// https://syzkaller.appspot.com/bug?id=4e947674d10b0fb0cb94d4d723989cee439a71d6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 0x10, 3, 6); if (res != -1) r[0] = res; *(uint64_t*)0x2000b000 = 0; *(uint32_t*)0x2000b008 = 0; *(uint64_t*)0x2000b010 = 0x205a6ff0; *(uint64_t*)0x205a6ff0 = 0x20000240; *(uint32_t*)0x20000240 = 0xfc; *(uint16_t*)0x20000244 = 0x19; *(uint16_t*)0x20000246 = 0x409; *(uint32_t*)0x20000248 = 0; *(uint32_t*)0x2000024c = 0; *(uint8_t*)0x20000250 = 0xac; *(uint8_t*)0x20000251 = 0x14; *(uint8_t*)0x20000252 = 0x14; *(uint8_t*)0x20000253 = 0; *(uint8_t*)0x20000260 = 0xac; *(uint8_t*)0x20000261 = 0x14; *(uint8_t*)0x20000262 = 0x14; *(uint8_t*)0x20000263 = 0; *(uint16_t*)0x20000270 = htobe16(0); *(uint16_t*)0x20000272 = htobe16(0); *(uint16_t*)0x20000274 = htobe16(0); *(uint16_t*)0x20000276 = htobe16(0); *(uint16_t*)0x20000278 = 0xa; *(uint8_t*)0x2000027a = 0; *(uint8_t*)0x2000027b = 0; *(uint8_t*)0x2000027c = 0; *(uint32_t*)0x20000280 = 0; *(uint32_t*)0x20000284 = 0; *(uint64_t*)0x20000288 = 0; *(uint64_t*)0x20000290 = 0; *(uint64_t*)0x20000298 = 0; *(uint64_t*)0x200002a0 = 0; *(uint64_t*)0x200002a8 = 0; *(uint64_t*)0x200002b0 = 0; *(uint64_t*)0x200002b8 = 0; *(uint64_t*)0x200002c0 = 0; *(uint64_t*)0x200002c8 = 0; *(uint64_t*)0x200002d0 = 0; *(uint64_t*)0x200002d8 = 0; *(uint64_t*)0x200002e0 = 0; *(uint32_t*)0x200002e8 = 0; *(uint32_t*)0x200002ec = 0; *(uint8_t*)0x200002f0 = 0; *(uint8_t*)0x200002f1 = 0; *(uint8_t*)0x200002f2 = 0; *(uint8_t*)0x200002f3 = 0; *(uint16_t*)0x200002f8 = 0x44; *(uint16_t*)0x200002fa = 5; *(uint32_t*)0x200002fc = htobe32(-1); *(uint32_t*)0x2000030c = htobe32(0); *(uint8_t*)0x20000310 = -1; *(uint16_t*)0x20000314 = 0; *(uint8_t*)0x20000318 = 0xfe; *(uint8_t*)0x20000319 = 0x80; *(uint8_t*)0x2000031a = 0; *(uint8_t*)0x2000031b = 0; *(uint8_t*)0x2000031c = 0; *(uint8_t*)0x2000031d = 0; *(uint8_t*)0x2000031e = 0; *(uint8_t*)0x2000031f = 0; *(uint8_t*)0x20000320 = 0; *(uint8_t*)0x20000321 = 0; *(uint8_t*)0x20000322 = 0; *(uint8_t*)0x20000323 = 0; *(uint8_t*)0x20000324 = 0; *(uint8_t*)0x20000325 = 0; *(uint8_t*)0x20000326 = 0; *(uint8_t*)0x20000327 = 0xaa; *(uint32_t*)0x20000328 = 0; *(uint8_t*)0x2000032c = 3; *(uint8_t*)0x2000032d = 0; *(uint8_t*)0x2000032e = 0; *(uint32_t*)0x20000330 = 0; *(uint32_t*)0x20000334 = 0; *(uint32_t*)0x20000338 = 0; *(uint64_t*)0x205a6ff8 = 0xfc; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); res = syscall(__NR_socket, 2, 0x8000200000002, 0x88); if (res != -1) r[1] = res; *(uint16_t*)0x20000000 = 2; *(uint16_t*)0x20000002 = htobe16(0x4e21); *(uint32_t*)0x20000004 = htobe32(0); *(uint8_t*)0x20000008 = 0; *(uint8_t*)0x20000009 = 0; *(uint8_t*)0x2000000a = 0; *(uint8_t*)0x2000000b = 0; *(uint8_t*)0x2000000c = 0; *(uint8_t*)0x2000000d = 0; *(uint8_t*)0x2000000e = 0; *(uint8_t*)0x2000000f = 0; syscall(__NR_bind, r[1], 0x20000000, 0x10); res = syscall(__NR_dup2, r[1], r[1]); if (res != -1) r[2] = res; *(uint16_t*)0x20000080 = 2; *(uint16_t*)0x20000082 = htobe16(0x4e21); *(uint32_t*)0x20000084 = htobe32(0); *(uint8_t*)0x20000088 = 0; *(uint8_t*)0x20000089 = 0; *(uint8_t*)0x2000008a = 0; *(uint8_t*)0x2000008b = 0; *(uint8_t*)0x2000008c = 0; *(uint8_t*)0x2000008d = 0; *(uint8_t*)0x2000008e = 0; *(uint8_t*)0x2000008f = 0; syscall(__NR_sendto, r[1], 0, 0, 0x8000, 0x20000080, 0x10); syscall(__NR_sendto, r[2], 0, 0, 0, 0, 0); return 0; }