// https://syzkaller.appspot.com/bug?id=de6519e18a472f06a6b530c84c3be8a29c554900 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include static void test(); void loop() { while (1) { test(); } } #ifndef __NR_bpf #define __NR_bpf 321 #endif long r[55]; void test() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul); *(uint16_t*)0x20001000 = (uint16_t)0x2; *(uint16_t*)0x20001002 = (uint16_t)0x234e; *(uint32_t*)0x20001004 = (uint32_t)0x0; *(uint8_t*)0x20001008 = (uint8_t)0x0; *(uint8_t*)0x20001009 = (uint8_t)0x0; *(uint8_t*)0x2000100a = (uint8_t)0x0; *(uint8_t*)0x2000100b = (uint8_t)0x0; *(uint8_t*)0x2000100c = (uint8_t)0x0; *(uint8_t*)0x2000100d = (uint8_t)0x0; *(uint8_t*)0x2000100e = (uint8_t)0x0; *(uint8_t*)0x2000100f = (uint8_t)0x0; r[13] = syscall(__NR_bind, r[1], 0x20001000ul, 0x10ul); r[14] = syscall(__NR_listen, r[1], 0x1ul); r[15] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul); *(uint32_t*)0x20105000 = (uint32_t)0x1; *(uint32_t*)0x20105004 = (uint32_t)0x2; *(uint64_t*)0x20105008 = (uint64_t)0x20414ff0; *(uint64_t*)0x20105010 = (uint64_t)0x20ef4ffa; *(uint32_t*)0x20105018 = (uint32_t)0x1; *(uint32_t*)0x2010501c = (uint32_t)0x80; *(uint64_t*)0x20105020 = (uint64_t)0x2000a000; *(uint32_t*)0x20105028 = (uint32_t)0x0; *(uint32_t*)0x2010502c = (uint32_t)0x0; *(uint8_t*)0x20414ff0 = (uint8_t)0x8db7; *(uint8_t*)0x20414ff1 = (uint8_t)0x0; *(uint16_t*)0x20414ff2 = (uint16_t)0x0; *(uint32_t*)0x20414ff4 = (uint32_t)0xfffffffffffffffe; *(uint8_t*)0x20414ff8 = (uint8_t)0xd395; *(uint8_t*)0x20414ff9 = (uint8_t)0x0; *(uint16_t*)0x20414ffa = (uint16_t)0x0; *(uint32_t*)0x20414ffc = (uint32_t)0x0; memcpy((void*)0x20ef4ffa, "\x73\x79\x73\x65\x4f\x00", 6); r[34] = syscall(__NR_bpf, 0x5ul, 0x20105000ul, 0x30ul); r[35] = syscall(__NR_socket, 0x29ul, 0x2ul, 0x0ul); *(uint32_t*)0x207d7ff8 = r[1]; *(uint32_t*)0x207d7ffc = r[34]; r[38] = syscall(__NR_ioctl, r[35], 0x89e0ul, 0x207d7ff8ul); *(uint16_t*)0x200d1ff0 = (uint16_t)0x2; *(uint16_t*)0x200d1ff2 = (uint16_t)0x234e; *(uint32_t*)0x200d1ff4 = (uint32_t)0x0; *(uint8_t*)0x200d1ff8 = (uint8_t)0x0; *(uint8_t*)0x200d1ff9 = (uint8_t)0x0; *(uint8_t*)0x200d1ffa = (uint8_t)0x0; *(uint8_t*)0x200d1ffb = (uint8_t)0x0; *(uint8_t*)0x200d1ffc = (uint8_t)0x0; *(uint8_t*)0x200d1ffd = (uint8_t)0x0; *(uint8_t*)0x200d1ffe = (uint8_t)0x0; *(uint8_t*)0x200d1fff = (uint8_t)0x0; r[50] = syscall(__NR_connect, r[15], 0x200d1ff0ul, 0x10ul); r[51] = syscall(__NR_socket, 0x2ul, 0x40000000000806ul, 0x0ul); memcpy((void*)0x2000d000, "\x6c\x6f\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 16); *(uint16_t*)0x2000d010 = (uint16_t)0xfffffffffffffffd; r[54] = syscall(__NR_ioctl, r[51], 0x8914ul, 0x2000d000ul); } int main() { loop(); return 0; }