// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20000f80 = 0x20000000; *(uint16_t*)0x20000000 = 1; *(uint8_t*)0x20000002 = 0; *(uint32_t*)0x20000004 = 0x4e24; *(uint32_t*)0x20000f88 = 0x80; *(uint64_t*)0x20000f90 = 0x20000100; *(uint64_t*)0x20000100 = 0x200000c0; *(uint64_t*)0x20000108 = 0; *(uint64_t*)0x20000f98 = 1; *(uint64_t*)0x20000fa0 = 0; *(uint64_t*)0x20000fa8 = 0; *(uint32_t*)0x20000fb0 = 0; *(uint32_t*)0x20000fb8 = 0xe3e9; *(uint64_t*)0x20000fc0 = 0x20000140; *(uint16_t*)0x20000140 = 0x18; *(uint32_t*)0x20000142 = 0; *(uint16_t*)0x20000146 = 0; *(uint8_t*)0x20000148 = 0xaa; *(uint8_t*)0x20000149 = 0xaa; *(uint8_t*)0x2000014a = 0xaa; *(uint8_t*)0x2000014b = 0xaa; *(uint8_t*)0x2000014c = 0xaa; *(uint8_t*)0x2000014d = 0xaa; memcpy((void*)0x2000014e, "\x76\x65\x74\x68\x31\x5f\x74\x6f\x5f\x74\x65\x61\x6d\x00\x00\x00", 16); *(uint32_t*)0x20000fc8 = 0x80; *(uint64_t*)0x20000fd0 = 0x20000240; *(uint64_t*)0x20000240 = 0x200001c0; *(uint64_t*)0x20000248 = 0; *(uint64_t*)0x20000fd8 = 1; *(uint64_t*)0x20000fe0 = 0x20000280; *(uint64_t*)0x20000fe8 = 0; *(uint32_t*)0x20000ff0 = 0x4048004; *(uint32_t*)0x20000ff8 = 8; *(uint64_t*)0x20001000 = 0x20000340; *(uint16_t*)0x20000340 = 0x18; *(uint32_t*)0x20000342 = 1; *(uint32_t*)0x20000346 = 0; *(uint32_t*)0x2000034a = r[0]; *(uint16_t*)0x2000034e = 2; *(uint16_t*)0x20000350 = htobe16(0x4e21); *(uint8_t*)0x20000352 = 0xac; *(uint8_t*)0x20000353 = 0x14; *(uint8_t*)0x20000354 = 0x14; *(uint8_t*)0x20000355 = 0xd; *(uint8_t*)0x20000356 = 0; *(uint8_t*)0x20000357 = 0; *(uint8_t*)0x20000358 = 0; *(uint8_t*)0x20000359 = 0; *(uint8_t*)0x2000035a = 0; *(uint8_t*)0x2000035b = 0; *(uint8_t*)0x2000035c = 0; *(uint8_t*)0x2000035d = 0; *(uint16_t*)0x2000035e = 2; *(uint16_t*)0x20000360 = 2; *(uint16_t*)0x20000362 = 4; *(uint16_t*)0x20000364 = 4; *(uint32_t*)0x20001008 = 0x80; *(uint64_t*)0x20001010 = 0x20000580; *(uint64_t*)0x20000580 = 0x200003c0; *(uint64_t*)0x20000588 = 0; *(uint64_t*)0x20000590 = 0x20000480; *(uint64_t*)0x20000598 = 0; *(uint64_t*)0x200005a0 = 0x20000500; *(uint64_t*)0x200005a8 = 0; *(uint64_t*)0x20001018 = 3; *(uint64_t*)0x20001020 = 0x200005c0; *(uint64_t*)0x200005c0 = 0x10; *(uint32_t*)0x200005c8 = 0x113; *(uint32_t*)0x200005cc = 0xe1; *(uint64_t*)0x200005d0 = 0x10; *(uint32_t*)0x200005d8 = 0x1ff; *(uint32_t*)0x200005dc = 6; *(uint64_t*)0x200005e0 = 0x10; *(uint32_t*)0x200005e8 = 0x109; *(uint32_t*)0x200005ec = 9; *(uint64_t*)0x200005f0 = 0x10; *(uint32_t*)0x200005f8 = 0; *(uint32_t*)0x200005fc = 7; *(uint64_t*)0x20001028 = 0x40; *(uint32_t*)0x20001030 = 0x8800; *(uint32_t*)0x20001038 = 5; *(uint64_t*)0x20001040 = 0x20000880; *(uint16_t*)0x20000880 = 2; *(uint16_t*)0x20000882 = htobe16(0x4e21); *(uint32_t*)0x20000884 = htobe32(0x7f000001); *(uint8_t*)0x20000888 = 0; *(uint8_t*)0x20000889 = 0; *(uint8_t*)0x2000088a = 0; *(uint8_t*)0x2000088b = 0; *(uint8_t*)0x2000088c = 0; *(uint8_t*)0x2000088d = 0; *(uint8_t*)0x2000088e = 0; *(uint8_t*)0x2000088f = 0; *(uint32_t*)0x20001048 = 0x80; *(uint64_t*)0x20001050 = 0x20000980; *(uint64_t*)0x20000980 = 0x20000900; *(uint64_t*)0x20000988 = 0; *(uint64_t*)0x20001058 = 1; *(uint64_t*)0x20001060 = 0x200009c0; *(uint64_t*)0x200009c0 = 0x10; *(uint32_t*)0x200009c8 = 0; *(uint32_t*)0x200009cc = 0xd9bf; *(uint64_t*)0x200009d0 = 0x10; *(uint32_t*)0x200009d8 = 0x107; *(uint32_t*)0x200009dc = 0x50a; *(uint64_t*)0x200009e0 = 0x10; *(uint32_t*)0x200009e8 = 0xff; *(uint32_t*)0x200009ec = 0x6cf6; *(uint64_t*)0x200009f0 = 0x10; *(uint32_t*)0x200009f8 = 0x118; *(uint32_t*)0x200009fc = 0xb15; *(uint64_t*)0x20000a00 = 0x10; *(uint32_t*)0x20000a08 = 1; *(uint32_t*)0x20000a0c = 0xfff; *(uint64_t*)0x20000a10 = 0x10; *(uint32_t*)0x20000a18 = 0x13e; *(uint32_t*)0x20000a1c = 0x656; *(uint64_t*)0x20000a20 = 0x10; *(uint32_t*)0x20000a28 = 0x119; *(uint32_t*)0x20000a2c = 0; *(uint64_t*)0x20001068 = 0x70; *(uint32_t*)0x20001070 = 0x44; *(uint32_t*)0x20001078 = 1; syscall(__NR_sendmmsg, r[0], 0x20000f80, 4, 0x20000000); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }