// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20000480 = 0x20000080; *(uint16_t*)0x20000080 = 0x18; *(uint32_t*)0x20000082 = 0; *(uint16_t*)0x20000086 = 4; *(uint8_t*)0x20000088 = 0xaa; *(uint8_t*)0x20000089 = 0xaa; *(uint8_t*)0x2000008a = 0xaa; *(uint8_t*)0x2000008b = 0xaa; *(uint8_t*)0x2000008c = 0xaa; *(uint8_t*)0x2000008d = 0xbb; memcpy((void*)0x2000008e, "\x79\x61\x6d\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint32_t*)0x20000488 = 0x80; *(uint64_t*)0x20000490 = 0x20000340; *(uint64_t*)0x20000340 = 0x20000100; *(uint64_t*)0x20000348 = 0; *(uint64_t*)0x20000350 = 0x20000200; *(uint64_t*)0x20000358 = 0; *(uint64_t*)0x20000360 = 0x200002c0; *(uint64_t*)0x20000368 = 0; *(uint64_t*)0x20000370 = 0x20000000; *(uint64_t*)0x20000378 = 0; *(uint64_t*)0x20000498 = 4; *(uint64_t*)0x200004a0 = 0x20000380; *(uint64_t*)0x20000380 = 0x10; *(uint32_t*)0x20000388 = 0x116; *(uint32_t*)0x2000038c = 0xfff; *(uint64_t*)0x20000390 = 0x10; *(uint32_t*)0x20000398 = 0; *(uint32_t*)0x2000039c = 6; *(uint64_t*)0x200003a0 = 0x10; *(uint32_t*)0x200003a8 = 0x10f; *(uint32_t*)0x200003ac = 2; *(uint64_t*)0x200004a8 = 0x30; *(uint32_t*)0x200004b0 = 0x8000; syscall(__NR_sendmsg, r[0], 0x20000480, 0x20000080); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }