// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xf86000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0xf, 3, 2); *(uint64_t*)0x20f56000 = 0; *(uint32_t*)0x20f56008 = 0; *(uint64_t*)0x20f56010 = 0x208feff0; *(uint64_t*)0x20f56018 = 1; *(uint64_t*)0x20f56020 = 0; *(uint64_t*)0x20f56028 = 0; *(uint32_t*)0x20f56030 = 0; *(uint64_t*)0x208feff0 = 0x202fffa8; *(uint64_t*)0x208feff8 = 0x50; *(uint8_t*)0x202fffa8 = 2; *(uint8_t*)0x202fffa9 = 3; *(uint8_t*)0x202fffaa = 0; *(uint8_t*)0x202fffab = 9; *(uint16_t*)0x202fffac = 0xa; *(uint16_t*)0x202fffae = 0; *(uint32_t*)0x202fffb0 = 0; *(uint32_t*)0x202fffb4 = 0; *(uint16_t*)0x202fffb8 = 3; *(uint16_t*)0x202fffba = 6; *(uint8_t*)0x202fffbc = 0; *(uint8_t*)0x202fffbd = 0; *(uint16_t*)0x202fffbe = 0; *(uint16_t*)0x202fffc0 = 2; *(uint16_t*)0x202fffc2 = 0; *(uint32_t*)0x202fffc4 = htobe32(0xe0000001); *(uint8_t*)0x202fffc8 = 0; *(uint8_t*)0x202fffc9 = 0; *(uint8_t*)0x202fffca = 0; *(uint8_t*)0x202fffcb = 0; *(uint8_t*)0x202fffcc = 0; *(uint8_t*)0x202fffcd = 0; *(uint8_t*)0x202fffce = 0; *(uint8_t*)0x202fffcf = 0; *(uint16_t*)0x202fffd0 = 2; *(uint16_t*)0x202fffd2 = 1; *(uint32_t*)0x202fffd4 = 0; *(uint8_t*)0x202fffd8 = 0; *(uint8_t*)0x202fffd9 = 0; *(uint8_t*)0x202fffda = 0; *(uint8_t*)0x202fffdb = 2; *(uint32_t*)0x202fffdc = 0; *(uint16_t*)0x202fffe0 = 3; *(uint16_t*)0x202fffe2 = 5; *(uint8_t*)0x202fffe4 = 0; *(uint8_t*)0x202fffe5 = 0; *(uint16_t*)0x202fffe6 = 0; *(uint16_t*)0x202fffe8 = 2; *(uint16_t*)0x202fffea = 0; *(uint32_t*)0x202fffec = htobe32(0xe0000001); *(uint8_t*)0x202ffff0 = 0; *(uint8_t*)0x202ffff1 = 0; *(uint8_t*)0x202ffff2 = 0; *(uint8_t*)0x202ffff3 = 0; *(uint8_t*)0x202ffff4 = 0; *(uint8_t*)0x202ffff5 = 0; *(uint8_t*)0x202ffff6 = 0; *(uint8_t*)0x202ffff7 = 0; syscall(__NR_sendmsg, r[0], 0x20f56000, 0); } int main() { for (;;) { loop(); } }