// https://syzkaller.appspot.com/bug?id=f0e01204e654ebd94c1d5ec4b99a76e9aa668bf7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_sendmmsg #define __NR_sendmmsg 345 #endif #ifndef __NR_add_key #define __NR_add_key 286 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 void loop() { *(uint32_t*)0x20003780 = 0x20000080; *(uint16_t*)0x20000080 = 1; memcpy((void*)0x20000082, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x20003784 = 0x6e; *(uint32_t*)0x20003788 = 0x200005c0; *(uint32_t*)0x200005c0 = 0x20000440; *(uint32_t*)0x200005c4 = 0; *(uint32_t*)0x200005c8 = 0x20000100; *(uint32_t*)0x200005cc = 0; *(uint32_t*)0x200005d0 = 0x200004c0; *(uint32_t*)0x200005d4 = 0; *(uint32_t*)0x2000378c = 3; *(uint32_t*)0x20003790 = 0x20000600; *(uint32_t*)0x20000600 = 0x10; *(uint32_t*)0x20000604 = 1; *(uint32_t*)0x20000608 = 1; *(uint32_t*)0x2000060c = -1; *(uint32_t*)0x20003794 = 0x10; *(uint32_t*)0x20003798 = 0; *(uint32_t*)0x2000379c = 0x20000900; *(uint16_t*)0x20000900 = 1; memcpy((void*)0x20000902, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x200037a0 = 0x6e; *(uint32_t*)0x200037a4 = 0x20000d80; *(uint32_t*)0x20000d80 = 0x20000980; memcpy((void*)0x20000980, "\x82\x55\x23\x29\xef\x60\x04\xee\x62\xd5\x1d\xc3\xd5\x01\x5b\xc6\x3e" "\x55\x64\xc5\xcb\xa6\xcf\xca\x3e\x08\x38\x86\x35\xf2\xb5\x17\xd0\x23" "\xb7\x54\x2e\xaf\x12\xa2\x19\x65\x0b\x74\x5a\x4c\x2b\xf2\x00\xb2\x9c" "\xde\xaa\x14\xe0\x8e\x4b\x3e\x63\x97\x63\xb5\xf2\xc3\x16\x4e\xf1\xc8" "\x73\x0b\xd2\x1f\x09\x65\x0a\x60\x41\x11\xcf\x7d\xf7\xdd\xb0\xe5\xd2" "\x23\xf1\x58\xb3\xf3\xc1\x34\x45\xbb\xb8\x68\xc0\x58\xca\xc3\x1d\xad" "\x58\x73\xd2\x66\x33\x05\x69\x08\xde\x19\xc6\x67\xf2\x72\xcc\x8a\x9e" "\x07\xd7\x5b\x3c\x8a\x3f\xec\x1b\x1b\xb6\xcd\x0e\x59\x33\x4c\xab\xea" "\xca\xe2\x68\x57\x71\x43\x17\xb0\x64\xaf\xae\xf8\xdb\x75\xa3\xdf\x1b" "\x3d\xf7\x81\x1a\x59\x8d\xc0\x24\x19\x9d\xc6\x11\x1c\xe6\x0f\xde\xc5" "\x73\xa9\x49\x4a\x26\x89\x5c\x7c\x4d\xcb\xa8\xae\xf2\x76\x57\x47\xc8" "\xef\x5b\x0a\xf5\xf4\xd9\xd9\xa4\xd2\x90\x83\xfa\x49\x85\x25\xe8\x54" "\x9a\x53\x1d\x1f\x4e\xd8\x00\xc0\xce", 213); *(uint32_t*)0x20000d84 = 0xd5; *(uint32_t*)0x20000d88 = 0x20000a80; *(uint32_t*)0x20000d8c = 0; *(uint32_t*)0x20000d90 = 0x20000ac0; *(uint32_t*)0x20000d94 = 0; *(uint32_t*)0x20000d98 = 0x20000b80; *(uint32_t*)0x20000d9c = 0; *(uint32_t*)0x20000da0 = 0x20000c00; *(uint32_t*)0x20000da4 = 0; *(uint32_t*)0x20000da8 = 0x20000c80; *(uint32_t*)0x20000dac = 0; *(uint32_t*)0x200037a8 = 6; *(uint32_t*)0x200037ac = 0x20001240; *(uint32_t*)0x20001240 = 0x18; *(uint32_t*)0x20001244 = 1; *(uint32_t*)0x20001248 = 2; *(uint32_t*)0x2000124c = 0; *(uint32_t*)0x20001250 = 0; *(uint32_t*)0x20001254 = 0; *(uint32_t*)0x20001258 = 0x18; *(uint32_t*)0x2000125c = 1; *(uint32_t*)0x20001260 = 2; *(uint32_t*)0x20001264 = 0; *(uint32_t*)0x20001268 = 0; *(uint32_t*)0x2000126c = 0; *(uint32_t*)0x20001270 = 0x18; *(uint32_t*)0x20001274 = 1; *(uint32_t*)0x20001278 = 2; *(uint32_t*)0x2000127c = 0; *(uint32_t*)0x20001280 = 0; *(uint32_t*)0x20001284 = 0; *(uint32_t*)0x20001288 = 0xc; *(uint32_t*)0x2000128c = 1; *(uint32_t*)0x20001290 = 1; *(uint32_t*)0x200037b0 = 0x54; *(uint32_t*)0x200037b4 = 0x4000; *(uint32_t*)0x200037b8 = 0x200012c0; *(uint16_t*)0x200012c0 = 1; memcpy((void*)0x200012c2, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x200037bc = 0x6e; *(uint32_t*)0x200037c0 = 0x20002580; *(uint32_t*)0x20002580 = 0x20001340; *(uint32_t*)0x20002584 = 0; *(uint32_t*)0x20002588 = 0x20001440; *(uint32_t*)0x2000258c = 0; *(uint32_t*)0x20002590 = 0x20001500; *(uint32_t*)0x20002594 = 0; *(uint32_t*)0x20002598 = 0x20002500; *(uint32_t*)0x2000259c = 0; *(uint32_t*)0x200037c4 = 4; *(uint32_t*)0x200037c8 = 0x20002840; *(uint32_t*)0x20002840 = 0x18; *(uint32_t*)0x20002844 = 1; *(uint32_t*)0x20002848 = 2; *(uint32_t*)0x2000284c = 0; *(uint32_t*)0x20002850 = 0; *(uint32_t*)0x20002854 = 0; *(uint32_t*)0x20002858 = 0x2c; *(uint32_t*)0x2000285c = 1; *(uint32_t*)0x20002860 = 1; *(uint32_t*)0x20002864 = -1; *(uint32_t*)0x20002868 = -1; *(uint32_t*)0x2000286c = -1; *(uint32_t*)0x20002870 = -1; *(uint32_t*)0x20002874 = -1; *(uint32_t*)0x20002878 = -1; *(uint32_t*)0x2000287c = -1; *(uint32_t*)0x20002880 = -1; *(uint32_t*)0x20002884 = 0x18; *(uint32_t*)0x20002888 = 1; *(uint32_t*)0x2000288c = 2; *(uint32_t*)0x20002890 = 0; *(uint32_t*)0x20002894 = 0; *(uint32_t*)0x20002898 = 0; *(uint32_t*)0x200037cc = 0x5c; *(uint32_t*)0x200037d0 = 1; *(uint32_t*)0x200037d4 = 0x200028c0; *(uint16_t*)0x200028c0 = 0; memcpy((void*)0x200028c2, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x200037d8 = 0x6e; *(uint32_t*)0x200037dc = 0x20002ac0; *(uint32_t*)0x20002ac0 = 0x20002940; *(uint32_t*)0x20002ac4 = 0; *(uint32_t*)0x20002ac8 = 0x200029c0; *(uint32_t*)0x20002acc = 0; *(uint32_t*)0x20002ad0 = 0x20002a80; *(uint32_t*)0x20002ad4 = 0; *(uint32_t*)0x200037e0 = 3; *(uint32_t*)0x200037e4 = 0x20002c40; *(uint32_t*)0x20002c40 = 0x18; *(uint32_t*)0x20002c44 = 1; *(uint32_t*)0x20002c48 = 2; *(uint32_t*)0x20002c4c = 0; *(uint32_t*)0x20002c50 = 0; *(uint32_t*)0x20002c54 = 0; *(uint32_t*)0x20002c58 = 0x18; *(uint32_t*)0x20002c5c = 1; *(uint32_t*)0x20002c60 = 2; *(uint32_t*)0x20002c64 = 0; *(uint32_t*)0x20002c68 = 0; *(uint32_t*)0x20002c6c = 0; *(uint32_t*)0x200037e8 = 0x30; *(uint32_t*)0x200037ec = 0x80; *(uint32_t*)0x200037f0 = 0x20002c80; *(uint16_t*)0x20002c80 = 1; *(uint8_t*)0x20002c82 = 0; *(uint32_t*)0x20002c84 = 0x4e22; *(uint32_t*)0x200037f4 = 0x6e; *(uint32_t*)0x200037f8 = 0x200030c0; *(uint32_t*)0x200030c0 = 0x20002d00; *(uint32_t*)0x200030c4 = 0; *(uint32_t*)0x200030c8 = 0x20002e00; *(uint32_t*)0x200030cc = 0; *(uint32_t*)0x200030d0 = 0x20002f00; *(uint32_t*)0x200030d4 = 0; *(uint32_t*)0x200030d8 = 0x20002f40; *(uint32_t*)0x200030dc = 0; *(uint32_t*)0x200030e0 = 0x20003000; *(uint32_t*)0x200030e4 = 0; *(uint32_t*)0x200030e8 = 0x20003040; *(uint32_t*)0x200030ec = 0; *(uint32_t*)0x200037fc = 6; *(uint32_t*)0x20003800 = 0; *(uint32_t*)0x20003804 = 0; *(uint32_t*)0x20003808 = 0x4841; *(uint32_t*)0x2000380c = 0x20003140; *(uint16_t*)0x20003140 = 0; *(uint8_t*)0x20003142 = 0; *(uint32_t*)0x20003144 = 0x4e23; *(uint32_t*)0x20003810 = 0x6e; *(uint32_t*)0x20003814 = 0x20003300; *(uint32_t*)0x20003300 = 0x200031c0; *(uint32_t*)0x20003304 = 0; *(uint32_t*)0x20003308 = 0x20003280; *(uint32_t*)0x2000330c = 0; *(uint32_t*)0x20003818 = 2; *(uint32_t*)0x2000381c = 0x200036c0; *(uint32_t*)0x200036c0 = -1; *(uint32_t*)0x200036c4 = -1; *(uint32_t*)0x200036c8 = -1; *(uint32_t*)0x200036cc = -1; *(uint32_t*)0x200036d0 = -1; *(uint32_t*)0x200036d4 = -1; *(uint32_t*)0x200036d8 = -1; *(uint32_t*)0x200036dc = -1; *(uint32_t*)0x200036e0 = -1; *(uint32_t*)0x200036e4 = -1; *(uint32_t*)0x200036e8 = -1; *(uint32_t*)0x200036ec = -1; *(uint32_t*)0x200036f0 = -1; *(uint32_t*)0x200036f4 = -1; *(uint32_t*)0x200036f8 = -1; *(uint32_t*)0x200036fc = -1; *(uint32_t*)0x20003700 = -1; *(uint32_t*)0x20003820 = 0x44; *(uint32_t*)0x20003824 = 0x10; syscall(__NR_sendmmsg, -1, 0x20003780, 6, 0x4000015); memcpy((void*)0x20000280, "dns_resolver", 13); *(uint8_t*)0x200002c0 = 0x73; *(uint8_t*)0x200002c1 = 0x79; *(uint8_t*)0x200002c2 = 0x7a; *(uint8_t*)0x200002c3 = 0; *(uint8_t*)0x200002c4 = 0; syscall(__NR_add_key, 0x20000280, 0x200002c0, 0x20000300, 0xfffff, 0xfffffffd); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }