// https://syzkaller.appspot.com/bug?id=826185a3ca17eb363147ce23a041ca1389b89ce3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; memcpy((void*)0x20000280, "/dev/vim2m\000", 11); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000280ul, 2ul, 0ul); if (res != -1) r[0] = res; *(uint32_t*)0x200003c0 = 0; *(uint32_t*)0x200003c4 = -1; *(uint32_t*)0x200003c8 = 1; *(uint32_t*)0x200003d0 = 2; *(uint32_t*)0x200003d8 = 0; *(uint32_t*)0x200003dc = 0; *(uint32_t*)0x200003e0 = 0x4000000; *(uint32_t*)0x200003e4 = 0x7fffffff; *(uint32_t*)0x200003e8 = 2; *(uint32_t*)0x200003ec = 0x1200000; *(uint64_t*)0x200003f0 = 0; *(uint32_t*)0x200003f8 = 0; *(uint64_t*)0x20000400 = 0; *(uint8_t*)0x20000408 = 0; *(uint32_t*)0x200004a0 = 0; memset((void*)0x200004a4, 0, 28); syscall(__NR_ioctl, r[0], 0xc100565c, 0x200003c0ul); *(uint32_t*)0x200002c0 = 0; *(uint32_t*)0x200002c4 = 0x7fff; *(uint32_t*)0x200002c8 = 4; *(uint32_t*)0x200002d0 = 2; *(uint16_t*)0x200002d8 = 0; *(uint16_t*)0x200002da = 0; *(uint16_t*)0x200002dc = 0; *(uint16_t*)0x200002de = 0; *(uint16_t*)0x200002e0 = 0; *(uint16_t*)0x200002e2 = 0; *(uint16_t*)0x200002e4 = 0; *(uint16_t*)0x200002e6 = 0; *(uint16_t*)0x200002e8 = 0; *(uint16_t*)0x200002ea = 0; *(uint16_t*)0x200002ec = 0; *(uint16_t*)0x200002ee = 0x8000; *(uint16_t*)0x200002f0 = 0; *(uint16_t*)0x200002f2 = 0; *(uint16_t*)0x200002f4 = 0; *(uint16_t*)0x200002f6 = 0; *(uint16_t*)0x200002f8 = 0; *(uint16_t*)0x200002fa = 0; *(uint16_t*)0x200002fc = 0; *(uint16_t*)0x200002fe = 0; *(uint16_t*)0x20000300 = 0; *(uint16_t*)0x20000302 = 0; *(uint16_t*)0x20000304 = 0; *(uint16_t*)0x20000306 = 0; *(uint16_t*)0x20000308 = 0; *(uint16_t*)0x2000030a = 0; *(uint16_t*)0x2000030c = 0; *(uint16_t*)0x2000030e = 0; *(uint16_t*)0x20000310 = 0; *(uint16_t*)0x20000312 = 0; *(uint16_t*)0x20000314 = 0; *(uint16_t*)0x20000316 = 0; *(uint16_t*)0x20000318 = 0; *(uint16_t*)0x2000031a = 0; *(uint16_t*)0x2000031c = 0; *(uint16_t*)0x2000031e = 0; *(uint16_t*)0x20000320 = 0; *(uint16_t*)0x20000322 = 0; *(uint16_t*)0x20000324 = 0; *(uint16_t*)0x20000326 = 0; *(uint16_t*)0x20000328 = 0; *(uint16_t*)0x2000032a = 0; *(uint16_t*)0x2000032c = 0; *(uint16_t*)0x2000032e = 0; *(uint16_t*)0x20000330 = 0; *(uint16_t*)0x20000332 = 0; *(uint16_t*)0x20000334 = 0; *(uint16_t*)0x20000336 = 0; *(uint16_t*)0x20000338 = 0; *(uint32_t*)0x2000033c = 0; memset((void*)0x20000340, 0, 8); *(uint32_t*)0x200003a0 = 0; memset((void*)0x200003a4, 0, 28); syscall(__NR_ioctl, r[0], 0xc100565c, 0x200002c0ul); return 0; }