// https://syzkaller.appspot.com/bug?id=d76b65a985a4cbf10165b3cbb882f59a0ab090bd // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res; res = syscall(__NR_socket, 0x10, 3, 0xc); if (res != -1) r[0] = res; *(uint64_t*)0x20000c80 = 0x20000680; *(uint16_t*)0x20000680 = 0x10; *(uint16_t*)0x20000682 = 0; *(uint32_t*)0x20000684 = 0; *(uint32_t*)0x20000688 = 0; *(uint32_t*)0x20000c88 = 0xc; *(uint64_t*)0x20000c90 = 0x20000c40; *(uint64_t*)0x20000c40 = 0x20002ac0; *(uint32_t*)0x20002ac0 = 0x18; *(uint8_t*)0x20002ac4 = 0x10; *(uint8_t*)0x20002ac5 = 0; *(uint16_t*)0x20002ac6 = 0; *(uint32_t*)0x20002ac8 = 0; *(uint32_t*)0x20002acc = 0; *(uint8_t*)0x20002ad0 = 0; *(uint8_t*)0x20002ad1 = 0; *(uint16_t*)0x20002ad2 = htobe16(0); *(uint16_t*)0x20002ad4 = 4; *(uint16_t*)0x20002ad6 = 0; *(uint64_t*)0x20000c48 = 0x18; *(uint64_t*)0x20000c98 = 1; *(uint64_t*)0x20000ca0 = 0; *(uint64_t*)0x20000ca8 = 0; *(uint32_t*)0x20000cb0 = 0; syscall(__NR_sendmsg, r[0], 0x20000c80, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }