// https://syzkaller.appspot.com/bug?id=c4117efdec586bbccac5428cce624863690bd3b8 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[4] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0xa, 0x80001, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20b34ffc = 0xc; res = syscall(__NR_getsockopt, r[0], 1, 0x11, 0x20b34ff8, 0x20b34ffc); if (res != -1) r[1] = *(uint32_t*)0x20b34ffc; syscall(__NR_setuid, r[1]); memcpy((void*)0x200001c0, "/dev/infiniband/rdma_cm\000", 24); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x200001c0, 2, 0); if (res != -1) r[2] = res; *(uint32_t*)0x20000100 = 0; *(uint16_t*)0x20000104 = 0x18; *(uint16_t*)0x20000106 = 0xfa00; *(uint64_t*)0x20000108 = 0; *(uint64_t*)0x20000110 = 0x200000c0; *(uint16_t*)0x20000118 = 2; *(uint8_t*)0x2000011a = 0; *(uint8_t*)0x2000011b = 0; *(uint8_t*)0x2000011c = 0; *(uint8_t*)0x2000011d = 0; *(uint8_t*)0x2000011e = 0; *(uint8_t*)0x2000011f = 0; res = syscall(__NR_write, r[2], 0x20000100, 0x20); if (res != -1) r[3] = *(uint32_t*)0x200000c0; *(uint32_t*)0x20000040 = 3; *(uint16_t*)0x20000044 = 0x40; *(uint16_t*)0x20000046 = 0xfa00; *(uint16_t*)0x20000048 = 2; *(uint16_t*)0x2000004a = htobe16(2); *(uint32_t*)0x2000004c = htobe32(0); *(uint8_t*)0x20000050 = 0xfe; *(uint8_t*)0x20000051 = 0x80; *(uint8_t*)0x20000052 = 0; *(uint8_t*)0x20000053 = 0; *(uint8_t*)0x20000054 = 0; *(uint8_t*)0x20000055 = 0; *(uint8_t*)0x20000056 = 0; *(uint8_t*)0x20000057 = 0; *(uint8_t*)0x20000058 = 0; *(uint8_t*)0x20000059 = 0; *(uint8_t*)0x2000005a = 0; *(uint8_t*)0x2000005b = 0; *(uint8_t*)0x2000005c = 0; *(uint8_t*)0x2000005d = 0; *(uint8_t*)0x2000005e = 0; *(uint8_t*)0x2000005f = 0xbb; *(uint32_t*)0x20000060 = 0; *(uint16_t*)0x20000064 = 0xa; *(uint16_t*)0x20000066 = htobe16(0); *(uint32_t*)0x20000068 = htobe32(0); *(uint8_t*)0x2000006c = 0xfe; *(uint8_t*)0x2000006d = 0x80; *(uint8_t*)0x2000006e = 0; *(uint8_t*)0x2000006f = 0; *(uint8_t*)0x20000070 = 0; *(uint8_t*)0x20000071 = 0; *(uint8_t*)0x20000072 = 0; *(uint8_t*)0x20000073 = 0; *(uint8_t*)0x20000074 = 0; *(uint8_t*)0x20000075 = 0; *(uint8_t*)0x20000076 = 0; *(uint8_t*)0x20000077 = 0; *(uint8_t*)0x20000078 = 0; *(uint8_t*)0x20000079 = 0; *(uint8_t*)0x2000007a = 0; *(uint8_t*)0x2000007b = 0xbb; *(uint32_t*)0x2000007c = 0; *(uint32_t*)0x20000080 = r[3]; *(uint32_t*)0x20000084 = 0; syscall(__NR_write, r[2], 0x20000040, 0x48); return 0; }