// https://syzkaller.appspot.com/bug?id=931b8ee1d48676e38d38bc6733533c39213c7e84 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; *(uint32_t*)0x20008000 = 0x15; *(uint32_t*)0x20008004 = 3; *(uint64_t*)0x20008008 = 0x20000040; memcpy((void*)0x20000040, "\xb7\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00\x95" "\x00\x00\x00\x00\x00\x00\x00\x17\x52\x86\x57\x43\x56\x94\xa5\x2d\x2a" "\x9a\xad\x6e\x14\xa1\xb4\x7b\xc2\x3c\x22\xc4\x7a\x67\x94\x58\x27\x3a" "\xd1\x32\x6f\xc6\xee\xe6\xb1\x03\x7a\x74\xcf\xb5\xaf\x10\x0f\xc4\xe9" "\x4d\x12\x3d\x9b\x22\xa7\x56\x1b\x88\x50\x82\x1b\xc1\xf8\xb5\xb0\xa3" "\xe3\xb7\x9b\x0d\x96\xab\x7c\xc6\x0e\x0e\x14\x4f\x0f\x04\xbf\xff\xe6" "\x6a\x22\xd1\x32\xa1\x61\xee\xa5\x3a\x46\xa5\x31\x6f\x68", 116); *(uint64_t*)0x20008010 = 0x20003ff6; memcpy((void*)0x20003ff6, "syzkaller\000", 10); *(uint32_t*)0x20008018 = 1; *(uint32_t*)0x2000801c = 0xc3; *(uint64_t*)0x20008020 = 0x200002c0; *(uint32_t*)0x20008028 = 0; *(uint32_t*)0x2000802c = 0; memset((void*)0x20008030, 0, 16); *(uint32_t*)0x20008040 = 0; *(uint32_t*)0x20008044 = 0; *(uint32_t*)0x20008048 = -1; *(uint32_t*)0x2000804c = 8; *(uint64_t*)0x20008050 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20008058 = 0; *(uint32_t*)0x2000805c = 0x10; *(uint64_t*)0x20008060 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x20008068 = 0; *(uint32_t*)0x2000806c = 0; *(uint32_t*)0x20008070 = -1; *(uint32_t*)0x20008074 = 0; *(uint64_t*)0x20008078 = 0; res = syscall(__NR_bpf, 5ul, 0x20008000ul, 0x48ul); if (res != -1) r[0] = res; res = syscall(__NR_socket, 2ul, 2ul, 0); if (res != -1) r[1] = res; *(uint32_t*)0x20000180 = 0x57bb; syscall(__NR_setsockopt, r[1], 1, 0xf, 0x20000180ul, 0x3cul); *(uint32_t*)0x200000c0 = r[0]; syscall(__NR_setsockopt, r[1], 1, 0x34, 0x200000c0ul, 4ul); return 0; }