// https://syzkaller.appspot.com/bug?id=1855ef8b2f9dbca23329412c936dc2ffeb6f32fb // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 0x26ul, 5ul, 0); if (res != -1) r[0] = res; *(uint16_t*)0x20000100 = 0x26; memcpy((void*)0x20000102, "aead\000\000\000\000\000\000\000\000\000\000", 14); *(uint32_t*)0x20000110 = 0; *(uint32_t*)0x20000114 = 0; memcpy((void*)0x20000118, "rfc4106(pcrypt(generic-gcm-aesni))" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000", 64); syscall(__NR_bind, r[0], 0x20000100ul, 0x58ul); res = syscall(__NR_socket, 0xaul, 1ul, 0); if (res != -1) r[1] = res; *(uint32_t*)0x20000100 = 1; syscall(__NR_setsockopt, r[1], 6, 0x13, 0x20000100ul, 4ul); *(uint16_t*)0x20001340 = 0xa; *(uint16_t*)0x20001342 = htobe16(0); *(uint32_t*)0x20001344 = htobe32(0); memset((void*)0x20001348, 0, 16); *(uint32_t*)0x20001358 = 0; syscall(__NR_connect, r[1], 0x20001340ul, 0x75ul); memcpy((void*)0x20000040, "tls\000", 4); syscall(__NR_setsockopt, r[1], 6, 0x1f, 0x20000040ul, 4ul); *(uint16_t*)0x20000180 = 0x304; *(uint16_t*)0x20000182 = 0x34; memcpy((void*)0x20000184, "\xe5\x73\xb0\x37\x5e\x00\x16\xdc", 8); memcpy((void*)0x2000018c, "\xc4\x08\xee\x5d\xfa\x1b\xb5\xf0\x44\xb4\xea\x4a\xb5\x7a\x3a\x93\x29" "\x43\x17\x02\x43\x33\x3b\x60\x85\x93\x35\x87\x82\x86\xb7\xfb", 32); memcpy((void*)0x200001ac, "\x99\x8a\x9d\xe9", 4); memcpy((void*)0x200001b0, "\xff\xff\xff\xff\xff\xff\xff\xfe", 8); syscall(__NR_setsockopt, r[1], 0x11a, 1, 0x20000180ul, 0x38ul); memset((void*)0x20000000, 157, 1); syscall(__NR_sendto, r[1], 0x20000000ul, 0xfef3ul, 0x8000ul, 0ul, 0ul); return 0; }