// https://syzkaller.appspot.com/bug?id=e86371dd7b6835334a55daec02e21a6449d83076 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_openat #define __NR_openat 295 #endif #ifndef __NR_ioctl #define __NR_ioctl 54 #endif #ifndef __NR_lseek #define __NR_lseek 19 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); memcpy((void*)0x2069aff4, "/dev/ashmem", 12); r[0] = syscall(__NR_openat, 0xffffff9c, 0x2069aff4, 0, 0); syscall(__NR_ioctl, r[0], 0x40087703, 0x10001); syscall(__NR_mmap, 0x206ff000, 0x3000, 0, 0x12, r[0], 0); syscall(__NR_lseek, r[0], 0, 3); } int main() { loop(); return 0; }