// https://syzkaller.appspot.com/bug?id=280dc3881aceb90226df17588dd00223ae760369 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0}; int main(void) { syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 2ul, 0x4000000805ul, 0); if (res != -1) r[0] = res; res = syscall(__NR_socket, 2ul, 5ul, 0x84); if (res != -1) r[1] = res; res = syscall(__NR_dup3, r[0], r[1], 0ul); if (res != -1) r[2] = res; *(uint16_t*)0x20d6cff0 = 2; *(uint16_t*)0x20d6cff2 = htobe16(0x4e20); *(uint32_t*)0x20d6cff4 = htobe32(0x7f000001); syscall(__NR_setsockopt, r[1], 0x84, 0x64, 0x20d6cff0ul, 0x10ul); memcpy((void*)0x20fa3fff, "\t", 1); *(uint16_t*)0x206f7000 = 2; *(uint16_t*)0x206f7002 = htobe16(0); *(uint8_t*)0x206f7004 = 0xac; *(uint8_t*)0x206f7005 = 0x14; *(uint8_t*)0x206f7006 = -1; *(uint8_t*)0x206f7007 = 0xbb; syscall(__NR_sendto, r[2], 0x20fa3ffful, 1ul, 0ul, 0x206f7000ul, 0x10ul); memcpy((void*)0x203cef9f, "7", 1); *(uint16_t*)0x20618000 = 2; *(uint16_t*)0x20618002 = htobe16(0x4e20); *(uint32_t*)0x20618004 = htobe32(0x7f000001); syscall(__NR_sendto, r[1], 0x203cef9ful, 0x34000ul, 0ul, 0x20618000ul, 0x10ul); memcpy((void*)0x200001c0, "\xb4\x04\x00\x00", 4); *(uint32_t*)0x200001c4 = 0; *(uint32_t*)0x200001c8 = 0; *(uint32_t*)0x20a8a000 = 0xf6; res = syscall(__NR_getsockopt, r[1], 0x84, 0x1d, 0x200001c0ul, 0x20a8a000ul); if (res != -1) r[3] = *(uint32_t*)0x200001c8; *(uint32_t*)0x2059aff8 = r[3]; *(uint32_t*)0x2059affc = 0; *(uint32_t*)0x2034f000 = 0x2059b000; syscall(__NR_getsockopt, r[2], 0x84, 0x7a, 0x2059aff8ul, 0x2034f000ul); return 0; }