// https://syzkaller.appspot.com/bug?id=de6519e18a472f06a6b530c84c3be8a29c554900 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif long r[219]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socketpair, 0x1ul, 0x5ul, 0x0ul, 0x2000dff8ul); if (r[1] != -1) r[2] = *(uint32_t*)0x2000dff8; if (r[1] != -1) r[3] = *(uint32_t*)0x2000dffc; *(uint32_t*)0x20b4cfd0 = (uint32_t)0x1; *(uint32_t*)0x20b4cfd4 = (uint32_t)0x2; *(uint64_t*)0x20b4cfd8 = (uint64_t)0x20ef3000; *(uint64_t*)0x20b4cfe0 = (uint64_t)0x20ccdffa; *(uint32_t*)0x20b4cfe8 = (uint32_t)0x1; *(uint32_t*)0x20b4cfec = (uint32_t)0x80; *(uint64_t*)0x20b4cff0 = (uint64_t)0x2000a000; *(uint32_t*)0x20b4cff8 = (uint32_t)0x0; *(uint32_t*)0x20b4cffc = (uint32_t)0x0; *(uint8_t*)0x20ef3000 = (uint8_t)0x8db7; *(uint8_t*)0x20ef3001 = (uint8_t)0x0; *(uint16_t*)0x20ef3002 = (uint16_t)0x0; *(uint32_t*)0x20ef3004 = (uint32_t)0x0; *(uint8_t*)0x20ef3008 = (uint8_t)0xd395; *(uint8_t*)0x20ef3009 = (uint8_t)0x0; *(uint16_t*)0x20ef300a = (uint16_t)0x0; *(uint32_t*)0x20ef300c = (uint32_t)0x0; memcpy((void*)0x20ccdffa, "\x73\x79\x73\x65\x4f\x00", 6); r[22] = syscall(__NR_bpf, 0x5ul, 0x20b4cfd0ul, 0x30ul); r[23] = syscall(__NR_socket, 0x29ul, 0x5ul, 0x0ul); *(uint32_t*)0x2081cff8 = r[2]; *(uint32_t*)0x2081cffc = r[22]; r[26] = syscall(__NR_ioctl, r[23], 0x89e0ul, 0x2081cff8ul); *(uint64_t*)0x20ed9f10 = (uint64_t)0x2056eff0; *(uint32_t*)0x20ed9f18 = (uint32_t)0x10; *(uint64_t*)0x20ed9f20 = (uint64_t)0x200e0000; *(uint64_t*)0x20ed9f28 = (uint64_t)0x6; *(uint64_t*)0x20ed9f30 = (uint64_t)0x206cdbc8; *(uint64_t*)0x20ed9f38 = (uint64_t)0x7; *(uint32_t*)0x20ed9f40 = (uint32_t)0x4040; *(uint32_t*)0x20ed9f48 = (uint32_t)0x20; *(uint64_t*)0x20ed9f4c = (uint64_t)0x20943000; *(uint32_t*)0x20ed9f54 = (uint32_t)0x10; *(uint64_t*)0x20ed9f5c = (uint64_t)0x20c99fa0; *(uint64_t*)0x20ed9f64 = (uint64_t)0x6; *(uint64_t*)0x20ed9f6c = (uint64_t)0x20c44000; *(uint64_t*)0x20ed9f74 = (uint64_t)0x7; *(uint32_t*)0x20ed9f7c = (uint32_t)0x1; *(uint32_t*)0x20ed9f84 = (uint32_t)0x0; *(uint64_t*)0x20ed9f88 = (uint64_t)0x20a98ff0; *(uint32_t*)0x20ed9f90 = (uint32_t)0x10; *(uint64_t*)0x20ed9f98 = (uint64_t)0x20209000; *(uint64_t*)0x20ed9fa0 = (uint64_t)0x9; *(uint64_t*)0x20ed9fa8 = (uint64_t)0x2096f000; *(uint64_t*)0x20ed9fb0 = (uint64_t)0x2; *(uint32_t*)0x20ed9fb8 = (uint32_t)0x4; *(uint32_t*)0x20ed9fc0 = (uint32_t)0x20; *(uint64_t*)0x20ed9fc4 = (uint64_t)0x20a15000; *(uint32_t*)0x20ed9fcc = (uint32_t)0x10; *(uint64_t*)0x20ed9fd4 = (uint64_t)0x20062f70; *(uint64_t*)0x20ed9fdc = (uint64_t)0x9; *(uint64_t*)0x20ed9fe4 = (uint64_t)0x2058bc3a; *(uint64_t*)0x20ed9fec = (uint64_t)0x5; *(uint32_t*)0x20ed9ff4 = (uint32_t)0x4000000; *(uint32_t*)0x20ed9ffc = (uint32_t)0x7fffffff; *(uint16_t*)0x2056eff0 = (uint16_t)0x4; *(uint16_t*)0x2056eff2 = (uint16_t)0x800; *(uint32_t*)0x2056eff4 = (uint32_t)0x2000000; memcpy((void*)0x2056eff8, "\xc0\xcc\x85\x46\xcc\xa3", 6); *(uint8_t*)0x2056effe = (uint8_t)0x5; *(uint8_t*)0x2056efff = (uint8_t)0x0; *(uint64_t*)0x200e0000 = (uint64_t)0x201f4f61; *(uint64_t*)0x200e0008 = (uint64_t)0x0; *(uint64_t*)0x200e0010 = (uint64_t)0x201d7fa5; *(uint64_t*)0x200e0018 = (uint64_t)0x0; *(uint64_t*)0x200e0020 = (uint64_t)0x205edf6c; *(uint64_t*)0x200e0028 = (uint64_t)0x0; *(uint64_t*)0x200e0030 = (uint64_t)0x202db000; *(uint64_t*)0x200e0038 = (uint64_t)0x0; *(uint64_t*)0x200e0040 = (uint64_t)0x20922000; *(uint64_t*)0x200e0048 = (uint64_t)0x0; *(uint64_t*)0x200e0050 = (uint64_t)0x20a51000; *(uint64_t*)0x200e0058 = (uint64_t)0x0; *(uint64_t*)0x206cdbc8 = (uint64_t)0x10; *(uint32_t*)0x206cdbd0 = (uint32_t)0x0; *(uint32_t*)0x206cdbd4 = (uint32_t)0x8; *(uint64_t*)0x206cdbd8 = (uint64_t)0x10; *(uint32_t*)0x206cdbe0 = (uint32_t)0x186; *(uint32_t*)0x206cdbe4 = (uint32_t)0x200; *(uint64_t*)0x206cdbe8 = (uint64_t)0x10; *(uint32_t*)0x206cdbf0 = (uint32_t)0x18b; *(uint32_t*)0x206cdbf4 = (uint32_t)0x3; *(uint64_t*)0x206cdbf8 = (uint64_t)0x10; *(uint32_t*)0x206cdc00 = (uint32_t)0x107; *(uint32_t*)0x206cdc04 = (uint32_t)0x8000; *(uint64_t*)0x206cdc08 = (uint64_t)0x10; *(uint32_t*)0x206cdc10 = (uint32_t)0x0; *(uint32_t*)0x206cdc14 = (uint32_t)0x4; *(uint64_t*)0x206cdc18 = (uint64_t)0x10; *(uint32_t*)0x206cdc20 = (uint32_t)0xff; *(uint32_t*)0x206cdc24 = (uint32_t)0x8; *(uint64_t*)0x206cdc28 = (uint64_t)0x10; *(uint32_t*)0x206cdc30 = (uint32_t)0x117; *(uint32_t*)0x206cdc34 = (uint32_t)0xffffffffffffffe1; *(uint16_t*)0x20943000 = (uint16_t)0x6; *(uint8_t*)0x20943002 = (uint8_t)0xbb; *(uint8_t*)0x20943003 = (uint8_t)0xbb; *(uint8_t*)0x20943004 = (uint8_t)0xbb; *(uint8_t*)0x20943005 = (uint8_t)0xbb; *(uint8_t*)0x20943006 = (uint8_t)0xbb; *(uint8_t*)0x20943007 = (uint8_t)0x0; *(uint8_t*)0x20943008 = (uint8_t)0x0; *(uint8_t*)0x20943009 = (uint8_t)0x0; *(uint8_t*)0x2094300a = (uint8_t)0x0; *(uint8_t*)0x2094300b = (uint8_t)0x0; *(uint8_t*)0x2094300c = (uint8_t)0x0; *(uint8_t*)0x2094300d = (uint8_t)0x0; *(uint8_t*)0x2094300e = (uint8_t)0x0; *(uint8_t*)0x2094300f = (uint8_t)0x0; *(uint64_t*)0x20c99fa0 = (uint64_t)0x20c7cfa4; *(uint64_t*)0x20c99fa8 = (uint64_t)0x0; *(uint64_t*)0x20c99fb0 = (uint64_t)0x20bd8f28; *(uint64_t*)0x20c99fb8 = (uint64_t)0x0; *(uint64_t*)0x20c99fc0 = (uint64_t)0x20383f16; *(uint64_t*)0x20c99fc8 = (uint64_t)0x0; *(uint64_t*)0x20c99fd0 = (uint64_t)0x201e0000; *(uint64_t*)0x20c99fd8 = (uint64_t)0x0; *(uint64_t*)0x20c99fe0 = (uint64_t)0x20e4e000; *(uint64_t*)0x20c99fe8 = (uint64_t)0x0; *(uint64_t*)0x20c99ff0 = (uint64_t)0x20778000; *(uint64_t*)0x20c99ff8 = (uint64_t)0x0; *(uint64_t*)0x20c44000 = (uint64_t)0x10; *(uint32_t*)0x20c44008 = (uint32_t)0x12f; *(uint32_t*)0x20c4400c = (uint32_t)0x3f; *(uint64_t*)0x20c44010 = (uint64_t)0x10; *(uint32_t*)0x20c44018 = (uint32_t)0x0; *(uint32_t*)0x20c4401c = (uint32_t)0x3; *(uint64_t*)0x20c44020 = (uint64_t)0x10; *(uint32_t*)0x20c44028 = (uint32_t)0x6; *(uint32_t*)0x20c4402c = (uint32_t)0xb37; *(uint64_t*)0x20c44030 = (uint64_t)0x10; *(uint32_t*)0x20c44038 = (uint32_t)0x10b; *(uint32_t*)0x20c4403c = (uint32_t)0x5; *(uint64_t*)0x20c44040 = (uint64_t)0x10; *(uint32_t*)0x20c44048 = (uint32_t)0x110; *(uint32_t*)0x20c4404c = (uint32_t)0x10001; *(uint64_t*)0x20c44050 = (uint64_t)0x10; *(uint32_t*)0x20c44058 = (uint32_t)0x29; *(uint32_t*)0x20c4405c = (uint32_t)0x6; *(uint64_t*)0x20c44060 = (uint64_t)0x10; *(uint32_t*)0x20c44068 = (uint32_t)0x0; *(uint32_t*)0x20c4406c = (uint32_t)0x2; *(uint16_t*)0x20a98ff0 = (uint16_t)0x2; *(uint16_t*)0x20a98ff2 = (uint16_t)0x204e; *(uint32_t*)0x20a98ff4 = (uint32_t)0x100007f; *(uint8_t*)0x20a98ff8 = (uint8_t)0x0; *(uint8_t*)0x20a98ff9 = (uint8_t)0x0; *(uint8_t*)0x20a98ffa = (uint8_t)0x0; *(uint8_t*)0x20a98ffb = (uint8_t)0x0; *(uint8_t*)0x20a98ffc = (uint8_t)0x0; *(uint8_t*)0x20a98ffd = (uint8_t)0x0; *(uint8_t*)0x20a98ffe = (uint8_t)0x0; *(uint8_t*)0x20a98fff = (uint8_t)0x0; *(uint64_t*)0x20209000 = (uint64_t)0x20fd1000; *(uint64_t*)0x20209008 = (uint64_t)0x0; *(uint64_t*)0x20209010 = (uint64_t)0x207eb000; *(uint64_t*)0x20209018 = (uint64_t)0x0; *(uint64_t*)0x20209020 = (uint64_t)0x20e99577; *(uint64_t*)0x20209028 = (uint64_t)0x0; *(uint64_t*)0x20209030 = (uint64_t)0x20795f4d; *(uint64_t*)0x20209038 = (uint64_t)0x0; *(uint64_t*)0x20209040 = (uint64_t)0x202f0000; *(uint64_t*)0x20209048 = (uint64_t)0x0; *(uint64_t*)0x20209050 = (uint64_t)0x206b2ffc; *(uint64_t*)0x20209058 = (uint64_t)0x0; *(uint64_t*)0x20209060 = (uint64_t)0x20d9bf25; *(uint64_t*)0x20209068 = (uint64_t)0x0; *(uint64_t*)0x20209070 = (uint64_t)0x204ba000; *(uint64_t*)0x20209078 = (uint64_t)0x0; *(uint64_t*)0x20209080 = (uint64_t)0x20794f13; *(uint64_t*)0x20209088 = (uint64_t)0x0; *(uint64_t*)0x2096f000 = (uint64_t)0x10; *(uint32_t*)0x2096f008 = (uint32_t)0x10e; *(uint32_t*)0x2096f00c = (uint32_t)0xf93; *(uint64_t*)0x2096f010 = (uint64_t)0x10; *(uint32_t*)0x2096f018 = (uint32_t)0xf; *(uint32_t*)0x2096f01c = (uint32_t)0x4; *(uint16_t*)0x20a15000 = (uint16_t)0x27; *(uint32_t*)0x20a15004 = (uint32_t)0xfffffffffffffff9; *(uint32_t*)0x20a15008 = (uint32_t)0x0; *(uint32_t*)0x20a1500c = (uint32_t)0x6; *(uint64_t*)0x20062f70 = (uint64_t)0x208f9fbc; *(uint64_t*)0x20062f78 = (uint64_t)0x0; *(uint64_t*)0x20062f80 = (uint64_t)0x20818fea; *(uint64_t*)0x20062f88 = (uint64_t)0x0; *(uint64_t*)0x20062f90 = (uint64_t)0x2087ef6c; *(uint64_t*)0x20062f98 = (uint64_t)0x0; *(uint64_t*)0x20062fa0 = (uint64_t)0x2030b000; *(uint64_t*)0x20062fa8 = (uint64_t)0x0; *(uint64_t*)0x20062fb0 = (uint64_t)0x20889000; *(uint64_t*)0x20062fb8 = (uint64_t)0x0; *(uint64_t*)0x20062fc0 = (uint64_t)0x202a6d01; *(uint64_t*)0x20062fc8 = (uint64_t)0x0; *(uint64_t*)0x20062fd0 = (uint64_t)0x20213fba; *(uint64_t*)0x20062fd8 = (uint64_t)0x0; *(uint64_t*)0x20062fe0 = (uint64_t)0x20952f85; *(uint64_t*)0x20062fe8 = (uint64_t)0x0; *(uint64_t*)0x20062ff0 = (uint64_t)0x20e0bfa0; *(uint64_t*)0x20062ff8 = (uint64_t)0x0; *(uint64_t*)0x2058bc3a = (uint64_t)0x10; *(uint32_t*)0x2058bc42 = (uint32_t)0x11f; *(uint32_t*)0x2058bc46 = (uint32_t)0x8; *(uint64_t*)0x2058bc4a = (uint64_t)0x10; *(uint32_t*)0x2058bc52 = (uint32_t)0x13f; *(uint32_t*)0x2058bc56 = (uint32_t)0x200; *(uint64_t*)0x2058bc5a = (uint64_t)0x10; *(uint32_t*)0x2058bc62 = (uint32_t)0x11f; *(uint32_t*)0x2058bc66 = (uint32_t)0x4; *(uint64_t*)0x2058bc6a = (uint64_t)0x10; *(uint32_t*)0x2058bc72 = (uint32_t)0x3a; *(uint32_t*)0x2058bc76 = (uint32_t)0x2; *(uint64_t*)0x2058bc7a = (uint64_t)0x10; *(uint32_t*)0x2058bc82 = (uint32_t)0x101; *(uint32_t*)0x2058bc86 = (uint32_t)0x0; r[218] = syscall(__NR_sendmmsg, r[3], 0x20ed9f10ul, 0x4ul, 0x0ul); } int main() { loop(); return 0; }