// https://syzkaller.appspot.com/bug?id=d4ac7bfeafac8a3d6d06123e078462ac765415e7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } uint64_t r[2] = {0xffffffffffffffff, 0xffffffff}; void test() { long res; memcpy((void*)0x20000180, "/dev/infiniband/rdma_cm", 24); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000180, 2, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000500 = 0; *(uint16_t*)0x20000504 = 0x18; *(uint16_t*)0x20000506 = 0xfa00; *(uint64_t*)0x20000508 = 0; *(uint64_t*)0x20000510 = 0x200004c0; *(uint16_t*)0x20000518 = 2; *(uint8_t*)0x2000051a = 0; *(uint8_t*)0x2000051b = 0; *(uint8_t*)0x2000051c = 0; *(uint8_t*)0x2000051d = 0; *(uint8_t*)0x2000051e = 0; *(uint8_t*)0x2000051f = 0; res = syscall(__NR_write, r[0], 0x20000500, 0x20); if (res != -1) r[1] = *(uint32_t*)0x200004c0; *(uint32_t*)0x20000540 = 3; *(uint16_t*)0x20000544 = 0x40; *(uint16_t*)0x20000546 = 0xfa00; *(uint16_t*)0x20000548 = 0xa; *(uint16_t*)0x2000054a = htobe16(0); *(uint32_t*)0x2000054c = 0; *(uint8_t*)0x20000550 = 0; *(uint8_t*)0x20000551 = 0; *(uint8_t*)0x20000552 = 0; *(uint8_t*)0x20000553 = 0; *(uint8_t*)0x20000554 = 0; *(uint8_t*)0x20000555 = 0; *(uint8_t*)0x20000556 = 0; *(uint8_t*)0x20000557 = 0; *(uint8_t*)0x20000558 = 0; *(uint8_t*)0x20000559 = 0; *(uint8_t*)0x2000055a = 0; *(uint8_t*)0x2000055b = 0; *(uint8_t*)0x2000055c = 0; *(uint8_t*)0x2000055d = 0; *(uint8_t*)0x2000055e = 0; *(uint8_t*)0x2000055f = 0; *(uint32_t*)0x20000560 = 0; *(uint16_t*)0x20000564 = 0xa; *(uint16_t*)0x20000566 = htobe16(0); *(uint32_t*)0x20000568 = 0; *(uint8_t*)0x2000056c = 0xfe; *(uint8_t*)0x2000056d = 0x80; *(uint8_t*)0x2000056e = 0; *(uint8_t*)0x2000056f = 0; *(uint8_t*)0x20000570 = 0; *(uint8_t*)0x20000571 = 0; *(uint8_t*)0x20000572 = 0; *(uint8_t*)0x20000573 = 0; *(uint8_t*)0x20000574 = 0; *(uint8_t*)0x20000575 = 0; *(uint8_t*)0x20000576 = 0; *(uint8_t*)0x20000577 = 0; *(uint8_t*)0x20000578 = 0; *(uint8_t*)0x20000579 = 0; *(uint8_t*)0x2000057a = 0; *(uint8_t*)0x2000057b = 0xbb; *(uint32_t*)0x2000057c = 0; *(uint32_t*)0x20000580 = r[1]; *(uint32_t*)0x20000584 = 0; syscall(__NR_write, r[0], 0x20000540, 0x48); syscall(__NR_close, r[0]); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (;;) { loop(); } }