// https://syzkaller.appspot.com/bug?id=7a694fef4d21cfe0461fb9d071a5cf8e57c0af79 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) { continue; } kill_and_wait(pid, &status); break; } } } uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; res = syscall(__NR_socket, 0x10ul, 3ul, 0xc); if (res != -1) r[0] = res; *(uint64_t*)0x20000040 = 0; *(uint32_t*)0x20000048 = 0; *(uint64_t*)0x20000050 = 0x20000340; *(uint64_t*)0x20000340 = 0x20000100; *(uint32_t*)0x20000100 = 0x54; *(uint8_t*)0x20000104 = 2; *(uint8_t*)0x20000105 = 6; *(uint16_t*)0x20000106 = 0x101; *(uint32_t*)0x20000108 = 0; *(uint32_t*)0x2000010c = 0; *(uint8_t*)0x20000110 = 0; *(uint8_t*)0x20000111 = 0; *(uint16_t*)0x20000112 = htobe16(0); *(uint16_t*)0x20000114 = 5; *(uint16_t*)0x20000116 = 4; *(uint8_t*)0x20000118 = 0; *(uint16_t*)0x2000011c = 9; *(uint16_t*)0x2000011e = 2; memcpy((void*)0x20000120, "syz2\000", 5); *(uint16_t*)0x20000128 = 5; *(uint16_t*)0x2000012a = 5; *(uint8_t*)0x2000012c = 0; *(uint16_t*)0x20000130 = 5; *(uint16_t*)0x20000132 = 1; *(uint8_t*)0x20000134 = 6; *(uint16_t*)0x20000138 = 0xd; *(uint16_t*)0x2000013a = 3; memcpy((void*)0x2000013c, "list:set\000", 9); *(uint16_t*)0x20000148 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x2000014a, 7, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000014b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000014b, 1, 7, 1); *(uint16_t*)0x2000014c = 8; STORE_BY_BITMASK(uint16_t, , 0x2000014e, 6, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000014f, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000014f, 0, 7, 1); *(uint32_t*)0x20000150 = htobe32(0xffff); *(uint64_t*)0x20000348 = 0x54; *(uint64_t*)0x20000058 = 1; *(uint64_t*)0x20000060 = 0; *(uint64_t*)0x20000068 = 0; *(uint32_t*)0x20000070 = 0; syscall(__NR_sendmsg, r[0], 0x20000040ul, 0ul); res = syscall(__NR_socket, 0xaul, 1ul, 0); if (res != -1) r[1] = res; memcpy((void*)0x20000540, "filter\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 32); *(uint32_t*)0x20000560 = 0xe; *(uint32_t*)0x20000564 = 4; *(uint32_t*)0x20000568 = 0x3c0; *(uint32_t*)0x2000056c = 0xd0; *(uint32_t*)0x20000570 = 0x108; *(uint32_t*)0x20000574 = 0x1f8; *(uint32_t*)0x20000578 = 0; *(uint32_t*)0x2000057c = 0xd0; *(uint32_t*)0x20000580 = 0x2c0; *(uint32_t*)0x20000584 = 0x2f0; *(uint32_t*)0x20000588 = 0x2f0; *(uint32_t*)0x2000058c = 0x2f0; *(uint32_t*)0x20000590 = 0x2c0; *(uint32_t*)0x20000594 = 4; *(uint64_t*)0x20000598 = 0; *(uint8_t*)0x200005a0 = 0; *(uint8_t*)0x200005a1 = 0; *(uint8_t*)0x200005a2 = 0; *(uint8_t*)0x200005a3 = 0; *(uint8_t*)0x200005a4 = 0; *(uint8_t*)0x200005a5 = 0; *(uint8_t*)0x200005a6 = 0; *(uint8_t*)0x200005a7 = 0; *(uint8_t*)0x200005a8 = 0; *(uint8_t*)0x200005a9 = 0; *(uint8_t*)0x200005aa = 0; *(uint8_t*)0x200005ab = 0; *(uint8_t*)0x200005ac = 0; *(uint8_t*)0x200005ad = 0; *(uint8_t*)0x200005ae = 0; *(uint8_t*)0x200005af = 0; *(uint8_t*)0x200005b0 = 0; *(uint8_t*)0x200005b1 = 0; *(uint8_t*)0x200005b2 = 0; *(uint8_t*)0x200005b3 = 0; *(uint8_t*)0x200005b4 = 0; *(uint8_t*)0x200005b5 = 0; *(uint8_t*)0x200005b6 = 0; *(uint8_t*)0x200005b7 = 0; *(uint8_t*)0x200005b8 = 0; *(uint8_t*)0x200005b9 = 0; *(uint8_t*)0x200005ba = 0; *(uint8_t*)0x200005bb = 0; *(uint8_t*)0x200005bc = 0; *(uint8_t*)0x200005bd = 0; *(uint8_t*)0x200005be = 0; *(uint8_t*)0x200005bf = 0; *(uint8_t*)0x200005c0 = 0; *(uint8_t*)0x200005c1 = 0; *(uint8_t*)0x200005c2 = 0; *(uint8_t*)0x200005c3 = 0; *(uint8_t*)0x200005c4 = 0; *(uint8_t*)0x200005c5 = 0; *(uint8_t*)0x200005c6 = 0; *(uint8_t*)0x200005c7 = 0; *(uint8_t*)0x200005c8 = 0; *(uint8_t*)0x200005c9 = 0; *(uint8_t*)0x200005ca = 0; *(uint8_t*)0x200005cb = 0; *(uint8_t*)0x200005cc = 0; *(uint8_t*)0x200005cd = 0; *(uint8_t*)0x200005ce = 0; *(uint8_t*)0x200005cf = 0; *(uint8_t*)0x200005d0 = 0; *(uint8_t*)0x200005d1 = 0; *(uint8_t*)0x200005d2 = 0; *(uint8_t*)0x200005d3 = 0; *(uint8_t*)0x200005d4 = 0; *(uint8_t*)0x200005d5 = 0; *(uint8_t*)0x200005d6 = 0; *(uint8_t*)0x200005d7 = 0; *(uint8_t*)0x200005d8 = 0; *(uint8_t*)0x200005d9 = 0; *(uint8_t*)0x200005da = 0; *(uint8_t*)0x200005db = 0; *(uint8_t*)0x200005dc = 0; *(uint8_t*)0x200005dd = 0; *(uint8_t*)0x200005de = 0; *(uint8_t*)0x200005df = 0; *(uint8_t*)0x200005e0 = 0; *(uint8_t*)0x200005e1 = 0; *(uint8_t*)0x200005e2 = 0; *(uint8_t*)0x200005e3 = 0; *(uint8_t*)0x200005e4 = 0; *(uint8_t*)0x200005e5 = 0; *(uint8_t*)0x200005e6 = 0; *(uint8_t*)0x200005e7 = 0; *(uint8_t*)0x200005e8 = 0; *(uint8_t*)0x200005e9 = 0; *(uint8_t*)0x200005ea = 0; *(uint8_t*)0x200005eb = 0; *(uint8_t*)0x200005ec = 0; *(uint8_t*)0x200005ed = 0; *(uint8_t*)0x200005ee = 0; *(uint8_t*)0x200005ef = 0; *(uint8_t*)0x200005f0 = 0; *(uint8_t*)0x200005f1 = 0; *(uint8_t*)0x200005f2 = 0; *(uint8_t*)0x200005f3 = 0; *(uint8_t*)0x200005f4 = 0; *(uint8_t*)0x200005f5 = 0; *(uint8_t*)0x200005f6 = 0; *(uint8_t*)0x200005f7 = 0; *(uint8_t*)0x200005f8 = 0; *(uint8_t*)0x200005f9 = 0; *(uint8_t*)0x200005fa = 0; *(uint8_t*)0x200005fb = 0; *(uint8_t*)0x200005fc = 0; *(uint8_t*)0x200005fd = 0; *(uint8_t*)0x200005fe = 0; *(uint8_t*)0x200005ff = 0; *(uint8_t*)0x20000600 = 0; *(uint8_t*)0x20000601 = 0; *(uint8_t*)0x20000602 = 0; *(uint8_t*)0x20000603 = 0; *(uint8_t*)0x20000604 = 0; *(uint8_t*)0x20000605 = 0; *(uint8_t*)0x20000606 = 0; *(uint8_t*)0x20000607 = 0; *(uint8_t*)0x20000608 = 0; *(uint8_t*)0x20000609 = 0; *(uint8_t*)0x2000060a = 0; *(uint8_t*)0x2000060b = 0; *(uint8_t*)0x2000060c = 0; *(uint8_t*)0x2000060d = 0; *(uint8_t*)0x2000060e = 0; *(uint8_t*)0x2000060f = 0; *(uint8_t*)0x20000610 = 0; *(uint8_t*)0x20000611 = 0; *(uint8_t*)0x20000612 = 0; *(uint8_t*)0x20000613 = 0; *(uint8_t*)0x20000614 = 0; *(uint8_t*)0x20000615 = 0; *(uint8_t*)0x20000616 = 0; *(uint8_t*)0x20000617 = 0; *(uint8_t*)0x20000618 = 0; *(uint8_t*)0x20000619 = 0; *(uint8_t*)0x2000061a = 0; *(uint8_t*)0x2000061b = 0; *(uint8_t*)0x2000061c = 0; *(uint8_t*)0x2000061d = 0; *(uint8_t*)0x2000061e = 0; *(uint8_t*)0x2000061f = 0; *(uint8_t*)0x20000620 = 0; *(uint8_t*)0x20000621 = 0; *(uint8_t*)0x20000622 = 0; *(uint8_t*)0x20000623 = 0; *(uint8_t*)0x20000624 = 0; *(uint8_t*)0x20000625 = 0; *(uint8_t*)0x20000626 = 0; *(uint8_t*)0x20000627 = 0; *(uint32_t*)0x20000628 = 0; *(uint16_t*)0x2000062c = 0xa8; *(uint16_t*)0x2000062e = 0x108; *(uint32_t*)0x20000630 = 0; *(uint64_t*)0x20000638 = 0; *(uint64_t*)0x20000640 = 0; *(uint16_t*)0x20000648 = 0x60; memcpy((void*)0x2000064a, "HMARK\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000667 = 0; *(uint32_t*)0x20000668 = htobe32(-1); *(uint32_t*)0x20000678 = htobe32(0); *(uint32_t*)0x2000067c = htobe32(0); *(uint32_t*)0x20000680 = htobe32(0); *(uint32_t*)0x20000684 = htobe32(0); *(uint16_t*)0x20000688 = htobe16(0); *(uint16_t*)0x2000068a = htobe16(0); *(uint16_t*)0x2000068c = htobe16(0); *(uint16_t*)0x2000068e = htobe16(0); *(uint32_t*)0x20000690 = 0; *(uint16_t*)0x20000694 = 0; *(uint32_t*)0x20000698 = 0; *(uint32_t*)0x2000069c = 4; *(uint32_t*)0x200006a0 = 0; *(uint8_t*)0x200006a8 = 0xfe; *(uint8_t*)0x200006a9 = 0x88; *(uint8_t*)0x200006aa = 0; *(uint8_t*)0x200006ab = 0; *(uint8_t*)0x200006ac = 0; *(uint8_t*)0x200006ad = 0; *(uint8_t*)0x200006ae = 0; *(uint8_t*)0x200006af = 0; *(uint8_t*)0x200006b0 = 0; *(uint8_t*)0x200006b1 = 0; *(uint8_t*)0x200006b2 = 0; *(uint8_t*)0x200006b3 = 0; *(uint8_t*)0x200006b4 = 0; *(uint8_t*)0x200006b5 = 0; *(uint8_t*)0x200006b6 = 0; *(uint8_t*)0x200006b7 = 1; *(uint8_t*)0x200006b8 = 0; *(uint8_t*)0x200006b9 = 0; *(uint8_t*)0x200006ba = 0; *(uint8_t*)0x200006bb = 0; *(uint8_t*)0x200006bc = 0; *(uint8_t*)0x200006bd = 0; *(uint8_t*)0x200006be = 0; *(uint8_t*)0x200006bf = 0; *(uint8_t*)0x200006c0 = 0; *(uint8_t*)0x200006c1 = 0; *(uint8_t*)0x200006c2 = -1; *(uint8_t*)0x200006c3 = -1; *(uint8_t*)0x200006c4 = 0xac; *(uint8_t*)0x200006c5 = 0x14; *(uint8_t*)0x200006c6 = 0x14; *(uint8_t*)0x200006c7 = 0xbb; *(uint32_t*)0x200006c8 = htobe32(0); *(uint32_t*)0x200006cc = htobe32(0); *(uint32_t*)0x200006d0 = htobe32(0); *(uint32_t*)0x200006d4 = htobe32(0); *(uint32_t*)0x200006d8 = htobe32(0); *(uint32_t*)0x200006dc = htobe32(0); *(uint32_t*)0x200006e0 = htobe32(0); *(uint32_t*)0x200006e4 = htobe32(0); memcpy((void*)0x200006e8, "vlan0\000\000\000\000\000\000\000\000\000\000\000", 16); memcpy((void*)0x200006f8, "syzkaller0\000\000\000\000\000\000", 16); *(uint8_t*)0x20000708 = 0; *(uint8_t*)0x20000718 = 0; *(uint16_t*)0x20000728 = 0; *(uint8_t*)0x2000072a = 0; *(uint8_t*)0x2000072b = 0; *(uint8_t*)0x2000072c = 0; *(uint32_t*)0x20000730 = 0; *(uint16_t*)0x20000734 = 0xa8; *(uint16_t*)0x20000736 = 0xf0; *(uint32_t*)0x20000738 = 0; *(uint64_t*)0x20000740 = 0; *(uint64_t*)0x20000748 = 0; *(uint16_t*)0x20000750 = 0x48; memcpy((void*)0x20000752, "TEE\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x2000076f = 1; *(uint8_t*)0x20000770 = -1; *(uint8_t*)0x20000771 = 2; *(uint8_t*)0x20000772 = 0; *(uint8_t*)0x20000773 = 0; *(uint8_t*)0x20000774 = 0; *(uint8_t*)0x20000775 = 0; *(uint8_t*)0x20000776 = 0; *(uint8_t*)0x20000777 = 0; *(uint8_t*)0x20000778 = 0; *(uint8_t*)0x20000779 = 0; *(uint8_t*)0x2000077a = 0; *(uint8_t*)0x2000077b = 0; *(uint8_t*)0x2000077c = 0; *(uint8_t*)0x2000077d = 0; *(uint8_t*)0x2000077e = 0; *(uint8_t*)0x2000077f = 1; memcpy((void*)0x20000780, "netdevsim0\000\000\000\000\000\000", 16); *(uint64_t*)0x20000790 = 0; *(uint8_t*)0x20000798 = 0xfe; *(uint8_t*)0x20000799 = 0x80; *(uint8_t*)0x2000079a = 0; *(uint8_t*)0x2000079b = 0; *(uint8_t*)0x2000079c = 0; *(uint8_t*)0x2000079d = 0; *(uint8_t*)0x2000079e = 0; *(uint8_t*)0x2000079f = 0; *(uint8_t*)0x200007a0 = 0; *(uint8_t*)0x200007a1 = 0; *(uint8_t*)0x200007a2 = 0; *(uint8_t*)0x200007a3 = 0; *(uint8_t*)0x200007a4 = 0; *(uint8_t*)0x200007a5 = 0; *(uint8_t*)0x200007a6 = 0; *(uint8_t*)0x200007a7 = 0xaa; *(uint8_t*)0x200007a8 = 0xfe; *(uint8_t*)0x200007a9 = 0x80; *(uint8_t*)0x200007aa = 0; *(uint8_t*)0x200007ab = 0; *(uint8_t*)0x200007ac = 0; *(uint8_t*)0x200007ad = 0; *(uint8_t*)0x200007ae = 0; *(uint8_t*)0x200007af = 0; *(uint8_t*)0x200007b0 = 0; *(uint8_t*)0x200007b1 = 0; *(uint8_t*)0x200007b2 = 0; *(uint8_t*)0x200007b3 = 0; *(uint8_t*)0x200007b4 = 0; *(uint8_t*)0x200007b5 = 0; *(uint8_t*)0x200007b6 = 0; *(uint8_t*)0x200007b7 = 0; *(uint32_t*)0x200007b8 = htobe32(0); *(uint32_t*)0x200007bc = htobe32(0); *(uint32_t*)0x200007c0 = htobe32(0); *(uint32_t*)0x200007c4 = htobe32(0); *(uint32_t*)0x200007c8 = htobe32(0); *(uint32_t*)0x200007cc = htobe32(0); *(uint32_t*)0x200007d0 = htobe32(0); *(uint32_t*)0x200007d4 = htobe32(0); memcpy((void*)0x200007d8, "vlan1\000\000\000\000\000\000\000\000\000\000\000", 16); memcpy((void*)0x200007e8, "ipvlan0\000\000\000\000\000\000\000\000\000", 16); *(uint8_t*)0x200007f8 = 0; *(uint8_t*)0x20000808 = 0; *(uint16_t*)0x20000818 = 0; *(uint8_t*)0x2000081a = 0; *(uint8_t*)0x2000081b = 0; *(uint8_t*)0x2000081c = 0; *(uint32_t*)0x20000820 = 0; *(uint16_t*)0x20000824 = 0xd0; *(uint16_t*)0x20000826 = 0xf8; *(uint32_t*)0x20000828 = 0; *(uint64_t*)0x20000830 = 0; *(uint64_t*)0x20000838 = 0; *(uint16_t*)0x20000840 = 0x28; memcpy((void*)0x20000842, "set\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x2000085f = 2; *(uint16_t*)0x20000860 = 0; *(uint8_t*)0x20000862 = 0; *(uint8_t*)0x20000863 = 1; *(uint16_t*)0x20000868 = 0x28; memcpy((void*)0x2000086a, "REJECT\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000887 = 0; *(uint32_t*)0x20000888 = 0; *(uint8_t*)0x20000890 = 0; *(uint8_t*)0x20000891 = 0; *(uint8_t*)0x20000892 = 0; *(uint8_t*)0x20000893 = 0; *(uint8_t*)0x20000894 = 0; *(uint8_t*)0x20000895 = 0; *(uint8_t*)0x20000896 = 0; *(uint8_t*)0x20000897 = 0; *(uint8_t*)0x20000898 = 0; *(uint8_t*)0x20000899 = 0; *(uint8_t*)0x2000089a = 0; *(uint8_t*)0x2000089b = 0; *(uint8_t*)0x2000089c = 0; *(uint8_t*)0x2000089d = 0; *(uint8_t*)0x2000089e = 0; *(uint8_t*)0x2000089f = 0; *(uint8_t*)0x200008a0 = 0; *(uint8_t*)0x200008a1 = 0; *(uint8_t*)0x200008a2 = 0; *(uint8_t*)0x200008a3 = 0; *(uint8_t*)0x200008a4 = 0; *(uint8_t*)0x200008a5 = 0; *(uint8_t*)0x200008a6 = 0; *(uint8_t*)0x200008a7 = 0; *(uint8_t*)0x200008a8 = 0; *(uint8_t*)0x200008a9 = 0; *(uint8_t*)0x200008aa = 0; *(uint8_t*)0x200008ab = 0; *(uint8_t*)0x200008ac = 0; *(uint8_t*)0x200008ad = 0; *(uint8_t*)0x200008ae = 0; *(uint8_t*)0x200008af = 0; *(uint8_t*)0x200008b0 = 0; *(uint8_t*)0x200008b1 = 0; *(uint8_t*)0x200008b2 = 0; *(uint8_t*)0x200008b3 = 0; *(uint8_t*)0x200008b4 = 0; *(uint8_t*)0x200008b5 = 0; *(uint8_t*)0x200008b6 = 0; *(uint8_t*)0x200008b7 = 0; *(uint8_t*)0x200008b8 = 0; *(uint8_t*)0x200008b9 = 0; *(uint8_t*)0x200008ba = 0; *(uint8_t*)0x200008bb = 0; *(uint8_t*)0x200008bc = 0; *(uint8_t*)0x200008bd = 0; *(uint8_t*)0x200008be = 0; *(uint8_t*)0x200008bf = 0; *(uint8_t*)0x200008c0 = 0; *(uint8_t*)0x200008c1 = 0; *(uint8_t*)0x200008c2 = 0; *(uint8_t*)0x200008c3 = 0; *(uint8_t*)0x200008c4 = 0; *(uint8_t*)0x200008c5 = 0; *(uint8_t*)0x200008c6 = 0; *(uint8_t*)0x200008c7 = 0; *(uint8_t*)0x200008c8 = 0; *(uint8_t*)0x200008c9 = 0; *(uint8_t*)0x200008ca = 0; *(uint8_t*)0x200008cb = 0; *(uint8_t*)0x200008cc = 0; *(uint8_t*)0x200008cd = 0; *(uint8_t*)0x200008ce = 0; *(uint8_t*)0x200008cf = 0; *(uint8_t*)0x200008d0 = 0; *(uint8_t*)0x200008d1 = 0; *(uint8_t*)0x200008d2 = 0; *(uint8_t*)0x200008d3 = 0; *(uint8_t*)0x200008d4 = 0; *(uint8_t*)0x200008d5 = 0; *(uint8_t*)0x200008d6 = 0; *(uint8_t*)0x200008d7 = 0; *(uint8_t*)0x200008d8 = 0; *(uint8_t*)0x200008d9 = 0; *(uint8_t*)0x200008da = 0; *(uint8_t*)0x200008db = 0; *(uint8_t*)0x200008dc = 0; *(uint8_t*)0x200008dd = 0; *(uint8_t*)0x200008de = 0; *(uint8_t*)0x200008df = 0; *(uint8_t*)0x200008e0 = 0; *(uint8_t*)0x200008e1 = 0; *(uint8_t*)0x200008e2 = 0; *(uint8_t*)0x200008e3 = 0; *(uint8_t*)0x200008e4 = 0; *(uint8_t*)0x200008e5 = 0; *(uint8_t*)0x200008e6 = 0; *(uint8_t*)0x200008e7 = 0; *(uint8_t*)0x200008e8 = 0; *(uint8_t*)0x200008e9 = 0; *(uint8_t*)0x200008ea = 0; *(uint8_t*)0x200008eb = 0; *(uint8_t*)0x200008ec = 0; *(uint8_t*)0x200008ed = 0; *(uint8_t*)0x200008ee = 0; *(uint8_t*)0x200008ef = 0; *(uint8_t*)0x200008f0 = 0; *(uint8_t*)0x200008f1 = 0; *(uint8_t*)0x200008f2 = 0; *(uint8_t*)0x200008f3 = 0; *(uint8_t*)0x200008f4 = 0; *(uint8_t*)0x200008f5 = 0; *(uint8_t*)0x200008f6 = 0; *(uint8_t*)0x200008f7 = 0; *(uint8_t*)0x200008f8 = 0; *(uint8_t*)0x200008f9 = 0; *(uint8_t*)0x200008fa = 0; *(uint8_t*)0x200008fb = 0; *(uint8_t*)0x200008fc = 0; *(uint8_t*)0x200008fd = 0; *(uint8_t*)0x200008fe = 0; *(uint8_t*)0x200008ff = 0; *(uint8_t*)0x20000900 = 0; *(uint8_t*)0x20000901 = 0; *(uint8_t*)0x20000902 = 0; *(uint8_t*)0x20000903 = 0; *(uint8_t*)0x20000904 = 0; *(uint8_t*)0x20000905 = 0; *(uint8_t*)0x20000906 = 0; *(uint8_t*)0x20000907 = 0; *(uint8_t*)0x20000908 = 0; *(uint8_t*)0x20000909 = 0; *(uint8_t*)0x2000090a = 0; *(uint8_t*)0x2000090b = 0; *(uint8_t*)0x2000090c = 0; *(uint8_t*)0x2000090d = 0; *(uint8_t*)0x2000090e = 0; *(uint8_t*)0x2000090f = 0; *(uint8_t*)0x20000910 = 0; *(uint8_t*)0x20000911 = 0; *(uint8_t*)0x20000912 = 0; *(uint8_t*)0x20000913 = 0; *(uint8_t*)0x20000914 = 0; *(uint8_t*)0x20000915 = 0; *(uint8_t*)0x20000916 = 0; *(uint8_t*)0x20000917 = 0; *(uint32_t*)0x20000918 = 0; *(uint16_t*)0x2000091c = 0xa8; *(uint16_t*)0x2000091e = 0xd0; *(uint32_t*)0x20000920 = 0; *(uint64_t*)0x20000928 = 0; *(uint64_t*)0x20000930 = 0; *(uint16_t*)0x20000938 = 0x28; memcpy((void*)0x2000093a, "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000957 = 0; *(uint32_t*)0x20000958 = 0xfffffffe; syscall(__NR_setsockopt, r[1], 0x29, 0x40, 0x20000540ul, 0x420ul); res = syscall(__NR_socket, 0x10ul, 3ul, 0xc); if (res != -1) r[2] = res; *(uint64_t*)0x20000140 = 0; *(uint32_t*)0x20000148 = 0; *(uint64_t*)0x20000150 = 0x20000100; *(uint64_t*)0x20000100 = 0x20000080; *(uint32_t*)0x20000080 = 0x2c; *(uint8_t*)0x20000084 = 0; *(uint8_t*)0x20000085 = 0xb; *(uint16_t*)0x20000086 = 0x101; *(uint32_t*)0x20000088 = 0; *(uint32_t*)0x2000008c = 0; *(uint8_t*)0x20000090 = 3; *(uint8_t*)0x20000091 = 0; *(uint16_t*)0x20000092 = htobe16(0); *(uint16_t*)0x20000094 = 8; STORE_BY_BITMASK(uint16_t, , 0x20000096, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000097, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000097, 0, 7, 1); *(uint32_t*)0x20000098 = htobe32(5); *(uint16_t*)0x2000009c = 8; STORE_BY_BITMASK(uint16_t, , 0x2000009e, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000009f, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000009f, 0, 7, 1); *(uint32_t*)0x200000a0 = htobe32(1); *(uint16_t*)0x200000a4 = 5; *(uint16_t*)0x200000a6 = 1; memcpy((void*)0x200000a8, "\000", 1); *(uint64_t*)0x20000108 = 0x2c; *(uint64_t*)0x20000158 = 1; *(uint64_t*)0x20000160 = 0; *(uint64_t*)0x20000168 = 0; *(uint32_t*)0x20000170 = 0; syscall(__NR_sendmsg, r[2], 0x20000140ul, 0ul); } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); loop(); return 0; }