// https://syzkaller.appspot.com/bug?id=038c47c353490e96ed3592dfd723466c8d2f0648 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_connect #define __NR_connect 362 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 0xa, 2, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000080 = 0; *(uint16_t*)0x20000084 = 0xa; *(uint16_t*)0x20000086 = htobe16(0); *(uint32_t*)0x20000088 = 0; *(uint8_t*)0x2000008c = -1; *(uint8_t*)0x2000008d = 1; *(uint8_t*)0x2000008e = 0; *(uint8_t*)0x2000008f = 0; *(uint8_t*)0x20000090 = 0; *(uint8_t*)0x20000091 = 0; *(uint8_t*)0x20000092 = 0; *(uint8_t*)0x20000093 = 0; *(uint8_t*)0x20000094 = 0; *(uint8_t*)0x20000095 = 0; *(uint8_t*)0x20000096 = 0; *(uint8_t*)0x20000097 = 0; *(uint8_t*)0x20000098 = 0; *(uint8_t*)0x20000099 = 0; *(uint8_t*)0x2000009a = 0; *(uint8_t*)0x2000009b = 1; *(uint32_t*)0x2000009c = 0; syscall(__NR_setsockopt, (long)r[0], 0x29, 0x2a, 0x20000080, 0x88); *(uint16_t*)0x20000000 = 0xa; *(uint16_t*)0x20000002 = htobe16(0); *(uint32_t*)0x20000004 = 0; *(uint8_t*)0x20000008 = 0; *(uint8_t*)0x20000009 = 0; *(uint8_t*)0x2000000a = 0; *(uint8_t*)0x2000000b = 0; *(uint8_t*)0x2000000c = 0; *(uint8_t*)0x2000000d = 0; *(uint8_t*)0x2000000e = 0; *(uint8_t*)0x2000000f = 0; *(uint8_t*)0x20000010 = 0; *(uint8_t*)0x20000011 = 0; *(uint8_t*)0x20000012 = -1; *(uint8_t*)0x20000013 = -1; *(uint8_t*)0x20000014 = 0xac; *(uint8_t*)0x20000015 = 0x14; *(uint8_t*)0x20000016 = 0x14; *(uint8_t*)0x20000017 = 0x15; *(uint32_t*)0x20000018 = 0; syscall(__NR_connect, (long)r[0], 0x20000000, 0x1c); *(uint32_t*)0x20000040 = 2; syscall(__NR_setsockopt, (long)r[0], 0x29, 1, 0x20000040, 4); return 0; }