// https://syzkaller.appspot.com/bug?id=f0e01204e654ebd94c1d5ec4b99a76e9aa668bf7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include void loop() { *(uint64_t*)0x20000780 = 0x20000180; *(uint16_t*)0x20000180 = 0x10; *(uint16_t*)0x20000182 = 0; *(uint32_t*)0x20000184 = 0; *(uint32_t*)0x20000188 = 0; *(uint32_t*)0x20000788 = 0xc; *(uint64_t*)0x20000790 = 0x20000740; *(uint64_t*)0x20000740 = 0x20000500; memcpy( (void*)0x20000500, "\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\xbe\xf5\x92\x41\xca\x86\x48\x11\xff\x5d\x75\x5c\x92\xa3\xe6\x2a" "\x23\x00\x00\x00\x4a\x22\x87\x47\x0d\x03\x2f\x96\xa1\xa5\xab\x1d\x39\xb3" "\x49\x50\xc7\xd1\x9a\x12\x1a\x35\xde\x95\x4f\x3b\xef\xf5\x28\x65\x97\xc9" "\xb6\x97\x77\xee\xf9\x49\x8a\x6c\x08\xc4\x4d\xcf\x12\xa0\x34\x4f\x5b\x5d" "\xcb\x6a\x3f\x93\x7d\xe2\xd3\x4d\x5d\xfd\x6b\x0a\xa1\xca\x93\x05\x4b\x2a" "\x19\xd3\x11\x9a\x5f\x23\xdb\xa9\x79\xa4\x2e\x0a\x8e\x32\x3a\xd8\x5b\x08" "\x84\xc7\x79\xaf\xf2\x92\x82\x39\x1b\x60\x53\xe2\x7b\x69\x32\xe0\xe8\x66" "\x94\x31\xf4\x62\xb2\xab\x1b\xcf\xb5\x96\x62\xf7\x40\xbc\x19\x3a\x55\x15" "\x31\xbb\x46\x67\x5d\x80\xd3\x03\xed\x97\x28\x38\x6c\xf8\x46\xf9\xf7\x6d" "\xbd\xd7\x5b\xe6\x72\x27\x77\xd7\x75\xcd\x89\x4f\x67\xf9\xf7\x3d\x26\xfd" "\xf9\xd1\x07\x27\x94\x67\xd1\xce\x87\x8b\x32\x42\xc5\xd0\x35\x2b\x2f\x7d" "\x40\x7b\xf4\x8f\x12\xd1\xfc\xf3\x4c\xf5\x81\xa3\xb3\x63\xe3\x96\x35\xed" "\xa3\xde\x4d\x5e\x1c\x34\x2c\xf1\x73\x4e\xbb\x80\x01\x80\x7d\xf3\x6a\x04" "\xf6\x9f\x6e\x40\x61\xab\x74\xb1\x36\xfc\xa2\x77\x11\x91\x70\x4a\x3e\x22" "\x48\xd8\x08\x79\x7d\x08\x0f\xee\xc1\x33\x00\x9d\x7d\xcc\xeb\xd0\xf0\x77" "\x23\x64\xf7\x1b\x6e\x9f\x88\x3b\xe4\x8b\x2d\xa8\xfd\x78\x8f\x2d\x57\xc6" "\x18\x44\x7f\x17\xcc\xc5\xd6\x25\xd7\xcd\xd7\xc0\xf1\xac\x65\xce\xa5\xde" "\x17\xc2\xb9\x0d\xac\x22\x0a\x7e\x94\x3e\x29\xfc\x33\x59\x24\x5b\xa4\x1e" "\xb3\xaf\xb9\xea\x87\x46\x20\xa2\x44\x6f\xce\x4c\xce\x0f\x15\x43\x02\x2b" "\xd5\xde\xdf\xfa\x02\x3c\x89\x47\xcf\x22\xf0\x0a\xcf\x5d\xd7\x4e\x26\x25" "\x1c\x7a\x22\x31\x5d\x88\x38\xb5\xa5\x1e\x38\xd0\x99\xeb\x11\xce\x15\x68" "\x0b\xd0\x31\x01\x67\x55\x5d\x5c\x32\x95\xa3\x79\x4c\xfb\x98\x50\x9a\x6f" "\x9f\x74\xd6\x06\xd0\xf3\xdc\x63\x24\x9e\x0b\x22\x8b\x80\x23\x8a\x5d\xc4" "\xe8\x0a\x5d\xae\xbb\x31\x98\x2d\x67\xeb\x2e\x98\xfc\xbb\x42\x29\x6e\x39" "\x11\xd5\xc7\xa0\xad\xd2\x35\xe8\xd8\xc0\x71\xa7\x14\x2f\xee\x9d\x91\x65" "\xc2\x74\xfa\xa5\x0c\x42\x98\xb3\xad\x8c\xfb", 479); *(uint64_t*)0x20000748 = 0x1df; *(uint64_t*)0x20000798 = 1; *(uint64_t*)0x200007a0 = 0; *(uint64_t*)0x200007a8 = 0; *(uint32_t*)0x200007b0 = 0; syscall(__NR_sendmsg, -1, 0x20000780, 0); memcpy((void*)0x20000280, "dns_resolver", 13); *(uint8_t*)0x200002c0 = 0x73; *(uint8_t*)0x200002c1 = 0x79; *(uint8_t*)0x200002c2 = 0x7a; *(uint8_t*)0x200002c3 = 0; *(uint8_t*)0x200002c4 = 0; syscall(__NR_add_key, 0x20000280, 0x200002c0, 0x20000300, 0xfffff, 0xfffffffd); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }