// https://syzkaller.appspot.com/bug?id=acbdbce572deeb65f3e0e5b7705bdb8d16b1210f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bind #define __NR_bind 200 #endif #ifndef __NR_getsockname #define __NR_getsockname 204 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 211 #endif #ifndef __NR_socket #define __NR_socket 198 #endif uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; res = syscall(__NR_socket, /*domain=*/0x11ul, /*type=*/0x800000003ul, /*proto=*/0); if (res != -1) r[0] = res; *(uint16_t*)0x20000080 = 0x11; memcpy((void*)0x20000082, "\x00\x00\x01\x00\x00\x00\x00\x00\x08\x00\x44\x94\x4e\xeb\xa7\x1a\x49" "\x76\xe2\x52\x92\x2c\xb1\x8f\x6e\x2e\x2a\xba\x00\x00\x00\x01\x2e\x0b" "\x38\x36\x00\x54\x04\xb0\xe0\x30\x1a\x4c\xe8\x75\xf2\xe3\xff\x5f\x16" "\x3e\xe3\x40\xb7\x67\x95\x00\x80\x00\x00\x00\x00\x00\x00\x01\x01\x01" "\x3c\x58\x11\x03\x9e\x15\x77\x50\x27\xec\xce\x66\xfd\x79\x2b\xbf\x0e" "\x5b\xf5\xff\x1b\x08\x16\xf3\xf6\xdb\x1c\x00\x01\x00\x00\x00\x00\x00" "\x00\x00\x49\x74\x00\x00\x00\x00\x00\x00\x00\x06\xad\x8e\x5e\xcc\x32" "\x6d\x3a\x09\xff\xc2\xc6\x54", 126); syscall(__NR_bind, /*fd=*/r[0], /*addr=*/0x20000080ul, /*addrlen=*/0x80ul); *(uint32_t*)0x20000000 = 0x14; res = syscall(__NR_getsockname, /*fd=*/r[0], /*addr=*/0x200003c0ul, /*addrlen=*/0x20000000ul); if (res != -1) r[1] = *(uint32_t*)0x200003c4; res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0); if (res != -1) r[2] = res; *(uint64_t*)0x20000800 = 0; *(uint32_t*)0x20000808 = 0; *(uint64_t*)0x20000810 = 0x20000040; *(uint64_t*)0x20000040 = 0x20000900; *(uint32_t*)0x20000900 = 0x80; *(uint16_t*)0x20000904 = 0x24; *(uint16_t*)0x20000906 = 0xf0b; *(uint32_t*)0x20000908 = 0; *(uint32_t*)0x2000090c = 0; *(uint8_t*)0x20000910 = 0; *(uint8_t*)0x20000911 = 0; *(uint16_t*)0x20000912 = 0; *(uint32_t*)0x20000914 = r[1]; *(uint16_t*)0x20000918 = 0; *(uint16_t*)0x2000091a = 0; *(uint16_t*)0x2000091c = -1; *(uint16_t*)0x2000091e = -1; *(uint16_t*)0x20000920 = 0; *(uint16_t*)0x20000922 = 0; *(uint16_t*)0x20000924 = 0xa; *(uint16_t*)0x20000926 = 1; memcpy((void*)0x20000928, "netem\000", 6); *(uint16_t*)0x20000930 = 0x50; *(uint16_t*)0x20000932 = 2; *(uint32_t*)0x20000934 = 0; *(uint32_t*)0x20000938 = 0; *(uint32_t*)0x2000093c = 0; *(uint32_t*)0x20000940 = 0; *(uint32_t*)0x20000944 = 0; *(uint32_t*)0x20000948 = 0; *(uint16_t*)0x2000094c = 0x2c; *(uint16_t*)0x2000094e = 0xc; *(uint64_t*)0x20000950 = 0; *(uint64_t*)0x20000958 = 0; *(uint32_t*)0x20000960 = 5; *(uint32_t*)0x20000964 = 0; *(uint64_t*)0x20000968 = 0; *(uint64_t*)0x20000970 = 0; *(uint16_t*)0x20000978 = 6; *(uint16_t*)0x2000097a = 2; memcpy((void*)0x2000097c, "\xed\x7f", 2); *(uint64_t*)0x20000048 = 0x80; *(uint64_t*)0x20000818 = 1; *(uint64_t*)0x20000820 = 0; *(uint64_t*)0x20000828 = 0; *(uint32_t*)0x20000830 = 0; syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x20000800ul, /*f=*/0ul); return 0; }