// https://syzkaller.appspot.com/bug?id=8591745f89e84e46e5b93f0e61bff04e26b9a9ea // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_dup3 #define __NR_dup3 330 #endif #ifndef __NR_getsockopt #define __NR_getsockopt 365 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_sendto #define __NR_sendto 369 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 2, 0x805, 0); if (res != -1) r[0] = res; res = syscall(__NR_socket, 2, 5, 0x84); if (res != -1) r[1] = res; res = syscall(__NR_dup3, (intptr_t)r[0], (intptr_t)r[1], 0); if (res != -1) r[2] = res; *(uint16_t*)0x20d6cff0 = 2; *(uint16_t*)0x20d6cff2 = htobe16(0x4e20); *(uint32_t*)0x20d6cff4 = htobe32(0x7f000001); syscall(__NR_setsockopt, (intptr_t)r[1], 0x84, 0x64, 0x20d6cff0, 0x10); memcpy((void*)0x20fa3fff, "\t", 1); *(uint16_t*)0x206f7000 = 2; *(uint16_t*)0x206f7002 = htobe16(0); *(uint8_t*)0x206f7004 = 0xac; *(uint8_t*)0x206f7005 = 0x14; *(uint8_t*)0x206f7006 = -1; *(uint8_t*)0x206f7007 = 0xbb; syscall(__NR_sendto, (intptr_t)r[2], 0x20fa3fff, 1, 0, 0x206f7000, 0x10); memcpy((void*)0x203cef9f, "7", 1); *(uint16_t*)0x20618000 = 2; *(uint16_t*)0x20618002 = htobe16(0x4e20); *(uint32_t*)0x20618004 = htobe32(0x7f000001); syscall(__NR_sendto, (intptr_t)r[1], 0x203cef9f, 0x34000, 0, 0x20618000, 0x10); memcpy((void*)0x200001c0, "\xb4\x04\x00\x00", 4); *(uint32_t*)0x200001c4 = 0; *(uint32_t*)0x200001c8 = 0; *(uint32_t*)0x20a8a000 = 0xf6; res = syscall(__NR_getsockopt, (intptr_t)r[1], 0x84, 0x1d, 0x200001c0, 0x20a8a000); if (res != -1) r[3] = *(uint32_t*)0x200001c8; *(uint32_t*)0x2059aff8 = r[3]; *(uint32_t*)0x2059affc = 0; *(uint32_t*)0x2034f000 = 0x2059b000; syscall(__NR_getsockopt, (intptr_t)r[2], 0x84, 0x7a, 0x2059aff8, 0x2034f000); return 0; }