// https://syzkaller.appspot.com/bug?id=a1aed641dc08e246e2fb01669c3605255392936a // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[72]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul); *(uint16_t*)0x20dca000 = (uint16_t)0x26; memcpy((void*)0x20dca002, "\x61\x65\x61\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 14); *(uint32_t*)0x20dca010 = (uint32_t)0x0; *(uint32_t*)0x20dca014 = (uint32_t)0x0; memcpy((void*)0x20dca018, "\x72\x66\x63\x37\x35\x33\x39\x28\x63\x74\x72\x28\x74\x77\x6f" "\x66\x69\x73\x68\x29\x2c\x73\x68\x61\x32\x32\x34\x2d\x73\x73" "\x73\x65\x33\x29\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00", 64); r[7] = syscall(__NR_bind, r[1], 0x20dca000ul, 0x58ul); memcpy((void*)0x201ec000, "\x0a\x07\x75\xb0\xd5\xe3\x83\xe5\xb3\xb6" "\x0c\xed\x5c\x54\xdb\xb7\x29\x5d\xf0\xdf" "\x82\x17\xad\x40\x00\x00\x00\x00\x00\x00" "\x00\xe6", 32); r[9] = syscall(__NR_setsockopt, r[1], 0x117ul, 0x1ul, 0x201ec000ul, 0x20ul); r[10] = syscall(__NR_accept, r[1], 0x0ul, 0x0ul); *(uint64_t*)0x20a0bfc8 = (uint64_t)0x0; *(uint32_t*)0x20a0bfd0 = (uint32_t)0x0; *(uint64_t*)0x20a0bfd8 = (uint64_t)0x20e18000; *(uint64_t*)0x20a0bfe0 = (uint64_t)0x5; *(uint64_t*)0x20a0bfe8 = (uint64_t)0x2091df88; *(uint64_t*)0x20a0bff0 = (uint64_t)0x78; *(uint32_t*)0x20a0bff8 = (uint32_t)0x0; *(uint64_t*)0x20e18000 = (uint64_t)0x20aa0000; *(uint64_t*)0x20e18008 = (uint64_t)0x0; *(uint64_t*)0x20e18010 = (uint64_t)0x20a62f92; *(uint64_t*)0x20e18018 = (uint64_t)0x0; *(uint64_t*)0x20e18020 = (uint64_t)0x201adf84; *(uint64_t*)0x20e18028 = (uint64_t)0x0; *(uint64_t*)0x20e18030 = (uint64_t)0x20158000; *(uint64_t*)0x20e18038 = (uint64_t)0x0; *(uint64_t*)0x20e18040 = (uint64_t)0x20575f5b; *(uint64_t*)0x20e18048 = (uint64_t)0xa5; memcpy((void*)0x20575f5b, "\x59\x58\xf9\x1b\xde\x91\x08\x95\x27\x65\xf1\xa1\xd7\xa4\x53" "\x4a\x21\xc1\x28\x92\xc9\xa1\xac\x57\x46\x04\xbd\xdd\xb7\xc2" "\xd9\xb1\x66\x0e\x90\xae\xdf\x33\xaa\x13\xea\xb2\xbe\x55\x3d" "\xc0\x1c\x7c\x23\x06\x58\xc9\x10\xe8\x06\x5d\x0b\x6f\xe1\x45" "\x5a\x18\xdb\x6b\x97\x25\xaf\x39\x04\xc7\x81\xe4\x51\x7a\x82" "\xaa\x3d\x8e\x9f\x15\x56\x33\x38\x6a\x60\xa6\x6f\xc1\x02\xe8" "\x86\xaa\x20\x52\x67\xe7\xcd\x3e\x8a\xec\x0c\xd3\xc8\x92\x5b" "\x8b\xca\xc6\x18\xa6\x78\x5c\x52\x00\x77\xec\x3c\x91\xa8\x88" "\xbe\xda\x75\x69\x1b\x2f\x7d\x70\xba\x3a\x54\x9e\x20\x7c\xfd" "\x7d\xe2\xbe\x1d\xf1\x15\xaf\x7a\xed\xb2\x2b\x2b\xa8\xf4\xe4" "\x76\x6c\x55\x8e\xf8\xd1\x9e\xd3\x76\x83\x3c\xb5\x5b\x09\xc7", 165); *(uint64_t*)0x2091df88 = (uint64_t)0x18; *(uint32_t*)0x2091df90 = (uint32_t)0x117; *(uint32_t*)0x2091df94 = (uint32_t)0x3; *(uint32_t*)0x2091df98 = (uint32_t)0x1; *(uint64_t*)0x2091dfa0 = (uint64_t)0x18; *(uint32_t*)0x2091dfa8 = (uint32_t)0x117; *(uint32_t*)0x2091dfac = (uint32_t)0x4; *(uint32_t*)0x2091dfb0 = (uint32_t)0x4; *(uint64_t*)0x2091dfb8 = (uint64_t)0x18; *(uint32_t*)0x2091dfc0 = (uint32_t)0x117; *(uint32_t*)0x2091dfc4 = (uint32_t)0x3; *(uint32_t*)0x2091dfc8 = (uint32_t)0x0; *(uint64_t*)0x2091dfd0 = (uint64_t)0x18; *(uint32_t*)0x2091dfd8 = (uint32_t)0x117; *(uint32_t*)0x2091dfdc = (uint32_t)0x4; *(uint32_t*)0x2091dfe0 = (uint32_t)0x6; *(uint64_t*)0x2091dfe8 = (uint64_t)0x18; *(uint32_t*)0x2091dff0 = (uint32_t)0x117; *(uint32_t*)0x2091dff4 = (uint32_t)0x3; *(uint32_t*)0x2091dff8 = (uint32_t)0x1; r[49] = syscall(__NR_sendmsg, r[10], 0x20a0bfc8ul, 0x0ul); *(uint64_t*)0x208e1000 = (uint64_t)0x200cd000; *(uint32_t*)0x208e1008 = (uint32_t)0x10; *(uint64_t*)0x208e1010 = (uint64_t)0x201db000; *(uint64_t*)0x208e1018 = (uint64_t)0x7; *(uint64_t*)0x208e1020 = (uint64_t)0x20331fba; *(uint64_t*)0x208e1028 = (uint64_t)0x0; *(uint32_t*)0x208e1030 = (uint32_t)0x1000; *(uint64_t*)0x201db000 = (uint64_t)0x20705000; *(uint64_t*)0x201db008 = (uint64_t)0x0; *(uint64_t*)0x201db010 = (uint64_t)0x20347000; *(uint64_t*)0x201db018 = (uint64_t)0x0; *(uint64_t*)0x201db020 = (uint64_t)0x2057c000; *(uint64_t*)0x201db028 = (uint64_t)0x0; *(uint64_t*)0x201db030 = (uint64_t)0x2032b000; *(uint64_t*)0x201db038 = (uint64_t)0x0; *(uint64_t*)0x201db040 = (uint64_t)0x203ecfd7; *(uint64_t*)0x201db048 = (uint64_t)0x0; *(uint64_t*)0x201db050 = (uint64_t)0x2070ef1e; *(uint64_t*)0x201db058 = (uint64_t)0x0; *(uint64_t*)0x201db060 = (uint64_t)0x20b2f000; *(uint64_t*)0x201db068 = (uint64_t)0x1000; r[71] = syscall(__NR_recvmsg, r[10], 0x208e1000ul, 0x2ul); } int main() { loop(); return 0; }