// https://syzkaller.appspot.com/bug?id=7a908c3df0092537ab02b844b96023f1f2644f71 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x10, 3, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20000140 = 0x20000000; *(uint16_t*)0x20000000 = 0x10; *(uint16_t*)0x20000002 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x20000148 = 0xc; *(uint64_t*)0x20000150 = 0x20000080; *(uint64_t*)0x20000080 = 0x20000180; *(uint32_t*)0x20000180 = 0x28; *(uint16_t*)0x20000184 = 0x10; *(uint16_t*)0x20000186 = 0xba5f; *(uint32_t*)0x20000188 = 0; *(uint32_t*)0x2000018c = 0; *(uint8_t*)0x20000190 = 0; *(uint8_t*)0x20000191 = 0; *(uint16_t*)0x20000192 = 0; *(uint32_t*)0x20000194 = 0; *(uint32_t*)0x20000198 = 3; *(uint32_t*)0x2000019c = 0; *(uint16_t*)0x200001a0 = 8; *(uint16_t*)0x200001a2 = 0x1b; *(uint32_t*)0x200001a4 = 0; *(uint64_t*)0x20000088 = 0x28; *(uint64_t*)0x20000158 = 1; *(uint64_t*)0x20000160 = 0; *(uint64_t*)0x20000168 = 0; *(uint32_t*)0x20000170 = 0; syscall(__NR_sendmsg, r[0], 0x20000140, 0); res = syscall(__NR_socket, 0xa, 1, 0); if (res != -1) r[1] = res; *(uint64_t*)0x20000040 = htobe64(0); *(uint64_t*)0x20000048 = htobe64(1); *(uint64_t*)0x20000050 = htobe64(0); *(uint64_t*)0x20000058 = htobe64(1); *(uint16_t*)0x20000060 = htobe16(0); *(uint16_t*)0x20000062 = htobe16(0); *(uint16_t*)0x20000064 = htobe16(0); *(uint16_t*)0x20000066 = htobe16(0); *(uint16_t*)0x20000068 = 0xa; *(uint8_t*)0x2000006a = 0; *(uint8_t*)0x2000006b = 0xfd; *(uint8_t*)0x2000006c = 0; *(uint32_t*)0x20000070 = 0; *(uint32_t*)0x20000074 = 0; *(uint64_t*)0x20000078 = 0; *(uint64_t*)0x20000080 = 0; *(uint64_t*)0x20000088 = 0; *(uint64_t*)0x20000090 = 0; *(uint64_t*)0x20000098 = 0; *(uint64_t*)0x200000a0 = 0; *(uint64_t*)0x200000a8 = 0; *(uint64_t*)0x200000b0 = 0; *(uint64_t*)0x200000b8 = 0; *(uint64_t*)0x200000c0 = 0; *(uint64_t*)0x200000c8 = 0; *(uint64_t*)0x200000d0 = 0; *(uint32_t*)0x200000d8 = 0; *(uint32_t*)0x200000dc = 0; *(uint8_t*)0x200000e0 = 1; *(uint8_t*)0x200000e1 = 0; *(uint8_t*)0x200000e2 = 0; *(uint8_t*)0x200000e3 = 0; *(uint8_t*)0x200000e8 = 0xac; *(uint8_t*)0x200000e9 = 0x14; *(uint8_t*)0x200000ea = 0x14; *(uint8_t*)0x200000eb = 0xaa; *(uint32_t*)0x200000f8 = htobe32(0); *(uint8_t*)0x200000fc = 0x33; *(uint16_t*)0x20000100 = 0; *(uint32_t*)0x20000104 = htobe32(0); *(uint32_t*)0x20000114 = 0; *(uint8_t*)0x20000118 = 0; *(uint8_t*)0x20000119 = 0; *(uint8_t*)0x2000011a = 0; *(uint32_t*)0x2000011c = 0; *(uint32_t*)0x20000120 = 0; *(uint32_t*)0x20000124 = 0; syscall(__NR_setsockopt, r[1], 0x29, 0x23, 0x20000040, 0xe8); *(uint16_t*)0x2031e000 = 0xa; *(uint16_t*)0x2031e002 = htobe16(0); *(uint32_t*)0x2031e004 = 0; *(uint8_t*)0x2031e008 = 0; *(uint8_t*)0x2031e009 = 0; *(uint8_t*)0x2031e00a = 0; *(uint8_t*)0x2031e00b = 0; *(uint8_t*)0x2031e00c = 0; *(uint8_t*)0x2031e00d = 0; *(uint8_t*)0x2031e00e = 0; *(uint8_t*)0x2031e00f = 0; *(uint8_t*)0x2031e010 = 0; *(uint8_t*)0x2031e011 = 0; *(uint8_t*)0x2031e012 = 0; *(uint8_t*)0x2031e013 = 0; *(uint8_t*)0x2031e014 = 0; *(uint8_t*)0x2031e015 = 0; *(uint8_t*)0x2031e016 = 0; *(uint8_t*)0x2031e017 = 0; *(uint32_t*)0x2031e018 = 0; syscall(__NR_sendto, r[1], 0x20000040, 0, 0x20000004, 0x2031e000, 0x1c); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }