// https://syzkaller.appspot.com/bug?id=176a70590ebfd17c1e3d65c543580943188c20d7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include void loop() { memcpy((void*)0x20000000, "\xed\x03\x46\xad\x18\x94\xdd\x80\x27\xb0\x2a\x04\xe9\x90\xf7\xac\xaf" "\x37\x61\x8d\x56\x76\xce\xdb\xaf\xcf\x9b\x7a\x9a\x39\x4a\xcc\x88\xf8" "\xb7\xdc\x90\xf8\xb4\x41\x70\x7b\x43\xc5\x94\xaa\x61\xe9\xa5\x68\x69" "\x7e\x76\x3e\x3a\x13\x09\x23\xa6\xa6\xc1\x84\x58\x11\x8a\xfe\xa6\x2c" "\xcf\xce\xd8\xe7\x5d\x98\x1c\x85\xd8\x74\xe1\xfb\xb0\x4e\xcc\xae\xc7" "\x2d\x78\x4a\x81\x63\x27\xb4\x4c\xa5\x51\x2e\xe8\x41\x83\x1b\x14\x72" "\x53\xf9\x35\x34\x86\xff\xdc\x0e\x6f\xc6\xb1\xef\xb9\xc7\xfa\x9a\x1e" "\xe8\x6b\x75\x6e\x80\xf1\x5c\x5d\xb5\x47\xaa\xe7\x56\x36\xa6\x8c\xfd" "\x3f\xb0\xc0\x68\x5f\xb4\xce\x93\x40\x70\xfe\x94\x30\xc3\x4a\x3c\xa0" "\x11\xa2\xae\x67\x52\xcc\x54\x43\x35\x00\xae\xf2\x90\x1c\x77\x95\x6e" "\xf3\x2f\x24\x76\xcb\xd7\x63\x2c\xa7\xca\xe3\x5c\x20\xee\x0c\xea\x4f" "\x96\x1a\x5e\x8d\x18\xc3\xc9\x02\xff\x02\xe8\x24\x77\x1a\x72\x1c\xd3" "\x27\x0f\xa1\x97\x86\x10\x37\x5f\xd3\xc8\x45\x1e", 216); syscall(SYS_pop_ctx, 0x20000000); memcpy((void*)0x20000380, "/dev/sysstat", 13); syscall(SYS_openat, 0xffffffffffffff9c, 0x20000380, 0xd, 3, 0); memcpy((void*)0x20000540, "/proc/self/wait", 16); syscall(SYS_openat, 0xffffffffffffff9c, 0x20000540, 0x10, 1, 0); } int main() { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }