// https://syzkaller.appspot.com/bug?id=4e947674d10b0fb0cb94d4d723989cee439a71d6 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0xf, 3, 2); if (res != -1) r[0] = res; *(uint64_t*)0x20360000 = 0; *(uint32_t*)0x20360008 = 0; *(uint64_t*)0x20360010 = 0x2035d000; *(uint64_t*)0x2035d000 = 0x2033c000; memcpy((void*)0x2033c000, "\x02\x0d\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03" "\x00\x06\x00\x00\x00\x00\x00\x02\x00\x4e\x20\x7f\x00\x00\x01\x00\x00" "\x00\x00\x00\x00\x00\x00\x03\x00\x05\x00\x00\x00\x00\x00\x02\x00\x4e" "\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x12\x00" "\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x00\x00\x00\x02" "\x01\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x02\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x20\x01\x02\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\xff\xff\xe0\x00\x00\x01", 128); *(uint64_t*)0x2035d008 = 0x80; *(uint64_t*)0x20360018 = 1; *(uint64_t*)0x20360020 = 0; *(uint64_t*)0x20360028 = 0; *(uint32_t*)0x20360030 = 0; syscall(__NR_sendmsg, r[0], 0x20360000, 0); res = syscall(__NR_socket, 2, 2, 0x88); if (res != -1) r[1] = res; *(uint16_t*)0x20000040 = 2; *(uint16_t*)0x20000042 = htobe16(0x4e20); *(uint32_t*)0x20000044 = htobe32(0x7f000001); *(uint8_t*)0x20000048 = 0; *(uint8_t*)0x20000049 = 0; *(uint8_t*)0x2000004a = 0; *(uint8_t*)0x2000004b = 0; *(uint8_t*)0x2000004c = 0; *(uint8_t*)0x2000004d = 0; *(uint8_t*)0x2000004e = 0; *(uint8_t*)0x2000004f = 0; syscall(__NR_bind, r[1], 0x20000040, 0x10); *(uint16_t*)0x20319ff0 = 2; *(uint16_t*)0x20319ff2 = htobe16(0x4e20); *(uint32_t*)0x20319ff4 = htobe32(0); *(uint8_t*)0x20319ff8 = 0; *(uint8_t*)0x20319ff9 = 0; *(uint8_t*)0x20319ffa = 0; *(uint8_t*)0x20319ffb = 0; *(uint8_t*)0x20319ffc = 0; *(uint8_t*)0x20319ffd = 0; *(uint8_t*)0x20319ffe = 0; *(uint8_t*)0x20319fff = 0; syscall(__NR_sendto, r[1], 0x20f81000, 0x87, 0x8084, 0x20319ff0, 0x10); *(uint16_t*)0x20df9ff0 = 2; *(uint16_t*)0x20df9ff2 = htobe16(0); *(uint32_t*)0x20df9ff4 = htobe32(0xe0000002); *(uint8_t*)0x20df9ff8 = 0; *(uint8_t*)0x20df9ff9 = 0; *(uint8_t*)0x20df9ffa = 0; *(uint8_t*)0x20df9ffb = 0; *(uint8_t*)0x20df9ffc = 0; *(uint8_t*)0x20df9ffd = 0; *(uint8_t*)0x20df9ffe = 0; *(uint8_t*)0x20df9fff = 0; syscall(__NR_sendto, r[1], 0x20000000, 0, 0, 0x20df9ff0, 0x10); *(uint32_t*)0x20001780 = 0; *(uint32_t*)0x20001784 = 0; *(uint32_t*)0x20001788 = 0; *(uint32_t*)0x2000178c = 0; *(uint32_t*)0x20001790 = 0; *(uint32_t*)0x20001794 = 0; } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }