// https://syzkaller.appspot.com/bug?id=5373bb773a0d4b3094ebd4d662be28ecb2ca4c8e // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0x10, 2, 4); if (res != -1) r[0] = res; *(uint32_t*)0x20000040 = 0; *(uint32_t*)0x20000044 = 0; *(uint32_t*)0x20000048 = 0x20000140; *(uint32_t*)0x20000140 = 0x200001c0; memcpy((void*)0x200001c0, "\x39\x00\x00\x00\x14\x00\x81\xae\x00\x00\xdc\x67" "\x6f\x97\xda\xf0\x1e\x23\x57\x81\x34\x66\x2c\x30" "\x0b\x2c\x00\x05\x00\x01\x87\x01\x54\x6f\xab\xca" "\x1b\x4e\x7d\x06\xa6\x58\x0e\x88\x37\x02\x00\xc5" "\x4c\x19\x60\xb8\x9c\x40\xeb\xb3\x73", 57); *(uint32_t*)0x20000144 = 0x39; *(uint32_t*)0x2000004c = 1; *(uint32_t*)0x20000050 = 0; *(uint32_t*)0x20000054 = 0; *(uint32_t*)0x20000058 = 0; syscall(__NR_sendmsg, (intptr_t)r[0], 0x20000040, 0); return 0; }