// https://syzkaller.appspot.com/bug?id=bd64b8b529c951b935a7c28423f6738f45d4a8a6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; *(uint32_t*)0x20000200 = 4; *(uint32_t*)0x20000204 = 0xe; *(uint64_t*)0x20000208 = 0x20000480; memcpy((void*)0x20000480, "\xb7\x02\x00\x00\xfe\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07" "\x01\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4" "\xf0\xff\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05" "\x00\x00\x00\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00" "\x01\x00\x00\x00\xb7\x03\x00\x00\x00\x00\x00\x00\x6a\x0a\x00\xfe\x00" "\x00\x00\x00\x85\x00\x00\x00\x26\x00\x00\x00\xb7\x00\x00\x00\x00\x00" "\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00", 112); *(uint64_t*)0x20000210 = 0x20000340; memcpy((void*)0x20000340, "syzkaller", 10); *(uint32_t*)0x20000218 = 0; *(uint32_t*)0x2000021c = 0; *(uint64_t*)0x20000220 = 0; *(uint32_t*)0x20000228 = 0; *(uint32_t*)0x2000022c = 0; *(uint8_t*)0x20000230 = 0; *(uint8_t*)0x20000231 = 0; *(uint8_t*)0x20000232 = 0; *(uint8_t*)0x20000233 = 0; *(uint8_t*)0x20000234 = 0; *(uint8_t*)0x20000235 = 0; *(uint8_t*)0x20000236 = 0; *(uint8_t*)0x20000237 = 0; *(uint8_t*)0x20000238 = 0; *(uint8_t*)0x20000239 = 0; *(uint8_t*)0x2000023a = 0; *(uint8_t*)0x2000023b = 0; *(uint8_t*)0x2000023c = 0; *(uint8_t*)0x2000023d = 0; *(uint8_t*)0x2000023e = 0; *(uint8_t*)0x2000023f = 0; *(uint32_t*)0x20000240 = 0; *(uint32_t*)0x20000244 = 0; res = syscall(__NR_bpf, 5, 0x20000200, 0x48); if (res != -1) r[0] = res; *(uint32_t*)0x20000040 = r[0]; *(uint32_t*)0x20000044 = 0; *(uint32_t*)0x20000048 = 0xff; *(uint32_t*)0x2000004c = 0xe7; *(uint64_t*)0x20000050 = 0x20000600; memcpy((void*)0x20000600, "\xdd\xe0\xe5\x13\x7c\x77\x27\x2b\xec\x52\xb0\x2a\xee\x28\x4f\xa8\x9f" "\x6a\xa4\xcb\x62\x96\x4b\x9b\x69\x20\xe8\x97\x4b\xc7\x6d\x7f\xc3\x0b" "\xd7\xa8\x7a\xa2\xeb\xa4\x30\x86\xad\x53\x74\x02\xf4\x82\x5a\x26\x65" "\x32\xc4\x8e\x24\xf6\xa2\x67\x3d\x19\x8b\x3e\xf3\x07\xa7\x5e\xd2\xb7" "\x08\xa4\x79\xc1\xa6\x32\xaf\x13\x96\x84\x24\x0f\x03\x45\x94\x54\x8e" "\xcd\xbb\x38\x07\x42\x37\x00\x51\x7c\xc6\x6c\x61\xc0\xc7\x3e\x55\xd3" "\xf3\xbf\xc5\x29\xe8\x05\xdd\x0b\x42\xcc\x97\xe7\x0c\xed\xe6\x68\x81" "\xde\xcc\x9e\x51\x7e\xc7\x4b\x74\x20\x8f\x31\xc3\x36\x1a\x20\x09\xef" "\x5d\x3c\x2b\x29\x54\xc5\xa5\x22\x5f\x3e\x5e\xda\xf0\xea\x2c\x90\x1d" "\xae\x23\xdc\x88\xe9\x5e\x85\xd3\x81\x5d\xc9\xf2\x38\x62\x69\x3f\x17" "\x9a\xb9\xb2\xb9\xbf\x94\x55\x19\x64\xac\x55\x86\xbc\x09\xc8\x8a\x7a" "\xfa\x33\xe6\x77\x0c\x13\x7a\x6b\xbb\xa4\xa9\xa9\x2f\xce\x00\xbe\x8a" "\x2f\xa8\xb1\xa3\xc0\x08\xba\x99\x60\xee\xc1\x92\x53\x8c\x6d\xa8\x1e" "\x52\xd3\xe9\x96\xae\x8a\xb8\xd8\x2c\x96\xbb\x47\x59\x91\x20\x61\x36" "\xc5\xda\x34\xa9\x72\x93\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 255); *(uint64_t*)0x20000058 = 0x20000500; *(uint32_t*)0x20000060 = 8; *(uint32_t*)0x20000064 = 0; syscall(__NR_bpf, 0xa, 0x20000040, 0x28); return 0; }