// https://syzkaller.appspot.com/bug?id=c2283e736a6077d20ce01c9cfcdc5e85473f5162 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_pipe, 0x200000c0); if (res != -1) { r[0] = *(uint32_t*)0x200000c0; r[1] = *(uint32_t*)0x200000c4; } syscall(__NR_write, r[1], 0x20000340, 0xff0e); syscall(__NR_close, r[1]); res = syscall(__NR_socket, 0xa, 1, 0); if (res != -1) r[2] = res; *(uint32_t*)0x200000c0 = 1; syscall(__NR_setsockopt, r[2], 6, 0x13, 0x200000c0, 4); *(uint16_t*)0x20000140 = 0xa; *(uint16_t*)0x20000142 = htobe16(0); *(uint32_t*)0x20000144 = htobe32(0); memcpy((void*)0x20000148, "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16); *(uint32_t*)0x20000158 = 0; syscall(__NR_connect, r[2], 0x20000140, 0x1c); memcpy((void*)0x20000200, "tls\000", 4); syscall(__NR_setsockopt, r[1], 6, 0x1f, 0x20000200, 4); *(uint16_t*)0x20000a40 = 0x303; *(uint16_t*)0x20000a42 = 0x33; memcpy((void*)0x20000a44, "\x65\x8b\xdc\xe8\xf1\x6b\x69\x01", 8); memcpy((void*)0x20000a4c, "\x9f\xae\x19\x47\xfe\x62\x57\x6d\x6d\x75\x73\xc5\x5f\x79\x5e\x68", 16); memcpy((void*)0x20000a5c, "\xa4\x3c\xc8\x0d", 4); memcpy((void*)0x20000a60, "\xca\x90\xbc\x29\xc8\xf9\x1c\xf6", 8); syscall(__NR_setsockopt, r[1], 0x11a, 1, 0x20000a40, 0x28); *(uint32_t*)0x20000180 = 0xb; *(uint16_t*)0x20000184 = 0x10; *(uint16_t*)0x20000186 = 0xfa00; *(uint64_t*)0x20000188 = 0; *(uint32_t*)0x20000190 = -1; *(uint32_t*)0x20000194 = 0x4cab; syscall(__NR_write, r[1], 0x20000180, 0x18); syscall(__NR_splice, r[0], 0, r[1], 0, 0x100000000, 0); return 0; }