// https://syzkaller.appspot.com/bug?id=038c47c353490e96ed3592dfd723466c8d2f0648 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_connect #define __NR_connect 362 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 0xa, 2, 0); if (res != -1) r[0] = res; *(uint16_t*)0x20000000 = 0xa; *(uint16_t*)0x20000002 = htobe16(0); *(uint32_t*)0x20000004 = 0; *(uint8_t*)0x20000008 = 0; *(uint8_t*)0x20000009 = 0; *(uint8_t*)0x2000000a = 0; *(uint8_t*)0x2000000b = 0; *(uint8_t*)0x2000000c = 0; *(uint8_t*)0x2000000d = 0; *(uint8_t*)0x2000000e = 0; *(uint8_t*)0x2000000f = 0; *(uint8_t*)0x20000010 = 0; *(uint8_t*)0x20000011 = 0; *(uint8_t*)0x20000012 = -1; *(uint8_t*)0x20000013 = -1; *(uint32_t*)0x20000014 = htobe32(0x7f000001); *(uint32_t*)0x20000018 = 0; syscall(__NR_connect, (long)r[0], 0x20000000, 0x1c); *(uint32_t*)0x20000280 = 3; *(uint16_t*)0x20000284 = 0xa; *(uint16_t*)0x20000286 = htobe16(0x4e21); *(uint32_t*)0x20000288 = 0xfffffffc; *(uint8_t*)0x2000028c = -1; *(uint8_t*)0x2000028d = 2; *(uint8_t*)0x2000028e = 0; *(uint8_t*)0x2000028f = 0; *(uint8_t*)0x20000290 = 0; *(uint8_t*)0x20000291 = 0; *(uint8_t*)0x20000292 = 0; *(uint8_t*)0x20000293 = 0; *(uint8_t*)0x20000294 = 0; *(uint8_t*)0x20000295 = 0; *(uint8_t*)0x20000296 = 0; *(uint8_t*)0x20000297 = 0; *(uint8_t*)0x20000298 = 0; *(uint8_t*)0x20000299 = 0; *(uint8_t*)0x2000029a = 0; *(uint8_t*)0x2000029b = 1; *(uint32_t*)0x2000029c = 5; syscall(__NR_setsockopt, (long)r[0], 0x29, 0x2a, 0x20000280, 0x88); *(uint32_t*)0x20000080 = 2; syscall(__NR_setsockopt, (long)r[0], 0x29, 1, 0x20000080, 4); return 0; }