// https://syzkaller.appspot.com/bug?id=46f76391fe0b58c2cc790c8e6f82bdf5b41d0354 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_ioctl #define __NR_ioctl 54 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_openat #define __NR_openat 295 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000, 0x1000, 0, 0x32, -1, 0); syscall(__NR_mmap, 0x20000000, 0x1000000, 7, 0x32, -1, 0); syscall(__NR_mmap, 0x21000000, 0x1000, 0, 0x32, -1, 0); intptr_t res = 0; *(uint32_t*)0x20000080 = 3; *(uint32_t*)0x20000084 = 1; *(uint32_t*)0x20000088 = 6; *(uint32_t*)0x2000008c = 0; *(uint32_t*)0x20000090 = 0; syscall(__NR_ioctl, -1, 0xc0145608, 0x20000080); memcpy((void*)0x20000000, "/dev/vim2m\000", 11); res = syscall(__NR_openat, 0xffffff9c, 0x20000000, 2, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000040 = 0; *(uint32_t*)0x20000044 = 9; *(uint32_t*)0x20000048 = 0; memcpy((void*)0x2000004c, "\xa2\xf5\xc0\xf5\xae\xa3\xcc\x0f\xee\xc0\xdb\xb6" "\x51\x00\x24\x21\x7f\x2f\x27\x3f\xad\x3d\xd1\x96" "\x73\xfa\x87\xe6\x5f\x51\x11\x03", 32); *(uint32_t*)0x2000006c = 0; *(uint32_t*)0x20000070 = 0; *(uint32_t*)0x20000074 = 0; *(uint32_t*)0x20000078 = 0; *(uint32_t*)0x2000007c = 0; syscall(__NR_ioctl, (intptr_t)r[0], 0xc050560f, 0x20000040); return 0; }