// https://syzkaller.appspot.com/bug?id=35093bfdbf6c30bc09e56dd2fc7ee4a07c708205 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include const int kInitNetNsFd = 201; static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto) { return syscall(__NR_socket, domain, type, proto); } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = -1; res = syz_init_net_socket(0x1a, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20001040 = 0x20000080; *(uint16_t*)0x20000080 = 0x10; memcpy((void*)0x20000082, "\xbe\xb7\xfa\x17\x0c\x60\x4d\x75\xbc\x5c\x63\x89\xf8\xc5\x6b\x95\xe1" "\x61\x16\xb3\xaf\xed\xab\xb1\x34\xa3\xd2\xa3\x05\xb4\xc6\xe1\x7f\x9f" "\xd2\x41\x29\xb2\xf9\xf0\x9d\x19\x48\x50\x30\x63\x5b\x58\x0f\xfd\xe1" "\x85\xde\xa4\x24\x21\x04\xdd\x4a\x10\x80\xe2\x8e\x9d\xad\xfc\x0f\x91" "\x71\xe0\xb1\x4b\x02\xbc\x21\xcd\x3b\x15\x32\x1f\x64\x5b\x47\x05\x5a" "\x11\xff\x4f\xc4\x7b\x7c\xa2\x1b\xb4\x05\x77\xa5\x7d\x6d\xb2\xc1\x31" "\x33\x44\xd5\x59\x56\x91\xdf\xd5\xd2\x00\xbd\x83\x4e\x0a\x3c\x7b\x0a" "\x34\x5f\xed\x54\xb0\xde\x74", 126); *(uint32_t*)0x20001048 = 0x80; *(uint64_t*)0x20001050 = 0; *(uint64_t*)0x20001058 = 0; *(uint64_t*)0x20001060 = 0; *(uint64_t*)0x20001068 = 0; *(uint32_t*)0x20001070 = 0; *(uint32_t*)0x20001078 = 0; *(uint64_t*)0x20001080 = 0; *(uint32_t*)0x20001088 = 0; *(uint64_t*)0x20001090 = 0; *(uint64_t*)0x20001098 = 0; *(uint64_t*)0x200010a0 = 0; *(uint64_t*)0x200010a8 = 0; *(uint32_t*)0x200010b0 = 0; *(uint32_t*)0x200010b8 = 0; *(uint64_t*)0x200010c0 = 0; *(uint32_t*)0x200010c8 = 0; *(uint64_t*)0x200010d0 = 0; *(uint64_t*)0x200010d8 = 0; *(uint64_t*)0x200010e0 = 0; *(uint64_t*)0x200010e8 = 0; *(uint32_t*)0x200010f0 = 0; *(uint32_t*)0x200010f8 = 0; *(uint64_t*)0x20001100 = 0; *(uint32_t*)0x20001108 = 0; *(uint64_t*)0x20001110 = 0; *(uint64_t*)0x20001118 = 0; *(uint64_t*)0x20001120 = 0; *(uint64_t*)0x20001128 = 0; *(uint32_t*)0x20001130 = 0; *(uint32_t*)0x20001138 = 0; *(uint64_t*)0x20001140 = 0; *(uint32_t*)0x20001148 = 0; *(uint64_t*)0x20001150 = 0; *(uint64_t*)0x20001158 = 0; *(uint64_t*)0x20001160 = 0; *(uint64_t*)0x20001168 = 0; *(uint32_t*)0x20001170 = 0; *(uint32_t*)0x20001178 = 0; syscall(__NR_sendmmsg, r[0], 0x20001040ul, 5ul, 0x20000004ul); return 0; }