// https://syzkaller.appspot.com/bug?id=bbfe73a02a942da23358fa0accf886a7a24937cd // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x11, 0x800000000002, 0x300); if (res != -1) r[0] = res; *(uint16_t*)0x2095bffc = 0; *(uint8_t*)0x2095bffe = 0; *(uint8_t*)0x2095bfff = 0; syscall(__NR_setsockopt, r[0], 0x107, 0x12, 0x2095bffc, 4); res = syscall(__NR_socket, 2, 3, 6); if (res != -1) r[1] = res; memcpy((void*)0x20000000, "c", 1); *(uint16_t*)0x205b5ff0 = 2; *(uint16_t*)0x205b5ff2 = htobe16(0); *(uint32_t*)0x205b5ff4 = htobe32(0); *(uint8_t*)0x205b5ff8 = 0; *(uint8_t*)0x205b5ff9 = 0; *(uint8_t*)0x205b5ffa = 0; *(uint8_t*)0x205b5ffb = 0; *(uint8_t*)0x205b5ffc = 0; *(uint8_t*)0x205b5ffd = 0; *(uint8_t*)0x205b5ffe = 0; *(uint8_t*)0x205b5fff = 0; syscall(__NR_sendto, r[1], 0x20000000, 1, 0x8000, 0x205b5ff0, 0x10); memcpy((void*)0x200001c0, "\x25\x10\x00", 3); *(uint16_t*)0x20cf9000 = 2; *(uint16_t*)0x20cf9002 = htobe16(0); *(uint32_t*)0x20cf9004 = htobe32(0); *(uint8_t*)0x20cf9008 = 0; *(uint8_t*)0x20cf9009 = 0; *(uint8_t*)0x20cf900a = 0; *(uint8_t*)0x20cf900b = 0; *(uint8_t*)0x20cf900c = 0; *(uint8_t*)0x20cf900d = 0; *(uint8_t*)0x20cf900e = 0; *(uint8_t*)0x20cf900f = 0; syscall(__NR_sendto, r[1], 0x200001c0, 3, 0, 0x20cf9000, 0x10); *(uint32_t*)0x20000100 = 0x41424344; *(uint32_t*)0x20000104 = 0x41424344; *(uint32_t*)0x200002c0 = 0; *(uint32_t*)0x200002c4 = 0; *(uint32_t*)0x200002c8 = 0; *(uint32_t*)0x200002cc = 0; *(uint32_t*)0x200002d0 = 0; *(uint32_t*)0x200002d4 = 0; } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }