// https://syzkaller.appspot.com/bug?id=00e7f2f74d18727ae04d47f616dcf919a0314f6b // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include long r[2]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 2, 0x80003, 0x87); memcpy((void*)0x203c1000, "\x66\x69\x6c\x74\x65\x72\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint32_t*)0x203c1020 = 0xe; *(uint32_t*)0x203c1024 = 4; *(uint32_t*)0x203c1028 = 0x280; *(uint32_t*)0x203c102c = -1; *(uint32_t*)0x203c1030 = 0; *(uint32_t*)0x203c1034 = 0; *(uint32_t*)0x203c1038 = 0; *(uint32_t*)0x203c103c = -1; *(uint32_t*)0x203c1040 = -1; *(uint32_t*)0x203c1044 = 0; *(uint32_t*)0x203c1048 = 0; *(uint32_t*)0x203c104c = 0; *(uint32_t*)0x203c1050 = -1; *(uint32_t*)0x203c1054 = 4; *(uint64_t*)0x203c1058 = 0x20008fc0; *(uint8_t*)0x203c1060 = 0; *(uint8_t*)0x203c1061 = 0; *(uint8_t*)0x203c1062 = 0; *(uint8_t*)0x203c1063 = 0; *(uint8_t*)0x203c1064 = 0; *(uint8_t*)0x203c1065 = 0; *(uint8_t*)0x203c1066 = 0; *(uint8_t*)0x203c1067 = 0; *(uint8_t*)0x203c1068 = 0; *(uint8_t*)0x203c1069 = 0; *(uint8_t*)0x203c106a = 0; *(uint8_t*)0x203c106b = 0; *(uint8_t*)0x203c106c = 0; *(uint8_t*)0x203c106d = 0; *(uint8_t*)0x203c106e = 0; *(uint8_t*)0x203c106f = 0; *(uint8_t*)0x203c1070 = 0; *(uint8_t*)0x203c1071 = 0; *(uint8_t*)0x203c1072 = 0; *(uint8_t*)0x203c1073 = 0; *(uint8_t*)0x203c1074 = 0; *(uint8_t*)0x203c1075 = 0; *(uint8_t*)0x203c1076 = 0; *(uint8_t*)0x203c1077 = 0; *(uint8_t*)0x203c1078 = 0; *(uint8_t*)0x203c1079 = 0; *(uint8_t*)0x203c107a = 0; *(uint8_t*)0x203c107b = 0; *(uint8_t*)0x203c107c = 0; *(uint8_t*)0x203c107d = 0; *(uint8_t*)0x203c107e = 0; *(uint8_t*)0x203c107f = 0; *(uint8_t*)0x203c1080 = 0; *(uint8_t*)0x203c1081 = 0; *(uint8_t*)0x203c1082 = 0; *(uint8_t*)0x203c1083 = 0; *(uint8_t*)0x203c1084 = 0; *(uint8_t*)0x203c1085 = 0; *(uint8_t*)0x203c1086 = 0; *(uint8_t*)0x203c1087 = 0; *(uint8_t*)0x203c1088 = 0; *(uint8_t*)0x203c1089 = 0; *(uint8_t*)0x203c108a = 0; *(uint8_t*)0x203c108b = 0; *(uint8_t*)0x203c108c = 0; *(uint8_t*)0x203c108d = 0; *(uint8_t*)0x203c108e = 0; *(uint8_t*)0x203c108f = 0; *(uint8_t*)0x203c1090 = 0; *(uint8_t*)0x203c1091 = 0; *(uint8_t*)0x203c1092 = 0; *(uint8_t*)0x203c1093 = 0; *(uint8_t*)0x203c1094 = 0; *(uint8_t*)0x203c1095 = 0; *(uint8_t*)0x203c1096 = 0; *(uint8_t*)0x203c1097 = 0; *(uint8_t*)0x203c1098 = 0; *(uint8_t*)0x203c1099 = 0; *(uint8_t*)0x203c109a = 0; *(uint8_t*)0x203c109b = 0; *(uint8_t*)0x203c109c = 0; *(uint8_t*)0x203c109d = 0; *(uint8_t*)0x203c109e = 0; *(uint8_t*)0x203c109f = 0; *(uint8_t*)0x203c10a0 = 0; *(uint8_t*)0x203c10a1 = 0; *(uint8_t*)0x203c10a2 = 0; *(uint8_t*)0x203c10a3 = 0; *(uint8_t*)0x203c10a4 = 0; *(uint8_t*)0x203c10a5 = 0; *(uint8_t*)0x203c10a6 = 0; *(uint8_t*)0x203c10a7 = 0; *(uint8_t*)0x203c10a8 = 0; *(uint8_t*)0x203c10a9 = 0; *(uint8_t*)0x203c10aa = 0; *(uint8_t*)0x203c10ab = 0; *(uint8_t*)0x203c10ac = 0; *(uint8_t*)0x203c10ad = 0; *(uint8_t*)0x203c10ae = 0; *(uint8_t*)0x203c10af = 0; *(uint8_t*)0x203c10b0 = 0; *(uint8_t*)0x203c10b1 = 0; *(uint8_t*)0x203c10b2 = 0; *(uint8_t*)0x203c10b3 = 0; *(uint32_t*)0x203c10b4 = 0; *(uint16_t*)0x203c10b8 = 0x70; *(uint16_t*)0x203c10ba = 0x98; *(uint32_t*)0x203c10bc = 0; *(uint64_t*)0x203c10c0 = 0; *(uint64_t*)0x203c10c8 = 0; *(uint16_t*)0x203c10d0 = 0x28; memcpy((void*)0x203c10d2, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x203c10ef = 0; *(uint32_t*)0x203c10f0 = 0xfffffffe; *(uint8_t*)0x203c10f8 = 0; *(uint8_t*)0x203c10f9 = 0; *(uint8_t*)0x203c10fa = 0; *(uint8_t*)0x203c10fb = 0; *(uint8_t*)0x203c10fc = 0; *(uint8_t*)0x203c10fd = 0; *(uint8_t*)0x203c10fe = 0; *(uint8_t*)0x203c10ff = 0; *(uint8_t*)0x203c1100 = 0; *(uint8_t*)0x203c1101 = 0; *(uint8_t*)0x203c1102 = 0; *(uint8_t*)0x203c1103 = 0; *(uint8_t*)0x203c1104 = 0; *(uint8_t*)0x203c1105 = 0; *(uint8_t*)0x203c1106 = 0; *(uint8_t*)0x203c1107 = 0; *(uint8_t*)0x203c1108 = 0; *(uint8_t*)0x203c1109 = 0; *(uint8_t*)0x203c110a = 0; *(uint8_t*)0x203c110b = 0; *(uint8_t*)0x203c110c = 0; *(uint8_t*)0x203c110d = 0; *(uint8_t*)0x203c110e = 0; *(uint8_t*)0x203c110f = 0; *(uint8_t*)0x203c1110 = 0; *(uint8_t*)0x203c1111 = 0; *(uint8_t*)0x203c1112 = 0; *(uint8_t*)0x203c1113 = 0; *(uint8_t*)0x203c1114 = 0; *(uint8_t*)0x203c1115 = 0; *(uint8_t*)0x203c1116 = 0; *(uint8_t*)0x203c1117 = 0; *(uint8_t*)0x203c1118 = 0; *(uint8_t*)0x203c1119 = 0; *(uint8_t*)0x203c111a = 0; *(uint8_t*)0x203c111b = 0; *(uint8_t*)0x203c111c = 0; *(uint8_t*)0x203c111d = 0; *(uint8_t*)0x203c111e = 0; *(uint8_t*)0x203c111f = 0; *(uint8_t*)0x203c1120 = 0; *(uint8_t*)0x203c1121 = 0; *(uint8_t*)0x203c1122 = 0; *(uint8_t*)0x203c1123 = 0; *(uint8_t*)0x203c1124 = 0; *(uint8_t*)0x203c1125 = 0; *(uint8_t*)0x203c1126 = 0; *(uint8_t*)0x203c1127 = 0; *(uint8_t*)0x203c1128 = 0; *(uint8_t*)0x203c1129 = 0; *(uint8_t*)0x203c112a = 0; *(uint8_t*)0x203c112b = 0; *(uint8_t*)0x203c112c = 0; *(uint8_t*)0x203c112d = 0; *(uint8_t*)0x203c112e = 0; *(uint8_t*)0x203c112f = 0; *(uint8_t*)0x203c1130 = 0; *(uint8_t*)0x203c1131 = 0; *(uint8_t*)0x203c1132 = 0; *(uint8_t*)0x203c1133 = 0; *(uint8_t*)0x203c1134 = 0; *(uint8_t*)0x203c1135 = 0; *(uint8_t*)0x203c1136 = 0; *(uint8_t*)0x203c1137 = 0; *(uint8_t*)0x203c1138 = 0; *(uint8_t*)0x203c1139 = 0; *(uint8_t*)0x203c113a = 0; *(uint8_t*)0x203c113b = 0; *(uint8_t*)0x203c113c = 0; *(uint8_t*)0x203c113d = 0; *(uint8_t*)0x203c113e = 0; *(uint8_t*)0x203c113f = 0; *(uint8_t*)0x203c1140 = 0; *(uint8_t*)0x203c1141 = 0; *(uint8_t*)0x203c1142 = 0; *(uint8_t*)0x203c1143 = 0; *(uint8_t*)0x203c1144 = 0; *(uint8_t*)0x203c1145 = 0; *(uint8_t*)0x203c1146 = 0; *(uint8_t*)0x203c1147 = 0; *(uint8_t*)0x203c1148 = 0; *(uint8_t*)0x203c1149 = 0; *(uint8_t*)0x203c114a = 0; *(uint8_t*)0x203c114b = 0; *(uint32_t*)0x203c114c = 0; *(uint16_t*)0x203c1150 = 0x70; *(uint16_t*)0x203c1152 = 0xb8; *(uint32_t*)0x203c1154 = 0; *(uint64_t*)0x203c1158 = 0; *(uint64_t*)0x203c1160 = 0; *(uint16_t*)0x203c1168 = 0x48; memcpy((void*)0x203c116a, "\x54\x45\x45\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x203c1187 = 1; *(uint64_t*)0x203c1188 = htobe64(0); *(uint64_t*)0x203c1190 = htobe64(1); memcpy((void*)0x203c1198, "\x62\x63\x73\x66\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint64_t*)0x203c11a8 = 0; *(uint8_t*)0x203c11b0 = 0; *(uint8_t*)0x203c11b1 = 0; *(uint8_t*)0x203c11b2 = 0; *(uint8_t*)0x203c11b3 = 0; *(uint8_t*)0x203c11b4 = 0; *(uint8_t*)0x203c11b5 = 0; *(uint8_t*)0x203c11b6 = 0; *(uint8_t*)0x203c11b7 = 0; *(uint8_t*)0x203c11b8 = 0; *(uint8_t*)0x203c11b9 = 0; *(uint8_t*)0x203c11ba = 0; *(uint8_t*)0x203c11bb = 0; *(uint8_t*)0x203c11bc = 0; *(uint8_t*)0x203c11bd = 0; *(uint8_t*)0x203c11be = 0; *(uint8_t*)0x203c11bf = 0; *(uint8_t*)0x203c11c0 = 0; *(uint8_t*)0x203c11c1 = 0; *(uint8_t*)0x203c11c2 = 0; *(uint8_t*)0x203c11c3 = 0; *(uint8_t*)0x203c11c4 = 0; *(uint8_t*)0x203c11c5 = 0; *(uint8_t*)0x203c11c6 = 0; *(uint8_t*)0x203c11c7 = 0; *(uint8_t*)0x203c11c8 = 0; *(uint8_t*)0x203c11c9 = 0; *(uint8_t*)0x203c11ca = 0; *(uint8_t*)0x203c11cb = 0; *(uint8_t*)0x203c11cc = 0; *(uint8_t*)0x203c11cd = 0; *(uint8_t*)0x203c11ce = 0; *(uint8_t*)0x203c11cf = 0; *(uint8_t*)0x203c11d0 = 0; *(uint8_t*)0x203c11d1 = 0; *(uint8_t*)0x203c11d2 = 0; *(uint8_t*)0x203c11d3 = 0; *(uint8_t*)0x203c11d4 = 0; *(uint8_t*)0x203c11d5 = 0; *(uint8_t*)0x203c11d6 = 0; *(uint8_t*)0x203c11d7 = 0; *(uint8_t*)0x203c11d8 = 0; *(uint8_t*)0x203c11d9 = 0; *(uint8_t*)0x203c11da = 0; *(uint8_t*)0x203c11db = 0; *(uint8_t*)0x203c11dc = 0; *(uint8_t*)0x203c11dd = 0; *(uint8_t*)0x203c11de = 0; *(uint8_t*)0x203c11df = 0; *(uint8_t*)0x203c11e0 = 0; *(uint8_t*)0x203c11e1 = 0; *(uint8_t*)0x203c11e2 = 0; *(uint8_t*)0x203c11e3 = 0; *(uint8_t*)0x203c11e4 = 0; *(uint8_t*)0x203c11e5 = 0; *(uint8_t*)0x203c11e6 = 0; *(uint8_t*)0x203c11e7 = 0; *(uint8_t*)0x203c11e8 = 0; *(uint8_t*)0x203c11e9 = 0; *(uint8_t*)0x203c11ea = 0; *(uint8_t*)0x203c11eb = 0; *(uint8_t*)0x203c11ec = 0; *(uint8_t*)0x203c11ed = 0; *(uint8_t*)0x203c11ee = 0; *(uint8_t*)0x203c11ef = 0; *(uint8_t*)0x203c11f0 = 0; *(uint8_t*)0x203c11f1 = 0; *(uint8_t*)0x203c11f2 = 0; *(uint8_t*)0x203c11f3 = 0; *(uint8_t*)0x203c11f4 = 0; *(uint8_t*)0x203c11f5 = 0; *(uint8_t*)0x203c11f6 = 0; *(uint8_t*)0x203c11f7 = 0; *(uint8_t*)0x203c11f8 = 0; *(uint8_t*)0x203c11f9 = 0; *(uint8_t*)0x203c11fa = 0; *(uint8_t*)0x203c11fb = 0; *(uint8_t*)0x203c11fc = 0; *(uint8_t*)0x203c11fd = 0; *(uint8_t*)0x203c11fe = 0; *(uint8_t*)0x203c11ff = 0; *(uint8_t*)0x203c1200 = 0; *(uint8_t*)0x203c1201 = 0; *(uint8_t*)0x203c1202 = 0; *(uint8_t*)0x203c1203 = 0; *(uint32_t*)0x203c1204 = 0; *(uint16_t*)0x203c1208 = 0x70; *(uint16_t*)0x203c120a = 0x98; *(uint32_t*)0x203c120c = 0; *(uint64_t*)0x203c1210 = 0; *(uint64_t*)0x203c1218 = 0; *(uint16_t*)0x203c1220 = 0x28; memcpy((void*)0x203c1222, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x203c123f = 0; *(uint32_t*)0x203c1240 = 0; *(uint8_t*)0x203c1248 = 0; *(uint8_t*)0x203c1249 = 0; *(uint8_t*)0x203c124a = 0; *(uint8_t*)0x203c124b = 0; *(uint8_t*)0x203c124c = 0; *(uint8_t*)0x203c124d = 0; *(uint8_t*)0x203c124e = 0; *(uint8_t*)0x203c124f = 0; *(uint8_t*)0x203c1250 = 0; *(uint8_t*)0x203c1251 = 0; *(uint8_t*)0x203c1252 = 0; *(uint8_t*)0x203c1253 = 0; *(uint8_t*)0x203c1254 = 0; *(uint8_t*)0x203c1255 = 0; *(uint8_t*)0x203c1256 = 0; *(uint8_t*)0x203c1257 = 0; *(uint8_t*)0x203c1258 = 0; *(uint8_t*)0x203c1259 = 0; *(uint8_t*)0x203c125a = 0; *(uint8_t*)0x203c125b = 0; *(uint8_t*)0x203c125c = 0; *(uint8_t*)0x203c125d = 0; *(uint8_t*)0x203c125e = 0; *(uint8_t*)0x203c125f = 0; *(uint8_t*)0x203c1260 = 0; *(uint8_t*)0x203c1261 = 0; *(uint8_t*)0x203c1262 = 0; *(uint8_t*)0x203c1263 = 0; *(uint8_t*)0x203c1264 = 0; *(uint8_t*)0x203c1265 = 0; *(uint8_t*)0x203c1266 = 0; *(uint8_t*)0x203c1267 = 0; *(uint8_t*)0x203c1268 = 0; *(uint8_t*)0x203c1269 = 0; *(uint8_t*)0x203c126a = 0; *(uint8_t*)0x203c126b = 0; *(uint8_t*)0x203c126c = 0; *(uint8_t*)0x203c126d = 0; *(uint8_t*)0x203c126e = 0; *(uint8_t*)0x203c126f = 0; *(uint8_t*)0x203c1270 = 0; *(uint8_t*)0x203c1271 = 0; *(uint8_t*)0x203c1272 = 0; *(uint8_t*)0x203c1273 = 0; *(uint8_t*)0x203c1274 = 0; *(uint8_t*)0x203c1275 = 0; *(uint8_t*)0x203c1276 = 0; *(uint8_t*)0x203c1277 = 0; *(uint8_t*)0x203c1278 = 0; *(uint8_t*)0x203c1279 = 0; *(uint8_t*)0x203c127a = 0; *(uint8_t*)0x203c127b = 0; *(uint8_t*)0x203c127c = 0; *(uint8_t*)0x203c127d = 0; *(uint8_t*)0x203c127e = 0; *(uint8_t*)0x203c127f = 0; *(uint8_t*)0x203c1280 = 0; *(uint8_t*)0x203c1281 = 0; *(uint8_t*)0x203c1282 = 0; *(uint8_t*)0x203c1283 = 0; *(uint8_t*)0x203c1284 = 0; *(uint8_t*)0x203c1285 = 0; *(uint8_t*)0x203c1286 = 0; *(uint8_t*)0x203c1287 = 0; *(uint8_t*)0x203c1288 = 0; *(uint8_t*)0x203c1289 = 0; *(uint8_t*)0x203c128a = 0; *(uint8_t*)0x203c128b = 0; *(uint8_t*)0x203c128c = 0; *(uint8_t*)0x203c128d = 0; *(uint8_t*)0x203c128e = 0; *(uint8_t*)0x203c128f = 0; *(uint8_t*)0x203c1290 = 0; *(uint8_t*)0x203c1291 = 0; *(uint8_t*)0x203c1292 = 0; *(uint8_t*)0x203c1293 = 0; *(uint8_t*)0x203c1294 = 0; *(uint8_t*)0x203c1295 = 0; *(uint8_t*)0x203c1296 = 0; *(uint8_t*)0x203c1297 = 0; *(uint8_t*)0x203c1298 = 0; *(uint8_t*)0x203c1299 = 0; *(uint8_t*)0x203c129a = 0; *(uint8_t*)0x203c129b = 0; *(uint32_t*)0x203c129c = 0; *(uint16_t*)0x203c12a0 = 0x70; *(uint16_t*)0x203c12a2 = 0x98; *(uint32_t*)0x203c12a4 = 0; *(uint64_t*)0x203c12a8 = 0; *(uint64_t*)0x203c12b0 = 0; *(uint16_t*)0x203c12b8 = 0x28; memcpy((void*)0x203c12ba, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x203c12d7 = 0; *(uint32_t*)0x203c12d8 = 0; *(uint64_t*)0x20008fc0 = 0; *(uint64_t*)0x20008fc8 = 0; *(uint64_t*)0x20008fd0 = 0; *(uint64_t*)0x20008fd8 = 0; *(uint64_t*)0x20008fe0 = 0; *(uint64_t*)0x20008fe8 = 0; *(uint64_t*)0x20008ff0 = 0; *(uint64_t*)0x20008ff8 = 0; syscall(__NR_setsockopt, r[0], 0, 0x40, 0x203c1000, 0x2e0); r[1] = syscall(__NR_socket, 2, 2, 0); *(uint32_t*)0x20e48000 = htobe32(0xe0000001); *(uint8_t*)0x20e48004 = 0xac; *(uint8_t*)0x20e48005 = 0x14; *(uint8_t*)0x20e48006 = 0; *(uint8_t*)0x20e48007 = 0xaa; *(uint32_t*)0x20e48008 = htobe32(-1); syscall(__NR_setsockopt, r[1], 0, 0x27, 0x20e48000, 0xc); } int main() { loop(); return 0; }