// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void execute_one(); extern unsigned long long procid; void loop() { while (1) { execute_one(); } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one() { long res = 0; res = syscall(__NR_socket, 0xf, 3, 2); if (res != -1) r[0] = res; *(uint64_t*)0x20f56000 = 0; *(uint32_t*)0x20f56008 = 0; *(uint64_t*)0x20f56010 = 0x208feff0; *(uint64_t*)0x208feff0 = 0x200000c0; *(uint8_t*)0x200000c0 = 2; *(uint8_t*)0x200000c1 = 3; *(uint8_t*)0x200000c2 = 0; *(uint8_t*)0x200000c3 = 9; *(uint16_t*)0x200000c4 = 0xf; *(uint16_t*)0x200000c6 = 0; *(uint32_t*)0x200000c8 = 0; *(uint32_t*)0x200000cc = 0; *(uint16_t*)0x200000d0 = 1; *(uint16_t*)0x200000d2 = 0x18; *(uint8_t*)0x200000d4 = 0; *(uint8_t*)0x200000d5 = 0x59; *(uint16_t*)0x200000d6 = 0; *(uint16_t*)0x200000d8 = 5; *(uint16_t*)0x200000da = 6; *(uint8_t*)0x200000dc = 0; *(uint8_t*)0x200000dd = 0; *(uint16_t*)0x200000de = 0; *(uint16_t*)0x200000e0 = 0xa; *(uint16_t*)0x200000e2 = htobe16(0); *(uint32_t*)0x200000e4 = 0; *(uint8_t*)0x200000e8 = 0; *(uint8_t*)0x200000e9 = 0; *(uint8_t*)0x200000ea = 0; *(uint8_t*)0x200000eb = 0; *(uint8_t*)0x200000ec = 0; *(uint8_t*)0x200000ed = 0; *(uint8_t*)0x200000ee = 0; *(uint8_t*)0x200000ef = 0; *(uint8_t*)0x200000f0 = 0; *(uint8_t*)0x200000f1 = 0; *(uint8_t*)0x200000f2 = 0; *(uint8_t*)0x200000f3 = 0; *(uint8_t*)0x200000f4 = 0; *(uint8_t*)0x200000f5 = 0; *(uint8_t*)0x200000f6 = 0; *(uint8_t*)0x200000f7 = 0; *(uint32_t*)0x200000f8 = 0; *(uint16_t*)0x20000100 = 2; *(uint16_t*)0x20000102 = 1; *(uint32_t*)0x20000104 = htobe32(0); *(uint8_t*)0x20000108 = 0; *(uint8_t*)0x20000109 = 0; *(uint8_t*)0x2000010a = 0; *(uint8_t*)0x2000010b = 2; *(uint32_t*)0x2000010c = 0; *(uint16_t*)0x20000110 = 5; *(uint16_t*)0x20000112 = 5; *(uint8_t*)0x20000114 = 0; *(uint8_t*)0x20000115 = 0; *(uint16_t*)0x20000116 = 0; *(uint16_t*)0x20000118 = 0xa; *(uint16_t*)0x2000011a = htobe16(0); *(uint32_t*)0x2000011c = 0; *(uint8_t*)0x20000120 = -1; *(uint8_t*)0x20000121 = 1; *(uint8_t*)0x20000122 = 0; *(uint8_t*)0x20000123 = 0; *(uint8_t*)0x20000124 = 0; *(uint8_t*)0x20000125 = 0; *(uint8_t*)0x20000126 = 0; *(uint8_t*)0x20000127 = 0; *(uint8_t*)0x20000128 = 0; *(uint8_t*)0x20000129 = 0; *(uint8_t*)0x2000012a = 0; *(uint8_t*)0x2000012b = 0; *(uint8_t*)0x2000012c = 0; *(uint8_t*)0x2000012d = 0; *(uint8_t*)0x2000012e = 0; *(uint8_t*)0x2000012f = 1; *(uint32_t*)0x20000130 = 0; *(uint64_t*)0x208feff8 = 0x78; *(uint64_t*)0x20f56018 = 1; *(uint64_t*)0x20f56020 = 0; *(uint64_t*)0x20f56028 = 0; *(uint32_t*)0x20f56030 = 0; syscall(__NR_sendmsg, r[0], 0x20f56000, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (;;) { loop(); } }