// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; res = syscall(__NR_fcntl, r[0], 0x406, r[0]); if (res != -1) r[1] = res; *(uint64_t*)0x200002c0 = 0x20000140; *(uint16_t*)0x20000140 = 0x10; *(uint16_t*)0x20000142 = 0; *(uint32_t*)0x20000144 = 0; *(uint32_t*)0x20000148 = 0x400e002; *(uint32_t*)0x200002c8 = 0xc; *(uint64_t*)0x200002d0 = 0x20000240; *(uint64_t*)0x20000240 = 0x20000200; *(uint32_t*)0x20000200 = 0x28; *(uint16_t*)0x20000204 = 0; *(uint16_t*)0x20000206 = 0x20; *(uint32_t*)0x20000208 = 0x70bd2a; *(uint32_t*)0x2000020c = 0x25dfdbfb; *(uint8_t*)0x20000210 = 2; *(uint8_t*)0x20000211 = 0; *(uint16_t*)0x20000212 = 0; *(uint16_t*)0x20000214 = 0xc; *(uint16_t*)0x20000216 = 3; *(uint16_t*)0x20000218 = 8; *(uint16_t*)0x2000021a = 8; *(uint8_t*)0x2000021c = 3; *(uint16_t*)0x20000220 = 8; *(uint16_t*)0x20000222 = 6; *(uint32_t*)0x20000224 = 2; *(uint64_t*)0x20000248 = 0x28; *(uint64_t*)0x200002d8 = 1; *(uint64_t*)0x200002e0 = 0; *(uint64_t*)0x200002e8 = 0; *(uint32_t*)0x200002f0 = 0x20008004; syscall(__NR_sendmsg, r[1], 0x200002c0, 0x20000000); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }