// https://syzkaller.appspot.com/bug?id=75cf599d7211c156c9f4bdad353b077f211df7d6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; *(uint32_t*)0x20000180 = 6; *(uint32_t*)0x20000184 = 4; *(uint64_t*)0x20000188 = 0x20000380; memcpy((void*)0x20000380, "\x18\x02\x00\x00\x1b\x00\x00\x00\x00\x00\x00\x00\xb2\x96\xff\xff\x85" "\x00\x00\x00\x07\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x3a\xf1" "\xf5\x37\x78\x42\x2d\xcc\xc1\xc3\xe3\x7f\xb1\x2b\x70\xdb\x92\x6e\x68" "\xba\xa6\x2f\x65\xa7\x76\x2b\x5e\xd9\xfe\xf6\x66\x38\x7d\xf3\x16\xdd" "\xb9\x04\x3b\x83\x86\x19\xeb\x04\x2c\x01\x00\x5e\x94\x77\x8e\xc3\x65" "\x07\x5d\xd7\x5a\xaa\xa9\x69\xf9\x97\x60\xa8\x4a\x18\xcb\x05\x34\xba" "\x5f\x07\xc0\x21\xba\xbe\x00\xf7\xe9\xd8\xaf\x4c\x5b\x46\x92\xaf\x9e" "\xac\x98\x3e\x8f\x8f\xf0\xd8\x56\x00\x7a\x2b\x39\xc1\x55\x70\x4d\x0a" "\x9a\xe0\x0c\xed\x6f\xf2\x28\x3c\x58\x06\x21", 147); *(uint64_t*)0x20000190 = 0x200000c0; memcpy((void*)0x200000c0, "GPL\000", 4); *(uint32_t*)0x20000198 = 4; *(uint32_t*)0x2000019c = 0x1000; *(uint64_t*)0x200001a0 = 0x2062b000; *(uint32_t*)0x200001a8 = 0; *(uint32_t*)0x200001ac = 0; memset((void*)0x200001b0, 0, 16); *(uint32_t*)0x200001c0 = 0; *(uint32_t*)0x200001c4 = 0; *(uint32_t*)0x200001c8 = -1; *(uint32_t*)0x200001cc = 8; *(uint64_t*)0x200001d0 = 0; *(uint32_t*)0x200001d8 = 0; *(uint32_t*)0x200001dc = 0x10; *(uint64_t*)0x200001e0 = 0; *(uint32_t*)0x200001e8 = 0; *(uint32_t*)0x200001ec = 0; *(uint32_t*)0x200001f0 = -1; *(uint32_t*)0x200001f4 = 0; *(uint64_t*)0x200001f8 = 0; res = syscall(__NR_bpf, 5ul, 0x20000180ul, 0x70ul); if (res != -1) r[0] = res; *(uint32_t*)0x20000740 = r[0]; *(uint32_t*)0x20000744 = 0xffff1f00; *(uint32_t*)0x20000748 = 0; *(uint32_t*)0x2000074c = 0; *(uint64_t*)0x20000750 = 0; *(uint64_t*)0x20000758 = 0; *(uint32_t*)0x20000760 = 0x80000; *(uint32_t*)0x20000764 = 0xe00; *(uint32_t*)0x20000768 = 0; *(uint32_t*)0x2000076c = 0; *(uint64_t*)0x20000770 = 0; *(uint64_t*)0x20000778 = 0; *(uint32_t*)0x20000780 = 2; *(uint32_t*)0x20000784 = 0; syscall(__NR_bpf, 0xaul, 0x20000740ul, 0x48ul); return 0; }