// https://syzkaller.appspot.com/bug?id=75cf599d7211c156c9f4bdad353b077f211df7d6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; *(uint32_t*)0x20000180 = 6; *(uint32_t*)0x20000184 = 4; *(uint64_t*)0x20000188 = 0x20000480; memcpy((void*)0x20000480, "\x18\x02\x00\x00\xfc\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x85" "\x00\x00\x00\x36\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x3f\xd0" "\xa3\x25\xab\x0b\x56\xa3\xeb\xbd\x14\xee\x70\x60\xf9\x6a\x90\xb8\x8f" "\x42\x46\x63\x53\x4b\x36\xc8\x31\x3d\x11\x5c\xdf\x81\x20\x16\xd1\x7b" "\x0e\x6b\xc2\x28\x6c\xd1\x5c\x2d\xe9\x98\x23\xa1\xf3\x15\xd2\x01\xa8" "\xab\xd5\x62\x81\x33\x72\xf3\x59\x8b\x4a\xfb\xfb\x45\xe6\x55\xf7\xf6" "\x06\x56\x1a\x4e\x1a\xe8\xa5\x8d\xa5\x15\xcd\x51", 114); *(uint64_t*)0x20000190 = 0x200000c0; memcpy((void*)0x200000c0, "GPL\000", 4); *(uint32_t*)0x20000198 = 4; *(uint32_t*)0x2000019c = 0x1000; *(uint64_t*)0x200001a0 = 0x2062b000; *(uint32_t*)0x200001a8 = 0; *(uint32_t*)0x200001ac = 0; memset((void*)0x200001b0, 0, 16); *(uint32_t*)0x200001c0 = 0; *(uint32_t*)0x200001c4 = 0; *(uint32_t*)0x200001c8 = -1; *(uint32_t*)0x200001cc = 8; *(uint64_t*)0x200001d0 = 0; *(uint32_t*)0x200001d8 = 0; *(uint32_t*)0x200001dc = 0x10; *(uint64_t*)0x200001e0 = 0; *(uint32_t*)0x200001e8 = 0; *(uint32_t*)0x200001ec = 0; *(uint32_t*)0x200001f0 = -1; *(uint32_t*)0x200001f4 = 0; *(uint64_t*)0x200001f8 = 0; res = syscall(__NR_bpf, 5ul, 0x20000180ul, 0x70ul); if (res != -1) r[0] = res; *(uint32_t*)0x20000b40 = r[0]; *(uint32_t*)0x20000b44 = 0x60; *(uint32_t*)0x20000b48 = 0; *(uint32_t*)0x20000b4c = 0; *(uint64_t*)0x20000b50 = 0; *(uint64_t*)0x20000b58 = 0; *(uint32_t*)0x20000b60 = 0xfffffffd; *(uint32_t*)0x20000b64 = 0xf2ffffff; *(uint32_t*)0x20000b68 = 0; *(uint32_t*)0x20000b6c = 0; *(uint64_t*)0x20000b70 = 0; *(uint64_t*)0x20000b78 = 0; *(uint32_t*)0x20000b80 = 2; *(uint32_t*)0x20000b84 = 0x800; syscall(__NR_bpf, 0xaul, 0x20000b40ul, 0x48ul); return 0; }