// https://syzkaller.appspot.com/bug?id=8f063539d4ecf1faf3132624b57a641e923ee25a // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } struct csum_inet { uint32_t acc; }; static void csum_inet_init(struct csum_inet* csum) { csum->acc = 0; } static void csum_inet_update(struct csum_inet* csum, const uint8_t* data, size_t length) { if (length == 0) return; size_t i; for (i = 0; i < length - 1; i += 2) csum->acc += *(uint16_t*)&data[i]; if (length & 1) csum->acc += (uint16_t)data[length - 1]; while (csum->acc > 0xffff) csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16); } static uint16_t csum_inet_digest(struct csum_inet* csum) { return ~csum->acc; } #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[8] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; syscall(__NR_socket, 0xa, 3, 0x3a); *(uint8_t*)0x20000040 = 0xaa; *(uint8_t*)0x20000041 = 0xaa; *(uint8_t*)0x20000042 = 0xaa; *(uint8_t*)0x20000043 = 0xaa; *(uint8_t*)0x20000044 = 0xaa; *(uint8_t*)0x20000045 = 0xaa; *(uint8_t*)0x20000046 = -1; *(uint8_t*)0x20000047 = -1; *(uint8_t*)0x20000048 = -1; *(uint8_t*)0x20000049 = -1; *(uint8_t*)0x2000004a = -1; *(uint8_t*)0x2000004b = -1; *(uint16_t*)0x2000004c = htobe16(0x800); STORE_BY_BITMASK(uint8_t, 0x2000004e, 5, 0, 4); STORE_BY_BITMASK(uint8_t, 0x2000004e, 4, 4, 4); STORE_BY_BITMASK(uint8_t, 0x2000004f, 6, 0, 2); STORE_BY_BITMASK(uint8_t, 0x2000004f, 0, 2, 6); *(uint16_t*)0x20000050 = htobe16(0x30); *(uint16_t*)0x20000052 = htobe16(0); *(uint16_t*)0x20000054 = htobe16(0); *(uint8_t*)0x20000056 = 0; *(uint8_t*)0x20000057 = 1; *(uint16_t*)0x20000058 = htobe16(0); *(uint8_t*)0x2000005a = 0xac; *(uint8_t*)0x2000005b = 0x14; *(uint8_t*)0x2000005c = 0x14; *(uint8_t*)0x2000005d = 0xbb; *(uint8_t*)0x2000005e = 0xac; *(uint8_t*)0x2000005f = 0x14; *(uint8_t*)0x20000060 = 0x14; *(uint8_t*)0x20000061 = 0; *(uint8_t*)0x20000062 = 0xb; *(uint8_t*)0x20000063 = 4; *(uint16_t*)0x20000064 = htobe16(0); *(uint8_t*)0x20000066 = 0; *(uint8_t*)0x20000067 = 0; *(uint16_t*)0x20000068 = 0; STORE_BY_BITMASK(uint8_t, 0x2000006a, 5, 0, 4); STORE_BY_BITMASK(uint8_t, 0x2000006a, 4, 4, 4); STORE_BY_BITMASK(uint8_t, 0x2000006b, 0, 0, 2); STORE_BY_BITMASK(uint8_t, 0x2000006b, 0, 2, 6); *(uint16_t*)0x2000006c = htobe16(0); *(uint16_t*)0x2000006e = htobe16(0); *(uint16_t*)0x20000070 = htobe16(0); *(uint8_t*)0x20000072 = 0; *(uint8_t*)0x20000073 = 0; *(uint16_t*)0x20000074 = htobe16(0); *(uint8_t*)0x20000076 = 0xac; *(uint8_t*)0x20000077 = 0x14; *(uint8_t*)0x20000078 = 0x14; *(uint8_t*)0x20000079 = 0xaa; *(uint8_t*)0x2000007a = 0xac; *(uint8_t*)0x2000007b = 0x14; *(uint8_t*)0x2000007c = 0x14; *(uint8_t*)0x2000007d = 0; *(uint32_t*)0x20000140 = 0; *(uint32_t*)0x20000144 = 0; *(uint32_t*)0x20000148 = 0; *(uint32_t*)0x2000014c = 0; *(uint32_t*)0x20000150 = 0; *(uint32_t*)0x20000154 = 0; struct csum_inet csum_1; csum_inet_init(&csum_1); csum_inet_update(&csum_1, (const uint8_t*)0x20000062, 28); *(uint16_t*)0x20000064 = csum_inet_digest(&csum_1); struct csum_inet csum_2; csum_inet_init(&csum_2); csum_inet_update(&csum_2, (const uint8_t*)0x2000004e, 20); *(uint16_t*)0x20000058 = csum_inet_digest(&csum_2); memcpy((void*)0x20000340, "/dev/kvm", 9); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000340, 0, 0); if (res != -1) r[0] = res; res = syscall(__NR_ioctl, r[0], 0xae01, 0); if (res != -1) r[1] = res; res = syscall(__NR_ioctl, r[1], 0xae41, 0); if (res != -1) r[2] = res; *(uint32_t*)0x20000040 = 2; *(uint32_t*)0x20000044 = 0; *(uint64_t*)0x20000048 = 0x49; *(uint64_t*)0x20000050 = 1; *(uint64_t*)0x20000058 = 0; *(uint64_t*)0x20000060 = 0; *(uint8_t*)0x20000068 = 0; *(uint8_t*)0x20000069 = 0; *(uint8_t*)0x2000006a = 0; *(uint8_t*)0x2000006b = 0; *(uint8_t*)0x2000006c = 0; *(uint8_t*)0x2000006d = 0; *(uint8_t*)0x2000006e = 0; *(uint8_t*)0x2000006f = 0; *(uint8_t*)0x20000070 = 0; *(uint8_t*)0x20000071 = 0; *(uint8_t*)0x20000072 = 0; *(uint8_t*)0x20000073 = 0; *(uint8_t*)0x20000074 = 0; *(uint8_t*)0x20000075 = 0; *(uint8_t*)0x20000076 = 0; *(uint8_t*)0x20000077 = 0; *(uint8_t*)0x20000078 = 0; *(uint8_t*)0x20000079 = 0; *(uint8_t*)0x2000007a = 0; *(uint8_t*)0x2000007b = 0; *(uint8_t*)0x2000007c = 0; *(uint8_t*)0x2000007d = 0; *(uint8_t*)0x2000007e = 0; *(uint8_t*)0x2000007f = 0; *(uint8_t*)0x20000080 = 0; *(uint8_t*)0x20000081 = 0; *(uint8_t*)0x20000082 = 0; *(uint8_t*)0x20000083 = 0; *(uint8_t*)0x20000084 = 0; *(uint8_t*)0x20000085 = 0; *(uint8_t*)0x20000086 = 0; *(uint8_t*)0x20000087 = 0; *(uint8_t*)0x20000088 = 0; *(uint8_t*)0x20000089 = 0; *(uint8_t*)0x2000008a = 0; *(uint8_t*)0x2000008b = 0; *(uint8_t*)0x2000008c = 0; *(uint8_t*)0x2000008d = 0; *(uint8_t*)0x2000008e = 0; *(uint8_t*)0x2000008f = 0; *(uint8_t*)0x20000090 = 0; *(uint8_t*)0x20000091 = 0; *(uint8_t*)0x20000092 = 0; *(uint8_t*)0x20000093 = 0; *(uint8_t*)0x20000094 = 0; *(uint8_t*)0x20000095 = 0; *(uint8_t*)0x20000096 = 0; *(uint8_t*)0x20000097 = 0; *(uint8_t*)0x20000098 = 0; *(uint8_t*)0x20000099 = 0; *(uint8_t*)0x2000009a = 0; *(uint8_t*)0x2000009b = 0; *(uint8_t*)0x2000009c = 0; *(uint8_t*)0x2000009d = 0; *(uint8_t*)0x2000009e = 0; *(uint8_t*)0x2000009f = 0; *(uint8_t*)0x200000a0 = 0; *(uint8_t*)0x200000a1 = 0; *(uint8_t*)0x200000a2 = 0; *(uint8_t*)0x200000a3 = 0; *(uint8_t*)0x200000a4 = 0; *(uint8_t*)0x200000a5 = 0; *(uint8_t*)0x200000a6 = 0; *(uint8_t*)0x200000a7 = 0; syscall(__NR_ioctl, r[2], 0xc080aebe, 0x20000040); memcpy((void*)0x20000140, "\x4e\x45\x54\x4d\x41\x50\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x2000015d = 0; *(uint32_t*)0x20000180 = 0x1e; syscall(__NR_getsockopt, -1, 0, 0x63, 0x20000140, 0x20000180); syscall(__NR_msgget, 0, 0x76); syscall(__NR_getresuid, 0x20000400, 0x20000440, 0x20000280); memcpy((void*)0x20000340, "./file0", 8); syscall(__NR_lstat, 0x20000340, 0x20000380); syscall(__NR_getpid); syscall(__NR_socket, 0xa, 0x1000000000002, 0); memcpy((void*)0x20000500, "./file0", 8); *(uint64_t*)0x200005c0 = 0x20000540; memcpy((void*)0x20000540, "trusted", 8); *(uint64_t*)0x200005c8 = 0x20000580; memcpy((void*)0x20000580, "selinux\\", 9); *(uint64_t*)0x20000680 = 0x20000600; memcpy((void*)0x20000600, "NETMAP", 7); *(uint64_t*)0x20000688 = 0x20000640; memcpy((void*)0x20000640, "NETMAP", 7); syscall(__NR_execve, 0x20000500, 0x200005c0, 0x20000680); *(uint32_t*)0x20000140 = 0; *(uint32_t*)0x20000144 = 0x70; *(uint8_t*)0x20000148 = 0x15; *(uint8_t*)0x20000149 = 0; *(uint8_t*)0x2000014a = 0; *(uint8_t*)0x2000014b = 0; *(uint32_t*)0x2000014c = 0; *(uint64_t*)0x20000150 = 0; *(uint64_t*)0x20000158 = 0; *(uint64_t*)0x20000160 = 0; STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 0, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 1, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 2, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 3, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 4, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0x10000003, 5, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 6, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 7, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 8, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 9, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 10, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 11, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 12, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 13, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 14, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 15, 2); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 17, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 18, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 19, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 20, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 21, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 22, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 23, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 24, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 25, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 26, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 27, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 28, 1); STORE_BY_BITMASK(uint64_t, 0x20000168, 0, 29, 35); *(uint32_t*)0x20000170 = 0; *(uint32_t*)0x20000174 = 0; *(uint64_t*)0x20000178 = 0; *(uint64_t*)0x20000180 = 0; *(uint64_t*)0x20000188 = 0; *(uint64_t*)0x20000190 = 0; *(uint32_t*)0x20000198 = 0; *(uint32_t*)0x2000019c = 0; *(uint64_t*)0x200001a0 = 0; *(uint32_t*)0x200001a8 = 0; *(uint16_t*)0x200001ac = 0; *(uint16_t*)0x200001ae = 0; syscall(__NR_perf_event_open, 0x20000140, 0, 0, -1, 0); *(uint8_t*)0x20000040 = 0; *(uint8_t*)0x20000041 = 0; *(uint8_t*)0x20000042 = 0; *(uint8_t*)0x20000043 = 0; *(uint8_t*)0x20000044 = 0; *(uint8_t*)0x20000045 = 0; *(uint8_t*)0x20000046 = 0; *(uint8_t*)0x20000047 = 0; *(uint8_t*)0x20000048 = 0; *(uint8_t*)0x20000049 = 0; *(uint8_t*)0x2000004a = 0; *(uint8_t*)0x2000004b = 0; *(uint8_t*)0x2000004c = 0; *(uint8_t*)0x2000004d = 0; *(uint8_t*)0x2000004e = 0; *(uint8_t*)0x2000004f = 0; *(uint8_t*)0x20000050 = 0; *(uint8_t*)0x20000051 = 0; *(uint8_t*)0x20000052 = 0; *(uint8_t*)0x20000053 = 0; *(uint8_t*)0x20000054 = 0; *(uint8_t*)0x20000055 = 0; *(uint8_t*)0x20000056 = 0; *(uint8_t*)0x20000057 = 0; *(uint8_t*)0x20000058 = 0; *(uint8_t*)0x20000059 = 0; *(uint8_t*)0x2000005a = 0; *(uint8_t*)0x2000005b = 0; *(uint8_t*)0x2000005c = 0; *(uint8_t*)0x2000005d = 0; *(uint8_t*)0x2000005e = 0; *(uint8_t*)0x2000005f = 0; *(uint16_t*)0x20000060 = 0; *(uint32_t*)0x20000064 = 9; *(uint32_t*)0x20000068 = 0x3f; *(uint64_t*)0x20000070 = 0x401; *(uint64_t*)0x20000078 = 0xe30; *(uint32_t*)0x20000080 = 0; syscall(__NR_ioctl, -1, 0xc0481273, 0x20000040); syscall(__NR_ioctl, -1, 2, 0); syscall(__NR_socket, 0xa, 0x40000001, 0); syscall(__NR_socket, 2, 3, 1); res = syscall(__NR_pipe2, 0x20000100, 0); if (res != -1) r[3] = *(uint32_t*)0x20000104; *(uint32_t*)0x20000040 = 0xffffffca; *(uint8_t*)0x20000044 = 0x4d; *(uint16_t*)0x20000045 = 0; syscall(__NR_write, r[3], 0x20000040, 7); memcpy((void*)0x20000140, "./file0", 8); syscall(__NR_mkdir, 0x20000140, 0); res = syscall(__NR_pipe2, 0x20000100, 0); if (res != -1) { r[4] = *(uint32_t*)0x20000100; r[5] = *(uint32_t*)0x20000104; } *(uint32_t*)0x20000040 = 0xffffffca; *(uint8_t*)0x20000044 = 0x4d; *(uint16_t*)0x20000045 = 0; syscall(__NR_write, r[5], 0x20000040, 7); *(uint32_t*)0x20000200 = 0xa0; *(uint8_t*)0x20000204 = 0x19; *(uint16_t*)0x20000205 = 1; *(uint64_t*)0x20000207 = 0; *(uint8_t*)0x2000020f = 0; *(uint32_t*)0x20000210 = 0; *(uint64_t*)0x20000214 = 0; *(uint32_t*)0x2000021c = 0; *(uint32_t*)0x20000220 = 0; *(uint32_t*)0x20000224 = 0; *(uint64_t*)0x20000228 = 0; *(uint64_t*)0x20000230 = 0; *(uint64_t*)0x20000238 = 0; *(uint64_t*)0x20000240 = 0; *(uint64_t*)0x20000248 = 0; *(uint64_t*)0x20000250 = 0; *(uint64_t*)0x20000258 = 0; *(uint64_t*)0x20000260 = 0; *(uint64_t*)0x20000268 = 0; *(uint64_t*)0x20000270 = 0; *(uint64_t*)0x20000278 = 0; *(uint64_t*)0x20000280 = 0; *(uint64_t*)0x20000288 = 0; *(uint64_t*)0x20000290 = 0; *(uint64_t*)0x20000298 = 0; syscall(__NR_write, r[5], 0x20000200, 0xa0); memcpy((void*)0x20000000, "./file0", 8); memcpy((void*)0x20000900, "\x39\x70\xfe", 3); memcpy((void*)0x20000a00, "trans=fd,", 9); memcpy((void*)0x20000a09, "rfdno", 5); *(uint8_t*)0x20000a0e = 0x3d; sprintf((char*)0x20000a0f, "0x%016llx", (long long)r[4]); *(uint8_t*)0x20000a21 = 0x2c; memcpy((void*)0x20000a22, "wfdno", 5); *(uint8_t*)0x20000a27 = 0x3d; sprintf((char*)0x20000a28, "0x%016llx", (long long)r[5]); *(uint8_t*)0x20000a3a = 0x2c; memcpy((void*)0x20000a3b, "loose", 5); *(uint8_t*)0x20000a40 = 0x2c; memcpy((void*)0x20000a41, "debug", 5); *(uint8_t*)0x20000a46 = 0x3d; sprintf((char*)0x20000a47, "0x%016llx", (long long)7); *(uint8_t*)0x20000a59 = 0x2c; memcpy((void*)0x20000a5a, "loose", 5); *(uint8_t*)0x20000a5f = 0x2c; memcpy((void*)0x20000a60, "cachetag", 8); *(uint8_t*)0x20000a68 = 0x3d; memcpy((void*)0x20000a69, "9p", 3); *(uint8_t*)0x20000a6c = 0x2c; memcpy((void*)0x20000a6d, "nodevmap", 8); *(uint8_t*)0x20000a75 = 0x2c; memcpy((void*)0x20000a76, "version=9p2000.L", 16); *(uint8_t*)0x20000a86 = 0x2c; memcpy((void*)0x20000a87, "access=client", 13); *(uint8_t*)0x20000a94 = 0x2c; memcpy((void*)0x20000a95, "version=9p2000", 14); *(uint8_t*)0x20000aa3 = 0x2c; *(uint8_t*)0x20000aa4 = 0; syscall(__NR_mount, 0, 0x20000000, 0x20000900, 0, 0x20000a00); res = syscall(__NR_socketpair, 2, 0xf, 1, 0x20000100); if (res != -1) r[6] = *(uint32_t*)0x20000104; memcpy((void*)0x20000140, "\x4e\x45\x54\x4d\x41\x50\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x2000015d = 0; *(uint32_t*)0x20000180 = 0x1e; syscall(__NR_getsockopt, r[6], 0, 0x63, 0x20000140, 0x20000180); syscall(__NR_gettid); syscall(__NR_getpid); syscall(__NR_ioprio_get, 3, 0); memcpy((void*)0x20000500, "./file0", 8); *(uint64_t*)0x200005c0 = 0x20000540; memcpy((void*)0x20000540, "trusted", 8); *(uint64_t*)0x200005c8 = 0x20000580; memcpy((void*)0x20000580, "selinux\\", 9); *(uint64_t*)0x20000680 = 0x20000600; memcpy((void*)0x20000600, "NETMAP", 7); *(uint64_t*)0x20000688 = 0x20000640; memcpy((void*)0x20000640, "NETMAP", 7); syscall(__NR_execve, 0x20000500, 0x200005c0, 0x20000680); memcpy((void*)0x200002c0, "./file0", 8); syscall(__NR_lstat, 0x200002c0, 0x200007c0); *(uint8_t*)0x20000040 = 0; *(uint8_t*)0x20000041 = 0; *(uint8_t*)0x20000042 = 0; *(uint8_t*)0x20000043 = 0; *(uint8_t*)0x20000044 = 0; *(uint8_t*)0x20000045 = 0; *(uint8_t*)0x20000046 = 0; *(uint8_t*)0x20000047 = 0; *(uint8_t*)0x20000048 = 0; *(uint8_t*)0x20000049 = 0; *(uint8_t*)0x2000004a = 0; *(uint8_t*)0x2000004b = 0; *(uint8_t*)0x2000004c = 0; *(uint8_t*)0x2000004d = 0; *(uint8_t*)0x2000004e = 0; *(uint8_t*)0x2000004f = 0; *(uint8_t*)0x20000050 = 0; *(uint8_t*)0x20000051 = 0; *(uint8_t*)0x20000052 = 0; *(uint8_t*)0x20000053 = 0; *(uint8_t*)0x20000054 = 0; *(uint8_t*)0x20000055 = 0; *(uint8_t*)0x20000056 = 0; *(uint8_t*)0x20000057 = 0; *(uint8_t*)0x20000058 = 0; *(uint8_t*)0x20000059 = 0; *(uint8_t*)0x2000005a = 0; *(uint8_t*)0x2000005b = 0; *(uint8_t*)0x2000005c = 0; *(uint8_t*)0x2000005d = 0; *(uint8_t*)0x2000005e = 0; *(uint8_t*)0x2000005f = 0; *(uint16_t*)0x20000060 = 0; *(uint32_t*)0x20000064 = 9; *(uint32_t*)0x20000068 = 0x3f; *(uint64_t*)0x20000070 = 0x401; *(uint64_t*)0x20000078 = 0xe30; *(uint32_t*)0x20000080 = 0; syscall(__NR_ioctl, -1, 0xc0481273, 0x20000040); syscall(__NR_ioctl, -1, 0x1260, 0); syscall(__NR_socket, 0xa, 0x40000001, 0); *(uint32_t*)0x20011fd4 = 9; *(uint32_t*)0x20011fd8 = 0; *(uint32_t*)0x20011fdc = 4; *(uint32_t*)0x20011fe0 = 4; *(uint32_t*)0x20011fe4 = 0; *(uint32_t*)0x20011fe8 = 1; *(uint32_t*)0x20011fec = 0; *(uint8_t*)0x20011ff0 = 0; *(uint8_t*)0x20011ff1 = 0; *(uint8_t*)0x20011ff2 = 0; *(uint8_t*)0x20011ff3 = 0; *(uint8_t*)0x20011ff4 = 0; *(uint8_t*)0x20011ff5 = 0; *(uint8_t*)0x20011ff6 = 0; *(uint8_t*)0x20011ff7 = 0; *(uint8_t*)0x20011ff8 = 0; *(uint8_t*)0x20011ff9 = 0; *(uint8_t*)0x20011ffa = 0; *(uint8_t*)0x20011ffb = 0; *(uint8_t*)0x20011ffc = 0; *(uint8_t*)0x20011ffd = 0; *(uint8_t*)0x20011ffe = 0; *(uint8_t*)0x20011fff = 0; syscall(__NR_bpf, 0, 0x20011fd4, 0x2c); *(uint32_t*)0x20000700 = 4; syscall(__NR_getsockopt, -1, 6, 0x1f, 0x200000c0, 0x20000700); res = syscall(__NR_socket, 0xa, 0x1000000000002, 0); if (res != -1) r[7] = res; memcpy((void*)0x20000000, "\x0a\x5c\xc8\x07\x00\x31\x5f\x85\x71\x50\x70", 11); syscall(__NR_ioctl, r[7], 0x8912, 0x20000000); *(uint64_t*)0x20003fe8 = 0xaa; *(uint64_t*)0x20003ff0 = 0; *(uint64_t*)0x20003ff8 = 0; syscall(__NR_ioctl, -1, 0xc018aa3f, 0x20003fe8); *(uint64_t*)0x20001fe2 = 0x20011000; *(uint64_t*)0x20001fea = 0x3000; *(uint64_t*)0x20001ff2 = 1; *(uint64_t*)0x20001ffa = 0; syscall(__NR_ioctl, -1, 0xc020aa00, 0x20001fe2); *(uint32_t*)0x20013e95 = 0; syscall(__NR_setsockopt, -1, 0x84, 8, 0x20013e95, 4); return 0; }