// https://syzkaller.appspot.com/bug?id=263641babb7f77b96d3fd13670303e216edf87a3 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_sendto #define __NR_sendto 369 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0xa, 2, 0); *(uint32_t*)0x20000f18 = htobe32(0xe0000001); *(uint32_t*)0x20000f28 = htobe32(0x7f000001); *(uint16_t*)0x20000f38 = htobe16(0x4e20); *(uint16_t*)0x20000f3a = 0; *(uint16_t*)0x20000f3c = htobe16(0x4e20); *(uint16_t*)0x20000f3e = 0; *(uint16_t*)0x20000f40 = 0xa; *(uint8_t*)0x20000f42 = 0; *(uint8_t*)0x20000f43 = 2; *(uint8_t*)0x20000f44 = 0; *(uint32_t*)0x20000f48 = 0; *(uint32_t*)0x20000f4c = 0; *(uint64_t*)0x20000f50 = 0; *(uint64_t*)0x20000f58 = 0; *(uint64_t*)0x20000f60 = 0; *(uint64_t*)0x20000f68 = 0; *(uint64_t*)0x20000f70 = 0; *(uint64_t*)0x20000f78 = 0; *(uint64_t*)0x20000f80 = 0; *(uint64_t*)0x20000f88 = 0; *(uint64_t*)0x20000f90 = 0; *(uint64_t*)0x20000f98 = 0; *(uint64_t*)0x20000fa0 = 0; *(uint64_t*)0x20000fa8 = 0; *(uint32_t*)0x20000fb0 = 0; *(uint32_t*)0x20000fb4 = 0; *(uint8_t*)0x20000fb8 = 1; *(uint8_t*)0x20000fb9 = 0; *(uint8_t*)0x20000fba = 0; *(uint8_t*)0x20000fbb = 0; *(uint32_t*)0x20000fc0 = htobe32(0x7f000001); *(uint32_t*)0x20000fd0 = 0; *(uint8_t*)0x20000fd4 = 0; *(uint16_t*)0x20000fd8 = 0; *(uint8_t*)0x20000fdc = 0; *(uint8_t*)0x20000fdd = 0; *(uint8_t*)0x20000fde = 0; *(uint8_t*)0x20000fdf = 0; *(uint8_t*)0x20000fe0 = 0; *(uint8_t*)0x20000fe1 = 0; *(uint8_t*)0x20000fe2 = 0; *(uint8_t*)0x20000fe3 = 0; *(uint8_t*)0x20000fe4 = 0; *(uint8_t*)0x20000fe5 = 0; *(uint8_t*)0x20000fe6 = 0; *(uint8_t*)0x20000fe7 = 0; *(uint8_t*)0x20000fe8 = 0; *(uint8_t*)0x20000fe9 = 0; *(uint8_t*)0x20000fea = 0; *(uint8_t*)0x20000feb = 0; *(uint32_t*)0x20000fec = 0; *(uint8_t*)0x20000ff0 = 0; *(uint8_t*)0x20000ff1 = 0; *(uint8_t*)0x20000ff2 = 0; *(uint32_t*)0x20000ff4 = 0; *(uint32_t*)0x20000ff8 = 0; *(uint32_t*)0x20000ffc = 0; syscall(__NR_setsockopt, r[0], 0x29, 0x23, 0x20000f18, 0xe8); *(uint16_t*)0x204e3fe4 = 2; *(uint16_t*)0x204e3fe6 = htobe16(0x4e20); *(uint32_t*)0x204e3fe8 = 0; *(uint8_t*)0x204e3fec = 0; *(uint8_t*)0x204e3fed = 0; *(uint8_t*)0x204e3fee = 0; *(uint8_t*)0x204e3fef = 0; *(uint8_t*)0x204e3ff0 = 0; *(uint8_t*)0x204e3ff1 = 0; *(uint8_t*)0x204e3ff2 = 0; *(uint8_t*)0x204e3ff3 = 0; *(uint8_t*)0x204e3ff4 = 0; *(uint8_t*)0x204e3ff5 = 0; *(uint8_t*)0x204e3ff6 = 0; *(uint8_t*)0x204e3ff7 = 0; *(uint8_t*)0x204e3ff8 = 0; *(uint8_t*)0x204e3ff9 = 0; *(uint8_t*)0x204e3ffa = 0; *(uint8_t*)0x204e3ffb = 0; *(uint32_t*)0x204e3ffc = 0; syscall(__NR_sendto, r[0], 0x20a9f000, 0, 0, 0x204e3fe4, 0x1c); } int main() { loop(); return 0; }