// https://syzkaller.appspot.com/bug?id=a12a0d53e98be4a617f1e02e8ae91dc4a31525f8 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0ul); intptr_t res = 0; memcpy((void*)0x200001c0, "/prof/kpdata\000", 13); res = syscall(SYS_openat, 0xffffffffffffff9cul, 0x200001c0ul, 0xdul, 3ul, 0ul); if (res != -1) r[0] = res; syscall(SYS_openat, 0xffffffffffffff9cul, 0ul, 0ul, 3ul, 0ul); memcpy((void*)0x20000000, "\x8f\x4f\xcb\x60\x7d\x30\x33\xe6\xce\xb2\x2d\xfe\xa9\x39\xc5\xee\x3a" "\x1c\x9e\x55\x60\x28\xe1\x4d\xe9\xb9\xcc\xb4\xc6\x19\xc3\xd9\xff\x02" "\x98\xb7\x3c\x12\x9e\x0c\x37\x29\x2a\x11\xa3\x09\x02\x54\x93\xa9\xaf" "\xc3\x62\xdd\xb4\xe2\x1e\x81\xc9\x71\x74\x38\xfb\x50\xb1\x8a\xb2\x81" "\xb2\x62\xa5\xb3\x41\xf5\x29\xfd\x60\x6a\xc7\x64\x95\x72\xff\xf8\x30" "\xa1\xe8\xad\xb0\x30\x7d\x11\x02\xca\xbf\x48\x5c\xc7\xe2\x1f\xcb\xd8" "\xa7\x9d\xb0\x3b\xcd\x29\x42\x71\xac\x4b\x0e\x37\xe2\xbd\x04\xfc\xe9" "\x46\xb4\x84\x54\xb6\x44\x07\x78\xe5\x21\x00\x90\xd0\xee\xc4\xdc\x43" "\xb0\x55\xb7\x2b\x1e\x37\x23\x44\x43\xbe\xbc\x7f\x93\x02\x7b\xc8\xf4" "\xe5\x6e\xb9\x71\xbb\xe9\x3d\x1b\x0e\x61\x30\x15\x8e\x32\x46\x84\xd5" "\xe2\x4d\xc8\x0b\x87\xfa\x54\x1b\x34\xb0\x5c\x89\xe2\x80\x4e\x64\xeb" "\x50\xf5\x14\xd7\x5f\x3a\x04\x00\x7d\x9f\x06\x89\x04\xba\xec\x70\xe6" "\x2e\xe8\xf4\xc7\x00\xba\x90\xe2\x07\x3b\x81\x66\x0f\x45\x3c\xa5\xc1" "\x54\x28\x65\x17\x17\xba\x80\x06\x4b\xbf\x0d\xd9\xa8\xd2\x86\xa5\x79" "\x3e\x06\x98\xcf\x8a\x33\x38\x00\x00\x00\x58\xeb\xae\xb2\x3f\xae\xde" "\x15\x11\x64\x90\xf5\x87\x19\x24\xc3\x14\xfa\x73\x3a\x23\x94\xc5\x8b" "\x5c\x5f\xc4\x33\x94\x82\x16\x88\xd2\x12\xcb\x3e\x26\x24\x39\x7e\x05" "\xf4\x38\xe7\xf4\xb4\xb5\xa4\x24\xc4\xf2\x58\x92\xce\xa3\xd1\x0d\x87" "\x71\x5d\xe1\xe5\x35\x97\x2e\x09\x4e\xb2\x4b\xc3\xc7\x29\x54\x26\x85" "\x6e\x4c\x03\x92\x28\x4f\xf3\x16\x76\x8b\x66\x4f\x2c\x70\xba\x44\xc2" "\x3a\x72\x18\x32\x3b\x5f\xa6", 347); syscall(SYS_write, r[0], 0x20000000ul, 0xffffffc7ul); return 0; }