// https://syzkaller.appspot.com/bug?id=3871fa3807e9588df440bc83440638d52811160e // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #define __syscall syscall uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x1012, -1, 0, 0); long res = 0; memcpy((void*)0x20000080, "./file0\x00", 8); res = syscall(SYS_open, 0x20000080, 0x60e, 0); if (res != -1) r[0] = res; *(uint64_t*)0x200001c0 = 0x20000040; memcpy((void*)0x20000040, "\x5a\x2a\x4f\x25\x8c\xf1\xe6\xc4\x3d\x08\x34\xc4\xce\xa3\x35\x2e\x26" "\xea\x1d\x21\x91\x3c\x87\xed\xda\x1a\x0f\x7c\x89\x25\xd6\x3a\x7c\x79" "\xa3\x2a\x4e\xb0\x42\xf4\xd7", 41); *(uint64_t*)0x200001c8 = 0x29; *(uint64_t*)0x200001d0 = 0; *(uint64_t*)0x200001d8 = 0; syscall(SYS_writev, r[0], 0x200001c0, 2); syscall(SYS_mmap, 0x2000d000, 0x1000, 1, 0x10, r[0], 0, 0); syscall(SYS_mlock, 0x20001000, 0x800000); return 0; }