// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_socket, 0x10, 3, 6); *(uint64_t*)0x2000b000 = 0x20e78000; *(uint16_t*)0x20e78000 = 0x10; *(uint16_t*)0x20e78002 = 0; *(uint32_t*)0x20e78004 = 0; *(uint32_t*)0x20e78008 = 0; *(uint32_t*)0x2000b008 = 0xc; *(uint64_t*)0x2000b010 = 0x205a6ff0; *(uint64_t*)0x205a6ff0 = 0x20f53000; *(uint32_t*)0x20f53000 = 0x138; *(uint16_t*)0x20f53004 = 0x10; *(uint16_t*)0x20f53006 = 0x713; *(uint32_t*)0x20f53008 = 0; *(uint32_t*)0x20f5300c = 0; *(uint8_t*)0x20f53010 = -1; *(uint8_t*)0x20f53011 = 2; *(uint8_t*)0x20f53012 = 0; *(uint8_t*)0x20f53013 = 0; *(uint8_t*)0x20f53014 = 0; *(uint8_t*)0x20f53015 = 0; *(uint8_t*)0x20f53016 = 0; *(uint8_t*)0x20f53017 = 0; *(uint8_t*)0x20f53018 = 0; *(uint8_t*)0x20f53019 = 0; *(uint8_t*)0x20f5301a = 0; *(uint8_t*)0x20f5301b = 0; *(uint8_t*)0x20f5301c = 0; *(uint8_t*)0x20f5301d = 0; *(uint8_t*)0x20f5301e = 0; *(uint8_t*)0x20f5301f = 1; *(uint32_t*)0x20f53020 = htobe32(0xe0000002); *(uint16_t*)0x20f53030 = 0; *(uint16_t*)0x20f53032 = htobe16(0); *(uint16_t*)0x20f53034 = 0; *(uint16_t*)0x20f53036 = htobe16(0); *(uint16_t*)0x20f53038 = 0; *(uint8_t*)0x20f5303a = 0; *(uint8_t*)0x20f5303b = 0; *(uint8_t*)0x20f5303c = 0; *(uint32_t*)0x20f53040 = 0; *(uint32_t*)0x20f53044 = 0; *(uint32_t*)0x20f53048 = htobe32(0x7f000001); *(uint32_t*)0x20f53058 = 0; *(uint8_t*)0x20f5305c = 0x6c; *(uint64_t*)0x20f53060 = htobe64(0); *(uint64_t*)0x20f53068 = htobe64(1); *(uint64_t*)0x20f53070 = 0; *(uint64_t*)0x20f53078 = 0; *(uint64_t*)0x20f53080 = 0; *(uint64_t*)0x20f53088 = 0; *(uint64_t*)0x20f53090 = 0; *(uint64_t*)0x20f53098 = 0; *(uint64_t*)0x20f530a0 = 0; *(uint64_t*)0x20f530a8 = 0; *(uint64_t*)0x20f530b0 = 0; *(uint64_t*)0x20f530b8 = 0; *(uint64_t*)0x20f530c0 = 0; *(uint64_t*)0x20f530c8 = 0; *(uint32_t*)0x20f530d0 = 0; *(uint32_t*)0x20f530d4 = 0; *(uint32_t*)0x20f530d8 = 0; *(uint32_t*)0x20f530dc = 0; *(uint32_t*)0x20f530e0 = 0; *(uint16_t*)0x20f530e4 = 2; *(uint8_t*)0x20f530e6 = 0; *(uint8_t*)0x20f530e7 = 0; *(uint8_t*)0x20f530e8 = 0; *(uint16_t*)0x20f530f0 = 0x48; *(uint16_t*)0x20f530f2 = 3; memcpy((void*)0x20f530f4, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x20f53134 = 0; *(uint64_t*)0x205a6ff8 = 0x138; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (;;) { loop(); } }