// https://syzkaller.appspot.com/bug?id=699ab57701c240ba847bd831e714aeda5b56047b // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; *(uint32_t*)0x20000200 = 4; *(uint32_t*)0x20000204 = 0xe; *(uint64_t*)0x20000208 = 0x20000480; memcpy((void*)0x20000480, "\xb7\x02\x00\x00\x04\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07" "\x01\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4" "\xf0\xff\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05" "\x00\x00\x00\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00" "\x01\x00\x7d\x60\xb7\x03\x00\x00\x00\x00\x00\x00\x6a\x0a\x00\xfe\x00" "\xba\x23\x00\x85\x00\x00\x00\x1f\x00\x00\x00\xb7\x00\x00\x00\x00\x00" "\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\xae\xb5\x85\x30\x00\xc7\xaa" "\x22\xc9\x49\x50\x49\xfb\x02\x5f\x57\x4a\x7d\x64\x05\x2c\x58\x22\x97" "\xd7\x72\xe1\xeb\x2a\xa2\x0a\x73\xf4\xf4\x40\x20\x13\x02\xa9\xc2\x67" "\xab\x12\x2e\x21\xad\x03\xe0\xcc\x03\xfd\xdd\x2c\x8a\xb5\xf8\x20\xe0" "\x7a\x85\x43\xdb\x2b\xfe\xa6\xbf\x5d\xd1\x29\xe9\x33\x72\x42\xed\x26" "\xe1\xdd\xbb\xdd\xbd\x5f\xd0\xfc\x4b\xa6\xbe\x3a\x2d\x8f\x31\xe4\x1d" "\x83\xf4\x41\x01\x1b\xdf\x7c\x69\xa2\x5c\x5f\xfa\xd7\x87\x63\x2a\xd8" "\x59\xe1\xc9\x14\x06\x44\x0b\xfe\xd7\x46\x5e\x41\x89\x68\x68\x38\xdf" "\x0b\xd7\x9e\x6e\x32", 243); *(uint64_t*)0x20000210 = 0x20000340; memcpy((void*)0x20000340, "syzkaller\000", 10); *(uint32_t*)0x20000218 = 0; *(uint32_t*)0x2000021c = 0; *(uint64_t*)0x20000220 = 0; *(uint32_t*)0x20000228 = 0; *(uint32_t*)0x2000022c = 0; *(uint8_t*)0x20000230 = 0; *(uint8_t*)0x20000231 = 0; *(uint8_t*)0x20000232 = 0; *(uint8_t*)0x20000233 = 0; *(uint8_t*)0x20000234 = 0; *(uint8_t*)0x20000235 = 0; *(uint8_t*)0x20000236 = 0; *(uint8_t*)0x20000237 = 0; *(uint8_t*)0x20000238 = 0; *(uint8_t*)0x20000239 = 0; *(uint8_t*)0x2000023a = 0; *(uint8_t*)0x2000023b = 0; *(uint8_t*)0x2000023c = 0; *(uint8_t*)0x2000023d = 0; *(uint8_t*)0x2000023e = 0; *(uint8_t*)0x2000023f = 0; *(uint32_t*)0x20000240 = 0; *(uint32_t*)0x20000244 = 0; *(uint32_t*)0x20000248 = -1; *(uint32_t*)0x2000024c = 8; *(uint64_t*)0x20000250 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000258 = 0; *(uint32_t*)0x2000025c = 0x10; *(uint64_t*)0x20000260 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x20000268 = 0; res = syscall(__NR_bpf, 5, 0x20000200, 0x48); if (res != -1) r[0] = res; *(uint32_t*)0x20000040 = r[0]; *(uint32_t*)0x20000044 = 0; *(uint32_t*)0x20000048 = 0xe; *(uint32_t*)0x2000004c = 0; *(uint64_t*)0x20000050 = 0x20000400; memcpy((void*)0x20000400, "\x3d\x6e\xe2\xe0\x4b\x91\xab\x10\xf3\x0f\x9b\xbe\x08\x00", 14); *(uint64_t*)0x20000058 = 0; *(uint32_t*)0x20000060 = 0x4000; *(uint32_t*)0x20000064 = 0; syscall(__NR_bpf, 0xa, 0x20000040, 0x28); return 0; }