// https://syzkaller.appspot.com/bug?id=c71f503ed91564f669d67ea159101451973968ef // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[157]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x20bbcff7, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d\x00", 9); r[2] = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20bbcff7ul, 0x7dul, 0x0ul); r[3] = syscall(__NR_ioctl, r[2], 0xae01ul, 0x0ul); r[4] = syscall(__NR_ioctl, r[3], 0xae41ul, 0x0ul); *(uint32_t*)0x20afd000 = (uint32_t)0x0; *(uint32_t*)0x20afd004 = (uint32_t)0x0; *(uint64_t*)0x20afd008 = (uint64_t)0x0; *(uint64_t*)0x20afd010 = (uint64_t)0x2000; *(uint64_t*)0x20afd018 = (uint64_t)0x20095000; r[10] = syscall(__NR_ioctl, r[3], 0x4020ae46ul, 0x20afd000ul); *(uint64_t*)0x20663f70 = (uint64_t)0x6c; *(uint64_t*)0x20663f78 = (uint64_t)0x9; *(uint64_t*)0x20663f80 = (uint64_t)0x4000; *(uint64_t*)0x20663f88 = (uint64_t)0x0; *(uint64_t*)0x20663f90 = (uint64_t)0x0; *(uint64_t*)0x20663f98 = (uint64_t)0xd4; *(uint64_t*)0x20663fa0 = (uint64_t)0xffffffffffffffff; *(uint64_t*)0x20663fa8 = (uint64_t)0x0; *(uint64_t*)0x20663fb0 = (uint64_t)0x5; *(uint64_t*)0x20663fb8 = (uint64_t)0x0; *(uint64_t*)0x20663fc0 = (uint64_t)0x800000000; *(uint64_t*)0x20663fc8 = (uint64_t)0x0; *(uint64_t*)0x20663fd0 = (uint64_t)0x0; *(uint64_t*)0x20663fd8 = (uint64_t)0x1; *(uint64_t*)0x20663fe0 = (uint64_t)0x4; *(uint64_t*)0x20663fe8 = (uint64_t)0x0; *(uint64_t*)0x20663ff0 = (uint64_t)0x2; *(uint64_t*)0x20663ff8 = (uint64_t)0x100; r[29] = syscall(__NR_ioctl, r[4], 0x4090ae82ul, 0x20663f70ul); *(uint64_t*)0x20fe2000 = (uint64_t)0x0; *(uint32_t*)0x20fe2008 = (uint32_t)0x0; *(uint16_t*)0x20fe200c = (uint16_t)0x0; *(uint8_t*)0x20fe200e = (uint8_t)0x0; *(uint8_t*)0x20fe200f = (uint8_t)0x9; *(uint8_t*)0x20fe2010 = (uint8_t)0x0; *(uint8_t*)0x20fe2011 = (uint8_t)0x0; *(uint8_t*)0x20fe2012 = (uint8_t)0x0; *(uint8_t*)0x20fe2013 = (uint8_t)0x9; *(uint8_t*)0x20fe2014 = (uint8_t)0x0; *(uint8_t*)0x20fe2015 = (uint8_t)0x0; *(uint8_t*)0x20fe2016 = (uint8_t)0x0; *(uint8_t*)0x20fe2017 = (uint8_t)0x0; *(uint64_t*)0x20fe2018 = (uint64_t)0x0; *(uint32_t*)0x20fe2020 = (uint32_t)0x0; *(uint16_t*)0x20fe2024 = (uint16_t)0x0; *(uint8_t*)0x20fe2026 = (uint8_t)0x0; *(uint8_t*)0x20fe2027 = (uint8_t)0x0; *(uint8_t*)0x20fe2028 = (uint8_t)0x0; *(uint8_t*)0x20fe2029 = (uint8_t)0x0; *(uint8_t*)0x20fe202a = (uint8_t)0x0; *(uint8_t*)0x20fe202b = (uint8_t)0x0; *(uint8_t*)0x20fe202c = (uint8_t)0x0; *(uint8_t*)0x20fe202d = (uint8_t)0x0; *(uint8_t*)0x20fe202e = (uint8_t)0x0; *(uint8_t*)0x20fe202f = (uint8_t)0x0; *(uint64_t*)0x20fe2030 = (uint64_t)0x0; *(uint32_t*)0x20fe2038 = (uint32_t)0x0; *(uint16_t*)0x20fe203c = (uint16_t)0x0; *(uint8_t*)0x20fe203e = (uint8_t)0x0; *(uint8_t*)0x20fe203f = (uint8_t)0x0; *(uint8_t*)0x20fe2040 = (uint8_t)0x0; *(uint8_t*)0x20fe2041 = (uint8_t)0x0; *(uint8_t*)0x20fe2042 = (uint8_t)0x0; *(uint8_t*)0x20fe2043 = (uint8_t)0x0; *(uint8_t*)0x20fe2044 = (uint8_t)0x0; *(uint8_t*)0x20fe2045 = (uint8_t)0x0; *(uint8_t*)0x20fe2046 = (uint8_t)0x0; *(uint8_t*)0x20fe2047 = (uint8_t)0x0; *(uint64_t*)0x20fe2048 = (uint64_t)0x0; *(uint32_t*)0x20fe2050 = (uint32_t)0x0; *(uint16_t*)0x20fe2054 = (uint16_t)0x0; *(uint8_t*)0x20fe2056 = (uint8_t)0x0; *(uint8_t*)0x20fe2057 = (uint8_t)0x0; *(uint8_t*)0x20fe2058 = (uint8_t)0x0; *(uint8_t*)0x20fe2059 = (uint8_t)0x0; *(uint8_t*)0x20fe205a = (uint8_t)0x0; *(uint8_t*)0x20fe205b = (uint8_t)0x0; *(uint8_t*)0x20fe205c = (uint8_t)0x0; *(uint8_t*)0x20fe205d = (uint8_t)0x0; *(uint8_t*)0x20fe205e = (uint8_t)0x0; *(uint8_t*)0x20fe205f = (uint8_t)0x0; *(uint64_t*)0x20fe2060 = (uint64_t)0x0; *(uint32_t*)0x20fe2068 = (uint32_t)0x0; *(uint16_t*)0x20fe206c = (uint16_t)0x0; *(uint8_t*)0x20fe206e = (uint8_t)0x0; *(uint8_t*)0x20fe206f = (uint8_t)0x0; *(uint8_t*)0x20fe2070 = (uint8_t)0x0; *(uint8_t*)0x20fe2071 = (uint8_t)0x0; *(uint8_t*)0x20fe2072 = (uint8_t)0x0; *(uint8_t*)0x20fe2073 = (uint8_t)0x0; *(uint8_t*)0x20fe2074 = (uint8_t)0x0; *(uint8_t*)0x20fe2075 = (uint8_t)0x0; *(uint8_t*)0x20fe2076 = (uint8_t)0x0; *(uint8_t*)0x20fe2077 = (uint8_t)0x0; *(uint64_t*)0x20fe2078 = (uint64_t)0x0; *(uint32_t*)0x20fe2080 = (uint32_t)0x0; *(uint16_t*)0x20fe2084 = (uint16_t)0x0; *(uint8_t*)0x20fe2086 = (uint8_t)0x0; *(uint8_t*)0x20fe2087 = (uint8_t)0x0; *(uint8_t*)0x20fe2088 = (uint8_t)0x0; *(uint8_t*)0x20fe2089 = (uint8_t)0x0; *(uint8_t*)0x20fe208a = (uint8_t)0x0; *(uint8_t*)0x20fe208b = (uint8_t)0x0; *(uint8_t*)0x20fe208c = (uint8_t)0x0; *(uint8_t*)0x20fe208d = (uint8_t)0x0; *(uint8_t*)0x20fe208e = (uint8_t)0x0; *(uint8_t*)0x20fe208f = (uint8_t)0x0; *(uint64_t*)0x20fe2090 = (uint64_t)0x0; *(uint32_t*)0x20fe2098 = (uint32_t)0x0; *(uint16_t*)0x20fe209c = (uint16_t)0x0; *(uint8_t*)0x20fe209e = (uint8_t)0x0; *(uint8_t*)0x20fe209f = (uint8_t)0x0; *(uint8_t*)0x20fe20a0 = (uint8_t)0x0; *(uint8_t*)0x20fe20a1 = (uint8_t)0x0; *(uint8_t*)0x20fe20a2 = (uint8_t)0x0; *(uint8_t*)0x20fe20a3 = (uint8_t)0x0; *(uint8_t*)0x20fe20a4 = (uint8_t)0x0; *(uint8_t*)0x20fe20a5 = (uint8_t)0x0; *(uint8_t*)0x20fe20a6 = (uint8_t)0x0; *(uint8_t*)0x20fe20a7 = (uint8_t)0x0; *(uint64_t*)0x20fe20a8 = (uint64_t)0x0; *(uint32_t*)0x20fe20b0 = (uint32_t)0x0; *(uint16_t*)0x20fe20b4 = (uint16_t)0x0; *(uint8_t*)0x20fe20b6 = (uint8_t)0x0; *(uint8_t*)0x20fe20b7 = (uint8_t)0x0; *(uint8_t*)0x20fe20b8 = (uint8_t)0x0; *(uint8_t*)0x20fe20b9 = (uint8_t)0x0; *(uint8_t*)0x20fe20ba = (uint8_t)0x0; *(uint8_t*)0x20fe20bb = (uint8_t)0x0; *(uint8_t*)0x20fe20bc = (uint8_t)0x0; *(uint8_t*)0x20fe20bd = (uint8_t)0x0; *(uint8_t*)0x20fe20be = (uint8_t)0x0; *(uint8_t*)0x20fe20bf = (uint8_t)0x0; *(uint64_t*)0x20fe20c0 = (uint64_t)0x0; *(uint16_t*)0x20fe20c8 = (uint16_t)0x0; *(uint16_t*)0x20fe20ca = (uint16_t)0x0; *(uint16_t*)0x20fe20cc = (uint16_t)0x0; *(uint16_t*)0x20fe20ce = (uint16_t)0x0; *(uint64_t*)0x20fe20d0 = (uint64_t)0x4; *(uint16_t*)0x20fe20d8 = (uint16_t)0x0; *(uint16_t*)0x20fe20da = (uint16_t)0x0; *(uint16_t*)0x20fe20dc = (uint16_t)0x0; *(uint16_t*)0x20fe20de = (uint16_t)0x0; *(uint64_t*)0x20fe20e0 = (uint64_t)0x62689cc022a97de7; *(uint64_t*)0x20fe20e8 = (uint64_t)0x0; *(uint64_t*)0x20fe20f0 = (uint64_t)0x0; *(uint64_t*)0x20fe20f8 = (uint64_t)0x0; *(uint64_t*)0x20fe2100 = (uint64_t)0x0; *(uint64_t*)0x20fe2108 = (uint64_t)0x500; *(uint64_t*)0x20fe2110 = (uint64_t)0x0; *(uint64_t*)0x20fe2118 = (uint64_t)0x0; *(uint64_t*)0x20fe2120 = (uint64_t)0x0; *(uint64_t*)0x20fe2128 = (uint64_t)0x3cc; *(uint64_t*)0x20fe2130 = (uint64_t)0x0; r[155] = syscall(__NR_ioctl, r[4], 0x4138ae84ul, 0x20fe2000ul); r[156] = syscall(__NR_ioctl, r[4], 0xae80ul, 0x0ul); } int main() { loop(); return 0; }