// https://syzkaller.appspot.com/bug?id=be2e39518462291fd049f665261632ded34b79fd // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; uint64_t procid; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 2, 0x80005, 0); memcpy((void*)0x20014bd0, "\x66\x69\x6c\x74\x65\x72\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint32_t*)0x20014bf0 = 0xe; *(uint32_t*)0x20014bf4 = 4; *(uint32_t*)0x20014bf8 = 0xfffffccc; *(uint32_t*)0x20014bfc = -1; *(uint32_t*)0x20014c00 = 0; *(uint32_t*)0x20014c04 = 0; *(uint32_t*)0x20014c08 = 0; *(uint32_t*)0x20014c0c = -1; *(uint32_t*)0x20014c10 = -1; *(uint32_t*)0x20014c14 = 0; *(uint32_t*)0x20014c18 = 0; *(uint32_t*)0x20014c1c = 0; *(uint32_t*)0x20014c20 = -1; *(uint32_t*)0x20014c24 = 4; *(uint32_t*)0x20014c28 = 0x20001000; *(uint8_t*)0x20014c2c = 0; *(uint8_t*)0x20014c2d = 0; *(uint8_t*)0x20014c2e = 0; *(uint8_t*)0x20014c2f = 0; *(uint8_t*)0x20014c30 = 0; *(uint8_t*)0x20014c31 = 0; *(uint8_t*)0x20014c32 = 0; *(uint8_t*)0x20014c33 = 0; *(uint8_t*)0x20014c34 = 0; *(uint8_t*)0x20014c35 = 0; *(uint8_t*)0x20014c36 = 0; *(uint8_t*)0x20014c37 = 0; *(uint8_t*)0x20014c38 = 0; *(uint8_t*)0x20014c39 = 0; *(uint8_t*)0x20014c3a = 0; *(uint8_t*)0x20014c3b = 0; *(uint8_t*)0x20014c3c = 0; *(uint8_t*)0x20014c3d = 0; *(uint8_t*)0x20014c3e = 0; *(uint8_t*)0x20014c3f = 0; *(uint8_t*)0x20014c40 = 0; *(uint8_t*)0x20014c41 = 0; *(uint8_t*)0x20014c42 = 0; *(uint8_t*)0x20014c43 = 0; *(uint8_t*)0x20014c44 = 0; *(uint8_t*)0x20014c45 = 0; *(uint8_t*)0x20014c46 = 0; *(uint8_t*)0x20014c47 = 0; *(uint8_t*)0x20014c48 = 0; *(uint8_t*)0x20014c49 = 0; *(uint8_t*)0x20014c4a = 0; *(uint8_t*)0x20014c4b = 0; *(uint8_t*)0x20014c4c = 0; *(uint8_t*)0x20014c4d = 0; *(uint8_t*)0x20014c4e = 0; *(uint8_t*)0x20014c4f = 0; *(uint8_t*)0x20014c50 = 0; *(uint8_t*)0x20014c51 = 0; *(uint8_t*)0x20014c52 = 0; *(uint8_t*)0x20014c53 = 0; *(uint8_t*)0x20014c54 = 0; *(uint8_t*)0x20014c55 = 0; *(uint8_t*)0x20014c56 = 0; *(uint8_t*)0x20014c57 = 0; *(uint8_t*)0x20014c58 = 0; *(uint8_t*)0x20014c59 = 0; *(uint8_t*)0x20014c5a = 0; *(uint8_t*)0x20014c5b = 0; *(uint8_t*)0x20014c5c = 0; *(uint8_t*)0x20014c5d = 0; *(uint8_t*)0x20014c5e = 0; *(uint8_t*)0x20014c5f = 0; *(uint8_t*)0x20014c60 = 0; *(uint8_t*)0x20014c61 = 0; *(uint8_t*)0x20014c62 = 0; *(uint8_t*)0x20014c63 = 0; *(uint8_t*)0x20014c64 = 0; *(uint8_t*)0x20014c65 = 0; *(uint8_t*)0x20014c66 = 0; *(uint8_t*)0x20014c67 = 0; *(uint8_t*)0x20014c68 = 0; *(uint8_t*)0x20014c69 = 0; *(uint8_t*)0x20014c6a = 0; *(uint8_t*)0x20014c6b = 0; *(uint8_t*)0x20014c6c = 0; *(uint8_t*)0x20014c6d = 0; *(uint8_t*)0x20014c6e = 0; *(uint8_t*)0x20014c6f = 0; *(uint8_t*)0x20014c70 = 0; *(uint8_t*)0x20014c71 = 0; *(uint8_t*)0x20014c72 = 0; *(uint8_t*)0x20014c73 = 0; *(uint8_t*)0x20014c74 = 0; *(uint8_t*)0x20014c75 = 0; *(uint8_t*)0x20014c76 = 0; *(uint8_t*)0x20014c77 = 0; *(uint8_t*)0x20014c78 = 0; *(uint8_t*)0x20014c79 = 0; *(uint8_t*)0x20014c7a = 0; *(uint8_t*)0x20014c7b = 0; *(uint8_t*)0x20014c7c = 0; *(uint8_t*)0x20014c7d = 0; *(uint8_t*)0x20014c7e = 0; *(uint8_t*)0x20014c7f = 0; *(uint32_t*)0x20014c80 = 0; *(uint16_t*)0x20014c84 = 0x70; *(uint16_t*)0x20014c86 = 0x98; *(uint32_t*)0x20014c88 = 0; *(uint64_t*)0x20014c8c = 0; *(uint64_t*)0x20014c94 = 0; *(uint16_t*)0x20014c9c = 0x28; memcpy((void*)0x20014c9e, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014cbb = 0; *(uint32_t*)0x20014cbc = 0xfffffffe; *(uint32_t*)0x20014cc0 = htobe32(-1); *(uint32_t*)0x20014cc4 = htobe32(0xe0000001); *(uint32_t*)0x20014cc8 = htobe32(-1); *(uint32_t*)0x20014ccc = htobe32(0xff000000); memcpy((void*)0x20014cd0, "\xfa\x5e\xa1\xe8\x53\x4f\x88\x6f\x89\xfd\xaf\xae\x6a\x8f\x7b\x2f", 16); memcpy((void*)0x20014ce0, "\xb4\x41\x1f\x31\xd2\xb4\x73\x55\x74\xdc\xa3\xa5\x42\x23\x90\x2e", 16); *(uint8_t*)0x20014cf0 = -1; *(uint8_t*)0x20014cf1 = 0; *(uint8_t*)0x20014cf2 = 0; *(uint8_t*)0x20014cf3 = 0; *(uint8_t*)0x20014cf4 = 0; *(uint8_t*)0x20014cf5 = 0; *(uint8_t*)0x20014cf6 = 0; *(uint8_t*)0x20014cf7 = 0; *(uint8_t*)0x20014cf8 = 0; *(uint8_t*)0x20014cf9 = 0; *(uint8_t*)0x20014cfa = 0; *(uint8_t*)0x20014cfb = 0; *(uint8_t*)0x20014cfc = 0; *(uint8_t*)0x20014cfd = 0; *(uint8_t*)0x20014cfe = 0; *(uint8_t*)0x20014cff = 0; *(uint8_t*)0x20014d00 = -1; *(uint8_t*)0x20014d01 = 0; *(uint8_t*)0x20014d02 = 0; *(uint8_t*)0x20014d03 = 0; *(uint8_t*)0x20014d04 = 0; *(uint8_t*)0x20014d05 = 0; *(uint8_t*)0x20014d06 = 0; *(uint8_t*)0x20014d07 = 0; *(uint8_t*)0x20014d08 = 0; *(uint8_t*)0x20014d09 = 0; *(uint8_t*)0x20014d0a = 0; *(uint8_t*)0x20014d0b = 0; *(uint8_t*)0x20014d0c = 0; *(uint8_t*)0x20014d0d = 0; *(uint8_t*)0x20014d0e = 0; *(uint8_t*)0x20014d0f = 0; *(uint16_t*)0x20014d10 = 0x62; *(uint8_t*)0x20014d12 = 0xc0; *(uint8_t*)0x20014d13 = 2; *(uint32_t*)0x20014d14 = 0; *(uint16_t*)0x20014d18 = 0x70; *(uint16_t*)0x20014d1a = 0x98; *(uint32_t*)0x20014d1c = 0; *(uint64_t*)0x20014d20 = 0; *(uint64_t*)0x20014d28 = 0; *(uint16_t*)0x20014d30 = 0x28; memcpy((void*)0x20014d32, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014d4f = 0; *(uint32_t*)0x20014d50 = 0; *(uint8_t*)0x20014d58 = 0; *(uint8_t*)0x20014d59 = 0; *(uint8_t*)0x20014d5a = 0; *(uint8_t*)0x20014d5b = 0; *(uint8_t*)0x20014d5c = 0; *(uint8_t*)0x20014d5d = 0; *(uint8_t*)0x20014d5e = 0; *(uint8_t*)0x20014d5f = 0; *(uint8_t*)0x20014d60 = 0; *(uint8_t*)0x20014d61 = 0; *(uint8_t*)0x20014d62 = 0; *(uint8_t*)0x20014d63 = 0; *(uint8_t*)0x20014d64 = 0; *(uint8_t*)0x20014d65 = 0; *(uint8_t*)0x20014d66 = 0; *(uint8_t*)0x20014d67 = 0; *(uint8_t*)0x20014d68 = 0; *(uint8_t*)0x20014d69 = 0; *(uint8_t*)0x20014d6a = 0; *(uint8_t*)0x20014d6b = 0; *(uint8_t*)0x20014d6c = 0; *(uint8_t*)0x20014d6d = 0; *(uint8_t*)0x20014d6e = 0; *(uint8_t*)0x20014d6f = 0; *(uint8_t*)0x20014d70 = 0; *(uint8_t*)0x20014d71 = 0; *(uint8_t*)0x20014d72 = 0; *(uint8_t*)0x20014d73 = 0; *(uint8_t*)0x20014d74 = 0; *(uint8_t*)0x20014d75 = 0; *(uint8_t*)0x20014d76 = 0; *(uint8_t*)0x20014d77 = 0; *(uint8_t*)0x20014d78 = 0; *(uint8_t*)0x20014d79 = 0; *(uint8_t*)0x20014d7a = 0; *(uint8_t*)0x20014d7b = 0; *(uint8_t*)0x20014d7c = 0; *(uint8_t*)0x20014d7d = 0; *(uint8_t*)0x20014d7e = 0; *(uint8_t*)0x20014d7f = 0; *(uint8_t*)0x20014d80 = 0; *(uint8_t*)0x20014d81 = 0; *(uint8_t*)0x20014d82 = 0; *(uint8_t*)0x20014d83 = 0; *(uint8_t*)0x20014d84 = 0; *(uint8_t*)0x20014d85 = 0; *(uint8_t*)0x20014d86 = 0; *(uint8_t*)0x20014d87 = 0; *(uint8_t*)0x20014d88 = 0; *(uint8_t*)0x20014d89 = 0; *(uint8_t*)0x20014d8a = 0; *(uint8_t*)0x20014d8b = 0; *(uint8_t*)0x20014d8c = 0; *(uint8_t*)0x20014d8d = 0; *(uint8_t*)0x20014d8e = 0; *(uint8_t*)0x20014d8f = 0; *(uint8_t*)0x20014d90 = 0; *(uint8_t*)0x20014d91 = 0; *(uint8_t*)0x20014d92 = 0; *(uint8_t*)0x20014d93 = 0; *(uint8_t*)0x20014d94 = 0; *(uint8_t*)0x20014d95 = 0; *(uint8_t*)0x20014d96 = 0; *(uint8_t*)0x20014d97 = 0; *(uint8_t*)0x20014d98 = 0; *(uint8_t*)0x20014d99 = 0; *(uint8_t*)0x20014d9a = 0; *(uint8_t*)0x20014d9b = 0; *(uint8_t*)0x20014d9c = 0; *(uint8_t*)0x20014d9d = 0; *(uint8_t*)0x20014d9e = 0; *(uint8_t*)0x20014d9f = 0; *(uint8_t*)0x20014da0 = 0; *(uint8_t*)0x20014da1 = 0; *(uint8_t*)0x20014da2 = 0; *(uint8_t*)0x20014da3 = 0; *(uint8_t*)0x20014da4 = 0; *(uint8_t*)0x20014da5 = 0; *(uint8_t*)0x20014da6 = 0; *(uint8_t*)0x20014da7 = 0; *(uint8_t*)0x20014da8 = 0; *(uint8_t*)0x20014da9 = 0; *(uint8_t*)0x20014daa = 0; *(uint8_t*)0x20014dab = 0; *(uint32_t*)0x20014dac = 0; *(uint16_t*)0x20014db0 = 0x1c8; *(uint16_t*)0x20014db2 = 0x1f0; *(uint32_t*)0x20014db4 = 0; *(uint64_t*)0x20014db8 = 0; *(uint64_t*)0x20014dc0 = 0; *(uint16_t*)0x20014dc8 = 0x158; memcpy((void*)0x20014dca, "\x68\x61\x73\x68\x6c\x69\x6d\x69\x74\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014de7 = 3; memcpy((void*)0x20014de8, "\x69\x70\x36\x74\x6e\x6c\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 255); *(uint64_t*)0x20014ee8 = 0x800; *(uint64_t*)0x20014ef0 = 0; *(uint32_t*)0x20014ef8 = 0x51; *(uint32_t*)0x20014efc = 0; *(uint32_t*)0x20014f00 = 0; *(uint32_t*)0x20014f04 = 3; *(uint32_t*)0x20014f08 = 0x81; *(uint32_t*)0x20014f0c = 5; *(uint8_t*)0x20014f10 = 0; *(uint8_t*)0x20014f11 = 0; *(uint32_t*)0x20014f18 = 0; *(uint16_t*)0x20014f20 = 0x28; memcpy((void*)0x20014f22, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014f3f = 0; *(uint32_t*)0x20014f40 = 0; *(uint8_t*)0x20014f48 = 0xac; *(uint8_t*)0x20014f49 = 0x14; *(uint8_t*)0x20014f4a = 0; *(uint8_t*)0x20014f4b = 0; *(uint32_t*)0x20014f4c = htobe32(0xfd2); *(uint32_t*)0x20014f50 = htobe32(0); *(uint32_t*)0x20014f54 = htobe32(0); *(uint8_t*)0x20014f58 = 0x73; *(uint8_t*)0x20014f59 = 0x79; *(uint8_t*)0x20014f5a = 0x7a; *(uint8_t*)0x20014f5b = 0; *(uint8_t*)0x20014f5c = 0; *(uint8_t*)0x20014f68 = 0x73; *(uint8_t*)0x20014f69 = 0x79; *(uint8_t*)0x20014f6a = 0x7a; *(uint8_t*)0x20014f6b = 0; *(uint8_t*)0x20014f6c = 0; *(uint8_t*)0x20014f78 = 0; *(uint8_t*)0x20014f79 = 0; *(uint8_t*)0x20014f7a = 0; *(uint8_t*)0x20014f7b = 0; *(uint8_t*)0x20014f7c = 0; *(uint8_t*)0x20014f7d = 0; *(uint8_t*)0x20014f7e = 0; *(uint8_t*)0x20014f7f = 0; *(uint8_t*)0x20014f80 = 0; *(uint8_t*)0x20014f81 = 0; *(uint8_t*)0x20014f82 = 0; *(uint8_t*)0x20014f83 = 0; *(uint8_t*)0x20014f84 = 0; *(uint8_t*)0x20014f85 = 0; *(uint8_t*)0x20014f86 = 0; *(uint8_t*)0x20014f87 = 0; *(uint8_t*)0x20014f88 = 0; *(uint8_t*)0x20014f89 = 0; *(uint8_t*)0x20014f8a = 0; *(uint8_t*)0x20014f8b = 0; *(uint8_t*)0x20014f8c = 0; *(uint8_t*)0x20014f8d = 0; *(uint8_t*)0x20014f8e = 0; *(uint8_t*)0x20014f8f = 0; *(uint8_t*)0x20014f90 = 0; *(uint8_t*)0x20014f91 = 0; *(uint8_t*)0x20014f92 = 0; *(uint8_t*)0x20014f93 = 0; *(uint8_t*)0x20014f94 = 0; *(uint8_t*)0x20014f95 = 0; *(uint8_t*)0x20014f96 = 0; *(uint8_t*)0x20014f97 = 0; *(uint16_t*)0x20014f98 = 0; *(uint8_t*)0x20014f9a = 0; *(uint8_t*)0x20014f9b = 0; *(uint32_t*)0x20014f9c = 0; *(uint16_t*)0x20014fa0 = 0x70; *(uint16_t*)0x20014fa2 = 0xb0; *(uint32_t*)0x20014fa4 = 0; *(uint64_t*)0x20014fa8 = 0; *(uint64_t*)0x20014fb0 = 0; *(uint16_t*)0x20014fb8 = 0x40; memcpy((void*)0x20014fba, "\x52\x41\x54\x45\x45\x53\x54\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014fd7 = 0; memcpy((void*)0x20014fd8, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint8_t*)0x20014fe8 = 1; *(uint8_t*)0x20014fe9 = 0x19; *(uint32_t*)0x20014fec = 8; *(uint64_t*)0x20001000 = 0; *(uint64_t*)0x20001008 = 0; *(uint64_t*)0x20001010 = 0; *(uint64_t*)0x20001018 = 0; *(uint64_t*)0x20001020 = 0; *(uint64_t*)0x20001028 = 0; *(uint64_t*)0x20001030 = 0; *(uint64_t*)0x20001038 = 0; syscall(__NR_setsockopt, r[0], 0, 0x40, 0x20014bd0, 0x430); } int main() { for (procid = 0; procid < 8; procid++) { if (fork() == 0) { for (;;) { loop(); } } } sleep(1000000); return 0; }