&master, &slave, NULL, NULL, NULL) == -1) return -1; if (dup2(master, master + 100) != -1) close(master); return slave; } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); intptr_t res = 0; res = syz_open_pts(); if (res != -1) r[0] = res; memcpy((void*)0x20000040, "\xe8\x62\xf7\xf4\xa0\xaf\x2c\xa7\x5f\xf2\x1f\xb8\x6b\x15\xec\x11\xdf" "\x30\x14\x4c\x07\x52\x6c\xae\x34\xc8\x1d\x94\x0a\x15\x38\xe9\x6c\x97" "\x40\x9f\xeb\xd1\xd0\x69\x6b\x80\x7d\x55\x65\xc2\x9d\x9d\x93\xce\xd0" "\x46\x84\x13\x3c\x4d\x03\x4c\x51\x64\xa7\xa4\xf6\x69\x47\xb3\x76\xc0" "\xb6\xed\x7c\xb2\xc4\xc6\xb8\x6e\x3e\xb9\x14\xa4\x78\x61\x3a\x4e\x48" "\x23\xa2\xb4\xbe\x2d\xc7\x8c\x1f\xd4\xe8\x27\x19\xd9\xe8\xaf\x97\x51" "\x27\xfb\x8b\xac\x3e\x0f\x88\x5a\xac\xf1\x05\x0e\xe8\x57\x3f\xe7\x9e" "\x37\x71\x08\x79\x6b\xaf\x40\xb2\xb6\xb5\xe1\x5e\x88\xe1\x63\xbc\x71" "\xdb\xdd\x5e\xec\x4e\x7f\x01\x24\x3c\x8e\xc4\xe6\x5d\xa4\x03\xef\x11", 153); syscall(SYS_write, r[0], 0x20000040ul, 0x99ul); memcpy((void*)0x20000000, "/dev/wskbd0\000", 12); syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000000ul, 1ul, 0ul); return 0; }