// https://syzkaller.appspot.com/bug?id=26cb120b31cd24d984fc16da67f50fb375c432a7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000ul, 0xf61000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[0] = syscall(__NR_socket, 0xful, 0x3ul, 0x2ul); *(uint64_t*)0x205f5000 = (uint64_t)0x0; *(uint32_t*)0x205f5008 = (uint32_t)0x0; *(uint64_t*)0x205f5010 = (uint64_t)0x208feff0; *(uint64_t*)0x205f5018 = (uint64_t)0x1; *(uint64_t*)0x205f5020 = (uint64_t)0x0; *(uint64_t*)0x205f5028 = (uint64_t)0x0; *(uint32_t*)0x205f5030 = (uint32_t)0x0; *(uint64_t*)0x208feff0 = (uint64_t)0x20d4cea8; *(uint64_t*)0x208feff8 = (uint64_t)0x58; *(uint8_t*)0x20d4cea8 = (uint8_t)0x2; *(uint8_t*)0x20d4cea9 = (uint8_t)0x3; *(uint8_t*)0x20d4ceaa = (uint8_t)0x4; *(uint8_t*)0x20d4ceab = (uint8_t)0x2; *(uint16_t*)0x20d4ceac = (uint16_t)0xb; *(uint16_t*)0x20d4ceae = (uint16_t)0x0; *(uint32_t*)0x20d4ceb0 = (uint32_t)0x0; *(uint32_t*)0x20d4ceb4 = (uint32_t)0x0; *(uint16_t*)0x20d4ceb8 = (uint16_t)0x1; *(uint16_t*)0x20d4ceba = (uint16_t)0x8; *(uint16_t*)0x20d4cebc = (uint16_t)0xc000; *(uint16_t*)0x20d4cebe = (uint16_t)0x0; *(uint16_t*)0x20d4cec0 = (uint16_t)0x3; *(uint16_t*)0x20d4cec2 = (uint16_t)0x6; *(uint8_t*)0x20d4cec4 = (uint8_t)0x0; *(uint8_t*)0x20d4cec5 = (uint8_t)0x0; *(uint16_t*)0x20d4cec6 = (uint16_t)0x0; *(uint16_t*)0x20d4cec8 = (uint16_t)0x2; *(uint16_t*)0x20d4ceca = (uint16_t)0x214e; *(uint32_t*)0x20d4cecc = (uint32_t)0xffffffff; *(uint8_t*)0x20d4ced0 = (uint8_t)0x0; *(uint8_t*)0x20d4ced1 = (uint8_t)0x0; *(uint8_t*)0x20d4ced2 = (uint8_t)0x0; *(uint8_t*)0x20d4ced3 = (uint8_t)0x0; *(uint8_t*)0x20d4ced4 = (uint8_t)0x0; *(uint8_t*)0x20d4ced5 = (uint8_t)0x0; *(uint8_t*)0x20d4ced6 = (uint8_t)0x0; *(uint8_t*)0x20d4ced7 = (uint8_t)0x0; *(uint16_t*)0x20d4ced8 = (uint16_t)0x2; *(uint16_t*)0x20d4ceda = (uint16_t)0x1; *(uint32_t*)0x20d4cedc = (uint32_t)0x0; *(uint8_t*)0x20d4cee0 = (uint8_t)0x0; *(uint8_t*)0x20d4cee1 = (uint8_t)0x0; *(uint8_t*)0x20d4cee2 = (uint8_t)0xfb; *(uint8_t*)0x20d4cee3 = (uint8_t)0x0; *(uint32_t*)0x20d4cee4 = (uint32_t)0x0; *(uint16_t*)0x20d4cee8 = (uint16_t)0x3; *(uint16_t*)0x20d4ceea = (uint16_t)0x5; *(uint8_t*)0x20d4ceec = (uint8_t)0x100000000; *(uint8_t*)0x20d4ceed = (uint8_t)0x7; *(uint16_t*)0x20d4ceee = (uint16_t)0x0; *(uint16_t*)0x20d4cef0 = (uint16_t)0x2; *(uint16_t*)0x20d4cef2 = (uint16_t)0x224e; *(uint32_t*)0x20d4cef4 = (uint32_t)0x0; *(uint8_t*)0x20d4cef8 = (uint8_t)0x0; *(uint8_t*)0x20d4cef9 = (uint8_t)0x0; *(uint8_t*)0x20d4cefa = (uint8_t)0x0; *(uint8_t*)0x20d4cefb = (uint8_t)0x0; *(uint8_t*)0x20d4cefc = (uint8_t)0x0; *(uint8_t*)0x20d4cefd = (uint8_t)0x0; *(uint8_t*)0x20d4cefe = (uint8_t)0x0; *(uint8_t*)0x20d4ceff = (uint8_t)0x0; syscall(__NR_sendmsg, r[0], 0x205f5000ul, 0x0ul); } int main() { loop(); return 0; }