// https://syzkaller.appspot.com/bug?id=48ac8459188ca5430fa946d53b6dd293465d969a // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_getsockopt #define __NR_getsockopt 365 #endif #ifndef __NR_add_key #define __NR_add_key 286 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 void loop() { *(uint32_t*)0x200002c0 = 0; memcpy((void*)0x200002c4, "\x8c\x00\x00\x00\x4f\x41\xbb\x60\x4e\xe6\x56\xab\x85\xa9\x57\x5c\x08" "\xb1\xfc\xba\x95\xd5\x31\xcd\x5d\xb4\x4c\xd3\x92\xa9\x6f\xcc\xe0\x6a" "\xe9\xcc\xd4\x3d\x28\x9f\x59\xe5\x94\x55\xe8\xde\x32\xc4\x81\x4f\x95" "\x7c\x54\x34\xbb\xd9\x96\x57\xca\xba\x4f\x6d\xcb\xf3\x4a\xaf\xdb\x7a" "\x0b\xbc\x02\x8f\x1f\xf8\x3f\x85\x36\x9c\xd3\x05\xbb\x55\x89\xd7\xbd" "\x39\x93\x2e\xfd\xc1\x85\x8e\x77\xf8\xc8\x9f\xb3\xc9\x5d\x66\xc5\xe0" "\x38\xfb\x20\x4e\xac\xc0\x93\x17\x69\xf1\xd1\xdf\x03\x5e\xf0\x50\xe2" "\x73\x3c\x91\x0e\xb5\xed\x8f\x8b\xb5\x44\x97\x5c\xa9\xe8\xc6\x75\x2c" "\x88\xcb\x83\xd9\xec\x6d\x56\x28\xcd\x25\x7c\xd1\x2e\x61\xc0\x57\x14" "\xd8\x46\x43\x48\x90\x67\x8f\xfc\xac\x97\xd9\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x2f\x3e\xd2\x23\xea\x2b\x68\x43\x23\x94\xf8", 187); *(uint32_t*)0x20000200 = 2; syscall(__NR_getsockopt, -1, 0x84, 0x6c, 0x200002c0, 0x20000200); memcpy((void*)0x20000080, "dns_resolver", 13); *(uint8_t*)0x20000000 = 0x73; *(uint8_t*)0x20000001 = 0x79; *(uint8_t*)0x20000002 = 0x7a; *(uint8_t*)0x20000003 = 0; *(uint8_t*)0x20000004 = 0; syscall(__NR_add_key, 0x20000080, 0x20000000, 0x200000c0, 0xfffff, 0xfffffffb); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }