// https://syzkaller.appspot.com/bug?id=d4198208cd864aa9a7fe3bf9b94f9346a79c7d69 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffff}; void loop() { long res; memcpy((void*)0x20000280, "/dev/infiniband/rdma_cm", 24); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000280, 2, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20001e80 = 0; *(uint16_t*)0x20001e84 = 0x18; *(uint16_t*)0x20001e86 = 0xfa00; *(uint64_t*)0x20001e88 = 3; *(uint64_t*)0x20001e90 = 0x20001e40; *(uint16_t*)0x20001e98 = 0x106; *(uint8_t*)0x20001e9a = 6; *(uint8_t*)0x20001e9b = 0; *(uint8_t*)0x20001e9c = 0; *(uint8_t*)0x20001e9d = 0; *(uint8_t*)0x20001e9e = 0; *(uint8_t*)0x20001e9f = 0; res = syscall(__NR_write, r[0], 0x20001e80, 0x20); if (res != -1) r[1] = *(uint32_t*)0x20001e40; *(uint32_t*)0x20001ec0 = 0xb; *(uint16_t*)0x20001ec4 = 0x10; *(uint16_t*)0x20001ec6 = 0xfa00; *(uint64_t*)0x20001ec8 = 0x20000040; *(uint32_t*)0x20001ed0 = r[1]; *(uint32_t*)0x20001ed4 = 1; syscall(__NR_write, r[0], 0x20001ec0, 0x18); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }