// https://syzkaller.appspot.com/bug?id=912f70e859dfffd2533b7cfcd2c71e0dd6f71e9d // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include long r[2]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 2, 1, 0); *(uint32_t*)0x20745000 = 0x10; syscall(__NR_getsockopt, r[0], 0, 0x29, 0x20000000, 0x20745000); r[1] = syscall(__NR_socket, 2, 0x803, 2); memcpy((void*)0x20002000, "\x6e\x61\x74\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint32_t*)0x20002020 = 0x1b; *(uint32_t*)0x20002024 = 4; *(uint32_t*)0x20002028 = 0x2a0; *(uint32_t*)0x2000202c = 0; *(uint32_t*)0x20002030 = 0; *(uint32_t*)0x20002034 = -1; *(uint32_t*)0x20002038 = 0; *(uint32_t*)0x2000203c = 0; *(uint32_t*)0x20002040 = 0; *(uint32_t*)0x20002044 = 0; *(uint32_t*)0x20002048 = -1; *(uint32_t*)0x2000204c = 0; *(uint32_t*)0x20002050 = 0; *(uint32_t*)0x20002054 = 4; *(uint64_t*)0x20002058 = 0x20003000; *(uint8_t*)0x20002060 = 0; *(uint8_t*)0x20002061 = 0; *(uint8_t*)0x20002062 = 0; *(uint8_t*)0x20002063 = 0; *(uint8_t*)0x20002064 = 0; *(uint8_t*)0x20002065 = 0; *(uint8_t*)0x20002066 = 0; *(uint8_t*)0x20002067 = 0; *(uint8_t*)0x20002068 = 0; *(uint8_t*)0x20002069 = 0; *(uint8_t*)0x2000206a = 0; *(uint8_t*)0x2000206b = 0; *(uint8_t*)0x2000206c = 0; *(uint8_t*)0x2000206d = 0; *(uint8_t*)0x2000206e = 0; *(uint8_t*)0x2000206f = 0; *(uint8_t*)0x20002070 = 0; *(uint8_t*)0x20002071 = 0; *(uint8_t*)0x20002072 = 0; *(uint8_t*)0x20002073 = 0; *(uint8_t*)0x20002074 = 0; *(uint8_t*)0x20002075 = 0; *(uint8_t*)0x20002076 = 0; *(uint8_t*)0x20002077 = 0; *(uint8_t*)0x20002078 = 0; *(uint8_t*)0x20002079 = 0; *(uint8_t*)0x2000207a = 0; *(uint8_t*)0x2000207b = 0; *(uint8_t*)0x2000207c = 0; *(uint8_t*)0x2000207d = 0; *(uint8_t*)0x2000207e = 0; *(uint8_t*)0x2000207f = 0; *(uint8_t*)0x20002080 = 0; *(uint8_t*)0x20002081 = 0; *(uint8_t*)0x20002082 = 0; *(uint8_t*)0x20002083 = 0; *(uint8_t*)0x20002084 = 0; *(uint8_t*)0x20002085 = 0; *(uint8_t*)0x20002086 = 0; *(uint8_t*)0x20002087 = 0; *(uint8_t*)0x20002088 = 0; *(uint8_t*)0x20002089 = 0; *(uint8_t*)0x2000208a = 0; *(uint8_t*)0x2000208b = 0; *(uint8_t*)0x2000208c = 0; *(uint8_t*)0x2000208d = 0; *(uint8_t*)0x2000208e = 0; *(uint8_t*)0x2000208f = 0; *(uint8_t*)0x20002090 = 0; *(uint8_t*)0x20002091 = 0; *(uint8_t*)0x20002092 = 0; *(uint8_t*)0x20002093 = 0; *(uint8_t*)0x20002094 = 0; *(uint8_t*)0x20002095 = 0; *(uint8_t*)0x20002096 = 0; *(uint8_t*)0x20002097 = 0; *(uint8_t*)0x20002098 = 0; *(uint8_t*)0x20002099 = 0; *(uint8_t*)0x2000209a = 0; *(uint8_t*)0x2000209b = 0; *(uint8_t*)0x2000209c = 0; *(uint8_t*)0x2000209d = 0; *(uint8_t*)0x2000209e = 0; *(uint8_t*)0x2000209f = 0; *(uint8_t*)0x200020a0 = 0; *(uint8_t*)0x200020a1 = 0; *(uint8_t*)0x200020a2 = 0; *(uint8_t*)0x200020a3 = 0; *(uint8_t*)0x200020a4 = 0; *(uint8_t*)0x200020a5 = 0; *(uint8_t*)0x200020a6 = 0; *(uint8_t*)0x200020a7 = 0; *(uint8_t*)0x200020a8 = 0; *(uint8_t*)0x200020a9 = 0; *(uint8_t*)0x200020aa = 0; *(uint8_t*)0x200020ab = 0; *(uint8_t*)0x200020ac = 0; *(uint8_t*)0x200020ad = 0; *(uint8_t*)0x200020ae = 0; *(uint8_t*)0x200020af = 0; *(uint8_t*)0x200020b0 = 0; *(uint8_t*)0x200020b1 = 0; *(uint8_t*)0x200020b2 = 0; *(uint8_t*)0x200020b3 = 0; *(uint32_t*)0x200020b4 = 0; *(uint16_t*)0x200020b8 = 0x70; *(uint16_t*)0x200020ba = 0x98; *(uint32_t*)0x200020bc = 0; *(uint64_t*)0x200020c0 = 0; *(uint64_t*)0x200020c8 = 0; *(uint16_t*)0x200020d0 = 0x28; memcpy((void*)0x200020d2, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x200020ef = 0; *(uint32_t*)0x200020f0 = 0xfffffffe; *(uint32_t*)0x200020f8 = htobe32(-1); *(uint8_t*)0x200020fc = 0xac; *(uint8_t*)0x200020fd = 0x14; *(uint8_t*)0x200020fe = 0; *(uint8_t*)0x200020ff = 0xaa; *(uint32_t*)0x20002100 = htobe32(0); *(uint32_t*)0x20002104 = htobe32(0); memcpy((void*)0x20002108, "\x69\x70\x36\x67\x72\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); memcpy((void*)0x20002118, "\x76\x63\x61\x6e\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint8_t*)0x20002128 = 0; *(uint8_t*)0x20002129 = 0; *(uint8_t*)0x2000212a = 0; *(uint8_t*)0x2000212b = 0; *(uint8_t*)0x2000212c = 0; *(uint8_t*)0x2000212d = 0; *(uint8_t*)0x2000212e = 0; *(uint8_t*)0x2000212f = 0; *(uint8_t*)0x20002130 = 0; *(uint8_t*)0x20002131 = 0; *(uint8_t*)0x20002132 = 0; *(uint8_t*)0x20002133 = 0; *(uint8_t*)0x20002134 = 0; *(uint8_t*)0x20002135 = 0; *(uint8_t*)0x20002136 = 0; *(uint8_t*)0x20002137 = 0; *(uint8_t*)0x20002138 = 0; *(uint8_t*)0x20002139 = 0; *(uint8_t*)0x2000213a = 0; *(uint8_t*)0x2000213b = 0; *(uint8_t*)0x2000213c = 0; *(uint8_t*)0x2000213d = 0; *(uint8_t*)0x2000213e = 0; *(uint8_t*)0x2000213f = 0; *(uint8_t*)0x20002140 = 0; *(uint8_t*)0x20002141 = 0; *(uint8_t*)0x20002142 = 0; *(uint8_t*)0x20002143 = 0; *(uint8_t*)0x20002144 = 0; *(uint8_t*)0x20002145 = 0; *(uint8_t*)0x20002146 = 0; *(uint8_t*)0x20002147 = 0; *(uint16_t*)0x20002148 = 0; *(uint8_t*)0x2000214a = 0; *(uint8_t*)0x2000214b = 0; *(uint32_t*)0x2000214c = 0; *(uint16_t*)0x20002150 = 0x70; *(uint16_t*)0x20002152 = 0xa8; *(uint32_t*)0x20002154 = 0; *(uint64_t*)0x20002158 = 0; *(uint64_t*)0x20002160 = 0; *(uint16_t*)0x20002168 = 0x38; memcpy((void*)0x2000216a, "\x53\x4e\x41\x54\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20002187 = 0; *(uint32_t*)0x20002188 = 1; *(uint32_t*)0x2000218c = 0; *(uint32_t*)0x20002190 = htobe32(0xe0000002); *(uint32_t*)0x20002194 = htobe32(0xe0000001); *(uint16_t*)0x20002198 = 0; *(uint16_t*)0x2000219a = 0; *(uint8_t*)0x200021a0 = 0; *(uint8_t*)0x200021a1 = 0; *(uint8_t*)0x200021a2 = 0; *(uint8_t*)0x200021a3 = 0; *(uint8_t*)0x200021a4 = 0; *(uint8_t*)0x200021a5 = 0; *(uint8_t*)0x200021a6 = 0; *(uint8_t*)0x200021a7 = 0; *(uint8_t*)0x200021a8 = 0; *(uint8_t*)0x200021a9 = 0; *(uint8_t*)0x200021aa = 0; *(uint8_t*)0x200021ab = 0; *(uint8_t*)0x200021ac = 0; *(uint8_t*)0x200021ad = 0; *(uint8_t*)0x200021ae = 0; *(uint8_t*)0x200021af = 0; *(uint8_t*)0x200021b0 = 0; *(uint8_t*)0x200021b1 = 0; *(uint8_t*)0x200021b2 = 0; *(uint8_t*)0x200021b3 = 0; *(uint8_t*)0x200021b4 = 0; *(uint8_t*)0x200021b5 = 0; *(uint8_t*)0x200021b6 = 0; *(uint8_t*)0x200021b7 = 0; *(uint8_t*)0x200021b8 = 0; *(uint8_t*)0x200021b9 = 0; *(uint8_t*)0x200021ba = 0; *(uint8_t*)0x200021bb = 0; *(uint8_t*)0x200021bc = 0; *(uint8_t*)0x200021bd = 0; *(uint8_t*)0x200021be = 0; *(uint8_t*)0x200021bf = 0; *(uint8_t*)0x200021c0 = 0; *(uint8_t*)0x200021c1 = 0; *(uint8_t*)0x200021c2 = 0; *(uint8_t*)0x200021c3 = 0; *(uint8_t*)0x200021c4 = 0; *(uint8_t*)0x200021c5 = 0; *(uint8_t*)0x200021c6 = 0; *(uint8_t*)0x200021c7 = 0; *(uint8_t*)0x200021c8 = 0; *(uint8_t*)0x200021c9 = 0; *(uint8_t*)0x200021ca = 0; *(uint8_t*)0x200021cb = 0; *(uint8_t*)0x200021cc = 0; *(uint8_t*)0x200021cd = 0; *(uint8_t*)0x200021ce = 0; *(uint8_t*)0x200021cf = 0; *(uint8_t*)0x200021d0 = 0; *(uint8_t*)0x200021d1 = 0; *(uint8_t*)0x200021d2 = 0; *(uint8_t*)0x200021d3 = 0; *(uint8_t*)0x200021d4 = 0; *(uint8_t*)0x200021d5 = 0; *(uint8_t*)0x200021d6 = 0; *(uint8_t*)0x200021d7 = 0; *(uint8_t*)0x200021d8 = 0; *(uint8_t*)0x200021d9 = 0; *(uint8_t*)0x200021da = 0; *(uint8_t*)0x200021db = 0; *(uint8_t*)0x200021dc = 0; *(uint8_t*)0x200021dd = 0; *(uint8_t*)0x200021de = 0; *(uint8_t*)0x200021df = 0; *(uint8_t*)0x200021e0 = 0; *(uint8_t*)0x200021e1 = 0; *(uint8_t*)0x200021e2 = 0; *(uint8_t*)0x200021e3 = 0; *(uint8_t*)0x200021e4 = 0; *(uint8_t*)0x200021e5 = 0; *(uint8_t*)0x200021e6 = 0; *(uint8_t*)0x200021e7 = 0; *(uint8_t*)0x200021e8 = 0; *(uint8_t*)0x200021e9 = 0; *(uint8_t*)0x200021ea = 0; *(uint8_t*)0x200021eb = 0; *(uint8_t*)0x200021ec = 0; *(uint8_t*)0x200021ed = 0; *(uint8_t*)0x200021ee = 0; *(uint8_t*)0x200021ef = 0; *(uint8_t*)0x200021f0 = 0; *(uint8_t*)0x200021f1 = 0; *(uint8_t*)0x200021f2 = 0; *(uint8_t*)0x200021f3 = 0; *(uint32_t*)0x200021f4 = 0; *(uint16_t*)0x200021f8 = 0x70; *(uint16_t*)0x200021fa = 0xb8; *(uint32_t*)0x200021fc = 0; *(uint64_t*)0x20002200 = 0; *(uint64_t*)0x20002208 = 0; *(uint16_t*)0x20002210 = 0x48; memcpy((void*)0x20002212, "\x54\x45\x45\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x2000222f = 1; *(uint32_t*)0x20002230 = htobe32(0x7f000001); *(uint8_t*)0x20002240 = 0x73; *(uint8_t*)0x20002241 = 0x79; *(uint8_t*)0x20002242 = 0x7a; *(uint8_t*)0x20002243 = 0; *(uint8_t*)0x20002244 = 0; *(uint64_t*)0x20002250 = 0; *(uint32_t*)0x20002258 = htobe32(0); *(uint8_t*)0x2000225c = 0xac; *(uint8_t*)0x2000225d = 0x14; *(uint8_t*)0x2000225e = 0; *(uint8_t*)0x2000225f = 0xbb; *(uint32_t*)0x20002260 = htobe32(0); *(uint32_t*)0x20002264 = htobe32(0); memcpy((void*)0x20002268, "\xea\x06\xa2\x8f\x44\x7c\xd3\x66\xb4\xdb\x6f\x4f\x4a\x2d\x3f\x92", 16); *(uint8_t*)0x20002278 = 0x73; *(uint8_t*)0x20002279 = 0x79; *(uint8_t*)0x2000227a = 0x7a; *(uint8_t*)0x2000227b = 0; *(uint8_t*)0x2000227c = 0; *(uint8_t*)0x20002288 = 0; *(uint8_t*)0x20002289 = 0; *(uint8_t*)0x2000228a = 0; *(uint8_t*)0x2000228b = 0; *(uint8_t*)0x2000228c = 0; *(uint8_t*)0x2000228d = 0; *(uint8_t*)0x2000228e = 0; *(uint8_t*)0x2000228f = 0; *(uint8_t*)0x20002290 = 0; *(uint8_t*)0x20002291 = 0; *(uint8_t*)0x20002292 = 0; *(uint8_t*)0x20002293 = 0; *(uint8_t*)0x20002294 = 0; *(uint8_t*)0x20002295 = 0; *(uint8_t*)0x20002296 = 0; *(uint8_t*)0x20002297 = 0; *(uint8_t*)0x20002298 = 0; *(uint8_t*)0x20002299 = 0; *(uint8_t*)0x2000229a = 0; *(uint8_t*)0x2000229b = 0; *(uint8_t*)0x2000229c = 0; *(uint8_t*)0x2000229d = 0; *(uint8_t*)0x2000229e = 0; *(uint8_t*)0x2000229f = 0; *(uint8_t*)0x200022a0 = 0; *(uint8_t*)0x200022a1 = 0; *(uint8_t*)0x200022a2 = 0; *(uint8_t*)0x200022a3 = 0; *(uint8_t*)0x200022a4 = 0; *(uint8_t*)0x200022a5 = 0; *(uint8_t*)0x200022a6 = 0; *(uint8_t*)0x200022a7 = 0; *(uint16_t*)0x200022a8 = 0; *(uint8_t*)0x200022aa = 0; *(uint8_t*)0x200022ab = 0; *(uint32_t*)0x200022ac = 0; *(uint16_t*)0x200022b0 = 0x70; *(uint16_t*)0x200022b2 = 0xa8; *(uint32_t*)0x200022b4 = 0; *(uint64_t*)0x200022b8 = 0; *(uint64_t*)0x200022c0 = 0; *(uint16_t*)0x200022c8 = 0x38; memcpy((void*)0x200022ca, "\x44\x4e\x41\x54\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x200022e7 = 0; *(uint32_t*)0x200022e8 = 1; *(uint32_t*)0x200022ec = 0; *(uint32_t*)0x200022f0 = htobe32(0xe0000002); *(uint32_t*)0x200022f4 = htobe32(0); *(uint16_t*)0x200022f8 = 0; *(uint16_t*)0x200022fa = 0; *(uint64_t*)0x20003000 = 0; *(uint64_t*)0x20003008 = 0; *(uint64_t*)0x20003010 = 0; *(uint64_t*)0x20003018 = 0; *(uint64_t*)0x20003020 = 0; *(uint64_t*)0x20003028 = 0; *(uint64_t*)0x20003030 = 0; *(uint64_t*)0x20003038 = 0; syscall(__NR_setsockopt, r[1], 0, 0x40, 0x20002000, 0x300); } int main() { loop(); return 0; }