// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20001680 = 0; *(uint32_t*)0x20001688 = 0; *(uint64_t*)0x20001690 = 0x20000440; *(uint64_t*)0x20000440 = 0x20000340; *(uint64_t*)0x20000448 = 0; *(uint64_t*)0x20000450 = 0x200003c0; *(uint64_t*)0x20000458 = 0; *(uint64_t*)0x20001698 = 2; *(uint64_t*)0x200016a0 = 0x20000480; *(uint64_t*)0x20000480 = 0x10; *(uint32_t*)0x20000488 = 0x29; *(uint32_t*)0x2000048c = 2; *(uint64_t*)0x20000490 = 0x10; *(uint32_t*)0x20000498 = 0x1ff; *(uint32_t*)0x2000049c = 0; *(uint64_t*)0x200004a0 = 0x10; *(uint32_t*)0x200004a8 = 0x11f; *(uint32_t*)0x200004ac = 4; *(uint64_t*)0x200016a8 = 0x30; *(uint32_t*)0x200016b0 = 0x4000; *(uint32_t*)0x200016b8 = 2; syscall(__NR_sendmmsg, r[0], 0x20001680, 1, 0x20000000); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }