// https://syzkaller.appspot.com/bug?id=244acf6996ae0b9122ac763d3099922258c9bd43 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; res = syscall(__NR_socket, 2ul, 1ul, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20d06000 = 1; syscall(__NR_setsockopt, r[0], 6, 0x13, 0x20d06000ul, 4ul); memcpy((void*)0x20000000, "batadv0\000\000\000\000\000\000\000\000\000", 16); syscall(__NR_setsockopt, r[0], 1, 0x19, 0x20000000ul, 0x90ul); *(uint16_t*)0x200000c0 = 2; *(uint16_t*)0x200000c2 = htobe16(0); *(uint8_t*)0x200000c4 = 0xac; *(uint8_t*)0x200000c5 = 0x1e; *(uint8_t*)0x200000c6 = 0; *(uint8_t*)0x200000c7 = 1 + procid * 1; syscall(__NR_connect, r[0], 0x200000c0ul, 0x10ul); *(uint32_t*)0x20000400 = 0; syscall(__NR_setsockopt, r[0], 6, 0x13, 0x20000400ul, 4ul); *(uint32_t*)0x20000240 = 1; syscall(__NR_setsockopt, r[0], 1, 0x3c, 0x20000240ul, 4ul); *(uint64_t*)0x20005700 = 0; *(uint32_t*)0x20005708 = 0; *(uint64_t*)0x20005710 = 0x20000040; *(uint64_t*)0x20000040 = 0x20000f80; memcpy( (void*)0x20000f80, "\x8d\x4d\x06\x81\xb2\x5a\xbc\x94\x36\x4a\x03\xbd\x5f\xfb\x6a\xbc\x2f\xf7" "\xfe\xe7\x5c\x5a\xfb\xbc\xa9\x11\x52\xbf\x28\x1a\x6c\x69\x2b\x08\x1b\x11" "\x0d\xc5\xd6\x03\x31\x2f\x11\xfa\x8e\xa9\xf8\xa0\x8b\xc5\x7f\xdd\x7c\xe2" "\xa8\x70\x40\xb7\x9e\x88\x12\x15\xf4\xa1\x89\x0a\x94\xf6\x1b\x7c\xd4\x9f" "\xb4\x00\xfc\xde\xc7\x4c\x29\x9c\x9d\x0a\x0c\xb7\x86\xf1\xf7\xf0\xb3\x38" "\x3d\xc8\x08\x9e\xe8\xd5\xe6\xe3\x8e\x0e\x57\xea\x68\x86\x26\x16\x28\x6c" "\xd9\xe7\x59\xd0\x00\x60\x11\xe2\xaf\x78\x55\x3d\x99\x11\xba\xa2\x3a\x94" "\x2f\x56\x91\x57\xf6\xb0\x81\x0a\xb1\x06\x29\xb4\xf6\xb7\x7f\x50\x48\xa4" "\xae\x91\x5e\x2f\x9a\x8f\xab\x8a\xdc\xd6\x11\xae\x30\x27\xf5\xae\xdb\xf0" "\xed\x01\x8e\xd5\x1e\x59\x59\x1b\xc8\x54\x93\xa2\x79\xb6\x99\xce\xbc\xde" "\x78\xaf\x52\x70\x76\x21\x01\x09\xac\x43\x61\xaa\x3a\xd3\x8e\x6e\xe0\x88" "\x30\x3f\xa0\xad\x42\x1b\xe3\xac\xd9\xd7\xab\xce\xe7\x27\x92\x4b\x49\xe2" "\xd7\xee\x4b\xaa\x90\x1d\x41\x86\xa2\xfd\xd8\x15\x94\x17\xc3\x00\x43\xd3" "\xd1\x7c\x2c\x65\x70\x8d\xd7\xd9\x2f\x16\x0a\x1b\x74\x7c\xe1\x1a\xea\x7c" "\x95\x4d\xba\xd7\x25\x63\xf2\xa2\x11\xf1\x98\xfb\xf6\x86\xc5\x75\x8f\x4f" "\xce\xda\x78\x02\x57\xeb\x83\x67\x88\x64\x50\xc4\x2a\x81\x33\x17\x95\xb8" "\x1d\x59\xb9\xc1\x87\x7b\xe3\x33\xb0\xfb\xf6\xb7\x64\x14\xf7\xc7\xe9\xc7" "\x01\x85\x70\x6e\xce\x19\x42\xa0\x9f\x0c\x4a\xd3\x6c\x7b\x53\x1f\x7b\x07" "\xa3\xb0\x69\x99\xba\xa0\x08\xfe\x11\x6d\xcc\xe2\x46\x14\x9b\xa4\x86\x8d" "\x4a\xb5\x17\x0a\x10\xec\xfa\x5b\x9d\xf7\x6e\x07\x02\x9a\xea\xcc\x80\xb7" "\xbf\xd2\x26\x80\xf0\xc6\x65\xa5\x7b\xf9\x5d\xc1\xa6\x61\x92\xda\x9c\xfa" "\x9a\xef\xd6\x78\xc7\xa3\xd6\x9e\xaf\x45\xc5\x01\xa4\x92\xf0\xac\x82\xad" "\x54\x54\x65\x3b\x85\x2b\x7b\xa9\x95\x00\x49\x7e\x89\xa1\x4d\x93\xaf\x83" "\xa7\x60\x0d\xf0\x0a\x4c\x24\x7a\x44\x47\x7b\x7f\xc7\x85\xd3\x64\x1a\xc3" "\xbe\xb7\xd1\xc3\x8d\x6c\xf2\x42\xe2\xeb\xee\x25\xb4\xcd\xce\xbd\x87\xeb" "\xc4\x0b\x13\xab\xf8\x71\x5c\xd2\xe2\xbf\x12\x2e\x9b\x45\xc2\x16\xd7\x3d" "\x98\x94\x97\x17\x78\xc1\x76\x8b\x73\x27\x6c\x55\x45\x0d\x3b\x28\x46\x25" "\xfb\xb6\x51\xd0\x70\x93\x55\x2b\xd5\xb1\x95\xa6\xed\xdc\xad\x79\xd6\xf0" "\x2d\xf6\x54\x04\xcd\x02\xe2\x3c\x5c\xfe\x1e\xa9\xdc\x3c\x47\x43\x55\x90" "\x09\x96\x24\x50\xc4\xe5\x3a\xb8\x68\x13\x02\x8a\xe9\x94\xe7\xfe\xf7\x9d" "\x62\x49\x9d\xad\xe1\xa4\x8c\xc3\x18\x4c\x80\xf9\x44\x5a\x81\x5d\x55\xb0" "\x1e\xba\x0a\xd4\x90\xdf\x37\x60\x97\x63\xa1\x83\x34\x72\xea\x68\x01\xde" "\x00\x34\x96\xbc\x6d\x3a\x2c\xaf\x91\x05\xa5\x44\x5b\xa4\x5d\x45\xdb\x81" "\x8c\x6c\xe4\xa0\x4e\x19\x51\x88\xa4\x03\x05\x07\x8d\x5a\x2f\x4c\x96\x4e" "\xff\x43\x21\x80\x00\x1b\xc7\x70\xe7\x65\x17\xcd\xef\x6c\xee\x5f\xf4\xe5" "\x89\x2a\xc9\x11\x92\x4e\x9b\x5d\x2f\x90\xae\x96\x0a\x6b\x87\x7c\x64\xc3" "\x0a\xad\xf4\x29\x98\xcf\x18\x53\x68\x56\x7b\x2b\x28\x6d\x72\xe4\x4a\x8f" "\x34\x95\xc2\x48\xf6\xee\x46\x1a\x21\x96\x26\x69\xa0\xfe\x7f\x85\x7f\x14" "\xdf\xd8\x1f\x44\x6a\x19\xa8\x90\x3e\x1c\x6a\xf8\x80\xb9\x47\xcf\x24\xbc" "\x3a\x01\xa6\x4c\xc5\x28\xae\xf6\xf3\x18\x58\x0a\x58\xc7\x0c\x0d\x9e\xce" "\x1e\x98\xce\x73\x83\x68\xe8\x92\x83\x16\x74\x1c\x54\x42\x84\x2c\x9d\xb9" "\xc6\x58\x48\x4a\x9a\xc0\xcc\x6e\x78\xf6\xdc\xbc\xcc\x1a\xe6\xa4\x3c\xd6" "\xb7\xf1\xb0\xd8\x8d\x63\x7f\xa1\xbb\x4a\xda\xb1\xa2\x82\xa7\x7c\xb1\xcc" "\xd2\x2f\x0b\xf6\x4a\xe7\xa6\x46\xb8\x7b\x0b\x19\xdc\x97\x59\x2e\xac\xbe" "\x64\x56\x9a\xb5\xd9\x86\xfb\xfe\xb8\xc8\x26\x49\x9b\x32\xc9\x8a\x42\x29" "\x19\xda\x49\x3b\x20\x49\x7c\xc8\xcb\x1f\x0e\x61\x2f\x57\xe8\x8f\x05\x11" "\x7b\x97\x37\xc0\xb8\xe2\xea\x25\xf6\xfa\x60\xda\x36\x73\xff\x61\xd7\x5b" "\xf6\xd9\xb7\x2f\x4b\xa0\xd7\xe1\xb7\x0e\xc9\x7b\x82\x3a\x92\x15\x7b\x82" "\xa9\xce\x24\x9e\x5d\x7c\x9c\x44\x9f\x17\xfe\x33\x53\xd3\xe1\x06\x5d\x87" "\x38\x19\xb5\x87\xa8\x72\x45\x2b\x9c\xfb\x87\x7d\x1d\x35\x26\xa8\x2e\x76" "\xdb\xd7\x18\x3a\x26\xc0\xc9\xf6\x63\x93\x25\x18\x58\xb0\x1c\x7b\xd9\x55" "\x95\xa7\x64\xaa\xba\x3e\xfd\x04\x4b\x6c\x73\xe4\x5e\x1f\xdb\x91\x07\x2c" "\x84\x52\x8e\x45\x02\x8f\x2b\x3c\x03\xe2\xbf\xa8\x23\x71\x1f\xb7\x08\x8f" "\x71\x7a\x70\x7d\xd0\x8d\x4b\x6d\xb3\x92\x5d\xbe\xd4\x2a\xca\xa6\x3a\x38" "\x95\x89\x62\xb5\xfa\x04\x0e\x6c\x8a\x40\xd1\x8f\x12\xf2\xf9\x2f\x40\xd4" "\xb1\x74\x6c\xce\xdd\x93\x75\x28\xfa\xd9\x3e\x05\xc3\xc9\x71\xba\x7e\x0a" "\x58\x18\x63\x5c\x59\x92\xc8\x24\x62\x19\x01\x28\x79\x83\x1c\xd9\x0b\xf0" "\xf1\x61\x50\xfc\x39\x2b\x57\x54\xe8\x53\x06\xd5\x0e\x98\x68\x73\x46\x35" "\xe8\xa4\x0e\xb5\x1b\xfa\x1b\xff\xb5\x74\x04\x3f\x66\xcf\x24\xef\x42\x51" "\xa0\x08\x90\x46\x16\xad\xe4\x74\xcc\xbe\x15\x8f\x06\xbf\xdd\x32\x4a\x42" "\x4b\xb8\xb5\x8d\x02\xb5\x90\x66\x56\xb7\xf0\x12\x45\x0a\x18\x81\x28\x58" "\x23\x5a\x3c\x50\x48\xcd\x67\xa5\xbf\x97\x9f\xcc\xea\x8d\xd1\x8a\x77\xcd" "\x64\xb9\x98\x53\xd7\xd6\xd9\x27\xdc\x1f\x24\x0c\x9f\xd2\x11\xa6\x8b\x56" "\xfb\xb6\x3a\x11\xe1\x27\x28\x47\x11\x84\x43\x96\xb4\x60\x7d\xf1\x81\xc2" "\xaa\xea\x4b\x50\x66\x36\x81\xec\xcc\xc6\x88\xf1\xac\xa5\x38\x27\x0a\xb7" "\x87\x65\xd6\x72\x3a\xba\xbd\x5a\x32\xb3\x5f\x65\x71\x25\x4d\xee\x6c\x89" "\xb6\x06\x05\x27\xac\x09\xee\x15\xe3\x5a\x4a\x27\xed\xff\x50\x42\xc0\x2a" "\xaa\x59\xb5\x29\x56\x94\x4c\x8f\xea\x5b\x88\x99\x30\xbe\xeb\x44\xf2\x1f" "\xd3\xd0\xff\x59\xdf\x87\x4a\xbf\xf9\x3a\xcd\xa8\x77\xe7\xe9\x9d\x3b\x5c" "\xf5\xd6\x95\xc4\x1a\x10\x4c\x05\x6f\x96\xe9\xef\x03\xdb\x3d\x07\x1b\x92" "\xfe\x59\x28\x1a\xcb\xe8\xf9\x05\x01\xe7\x0c\x44\x69\x73\x9b\x85\x12\x67" "\xa8\xc4\x24\x79\xae\x8a\xc5\xf9\x90\x47\xa9\xe1\x2e\xe1\x00\x98\xc7\x87" "\xf3\xb3\x81\x2f\x7d\xba\xf4\xb9\xe5\x9f\x24\x0c\x0f\x40\xd7\xb4\xe4\x2e" "\x9c\xf5\x2b\xdb\xbc\x66\xbf\x73\xc2\x28\x0d\x53\x43\x22\xd8\x34\x43\xa8" "\x58\x2b\xe3\x23\x1e\x04\x62\x6b\xef\x68\xa1\x69\x77\xdc\xe8\x4e\x09\x78" "\xf3\x16\xb0\xc4\xae\x91\x49\xce\xd0\x76\x0a\x92\x8d\xa8\x04\xf5\xe3\xa5" "\xe4\xa8\xf9\xde\xa4\x16\x01\xeb\x50\x0e\x21\x70\x64\x72\xfc\xf6\x83\x1c" "\x72\x1e\x13\x1c\x34\xa3\x6c\xb4\x6d\x32\x56\x89\xdd\x89\x63\x39\x88\xea" "\x2d\x86\x55\xb3\x7e\x61\x5a\x7c\x59\xf1\xd1\x53\xae\x5d\x71\xfe\x9b\x9d" "\x3a\xfd\x8b\x76\x09\x5a\xb1\x95\x8e\x69\x7c\xd1\xd8\x04\x88\xe4\x66\xf0" "\x0a\xf4\xdd\x7d\x5f\x36\x4c\x71\x2d\xbc\xbc\x09\x0e\x56\x3f\x29\x54\x98" "\x8e\x44\x6b\x6d\x14\xce\xa3\x2e\x43\x80\x2b\x5f\xdd\xf3\xf5\x12\x9d\xae" "\xbf\x5d\x6f\x4a\x70\xb4\x5d\xa9\x67\x2d\x96\x47\xe2\xc0\xb3\xe6\x45\x94" "\xb6\x37\x4a\x6f\xcb\x87\xd6\xfd\xbd\x71\x67\x28\xb1\xa8\x7f\x90\x21\x0f" "\x5d\x04\x53\x59\x69\xbb\xdd\x72\xc1\x68\x81\x49\xeb\x7e\x96\x68\x85\xf7" "\x46\x18\x97\x49\xc5\x9b\xfe\x2a\x07\xd5\x97\x09\x14\x91\x97\xf7\xb9\x9d" "\x15\x3d\xa4\xac\xa6\xe4\x22\xd2\xfb\xe4\xb1\x98\xd6\x1b\x5b\x9f\x5e\xd1" "\x26\x13\xf5\xa7\x45\xdf\xed\x51\xe4\xbf\x60\x1f\xd7\xb9\x95\x71\xf5\xd1" "\xb8\xf3\x9a\x26\x35\xfc\x6b\xcf\x59\xb9\xa2\x02\xfc\xbe\xc8\xaf\xf0\xb5" "\xc8\xb8\xd0\x53\x05\x22\x29\xe2\xce\xd3\x25\x6d\x73\xfa\x81\xda\x38\x41" "\xe0\xd2\x9c\x55\x30\xb2\xec\x28\x14\x65\xa7\xdb\x67\xfb\xf3\xdd\xa4\x3e" "\x21\x3b\xfa\xcc\xfb\xff\xb4\xb3\xaf\x6a\x5e\x97\x44\x0a\x15\x72\x27\x18" "\xf1\x9e\x1b\x27\x92\x17\x5c\x9b\x72\x91\xa3\xb0\x84\xf6\x91\x6d\xcf\x7a" "\xe7\x6d\x5f\xf9\x44\x6a\x43\x85\x21\x38\xaf\xa4\x34\x1c\x0c\x63\xea\x74" "\xb3\x2c\x03\x90\xb5\x7b\x88\x4f\x64\xca\x16\xb7\xc2\x9f\x2b\x15\x55\xd1" "\xb1\xce\x96\xc9\x8c\x7c\x4a\x4a\xc4\x1d\xfb\xa5\x8a\x20\xc2\xa6\xa9\x17" "\x00\x2e\xc0\x6b\x64\x90\x79\xb3\xa1\xb5\xd4\xcf\xd7\x26\x15\x18\x05\xd6" "\x39\xc5\xf5\xd1\xe1\xb2\xe1\x25\x14\xda\x9a\xe9\xf0\x40\x32\x2d\x10\x19" "\x1c\xc7\x81\x83\xfe\xd3\x61\x78\x2d\x0e\x24\xc7\x28\xee\x8d\x87\x1b\xba" "\x4b\xde\x6a\x90\xb8\xb3\xbe\xdb\xe0\x2b\x60\x2d\xf2\x37\x4f\xf0\xa6\x42" "\x71\x74\x0d\x29\x73\xe1\x70\xb3\x9a\x4e\x6d\xc7\xff\x41\x62\xca\xbb\xed" "\x8b\x05\x2c\xff\x98\x2c\x45\xd7\xa2\x0e\x16\xed\x04\x84\x68\xd6\x74\x3b" "\x26\xa9\x90\x20\x4e\xc2\x4f\xbc\xc6\xd7\xef\x20\x1c\x56\xf5\x6d\x7e\xb0" "\x82\x42\xd6\x28\x89\x83\x15\x39\xd8\xa8\xd7\x75\x4c\xa1\x5b\x25\xd8\x93" "\x97\xea\xbb\xc9\xa0\xdd\x98\x6e\x96\xc4\x68\xe0\x3b\xce\x32\x98\x73\x30" "\x65\xfd\x3a\x71\x19\x46\x36\x5f\x94\xed\xc0\xdc\xed\x9b\x8e\xe8\x2a\x71" "\x97\x98\xf8\x06\xda\x1e\xd8\x0a\x40\x8b\x68\x93\x98\xfa\x8c\x70\xe6\xd1" "\xd9\xe7\x8c\xb3\xc7\x28\x7b\xd5\x3a\x34\xcf\xb5\x39\xfc\xdb\x68\x1a\xb0" "\x72\x32\xe5\xd7\xd5\x01\x62\xbc\x46\x2b\xd4\x2b\xb1\xa2\xbb\xe4\xe0\xbb" "\xf5\x34\x42\x84\xa3\x0e\x23\x42\x23\x8d\x44\x47\x6f\xfa\x5f\xbb\x7e\xd0" "\x2c\x56\xbc\x02\xdc\xb7\x3a\xf0\xef\x47\x41\x47\x39\x6e\xc3\x9d\x3d\xf7" "\x49\x16\xcb\x6d\x61\x16\xf4\x41\x19\xdd\xed\x2a\xa0\x01\x55\x2c\xda\x94" "\x79\x5f\x52\x93\xb7\xc6\x24\x8f\x10\x52\x23\xb0\x77\xd4\xe7\x7b\xb7\x3b" "\x88\xc2\xaf\xab\x30\xfd\x55\xd7\xd7\xea\x5c\x94\xff\x2f\xbb\x05\x6c\xed" "\xbe\x67\x2b\x79\x9b\x27\x9a\xc6\x09\xfe\x04\x35\xc4\xef\x72\x5e\xa4\x63" "\xbf\x49\x70\xb5\xf5\x38\x88\x50\xd5\x65\xc5\x38\xfd\x2d\x24\x6e\x8c\xd3" "\x7e\x18\x96\xf3\x33\xc2\x47\x7b\xed\xf9\xbe\xe8\xa2\xcd\x24\x4e\xf3\x34" "\x5e\x4a\x38\xe4\x1a\xf7\x48\xff\x6b\xce\x4d\xe8\xe6\x4d\x25\x70\xaf\x5f" "\x28\x5c\x22\x43\xab\x58\x71\x75\x02\xab\xa1\x5e\xa0\x1d\x8e\xe3\xea\x20" "\xc0\xd6\xbe\x9e\xbf\x52\xd2\xb5\x6f\x2f\x65\x4f\x61\x7d\x1d\xdf\x7a\xd9" "\x7c\x95\x02\x60\xe2\xeb\x09\xf0\x61\x92\xfe\xf3\xbe\xe6\xf0\xe2\x42\xd3" "\xc8\x18\xc2\x7c\x57\x58\x26\xb2\xd8\x6e\x7c\x35\x5d\x21\x87\x33\x21\xc2" "\x6d\x51\xa1\x33\xa1\x2f\xb5\xc4\xe7\x43\x85\x2b\xe9\x98\x6e\x0a\x4f\xe0" "\x8b\x44\x92\x40\x06\x0a\x45\x49\xfb\xe3\x97\x7e\x6c\xb4\xfd\x4e\xf7\xeb" "\x97\xcd\xe3\x0a\x99\xea\x5f\x0a\x09\x17\x1f\xc8\xcb\x66\x82\x69\xc7\x5a" "\xbb\x33\x84\xdb\xc1\x1b\x99\x21\xc2\x4f\x63\x17\x5f\x32\xe6\x55\x96\x56" "\xb5\x99\x92\xbc\xa7\x6f\x1e\xe5\x0d\x85\xaf\xe9\x57\xd4\x97\x00\xfb\x9a" "\x97\x1d\x19\x9b\x98\x02\x37\xeb\xe3\x30\xf3\xfb\xc7\xd7\xdd\x7b\x65\x9c" "\xf7\x40\x8b\xec\x8c\xc5\x62\xf2\x9d\x81\xec\x2c\xbb\x0e\x62\x95\xf8\x48" "\x82\xb7\x38\x82\x85\x27\x1e\x25\x47\x5d\x6d\xb3\x15\x05\x63\x84\x5a\xd6" "\xee\x1e\x16\x60\xff\x45\x84\xcc\x5e\x9e\x68\xda\x3c\xff\xfd\xf2\xfe\x05" "\x21\x6d\xf8\x93\xf2\x31\xdd\x24\x03\x79\xa9\xfe\x12\xdb\xaf\x23\x51\x22" "\x22\x55\xad\x8b\x59\x5d\xab\x42\xe6\xd5\x87\x86\x88\x98\xc6\x51\xdd\xdd" "\x23\x6e\x3b\x09\x88\x83\x71\x9d\x8f\xc0\x66\xa9\xed\x13\xd2\xad\x46\x01" "\xc5\x5b\xd3\x5b\x25\x2b\x66\xbf\x94\x35\x7f\x2a\x1c\xf1\x55\x8e\x7d\xb6" "\x0c\xc0\xb0\x1f\xa3\x19\x4d\xe6\x6f\x72\xc7\xd5\xcd\x25\x9c\x4e\x06\x3e" "\xa5\x91\x90\x8e\xef\xb1\x9d\x74\xaf\x1c\x20\x56\x1e\xfe\x78\x34\x49\x11" "\xb7\x36\xfb\x45\xfa\x79\xa8\xed\xd0\x11\xe9\xbf\xd7\x1c\x15\xa5\x62\x0f" "\xe8\xe7\x4f\x21\x09\xfa\x20\x41\xd9\x77\xe2\x6f\x14\xfc\x7c\xa7\x26\x17" "\x94\x2e\x4b\x2b\xba\xa3\xe7\x86\x85\xee\xf3\x34\x88\xb7\x60\xc3\x6c\x5d" "\x88\x9f\x65\xfb\xbf\xec\x6f\x5a\x16\x25\x91\xa8\x21\x3c\xff\xeb\xe6\xad" "\x7e\x11\x2b\xf0\xce\x62\x72\xe0\x6b\xf9\x4e\x28\x35\x22\x1b\x3c\xab\x6d" "\x01\x5d\x57\xdd\x49\xed\xc6\x49\xa4\xf2\xd0\xc4\xeb\xe8\x2f\x09\x5c\x80" "\x89\x88\xde\x1b\xcd\xcf\x34\xfc\xc0\xc2\xae\x1c\x52\x19\x83\x78\x10\x3f" "\x4c\x32\x38\x72\xfe\x7a\xca\xbf\x95\xe1\xc3\x85\x54\xb6\xc9\xe1\x72\xc4" "\x9b\x4f\x18\x08\xfb\x04\x8a\x9f\x47\xda\xf9\x38\x32\xe2\x3a\x8f\x92\xb4" "\xb9\x22\x95\x32\xc0\x1c\x44\x69\x06\xc4\x9f\xbb\xb5\x31\xc1\xc2\x86\xe0" "\x21\xa7\xfa\xfa\x3f\x09\x1f\x58\x8c\x67\x48\x53\xc3\x45\xee\xb4\x11\x62" "\x78\x77\xa4\x2d\x6c\x40\x3e\x4c\x72\xe3\xfb\x33\x24\x25\xf3\x5d\xc8\xc8" "\xe5\xcf\x52\x9a\xc1\x99\x93\x23\x58\x8a\x2e\x20\x08\xfe\x43", 2697); *(uint64_t*)0x20000048 = 0xa89; *(uint64_t*)0x20005718 = 1; *(uint64_t*)0x20005720 = 0; *(uint64_t*)0x20005728 = 0; *(uint32_t*)0x20005730 = 0; *(uint32_t*)0x20005738 = 0; syscall(__NR_sendmmsg, r[0], 0x20005700ul, 1ul, 0x4044840ul); *(uint8_t*)0x20000f00 = 0x7f; *(uint8_t*)0x20000f01 = 0x45; *(uint8_t*)0x20000f02 = 0x4c; *(uint8_t*)0x20000f03 = 0x46; *(uint8_t*)0x20000f04 = 0; *(uint8_t*)0x20000f05 = 0; *(uint8_t*)0x20000f06 = 0; *(uint8_t*)0x20000f07 = 0; *(uint64_t*)0x20000f08 = 0; *(uint16_t*)0x20000f10 = 0; *(uint16_t*)0x20000f12 = 0; *(uint32_t*)0x20000f14 = 0; *(uint64_t*)0x20000f18 = 0; *(uint64_t*)0x20000f20 = 0x40; *(uint64_t*)0x20000f28 = 0; *(uint32_t*)0x20000f30 = 0; *(uint16_t*)0x20000f34 = 0; *(uint16_t*)0x20000f36 = 0x38; *(uint16_t*)0x20000f38 = 0; *(uint16_t*)0x20000f3a = 0; *(uint16_t*)0x20000f3c = 0; *(uint16_t*)0x20000f3e = 0; *(uint32_t*)0x20000f40 = 0; *(uint32_t*)0x20000f44 = 0; *(uint64_t*)0x20000f48 = 0; *(uint64_t*)0x20000f50 = 0; *(uint64_t*)0x20000f58 = 0; *(uint64_t*)0x20000f60 = 0; *(uint64_t*)0x20000f68 = 0; *(uint64_t*)0x20000f70 = 0; syscall(__NR_write, r[0], 0x20000f00ul, 0x78ul); } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); for (procid = 0; procid < 6; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; }