// https://syzkaller.appspot.com/bug?id=4e947674d10b0fb0cb94d4d723989cee439a71d6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 0x10, 3, 6); if (res != -1) r[0] = res; *(uint64_t*)0x20000400 = 0x20000040; *(uint16_t*)0x20000040 = 0x10; *(uint16_t*)0x20000042 = 0; *(uint32_t*)0x20000044 = 0; *(uint32_t*)0x20000048 = 0; *(uint32_t*)0x20000408 = 0xc; *(uint64_t*)0x20000410 = 0x200001c0; *(uint64_t*)0x200001c0 = 0x200005c0; *(uint32_t*)0x200005c0 = 0xb8; *(uint16_t*)0x200005c4 = 0x19; *(uint16_t*)0x200005c6 = 0x407; *(uint32_t*)0x200005c8 = 0; *(uint32_t*)0x200005cc = 0; *(uint32_t*)0x200005d0 = htobe32(0x7f000001); *(uint8_t*)0x200005e0 = 0; *(uint8_t*)0x200005e1 = 0; *(uint8_t*)0x200005e2 = 0; *(uint8_t*)0x200005e3 = 0; *(uint8_t*)0x200005e4 = 0; *(uint8_t*)0x200005e5 = 0; *(uint8_t*)0x200005e6 = 0; *(uint8_t*)0x200005e7 = 0; *(uint8_t*)0x200005e8 = 0; *(uint8_t*)0x200005e9 = 0; *(uint8_t*)0x200005ea = -1; *(uint8_t*)0x200005eb = -1; *(uint8_t*)0x200005ec = 0xac; *(uint8_t*)0x200005ed = 0x14; *(uint8_t*)0x200005ee = 0x14; *(uint8_t*)0x200005ef = 0; *(uint16_t*)0x200005f0 = htobe16(0); *(uint16_t*)0x200005f2 = htobe16(0); *(uint16_t*)0x200005f4 = htobe16(0); *(uint16_t*)0x200005f6 = htobe16(0); *(uint16_t*)0x200005f8 = 2; *(uint8_t*)0x200005fa = -1; *(uint8_t*)0x200005fb = 0xfc; *(uint8_t*)0x200005fc = 0; *(uint32_t*)0x20000600 = 0; *(uint32_t*)0x20000604 = 0; *(uint64_t*)0x20000608 = 0; *(uint64_t*)0x20000610 = 0; *(uint64_t*)0x20000618 = 0; *(uint64_t*)0x20000620 = 0; *(uint64_t*)0x20000628 = 0; *(uint64_t*)0x20000630 = 0; *(uint64_t*)0x20000638 = 0; *(uint64_t*)0x20000640 = 0; *(uint64_t*)0x20000648 = 0; *(uint64_t*)0x20000650 = 0; *(uint64_t*)0x20000658 = 0; *(uint64_t*)0x20000660 = 0; *(uint32_t*)0x20000668 = 0; *(uint32_t*)0x2000066c = 0; *(uint8_t*)0x20000670 = 0; *(uint8_t*)0x20000671 = 0; *(uint8_t*)0x20000672 = 0; *(uint8_t*)0x20000673 = 0; *(uint64_t*)0x200001c8 = 0xb8; *(uint64_t*)0x20000418 = 1; *(uint64_t*)0x20000420 = 0; *(uint64_t*)0x20000428 = 0; *(uint32_t*)0x20000430 = 0; syscall(__NR_sendmsg, r[0], 0x20000400, 0); res = syscall(__NR_socket, 2, 0x200000002, 0x88); if (res != -1) r[1] = res; *(uint16_t*)0x20000000 = 2; *(uint16_t*)0x20000002 = htobe16(0x4e21); *(uint32_t*)0x20000004 = htobe32(0); *(uint8_t*)0x20000008 = 0; *(uint8_t*)0x20000009 = 0; *(uint8_t*)0x2000000a = 0; *(uint8_t*)0x2000000b = 0; *(uint8_t*)0x2000000c = 0; *(uint8_t*)0x2000000d = 0; *(uint8_t*)0x2000000e = 0; *(uint8_t*)0x2000000f = 0; syscall(__NR_bind, r[1], 0x20000000, 0x10); res = syscall(__NR_dup2, r[1], r[1]); if (res != -1) r[2] = res; *(uint16_t*)0x20000100 = 2; *(uint16_t*)0x20000102 = htobe16(0x4e21); *(uint32_t*)0x20000104 = htobe32(0); *(uint8_t*)0x20000108 = 0; *(uint8_t*)0x20000109 = 0; *(uint8_t*)0x2000010a = 0; *(uint8_t*)0x2000010b = 0; *(uint8_t*)0x2000010c = 0; *(uint8_t*)0x2000010d = 0; *(uint8_t*)0x2000010e = 0; *(uint8_t*)0x2000010f = 0; syscall(__NR_sendto, r[2], 0x20000140, 0, 0x8000, 0x20000100, 0x10); *(uint16_t*)0x20000040 = 2; *(uint16_t*)0x20000042 = htobe16(0); *(uint32_t*)0x20000044 = htobe32(-1); *(uint8_t*)0x20000048 = 0; *(uint8_t*)0x20000049 = 0; *(uint8_t*)0x2000004a = 0; *(uint8_t*)0x2000004b = 0; *(uint8_t*)0x2000004c = 0; *(uint8_t*)0x2000004d = 0; *(uint8_t*)0x2000004e = 0; *(uint8_t*)0x2000004f = 0; syscall(__NR_sendto, r[1], 0x20000180, 0, 0, 0x20000040, 0x10); return 0; }