// https://syzkaller.appspot.com/bug?id=f0e01204e654ebd94c1d5ec4b99a76e9aa668bf7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_add_key #define __NR_add_key 286 #endif #ifndef __NR_getsockopt #define __NR_getsockopt 365 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0x0}; void loop() { long res = 0; memcpy((void*)0x200002c0, "keyring", 8); *(uint8_t*)0x20000200 = 0x73; *(uint8_t*)0x20000201 = 0x79; *(uint8_t*)0x20000202 = 0x7a; *(uint8_t*)0x20000203 = 0; *(uint8_t*)0x20000204 = 0; res = syscall(__NR_add_key, 0x200002c0, 0x20000200, 0, 0, -1); if (res != -1) r[0] = res; memcpy((void*)0x20002300, "\x2f\x00\xe5\x00\xa5\x09\x32\x7f\xa4\x4c\xd4\x1f" "\xb5\x4c\x01\x1a\xdf\x23\x1c\xf7\xc2\xd7\x2e\x92" "\xd1\x39\x2b\xe8\x72\x0e\x6f\xb2\x60\x59\xb5\x23", 36); *(uint32_t*)0x20002340 = 1; syscall(__NR_getsockopt, -1, 0x84, 0x6c, 0x20002300, 0x20002340); memcpy((void*)0x20000100, "dns_resolver", 13); *(uint8_t*)0x20000080 = 0x73; *(uint8_t*)0x20000081 = 0x79; *(uint8_t*)0x20000082 = 0x7a; *(uint8_t*)0x20000083 = 0; *(uint8_t*)0x20000084 = 0; syscall(__NR_add_key, 0x20000100, 0x20000080, 0x20002200, 0xe9da, r[0]); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }