// https://syzkaller.appspot.com/bug?id=e634bd820c7bd376c401dd05f3ba79fe401f44ec // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_io_setup #define __NR_io_setup 245 #endif #ifndef __NR_io_submit #define __NR_io_submit 248 #endif #ifndef __NR_memfd_create #define __NR_memfd_create 356 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[2] = {0x0, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_io_setup, 1, 0x20000140); if (res != -1) r[0] = *(uint32_t*)0x20000140; memcpy((void*)0x20000240, ":+lo#\000`vo\334.\a8\335A\311~" "\'\006\355\326\264\262!\202\026\241\305\b\367\363_" "\235y\\\266\343b\002\334\207\256d\250\320 " "X\330\377\031\teP0\341?6\a\261\247\335 " "\224D\376\320\026\177\302\316\223\370i", 73); res = syscall(__NR_memfd_create, 0x20000240, 0); if (res != -1) r[1] = res; *(uint32_t*)0x20000080 = 0x20001100; *(uint64_t*)0x20001100 = 0; *(uint32_t*)0x20001108 = 0; *(uint32_t*)0x2000110c = 0; *(uint16_t*)0x20001110 = 5; *(uint16_t*)0x20001112 = 0; *(uint32_t*)0x20001114 = r[1]; *(uint64_t*)0x20001118 = 0; *(uint64_t*)0x20001120 = 0; *(uint64_t*)0x20001128 = 0; *(uint64_t*)0x20001130 = 0; *(uint32_t*)0x20001138 = 0; *(uint32_t*)0x2000113c = -1; syscall(__NR_io_submit, (long)r[0], 1, 0x20000080); return 0; }