// https://syzkaller.appspot.com/bug?id=5b9d1e3232dc19d61832a76821bc5fc9b914b4cd // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include __attribute__((noreturn)) static void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } } #include #include const int kFailStatus = 67; const int kRetryStatus = 69; static void fail(const char* msg, ...) { int e = errno; va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus); } static uint64_t current_time_ms() { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) fail("clock_gettime failed"); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define XT_TABLE_SIZE 1536 #define XT_MAX_ENTRIES 10 struct xt_counters { uint64_t pcnt, bcnt; }; struct ipt_getinfo { char name[32]; unsigned int valid_hooks; unsigned int hook_entry[5]; unsigned int underflow[5]; unsigned int num_entries; unsigned int size; }; struct ipt_get_entries { char name[32]; unsigned int size; void* entrytable[XT_TABLE_SIZE / sizeof(void*)]; }; struct ipt_replace { char name[32]; unsigned int valid_hooks; unsigned int num_entries; unsigned int size; unsigned int hook_entry[5]; unsigned int underflow[5]; unsigned int num_counters; struct xt_counters* counters; char entrytable[XT_TABLE_SIZE]; }; struct ipt_table_desc { const char* name; struct ipt_getinfo info; struct ipt_replace replace; }; static struct ipt_table_desc ipv4_tables[] = { {.name = "filter"}, {.name = "nat"}, {.name = "mangle"}, {.name = "raw"}, {.name = "security"}, }; static struct ipt_table_desc ipv6_tables[] = { {.name = "filter"}, {.name = "nat"}, {.name = "mangle"}, {.name = "raw"}, {.name = "security"}, }; #define IPT_BASE_CTL 64 #define IPT_SO_SET_REPLACE (IPT_BASE_CTL) #define IPT_SO_GET_INFO (IPT_BASE_CTL) #define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1) struct arpt_getinfo { char name[32]; unsigned int valid_hooks; unsigned int hook_entry[3]; unsigned int underflow[3]; unsigned int num_entries; unsigned int size; }; struct arpt_get_entries { char name[32]; unsigned int size; void* entrytable[XT_TABLE_SIZE / sizeof(void*)]; }; struct arpt_replace { char name[32]; unsigned int valid_hooks; unsigned int num_entries; unsigned int size; unsigned int hook_entry[3]; unsigned int underflow[3]; unsigned int num_counters; struct xt_counters* counters; char entrytable[XT_TABLE_SIZE]; }; struct arpt_table_desc { const char* name; struct arpt_getinfo info; struct arpt_replace replace; }; static struct arpt_table_desc arpt_tables[] = { {.name = "filter"}, }; #define ARPT_BASE_CTL 96 #define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL) #define ARPT_SO_GET_INFO (ARPT_BASE_CTL) #define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1) static void checkpoint_iptables(struct ipt_table_desc* tables, int num_tables, int family, int level) { struct ipt_get_entries entries; socklen_t optlen; int fd, i; fd = socket(family, SOCK_STREAM, IPPROTO_TCP); if (fd == -1) fail("socket(%d, SOCK_STREAM, IPPROTO_TCP)", family); for (i = 0; i < num_tables; i++) { struct ipt_table_desc* table = &tables[i]; strcpy(table->info.name, table->name); strcpy(table->replace.name, table->name); optlen = sizeof(table->info); if (getsockopt(fd, level, IPT_SO_GET_INFO, &table->info, &optlen)) { switch (errno) { case EPERM: case ENOENT: case ENOPROTOOPT: continue; } fail("getsockopt(IPT_SO_GET_INFO)"); } if (table->info.size > sizeof(table->replace.entrytable)) fail("table size is too large: %u", table->info.size); if (table->info.num_entries > XT_MAX_ENTRIES) fail("too many counters: %u", table->info.num_entries); memset(&entries, 0, sizeof(entries)); strcpy(entries.name, table->name); entries.size = table->info.size; optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size; if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen)) fail("getsockopt(IPT_SO_GET_ENTRIES)"); table->replace.valid_hooks = table->info.valid_hooks; table->replace.num_entries = table->info.num_entries; table->replace.size = table->info.size; memcpy(table->replace.hook_entry, table->info.hook_entry, sizeof(table->replace.hook_entry)); memcpy(table->replace.underflow, table->info.underflow, sizeof(table->replace.underflow)); memcpy(table->replace.entrytable, entries.entrytable, table->info.size); } close(fd); } static void reset_iptables(struct ipt_table_desc* tables, int num_tables, int family, int level) { struct xt_counters counters[XT_MAX_ENTRIES]; struct ipt_get_entries entries; struct ipt_getinfo info; socklen_t optlen; int fd, i; fd = socket(family, SOCK_STREAM, IPPROTO_TCP); if (fd == -1) fail("socket(%d, SOCK_STREAM, IPPROTO_TCP)", family); for (i = 0; i < num_tables; i++) { struct ipt_table_desc* table = &tables[i]; if (table->info.valid_hooks == 0) continue; memset(&info, 0, sizeof(info)); strcpy(info.name, table->name); optlen = sizeof(info); if (getsockopt(fd, level, IPT_SO_GET_INFO, &info, &optlen)) fail("getsockopt(IPT_SO_GET_INFO)"); if (memcmp(&table->info, &info, sizeof(table->info)) == 0) { memset(&entries, 0, sizeof(entries)); strcpy(entries.name, table->name); entries.size = table->info.size; optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size; if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen)) fail("getsockopt(IPT_SO_GET_ENTRIES)"); if (memcmp(table->replace.entrytable, entries.entrytable, table->info.size) == 0) continue; } table->replace.num_counters = info.num_entries; table->replace.counters = counters; optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) + table->replace.size; if (setsockopt(fd, level, IPT_SO_SET_REPLACE, &table->replace, optlen)) fail("setsockopt(IPT_SO_SET_REPLACE)"); } close(fd); } static void checkpoint_arptables(void) { struct arpt_get_entries entries; socklen_t optlen; unsigned i; int fd; fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (fd == -1) fail("socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)"); for (i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) { struct arpt_table_desc* table = &arpt_tables[i]; strcpy(table->info.name, table->name); strcpy(table->replace.name, table->name); optlen = sizeof(table->info); if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &table->info, &optlen)) { switch (errno) { case EPERM: case ENOENT: case ENOPROTOOPT: continue; } fail("getsockopt(ARPT_SO_GET_INFO)"); } if (table->info.size > sizeof(table->replace.entrytable)) fail("table size is too large: %u", table->info.size); if (table->info.num_entries > XT_MAX_ENTRIES) fail("too many counters: %u", table->info.num_entries); memset(&entries, 0, sizeof(entries)); strcpy(entries.name, table->name); entries.size = table->info.size; optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size; if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen)) fail("getsockopt(ARPT_SO_GET_ENTRIES)"); table->replace.valid_hooks = table->info.valid_hooks; table->replace.num_entries = table->info.num_entries; table->replace.size = table->info.size; memcpy(table->replace.hook_entry, table->info.hook_entry, sizeof(table->replace.hook_entry)); memcpy(table->replace.underflow, table->info.underflow, sizeof(table->replace.underflow)); memcpy(table->replace.entrytable, entries.entrytable, table->info.size); } close(fd); } static void reset_arptables() { struct xt_counters counters[XT_MAX_ENTRIES]; struct arpt_get_entries entries; struct arpt_getinfo info; socklen_t optlen; unsigned i; int fd; fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (fd == -1) fail("socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)"); for (i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) { struct arpt_table_desc* table = &arpt_tables[i]; if (table->info.valid_hooks == 0) continue; memset(&info, 0, sizeof(info)); strcpy(info.name, table->name); optlen = sizeof(info); if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &info, &optlen)) fail("getsockopt(ARPT_SO_GET_INFO)"); if (memcmp(&table->info, &info, sizeof(table->info)) == 0) { memset(&entries, 0, sizeof(entries)); strcpy(entries.name, table->name); entries.size = table->info.size; optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size; if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen)) fail("getsockopt(ARPT_SO_GET_ENTRIES)"); if (memcmp(table->replace.entrytable, entries.entrytable, table->info.size) == 0) continue; } table->replace.num_counters = info.num_entries; table->replace.counters = counters; optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) + table->replace.size; if (setsockopt(fd, SOL_IP, ARPT_SO_SET_REPLACE, &table->replace, optlen)) fail("setsockopt(ARPT_SO_SET_REPLACE)"); } close(fd); } static void checkpoint_net_namespace(void) { checkpoint_arptables(); checkpoint_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]), AF_INET, SOL_IP); checkpoint_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]), AF_INET6, SOL_IPV6); } static void reset_net_namespace(void) { reset_arptables(); reset_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]), AF_INET, SOL_IP); reset_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]), AF_INET6, SOL_IPV6); } static void test(); void loop() { int iter; checkpoint_net_namespace(); for (iter = 0;; iter++) { int pid = fork(); if (pid < 0) fail("loop fork failed"); if (pid == 0) { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); test(); doexit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { int res = waitpid(-1, &status, __WALL | WNOHANG); if (res == pid) break; usleep(1000); if (current_time_ms() - start > 5 * 1000) { kill(-pid, SIGKILL); kill(pid, SIGKILL); while (waitpid(-1, &status, __WALL) != pid) { } break; } } reset_net_namespace(); } } long r[2]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0x28000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0xa, 5, 0); *(uint32_t*)0x2000c000 = -1; *(uint16_t*)0x2000c008 = 0xa; *(uint16_t*)0x2000c00a = htobe16(0x4e20); *(uint32_t*)0x2000c00c = 0x8000; *(uint8_t*)0x2000c010 = -1; *(uint8_t*)0x2000c011 = 1; *(uint8_t*)0x2000c012 = 0; *(uint8_t*)0x2000c013 = 0; *(uint8_t*)0x2000c014 = 0; *(uint8_t*)0x2000c015 = 0; *(uint8_t*)0x2000c016 = 0; *(uint8_t*)0x2000c017 = 0; *(uint8_t*)0x2000c018 = 0; *(uint8_t*)0x2000c019 = 0; *(uint8_t*)0x2000c01a = 0; *(uint8_t*)0x2000c01b = 0; *(uint8_t*)0x2000c01c = 0; *(uint8_t*)0x2000c01d = 0; *(uint8_t*)0x2000c01e = 0; *(uint8_t*)0x2000c01f = 1; *(uint32_t*)0x2000c020 = 0x8d0; *(uint64_t*)0x2000c028 = 0; *(uint64_t*)0x2000c030 = 0; *(uint64_t*)0x2000c038 = 0; *(uint64_t*)0x2000c040 = 0; *(uint64_t*)0x2000c048 = 0; *(uint64_t*)0x2000c050 = 0; *(uint64_t*)0x2000c058 = 0; *(uint64_t*)0x2000c060 = 0; *(uint64_t*)0x2000c068 = 0; *(uint64_t*)0x2000c070 = 0; *(uint64_t*)0x2000c078 = 0; *(uint64_t*)0x2000c080 = 0; syscall(__NR_setsockopt, r[0], 0x29, 0x2a, 0x2000c000, 0x88); r[1] = syscall(__NR_socket, 0xa, 0x801, 0); memcpy((void*)0x20014c40, "\x66\x69\x6c\x74\x65\x72\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint32_t*)0x20014c60 = 0xe; *(uint32_t*)0x20014c64 = 4; *(uint32_t*)0x20014c68 = 0x360; *(uint32_t*)0x20014c6c = -1; *(uint32_t*)0x20014c70 = 0; *(uint32_t*)0x20014c74 = 0x1c0; *(uint32_t*)0x20014c78 = 0; *(uint32_t*)0x20014c7c = -1; *(uint32_t*)0x20014c80 = -1; *(uint32_t*)0x20014c84 = 0x290; *(uint32_t*)0x20014c88 = 0x290; *(uint32_t*)0x20014c8c = 0x290; *(uint32_t*)0x20014c90 = -1; *(uint32_t*)0x20014c94 = 4; *(uint64_t*)0x20014c98 = 0x2000bfc0; *(uint8_t*)0x20014ca0 = 0; *(uint8_t*)0x20014ca1 = 0; *(uint8_t*)0x20014ca2 = 0; *(uint8_t*)0x20014ca3 = 0; *(uint8_t*)0x20014ca4 = 0; *(uint8_t*)0x20014ca5 = 0; *(uint8_t*)0x20014ca6 = 0; *(uint8_t*)0x20014ca7 = 0; *(uint8_t*)0x20014ca8 = 0; *(uint8_t*)0x20014ca9 = 0; *(uint8_t*)0x20014caa = 0; *(uint8_t*)0x20014cab = 0; *(uint8_t*)0x20014cac = 0; *(uint8_t*)0x20014cad = 0; *(uint8_t*)0x20014cae = 0; *(uint8_t*)0x20014caf = 0; *(uint8_t*)0x20014cb0 = 0; *(uint8_t*)0x20014cb1 = 0; *(uint8_t*)0x20014cb2 = 0; *(uint8_t*)0x20014cb3 = 0; *(uint8_t*)0x20014cb4 = 0; *(uint8_t*)0x20014cb5 = 0; *(uint8_t*)0x20014cb6 = 0; *(uint8_t*)0x20014cb7 = 0; *(uint8_t*)0x20014cb8 = 0; *(uint8_t*)0x20014cb9 = 0; *(uint8_t*)0x20014cba = 0; *(uint8_t*)0x20014cbb = 0; *(uint8_t*)0x20014cbc = 0; *(uint8_t*)0x20014cbd = 0; *(uint8_t*)0x20014cbe = 0; *(uint8_t*)0x20014cbf = 0; *(uint8_t*)0x20014cc0 = 0; *(uint8_t*)0x20014cc1 = 0; *(uint8_t*)0x20014cc2 = 0; *(uint8_t*)0x20014cc3 = 0; *(uint8_t*)0x20014cc4 = 0; *(uint8_t*)0x20014cc5 = 0; *(uint8_t*)0x20014cc6 = 0; *(uint8_t*)0x20014cc7 = 0; *(uint8_t*)0x20014cc8 = 0; *(uint8_t*)0x20014cc9 = 0; *(uint8_t*)0x20014cca = 0; *(uint8_t*)0x20014ccb = 0; *(uint8_t*)0x20014ccc = 0; *(uint8_t*)0x20014ccd = 0; *(uint8_t*)0x20014cce = 0; *(uint8_t*)0x20014ccf = 0; *(uint8_t*)0x20014cd0 = 0; *(uint8_t*)0x20014cd1 = 0; *(uint8_t*)0x20014cd2 = 0; *(uint8_t*)0x20014cd3 = 0; *(uint8_t*)0x20014cd4 = 0; *(uint8_t*)0x20014cd5 = 0; *(uint8_t*)0x20014cd6 = 0; *(uint8_t*)0x20014cd7 = 0; *(uint8_t*)0x20014cd8 = 0; *(uint8_t*)0x20014cd9 = 0; *(uint8_t*)0x20014cda = 0; *(uint8_t*)0x20014cdb = 0; *(uint8_t*)0x20014cdc = 0; *(uint8_t*)0x20014cdd = 0; *(uint8_t*)0x20014cde = 0; *(uint8_t*)0x20014cdf = 0; *(uint8_t*)0x20014ce0 = 0; *(uint8_t*)0x20014ce1 = 0; *(uint8_t*)0x20014ce2 = 0; *(uint8_t*)0x20014ce3 = 0; *(uint8_t*)0x20014ce4 = 0; *(uint8_t*)0x20014ce5 = 0; *(uint8_t*)0x20014ce6 = 0; *(uint8_t*)0x20014ce7 = 0; *(uint8_t*)0x20014ce8 = 0; *(uint8_t*)0x20014ce9 = 0; *(uint8_t*)0x20014cea = 0; *(uint8_t*)0x20014ceb = 0; *(uint8_t*)0x20014cec = 0; *(uint8_t*)0x20014ced = 0; *(uint8_t*)0x20014cee = 0; *(uint8_t*)0x20014cef = 0; *(uint8_t*)0x20014cf0 = 0; *(uint8_t*)0x20014cf1 = 0; *(uint8_t*)0x20014cf2 = 0; *(uint8_t*)0x20014cf3 = 0; *(uint8_t*)0x20014cf4 = 0; *(uint8_t*)0x20014cf5 = 0; *(uint8_t*)0x20014cf6 = 0; *(uint8_t*)0x20014cf7 = 0; *(uint8_t*)0x20014cf8 = 0; *(uint8_t*)0x20014cf9 = 0; *(uint8_t*)0x20014cfa = 0; *(uint8_t*)0x20014cfb = 0; *(uint8_t*)0x20014cfc = 0; *(uint8_t*)0x20014cfd = 0; *(uint8_t*)0x20014cfe = 0; *(uint8_t*)0x20014cff = 0; *(uint8_t*)0x20014d00 = 0; *(uint8_t*)0x20014d01 = 0; *(uint8_t*)0x20014d02 = 0; *(uint8_t*)0x20014d03 = 0; *(uint8_t*)0x20014d04 = 0; *(uint8_t*)0x20014d05 = 0; *(uint8_t*)0x20014d06 = 0; *(uint8_t*)0x20014d07 = 0; *(uint8_t*)0x20014d08 = 0; *(uint8_t*)0x20014d09 = 0; *(uint8_t*)0x20014d0a = 0; *(uint8_t*)0x20014d0b = 0; *(uint8_t*)0x20014d0c = 0; *(uint8_t*)0x20014d0d = 0; *(uint8_t*)0x20014d0e = 0; *(uint8_t*)0x20014d0f = 0; *(uint8_t*)0x20014d10 = 0; *(uint8_t*)0x20014d11 = 0; *(uint8_t*)0x20014d12 = 0; *(uint8_t*)0x20014d13 = 0; *(uint8_t*)0x20014d14 = 0; *(uint8_t*)0x20014d15 = 0; *(uint8_t*)0x20014d16 = 0; *(uint8_t*)0x20014d17 = 0; *(uint8_t*)0x20014d18 = 0; *(uint8_t*)0x20014d19 = 0; *(uint8_t*)0x20014d1a = 0; *(uint8_t*)0x20014d1b = 0; *(uint8_t*)0x20014d1c = 0; *(uint8_t*)0x20014d1d = 0; *(uint8_t*)0x20014d1e = 0; *(uint8_t*)0x20014d1f = 0; *(uint8_t*)0x20014d20 = 0; *(uint8_t*)0x20014d21 = 0; *(uint8_t*)0x20014d22 = 0; *(uint8_t*)0x20014d23 = 0; *(uint8_t*)0x20014d24 = 0; *(uint8_t*)0x20014d25 = 0; *(uint8_t*)0x20014d26 = 0; *(uint8_t*)0x20014d27 = 0; *(uint32_t*)0x20014d28 = 0; *(uint16_t*)0x20014d2c = 0xa8; *(uint16_t*)0x20014d2e = 0xf0; *(uint32_t*)0x20014d30 = 0; *(uint64_t*)0x20014d38 = 0; *(uint64_t*)0x20014d40 = 0; *(uint16_t*)0x20014d48 = 0x48; memcpy((void*)0x20014d4a, "\x54\x45\x45\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014d67 = 1; *(uint32_t*)0x20014d68 = htobe32(-1); *(uint8_t*)0x20014d78 = 0x73; *(uint8_t*)0x20014d79 = 0x79; *(uint8_t*)0x20014d7a = 0x7a; *(uint8_t*)0x20014d7b = 0x30; *(uint8_t*)0x20014d7c = 0; *(uint64_t*)0x20014d88 = 0; *(uint8_t*)0x20014d90 = 0; *(uint8_t*)0x20014d91 = 0; *(uint8_t*)0x20014d92 = 0; *(uint8_t*)0x20014d93 = 0; *(uint8_t*)0x20014d94 = 0; *(uint8_t*)0x20014d95 = 0; *(uint8_t*)0x20014d96 = 0; *(uint8_t*)0x20014d97 = 0; *(uint8_t*)0x20014d98 = 0; *(uint8_t*)0x20014d99 = 0; *(uint8_t*)0x20014d9a = 0; *(uint8_t*)0x20014d9b = 0; *(uint8_t*)0x20014d9c = 0; *(uint8_t*)0x20014d9d = 0; *(uint8_t*)0x20014d9e = 0; *(uint8_t*)0x20014d9f = 0; *(uint8_t*)0x20014da0 = 0; *(uint8_t*)0x20014da1 = 0; *(uint8_t*)0x20014da2 = 0; *(uint8_t*)0x20014da3 = 0; *(uint8_t*)0x20014da4 = 0; *(uint8_t*)0x20014da5 = 0; *(uint8_t*)0x20014da6 = 0; *(uint8_t*)0x20014da7 = 0; *(uint8_t*)0x20014da8 = 0; *(uint8_t*)0x20014da9 = 0; *(uint8_t*)0x20014daa = 0; *(uint8_t*)0x20014dab = 0; *(uint8_t*)0x20014dac = 0; *(uint8_t*)0x20014dad = 0; *(uint8_t*)0x20014dae = 0; *(uint8_t*)0x20014daf = 0; *(uint8_t*)0x20014db0 = 0; *(uint8_t*)0x20014db1 = 0; *(uint8_t*)0x20014db2 = 0; *(uint8_t*)0x20014db3 = 0; *(uint8_t*)0x20014db4 = 0; *(uint8_t*)0x20014db5 = 0; *(uint8_t*)0x20014db6 = 0; *(uint8_t*)0x20014db7 = 0; *(uint8_t*)0x20014db8 = 0; *(uint8_t*)0x20014db9 = 0; *(uint8_t*)0x20014dba = 0; *(uint8_t*)0x20014dbb = 0; *(uint8_t*)0x20014dbc = 0; *(uint8_t*)0x20014dbd = 0; *(uint8_t*)0x20014dbe = 0; *(uint8_t*)0x20014dbf = 0; *(uint8_t*)0x20014dc0 = 0; *(uint8_t*)0x20014dc1 = 0; *(uint8_t*)0x20014dc2 = 0; *(uint8_t*)0x20014dc3 = 0; *(uint8_t*)0x20014dc4 = 0; *(uint8_t*)0x20014dc5 = 0; *(uint8_t*)0x20014dc6 = 0; *(uint8_t*)0x20014dc7 = 0; *(uint8_t*)0x20014dc8 = 0; *(uint8_t*)0x20014dc9 = 0; *(uint8_t*)0x20014dca = 0; *(uint8_t*)0x20014dcb = 0; *(uint8_t*)0x20014dcc = 0; *(uint8_t*)0x20014dcd = 0; *(uint8_t*)0x20014dce = 0; *(uint8_t*)0x20014dcf = 0; *(uint8_t*)0x20014dd0 = 0; *(uint8_t*)0x20014dd1 = 0; *(uint8_t*)0x20014dd2 = 0; *(uint8_t*)0x20014dd3 = 0; *(uint8_t*)0x20014dd4 = 0; *(uint8_t*)0x20014dd5 = 0; *(uint8_t*)0x20014dd6 = 0; *(uint8_t*)0x20014dd7 = 0; *(uint8_t*)0x20014dd8 = 0; *(uint8_t*)0x20014dd9 = 0; *(uint8_t*)0x20014dda = 0; *(uint8_t*)0x20014ddb = 0; *(uint8_t*)0x20014ddc = 0; *(uint8_t*)0x20014ddd = 0; *(uint8_t*)0x20014dde = 0; *(uint8_t*)0x20014ddf = 0; *(uint8_t*)0x20014de0 = 0; *(uint8_t*)0x20014de1 = 0; *(uint8_t*)0x20014de2 = 0; *(uint8_t*)0x20014de3 = 0; *(uint8_t*)0x20014de4 = 0; *(uint8_t*)0x20014de5 = 0; *(uint8_t*)0x20014de6 = 0; *(uint8_t*)0x20014de7 = 0; *(uint8_t*)0x20014de8 = 0; *(uint8_t*)0x20014de9 = 0; *(uint8_t*)0x20014dea = 0; *(uint8_t*)0x20014deb = 0; *(uint8_t*)0x20014dec = 0; *(uint8_t*)0x20014ded = 0; *(uint8_t*)0x20014dee = 0; *(uint8_t*)0x20014def = 0; *(uint8_t*)0x20014df0 = 0; *(uint8_t*)0x20014df1 = 0; *(uint8_t*)0x20014df2 = 0; *(uint8_t*)0x20014df3 = 0; *(uint8_t*)0x20014df4 = 0; *(uint8_t*)0x20014df5 = 0; *(uint8_t*)0x20014df6 = 0; *(uint8_t*)0x20014df7 = 0; *(uint8_t*)0x20014df8 = 0; *(uint8_t*)0x20014df9 = 0; *(uint8_t*)0x20014dfa = 0; *(uint8_t*)0x20014dfb = 0; *(uint8_t*)0x20014dfc = 0; *(uint8_t*)0x20014dfd = 0; *(uint8_t*)0x20014dfe = 0; *(uint8_t*)0x20014dff = 0; *(uint8_t*)0x20014e00 = 0; *(uint8_t*)0x20014e01 = 0; *(uint8_t*)0x20014e02 = 0; *(uint8_t*)0x20014e03 = 0; *(uint8_t*)0x20014e04 = 0; *(uint8_t*)0x20014e05 = 0; *(uint8_t*)0x20014e06 = 0; *(uint8_t*)0x20014e07 = 0; *(uint8_t*)0x20014e08 = 0; *(uint8_t*)0x20014e09 = 0; *(uint8_t*)0x20014e0a = 0; *(uint8_t*)0x20014e0b = 0; *(uint8_t*)0x20014e0c = 0; *(uint8_t*)0x20014e0d = 0; *(uint8_t*)0x20014e0e = 0; *(uint8_t*)0x20014e0f = 0; *(uint8_t*)0x20014e10 = 0; *(uint8_t*)0x20014e11 = 0; *(uint8_t*)0x20014e12 = 0; *(uint8_t*)0x20014e13 = 0; *(uint8_t*)0x20014e14 = 0; *(uint8_t*)0x20014e15 = 0; *(uint8_t*)0x20014e16 = 0; *(uint8_t*)0x20014e17 = 0; *(uint32_t*)0x20014e18 = 0; *(uint16_t*)0x20014e1c = 0xa8; *(uint16_t*)0x20014e1e = 0xd0; *(uint32_t*)0x20014e20 = 0; *(uint64_t*)0x20014e28 = 0; *(uint64_t*)0x20014e30 = 0; *(uint16_t*)0x20014e38 = 0x28; memcpy((void*)0x20014e3a, "\x4e\x46\x51\x55\x45\x55\x45\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014e57 = 3; *(uint16_t*)0x20014e58 = 0; *(uint16_t*)0x20014e5a = 0x71; *(uint16_t*)0x20014e5c = 0; *(uint8_t*)0x20014e60 = 0; *(uint8_t*)0x20014e61 = 0; *(uint8_t*)0x20014e62 = 0; *(uint8_t*)0x20014e63 = 0; *(uint8_t*)0x20014e64 = 0; *(uint8_t*)0x20014e65 = 0; *(uint8_t*)0x20014e66 = 0; *(uint8_t*)0x20014e67 = 0; *(uint8_t*)0x20014e68 = 0; *(uint8_t*)0x20014e69 = 0; *(uint8_t*)0x20014e6a = 0; *(uint8_t*)0x20014e6b = 0; *(uint8_t*)0x20014e6c = 0; *(uint8_t*)0x20014e6d = 0; *(uint8_t*)0x20014e6e = 0; *(uint8_t*)0x20014e6f = 0; *(uint8_t*)0x20014e70 = 0; *(uint8_t*)0x20014e71 = 0; *(uint8_t*)0x20014e72 = 0; *(uint8_t*)0x20014e73 = 0; *(uint8_t*)0x20014e74 = 0; *(uint8_t*)0x20014e75 = 0; *(uint8_t*)0x20014e76 = 0; *(uint8_t*)0x20014e77 = 0; *(uint8_t*)0x20014e78 = 0; *(uint8_t*)0x20014e79 = 0; *(uint8_t*)0x20014e7a = 0; *(uint8_t*)0x20014e7b = 0; *(uint8_t*)0x20014e7c = 0; *(uint8_t*)0x20014e7d = 0; *(uint8_t*)0x20014e7e = 0; *(uint8_t*)0x20014e7f = 0; *(uint8_t*)0x20014e80 = 0; *(uint8_t*)0x20014e81 = 0; *(uint8_t*)0x20014e82 = 0; *(uint8_t*)0x20014e83 = 0; *(uint8_t*)0x20014e84 = 0; *(uint8_t*)0x20014e85 = 0; *(uint8_t*)0x20014e86 = 0; *(uint8_t*)0x20014e87 = 0; *(uint8_t*)0x20014e88 = 0; *(uint8_t*)0x20014e89 = 0; *(uint8_t*)0x20014e8a = 0; *(uint8_t*)0x20014e8b = 0; *(uint8_t*)0x20014e8c = 0; *(uint8_t*)0x20014e8d = 0; *(uint8_t*)0x20014e8e = 0; *(uint8_t*)0x20014e8f = 0; *(uint8_t*)0x20014e90 = 0; *(uint8_t*)0x20014e91 = 0; *(uint8_t*)0x20014e92 = 0; *(uint8_t*)0x20014e93 = 0; *(uint8_t*)0x20014e94 = 0; *(uint8_t*)0x20014e95 = 0; *(uint8_t*)0x20014e96 = 0; *(uint8_t*)0x20014e97 = 0; *(uint8_t*)0x20014e98 = 0; *(uint8_t*)0x20014e99 = 0; *(uint8_t*)0x20014e9a = 0; *(uint8_t*)0x20014e9b = 0; *(uint8_t*)0x20014e9c = 0; *(uint8_t*)0x20014e9d = 0; *(uint8_t*)0x20014e9e = 0; *(uint8_t*)0x20014e9f = 0; *(uint8_t*)0x20014ea0 = 0; *(uint8_t*)0x20014ea1 = 0; *(uint8_t*)0x20014ea2 = 0; *(uint8_t*)0x20014ea3 = 0; *(uint8_t*)0x20014ea4 = 0; *(uint8_t*)0x20014ea5 = 0; *(uint8_t*)0x20014ea6 = 0; *(uint8_t*)0x20014ea7 = 0; *(uint8_t*)0x20014ea8 = 0; *(uint8_t*)0x20014ea9 = 0; *(uint8_t*)0x20014eaa = 0; *(uint8_t*)0x20014eab = 0; *(uint8_t*)0x20014eac = 0; *(uint8_t*)0x20014ead = 0; *(uint8_t*)0x20014eae = 0; *(uint8_t*)0x20014eaf = 0; *(uint8_t*)0x20014eb0 = 0; *(uint8_t*)0x20014eb1 = 0; *(uint8_t*)0x20014eb2 = 0; *(uint8_t*)0x20014eb3 = 0; *(uint8_t*)0x20014eb4 = 0; *(uint8_t*)0x20014eb5 = 0; *(uint8_t*)0x20014eb6 = 0; *(uint8_t*)0x20014eb7 = 0; *(uint8_t*)0x20014eb8 = 0; *(uint8_t*)0x20014eb9 = 0; *(uint8_t*)0x20014eba = 0; *(uint8_t*)0x20014ebb = 0; *(uint8_t*)0x20014ebc = 0; *(uint8_t*)0x20014ebd = 0; *(uint8_t*)0x20014ebe = 0; *(uint8_t*)0x20014ebf = 0; *(uint8_t*)0x20014ec0 = 0; *(uint8_t*)0x20014ec1 = 0; *(uint8_t*)0x20014ec2 = 0; *(uint8_t*)0x20014ec3 = 0; *(uint8_t*)0x20014ec4 = 0; *(uint8_t*)0x20014ec5 = 0; *(uint8_t*)0x20014ec6 = 0; *(uint8_t*)0x20014ec7 = 0; *(uint8_t*)0x20014ec8 = 0; *(uint8_t*)0x20014ec9 = 0; *(uint8_t*)0x20014eca = 0; *(uint8_t*)0x20014ecb = 0; *(uint8_t*)0x20014ecc = 0; *(uint8_t*)0x20014ecd = 0; *(uint8_t*)0x20014ece = 0; *(uint8_t*)0x20014ecf = 0; *(uint8_t*)0x20014ed0 = 0; *(uint8_t*)0x20014ed1 = 0; *(uint8_t*)0x20014ed2 = 0; *(uint8_t*)0x20014ed3 = 0; *(uint8_t*)0x20014ed4 = 0; *(uint8_t*)0x20014ed5 = 0; *(uint8_t*)0x20014ed6 = 0; *(uint8_t*)0x20014ed7 = 0; *(uint8_t*)0x20014ed8 = 0; *(uint8_t*)0x20014ed9 = 0; *(uint8_t*)0x20014eda = 0; *(uint8_t*)0x20014edb = 0; *(uint8_t*)0x20014edc = 0; *(uint8_t*)0x20014edd = 0; *(uint8_t*)0x20014ede = 0; *(uint8_t*)0x20014edf = 0; *(uint8_t*)0x20014ee0 = 0; *(uint8_t*)0x20014ee1 = 0; *(uint8_t*)0x20014ee2 = 0; *(uint8_t*)0x20014ee3 = 0; *(uint8_t*)0x20014ee4 = 0; *(uint8_t*)0x20014ee5 = 0; *(uint8_t*)0x20014ee6 = 0; *(uint8_t*)0x20014ee7 = 0; *(uint32_t*)0x20014ee8 = 0; *(uint16_t*)0x20014eec = 0xa8; *(uint16_t*)0x20014eee = 0xd0; *(uint32_t*)0x20014ef0 = 0; *(uint64_t*)0x20014ef8 = 0; *(uint64_t*)0x20014f00 = 0; *(uint16_t*)0x20014f08 = 0x28; memcpy((void*)0x20014f0a, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014f27 = 0; *(uint32_t*)0x20014f28 = 0; *(uint8_t*)0x20014f30 = 0; *(uint8_t*)0x20014f31 = 0; *(uint8_t*)0x20014f32 = 0; *(uint8_t*)0x20014f33 = 0; *(uint8_t*)0x20014f34 = 0; *(uint8_t*)0x20014f35 = 0; *(uint8_t*)0x20014f36 = 0; *(uint8_t*)0x20014f37 = 0; *(uint8_t*)0x20014f38 = 0; *(uint8_t*)0x20014f39 = 0; *(uint8_t*)0x20014f3a = 0; *(uint8_t*)0x20014f3b = 0; *(uint8_t*)0x20014f3c = 0; *(uint8_t*)0x20014f3d = 0; *(uint8_t*)0x20014f3e = 0; *(uint8_t*)0x20014f3f = 0; *(uint8_t*)0x20014f40 = 0; *(uint8_t*)0x20014f41 = 0; *(uint8_t*)0x20014f42 = 0; *(uint8_t*)0x20014f43 = 0; *(uint8_t*)0x20014f44 = 0; *(uint8_t*)0x20014f45 = 0; *(uint8_t*)0x20014f46 = 0; *(uint8_t*)0x20014f47 = 0; *(uint8_t*)0x20014f48 = 0; *(uint8_t*)0x20014f49 = 0; *(uint8_t*)0x20014f4a = 0; *(uint8_t*)0x20014f4b = 0; *(uint8_t*)0x20014f4c = 0; *(uint8_t*)0x20014f4d = 0; *(uint8_t*)0x20014f4e = 0; *(uint8_t*)0x20014f4f = 0; *(uint8_t*)0x20014f50 = 0; *(uint8_t*)0x20014f51 = 0; *(uint8_t*)0x20014f52 = 0; *(uint8_t*)0x20014f53 = 0; *(uint8_t*)0x20014f54 = 0; *(uint8_t*)0x20014f55 = 0; *(uint8_t*)0x20014f56 = 0; *(uint8_t*)0x20014f57 = 0; *(uint8_t*)0x20014f58 = 0; *(uint8_t*)0x20014f59 = 0; *(uint8_t*)0x20014f5a = 0; *(uint8_t*)0x20014f5b = 0; *(uint8_t*)0x20014f5c = 0; *(uint8_t*)0x20014f5d = 0; *(uint8_t*)0x20014f5e = 0; *(uint8_t*)0x20014f5f = 0; *(uint8_t*)0x20014f60 = 0; *(uint8_t*)0x20014f61 = 0; *(uint8_t*)0x20014f62 = 0; *(uint8_t*)0x20014f63 = 0; *(uint8_t*)0x20014f64 = 0; *(uint8_t*)0x20014f65 = 0; *(uint8_t*)0x20014f66 = 0; *(uint8_t*)0x20014f67 = 0; *(uint8_t*)0x20014f68 = 0; *(uint8_t*)0x20014f69 = 0; *(uint8_t*)0x20014f6a = 0; *(uint8_t*)0x20014f6b = 0; *(uint8_t*)0x20014f6c = 0; *(uint8_t*)0x20014f6d = 0; *(uint8_t*)0x20014f6e = 0; *(uint8_t*)0x20014f6f = 0; *(uint8_t*)0x20014f70 = 0; *(uint8_t*)0x20014f71 = 0; *(uint8_t*)0x20014f72 = 0; *(uint8_t*)0x20014f73 = 0; *(uint8_t*)0x20014f74 = 0; *(uint8_t*)0x20014f75 = 0; *(uint8_t*)0x20014f76 = 0; *(uint8_t*)0x20014f77 = 0; *(uint8_t*)0x20014f78 = 0; *(uint8_t*)0x20014f79 = 0; *(uint8_t*)0x20014f7a = 0; *(uint8_t*)0x20014f7b = 0; *(uint8_t*)0x20014f7c = 0; *(uint8_t*)0x20014f7d = 0; *(uint8_t*)0x20014f7e = 0; *(uint8_t*)0x20014f7f = 0; *(uint8_t*)0x20014f80 = 0; *(uint8_t*)0x20014f81 = 0; *(uint8_t*)0x20014f82 = 0; *(uint8_t*)0x20014f83 = 0; *(uint8_t*)0x20014f84 = 0; *(uint8_t*)0x20014f85 = 0; *(uint8_t*)0x20014f86 = 0; *(uint8_t*)0x20014f87 = 0; *(uint8_t*)0x20014f88 = 0; *(uint8_t*)0x20014f89 = 0; *(uint8_t*)0x20014f8a = 0; *(uint8_t*)0x20014f8b = 0; *(uint8_t*)0x20014f8c = 0; *(uint8_t*)0x20014f8d = 0; *(uint8_t*)0x20014f8e = 0; *(uint8_t*)0x20014f8f = 0; *(uint8_t*)0x20014f90 = 0; *(uint8_t*)0x20014f91 = 0; *(uint8_t*)0x20014f92 = 0; *(uint8_t*)0x20014f93 = 0; *(uint8_t*)0x20014f94 = 0; *(uint8_t*)0x20014f95 = 0; *(uint8_t*)0x20014f96 = 0; *(uint8_t*)0x20014f97 = 0; *(uint8_t*)0x20014f98 = 0; *(uint8_t*)0x20014f99 = 0; *(uint8_t*)0x20014f9a = 0; *(uint8_t*)0x20014f9b = 0; *(uint8_t*)0x20014f9c = 0; *(uint8_t*)0x20014f9d = 0; *(uint8_t*)0x20014f9e = 0; *(uint8_t*)0x20014f9f = 0; *(uint8_t*)0x20014fa0 = 0; *(uint8_t*)0x20014fa1 = 0; *(uint8_t*)0x20014fa2 = 0; *(uint8_t*)0x20014fa3 = 0; *(uint8_t*)0x20014fa4 = 0; *(uint8_t*)0x20014fa5 = 0; *(uint8_t*)0x20014fa6 = 0; *(uint8_t*)0x20014fa7 = 0; *(uint8_t*)0x20014fa8 = 0; *(uint8_t*)0x20014fa9 = 0; *(uint8_t*)0x20014faa = 0; *(uint8_t*)0x20014fab = 0; *(uint8_t*)0x20014fac = 0; *(uint8_t*)0x20014fad = 0; *(uint8_t*)0x20014fae = 0; *(uint8_t*)0x20014faf = 0; *(uint8_t*)0x20014fb0 = 0; *(uint8_t*)0x20014fb1 = 0; *(uint8_t*)0x20014fb2 = 0; *(uint8_t*)0x20014fb3 = 0; *(uint8_t*)0x20014fb4 = 0; *(uint8_t*)0x20014fb5 = 0; *(uint8_t*)0x20014fb6 = 0; *(uint8_t*)0x20014fb7 = 0; *(uint32_t*)0x20014fb8 = 0; *(uint16_t*)0x20014fbc = 0xa8; *(uint16_t*)0x20014fbe = 0xd0; *(uint32_t*)0x20014fc0 = 0; *(uint64_t*)0x20014fc8 = 0; *(uint64_t*)0x20014fd0 = 0; *(uint16_t*)0x20014fd8 = 0x28; memcpy((void*)0x20014fda, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20014ff7 = 0; *(uint32_t*)0x20014ff8 = 0xfffffffe; syscall(__NR_setsockopt, r[1], 0x29, 0x40, 0x20014c40, 0x3c0); } int main() { for (;;) { loop(); } }