// https://syzkaller.appspot.com/bug?id=a48f98b0e0e04ef593cbc75e242bdfe44f04c87c // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_connect #define __NR_connect 362 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_write #define __NR_write 4 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000, 0x1000, 0, 0x32, -1, 0); syscall(__NR_mmap, 0x20000000, 0x1000000, 7, 0x32, -1, 0); syscall(__NR_mmap, 0x21000000, 0x1000, 0, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0xa, 1, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000240 = 1; syscall(__NR_setsockopt, (intptr_t)r[0], 6, 0x13, 0x20000240, 4); *(uint16_t*)0x20000200 = 0xa; *(uint16_t*)0x20000202 = htobe16(0); *(uint32_t*)0x20000204 = htobe32(0); *(uint64_t*)0x20000208 = htobe64(0); *(uint64_t*)0x20000210 = htobe64(1); *(uint32_t*)0x20000218 = 0; syscall(__NR_connect, (intptr_t)r[0], 0x20000200, 0x1c); memcpy((void*)0x20000540, "tls\000", 4); syscall(__NR_setsockopt, (intptr_t)r[0], 6, 0x1f, 0x20000540, 4); *(uint16_t*)0x20000080 = 0x303; *(uint16_t*)0x20000082 = 0x39; memcpy((void*)0x20000084, "\x83\x7a\xd5\x52\xee\xd2\x2b\x08", 8); memcpy((void*)0x2000008c, "\xa4\x32\x6b\xf4\x7c\x64\x89\x97\xa7\x34\x7f\x17\x67\xb5\x03\xc5", 16); memset((void*)0x2000009c, 0, 4); memcpy((void*)0x200000a0, "\x72\xd6\x9f\x07\x6b\x51\x03\x00", 8); syscall(__NR_setsockopt, (intptr_t)r[0], 0x11a, 1, 0x20000080, 0x28); *(uint8_t*)0x20000580 = 0x7f; *(uint8_t*)0x20000581 = 0x45; *(uint8_t*)0x20000582 = 0x4c; *(uint8_t*)0x20000583 = 0x46; *(uint8_t*)0x20000584 = 0; *(uint8_t*)0x20000585 = 0; *(uint8_t*)0x20000586 = 0; *(uint8_t*)0x20000587 = 0; *(uint64_t*)0x20000588 = 0; *(uint16_t*)0x20000590 = 0; *(uint16_t*)0x20000592 = 0; *(uint32_t*)0x20000594 = 0; *(uint64_t*)0x20000598 = 0; *(uint64_t*)0x200005a0 = 0x40; *(uint64_t*)0x200005a8 = 0; *(uint32_t*)0x200005b0 = 0; *(uint16_t*)0x200005b4 = 0; *(uint16_t*)0x200005b6 = 0x38; *(uint16_t*)0x200005b8 = 0; *(uint16_t*)0x200005ba = 0; *(uint16_t*)0x200005bc = 0; *(uint16_t*)0x200005be = 0; *(uint32_t*)0x200005c0 = 0; *(uint32_t*)0x200005c4 = 0; *(uint64_t*)0x200005c8 = 0; *(uint64_t*)0x200005d0 = 0; *(uint64_t*)0x200005d8 = 0; *(uint64_t*)0x200005e0 = 0; *(uint64_t*)0x200005e8 = 0; *(uint64_t*)0x200005f0 = 0; memset((void*)0x200005f8, 0, 256); memset((void*)0x200006f8, 0, 256); syscall(__NR_write, (intptr_t)r[0], 0x20000580, 0x278); return 0; }