// https://syzkaller.appspot.com/bug?id=a565654c68511a745c2a7ebc8ecc7885cd7a2f55 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_getpid #define __NR_getpid 172 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_process_vm_writev #define __NR_process_vm_writev 271 #endif uint64_t r[1] = {0x0}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; res = syscall(__NR_getpid); if (res != -1) r[0] = res; *(uint64_t*)0x20000200 = 0x20000000; *(uint64_t*)0x20000208 = 0x5e; *(uint64_t*)0x20000210 = 0x20000080; *(uint64_t*)0x20000218 = 0x25; *(uint64_t*)0x20000220 = 0x20000100; *(uint64_t*)0x20000228 = 0xe0; *(uint64_t*)0x200002c0 = 0x20000340; *(uint64_t*)0x200002c8 = 0xfffffc1c; *(uint64_t*)0x200002d0 = 0x20000240; *(uint64_t*)0x200002d8 = 0x62; syscall(__NR_process_vm_writev, /*pid=*/r[0], /*loc_vec=*/0x20000200ul, /*loc_vlen=*/0x43ul, /*rem_vec=*/0x200002c0ul, /*rem_vlen=*/1ul, /*flags=*/0ul); return 0; }