// https://syzkaller.appspot.com/bug?id=d8f929a12de794d8a315fca310adc9a24eb9c881 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include __attribute__((noreturn)) static void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } } #include #include #include #include #include #include #include #include #include #include const int kFailStatus = 67; const int kRetryStatus = 69; static void fail(const char* msg, ...) { int e = errno; va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus); } static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* uctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { _longjmp(segv_env, 1); } doexit(sig); } static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static void use_temporary_dir() { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) fail("failed to mkdtemp"); if (chmod(tmpdir, 0777)) fail("failed to chmod"); if (chdir(tmpdir)) fail("failed to chdir"); } long r[2]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 2, 1, 0); NONFAILING(*(uint32_t*)0x20745000 = 0x10); syscall(__NR_getsockopt, r[0], 0, 0x29, 0x20000000, 0x20745000); r[1] = syscall(__NR_socket, 2, 0x803, 2); NONFAILING(memcpy((void*)0x20002000, "\x6e\x61\x74\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 32)); NONFAILING(*(uint32_t*)0x20002020 = 0x1b); NONFAILING(*(uint32_t*)0x20002024 = 4); NONFAILING(*(uint32_t*)0x20002028 = 0x2a0); NONFAILING(*(uint32_t*)0x2000202c = 0); NONFAILING(*(uint32_t*)0x20002030 = 0); NONFAILING(*(uint32_t*)0x20002034 = -1); NONFAILING(*(uint32_t*)0x20002038 = 0); NONFAILING(*(uint32_t*)0x2000203c = 0); NONFAILING(*(uint32_t*)0x20002040 = 0); NONFAILING(*(uint32_t*)0x20002044 = 0); NONFAILING(*(uint32_t*)0x20002048 = -1); NONFAILING(*(uint32_t*)0x2000204c = 0); NONFAILING(*(uint32_t*)0x20002050 = 0); NONFAILING(*(uint32_t*)0x20002054 = 4); NONFAILING(*(uint64_t*)0x20002058 = 0x20003000); NONFAILING(*(uint8_t*)0x20002060 = 0); NONFAILING(*(uint8_t*)0x20002061 = 0); NONFAILING(*(uint8_t*)0x20002062 = 0); NONFAILING(*(uint8_t*)0x20002063 = 0); NONFAILING(*(uint8_t*)0x20002064 = 0); NONFAILING(*(uint8_t*)0x20002065 = 0); NONFAILING(*(uint8_t*)0x20002066 = 0); NONFAILING(*(uint8_t*)0x20002067 = 0); NONFAILING(*(uint8_t*)0x20002068 = 0); NONFAILING(*(uint8_t*)0x20002069 = 0); NONFAILING(*(uint8_t*)0x2000206a = 0); NONFAILING(*(uint8_t*)0x2000206b = 0); NONFAILING(*(uint8_t*)0x2000206c = 0); NONFAILING(*(uint8_t*)0x2000206d = 0); NONFAILING(*(uint8_t*)0x2000206e = 0); NONFAILING(*(uint8_t*)0x2000206f = 0); NONFAILING(*(uint8_t*)0x20002070 = 0); NONFAILING(*(uint8_t*)0x20002071 = 0); NONFAILING(*(uint8_t*)0x20002072 = 0); NONFAILING(*(uint8_t*)0x20002073 = 0); NONFAILING(*(uint8_t*)0x20002074 = 0); NONFAILING(*(uint8_t*)0x20002075 = 0); NONFAILING(*(uint8_t*)0x20002076 = 0); NONFAILING(*(uint8_t*)0x20002077 = 0); NONFAILING(*(uint8_t*)0x20002078 = 0); NONFAILING(*(uint8_t*)0x20002079 = 0); NONFAILING(*(uint8_t*)0x2000207a = 0); NONFAILING(*(uint8_t*)0x2000207b = 0); NONFAILING(*(uint8_t*)0x2000207c = 0); NONFAILING(*(uint8_t*)0x2000207d = 0); NONFAILING(*(uint8_t*)0x2000207e = 0); NONFAILING(*(uint8_t*)0x2000207f = 0); NONFAILING(*(uint8_t*)0x20002080 = 0); NONFAILING(*(uint8_t*)0x20002081 = 0); NONFAILING(*(uint8_t*)0x20002082 = 0); NONFAILING(*(uint8_t*)0x20002083 = 0); NONFAILING(*(uint8_t*)0x20002084 = 0); NONFAILING(*(uint8_t*)0x20002085 = 0); NONFAILING(*(uint8_t*)0x20002086 = 0); NONFAILING(*(uint8_t*)0x20002087 = 0); NONFAILING(*(uint8_t*)0x20002088 = 0); NONFAILING(*(uint8_t*)0x20002089 = 0); NONFAILING(*(uint8_t*)0x2000208a = 0); NONFAILING(*(uint8_t*)0x2000208b = 0); NONFAILING(*(uint8_t*)0x2000208c = 0); NONFAILING(*(uint8_t*)0x2000208d = 0); NONFAILING(*(uint8_t*)0x2000208e = 0); NONFAILING(*(uint8_t*)0x2000208f = 0); NONFAILING(*(uint8_t*)0x20002090 = 0); NONFAILING(*(uint8_t*)0x20002091 = 0); NONFAILING(*(uint8_t*)0x20002092 = 0); NONFAILING(*(uint8_t*)0x20002093 = 0); NONFAILING(*(uint8_t*)0x20002094 = 0); NONFAILING(*(uint8_t*)0x20002095 = 0); NONFAILING(*(uint8_t*)0x20002096 = 0); NONFAILING(*(uint8_t*)0x20002097 = 0); NONFAILING(*(uint8_t*)0x20002098 = 0); NONFAILING(*(uint8_t*)0x20002099 = 0); NONFAILING(*(uint8_t*)0x2000209a = 0); NONFAILING(*(uint8_t*)0x2000209b = 0); NONFAILING(*(uint8_t*)0x2000209c = 0); NONFAILING(*(uint8_t*)0x2000209d = 0); NONFAILING(*(uint8_t*)0x2000209e = 0); NONFAILING(*(uint8_t*)0x2000209f = 0); NONFAILING(*(uint8_t*)0x200020a0 = 0); NONFAILING(*(uint8_t*)0x200020a1 = 0); NONFAILING(*(uint8_t*)0x200020a2 = 0); NONFAILING(*(uint8_t*)0x200020a3 = 0); NONFAILING(*(uint8_t*)0x200020a4 = 0); NONFAILING(*(uint8_t*)0x200020a5 = 0); NONFAILING(*(uint8_t*)0x200020a6 = 0); NONFAILING(*(uint8_t*)0x200020a7 = 0); NONFAILING(*(uint8_t*)0x200020a8 = 0); NONFAILING(*(uint8_t*)0x200020a9 = 0); NONFAILING(*(uint8_t*)0x200020aa = 0); NONFAILING(*(uint8_t*)0x200020ab = 0); NONFAILING(*(uint8_t*)0x200020ac = 0); NONFAILING(*(uint8_t*)0x200020ad = 0); NONFAILING(*(uint8_t*)0x200020ae = 0); NONFAILING(*(uint8_t*)0x200020af = 0); NONFAILING(*(uint8_t*)0x200020b0 = 0); NONFAILING(*(uint8_t*)0x200020b1 = 0); NONFAILING(*(uint8_t*)0x200020b2 = 0); NONFAILING(*(uint8_t*)0x200020b3 = 0); NONFAILING(*(uint32_t*)0x200020b4 = 0); NONFAILING(*(uint16_t*)0x200020b8 = 0x70); NONFAILING(*(uint16_t*)0x200020ba = 0x98); NONFAILING(*(uint32_t*)0x200020bc = 0); NONFAILING(*(uint64_t*)0x200020c0 = 0); NONFAILING(*(uint64_t*)0x200020c8 = 0); NONFAILING(*(uint16_t*)0x200020d0 = 0x28); NONFAILING(memcpy((void*)0x200020d2, "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00", 29)); NONFAILING(*(uint8_t*)0x200020ef = 0); NONFAILING(*(uint32_t*)0x200020f0 = 0xfffffffe); NONFAILING(*(uint32_t*)0x200020f8 = htobe32(-1)); NONFAILING(*(uint8_t*)0x200020fc = 0xac); NONFAILING(*(uint8_t*)0x200020fd = 0x14); NONFAILING(*(uint8_t*)0x200020fe = 0); NONFAILING(*(uint8_t*)0x200020ff = 0xaa); NONFAILING(*(uint32_t*)0x20002100 = htobe32(0)); NONFAILING(*(uint32_t*)0x20002104 = htobe32(0)); NONFAILING(memcpy( (void*)0x20002108, "\x69\x70\x36\x67\x72\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16)); NONFAILING(memcpy( (void*)0x20002118, "\x76\x63\x61\x6e\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16)); NONFAILING(*(uint8_t*)0x20002128 = 0); NONFAILING(*(uint8_t*)0x20002129 = 0); NONFAILING(*(uint8_t*)0x2000212a = 0); NONFAILING(*(uint8_t*)0x2000212b = 0); NONFAILING(*(uint8_t*)0x2000212c = 0); NONFAILING(*(uint8_t*)0x2000212d = 0); NONFAILING(*(uint8_t*)0x2000212e = 0); NONFAILING(*(uint8_t*)0x2000212f = 0); NONFAILING(*(uint8_t*)0x20002130 = 0); NONFAILING(*(uint8_t*)0x20002131 = 0); NONFAILING(*(uint8_t*)0x20002132 = 0); NONFAILING(*(uint8_t*)0x20002133 = 0); NONFAILING(*(uint8_t*)0x20002134 = 0); NONFAILING(*(uint8_t*)0x20002135 = 0); NONFAILING(*(uint8_t*)0x20002136 = 0); NONFAILING(*(uint8_t*)0x20002137 = 0); NONFAILING(*(uint8_t*)0x20002138 = 0); NONFAILING(*(uint8_t*)0x20002139 = 0); NONFAILING(*(uint8_t*)0x2000213a = 0); NONFAILING(*(uint8_t*)0x2000213b = 0); NONFAILING(*(uint8_t*)0x2000213c = 0); NONFAILING(*(uint8_t*)0x2000213d = 0); NONFAILING(*(uint8_t*)0x2000213e = 0); NONFAILING(*(uint8_t*)0x2000213f = 0); NONFAILING(*(uint8_t*)0x20002140 = 0); NONFAILING(*(uint8_t*)0x20002141 = 0); NONFAILING(*(uint8_t*)0x20002142 = 0); NONFAILING(*(uint8_t*)0x20002143 = 0); NONFAILING(*(uint8_t*)0x20002144 = 0); NONFAILING(*(uint8_t*)0x20002145 = 0); NONFAILING(*(uint8_t*)0x20002146 = 0); NONFAILING(*(uint8_t*)0x20002147 = 0); NONFAILING(*(uint16_t*)0x20002148 = 0); NONFAILING(*(uint8_t*)0x2000214a = 0); NONFAILING(*(uint8_t*)0x2000214b = 0); NONFAILING(*(uint32_t*)0x2000214c = 0); NONFAILING(*(uint16_t*)0x20002150 = 0x70); NONFAILING(*(uint16_t*)0x20002152 = 0xa8); NONFAILING(*(uint32_t*)0x20002154 = 0); NONFAILING(*(uint64_t*)0x20002158 = 0); NONFAILING(*(uint64_t*)0x20002160 = 0); NONFAILING(*(uint16_t*)0x20002168 = 0x38); NONFAILING(memcpy((void*)0x2000216a, "\x53\x4e\x41\x54\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00", 29)); NONFAILING(*(uint8_t*)0x20002187 = 0); NONFAILING(*(uint32_t*)0x20002188 = 1); NONFAILING(*(uint32_t*)0x2000218c = 0); NONFAILING(*(uint32_t*)0x20002190 = htobe32(0xe0000002)); NONFAILING(*(uint32_t*)0x20002194 = htobe32(0xe0000001)); NONFAILING(*(uint16_t*)0x20002198 = 0); NONFAILING(*(uint16_t*)0x2000219a = 0); NONFAILING(*(uint8_t*)0x200021a0 = 0); NONFAILING(*(uint8_t*)0x200021a1 = 0); NONFAILING(*(uint8_t*)0x200021a2 = 0); NONFAILING(*(uint8_t*)0x200021a3 = 0); NONFAILING(*(uint8_t*)0x200021a4 = 0); NONFAILING(*(uint8_t*)0x200021a5 = 0); NONFAILING(*(uint8_t*)0x200021a6 = 0); NONFAILING(*(uint8_t*)0x200021a7 = 0); NONFAILING(*(uint8_t*)0x200021a8 = 0); NONFAILING(*(uint8_t*)0x200021a9 = 0); NONFAILING(*(uint8_t*)0x200021aa = 0); NONFAILING(*(uint8_t*)0x200021ab = 0); NONFAILING(*(uint8_t*)0x200021ac = 0); NONFAILING(*(uint8_t*)0x200021ad = 0); NONFAILING(*(uint8_t*)0x200021ae = 0); NONFAILING(*(uint8_t*)0x200021af = 0); NONFAILING(*(uint8_t*)0x200021b0 = 0); NONFAILING(*(uint8_t*)0x200021b1 = 0); NONFAILING(*(uint8_t*)0x200021b2 = 0); NONFAILING(*(uint8_t*)0x200021b3 = 0); NONFAILING(*(uint8_t*)0x200021b4 = 0); NONFAILING(*(uint8_t*)0x200021b5 = 0); NONFAILING(*(uint8_t*)0x200021b6 = 0); NONFAILING(*(uint8_t*)0x200021b7 = 0); NONFAILING(*(uint8_t*)0x200021b8 = 0); NONFAILING(*(uint8_t*)0x200021b9 = 0); NONFAILING(*(uint8_t*)0x200021ba = 0); NONFAILING(*(uint8_t*)0x200021bb = 0); NONFAILING(*(uint8_t*)0x200021bc = 0); NONFAILING(*(uint8_t*)0x200021bd = 0); NONFAILING(*(uint8_t*)0x200021be = 0); NONFAILING(*(uint8_t*)0x200021bf = 0); NONFAILING(*(uint8_t*)0x200021c0 = 0); NONFAILING(*(uint8_t*)0x200021c1 = 0); NONFAILING(*(uint8_t*)0x200021c2 = 0); NONFAILING(*(uint8_t*)0x200021c3 = 0); NONFAILING(*(uint8_t*)0x200021c4 = 0); NONFAILING(*(uint8_t*)0x200021c5 = 0); NONFAILING(*(uint8_t*)0x200021c6 = 0); NONFAILING(*(uint8_t*)0x200021c7 = 0); NONFAILING(*(uint8_t*)0x200021c8 = 0); NONFAILING(*(uint8_t*)0x200021c9 = 0); NONFAILING(*(uint8_t*)0x200021ca = 0); NONFAILING(*(uint8_t*)0x200021cb = 0); NONFAILING(*(uint8_t*)0x200021cc = 0); NONFAILING(*(uint8_t*)0x200021cd = 0); NONFAILING(*(uint8_t*)0x200021ce = 0); NONFAILING(*(uint8_t*)0x200021cf = 0); NONFAILING(*(uint8_t*)0x200021d0 = 0); NONFAILING(*(uint8_t*)0x200021d1 = 0); NONFAILING(*(uint8_t*)0x200021d2 = 0); NONFAILING(*(uint8_t*)0x200021d3 = 0); NONFAILING(*(uint8_t*)0x200021d4 = 0); NONFAILING(*(uint8_t*)0x200021d5 = 0); NONFAILING(*(uint8_t*)0x200021d6 = 0); NONFAILING(*(uint8_t*)0x200021d7 = 0); NONFAILING(*(uint8_t*)0x200021d8 = 0); NONFAILING(*(uint8_t*)0x200021d9 = 0); NONFAILING(*(uint8_t*)0x200021da = 0); NONFAILING(*(uint8_t*)0x200021db = 0); NONFAILING(*(uint8_t*)0x200021dc = 0); NONFAILING(*(uint8_t*)0x200021dd = 0); NONFAILING(*(uint8_t*)0x200021de = 0); NONFAILING(*(uint8_t*)0x200021df = 0); NONFAILING(*(uint8_t*)0x200021e0 = 0); NONFAILING(*(uint8_t*)0x200021e1 = 0); NONFAILING(*(uint8_t*)0x200021e2 = 0); NONFAILING(*(uint8_t*)0x200021e3 = 0); NONFAILING(*(uint8_t*)0x200021e4 = 0); NONFAILING(*(uint8_t*)0x200021e5 = 0); NONFAILING(*(uint8_t*)0x200021e6 = 0); NONFAILING(*(uint8_t*)0x200021e7 = 0); NONFAILING(*(uint8_t*)0x200021e8 = 0); NONFAILING(*(uint8_t*)0x200021e9 = 0); NONFAILING(*(uint8_t*)0x200021ea = 0); NONFAILING(*(uint8_t*)0x200021eb = 0); NONFAILING(*(uint8_t*)0x200021ec = 0); NONFAILING(*(uint8_t*)0x200021ed = 0); NONFAILING(*(uint8_t*)0x200021ee = 0); NONFAILING(*(uint8_t*)0x200021ef = 0); NONFAILING(*(uint8_t*)0x200021f0 = 0); NONFAILING(*(uint8_t*)0x200021f1 = 0); NONFAILING(*(uint8_t*)0x200021f2 = 0); NONFAILING(*(uint8_t*)0x200021f3 = 0); NONFAILING(*(uint32_t*)0x200021f4 = 0); NONFAILING(*(uint16_t*)0x200021f8 = 0x70); NONFAILING(*(uint16_t*)0x200021fa = 0xb8); NONFAILING(*(uint32_t*)0x200021fc = 0); NONFAILING(*(uint64_t*)0x20002200 = 0); NONFAILING(*(uint64_t*)0x20002208 = 0); NONFAILING(*(uint16_t*)0x20002210 = 0x48); NONFAILING(memcpy((void*)0x20002212, "\x54\x45\x45\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00", 29)); NONFAILING(*(uint8_t*)0x2000222f = 1); NONFAILING(*(uint32_t*)0x20002230 = htobe32(0x7f000001)); NONFAILING(*(uint8_t*)0x20002240 = 0x73); NONFAILING(*(uint8_t*)0x20002241 = 0x79); NONFAILING(*(uint8_t*)0x20002242 = 0x7a); NONFAILING(*(uint8_t*)0x20002243 = 0); NONFAILING(*(uint8_t*)0x20002244 = 0); NONFAILING(*(uint64_t*)0x20002250 = 0); NONFAILING(*(uint32_t*)0x20002258 = htobe32(0)); NONFAILING(*(uint8_t*)0x2000225c = 0xac); NONFAILING(*(uint8_t*)0x2000225d = 0x14); NONFAILING(*(uint8_t*)0x2000225e = 0); NONFAILING(*(uint8_t*)0x2000225f = 0xbb); NONFAILING(*(uint32_t*)0x20002260 = htobe32(0)); NONFAILING(*(uint32_t*)0x20002264 = htobe32(0)); NONFAILING(memcpy( (void*)0x20002268, "\xea\x06\xa2\x8f\x44\x7c\xd3\x66\xb4\xdb\x6f\x4f\x4a\x2d\x3f\x92", 16)); NONFAILING(*(uint8_t*)0x20002278 = 0x73); NONFAILING(*(uint8_t*)0x20002279 = 0x79); NONFAILING(*(uint8_t*)0x2000227a = 0x7a); NONFAILING(*(uint8_t*)0x2000227b = 0); NONFAILING(*(uint8_t*)0x2000227c = 0); NONFAILING(*(uint8_t*)0x20002288 = 0); NONFAILING(*(uint8_t*)0x20002289 = 0); NONFAILING(*(uint8_t*)0x2000228a = 0); NONFAILING(*(uint8_t*)0x2000228b = 0); NONFAILING(*(uint8_t*)0x2000228c = 0); NONFAILING(*(uint8_t*)0x2000228d = 0); NONFAILING(*(uint8_t*)0x2000228e = 0); NONFAILING(*(uint8_t*)0x2000228f = 0); NONFAILING(*(uint8_t*)0x20002290 = 0); NONFAILING(*(uint8_t*)0x20002291 = 0); NONFAILING(*(uint8_t*)0x20002292 = 0); NONFAILING(*(uint8_t*)0x20002293 = 0); NONFAILING(*(uint8_t*)0x20002294 = 0); NONFAILING(*(uint8_t*)0x20002295 = 0); NONFAILING(*(uint8_t*)0x20002296 = 0); NONFAILING(*(uint8_t*)0x20002297 = 0); NONFAILING(*(uint8_t*)0x20002298 = 0); NONFAILING(*(uint8_t*)0x20002299 = 0); NONFAILING(*(uint8_t*)0x2000229a = 0); NONFAILING(*(uint8_t*)0x2000229b = 0); NONFAILING(*(uint8_t*)0x2000229c = 0); NONFAILING(*(uint8_t*)0x2000229d = 0); NONFAILING(*(uint8_t*)0x2000229e = 0); NONFAILING(*(uint8_t*)0x2000229f = 0); NONFAILING(*(uint8_t*)0x200022a0 = 0); NONFAILING(*(uint8_t*)0x200022a1 = 0); NONFAILING(*(uint8_t*)0x200022a2 = 0); NONFAILING(*(uint8_t*)0x200022a3 = 0); NONFAILING(*(uint8_t*)0x200022a4 = 0); NONFAILING(*(uint8_t*)0x200022a5 = 0); NONFAILING(*(uint8_t*)0x200022a6 = 0); NONFAILING(*(uint8_t*)0x200022a7 = 0); NONFAILING(*(uint16_t*)0x200022a8 = 0); NONFAILING(*(uint8_t*)0x200022aa = 0); NONFAILING(*(uint8_t*)0x200022ab = 0); NONFAILING(*(uint32_t*)0x200022ac = 0); NONFAILING(*(uint16_t*)0x200022b0 = 0x70); NONFAILING(*(uint16_t*)0x200022b2 = 0xa8); NONFAILING(*(uint32_t*)0x200022b4 = 0); NONFAILING(*(uint64_t*)0x200022b8 = 0); NONFAILING(*(uint64_t*)0x200022c0 = 0); NONFAILING(*(uint16_t*)0x200022c8 = 0x38); NONFAILING(memcpy((void*)0x200022ca, "\x44\x4e\x41\x54\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00", 29)); NONFAILING(*(uint8_t*)0x200022e7 = 0); NONFAILING(*(uint32_t*)0x200022e8 = 1); NONFAILING(*(uint32_t*)0x200022ec = 0); NONFAILING(*(uint32_t*)0x200022f0 = htobe32(0xe0000002)); NONFAILING(*(uint32_t*)0x200022f4 = htobe32(0)); NONFAILING(*(uint16_t*)0x200022f8 = 0); NONFAILING(*(uint16_t*)0x200022fa = 0); NONFAILING(*(uint64_t*)0x20003000 = 0); NONFAILING(*(uint64_t*)0x20003008 = 0); NONFAILING(*(uint64_t*)0x20003010 = 0); NONFAILING(*(uint64_t*)0x20003018 = 0); NONFAILING(*(uint64_t*)0x20003020 = 0); NONFAILING(*(uint64_t*)0x20003028 = 0); NONFAILING(*(uint64_t*)0x20003030 = 0); NONFAILING(*(uint64_t*)0x20003038 = 0); syscall(__NR_setsockopt, r[1], 0, 0x40, 0x20002000, 0x300); } int main() { install_segv_handler(); use_temporary_dir(); loop(); return 0; }