// https://syzkaller.appspot.com/bug?id=32f4bfa7b6e36b4a1d0e77fe63f10b6f0abc957d // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x3ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x400000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x400001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=SOCK_DGRAM*/ 2ul, /*proto=*/0); if (res != -1) r[0] = res; *(uint64_t*)0x400000000000 = 0; *(uint32_t*)0x400000000008 = 0; *(uint64_t*)0x400000000010 = 0x400000000140; *(uint64_t*)0x400000000140 = 0x400000000180; memcpy((void*)0x400000000180, "\xd8\x00\x00\x00\x18\x00\x81\x06\x4e\x81\xf7\x82\xdb\x4c\xb9\x04\x02" "\x1d\x08\x00\xfd\x00\x7c\x05\xe8\xfe\x55\xa1\x0a\x00\x0b\x00\x01\x40" "\x02\x02\x03\x60\x0e\x41\xb0\x00\x09\x00\xac\x00\x06\x03\x11\x00\x00" "\x00\x16\x00\x15\x00\x09\x00\x02\x00\x00\x00\x03\x5c\x3b\x61\xc1\xd6" "\x7f\x6f\x94\x00\x71\x34\xcf\x6e\xfb\x80\x00\xa0\x07\xa2\x90\x45\x7f" "\x01\xa7\xce\xe4\x09\x00\x00\x00\x1f\xb7\x91\x64\x3a\x5e\xe4\xce\x1b" "\x14\xd6\xd9\x30\xdf\xe1\xd9\xd3\x22\xfe\x7c\x9f\x87\x75\x73\x0d\x16" "\xa4\x68\x3f\x5a\xe2\x4e\x25\xcc\xca\x9e\x00\x36\x0d\xb7\x98\x26\x83" "\x5d\x3a\x71\xd9\x56\x67\xe0\x06\xdc\xdf\x63\x95\x1f\x21\x5c\xe3\xbb" "\x9a\xd8\x09\xd5\xe1\xca\xce\x81\xed\x0b\xff\xec\xe0\xb4\x2a\x9e\xcb" "\xee\x5d\xe6\xcc\xd4\x0d\xd6\xe4\xed\xef\x3d\x93\x45\x2a\x92\x95\x4b" "\x43\x37\x0e\x97\x03\x92\x07\x23\xf9\x00\x00\x00\x00\x8a\xf2\x6c\x8b" "\x7b\x55\xf4\xd2\xa6\x82\x3a\x45\xf2\x8f\xcb\x1d", 216); *(uint64_t*)0x400000000148 = 0xd8; *(uint64_t*)0x400000000018 = 1; *(uint64_t*)0x400000000020 = 0; *(uint64_t*)0x400000000028 = 0; *(uint32_t*)0x400000000030 = 0; syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x400000000000ul, /*f=*/0ul); return 0; }