// https://syzkaller.appspot.com/bug?id=779a64ccaefd969d5d9bc72a7c4fe39598d53884 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) { continue; } kill_and_wait(pid, &status); break; } } } uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; res = syscall(__NR_socket, 0xaul, 0x80002ul, 0); if (res != -1) r[0] = res; memcpy((void*)0x200004c0, "filter\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 32); *(uint32_t*)0x200004e0 = 0xe; *(uint32_t*)0x200004e4 = 4; *(uint32_t*)0x200004e8 = 0x400; *(uint32_t*)0x200004ec = 0xd0; *(uint32_t*)0x200004f0 = 0; *(uint32_t*)0x200004f4 = 0xd0; *(uint32_t*)0x200004f8 = 0xd0; *(uint32_t*)0x200004fc = 0xd0; *(uint32_t*)0x20000500 = 0x2c0; *(uint32_t*)0x20000504 = 0x330; *(uint32_t*)0x20000508 = 0x330; *(uint32_t*)0x2000050c = 0x330; *(uint32_t*)0x20000510 = 0x2c0; *(uint32_t*)0x20000514 = 4; *(uint64_t*)0x20000518 = 0; *(uint8_t*)0x20000520 = 0; *(uint8_t*)0x20000521 = 0; *(uint8_t*)0x20000522 = 0; *(uint8_t*)0x20000523 = 0; *(uint8_t*)0x20000524 = 0; *(uint8_t*)0x20000525 = 0; *(uint8_t*)0x20000526 = 0; *(uint8_t*)0x20000527 = 0; *(uint8_t*)0x20000528 = 0; *(uint8_t*)0x20000529 = 0; *(uint8_t*)0x2000052a = 0; *(uint8_t*)0x2000052b = 0; *(uint8_t*)0x2000052c = 0; *(uint8_t*)0x2000052d = 0; *(uint8_t*)0x2000052e = 0; *(uint8_t*)0x2000052f = 0; *(uint8_t*)0x20000530 = 0; *(uint8_t*)0x20000531 = 0; *(uint8_t*)0x20000532 = 0; *(uint8_t*)0x20000533 = 0; *(uint8_t*)0x20000534 = 0; *(uint8_t*)0x20000535 = 0; *(uint8_t*)0x20000536 = 0; *(uint8_t*)0x20000537 = 0; *(uint8_t*)0x20000538 = 0; *(uint8_t*)0x20000539 = 0; *(uint8_t*)0x2000053a = 0; *(uint8_t*)0x2000053b = 0; *(uint8_t*)0x2000053c = 0; *(uint8_t*)0x2000053d = 0; *(uint8_t*)0x2000053e = 0; *(uint8_t*)0x2000053f = 0; *(uint8_t*)0x20000540 = 0; *(uint8_t*)0x20000541 = 0; *(uint8_t*)0x20000542 = 0; *(uint8_t*)0x20000543 = 0; *(uint8_t*)0x20000544 = 0; *(uint8_t*)0x20000545 = 0; *(uint8_t*)0x20000546 = 0; *(uint8_t*)0x20000547 = 0; *(uint8_t*)0x20000548 = 0; *(uint8_t*)0x20000549 = 0; *(uint8_t*)0x2000054a = 0; *(uint8_t*)0x2000054b = 0; *(uint8_t*)0x2000054c = 0; *(uint8_t*)0x2000054d = 0; *(uint8_t*)0x2000054e = 0; *(uint8_t*)0x2000054f = 0; *(uint8_t*)0x20000550 = 0; *(uint8_t*)0x20000551 = 0; *(uint8_t*)0x20000552 = 0; *(uint8_t*)0x20000553 = 0; *(uint8_t*)0x20000554 = 0; *(uint8_t*)0x20000555 = 0; *(uint8_t*)0x20000556 = 0; *(uint8_t*)0x20000557 = 0; *(uint8_t*)0x20000558 = 0; *(uint8_t*)0x20000559 = 0; *(uint8_t*)0x2000055a = 0; *(uint8_t*)0x2000055b = 0; *(uint8_t*)0x2000055c = 0; *(uint8_t*)0x2000055d = 0; *(uint8_t*)0x2000055e = 0; *(uint8_t*)0x2000055f = 0; *(uint8_t*)0x20000560 = 0; *(uint8_t*)0x20000561 = 0; *(uint8_t*)0x20000562 = 0; *(uint8_t*)0x20000563 = 0; *(uint8_t*)0x20000564 = 0; *(uint8_t*)0x20000565 = 0; *(uint8_t*)0x20000566 = 0; *(uint8_t*)0x20000567 = 0; *(uint8_t*)0x20000568 = 0; *(uint8_t*)0x20000569 = 0; *(uint8_t*)0x2000056a = 0; *(uint8_t*)0x2000056b = 0; *(uint8_t*)0x2000056c = 0; *(uint8_t*)0x2000056d = 0; *(uint8_t*)0x2000056e = 0; *(uint8_t*)0x2000056f = 0; *(uint8_t*)0x20000570 = 0; *(uint8_t*)0x20000571 = 0; *(uint8_t*)0x20000572 = 0; *(uint8_t*)0x20000573 = 0; *(uint8_t*)0x20000574 = 0; *(uint8_t*)0x20000575 = 0; *(uint8_t*)0x20000576 = 0; *(uint8_t*)0x20000577 = 0; *(uint8_t*)0x20000578 = 0; *(uint8_t*)0x20000579 = 0; *(uint8_t*)0x2000057a = 0; *(uint8_t*)0x2000057b = 0; *(uint8_t*)0x2000057c = 0; *(uint8_t*)0x2000057d = 0; *(uint8_t*)0x2000057e = 0; *(uint8_t*)0x2000057f = 0; *(uint8_t*)0x20000580 = 0; *(uint8_t*)0x20000581 = 0; *(uint8_t*)0x20000582 = 0; *(uint8_t*)0x20000583 = 0; *(uint8_t*)0x20000584 = 0; *(uint8_t*)0x20000585 = 0; *(uint8_t*)0x20000586 = 0; *(uint8_t*)0x20000587 = 0; *(uint8_t*)0x20000588 = 0; *(uint8_t*)0x20000589 = 0; *(uint8_t*)0x2000058a = 0; *(uint8_t*)0x2000058b = 0; *(uint8_t*)0x2000058c = 0; *(uint8_t*)0x2000058d = 0; *(uint8_t*)0x2000058e = 0; *(uint8_t*)0x2000058f = 0; *(uint8_t*)0x20000590 = 0; *(uint8_t*)0x20000591 = 0; *(uint8_t*)0x20000592 = 0; *(uint8_t*)0x20000593 = 0; *(uint8_t*)0x20000594 = 0; *(uint8_t*)0x20000595 = 0; *(uint8_t*)0x20000596 = 0; *(uint8_t*)0x20000597 = 0; *(uint8_t*)0x20000598 = 0; *(uint8_t*)0x20000599 = 0; *(uint8_t*)0x2000059a = 0; *(uint8_t*)0x2000059b = 0; *(uint8_t*)0x2000059c = 0; *(uint8_t*)0x2000059d = 0; *(uint8_t*)0x2000059e = 0; *(uint8_t*)0x2000059f = 0; *(uint8_t*)0x200005a0 = 0; *(uint8_t*)0x200005a1 = 0; *(uint8_t*)0x200005a2 = 0; *(uint8_t*)0x200005a3 = 0; *(uint8_t*)0x200005a4 = 0; *(uint8_t*)0x200005a5 = 0; *(uint8_t*)0x200005a6 = 0; *(uint8_t*)0x200005a7 = 0; *(uint32_t*)0x200005a8 = 0; *(uint16_t*)0x200005ac = 0xa8; *(uint16_t*)0x200005ae = 0xd0; *(uint32_t*)0x200005b0 = 0; *(uint64_t*)0x200005b8 = 0; *(uint64_t*)0x200005c0 = 0; *(uint16_t*)0x200005c8 = 0x28; memcpy((void*)0x200005ca, "REJECT\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200005e7 = 0; *(uint32_t*)0x200005e8 = 0; *(uint8_t*)0x200005f0 = -1; *(uint8_t*)0x200005f1 = 1; *(uint8_t*)0x200005f2 = 0; *(uint8_t*)0x200005f3 = 0; *(uint8_t*)0x200005f4 = 0; *(uint8_t*)0x200005f5 = 0; *(uint8_t*)0x200005f6 = 0; *(uint8_t*)0x200005f7 = 0; *(uint8_t*)0x200005f8 = 0; *(uint8_t*)0x200005f9 = 0; *(uint8_t*)0x200005fa = 0; *(uint8_t*)0x200005fb = 0; *(uint8_t*)0x200005fc = 0; *(uint8_t*)0x200005fd = 0; *(uint8_t*)0x200005fe = 0; *(uint8_t*)0x200005ff = 1; *(uint8_t*)0x20000600 = 0; *(uint8_t*)0x20000601 = 0; *(uint8_t*)0x20000602 = 0; *(uint8_t*)0x20000603 = 0; *(uint8_t*)0x20000604 = 0; *(uint8_t*)0x20000605 = 0; *(uint8_t*)0x20000606 = 0; *(uint8_t*)0x20000607 = 0; *(uint8_t*)0x20000608 = 0; *(uint8_t*)0x20000609 = 0; *(uint8_t*)0x2000060a = -1; *(uint8_t*)0x2000060b = -1; *(uint32_t*)0x2000060c = htobe32(0x7f000001); *(uint32_t*)0x20000610 = htobe32(0); *(uint32_t*)0x20000614 = htobe32(0); *(uint32_t*)0x20000618 = htobe32(0); *(uint32_t*)0x2000061c = htobe32(0); *(uint32_t*)0x20000620 = htobe32(0); *(uint32_t*)0x20000624 = htobe32(0); *(uint32_t*)0x20000628 = htobe32(0); *(uint32_t*)0x2000062c = htobe32(0); memcpy((void*)0x20000630, "bridge0\000\000\000\000\000\000\000\000\000", 16); memcpy((void*)0x20000640, "ip_vti0\000\000\000\000\000\000\000\000\000", 16); *(uint8_t*)0x20000650 = 0; *(uint8_t*)0x20000660 = 0; *(uint16_t*)0x20000670 = 0; *(uint8_t*)0x20000672 = 0; *(uint8_t*)0x20000673 = 0; *(uint8_t*)0x20000674 = 0; *(uint32_t*)0x20000678 = 0; *(uint16_t*)0x2000067c = 0xe0; *(uint16_t*)0x2000067e = 0x108; *(uint32_t*)0x20000680 = 0; *(uint64_t*)0x20000688 = 0; *(uint64_t*)0x20000690 = 0; *(uint16_t*)0x20000698 = 0x38; memcpy((void*)0x2000069a, "quota\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200006b7 = 0; *(uint32_t*)0x200006b8 = 0; *(uint32_t*)0x200006bc = 0; *(uint64_t*)0x200006c0 = 0x100000000; *(uint64_t*)0x200006c8 = 0; *(uint16_t*)0x200006d0 = 0x28; memcpy((void*)0x200006d2, "NFQUEUE\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200006ef = 1; *(uint16_t*)0x200006f0 = 0; *(uint16_t*)0x200006f2 = 1; *(uint8_t*)0x200006f8 = -1; *(uint8_t*)0x200006f9 = 2; *(uint8_t*)0x200006fa = 0; *(uint8_t*)0x200006fb = 0; *(uint8_t*)0x200006fc = 0; *(uint8_t*)0x200006fd = 0; *(uint8_t*)0x200006fe = 0; *(uint8_t*)0x200006ff = 0; *(uint8_t*)0x20000700 = 0; *(uint8_t*)0x20000701 = 0; *(uint8_t*)0x20000702 = 0; *(uint8_t*)0x20000703 = 0; *(uint8_t*)0x20000704 = 0; *(uint8_t*)0x20000705 = 0; *(uint8_t*)0x20000706 = 0; *(uint8_t*)0x20000707 = 1; *(uint8_t*)0x20000708 = 0xfe; *(uint8_t*)0x20000709 = 0x80; *(uint8_t*)0x2000070a = 0; *(uint8_t*)0x2000070b = 0; *(uint8_t*)0x2000070c = 0; *(uint8_t*)0x2000070d = 0; *(uint8_t*)0x2000070e = 0; *(uint8_t*)0x2000070f = 0; *(uint8_t*)0x20000710 = 0; *(uint8_t*)0x20000711 = 0; *(uint8_t*)0x20000712 = 0; *(uint8_t*)0x20000713 = 0; *(uint8_t*)0x20000714 = 0; *(uint8_t*)0x20000715 = 0; *(uint8_t*)0x20000716 = 0; *(uint8_t*)0x20000717 = 0; *(uint32_t*)0x20000718 = htobe32(0); *(uint32_t*)0x2000071c = htobe32(0); *(uint32_t*)0x20000720 = htobe32(0); *(uint32_t*)0x20000724 = htobe32(0); *(uint32_t*)0x20000728 = htobe32(0); *(uint32_t*)0x2000072c = htobe32(0); *(uint32_t*)0x20000730 = htobe32(0); *(uint32_t*)0x20000734 = htobe32(0); memcpy((void*)0x20000738, "veth0_macvtap\000\000\000", 16); memcpy((void*)0x20000748, "ipvlan0\000\000\000\000\000\000\000\000\000", 16); *(uint8_t*)0x20000758 = 0; *(uint8_t*)0x20000768 = 0; *(uint16_t*)0x20000778 = 0; *(uint8_t*)0x2000077a = 0; *(uint8_t*)0x2000077b = 0; *(uint8_t*)0x2000077c = 0; *(uint32_t*)0x20000780 = 0; *(uint16_t*)0x20000784 = 0x110; *(uint16_t*)0x20000786 = 0x158; *(uint32_t*)0x20000788 = 0; *(uint64_t*)0x20000790 = 0; *(uint64_t*)0x20000798 = 0; *(uint16_t*)0x200007a0 = 0x68; memcpy((void*)0x200007a2, "iprange\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000", 29); *(uint8_t*)0x200007bf = 1; *(uint8_t*)0x200007c0 = 0xac; *(uint8_t*)0x200007c1 = 0x14; *(uint8_t*)0x200007c2 = 0x14; *(uint8_t*)0x200007c3 = 0xbb; *(uint64_t*)0x200007d0 = htobe64(0); *(uint64_t*)0x200007d8 = htobe64(1); *(uint32_t*)0x200007e0 = htobe32(0); *(uint8_t*)0x200007f0 = 0xfe; *(uint8_t*)0x200007f1 = 0x80; *(uint8_t*)0x200007f2 = 0; *(uint8_t*)0x200007f3 = 0; *(uint8_t*)0x200007f4 = 0; *(uint8_t*)0x200007f5 = 0; *(uint8_t*)0x200007f6 = 0; *(uint8_t*)0x200007f7 = 0; *(uint8_t*)0x200007f8 = 0; *(uint8_t*)0x200007f9 = 0; *(uint8_t*)0x200007fa = 0; *(uint8_t*)0x200007fb = 0; *(uint8_t*)0x200007fc = 0; *(uint8_t*)0x200007fd = 0; *(uint8_t*)0x200007fe = 0; *(uint8_t*)0x200007ff = 0; *(uint8_t*)0x20000800 = 0; *(uint16_t*)0x20000808 = 0x48; memcpy((void*)0x2000080a, "TEE\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000827 = 1; memcpy((void*)0x20000828, " \001\000\000\000\000\000\000\000\000\000\000\000\000\000\002", 16); memcpy((void*)0x20000838, "ip6tnl0\000\000\000\000\000\000\000\000\000", 16); *(uint64_t*)0x20000848 = 0; *(uint8_t*)0x20000850 = 0; *(uint8_t*)0x20000851 = 0; *(uint8_t*)0x20000852 = 0; *(uint8_t*)0x20000853 = 0; *(uint8_t*)0x20000854 = 0; *(uint8_t*)0x20000855 = 0; *(uint8_t*)0x20000856 = 0; *(uint8_t*)0x20000857 = 0; *(uint8_t*)0x20000858 = 0; *(uint8_t*)0x20000859 = 0; *(uint8_t*)0x2000085a = 0; *(uint8_t*)0x2000085b = 0; *(uint8_t*)0x2000085c = 0; *(uint8_t*)0x2000085d = 0; *(uint8_t*)0x2000085e = 0; *(uint8_t*)0x2000085f = 0; *(uint8_t*)0x20000860 = 0; *(uint8_t*)0x20000861 = 0; *(uint8_t*)0x20000862 = 0; *(uint8_t*)0x20000863 = 0; *(uint8_t*)0x20000864 = 0; *(uint8_t*)0x20000865 = 0; *(uint8_t*)0x20000866 = 0; *(uint8_t*)0x20000867 = 0; *(uint8_t*)0x20000868 = 0; *(uint8_t*)0x20000869 = 0; *(uint8_t*)0x2000086a = 0; *(uint8_t*)0x2000086b = 0; *(uint8_t*)0x2000086c = 0; *(uint8_t*)0x2000086d = 0; *(uint8_t*)0x2000086e = 0; *(uint8_t*)0x2000086f = 0; *(uint8_t*)0x20000870 = 0; *(uint8_t*)0x20000871 = 0; *(uint8_t*)0x20000872 = 0; *(uint8_t*)0x20000873 = 0; *(uint8_t*)0x20000874 = 0; *(uint8_t*)0x20000875 = 0; *(uint8_t*)0x20000876 = 0; *(uint8_t*)0x20000877 = 0; *(uint8_t*)0x20000878 = 0; *(uint8_t*)0x20000879 = 0; *(uint8_t*)0x2000087a = 0; *(uint8_t*)0x2000087b = 0; *(uint8_t*)0x2000087c = 0; *(uint8_t*)0x2000087d = 0; *(uint8_t*)0x2000087e = 0; *(uint8_t*)0x2000087f = 0; *(uint8_t*)0x20000880 = 0; *(uint8_t*)0x20000881 = 0; *(uint8_t*)0x20000882 = 0; *(uint8_t*)0x20000883 = 0; *(uint8_t*)0x20000884 = 0; *(uint8_t*)0x20000885 = 0; *(uint8_t*)0x20000886 = 0; *(uint8_t*)0x20000887 = 0; *(uint8_t*)0x20000888 = 0; *(uint8_t*)0x20000889 = 0; *(uint8_t*)0x2000088a = 0; *(uint8_t*)0x2000088b = 0; *(uint8_t*)0x2000088c = 0; *(uint8_t*)0x2000088d = 0; *(uint8_t*)0x2000088e = 0; *(uint8_t*)0x2000088f = 0; *(uint8_t*)0x20000890 = 0; *(uint8_t*)0x20000891 = 0; *(uint8_t*)0x20000892 = 0; *(uint8_t*)0x20000893 = 0; *(uint8_t*)0x20000894 = 0; *(uint8_t*)0x20000895 = 0; *(uint8_t*)0x20000896 = 0; *(uint8_t*)0x20000897 = 0; *(uint8_t*)0x20000898 = 0; *(uint8_t*)0x20000899 = 0; *(uint8_t*)0x2000089a = 0; *(uint8_t*)0x2000089b = 0; *(uint8_t*)0x2000089c = 0; *(uint8_t*)0x2000089d = 0; *(uint8_t*)0x2000089e = 0; *(uint8_t*)0x2000089f = 0; *(uint8_t*)0x200008a0 = 0; *(uint8_t*)0x200008a1 = 0; *(uint8_t*)0x200008a2 = 0; *(uint8_t*)0x200008a3 = 0; *(uint8_t*)0x200008a4 = 0; *(uint8_t*)0x200008a5 = 0; *(uint8_t*)0x200008a6 = 0; *(uint8_t*)0x200008a7 = 0; *(uint8_t*)0x200008a8 = 0; *(uint8_t*)0x200008a9 = 0; *(uint8_t*)0x200008aa = 0; *(uint8_t*)0x200008ab = 0; *(uint8_t*)0x200008ac = 0; *(uint8_t*)0x200008ad = 0; *(uint8_t*)0x200008ae = 0; *(uint8_t*)0x200008af = 0; *(uint8_t*)0x200008b0 = 0; *(uint8_t*)0x200008b1 = 0; *(uint8_t*)0x200008b2 = 0; *(uint8_t*)0x200008b3 = 0; *(uint8_t*)0x200008b4 = 0; *(uint8_t*)0x200008b5 = 0; *(uint8_t*)0x200008b6 = 0; *(uint8_t*)0x200008b7 = 0; *(uint8_t*)0x200008b8 = 0; *(uint8_t*)0x200008b9 = 0; *(uint8_t*)0x200008ba = 0; *(uint8_t*)0x200008bb = 0; *(uint8_t*)0x200008bc = 0; *(uint8_t*)0x200008bd = 0; *(uint8_t*)0x200008be = 0; *(uint8_t*)0x200008bf = 0; *(uint8_t*)0x200008c0 = 0; *(uint8_t*)0x200008c1 = 0; *(uint8_t*)0x200008c2 = 0; *(uint8_t*)0x200008c3 = 0; *(uint8_t*)0x200008c4 = 0; *(uint8_t*)0x200008c5 = 0; *(uint8_t*)0x200008c6 = 0; *(uint8_t*)0x200008c7 = 0; *(uint8_t*)0x200008c8 = 0; *(uint8_t*)0x200008c9 = 0; *(uint8_t*)0x200008ca = 0; *(uint8_t*)0x200008cb = 0; *(uint8_t*)0x200008cc = 0; *(uint8_t*)0x200008cd = 0; *(uint8_t*)0x200008ce = 0; *(uint8_t*)0x200008cf = 0; *(uint8_t*)0x200008d0 = 0; *(uint8_t*)0x200008d1 = 0; *(uint8_t*)0x200008d2 = 0; *(uint8_t*)0x200008d3 = 0; *(uint8_t*)0x200008d4 = 0; *(uint8_t*)0x200008d5 = 0; *(uint8_t*)0x200008d6 = 0; *(uint8_t*)0x200008d7 = 0; *(uint32_t*)0x200008d8 = 0; *(uint16_t*)0x200008dc = 0xa8; *(uint16_t*)0x200008de = 0xd0; *(uint32_t*)0x200008e0 = 0; *(uint64_t*)0x200008e8 = 0; *(uint64_t*)0x200008f0 = 0; *(uint16_t*)0x200008f8 = 0x28; memcpy((void*)0x200008fa, "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000917 = 0; *(uint32_t*)0x20000918 = 0xfffffffe; syscall(__NR_setsockopt, r[0], 0x29, 0x40, 0x200004c0ul, 0x460ul); res = syscall(__NR_socket, 0xaul, 2ul, 0); if (res != -1) r[1] = res; *(uint8_t*)0x200000c0 = 0xfe; *(uint8_t*)0x200000c1 = 0x80; *(uint8_t*)0x200000c2 = 0; *(uint8_t*)0x200000c3 = 0xef; *(uint8_t*)0x200000c4 = 0x12; *(uint8_t*)0x200000c5 = 0; *(uint8_t*)0x200000c6 = 0; *(uint8_t*)0x200000c7 = 0; *(uint8_t*)0x200000c8 = 3; *(uint8_t*)0x200000c9 = 0; *(uint8_t*)0x200000ca = 0; *(uint8_t*)0x200000cb = 0; *(uint8_t*)0x200000cc = 0; *(uint8_t*)0x200000cd = 6; *(uint8_t*)0x200000ce = 0; *(uint8_t*)0x200000cf = 0xaa; *(uint32_t*)0x200000d0 = 0; *(uint32_t*)0x200000d4 = 0; syscall(__NR_ioctl, r[1], 0x89a1, 0x200000c0ul); *(uint8_t*)0x200005c0 = 0xfe; *(uint8_t*)0x200005c1 = 0x80; *(uint8_t*)0x200005c2 = 0; *(uint8_t*)0x200005c3 = 0; *(uint8_t*)0x200005c4 = 0; *(uint8_t*)0x200005c5 = 0; *(uint8_t*)0x200005c6 = 0; *(uint8_t*)0x200005c7 = 0; *(uint8_t*)0x200005c8 = 0; *(uint8_t*)0x200005c9 = 0; *(uint8_t*)0x200005ca = 0; *(uint8_t*)0x200005cb = 0; *(uint8_t*)0x200005cc = 0; *(uint8_t*)0x200005cd = 0; *(uint8_t*)0x200005ce = 0; *(uint8_t*)0x200005cf = 0xaa; *(uint8_t*)0x200005d0 = 0; *(uint8_t*)0x200005d1 = 0; *(uint8_t*)0x200005d2 = 0; *(uint8_t*)0x200005d3 = 0; *(uint8_t*)0x200005d4 = 0; *(uint8_t*)0x200005d5 = 0; *(uint8_t*)0x200005d6 = 0; *(uint8_t*)0x200005d7 = 0; *(uint8_t*)0x200005d8 = 0; *(uint8_t*)0x200005d9 = 0; *(uint8_t*)0x200005da = -1; *(uint8_t*)0x200005db = -1; *(uint32_t*)0x200005dc = htobe32(0x7f000001); *(uint8_t*)0x200005e0 = 0xfe; *(uint8_t*)0x200005e1 = 0x80; *(uint8_t*)0x200005e2 = 0; *(uint8_t*)0x200005e3 = 0; *(uint8_t*)0x200005e4 = 0; *(uint8_t*)0x200005e5 = 0; *(uint8_t*)0x200005e6 = 0; *(uint8_t*)0x200005e7 = 0; *(uint8_t*)0x200005e8 = 0; *(uint8_t*)0x200005e9 = 0; *(uint8_t*)0x200005ea = 0; *(uint8_t*)0x200005eb = 0; *(uint8_t*)0x200005ec = 0; *(uint8_t*)0x200005ed = 0; *(uint8_t*)0x200005ee = 0; *(uint8_t*)0x200005ef = 0xaa; *(uint32_t*)0x200005f0 = 0; *(uint16_t*)0x200005f4 = 0; *(uint16_t*)0x200005f6 = 0; *(uint32_t*)0x200005f8 = 0; *(uint64_t*)0x20000600 = 0; *(uint32_t*)0x20000608 = 0x20008; *(uint32_t*)0x2000060c = 0; syscall(__NR_ioctl, r[1], 0x89a0, 0x200005c0ul); res = syscall(__NR_socket, 0x10ul, 3ul, 0xc); if (res != -1) r[2] = res; *(uint64_t*)0x20000180 = 0; *(uint32_t*)0x20000188 = 0; *(uint64_t*)0x20000190 = 0x20000140; *(uint64_t*)0x20000140 = 0x200000c0; *(uint32_t*)0x200000c0 = 0x2c; *(uint8_t*)0x200000c4 = 0; *(uint8_t*)0x200000c5 = 0xb; *(uint16_t*)0x200000c6 = 0x301; *(uint32_t*)0x200000c8 = 0; *(uint32_t*)0x200000cc = 0; *(uint8_t*)0x200000d0 = 3; *(uint8_t*)0x200000d1 = 0; *(uint16_t*)0x200000d2 = htobe16(0); *(uint16_t*)0x200000d4 = 8; STORE_BY_BITMASK(uint16_t, , 0x200000d6, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000d7, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000d7, 0, 7, 1); *(uint32_t*)0x200000d8 = htobe32(1); *(uint16_t*)0x200000dc = 8; STORE_BY_BITMASK(uint16_t, , 0x200000de, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000df, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000df, 0, 7, 1); *(uint32_t*)0x200000e0 = htobe32(1); *(uint16_t*)0x200000e4 = 5; *(uint16_t*)0x200000e6 = 1; memcpy((void*)0x200000e8, "\000", 1); *(uint64_t*)0x20000148 = 0x2c; *(uint64_t*)0x20000198 = 1; *(uint64_t*)0x200001a0 = 0; *(uint64_t*)0x200001a8 = 0; *(uint32_t*)0x200001b0 = 0; syscall(__NR_sendmsg, r[2], 0x20000180ul, 0ul); } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); loop(); return 0; }