// https://syzkaller.appspot.com/bug?id=ad9da2be119e0ca4626ef81bd90f6e67b425c74d // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0); if (res != -1) r[0] = res; syscall(__NR_close, /*fd=*/r[0]); res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0x106); if (res != -1) r[1] = res; *(uint16_t*)0x20000040 = 0xa; *(uint16_t*)0x20000042 = htobe16(0x4e22); *(uint32_t*)0x20000044 = htobe32(0); memset((void*)0x20000048, 0, 10); memset((void*)0x20000052, 255, 2); *(uint32_t*)0x20000054 = htobe32(0); *(uint32_t*)0x20000058 = 0xf; syscall(__NR_bind, /*fd=*/r[0], /*addr=*/0x20000040ul, /*addrlen=*/0x1cul); syscall(__NR_listen, /*fd=*/r[1], /*backlog=*/0); res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=NETLINK_INET_DIAG*/ 4); if (res != -1) r[2] = res; *(uint64_t*)0x20000280 = 0x20000040; memcpy( (void*)0x20000040, "\x58\x00\x00\x00\x14\x00\x19\x23\x40\x83\x4b\x80\x04\x0d\x8c\x56\x0a\x06" "\x7f\xbc\x45\xff\x81\x05\x4e\x22\x00\x00\x00\x00\x58\x00\x0b\x48\x04\x00" "\x94\x5f\x64\x00\x94\x00\x05\x00\x38\x92\x5a\x01\x00\x00\x00\x00\x00\x00" "\x00\x80\x04\x00\x00\x00\xff\xe8\x09\x00\x00\x00\xff\xf5\xdd\x00\x00\x00" "\x08\x00\x03\x00\x06\x01\x00\x00\x41\x8e\x01\x40\x00\x04\xfc\xff", 88); *(uint64_t*)0x20000288 = 0x58; syscall(__NR_writev, /*fd=*/r[2], /*vec=*/0x20000280ul, /*vlen=*/1ul); return 0; }