// https://syzkaller.appspot.com/bug?id=4e947674d10b0fb0cb94d4d723989cee439a71d6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 0x10, 3, 6); if (res != -1) r[0] = res; *(uint64_t*)0x20001440 = 0x20000000; *(uint16_t*)0x20000000 = 0x10; *(uint16_t*)0x20000002 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x20001448 = 0x349; *(uint64_t*)0x20001450 = 0x20001400; *(uint64_t*)0x20001400 = 0x20001040; *(uint32_t*)0x20001040 = 0xb8; *(uint16_t*)0x20001044 = 0x19; *(uint16_t*)0x20001046 = 0x101; *(uint32_t*)0x20001048 = 0; *(uint32_t*)0x2000104c = 0; *(uint32_t*)0x20001050 = htobe32(0xe0000001); *(uint8_t*)0x20001060 = -1; *(uint8_t*)0x20001061 = 2; *(uint8_t*)0x20001062 = 0; *(uint8_t*)0x20001063 = 0; *(uint8_t*)0x20001064 = 0; *(uint8_t*)0x20001065 = 0; *(uint8_t*)0x20001066 = 0; *(uint8_t*)0x20001067 = 0; *(uint8_t*)0x20001068 = 0; *(uint8_t*)0x20001069 = 0; *(uint8_t*)0x2000106a = 0; *(uint8_t*)0x2000106b = 0; *(uint8_t*)0x2000106c = 0; *(uint8_t*)0x2000106d = 0; *(uint8_t*)0x2000106e = 0; *(uint8_t*)0x2000106f = 1; *(uint16_t*)0x20001070 = htobe16(0); *(uint16_t*)0x20001072 = htobe16(0); *(uint16_t*)0x20001074 = htobe16(0); *(uint16_t*)0x20001076 = htobe16(0); *(uint16_t*)0x20001078 = 0xa; *(uint8_t*)0x2000107a = 0; *(uint8_t*)0x2000107b = 0; *(uint8_t*)0x2000107c = 0; *(uint32_t*)0x20001080 = 0; *(uint32_t*)0x20001084 = 0; *(uint64_t*)0x20001088 = 0; *(uint64_t*)0x20001090 = 0; *(uint64_t*)0x20001098 = 0; *(uint64_t*)0x200010a0 = 0; *(uint64_t*)0x200010a8 = 0; *(uint64_t*)0x200010b0 = 0; *(uint64_t*)0x200010b8 = 0; *(uint64_t*)0x200010c0 = 0; *(uint64_t*)0x200010c8 = 0; *(uint64_t*)0x200010d0 = 0; *(uint64_t*)0x200010d8 = 0; *(uint64_t*)0x200010e0 = 0; *(uint32_t*)0x200010e8 = 0; *(uint32_t*)0x200010ec = 0; *(uint8_t*)0x200010f0 = 0; *(uint8_t*)0x200010f1 = 0; *(uint8_t*)0x200010f2 = 0; *(uint8_t*)0x200010f3 = 0; *(uint64_t*)0x20001408 = 0xb8; *(uint64_t*)0x20001458 = 1; *(uint64_t*)0x20001460 = 0; *(uint64_t*)0x20001468 = 0; *(uint32_t*)0x20001470 = 0; syscall(__NR_sendmsg, r[0], 0x20001440, 0); res = syscall(__NR_socket, 2, 0x200000002, 0x88); if (res != -1) r[1] = res; *(uint16_t*)0x20000000 = 2; *(uint16_t*)0x20000002 = htobe16(0x4e21); *(uint32_t*)0x20000004 = htobe32(0); *(uint8_t*)0x20000008 = 0; *(uint8_t*)0x20000009 = 0; *(uint8_t*)0x2000000a = 0; *(uint8_t*)0x2000000b = 0; *(uint8_t*)0x2000000c = 0; *(uint8_t*)0x2000000d = 0; *(uint8_t*)0x2000000e = 0; *(uint8_t*)0x2000000f = 0; syscall(__NR_bind, r[1], 0x20000000, 0x10); res = syscall(__NR_dup2, r[1], r[1]); if (res != -1) r[2] = res; *(uint16_t*)0x20000100 = 2; *(uint16_t*)0x20000102 = htobe16(0x4e21); *(uint32_t*)0x20000104 = htobe32(0); *(uint8_t*)0x20000108 = 0; *(uint8_t*)0x20000109 = 0; *(uint8_t*)0x2000010a = 0; *(uint8_t*)0x2000010b = 0; *(uint8_t*)0x2000010c = 0; *(uint8_t*)0x2000010d = 0; *(uint8_t*)0x2000010e = 0; *(uint8_t*)0x2000010f = 0; syscall(__NR_sendto, r[2], 0x20000140, 0, 0x8000, 0x20000100, 0x10); *(uint16_t*)0x20000040 = 2; *(uint16_t*)0x20000042 = htobe16(0); *(uint32_t*)0x20000044 = htobe32(-1); *(uint8_t*)0x20000048 = 0; *(uint8_t*)0x20000049 = 0; *(uint8_t*)0x2000004a = 0; *(uint8_t*)0x2000004b = 0; *(uint8_t*)0x2000004c = 0; *(uint8_t*)0x2000004d = 0; *(uint8_t*)0x2000004e = 0; *(uint8_t*)0x2000004f = 0; syscall(__NR_sendto, r[1], 0x20000180, 0, 0, 0x20000040, 0x10); return 0; }