// https://syzkaller.appspot.com/bug?id=d38ed0177151ca71af235c613ab4897461cf9ff3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 2, 1, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000580 = 1; syscall(__NR_setsockopt, r[0], 6, 0x10000000013, 0x20000580, 4); *(uint32_t*)0x20000040 = 1; syscall(__NR_setsockopt, r[0], 6, 0x4000000000014, 0x20000040, 4); *(uint16_t*)0x200000c0 = 2; *(uint16_t*)0x200000c2 = htobe16(0); *(uint8_t*)0x200000c4 = 0xac; *(uint8_t*)0x200000c5 = 0x14; *(uint8_t*)0x200000c6 = 0x14; *(uint8_t*)0x200000c7 = 0x16; *(uint8_t*)0x200000c8 = 0; *(uint8_t*)0x200000c9 = 0; *(uint8_t*)0x200000ca = 0; *(uint8_t*)0x200000cb = 0; *(uint8_t*)0x200000cc = 0; *(uint8_t*)0x200000cd = 0; *(uint8_t*)0x200000ce = 0; *(uint8_t*)0x200000cf = 0; syscall(__NR_connect, r[0], 0x200000c0, 0x10); *(uint64_t*)0x20005c00 = 0x20002d00; *(uint16_t*)0x20002d00 = 0x1f; *(uint8_t*)0x20002d02 = 0; *(uint8_t*)0x20002d03 = 0; *(uint8_t*)0x20002d04 = 0; *(uint8_t*)0x20002d05 = 0; *(uint8_t*)0x20002d06 = 0; *(uint8_t*)0x20002d07 = 0; *(uint32_t*)0x20005c08 = 0x80; *(uint64_t*)0x20005c10 = 0x20004080; *(uint64_t*)0x20004080 = 0x20002e80; memcpy( (void*)0x20002e80, "\x70\xcc\x8d\x14\x1c\x4c\xfc\x85\xd2\x6d\x54\xe8\x14\xcb\x31\x26\x99\xb4" "\x2e\xaa\x35\x51\x80\x03\x0b\xf9\x43\x6c\x01\x96\xc3\x17\xf9\x19\xd7\x1f" "\xc4\x10\xa3\x3c\x04\x95\x05\xc4\x49\x9d\xde\x67\x7e\x0c\x84\x65\x50\x2f" "\xbd\x9c\xc3\x61\xae\xed\x6a\xdd\xdb\x1a\x6b\xab\x5c\x9f\xf8\xfe\x19\xcd" "\xbb\xdf\x86\xb5\x4e\x67\x2f\x1f\x04\xfd\x1e\xa6\xb7\x9e\xd5\xd3\x5e\x54" "\xb7\x19\x3a\x92\xb3\xd3\x8a\x61\x2f\x71\x88\x72\x95\xd1\x3d\xaf\x02\xab" "\xcd\x8d\x47\x2d\xbd\xf2\xb6\x00\x43\x20\xd4\xba\x71\xb7\xf4\x94\xc0\xf2" "\x05\xdb\x97\x5e\x1e\x58\x87\xc2\x92\x14\x94\xa6\x19\xb9\x6d\xa0\x8c\xb1" "\x22\x23\xba\xb6\x17\x49\x40\x20\x2f\x68\x8b\xa5\x6b\x21\x4f\x2d\x46\x2c" "\x45\x68\x78\xfe\x2d\xba\x9a\x21\x3e\x5f\x03\x5b\xe4\xc9\xdb\x4e\xe1\x87" "\x99\xa1\xf7\xb3\x42\x9a\x35\xfc\x5b\x53\x40\xbc\x08\xa5\xb6\xce\xd8\xdb" "\xaa\x54\xe7\xf6\xc4\xc5\x1c\x27\x86\xe1\x3a\xd7\x2d\x79\xee\x70\xcf\xbb" "\x54\xb0\x0c\x7f\x7a\x1e\x50\xf1\xb4\x78\xea\xfb\x54\x00\x7f\xf1\xe5\xf0" "\x74\x90\xef\xa9\x8f\xe5\xf8\x91\x04\x93\x82\x74\x58\xc7\x98\x69\x14\xd7" "\x19\x9c\x41\x46\x3c\x62\x74\xf2\x5f\xd0\x1d\x06\xdc\x29\x41\xc0\x6f\x50" "\x9c\xbb\xa2\xac\xda\x2e\x92\x28\x34\x01\x92\x81\x90\xe1\xb4\x04\x65\x35" "\x3f\xc3\x28\x93\xb2\x5f\x4a\xe9\x1e\xd7\x0e\x67\x50\xf6\x14\x99\xec\xa5" "\xc7\x80\xe6\xe9\x85\xba\x24\x1f\x55\x4b\x42\x86\x2f\x31\x15\x70\x64\xfb" "\x0a\x6b\xcb\xa1\xad\x3c\xfb\xf3\x72\x49\x1a\x67\xdb\x4d\x38\xeb\x5b\x23" "\xa6\x34\xaf\x92\x06\xa4\xaa\xf7\xdf\x4e\x17\x5f\x9b\x40\x9b\x65\x07\x4d" "\x5d\xad\x04\xa6\x62\x2e\x2a\x83\x9b\x92\xb2\x93\x77\xf6\x5e\x82\xfd\xfa" "\x2e\x63\x26\x58\xc0\x83\x10\xe0\x7d\xdb\x02\x30\x65\x22\xab\x45\x08\xf1" "\x28\x2c\x24\x48\x08\x97\x4f\xfb\x09\x64\xec\x2c\xad\x22\x7e\x62\x27\xca" "\x17\xc1\xec\x59\x72\x13\x2d\x58\xdd\x7e\x93\x2b\x88\x1f\x98\x85\xa4\xd2" "\x77\xf4\x84\xce\x44\xd0\xbe\x80\x93\xb6\x26\xf6\xca\x35\x56\xc3\xaa\xf2" "\xb4\xcb\xe6\x85\xf6\x2b\xfc\x9b\xda\x86\xae\x77\xd5\x67\xf8\xb9\x7a\xcc" "\xd0\x20\x55\xbc\x51\xe6\xd9\x20\xf7\x5e\xfa\x14\x67\x95\xa8\x67\x0d\x6e" "\x84\xcf\x70\xb9\xc1\x93\xfb\x62\x7d\x23\xe1\x70\xcf\x6b\xac\xb1\xbb\x8b" "\xfd\xdc\x1e\x9e\x85\x6e\x5f\x89\x89", 513); *(uint64_t*)0x20004088 = 0x201; *(uint64_t*)0x20005c18 = 1; *(uint64_t*)0x20005c20 = 0; *(uint64_t*)0x20005c28 = 0; *(uint32_t*)0x20005c30 = 0; *(uint32_t*)0x20005c38 = 0; syscall(__NR_sendmmsg, r[0], 0x20005c00, 1, 0); *(uint64_t*)0x20005f80 = 0x20005a40; *(uint16_t*)0x20005a40 = 0x1a; *(uint16_t*)0x20005a42 = 0; *(uint8_t*)0x20005a44 = 0; *(uint8_t*)0x20005a45 = 0; *(uint8_t*)0x20005a46 = 0; *(uint8_t*)0x20005a47 = 0; *(uint8_t*)0x20005a48 = -1; *(uint8_t*)0x20005a49 = -1; *(uint8_t*)0x20005a4a = -1; *(uint8_t*)0x20005a4b = -1; *(uint8_t*)0x20005a4c = -1; *(uint8_t*)0x20005a4d = -1; *(uint32_t*)0x20005f88 = 0x80; *(uint64_t*)0x20005f90 = 0x20005f40; *(uint64_t*)0x20005f40 = 0x20005ac0; memcpy((void*)0x20005ac0, "H", 1); *(uint64_t*)0x20005f48 = 1; *(uint64_t*)0x20005f98 = 1; *(uint64_t*)0x20005fa0 = 0; *(uint64_t*)0x20005fa8 = 0; *(uint32_t*)0x20005fb0 = 0; *(uint32_t*)0x20005fb8 = 0; syscall(__NR_sendmmsg, r[0], 0x20005f80, 1, 0); return 0; }