// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 0x801, 0); if (res != -1) r[0] = res; *(uint64_t*)0x200027c0 = 0x20000940; *(uint16_t*)0x20000940 = 0x18; *(uint32_t*)0x20000942 = 1; *(uint32_t*)0x20000946 = 0; *(uint32_t*)0x2000094a = r[0]; *(uint16_t*)0x2000094e = 2; *(uint16_t*)0x20000950 = htobe16(0x4e20); *(uint32_t*)0x20000952 = htobe32(0xe0000001); *(uint8_t*)0x20000956 = 0; *(uint8_t*)0x20000957 = 0; *(uint8_t*)0x20000958 = 0; *(uint8_t*)0x20000959 = 0; *(uint8_t*)0x2000095a = 0; *(uint8_t*)0x2000095b = 0; *(uint8_t*)0x2000095c = 0; *(uint8_t*)0x2000095d = 0; *(uint32_t*)0x2000095e = 1; *(uint32_t*)0x20000962 = 3; *(uint32_t*)0x20000966 = 1; *(uint32_t*)0x2000096a = 3; *(uint32_t*)0x200027c8 = 0x80; *(uint64_t*)0x200027d0 = 0x20000d40; *(uint64_t*)0x20000d40 = 0x200009c0; *(uint64_t*)0x20000d48 = 0; *(uint64_t*)0x20000d50 = 0x20000a00; *(uint64_t*)0x20000d58 = 0; *(uint64_t*)0x20000d60 = 0x20000b00; *(uint64_t*)0x20000d68 = 0; *(uint64_t*)0x20000d70 = 0x20000c00; *(uint64_t*)0x20000d78 = 0; *(uint64_t*)0x20000d80 = 0x20000c40; *(uint64_t*)0x20000d88 = 0; *(uint64_t*)0x200027d8 = 5; *(uint64_t*)0x200027e0 = 0x20000dc0; *(uint64_t*)0x20000dc0 = 0x10; *(uint32_t*)0x20000dc8 = 0x110; *(uint32_t*)0x20000dcc = 0x577; *(uint64_t*)0x20000dd0 = 0x10; *(uint32_t*)0x20000dd8 = 0; *(uint32_t*)0x20000ddc = 1; *(uint64_t*)0x20000de0 = 0x10; *(uint32_t*)0x20000de8 = 0; *(uint32_t*)0x20000dec = 0x80000000; *(uint64_t*)0x20000df0 = 0x10; *(uint32_t*)0x20000df8 = 0x101; *(uint32_t*)0x20000dfc = 4; *(uint64_t*)0x20000e00 = 0x10; *(uint32_t*)0x20000e08 = 6; *(uint32_t*)0x20000e0c = 0x401; *(uint64_t*)0x20000e10 = 0x10; *(uint32_t*)0x20000e18 = 0x101; *(uint32_t*)0x20000e1c = 3; *(uint64_t*)0x200027e8 = 0x60; *(uint32_t*)0x200027f0 = 0x4881; *(uint32_t*)0x200027f8 = 0; *(uint64_t*)0x20002800 = 0; *(uint32_t*)0x20002808 = 0; *(uint64_t*)0x20002810 = 0x20002200; *(uint64_t*)0x20002200 = 0x200020c0; *(uint64_t*)0x20002208 = 0; *(uint64_t*)0x20002210 = 0x200021c0; *(uint64_t*)0x20002218 = 0; *(uint64_t*)0x20002818 = 2; *(uint64_t*)0x20002820 = 0x20002240; *(uint64_t*)0x20002240 = 0x10; *(uint32_t*)0x20002248 = 0x113; *(uint32_t*)0x2000224c = 0xf8f0; *(uint64_t*)0x20002250 = 0x10; *(uint32_t*)0x20002258 = 0; *(uint32_t*)0x2000225c = 0x7ff; *(uint64_t*)0x20002260 = 0x10; *(uint32_t*)0x20002268 = 0; *(uint32_t*)0x2000226c = 0xffff; *(uint64_t*)0x20002270 = 0x10; *(uint32_t*)0x20002278 = 0x119; *(uint32_t*)0x2000227c = 0x7ff; *(uint64_t*)0x20002280 = 0x10; *(uint32_t*)0x20002288 = 0; *(uint32_t*)0x2000228c = 5; *(uint64_t*)0x20002290 = 0x10; *(uint32_t*)0x20002298 = 0x115; *(uint32_t*)0x2000229c = 3; *(uint64_t*)0x200022a0 = 0x10; *(uint32_t*)0x200022a8 = 0x29; *(uint32_t*)0x200022ac = 0x400; *(uint64_t*)0x20002828 = 0x70; *(uint32_t*)0x20002830 = 0x840; *(uint32_t*)0x20002838 = 0x7ec4; syscall(__NR_sendmmsg, r[0], 0x200027c0, 2, 0x20000000); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }