// https://syzkaller.appspot.com/bug?id=f0e01204e654ebd94c1d5ec4b99a76e9aa668bf7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include void loop() { *(uint64_t*)0x20003780 = 0x20000080; *(uint16_t*)0x20000080 = 1; memcpy((void*)0x20000082, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x20003788 = 0x6e; *(uint64_t*)0x20003790 = 0x200005c0; *(uint64_t*)0x200005c0 = 0x20000440; *(uint64_t*)0x200005c8 = 0; *(uint64_t*)0x200005d0 = 0x20000100; *(uint64_t*)0x200005d8 = 0; *(uint64_t*)0x200005e0 = 0x200004c0; *(uint64_t*)0x200005e8 = 0; *(uint64_t*)0x20003798 = 3; *(uint64_t*)0x200037a0 = 0x20000600; *(uint64_t*)0x20000600 = 0x18; *(uint32_t*)0x20000608 = 1; *(uint32_t*)0x2000060c = 1; *(uint32_t*)0x20000610 = -1; *(uint64_t*)0x200037a8 = 0x18; *(uint32_t*)0x200037b0 = 0; *(uint64_t*)0x200037b8 = 0x20000900; *(uint16_t*)0x20000900 = 1; memcpy((void*)0x20000902, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x200037c0 = 0x6e; *(uint64_t*)0x200037c8 = 0x20000d80; *(uint64_t*)0x20000d80 = 0x20000980; memcpy((void*)0x20000980, "\x82\x55\x23\x29\xef\x60\x04\xee\x62\xd5\x1d\xc3\xd5\x01\x5b\xc6\x3e" "\x55\x64\xc5\xcb\xa6\xcf\xca\x3e\x08\x38\x86\x35\xf2\xb5\x17\xd0\x23" "\xb7\x54\x2e\xaf\x12\xa2\x19\x65\x0b\x74\x5a\x4c\x2b\xf2\x00\xb2\x9c" "\xde\xaa\x14\xe0\x8e\x4b\x3e\x63\x97\x63\xb5\xf2\xc3\x16\x4e\xf1\xc8" "\x73\x0b\xd2\x1f\x09\x65\x0a\x60\x41\x11\xcf\x7d\xf7\xdd\xb0\xe5\xd2" "\x23\xf1\x58\xb3\xf3\xc1\x34\x45\xbb\xb8\x68\xc0\x58\xca\xc3\x1d\xad" "\x58\x73\xd2\x66\x33\x05\x69\x08\xde\x19\xc6\x67\xf2\x72\xcc\x8a\x9e" "\x07\xd7\x5b\x3c\x8a\x3f\xec\x1b\x1b\xb6\xcd\x0e\x59\x33\x4c\xab\xea" "\xca\xe2\x68\x57\x71\x43\x17\xb0\x64\xaf\xae\xf8\xdb\x75\xa3\xdf\x1b" "\x3d\xf7\x81\x1a\x59\x8d\xc0\x24\x19\x9d\xc6\x11\x1c\xe6\x0f\xde\xc5" "\x73\xa9\x49\x4a\x26\x89\x5c\x7c\x4d\xcb\xa8\xae\xf2\x76\x57\x47\xc8" "\xef\x5b\x0a\xf5\xf4\xd9\xd9\xa4\xd2\x90\x83\xfa\x49\x85\x25\xe8\x54" "\x9a\x53\x1d\x1f\x4e\xd8\x00\xc0\xce", 213); *(uint64_t*)0x20000d88 = 0xd5; *(uint64_t*)0x20000d90 = 0x20000a80; *(uint64_t*)0x20000d98 = 0; *(uint64_t*)0x20000da0 = 0x20000ac0; *(uint64_t*)0x20000da8 = 0; *(uint64_t*)0x20000db0 = 0x20000b80; *(uint64_t*)0x20000db8 = 0; *(uint64_t*)0x20000dc0 = 0x20000c00; *(uint64_t*)0x20000dc8 = 0; *(uint64_t*)0x20000dd0 = 0x20000c80; *(uint64_t*)0x20000dd8 = 0; *(uint64_t*)0x200037d0 = 6; *(uint64_t*)0x200037d8 = 0x20001240; *(uint64_t*)0x20001240 = 0x20; *(uint32_t*)0x20001248 = 1; *(uint32_t*)0x2000124c = 2; *(uint32_t*)0x20001250 = 0; *(uint32_t*)0x20001254 = 0; *(uint32_t*)0x20001258 = 0; *(uint64_t*)0x20001260 = 0x20; *(uint32_t*)0x20001268 = 1; *(uint32_t*)0x2000126c = 2; *(uint32_t*)0x20001270 = 0; *(uint32_t*)0x20001274 = 0; *(uint32_t*)0x20001278 = 0; *(uint64_t*)0x20001280 = 0x20; *(uint32_t*)0x20001288 = 1; *(uint32_t*)0x2000128c = 2; *(uint32_t*)0x20001290 = 0; *(uint32_t*)0x20001294 = 0; *(uint32_t*)0x20001298 = 0; *(uint64_t*)0x200012a0 = 0x10; *(uint32_t*)0x200012a8 = 1; *(uint32_t*)0x200012ac = 1; *(uint64_t*)0x200037e0 = 0x70; *(uint32_t*)0x200037e8 = 0x4000; *(uint64_t*)0x200037f0 = 0x200012c0; *(uint16_t*)0x200012c0 = 1; memcpy((void*)0x200012c2, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x200037f8 = 0x6e; *(uint64_t*)0x20003800 = 0x20002580; *(uint64_t*)0x20002580 = 0x20001340; *(uint64_t*)0x20002588 = 0; *(uint64_t*)0x20002590 = 0x20001440; *(uint64_t*)0x20002598 = 0; *(uint64_t*)0x200025a0 = 0x20001500; *(uint64_t*)0x200025a8 = 0; *(uint64_t*)0x200025b0 = 0x20002500; *(uint64_t*)0x200025b8 = 0; *(uint64_t*)0x20003808 = 4; *(uint64_t*)0x20003810 = 0x20002840; *(uint64_t*)0x20002840 = 0x20; *(uint32_t*)0x20002848 = 1; *(uint32_t*)0x2000284c = 2; *(uint32_t*)0x20002850 = 0; *(uint32_t*)0x20002854 = 0; *(uint32_t*)0x20002858 = 0; *(uint64_t*)0x20002860 = 0x30; *(uint32_t*)0x20002868 = 1; *(uint32_t*)0x2000286c = 1; *(uint32_t*)0x20002870 = -1; *(uint32_t*)0x20002874 = -1; *(uint32_t*)0x20002878 = -1; *(uint32_t*)0x2000287c = -1; *(uint32_t*)0x20002880 = -1; *(uint32_t*)0x20002884 = -1; *(uint32_t*)0x20002888 = -1; *(uint32_t*)0x2000288c = -1; *(uint64_t*)0x20002890 = 0x20; *(uint32_t*)0x20002898 = 1; *(uint32_t*)0x2000289c = 2; *(uint32_t*)0x200028a0 = 0; *(uint32_t*)0x200028a4 = 0; *(uint32_t*)0x200028a8 = 0; *(uint64_t*)0x20003818 = 0x70; *(uint32_t*)0x20003820 = 1; *(uint64_t*)0x20003828 = 0x200028c0; *(uint16_t*)0x200028c0 = 0; memcpy((void*)0x200028c2, "\x2e\x2f\x66\x69\x6c\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00", 108); *(uint32_t*)0x20003830 = 0x6e; *(uint64_t*)0x20003838 = 0x20002ac0; *(uint64_t*)0x20002ac0 = 0x20002940; *(uint64_t*)0x20002ac8 = 0; *(uint64_t*)0x20002ad0 = 0x200029c0; *(uint64_t*)0x20002ad8 = 0; *(uint64_t*)0x20002ae0 = 0x20002a80; *(uint64_t*)0x20002ae8 = 0; *(uint64_t*)0x20003840 = 3; *(uint64_t*)0x20003848 = 0x20002c40; *(uint64_t*)0x20002c40 = 0x20; *(uint32_t*)0x20002c48 = 1; *(uint32_t*)0x20002c4c = 2; *(uint32_t*)0x20002c50 = 0; *(uint32_t*)0x20002c54 = 0; *(uint32_t*)0x20002c58 = 0; *(uint64_t*)0x20002c60 = 0x20; *(uint32_t*)0x20002c68 = 1; *(uint32_t*)0x20002c6c = 2; *(uint32_t*)0x20002c70 = 0; *(uint32_t*)0x20002c74 = 0; *(uint32_t*)0x20002c78 = 0; *(uint64_t*)0x20003850 = 0x40; *(uint32_t*)0x20003858 = 0x80; *(uint64_t*)0x20003860 = 0x20002c80; *(uint16_t*)0x20002c80 = 1; *(uint8_t*)0x20002c82 = 0; *(uint32_t*)0x20002c84 = 0x4e22; *(uint32_t*)0x20003868 = 0x6e; *(uint64_t*)0x20003870 = 0x200030c0; *(uint64_t*)0x200030c0 = 0x20002d00; *(uint64_t*)0x200030c8 = 0; *(uint64_t*)0x200030d0 = 0x20002e00; *(uint64_t*)0x200030d8 = 0; *(uint64_t*)0x200030e0 = 0x20002f00; *(uint64_t*)0x200030e8 = 0; *(uint64_t*)0x200030f0 = 0x20002f40; *(uint64_t*)0x200030f8 = 0; *(uint64_t*)0x20003100 = 0x20003000; *(uint64_t*)0x20003108 = 0; *(uint64_t*)0x20003110 = 0x20003040; *(uint64_t*)0x20003118 = 0; *(uint64_t*)0x20003878 = 6; *(uint64_t*)0x20003880 = 0; *(uint64_t*)0x20003888 = 0; *(uint32_t*)0x20003890 = 0x4841; *(uint64_t*)0x20003898 = 0x20003140; *(uint16_t*)0x20003140 = 0; *(uint8_t*)0x20003142 = 0; *(uint32_t*)0x20003144 = 0x4e23; *(uint32_t*)0x200038a0 = 0x6e; *(uint64_t*)0x200038a8 = 0x20003300; *(uint64_t*)0x20003300 = 0x200031c0; *(uint64_t*)0x20003308 = 0; *(uint64_t*)0x20003310 = 0x20003280; *(uint64_t*)0x20003318 = 0; *(uint64_t*)0x200038b0 = 2; *(uint64_t*)0x200038b8 = 0x200036c0; *(uint32_t*)0x200036c0 = -1; *(uint32_t*)0x200036c4 = -1; *(uint32_t*)0x200036c8 = -1; *(uint32_t*)0x200036cc = -1; *(uint32_t*)0x200036d0 = -1; *(uint32_t*)0x200036d4 = -1; *(uint32_t*)0x200036d8 = -1; *(uint32_t*)0x200036dc = -1; *(uint32_t*)0x200036e0 = -1; *(uint32_t*)0x200036e4 = -1; *(uint32_t*)0x200036e8 = -1; *(uint32_t*)0x200036ec = -1; *(uint32_t*)0x200036f0 = -1; *(uint32_t*)0x200036f4 = -1; *(uint32_t*)0x200036f8 = -1; *(uint32_t*)0x200036fc = -1; *(uint32_t*)0x20003700 = -1; *(uint64_t*)0x200038c0 = 0x44; *(uint32_t*)0x200038c8 = 0x10; syscall(__NR_sendmmsg, -1, 0x20003780, 6, 0x4000015); memcpy((void*)0x20000280, "dns_resolver", 13); *(uint8_t*)0x200002c0 = 0x73; *(uint8_t*)0x200002c1 = 0x79; *(uint8_t*)0x200002c2 = 0x7a; *(uint8_t*)0x200002c3 = 0; *(uint8_t*)0x200002c4 = 0; syscall(__NR_add_key, 0x20000280, 0x200002c0, 0x20000300, 0xfffff, 0xfffffffd); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }