// https://syzkaller.appspot.com/bug?id=47019f953ae2a8b2a975960010f7ed05b77aa7df // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0x11000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 0x10); *(uint32_t*)0x20003000 = 0x20000000; *(uint32_t*)0x20003004 = 0; *(uint32_t*)0x20003008 = 0x20004000; *(uint32_t*)0x2000300c = 1; *(uint32_t*)0x20003010 = 0x20000000; *(uint32_t*)0x20003014 = 0; *(uint32_t*)0x20003018 = 0; *(uint32_t*)0x20004000 = 0x20010fdc; *(uint32_t*)0x20004004 = 0x23; memcpy((void*)0x20010fdc, "\x23\x00\x00\x00\x24\x00\x91\x15\x46\x00\x00\x00" "\x00\x00\x00\x12\x01\x00\x00\x00\x00\x00\x00\x27" "\x07\x41\x00\x00\x00\x00\x00\x18\x00\x73\x52", 35); syscall(__NR_sendmsg, r[0], 0x20003000, 0); } int main() { loop(); return 0; }