// https://syzkaller.appspot.com/bug?id=02617ac69815ae324053c954118c2dc7ba0e59b2 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 0xaul, 1ul, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000040 = 1; syscall(__NR_setsockopt, r[0], 6, 0x13, 0x20000040ul, 0x76dcul); *(uint32_t*)0x20000000 = 1; syscall(__NR_setsockopt, r[0], 6, 0x14, 0x20000000ul, 4ul); *(uint16_t*)0x20000080 = 0xa; *(uint16_t*)0x20000082 = htobe16(0); *(uint32_t*)0x20000084 = htobe32(0); memset((void*)0x20000088, 0, 16); *(uint32_t*)0x20000098 = 0; syscall(__NR_connect, r[0], 0x20000080ul, 0x1cul); memcpy((void*)0x200000c0, "tls\000", 4); syscall(__NR_setsockopt, r[0], 6, 0x1f, 0x200000c0ul, 4ul); *(uint16_t*)0x200001c0 = 0x304; *(uint16_t*)0x200001c2 = 0x35; memset((void*)0x200001c4, 0, 8); memcpy((void*)0x200001cc, "\xb6\x8b\x0e\x08\x05\xf3\xfd\xda\xc6\x34\xa0\xa0\x23\x35\xf8\x79", 16); memcpy((void*)0x200001dc, "\xfb\x8a\x5c\xa9", 4); memcpy((void*)0x200001e0, "\x4c\xdb\x9d\xd4\x93\x10\x2d\x1c", 8); syscall(__NR_setsockopt, r[0], 0x11a, 2, 0x200001c0ul, 0x28ul); memset((void*)0x20000140, 3, 1); syscall(__NR_sendto, r[0], 0x20000140ul, 1ul, 0ul, 0ul, 0ul); { int i; for (i = 0; i < 64; i++) { syscall(__NR_sendto, r[0], 0x20000140ul, 1ul, 0ul, 0ul, 0ul); } } *(uint64_t*)0x20000180 = 0; *(uint32_t*)0x20000188 = 0; *(uint64_t*)0x20000190 = 0x20001a80; *(uint64_t*)0x20001a80 = 0x20000280; memcpy((void*)0x20000280, "\xa4\xb1\x40\xcd\xce\xaa\x3f\x69\x78\xed\x3e\xaa\xf5\x74\xf1\x52\x2b" "\x44\xf8\x89\x47\x66\x8e\x0b\xae\x6d\x38\xa2\x34\x26\x50\x7e\x9d\xbb" "\x1e\x76\x1b\x5e\x6e\x70\xd2\x1a\x67\x92\x4d\xc3\x5d\x0a\xbd\x95\xe0" "\xa5\xbd\x97\x30\x3e\xd5\x5f\x37\x88\x56\xf5\x69\xab\xa1\x67\x2e\x35" "\xc9\x74\x19\x2e\x1e\x89\xa9\xc0\x06\x8e\x96\x98\x90\xcc\x22\xa5\xd4" "\xbc\xba\xe7\x41\xef\xa1\x70\x54\x77\x61", 95); *(uint64_t*)0x20001a88 = 0x5f; *(uint64_t*)0x20001a90 = 0; *(uint64_t*)0x20001a98 = 0; *(uint64_t*)0x20001aa0 = 0; *(uint64_t*)0x20001aa8 = 0; *(uint64_t*)0x20001ab0 = 0; *(uint64_t*)0x20001ab8 = 0; *(uint64_t*)0x20001ac0 = 0; *(uint64_t*)0x20001ac8 = 0; *(uint64_t*)0x20001ad0 = 0; *(uint64_t*)0x20001ad8 = 0; *(uint64_t*)0x20001ae0 = 0; *(uint64_t*)0x20001ae8 = 0; *(uint64_t*)0x20001af0 = 0; *(uint64_t*)0x20001af8 = 0; *(uint64_t*)0x20001b00 = 0; *(uint64_t*)0x20001b08 = 0; *(uint64_t*)0x20000198 = 9; *(uint64_t*)0x200001a0 = 0; *(uint64_t*)0x200001a8 = 0; *(uint32_t*)0x200001b0 = 0; syscall(__NR_sendmsg, r[0], 0x20000180ul, 0x20000000ul); { int i; for (i = 0; i < 64; i++) { syscall(__NR_sendmsg, r[0], 0x20000180ul, 0x20000000ul); } } *(uint64_t*)0x20002900 = 0; *(uint32_t*)0x20002908 = 0; *(uint64_t*)0x20002910 = 0x20000580; *(uint64_t*)0x20000580 = 0x20000640; *(uint64_t*)0x20000588 = 0xda; *(uint64_t*)0x20002918 = 1; *(uint64_t*)0x20002920 = 0; *(uint64_t*)0x20002928 = 0; *(uint32_t*)0x20002930 = 0; *(uint32_t*)0x20002938 = 0; syscall(__NR_recvmmsg, r[0], 0x20002900ul, 1ul, 0ul, 0ul); return 0; }