// https://syzkaller.appspot.com/bug?id=9af1b02de9c2c9d59a4beda7aecb08289aff9e7e // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 2, 1, 0); memcpy((void*)0x208e4000, "\x72\x61\x77\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint32_t*)0x208e4020 = 0; *(uint32_t*)0x208e4024 = 0; *(uint32_t*)0x208e4028 = 0x90; *(uint32_t*)0x208e402c = 0; *(uint32_t*)0x208e4030 = 0; *(uint32_t*)0x208e4034 = 0; *(uint32_t*)0x208e4038 = 0; *(uint32_t*)0x208e403c = 0; *(uint32_t*)0x208e4040 = 0; *(uint32_t*)0x208e4044 = 0; *(uint32_t*)0x208e4048 = 0; *(uint32_t*)0x208e404c = 0; *(uint32_t*)0x208e4050 = 0; *(uint32_t*)0x208e4054 = 0x10; *(uint32_t*)0x208e4058 = 0x2010dff0; *(uint32_t*)0x208e405c = htobe32(0x7f000001); *(uint32_t*)0x208e4060 = htobe32(0xe0000002); *(uint32_t*)0x208e4064 = htobe32(0xff000000); *(uint32_t*)0x208e4068 = htobe32(0); memcpy((void*)0x208e406c, "\x0e\x76\x23\x7f\x31\xe5\x93\x3b\x5d\x21\x15\x69\x60\x8e\x27\x15", 16); memcpy((void*)0x208e407c, "\x37\x7f\x67\xae\x38\x7d\x53\x0d\x81\x18\x49\x39\x0c\x3b\xb2\x51", 16); *(uint8_t*)0x208e408c = -1; *(uint8_t*)0x208e408d = 0; *(uint8_t*)0x208e408e = 0; *(uint8_t*)0x208e408f = 0; *(uint8_t*)0x208e4090 = 0; *(uint8_t*)0x208e4091 = 0; *(uint8_t*)0x208e4092 = 0; *(uint8_t*)0x208e4093 = 0; *(uint8_t*)0x208e4094 = 0; *(uint8_t*)0x208e4095 = 0; *(uint8_t*)0x208e4096 = 0; *(uint8_t*)0x208e4097 = 0; *(uint8_t*)0x208e4098 = 0; *(uint8_t*)0x208e4099 = 0; *(uint8_t*)0x208e409a = 0; *(uint8_t*)0x208e409b = 0; *(uint8_t*)0x208e409c = 0; *(uint8_t*)0x208e409d = 0; *(uint8_t*)0x208e409e = 0; *(uint8_t*)0x208e409f = 0; *(uint8_t*)0x208e40a0 = 0; *(uint8_t*)0x208e40a1 = 0; *(uint8_t*)0x208e40a2 = 0; *(uint8_t*)0x208e40a3 = 0; *(uint8_t*)0x208e40a4 = 0; *(uint8_t*)0x208e40a5 = 0; *(uint8_t*)0x208e40a6 = 0; *(uint8_t*)0x208e40a7 = 0; *(uint8_t*)0x208e40a8 = 0; *(uint8_t*)0x208e40a9 = 0; *(uint8_t*)0x208e40aa = 0; *(uint8_t*)0x208e40ab = 0; *(uint16_t*)0x208e40ac = 0xff; *(uint8_t*)0x208e40ae = 3; *(uint8_t*)0x208e40af = 1; *(uint32_t*)0x208e40b0 = 1; *(uint16_t*)0x208e40b4 = 0x70; *(uint16_t*)0x208e40b6 = 0x90; *(uint32_t*)0x208e40b8 = 6; *(uint64_t*)0x208e40bc = 8; *(uint64_t*)0x208e40c4 = 2; *(uint16_t*)0x208e40cc = 0x20; memcpy((void*)0x208e40ce, "\x1d\x7a\x20\x80\x3f\xa5\xbd\x9f\x37\x6c\x84\x4c" "\x84\x66\x84\xd9\x2f\x44\x8b\x53\x3e\x09\x90\x01" "\x50\x04\xfa\x4e\x63", 29); *(uint8_t*)0x208e40eb = 1; syscall(__NR_setsockopt, r[0], 0, 0x40, 0x208e4000, 0xec); } int main() { loop(); return 0; }