// https://syzkaller.appspot.com/bug?id=55ef9d629f3b3d7d70b69558015b63b48d01af66 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include const int kInitNetNsFd = 239; static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto) { return syscall(__NR_socket, domain, type, proto); } #ifndef __NR_connect #define __NR_connect 362 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syz_init_net_socket(3, 5, 0); if (res != -1) r[0] = res; *(uint16_t*)0x20000000 = 3; *(uint8_t*)0x20000002 = 0x98; *(uint8_t*)0x20000003 = 0x92; *(uint8_t*)0x20000004 = 0x9c; *(uint8_t*)0x20000005 = 0xaa; *(uint8_t*)0x20000006 = 0xb0; *(uint8_t*)0x20000007 = 0x40; *(uint8_t*)0x20000008 = 2; *(uint32_t*)0x2000000c = 8; *(uint8_t*)0x20000010 = 0xbb; *(uint8_t*)0x20000011 = 0xbb; *(uint8_t*)0x20000012 = 0xbb; *(uint8_t*)0x20000013 = 0xbb; *(uint8_t*)0x20000014 = 0xbb; *(uint8_t*)0x20000015 = 0; *(uint8_t*)0x20000016 = 0; *(uint8_t*)0x20000017 = 0x40; *(uint8_t*)0x20000018 = 0x40; *(uint8_t*)0x20000019 = 0x40; *(uint8_t*)0x2000001a = 0x40; *(uint8_t*)0x2000001b = 0x40; *(uint8_t*)0x2000001c = 0x40; *(uint8_t*)0x2000001d = 0; *(uint8_t*)0x2000001e = 0xa2; *(uint8_t*)0x2000001f = 0xa6; *(uint8_t*)0x20000020 = 0xa8; *(uint8_t*)0x20000021 = 0x40; *(uint8_t*)0x20000022 = 0x40; *(uint8_t*)0x20000023 = 0x40; *(uint8_t*)0x20000024 = 0; *(uint8_t*)0x20000025 = 0xa2; *(uint8_t*)0x20000026 = 0xa6; *(uint8_t*)0x20000027 = 0xa8; *(uint8_t*)0x20000028 = 0x40; *(uint8_t*)0x20000029 = 0x40; *(uint8_t*)0x2000002a = 0x40; *(uint8_t*)0x2000002b = 0; *(uint8_t*)0x2000002c = 0xbb; *(uint8_t*)0x2000002d = 0xbb; *(uint8_t*)0x2000002e = 0xbb; *(uint8_t*)0x2000002f = 0xbb; *(uint8_t*)0x20000030 = 0xbb; *(uint8_t*)0x20000031 = 0; *(uint8_t*)0x20000032 = 0; *(uint8_t*)0x20000033 = 0xa2; *(uint8_t*)0x20000034 = 0xa6; *(uint8_t*)0x20000035 = 0xa8; *(uint8_t*)0x20000036 = 0x40; *(uint8_t*)0x20000037 = 0x40; *(uint8_t*)0x20000038 = 0x40; *(uint8_t*)0x20000039 = 0; *(uint8_t*)0x2000003a = 0x40; *(uint8_t*)0x2000003b = 0x40; *(uint8_t*)0x2000003c = 0x40; *(uint8_t*)0x2000003d = 0x40; *(uint8_t*)0x2000003e = 0x40; *(uint8_t*)0x2000003f = 0x40; *(uint8_t*)0x20000040 = 0; *(uint8_t*)0x20000041 = 0x98; *(uint8_t*)0x20000042 = 0x92; *(uint8_t*)0x20000043 = 0x9c; *(uint8_t*)0x20000044 = 0xaa; *(uint8_t*)0x20000045 = 0xb0; *(uint8_t*)0x20000046 = 0x40; *(uint8_t*)0x20000047 = 2; syscall(__NR_connect, (intptr_t)r[0], 0x20000000, 0x3c); return 0; }