// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 6); *(uint64_t*)0x20041000 = 0x2000f000; *(uint32_t*)0x20041008 = 0xc; *(uint64_t*)0x20041010 = 0x205a6ff0; *(uint64_t*)0x20041018 = 1; *(uint64_t*)0x20041020 = 0; *(uint64_t*)0x20041028 = 0; *(uint32_t*)0x20041030 = 0; *(uint16_t*)0x2000f000 = 0x10; *(uint16_t*)0x2000f002 = 0; *(uint32_t*)0x2000f004 = 0; *(uint32_t*)0x2000f008 = 0; *(uint64_t*)0x205a6ff0 = 0x20fe7ec8; *(uint64_t*)0x205a6ff8 = 0x234; *(uint32_t*)0x20fe7ec8 = 0x138; *(uint16_t*)0x20fe7ecc = 0x10; *(uint16_t*)0x20fe7ece = 0x713; *(uint32_t*)0x20fe7ed0 = 0; *(uint32_t*)0x20fe7ed4 = 0; *(uint8_t*)0x20fe7ed8 = 0xfe; *(uint8_t*)0x20fe7ed9 = 0x80; *(uint8_t*)0x20fe7eda = 0; *(uint8_t*)0x20fe7edb = 0; *(uint8_t*)0x20fe7edc = 0; *(uint8_t*)0x20fe7edd = 0; *(uint8_t*)0x20fe7ede = 0; *(uint8_t*)0x20fe7edf = 0; *(uint8_t*)0x20fe7ee0 = 0; *(uint8_t*)0x20fe7ee1 = 0; *(uint8_t*)0x20fe7ee2 = 0; *(uint8_t*)0x20fe7ee3 = 0; *(uint8_t*)0x20fe7ee4 = 0; *(uint8_t*)0x20fe7ee5 = 0; *(uint8_t*)0x20fe7ee6 = 0; *(uint8_t*)0x20fe7ee7 = 0xaa; *(uint32_t*)0x20fe7ee8 = htobe32(0xe0000002); *(uint16_t*)0x20fe7ef8 = 0; *(uint16_t*)0x20fe7efa = htobe16(0); *(uint16_t*)0x20fe7efc = 0; *(uint16_t*)0x20fe7efe = htobe16(0); *(uint16_t*)0x20fe7f00 = 0; *(uint8_t*)0x20fe7f02 = 0; *(uint8_t*)0x20fe7f03 = 0; *(uint8_t*)0x20fe7f04 = 0; *(uint32_t*)0x20fe7f08 = 0; *(uint32_t*)0x20fe7f0c = 0; *(uint32_t*)0x20fe7f10 = htobe32(0xe0000001); *(uint32_t*)0x20fe7f20 = 0; *(uint8_t*)0x20fe7f24 = 0x6c; *(uint8_t*)0x20fe7f28 = -1; *(uint8_t*)0x20fe7f29 = 2; *(uint8_t*)0x20fe7f2a = 0; *(uint8_t*)0x20fe7f2b = 0; *(uint8_t*)0x20fe7f2c = 0; *(uint8_t*)0x20fe7f2d = 0; *(uint8_t*)0x20fe7f2e = 0; *(uint8_t*)0x20fe7f2f = 0; *(uint8_t*)0x20fe7f30 = 0; *(uint8_t*)0x20fe7f31 = 0; *(uint8_t*)0x20fe7f32 = 0; *(uint8_t*)0x20fe7f33 = 0; *(uint8_t*)0x20fe7f34 = 0; *(uint8_t*)0x20fe7f35 = 0; *(uint8_t*)0x20fe7f36 = 0; *(uint8_t*)0x20fe7f37 = 1; *(uint64_t*)0x20fe7f38 = 0; *(uint64_t*)0x20fe7f40 = 0; *(uint64_t*)0x20fe7f48 = 0; *(uint64_t*)0x20fe7f50 = 0; *(uint64_t*)0x20fe7f58 = 0; *(uint64_t*)0x20fe7f60 = 0; *(uint64_t*)0x20fe7f68 = 0; *(uint64_t*)0x20fe7f70 = 0; *(uint64_t*)0x20fe7f78 = 0; *(uint64_t*)0x20fe7f80 = 0; *(uint64_t*)0x20fe7f88 = 0; *(uint64_t*)0x20fe7f90 = 0; *(uint32_t*)0x20fe7f98 = 0; *(uint32_t*)0x20fe7f9c = 0; *(uint32_t*)0x20fe7fa0 = 0; *(uint32_t*)0x20fe7fa4 = 0; *(uint32_t*)0x20fe7fa8 = 0; *(uint16_t*)0x20fe7fac = 0xa; *(uint8_t*)0x20fe7fae = 1; *(uint8_t*)0x20fe7faf = 0; *(uint8_t*)0x20fe7fb0 = 0; *(uint16_t*)0x20fe7fb8 = 0x48; *(uint16_t*)0x20fe7fba = 3; memcpy((void*)0x20fe7fbc, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\xf1\xff\xff\xff\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x20fe7ffc = 0; syscall(__NR_sendmsg, r[0], 0x20041000, 0); } int main() { for (;;) { loop(); } }