// https://syzkaller.appspot.com/bug?id=157b9613a410da014866c2865af1be18db03d922 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0x10, 3, 0xc); if (res != -1) r[0] = res; *(uint32_t*)0x20001080 = 0; *(uint32_t*)0x20001084 = 0; *(uint32_t*)0x20001088 = 0x20001040; *(uint32_t*)0x20001040 = 0x20000100; *(uint32_t*)0x20000100 = 0x4c; *(uint8_t*)0x20000104 = 2; *(uint8_t*)0x20000105 = 6; *(uint16_t*)0x20000106 = 1; *(uint32_t*)0x20000108 = 0; *(uint32_t*)0x2000010c = 0; *(uint8_t*)0x20000110 = 0; *(uint8_t*)0x20000111 = 0; *(uint16_t*)0x20000112 = htobe16(0); *(uint16_t*)0x20000114 = 5; *(uint16_t*)0x20000116 = 4; *(uint8_t*)0x20000118 = 0; *(uint16_t*)0x2000011c = 9; *(uint16_t*)0x2000011e = 2; memcpy((void*)0x20000120, "syz0\000", 5); *(uint16_t*)0x20000128 = 0x12; *(uint16_t*)0x2000012a = 3; memcpy((void*)0x2000012c, "hash:net,port\000", 14); *(uint16_t*)0x2000013c = 5; *(uint16_t*)0x2000013e = 5; *(uint8_t*)0x20000140 = 2; *(uint16_t*)0x20000144 = 5; *(uint16_t*)0x20000146 = 1; *(uint8_t*)0x20000148 = 7; *(uint32_t*)0x20001044 = 0x4c; *(uint32_t*)0x2000108c = 1; *(uint32_t*)0x20001090 = 0; *(uint32_t*)0x20001094 = 0; *(uint32_t*)0x20001098 = 0; syscall(__NR_sendmsg, (intptr_t)r[0], 0x20001080, 0); res = syscall(__NR_socket, 0x10, 3, 0xc); if (res != -1) r[1] = res; *(uint32_t*)0x20000140 = 0; *(uint32_t*)0x20000144 = 0; *(uint32_t*)0x20000148 = 0x20000100; *(uint32_t*)0x20000100 = 0x20000040; *(uint32_t*)0x20000040 = 0xb0; *(uint8_t*)0x20000044 = 0xb; *(uint8_t*)0x20000045 = 6; *(uint16_t*)0x20000046 = 0x455; *(uint32_t*)0x20000048 = 0x70bd2b; *(uint32_t*)0x2000004c = 0x25dfdbfb; *(uint8_t*)0x20000050 = 0; *(uint8_t*)0x20000051 = 0; *(uint16_t*)0x20000052 = htobe16(9); *(uint16_t*)0x20000054 = 9; *(uint16_t*)0x20000056 = 2; memcpy((void*)0x20000058, "syz0\000", 5); *(uint16_t*)0x20000060 = 5; *(uint16_t*)0x20000062 = 1; *(uint8_t*)0x20000064 = 7; *(uint16_t*)0x20000068 = 9; *(uint16_t*)0x2000006a = 2; memcpy((void*)0x2000006c, "syz0\000", 5); *(uint16_t*)0x20000074 = 5; *(uint16_t*)0x20000076 = 1; *(uint8_t*)0x20000078 = 7; *(uint16_t*)0x2000007c = 0x48; STORE_BY_BITMASK(uint16_t, , 0x2000007e, 7, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000007f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000007f, 1, 7, 1); *(uint16_t*)0x20000080 = 9; *(uint16_t*)0x20000082 = 0x1a; memcpy((void*)0x20000084, "syz2\000", 5); *(uint16_t*)0x2000008c = 0xc; STORE_BY_BITMASK(uint16_t, , 0x2000008e, 0x18, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000008f, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000008f, 0, 7, 1); *(uint64_t*)0x20000090 = htobe64(0x64b4); *(uint16_t*)0x20000098 = 0x18; STORE_BY_BITMASK(uint16_t, , 0x2000009a, 0x14, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000009b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000009b, 1, 7, 1); *(uint16_t*)0x2000009c = 0x14; *(uint16_t*)0x2000009e = 2; *(uint8_t*)0x200000a0 = 0xfe; *(uint8_t*)0x200000a1 = 0x80; *(uint8_t*)0x200000a2 = 0; *(uint8_t*)0x200000a3 = 0; *(uint8_t*)0x200000a4 = 0; *(uint8_t*)0x200000a5 = 0; *(uint8_t*)0x200000a6 = 0; *(uint8_t*)0x200000a7 = 0; *(uint8_t*)0x200000a8 = 0; *(uint8_t*)0x200000a9 = 0; *(uint8_t*)0x200000aa = 0; *(uint8_t*)0x200000ab = 0; *(uint8_t*)0x200000ac = 0; *(uint8_t*)0x200000ad = 0; *(uint8_t*)0x200000ae = 0; *(uint8_t*)0x200000af = 0x1a; *(uint16_t*)0x200000b0 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x200000b2, 0x19, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000b3, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000b3, 0, 7, 1); *(uint64_t*)0x200000b4 = htobe64(0x40); *(uint16_t*)0x200000bc = 8; STORE_BY_BITMASK(uint16_t, , 0x200000be, 8, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000bf, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000bf, 0, 7, 1); *(uint32_t*)0x200000c0 = htobe32(8); *(uint16_t*)0x200000c4 = 0x2c; STORE_BY_BITMASK(uint16_t, , 0x200000c6, 7, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000c7, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000c7, 1, 7, 1); *(uint16_t*)0x200000c8 = 8; STORE_BY_BITMASK(uint16_t, , 0x200000ca, 9, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000cb, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000cb, 0, 7, 1); *(uint32_t*)0x200000cc = htobe32(0); *(uint16_t*)0x200000d0 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x200000d2, 0x18, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000d3, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000d3, 0, 7, 1); *(uint64_t*)0x200000d4 = htobe64(0x1000); *(uint16_t*)0x200000dc = 8; STORE_BY_BITMASK(uint16_t, , 0x200000de, 0x1c, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000df, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000df, 0, 7, 1); *(uint32_t*)0x200000e0 = htobe32(0xfffffff8); *(uint16_t*)0x200000e4 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x200000e6, 0x19, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000e7, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000e7, 0, 7, 1); *(uint64_t*)0x200000e8 = htobe64(4); *(uint32_t*)0x20000104 = 0xb0; *(uint32_t*)0x2000014c = 1; *(uint32_t*)0x20000150 = 0; *(uint32_t*)0x20000154 = 0; *(uint32_t*)0x20000158 = 0x4000055; syscall(__NR_sendmsg, (intptr_t)r[1], 0x20000140, 0x41000); return 0; }