// https://syzkaller.appspot.com/bug?id=cc1223d6fa3314ae162079135e6a3fb70d2212b6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #ifndef SYS_shm_open2 #define SYS_shm_open2 571 #endif uint64_t r[1] = {0x0}; int main(void) { syscall(SYS_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; memcpy((void*)0x20000080, "./file0\000", 8); syscall( SYS_open, /*file=*/0x20000080ul, /*flags=O_VERIFY|O_TTY_INIT|O_TRUNC|O_SYNC|O_NOCTTY|O_DIRECT|0xf5fbbcdef910626a*/ 0xf5fbbcdef939e6eaul, /*mode=*/0ul); res = syscall(SYS_getpid); if (res != -1) r[0] = res; memcpy((void*)0x20000240, "./file0\000", 8); syscall( SYS_ktrace, /*path=*/0x20000240ul, /*ops=*/0ul, /*trpoints=KTRFAC_FAULT|KTRFAC_CAPFAIL|KTRFAC_PROCCTOR|KTRFAC_SYSCTL|KTRFAC_PSIG|KTRFAC_SYSRET*/ 0x3624ul, /*pid=*/r[0]); memcpy((void*)0x20000140, "./file0\000", 8); syscall(SYS_shm_open2, /*path=*/0x20000140ul, /*flags=O_CREAT*/ 0x200ul, /*mode=*/0ul, /*shmflags=SHM_GROW_ON_WRITE*/ 2ul, /*name=*/0ul); return 0; }