// https://syzkaller.appspot.com/bug?id=8fdd21f601550b6e5e43dec7d4a96955879a5aac // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0x10ul, 3ul, 0ul); if (res != -1) r[0] = res; res = syscall(__NR_socket, 2ul, 2ul, 0x88ul); if (res != -1) r[1] = res; *(uint64_t*)0x20000240 = 0; *(uint32_t*)0x20000248 = 0x1c6; *(uint64_t*)0x20000250 = 0x20000080; *(uint64_t*)0x20000080 = 0x20000880; memcpy((void*)0x20000880, "\x48\x00\x00\x00\x24\x00\x07\x05\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 20); *(uint32_t*)0x20000894 = r[1]; memcpy((void*)0x20000898, "\x00\x00\x00\x11\xff\xff\xff\xff\x00\x00\x00\x00\x08\x00\x01\x00\x63" "\x62\x73\x00\x1c\x00\x02\x00\x19\x00\x01\x00\x00\x00\x00\x00\x07\x00" "\x00\x00\x05\x00\x00\x00\x00\xfe\xff\x00\x00\x00\x00\x00\x00\x00\x00" "\xa2\xe3\x87\xd6\x3e\x72\x17\x59\x05\x78\x00\x3f\x91\x16\x0e\x12\xe5" "\xca\xb3\x8e\xa6\xd1\x4b\x05\xd0\xdf\x91\x5a\x3f\x95\x8c\x8b\x0b\x00" "\x00\x30", 87); *(uint64_t*)0x20000088 = 0x48; *(uint64_t*)0x20000258 = 1; *(uint64_t*)0x20000260 = 0; *(uint64_t*)0x20000268 = 0; *(uint32_t*)0x20000270 = 0x65580000; syscall(__NR_sendmsg, r[0], 0x20000240ul, 0ul); return 0; }