// https://syzkaller.appspot.com/bug?id=f7719d3447c91d8806d66d90e757bd9fb3adb206 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include int main(void) { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); *(uint32_t*)0x20000300 = -1; *(uint32_t*)0x20000304 = 2; *(uint32_t*)0x20000308 = 4; *(uint32_t*)0x2000030c = 0x3f; *(uint64_t*)0x20000310 = 0x20000140; *(uint64_t*)0x20000140 = 0x20000080; memcpy((void*)0x20000080, "\xeb\xea\x43\xa1\x20\x37\xeb\x61\x6b\xb5\xe7\xa1\x54\x9a\xc6\x9b\x9d" "\xec\x6a\x1c\x92\x08\x4f\x83\x95\x00\xe6\xe0\xae\xc4\x10\xf0\x96\x22" "\x5d\xc2\xe2\x73\xdf\x3c\x93\x7d\x43\x7b\xee\x09\xad\xec\x4d\xab\xd7" "\xb4\x78\x79\xc5\x36\x3b\x41\xc6\x0e\x62\x52\x32\xf6\x7f\xbb\x10\xa2" "\xfc\xda\x3b\x14\x42\x7b\x6d\xa5\xd2\xde\xfb\x71", 80); *(uint32_t*)0x20000148 = -1; *(uint8_t*)0x2000014c = 1; *(uint32_t*)0x20000150 = 4; *(uint64_t*)0x20000158 = 0x18000000; *(uint64_t*)0x20000160 = 0; *(uint64_t*)0x20000318 = 0; *(uint32_t*)0x20000320 = -1; *(uint32_t*)0x20000324 = 1; *(uint32_t*)0x20000328 = 0x40; *(uint32_t*)0x2000032c = 0xff; *(uint64_t*)0x20000330 = 0x20000200; *(uint64_t*)0x20000200 = 0x20000180; memcpy((void*)0x20000180, "\xba\xd7\xa4\x0e\x14\x91\x93\x8c\xba\x6d\x67\x37\x23\x7c\x26\xd2\xfb" "\x6c\x6e\x29\x99\xae\x9f\x89\x99\xb2\xe3\x50\xf0\x16\x8f\x52\x51\x8c" "\x46\xf2\xf3\xfc\xf6\x9f\x87\x79\x09\x2a\x53\x69\x8b\x2c\x1c\xba\x8c" "\x95\xd6\x06\xbc\x48\x6f\x5f\xe4\x7d\xa0\x0e\x99\x26\xc0\x79\x31\xa9" "\xbf\xf5\x7d\x97\x48\x75\x40\xca\x7f\x26\x39\x22", 80); *(uint32_t*)0x20000208 = 0x1ff; *(uint8_t*)0x2000020c = 1; *(uint32_t*)0x20000210 = 9; *(uint64_t*)0x20000218 = 5; *(uint64_t*)0x20000220 = 0xc1; *(uint64_t*)0x20000338 = 0; *(uint32_t*)0x20000340 = -1; *(uint32_t*)0x20000344 = 1; *(uint32_t*)0x20000348 = 8; *(uint32_t*)0x2000034c = 3; *(uint64_t*)0x20000350 = 0x200002c0; *(uint64_t*)0x200002c0 = 0x20000240; memcpy((void*)0x20000240, "\x9e\x3e\x07\x2d\x22\xdf\x28\xf4\x8d\x8a\x3b\x0c\xd1\xeb\x8c\xcf\x72" "\xbc\x69\x44\xad\x43\x08\xd1\xc0\x3a\x22\x5a\xb8\x24\x56\x3a\x23\xa6" "\x11\x5a\xbd\x67\xc6\xdf\x04\xd8\x56\x6b\x72\x65\x7c\x7b\x8b\x1f\xe4" "\x9a\x45\xbe\x7f\x95\x84\xed\x0a\x02\xe1\x78\x9a\xc7\x92\x81\x73\x68" "\xd6\x4a\x08\x65\x8b\xc5\x2b\x9c\xb5\xfe\x42\xd4", 80); *(uint32_t*)0x200002c8 = 0xfffffffb; *(uint8_t*)0x200002cc = 0; *(uint32_t*)0x200002d0 = 4; *(uint64_t*)0x200002d8 = 0x81; *(uint64_t*)0x200002e0 = 4; *(uint64_t*)0x20000358 = 0; syscall(SYS_tap_fds, 0x20000300, 3); return 0; }