// https://syzkaller.appspot.com/bug?id=0ac48b55b4d38313c7fe2e32cd63b9b3a802a435 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 0x1eul, 2ul, 0); if (res != -1) r[0] = res; *(uint16_t*)0x20d80f80 = 0x1e; memcpy((void*)0x20d80f82, "\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x7b\xc8\x79\x04\x05\xc7\xba" "\xd6\x2e\x0a\x43\xa6\x32\xed\x49\x38\xd3\x6d\x73\xfb\x8f\x84\x01\xa3" "\xff\x59\x82\x9a\x2b\x0a\xfe\x7c\xe4\x3a\x4b\x24\x70\xa0\xc5\x21\x66" "\x69\xca\x02\x1f\x6f\x65\xdc\xf1\x60\xe7\xe5\x8f\x35\x8c\x00\x02\xf0" "\x00\x01\x58\xd1\x9b\xcb\x31\xf1\x31\x4a\x8e\xf1\x51\x62\x2c\xa5\xbd" "\xb9\xc8\xea\xd2\x00\x00\x77\xae\xb8\x1c\x90\x00\x1d\x6d\x7c\x98\x0e" "\xe5\x90\xc8\xb9\xf7\x0d\xc1\x36\xcb\x18\x4a\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00", 126); syscall(__NR_bind, r[0], 0x20d80f80ul, 0x80ul); res = syscall(__NR_socket, 0x1eul, 2ul, 0); if (res != -1) r[1] = res; *(uint64_t*)0x20000940 = 0x20000140; *(uint16_t*)0x20000140 = 0x1e; *(uint8_t*)0x20000142 = 1; *(uint8_t*)0x20000143 = 0; *(uint32_t*)0x20000144 = 0; *(uint32_t*)0x20000148 = 0; *(uint32_t*)0x2000014c = 2; *(uint32_t*)0x20000948 = 0x10; *(uint64_t*)0x20000950 = 0; *(uint64_t*)0x20000958 = 0; *(uint64_t*)0x20000960 = 0; *(uint64_t*)0x20000968 = 0; *(uint32_t*)0x20000970 = 0; syscall(__NR_sendmsg, r[1], 0x20000940ul, 0ul); return 0; }