// https://syzkaller.appspot.com/bug?id=dad48ceb9915533eaa979440cce82209ee69f0f4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } long r[156]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x20001000, "\x2f\x64\x65\x76\x2f\x62\x69\x6e\x64\x65\x72\x23\x00", 13); r[2] = syz_open_dev(0x20001000ul, 0x0ul, 0x0ul); r[3] = syscall(__NR_epoll_create, 0x10001ul); *(uint32_t*)0x20336ff4 = (uint32_t)0x2019; *(uint64_t*)0x20336ff8 = (uint64_t)0x0; r[6] = syscall(__NR_epoll_ctl, r[3], 0x1ul, r[2], 0x20336ff4ul); r[7] = syscall(__NR_ioctl, r[2], 0x40046208ul, 0x0ul); *(uint16_t*)0x20462f7c = (uint16_t)0x2; *(uint16_t*)0x20462f7e = (uint16_t)0x214e; *(uint32_t*)0x20462f80 = (uint32_t)0x0; *(uint8_t*)0x20462f84 = (uint8_t)0x0; *(uint8_t*)0x20462f85 = (uint8_t)0x0; *(uint8_t*)0x20462f86 = (uint8_t)0x0; *(uint8_t*)0x20462f87 = (uint8_t)0x0; *(uint8_t*)0x20462f88 = (uint8_t)0x0; *(uint8_t*)0x20462f89 = (uint8_t)0x0; *(uint8_t*)0x20462f8a = (uint8_t)0x0; *(uint8_t*)0x20462f8b = (uint8_t)0x0; *(uint16_t*)0x20462f8c = (uint16_t)0xa; *(uint16_t*)0x20462f8e = (uint16_t)0x204e; *(uint32_t*)0x20462f90 = (uint32_t)0x1; *(uint64_t*)0x20462f94 = (uint64_t)0x0; *(uint64_t*)0x20462f9c = (uint64_t)0x100000000000000; *(uint32_t*)0x20462fa4 = (uint32_t)0x8000; *(uint16_t*)0x20462fa8 = (uint16_t)0x2; *(uint16_t*)0x20462faa = (uint16_t)0x214e; *(uint32_t*)0x20462fac = (uint32_t)0x20000e0; *(uint8_t*)0x20462fb0 = (uint8_t)0x0; *(uint8_t*)0x20462fb1 = (uint8_t)0x0; *(uint8_t*)0x20462fb2 = (uint8_t)0x0; *(uint8_t*)0x20462fb3 = (uint8_t)0x0; *(uint8_t*)0x20462fb4 = (uint8_t)0x0; *(uint8_t*)0x20462fb5 = (uint8_t)0x0; *(uint8_t*)0x20462fb6 = (uint8_t)0x0; *(uint8_t*)0x20462fb7 = (uint8_t)0x0; *(uint16_t*)0x20462fb8 = (uint16_t)0x2; *(uint16_t*)0x20462fba = (uint16_t)0x234e; *(uint32_t*)0x20462fbc = (uint32_t)0x10000e0; *(uint8_t*)0x20462fc0 = (uint8_t)0x0; *(uint8_t*)0x20462fc1 = (uint8_t)0x0; *(uint8_t*)0x20462fc2 = (uint8_t)0x0; *(uint8_t*)0x20462fc3 = (uint8_t)0x0; *(uint8_t*)0x20462fc4 = (uint8_t)0x0; *(uint8_t*)0x20462fc5 = (uint8_t)0x0; *(uint8_t*)0x20462fc6 = (uint8_t)0x0; *(uint8_t*)0x20462fc7 = (uint8_t)0x0; *(uint16_t*)0x20462fc8 = (uint16_t)0xa; *(uint16_t*)0x20462fca = (uint16_t)0x214e; *(uint32_t*)0x20462fcc = (uint32_t)0xf4a8; *(uint8_t*)0x20462fd0 = (uint8_t)0x0; *(uint8_t*)0x20462fd1 = (uint8_t)0x0; *(uint8_t*)0x20462fd2 = (uint8_t)0x0; *(uint8_t*)0x20462fd3 = (uint8_t)0x0; *(uint8_t*)0x20462fd4 = (uint8_t)0x0; *(uint8_t*)0x20462fd5 = (uint8_t)0x0; *(uint8_t*)0x20462fd6 = (uint8_t)0x0; *(uint8_t*)0x20462fd7 = (uint8_t)0x0; *(uint8_t*)0x20462fd8 = (uint8_t)0x0; *(uint8_t*)0x20462fd9 = (uint8_t)0x0; *(uint8_t*)0x20462fda = (uint8_t)0x0; *(uint8_t*)0x20462fdb = (uint8_t)0x0; *(uint8_t*)0x20462fdc = (uint8_t)0x0; *(uint8_t*)0x20462fdd = (uint8_t)0x0; *(uint8_t*)0x20462fde = (uint8_t)0x0; *(uint8_t*)0x20462fdf = (uint8_t)0x0; *(uint32_t*)0x20462fe0 = (uint32_t)0x1; *(uint16_t*)0x20462fe4 = (uint16_t)0xa; *(uint16_t*)0x20462fe6 = (uint16_t)0x224e; *(uint32_t*)0x20462fe8 = (uint32_t)0x3478; *(uint8_t*)0x20462fec = (uint8_t)0x0; *(uint8_t*)0x20462fed = (uint8_t)0x0; *(uint8_t*)0x20462fee = (uint8_t)0x0; *(uint8_t*)0x20462fef = (uint8_t)0x0; *(uint8_t*)0x20462ff0 = (uint8_t)0x0; *(uint8_t*)0x20462ff1 = (uint8_t)0x0; *(uint8_t*)0x20462ff2 = (uint8_t)0x0; *(uint8_t*)0x20462ff3 = (uint8_t)0x0; *(uint8_t*)0x20462ff4 = (uint8_t)0x0; *(uint8_t*)0x20462ff5 = (uint8_t)0x0; *(uint8_t*)0x20462ff6 = (uint8_t)0x0; *(uint8_t*)0x20462ff7 = (uint8_t)0x0; *(uint8_t*)0x20462ff8 = (uint8_t)0x0; *(uint8_t*)0x20462ff9 = (uint8_t)0x0; *(uint8_t*)0x20462ffa = (uint8_t)0x0; *(uint8_t*)0x20462ffb = (uint8_t)0x0; *(uint32_t*)0x20462ffc = (uint32_t)0x400; r[87] = syscall(__NR_setsockopt, 0xfffffffffffffffful, 0x84ul, 0x6bul, 0x20462f7cul, 0x84ul); *(uint32_t*)0x200b7000 = (uint32_t)0x80; *(uint32_t*)0x200b7004 = (uint32_t)0x8; *(uint32_t*)0x200b7008 = (uint32_t)0x7; *(uint8_t*)0x200b700c = (uint8_t)0x0; *(uint8_t*)0x200b700d = (uint8_t)0x0; *(uint8_t*)0x200b700e = (uint8_t)0x0; *(uint8_t*)0x200b700f = (uint8_t)0x0; *(uint8_t*)0x200b7010 = (uint8_t)0x0; *(uint8_t*)0x200b7011 = (uint8_t)0x0; *(uint8_t*)0x200b7012 = (uint8_t)0x0; *(uint8_t*)0x200b7013 = (uint8_t)0x0; *(uint8_t*)0x200b7014 = (uint8_t)0x0; *(uint8_t*)0x200b7015 = (uint8_t)0x0; *(uint8_t*)0x200b7016 = (uint8_t)0x0; *(uint8_t*)0x200b7017 = (uint8_t)0x0; *(uint8_t*)0x200b7018 = (uint8_t)0x0; *(uint8_t*)0x200b7019 = (uint8_t)0x0; *(uint8_t*)0x200b701a = (uint8_t)0x0; *(uint8_t*)0x200b701b = (uint8_t)0x0; *(uint8_t*)0x200b701c = (uint8_t)0x0; *(uint8_t*)0x200b701d = (uint8_t)0x0; *(uint8_t*)0x200b701e = (uint8_t)0x0; *(uint8_t*)0x200b701f = (uint8_t)0x0; *(uint8_t*)0x200b7020 = (uint8_t)0x0; *(uint8_t*)0x200b7021 = (uint8_t)0x0; *(uint8_t*)0x200b7022 = (uint8_t)0x0; *(uint8_t*)0x200b7023 = (uint8_t)0x0; *(uint8_t*)0x200b7024 = (uint8_t)0x0; *(uint8_t*)0x200b7025 = (uint8_t)0x0; *(uint8_t*)0x200b7026 = (uint8_t)0x0; *(uint8_t*)0x200b7027 = (uint8_t)0x0; *(uint8_t*)0x200b7028 = (uint8_t)0x0; *(uint8_t*)0x200b7029 = (uint8_t)0x0; *(uint8_t*)0x200b702a = (uint8_t)0x0; *(uint8_t*)0x200b702b = (uint8_t)0x0; *(uint8_t*)0x200b702c = (uint8_t)0x0; *(uint8_t*)0x200b702d = (uint8_t)0x0; *(uint8_t*)0x200b702e = (uint8_t)0x0; *(uint8_t*)0x200b702f = (uint8_t)0x0; *(uint8_t*)0x200b7030 = (uint8_t)0x0; *(uint8_t*)0x200b7031 = (uint8_t)0x0; *(uint8_t*)0x200b7032 = (uint8_t)0x0; *(uint8_t*)0x200b7033 = (uint8_t)0x0; *(uint8_t*)0x200b7034 = (uint8_t)0x0; *(uint8_t*)0x200b7035 = (uint8_t)0x0; *(uint8_t*)0x200b7036 = (uint8_t)0x0; *(uint8_t*)0x200b7037 = (uint8_t)0x0; *(uint8_t*)0x200b7038 = (uint8_t)0x0; *(uint8_t*)0x200b7039 = (uint8_t)0x0; *(uint8_t*)0x200b703a = (uint8_t)0x0; *(uint8_t*)0x200b703b = (uint8_t)0x0; *(uint8_t*)0x200b703c = (uint8_t)0x0; *(uint8_t*)0x200b703d = (uint8_t)0x0; *(uint8_t*)0x200b703e = (uint8_t)0x0; *(uint8_t*)0x200b703f = (uint8_t)0x0; *(uint8_t*)0x200b7040 = (uint8_t)0x0; *(uint8_t*)0x200b7041 = (uint8_t)0x0; *(uint8_t*)0x200b7042 = (uint8_t)0x0; *(uint8_t*)0x200b7043 = (uint8_t)0x0; *(uint8_t*)0x200b7044 = (uint8_t)0x0; *(uint8_t*)0x200b7045 = (uint8_t)0x0; *(uint8_t*)0x200b7046 = (uint8_t)0x0; *(uint8_t*)0x200b7047 = (uint8_t)0x0; *(uint8_t*)0x200b7048 = (uint8_t)0x0; *(uint8_t*)0x200b7049 = (uint8_t)0x0; *(uint8_t*)0x200b704a = (uint8_t)0x0; *(uint8_t*)0x200b704b = (uint8_t)0x0; r[155] = syscall(__NR_ioctl, 0xfffffffffffffffful, 0xc04c5349ul, 0x200b7000ul); } int main() { loop(); return 0; }