// https://syzkaller.appspot.com/bug?id=7d57b0d2571f9a24c32882272f8dd6361e046ddf // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include static void execute_one(); extern unsigned long long procid; void loop() { while (1) { execute_one(); } } uint64_t r[1] = {0xffffffffffffffff}; unsigned long long procid; void execute_one() { long res = 0; res = syscall(__NR_socket, 0xa, 2, 0); if (res != -1) r[0] = res; *(uint16_t*)0x200000c0 = 0xa; *(uint16_t*)0x200000c2 = htobe16(0x4e23); *(uint32_t*)0x200000c4 = 0; *(uint8_t*)0x200000c8 = -1; *(uint8_t*)0x200000c9 = 1; *(uint8_t*)0x200000ca = 0; *(uint8_t*)0x200000cb = 0; *(uint8_t*)0x200000cc = 0; *(uint8_t*)0x200000cd = 0; *(uint8_t*)0x200000ce = 0; *(uint8_t*)0x200000cf = 0; *(uint8_t*)0x200000d0 = 0; *(uint8_t*)0x200000d1 = 0; *(uint8_t*)0x200000d2 = 0; *(uint8_t*)0x200000d3 = 0; *(uint8_t*)0x200000d4 = 0; *(uint8_t*)0x200000d5 = 0; *(uint8_t*)0x200000d6 = 0; *(uint8_t*)0x200000d7 = 1; *(uint32_t*)0x200000d8 = 0; syscall(__NR_sendto, r[0], 0x20000000, 0xfdb0, 0x4008080, 0x200000c0, 0x1c); syscall(__NR_sendmmsg, r[0], 0x200092c0, 0x4ff, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (procid = 0; procid < 8; procid++) { if (fork() == 0) { for (;;) { loop(); } } } sleep(1000000); return 0; }