// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x2000b700 = 0x20000080; *(uint16_t*)0x20000080 = 0x27; *(uint32_t*)0x20000084 = 1; *(uint32_t*)0x20000088 = 2; *(uint32_t*)0x2000008c = 5; *(uint32_t*)0x2000b708 = 0x80; *(uint64_t*)0x2000b710 = 0x20000100; *(uint64_t*)0x2000b718 = 0; *(uint64_t*)0x2000b720 = 0x20000140; *(uint64_t*)0x2000b728 = 0; *(uint32_t*)0x2000b730 = 0; *(uint32_t*)0x2000b738 = 0x20; *(uint64_t*)0x2000b740 = 0x20001240; *(uint16_t*)0x20001240 = 3; memcpy((void*)0x20001242, "\xd3\x33\x58\xac\x1b\x0b\x25", 7); *(uint32_t*)0x2000124c = 0x10000; *(uint32_t*)0x2000b748 = 0x80; *(uint64_t*)0x2000b750 = 0x20001340; *(uint64_t*)0x20001340 = 0x200012c0; *(uint64_t*)0x20001348 = 0; *(uint64_t*)0x20001350 = 0x20001980; *(uint64_t*)0x20001358 = 0; *(uint64_t*)0x20001360 = 0x20001300; *(uint64_t*)0x20001368 = 0; *(uint64_t*)0x2000b758 = 3; *(uint64_t*)0x2000b760 = 0x20002980; *(uint64_t*)0x20002980 = 0x10; *(uint32_t*)0x20002988 = 0; *(uint32_t*)0x2000298c = 7; *(uint64_t*)0x20002990 = 0x10; *(uint32_t*)0x20002998 = 0x10b; *(uint32_t*)0x2000299c = 0; *(uint64_t*)0x200029a0 = 0x10; *(uint32_t*)0x200029a8 = 1; *(uint32_t*)0x200029ac = 8; *(uint64_t*)0x200029b0 = 0x10; *(uint32_t*)0x200029b8 = 0x10d; *(uint32_t*)0x200029bc = 0xfbb; *(uint64_t*)0x200029c0 = 0x10; *(uint32_t*)0x200029c8 = 0x1ff; *(uint32_t*)0x200029cc = 6; *(uint64_t*)0x2000b768 = 0x50; *(uint32_t*)0x2000b770 = 0x4001; *(uint32_t*)0x2000b778 = 0xd5; *(uint64_t*)0x2000b780 = 0x20001400; *(uint16_t*)0x20001400 = 0x1f; *(uint32_t*)0x20001404 = 0; *(uint16_t*)0x20001408 = 3; *(uint32_t*)0x2000b788 = 0x80; *(uint64_t*)0x2000b790 = 0x200015c0; *(uint64_t*)0x200015c0 = 0x20001480; *(uint64_t*)0x200015c8 = 0; *(uint64_t*)0x200015d0 = 0x20001540; *(uint64_t*)0x200015d8 = 0; *(uint64_t*)0x200015e0 = 0x20001580; *(uint64_t*)0x200015e8 = 0; *(uint64_t*)0x2000b798 = 3; *(uint64_t*)0x2000b7a0 = 0x20001600; *(uint64_t*)0x20001600 = 0x10; *(uint32_t*)0x20001608 = 0x11f; *(uint32_t*)0x2000160c = 4; *(uint64_t*)0x2000b7a8 = 0x10; *(uint32_t*)0x2000b7b0 = 0x4000; *(uint32_t*)0x2000b7b8 = 0; *(uint64_t*)0x2000b7c0 = 0x200016c0; *(uint16_t*)0x200016c0 = 3; memcpy((void*)0x200016c2, "\x1d\x55\x9f\x59\xda\x2d\xa1", 7); *(uint32_t*)0x200016cc = 2; *(uint32_t*)0x2000b7c8 = 0x80; *(uint64_t*)0x2000b7d0 = 0x20004b80; *(uint64_t*)0x20004b80 = 0x20001740; *(uint64_t*)0x20004b88 = 0; *(uint64_t*)0x20004b90 = 0x20001780; *(uint64_t*)0x20004b98 = 0; *(uint64_t*)0x20004ba0 = 0x20001840; *(uint64_t*)0x20004ba8 = 0; *(uint64_t*)0x20004bb0 = 0x200018c0; *(uint64_t*)0x20004bb8 = 0; *(uint64_t*)0x2000b7d8 = 4; *(uint64_t*)0x2000b7e0 = 0x20004bc0; *(uint64_t*)0x2000b7e8 = 0; *(uint32_t*)0x2000b7f0 = 0; *(uint32_t*)0x2000b7f8 = 9; *(uint64_t*)0x2000b800 = 0x20004d80; *(uint16_t*)0x20004d80 = 0x10; *(uint16_t*)0x20004d82 = 0; *(uint32_t*)0x20004d84 = 0; *(uint32_t*)0x20004d88 = 0x4000; *(uint32_t*)0x2000b808 = 0x80; *(uint64_t*)0x2000b810 = 0x20004f40; *(uint64_t*)0x20004f40 = 0x20004e00; *(uint64_t*)0x20004f48 = 0; *(uint64_t*)0x20004f50 = 0x20004e40; *(uint64_t*)0x20004f58 = 0; *(uint64_t*)0x2000b818 = 2; *(uint64_t*)0x2000b820 = 0x20004f80; *(uint64_t*)0x20004f80 = 0x10; *(uint32_t*)0x20004f88 = 0x11f; *(uint32_t*)0x20004f8c = 9; *(uint64_t*)0x20004f90 = 0x10; *(uint32_t*)0x20004f98 = 0x10f; *(uint32_t*)0x20004f9c = 6; *(uint64_t*)0x20004fa0 = 0x10; *(uint32_t*)0x20004fa8 = 0x118; *(uint32_t*)0x20004fac = 9; *(uint64_t*)0x20004fb0 = 0x10; *(uint32_t*)0x20004fb8 = 0x13f; *(uint32_t*)0x20004fbc = 3; *(uint64_t*)0x20004fc0 = 0x10; *(uint32_t*)0x20004fc8 = 0x118; *(uint32_t*)0x20004fcc = 0xe4; *(uint64_t*)0x20004fd0 = 0x10; *(uint32_t*)0x20004fd8 = 0x116; *(uint32_t*)0x20004fdc = 0xff; *(uint64_t*)0x20004fe0 = 0x10; *(uint32_t*)0x20004fe8 = 0xbe; *(uint32_t*)0x20004fec = 0x100; *(uint64_t*)0x20004ff0 = 0x10; *(uint32_t*)0x20004ff8 = 0x102; *(uint32_t*)0x20004ffc = 8; *(uint64_t*)0x20005000 = 0x10; *(uint32_t*)0x20005008 = 0x10a; *(uint32_t*)0x2000500c = 0xdca; *(uint64_t*)0x20005010 = 0x10; *(uint32_t*)0x20005018 = 1; *(uint32_t*)0x2000501c = 8; *(uint64_t*)0x2000b828 = 0xa0; *(uint32_t*)0x2000b830 = 0; *(uint32_t*)0x2000b838 = 6; *(uint64_t*)0x2000b840 = 0x20005480; *(uint16_t*)0x20005480 = 0x27; *(uint32_t*)0x20005484 = 0; *(uint32_t*)0x20005488 = 0; *(uint32_t*)0x2000548c = 5; *(uint32_t*)0x2000b848 = 0x80; *(uint64_t*)0x2000b850 = 0x20006680; *(uint64_t*)0x20006680 = 0x20005500; *(uint64_t*)0x20006688 = 0; *(uint64_t*)0x20006690 = 0x20005540; *(uint64_t*)0x20006698 = 0; *(uint64_t*)0x200066a0 = 0x200055c0; *(uint64_t*)0x200066a8 = 0; *(uint64_t*)0x200066b0 = 0x20005680; *(uint64_t*)0x200066b8 = 0; *(uint64_t*)0x2000b858 = 4; *(uint64_t*)0x2000b860 = 0; *(uint64_t*)0x2000b868 = 0; *(uint32_t*)0x2000b870 = 0x10; *(uint32_t*)0x2000b878 = 0x7bc; *(uint64_t*)0x2000b880 = 0x200066c0; *(uint16_t*)0x200066c0 = 0x10; *(uint16_t*)0x200066c2 = 0; *(uint32_t*)0x200066c4 = 0x25dfdbfd; *(uint32_t*)0x200066c8 = 0x1000; *(uint32_t*)0x2000b888 = 0x80; *(uint64_t*)0x2000b890 = 0x20006bc0; *(uint64_t*)0x20006bc0 = 0x20006740; *(uint64_t*)0x20006bc8 = 0; *(uint64_t*)0x20006bd0 = 0x200067c0; *(uint64_t*)0x20006bd8 = 0; *(uint64_t*)0x20006be0 = 0x20006800; *(uint64_t*)0x20006be8 = 0; *(uint64_t*)0x20006bf0 = 0x200068c0; *(uint64_t*)0x20006bf8 = 0; *(uint64_t*)0x20006c00 = 0x200069c0; *(uint64_t*)0x20006c08 = 0; *(uint64_t*)0x20006c10 = 0x20006a40; *(uint64_t*)0x20006c18 = 0; *(uint64_t*)0x20006c20 = 0x20006ac0; *(uint64_t*)0x20006c28 = 0; *(uint64_t*)0x2000b898 = 7; *(uint64_t*)0x2000b8a0 = 0; *(uint64_t*)0x2000b8a8 = 0; *(uint32_t*)0x2000b8b0 = 0x40000; *(uint32_t*)0x2000b8b8 = 2; *(uint64_t*)0x2000b8c0 = 0; *(uint32_t*)0x2000b8c8 = 0; *(uint64_t*)0x2000b8d0 = 0x20007dc0; *(uint64_t*)0x20007dc0 = 0x20006c40; *(uint64_t*)0x20007dc8 = 0; *(uint64_t*)0x20007dd0 = 0x20006d00; *(uint64_t*)0x20007dd8 = 0; *(uint64_t*)0x20007de0 = 0x20006d80; *(uint64_t*)0x20007de8 = 0; *(uint64_t*)0x20007df0 = 0x20006dc0; *(uint64_t*)0x20007df8 = 0; *(uint64_t*)0x2000b8d8 = 4; *(uint64_t*)0x2000b8e0 = 0x20007e00; *(uint64_t*)0x20007e00 = 0x10; *(uint32_t*)0x20007e08 = 0x104; *(uint32_t*)0x20007e0c = 3; *(uint64_t*)0x20007e10 = 0x10; *(uint32_t*)0x20007e18 = 1; *(uint32_t*)0x20007e1c = 0; *(uint64_t*)0x20007e20 = 0x10; *(uint32_t*)0x20007e28 = 0x197; *(uint32_t*)0x20007e2c = 8; *(uint64_t*)0x20007e30 = 0x10; *(uint32_t*)0x20007e38 = 0x105; *(uint32_t*)0x20007e3c = 3; *(uint64_t*)0x20007e40 = 0x10; *(uint32_t*)0x20007e48 = 0x10d; *(uint32_t*)0x20007e4c = 7; *(uint64_t*)0x2000b8e8 = 0x50; *(uint32_t*)0x2000b8f0 = 0x40; *(uint32_t*)0x2000b8f8 = 2; *(uint64_t*)0x2000b900 = 0x20009000; *(uint16_t*)0x20009000 = 0x1f; *(uint16_t*)0x20009002 = 0x971e; *(uint8_t*)0x20009004 = 0; *(uint8_t*)0x20009005 = 8; *(uint8_t*)0x20009006 = 0x33; *(uint8_t*)0x20009007 = 0x2f; *(uint8_t*)0x20009008 = 8; *(uint8_t*)0x20009009 = 1; *(uint16_t*)0x2000900a = 7; *(uint8_t*)0x2000900c = 8; *(uint32_t*)0x2000b908 = 0x80; *(uint64_t*)0x2000b910 = 0x20009080; *(uint64_t*)0x2000b918 = 0; *(uint64_t*)0x2000b920 = 0; *(uint64_t*)0x2000b928 = 0; *(uint32_t*)0x2000b930 = 0x8000; *(uint32_t*)0x2000b938 = 2; *(uint64_t*)0x2000b940 = 0x200090c0; *(uint16_t*)0x200090c0 = 0x18; *(uint32_t*)0x200090c2 = 1; *(uint32_t*)0x200090c6 = 0; *(uint32_t*)0x200090ca = r[0]; *(uint16_t*)0x200090ce = 1; *(uint16_t*)0x200090d0 = 2; *(uint16_t*)0x200090d2 = 2; *(uint16_t*)0x200090d4 = 3; *(uint16_t*)0x200090d6 = 0xa; *(uint16_t*)0x200090d8 = htobe16(0x4e24); *(uint32_t*)0x200090da = 0x3f; *(uint8_t*)0x200090de = 0; *(uint8_t*)0x200090df = 0; *(uint8_t*)0x200090e0 = 0; *(uint8_t*)0x200090e1 = 0; *(uint8_t*)0x200090e2 = 0; *(uint8_t*)0x200090e3 = 0; *(uint8_t*)0x200090e4 = 0; *(uint8_t*)0x200090e5 = 0; *(uint8_t*)0x200090e6 = 0; *(uint8_t*)0x200090e7 = 0; *(uint8_t*)0x200090e8 = -1; *(uint8_t*)0x200090e9 = -1; *(uint8_t*)0x200090ea = 0xac; *(uint8_t*)0x200090eb = 0x14; *(uint8_t*)0x200090ec = 0x14; *(uint8_t*)0x200090ed = 0xc; *(uint32_t*)0x200090ee = 3; *(uint32_t*)0x2000b948 = 0x80; *(uint64_t*)0x2000b950 = 0x2000b500; *(uint64_t*)0x2000b500 = 0x20009140; *(uint64_t*)0x2000b508 = 0; *(uint64_t*)0x2000b510 = 0x2000a140; *(uint64_t*)0x2000b518 = 0; *(uint64_t*)0x2000b520 = 0x2000a240; *(uint64_t*)0x2000b528 = 0; *(uint64_t*)0x2000b530 = 0x2000b240; *(uint64_t*)0x2000b538 = 0; *(uint64_t*)0x2000b540 = 0x2000b300; *(uint64_t*)0x2000b548 = 0; *(uint64_t*)0x2000b550 = 0x2000b400; *(uint64_t*)0x2000b558 = 0; *(uint64_t*)0x2000b958 = 6; *(uint64_t*)0x2000b960 = 0x2000b580; *(uint64_t*)0x2000b580 = 0x10; *(uint32_t*)0x2000b588 = 0x11d; *(uint32_t*)0x2000b58c = 0x1b; *(uint64_t*)0x2000b590 = 0x10; *(uint32_t*)0x2000b598 = 1; *(uint32_t*)0x2000b59c = 4; *(uint64_t*)0x2000b968 = 0x20; *(uint32_t*)0x2000b970 = 0x20004010; *(uint32_t*)0x2000b978 = 7; syscall(__NR_sendmmsg, r[0], 0x2000b700, 0xa, 0x20000000); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }