// https://syzkaller.appspot.com/bug?id=5352e0c8a505e714690340f9d21cdaa8c098e3c4 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include const int kInitNetNsFd = 239; static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto) { return syscall(__NR_socket, domain, type, proto); } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = -1; res = syz_init_net_socket(0x27, 1, 1); if (res != -1) r[0] = res; *(uint16_t*)0x20000040 = 0x27; *(uint32_t*)0x20000044 = 0; *(uint32_t*)0x20000048 = 0; *(uint32_t*)0x2000004c = 0; *(uint8_t*)0x20000050 = 0; *(uint8_t*)0x20000051 = 0; memcpy((void*)0x20000052, "\xac\x41\xd1\xc4\x5d\x71\xd3\xaf\x05\x41\x82\xa9\xa6\xfd\xfe\xbb\xf3" "\x55\x0b\x22\x09\x89\x5f\x34\x8f\x8f\xc6\x71\x6e\x08\xd1\x36\x4a\xd5" "\x52\x6c\x6e\x89\x8c\xbb\x38\xc3\x10\xd3\x2b\x6a\x32\x17\xfa\x0c\xb9" "\xe4\xca\xfe\x05\x69\x94\x2f\x46\x4d\xe7\x18\x8b", 63); *(uint64_t*)0x20000098 = 0; syscall(__NR_bind, r[0], 0x20000040ul, 0x60ul); res = -1; res = syz_init_net_socket(0x27, 1, 1); if (res != -1) r[1] = res; *(uint16_t*)0x20000040 = 0x27; *(uint32_t*)0x20000044 = 0; *(uint32_t*)0x20000048 = 0; *(uint32_t*)0x2000004c = 0; *(uint8_t*)0x20000050 = 0; *(uint8_t*)0x20000051 = 0; memcpy((void*)0x20000052, "\xac\x41\xd1\xc4\x5d\x71\xd3\xaf\x05\x41\x82\xa9\xa6\xfd\xfe\xbb\xf3" "\x55\x0b\x22\x09\x89\x5f\x34\x8f\x8f\xc6\x71\x6e\x08\xd1\x36\x4a\xd5" "\x52\x6c\x6e\x89\x8c\xbb\x38\xc3\x10\xd3\x2b\x6a\x32\x17\xfa\x0c\xb9" "\xe4\xca\xfe\x05\x69\x94\x2f\x46\x4d\xe7\x18\x8b", 63); *(uint64_t*)0x20000098 = 0; syscall(__NR_bind, r[1], 0x20000040ul, 0x60ul); return 0; }