// https://syzkaller.appspot.com/bug?id=1d06e732324171bb1b1748e64b71a5536d745f7f // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[0] = syscall(__NR_socket, 0x40000000015ul, 0x5ul, 0x0ul); *(uint16_t*)0x20fc4000 = (uint16_t)0x2; *(uint16_t*)0x20fc4002 = (uint16_t)0x204e; *(uint32_t*)0x20fc4004 = (uint32_t)0x100007f; *(uint8_t*)0x20fc4008 = (uint8_t)0x0; *(uint8_t*)0x20fc4009 = (uint8_t)0x0; *(uint8_t*)0x20fc400a = (uint8_t)0x0; *(uint8_t*)0x20fc400b = (uint8_t)0x0; *(uint8_t*)0x20fc400c = (uint8_t)0x0; *(uint8_t*)0x20fc400d = (uint8_t)0x0; *(uint8_t*)0x20fc400e = (uint8_t)0x0; *(uint8_t*)0x20fc400f = (uint8_t)0x0; syscall(__NR_bind, r[0], 0x20fc4000ul, 0x10ul); *(uint64_t*)0x2020c000 = (uint64_t)0x2085dff0; *(uint32_t*)0x2020c008 = (uint32_t)0x10; *(uint64_t*)0x2020c010 = (uint64_t)0x2019ffc0; *(uint64_t*)0x2020c018 = (uint64_t)0x4; *(uint64_t*)0x2020c020 = (uint64_t)0x20b6a9f8; *(uint64_t*)0x2020c028 = (uint64_t)0x10; *(uint32_t*)0x2020c030 = (uint32_t)0x0; *(uint32_t*)0x2020c038 = (uint32_t)0x0; *(uint16_t*)0x2085dff0 = (uint16_t)0x2; *(uint16_t*)0x2085dff2 = (uint16_t)0x204e; *(uint8_t*)0x2085dff4 = (uint8_t)0xac; *(uint8_t*)0x2085dff5 = (uint8_t)0x14; *(uint8_t*)0x2085dff6 = (uint8_t)0x0; *(uint8_t*)0x2085dff7 = (uint8_t)0xaa; *(uint8_t*)0x2085dff8 = (uint8_t)0x0; *(uint8_t*)0x2085dff9 = (uint8_t)0x0; *(uint8_t*)0x2085dffa = (uint8_t)0x0; *(uint8_t*)0x2085dffb = (uint8_t)0x0; *(uint8_t*)0x2085dffc = (uint8_t)0x0; *(uint8_t*)0x2085dffd = (uint8_t)0x0; *(uint8_t*)0x2085dffe = (uint8_t)0x0; *(uint8_t*)0x2085dfff = (uint8_t)0x0; *(uint64_t*)0x2019ffc0 = (uint64_t)0x20611f04; *(uint64_t*)0x2019ffc8 = (uint64_t)0x0; *(uint64_t*)0x2019ffd0 = (uint64_t)0x201ad000; *(uint64_t*)0x2019ffd8 = (uint64_t)0x0; *(uint64_t*)0x2019ffe0 = (uint64_t)0x20071fae; *(uint64_t*)0x2019ffe8 = (uint64_t)0x0; *(uint64_t*)0x2019fff0 = (uint64_t)0x206a5fc0; *(uint64_t*)0x2019fff8 = (uint64_t)0x0; *(uint64_t*)0x20b6a9f8 = (uint64_t)0x10; *(uint32_t*)0x20b6aa00 = (uint32_t)0x114; *(uint32_t*)0x20b6aa04 = (uint32_t)0x1; syscall(__NR_sendmmsg, r[0], 0x2020c000ul, 0x1ul, 0x0ul); } int main() { loop(); return 0; }