// https://syzkaller.appspot.com/bug?id=e0f9c38c15564530284f5311089261bbe42588d4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include static void test(); void loop() { while (1) { test(); } } #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[76]; void test() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0xful, 0x3ul, 0x2ul); *(uint32_t*)0x208befc8 = (uint32_t)0x0; *(uint32_t*)0x208befcc = (uint32_t)0x0; *(uint32_t*)0x208befd0 = (uint32_t)0x208feff0; *(uint32_t*)0x208befd4 = (uint32_t)0x1; *(uint32_t*)0x208befd8 = (uint32_t)0x0; *(uint32_t*)0x208befdc = (uint32_t)0x0; *(uint32_t*)0x208befe0 = (uint32_t)0x0; *(uint32_t*)0x208feff0 = (uint32_t)0x20780f98; *(uint32_t*)0x208feff4 = (uint32_t)0x68; *(uint8_t*)0x20780f98 = (uint8_t)0x2; *(uint8_t*)0x20780f99 = (uint8_t)0x3; *(uint8_t*)0x20780f9a = (uint8_t)0x0; *(uint8_t*)0x20780f9b = (uint8_t)0x9; *(uint16_t*)0x20780f9c = (uint16_t)0xd; *(uint16_t*)0x20780f9e = (uint16_t)0x0; *(uint32_t*)0x20780fa0 = (uint32_t)0x0; *(uint32_t*)0x20780fa4 = (uint32_t)0x0; *(uint16_t*)0x20780fa8 = (uint16_t)0x3; *(uint16_t*)0x20780faa = (uint16_t)0x7; *(uint8_t*)0x20780fac = (uint8_t)0x4; *(uint8_t*)0x20780fad = (uint8_t)0x18; *(uint16_t*)0x20780fae = (uint16_t)0x0; *(uint16_t*)0x20780fb0 = (uint16_t)0x2; *(uint16_t*)0x20780fb2 = (uint16_t)0x214e; *(uint32_t*)0x20780fb4 = (uint32_t)0x20000e0; *(uint8_t*)0x20780fb8 = (uint8_t)0x0; *(uint8_t*)0x20780fb9 = (uint8_t)0x0; *(uint8_t*)0x20780fba = (uint8_t)0x0; *(uint8_t*)0x20780fbb = (uint8_t)0x0; *(uint8_t*)0x20780fbc = (uint8_t)0x0; *(uint8_t*)0x20780fbd = (uint8_t)0x0; *(uint8_t*)0x20780fbe = (uint8_t)0x0; *(uint8_t*)0x20780fbf = (uint8_t)0x0; *(uint16_t*)0x20780fc0 = (uint16_t)0x3; *(uint16_t*)0x20780fc2 = (uint16_t)0x6; *(uint8_t*)0x20780fc4 = (uint8_t)0x0; *(uint8_t*)0x20780fc5 = (uint8_t)0x1; *(uint16_t*)0x20780fc6 = (uint16_t)0x0; *(uint16_t*)0x20780fc8 = (uint16_t)0x2; *(uint16_t*)0x20780fca = (uint16_t)0x204e; *(uint32_t*)0x20780fcc = (uint32_t)0x20000e0; *(uint8_t*)0x20780fd0 = (uint8_t)0x0; *(uint8_t*)0x20780fd1 = (uint8_t)0x0; *(uint8_t*)0x20780fd2 = (uint8_t)0x0; *(uint8_t*)0x20780fd3 = (uint8_t)0x0; *(uint8_t*)0x20780fd4 = (uint8_t)0x0; *(uint8_t*)0x20780fd5 = (uint8_t)0x0; *(uint8_t*)0x20780fd6 = (uint8_t)0x0; *(uint8_t*)0x20780fd7 = (uint8_t)0x0; *(uint16_t*)0x20780fd8 = (uint16_t)0x2; *(uint16_t*)0x20780fda = (uint16_t)0x1; *(uint32_t*)0x20780fdc = (uint32_t)0x0; *(uint8_t*)0x20780fe0 = (uint8_t)0x0; *(uint8_t*)0x20780fe1 = (uint8_t)0x0; *(uint8_t*)0x20780fe2 = (uint8_t)0x0; *(uint8_t*)0x20780fe3 = (uint8_t)0x2; *(uint32_t*)0x20780fe4 = (uint32_t)0x0; *(uint16_t*)0x20780fe8 = (uint16_t)0x3; *(uint16_t*)0x20780fea = (uint16_t)0x5; *(uint8_t*)0x20780fec = (uint8_t)0x0; *(uint8_t*)0x20780fed = (uint8_t)0x0; *(uint16_t*)0x20780fee = (uint16_t)0x0; *(uint16_t*)0x20780ff0 = (uint16_t)0x2; *(uint16_t*)0x20780ff2 = (uint16_t)0x204e; *(uint32_t*)0x20780ff4 = (uint32_t)0x100007f; *(uint8_t*)0x20780ff8 = (uint8_t)0x0; *(uint8_t*)0x20780ff9 = (uint8_t)0x0; *(uint8_t*)0x20780ffa = (uint8_t)0x0; *(uint8_t*)0x20780ffb = (uint8_t)0x0; *(uint8_t*)0x20780ffc = (uint8_t)0x0; *(uint8_t*)0x20780ffd = (uint8_t)0x0; *(uint8_t*)0x20780ffe = (uint8_t)0x0; *(uint8_t*)0x20780fff = (uint8_t)0x0; r[75] = syscall(__NR_sendmsg, r[1], 0x208befc8ul, 0x0ul); } int main() { loop(); return 0; }