// https://syzkaller.appspot.com/bug?id=5ea2c9ac96fc3c1da4d7ee9572c8c7ed229f1b13 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 4); memcpy((void*)0x20f67000, "\x9a\xdc\x01\xce", 4); syscall(__NR_setsockopt, r[0], 0x10e, 0xb, 0x20f67000, 4); *(uint32_t*)0x2058efc8 = 0x201e4000; *(uint32_t*)0x2058efcc = 0xc; *(uint32_t*)0x2058efd0 = 0x20877000; *(uint32_t*)0x2058efd4 = 1; *(uint32_t*)0x2058efd8 = 0; *(uint32_t*)0x2058efdc = 0; *(uint32_t*)0x2058efe0 = 0; *(uint16_t*)0x201e4000 = 0x10; *(uint16_t*)0x201e4002 = 0; *(uint32_t*)0x201e4004 = 0; *(uint32_t*)0x201e4008 = 0; *(uint32_t*)0x20877000 = 0x20611000; *(uint32_t*)0x20877004 = 0x14; *(uint32_t*)0x20611000 = 0x14; *(uint8_t*)0x20611004 = 0; *(uint8_t*)0x20611005 = 0xb; *(uint16_t*)0x20611006 = 0x10c; *(uint32_t*)0x20611008 = 0; *(uint32_t*)0x2061100c = 0; *(uint8_t*)0x20611010 = 0; *(uint8_t*)0x20611011 = 0; *(uint16_t*)0x20611012 = htobe16(0); syscall(__NR_sendmsg, r[0], 0x2058efc8, 0); } int main() { loop(); return 0; }