// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 6); *(uint64_t*)0x2000b000 = 0x2000f000; *(uint32_t*)0x2000b008 = 0xc; *(uint64_t*)0x2000b010 = 0x205a6ff0; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; *(uint16_t*)0x2000f000 = 0x10; *(uint16_t*)0x2000f002 = 0; *(uint32_t*)0x2000f004 = 0; *(uint32_t*)0x2000f008 = 0; *(uint64_t*)0x205a6ff0 = 0x20b59ec4; *(uint64_t*)0x205a6ff8 = 0x138; *(uint32_t*)0x20b59ec4 = 0x138; *(uint16_t*)0x20b59ec8 = 0x10; *(uint16_t*)0x20b59eca = 0x70f; *(uint32_t*)0x20b59ecc = 0; *(uint32_t*)0x20b59ed0 = 0; *(uint8_t*)0x20b59ed4 = 0xfe; *(uint8_t*)0x20b59ed5 = 0x80; *(uint8_t*)0x20b59ed6 = 0; *(uint8_t*)0x20b59ed7 = 0; *(uint8_t*)0x20b59ed8 = 0; *(uint8_t*)0x20b59ed9 = 0; *(uint8_t*)0x20b59eda = 0; *(uint8_t*)0x20b59edb = 0; *(uint8_t*)0x20b59edc = 0; *(uint8_t*)0x20b59edd = 0; *(uint8_t*)0x20b59ede = 0; *(uint8_t*)0x20b59edf = 0; *(uint8_t*)0x20b59ee0 = 0; *(uint8_t*)0x20b59ee1 = 0; *(uint8_t*)0x20b59ee2 = 0; *(uint8_t*)0x20b59ee3 = 0xaa; *(uint32_t*)0x20b59ee4 = htobe32(0xe0000002); *(uint16_t*)0x20b59ef4 = 0; *(uint16_t*)0x20b59ef6 = htobe16(0); *(uint16_t*)0x20b59ef8 = 0; *(uint16_t*)0x20b59efa = htobe16(0); *(uint16_t*)0x20b59efc = 0; *(uint8_t*)0x20b59efe = 0; *(uint8_t*)0x20b59eff = 0; *(uint8_t*)0x20b59f00 = 0; *(uint32_t*)0x20b59f04 = 0; *(uint32_t*)0x20b59f08 = 0; *(uint32_t*)0x20b59f0c = htobe32(0x7f000001); *(uint32_t*)0x20b59f1c = 0; *(uint8_t*)0x20b59f20 = 0x6c; *(uint8_t*)0x20b59f24 = 0xfe; *(uint8_t*)0x20b59f25 = 0x80; *(uint8_t*)0x20b59f26 = 0; *(uint8_t*)0x20b59f27 = 0; *(uint8_t*)0x20b59f28 = 0; *(uint8_t*)0x20b59f29 = 0; *(uint8_t*)0x20b59f2a = 0; *(uint8_t*)0x20b59f2b = 0; *(uint8_t*)0x20b59f2c = 0; *(uint8_t*)0x20b59f2d = 0; *(uint8_t*)0x20b59f2e = 0; *(uint8_t*)0x20b59f2f = 0; *(uint8_t*)0x20b59f30 = 0; *(uint8_t*)0x20b59f31 = 0; *(uint8_t*)0x20b59f32 = 0; *(uint8_t*)0x20b59f33 = 0xbb; *(uint64_t*)0x20b59f34 = 0; *(uint64_t*)0x20b59f3c = 0; *(uint64_t*)0x20b59f44 = 0; *(uint64_t*)0x20b59f4c = 0; *(uint64_t*)0x20b59f54 = 0; *(uint64_t*)0x20b59f5c = 0; *(uint64_t*)0x20b59f64 = 0; *(uint64_t*)0x20b59f6c = 0; *(uint64_t*)0x20b59f74 = 0; *(uint64_t*)0x20b59f7c = 0; *(uint64_t*)0x20b59f84 = 0; *(uint64_t*)0x20b59f8c = 0; *(uint32_t*)0x20b59f94 = 0; *(uint32_t*)0x20b59f98 = 0; *(uint32_t*)0x20b59f9c = 0; *(uint32_t*)0x20b59fa0 = 0; *(uint32_t*)0x20b59fa4 = 0; *(uint16_t*)0x20b59fa8 = 0xa; *(uint8_t*)0x20b59faa = 0; *(uint8_t*)0x20b59fab = 0; *(uint8_t*)0x20b59fac = 0; *(uint16_t*)0x20b59fb4 = 0x48; *(uint16_t*)0x20b59fb6 = 3; memcpy((void*)0x20b59fb8, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\xf1\xff\xff\xff\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x20b59ff8 = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); } int main() { for (;;) { loop(); } }