// https://syzkaller.appspot.com/bug?id=1665547180092fef185a46d5a4ba5b382d77848e // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[27]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0xaul, 0x1ul, 0x84ul); memcpy((void*)0x201a6000, "\x92\x2e\xed\x72\x41\x8d\x22\x30\x96\x34\x2b\x75\xe7\x4b\xd5" "\xd2\x6a\x49\xa6\x99\xd1\x86\xb0\xf0\x5a\x77\xbc\x69\x9b\xff" "\xb9\xd4\x3b\x17\x9e\x43\xce\xa5\x8b\xf7\xa3\xb1\xe8\xf0\x01" "\x9e\xb1\x57\x8c\x5f\xbc\xf2\x7f\x87\xbb\x3b\x47\xe1\x71\x50" "\x33\xaf\xe7\xc9\x47\xab\x86\x0a\x99\xa5\xc6\x0c\x8b\x0b\xff" "\xcf\xc3\x3b\xd6\xab\x7e\xfe\xf9\x4b\x30\x23\x11\xed\x9f\x6b" "\x88\x7c\x87\xa1\x4a\x8e\x84\x3d\x2c\xa4\xaa\xa4\xc9\xda\x25" "\x76\x54\xcc\x98\x7b\x0c\xcb\xe8\x6d\x95\x5f\x33\x28\x7c\xab" "\xbe\xb4\xc7\x92\x3e\x91\x09\xca\x45\x97\x8c\x8e\xb0\xf5\x26" "\x14\xd2\x2a\xcf\xa8\x27\x90\xbd\xbc\xaa\x75\x7d\xa2\x12\xbf" "\x30\x4c\x13\x72\x5d\x2f\x39\xd5\x4c\x9b\x5e\x4f\x9f\xcc\xec" "\xab\xf8\x12\xd6\x17\x39\xcf\xa2\x52\xaf\x34\xba\x73\x61\xb0" "\xff\x3c\x1f\x89\x9c\x36\x92\x8d\x5e\xd2\xc3\x07\x3e\x75\xe8" "\xcf\x1a\x55\xf8\xba\x67\x40\xbe\x1e\x63\x0f\x56\xb1\x56\x38" "\x74\x80\x4d\xfc\x30\x1b\x8b\xf1\xe9\x6c\xb7\x55\x4c\xfe\xd8" "\xb9\x8b\x8e\xcc\x74\xdc\xda\xfe\xfe\x0e\x8a\x3c\x60\x95\x45" "\xf6\xc4\x1a\x0c\x29", 245); *(uint16_t*)0x2015bfe4 = (uint16_t)0xa; *(uint16_t*)0x2015bfe6 = (uint16_t)0x204e; *(uint32_t*)0x2015bfe8 = (uint32_t)0x6; *(uint8_t*)0x2015bfec = (uint8_t)0xfe; *(uint8_t*)0x2015bfed = (uint8_t)0x80; *(uint8_t*)0x2015bfee = (uint8_t)0x0; *(uint8_t*)0x2015bfef = (uint8_t)0x0; *(uint8_t*)0x2015bff0 = (uint8_t)0x0; *(uint8_t*)0x2015bff1 = (uint8_t)0x0; *(uint8_t*)0x2015bff2 = (uint8_t)0x0; *(uint8_t*)0x2015bff3 = (uint8_t)0x0; *(uint8_t*)0x2015bff4 = (uint8_t)0x0; *(uint8_t*)0x2015bff5 = (uint8_t)0x0; *(uint8_t*)0x2015bff6 = (uint8_t)0x0; *(uint8_t*)0x2015bff7 = (uint8_t)0x0; *(uint8_t*)0x2015bff8 = (uint8_t)0x0; *(uint8_t*)0x2015bff9 = (uint8_t)0x0; *(uint8_t*)0x2015bffa = (uint8_t)0x0; *(uint8_t*)0x2015bffb = (uint8_t)0xbb; *(uint32_t*)0x2015bffc = (uint32_t)0x1; r[23] = syscall(__NR_sendto, r[1], 0x201a6000ul, 0xf5ul, 0x40ul, 0x2015bfe4ul, 0x1cul); r[24] = syscall(__NR_listen, r[1], 0x10000ul); *(uint32_t*)0x208d6ffc = (uint32_t)0x10; r[26] = syscall(__NR_accept, r[1], 0x2050b000ul, 0x208d6ffcul); } int main() { loop(); return 0; }