// https://syzkaller.appspot.com/bug?id=176a70590ebfd17c1e3d65c543580943188c20d7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include void loop() { memcpy((void*)0x20000300, "\xbf\xb6\x87\x48\xf2\xeb\x64\xb6\x82\x69\x4d\xfd\x5d\x51\xb8\x98\x00" "\x7b\x40\x85\x29\xfb\x31\x90\xcb\x36\x86\x66\xe2\xfd\x7b\x10\x74\xa2" "\x14\x2c\xa2\x3a\x74\xc6\x06\x8c\x16\x89\x8b\x0e\xd3\xc8\x75\xb8\x3d" "\xd3\xcb\x50\x1b\x14\x0b\xd2\x27\x64\xae\x4e\xdb\xd0\x2e\xb8\xe9\xc4" "\x14\xc2\x46\x06\xe4\xc4\xdc\x13\x9c\x1d\x8f\xc6\xe5\x5b\xa4\xf9\x87" "\xf0\xe1\x04\x4c\x9c\xc3\x2d\xed\x33\x0f\xf4\x89\x02\x4f\x0d\x67\x23" "\xff\x66\x8d\xb7\xbd\x6e\x47\x8f\xb9\xca\xa7\xbc\x6c\x15\xfc\x45\xbf" "\xff\xfb\x04\xdb\x3a\x11\xfc\x1b\xf6\x06\xea\x0b\x85\x0c\x34\x3c\x79" "\x31\xce\x6d\x4f\xb3\x3e\x70\x2d\x3e\xb7\x66\x46\x83\x55\xa5\xc5\x2d" "\xc5\xd2\x67\x0e\xcc\xd3\x98\xec\xfb\x7c\x1e\x18\xcc\x9f\xa0\xf5\xa1" "\xbd\x63\x30\x1b\xa0\xc3\xf1\xae\xc9\xa1\x0d\x4d\xc7\x44\x40\xd1\xe9" "\x7e\xd6\xa0\xc3\x11\xc7\x6e\x25\x7b\xc1\xcf\x47\x71\x9c\x8c\x52\xeb" "\xd2\xdb\x31\xef\x89\x0a\x1d\x28\xa2\x54\x8a\x22", 216); syscall(SYS_pop_ctx, 0x20000300); memcpy((void*)0x20000780, "/proc/self/ns", 14); syscall(SYS_openat, 0xffffffffffffff9c, 0x20000780, 0xe, 1, 0); } int main() { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }