// https://syzkaller.appspot.com/bug?id=9a331870806c3441070b5526561a5f81fe70acbd // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_sendto #define __NR_sendto 369 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 0x3, 0x32, 0xffffffff, 0x0); r[0] = syscall(__NR_socket, 0x2, 0x2, 0x0); *(uint32_t*)0x20000000 = htobe32(0x80000000); *(uint8_t*)0x20000010 = 0xac; *(uint8_t*)0x20000011 = 0x14; *(uint8_t*)0x20000012 = 0x0; *(uint8_t*)0x20000013 = 0xbb; *(uint16_t*)0x20000020 = htobe16(0x4e20); *(uint16_t*)0x20000022 = 0x0; *(uint16_t*)0x20000024 = htobe16(0x4e21); *(uint16_t*)0x20000026 = 0x0; *(uint16_t*)0x20000028 = 0x2; *(uint8_t*)0x2000002a = 0x0; *(uint8_t*)0x2000002b = 0x0; *(uint8_t*)0x2000002c = 0x0; *(uint32_t*)0x20000030 = 0x0; *(uint32_t*)0x20000034 = 0x0; *(uint64_t*)0x20000038 = 0x0; *(uint64_t*)0x20000040 = 0x0; *(uint64_t*)0x20000048 = 0x4; *(uint64_t*)0x20000050 = 0x0; *(uint64_t*)0x20000058 = 0x0; *(uint64_t*)0x20000060 = 0x0; *(uint64_t*)0x20000068 = 0x0; *(uint64_t*)0x20000070 = 0x0; *(uint64_t*)0x20000078 = 0x0; *(uint64_t*)0x20000080 = 0x0; *(uint64_t*)0x20000088 = 0x3; *(uint64_t*)0x20000090 = 0x0; *(uint32_t*)0x20000098 = 0x0; *(uint32_t*)0x2000009c = 0x1; *(uint8_t*)0x200000a0 = 0x1; *(uint8_t*)0x200000a1 = 0x0; *(uint8_t*)0x200000a2 = 0x0; *(uint8_t*)0x200000a3 = 0x0; *(uint32_t*)0x200000a8 = htobe32(0x1); *(uint32_t*)0x200000b8 = 0xfffffffe; *(uint8_t*)0x200000bc = 0x0; *(uint16_t*)0x200000c0 = 0xa; *(uint32_t*)0x200000c4 = htobe32(0x7f000001); *(uint32_t*)0x200000d4 = 0x0; *(uint8_t*)0x200000d8 = 0x0; *(uint8_t*)0x200000d9 = 0x0; *(uint8_t*)0x200000da = 0x0; *(uint32_t*)0x200000dc = 0x0; *(uint32_t*)0x200000e0 = 0x2; *(uint32_t*)0x200000e4 = 0x0; syscall(__NR_setsockopt, r[0], 0x0, 0x11, 0x20000000, 0xe8); *(uint16_t*)0x202f9000 = 0x2; *(uint16_t*)0x202f9002 = htobe16(0x4e20); *(uint32_t*)0x202f9004 = htobe32(0x0); *(uint8_t*)0x202f9008 = 0x0; *(uint8_t*)0x202f9009 = 0x0; *(uint8_t*)0x202f900a = 0x0; *(uint8_t*)0x202f900b = 0x0; *(uint8_t*)0x202f900c = 0x0; *(uint8_t*)0x202f900d = 0x0; *(uint8_t*)0x202f900e = 0x0; *(uint8_t*)0x202f900f = 0x0; syscall(__NR_sendto, r[0], 0x2010affe, 0x0, 0x2004487c, 0x202f9000, 0x10); } int main() { loop(); return 0; }