// https://syzkaller.appspot.com/bug?id=71d19ff127410a28ebb96c74e20dcc5dd0476fb8 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 0x10); *(uint32_t*)0x2038bfc8 = 0x20d49ff4; *(uint32_t*)0x2038bfcc = 0xc; *(uint32_t*)0x2038bfd0 = 0x20007000; *(uint32_t*)0x2038bfd4 = 1; *(uint32_t*)0x2038bfd8 = 0; *(uint32_t*)0x2038bfdc = 0; *(uint32_t*)0x2038bfe0 = 0; *(uint16_t*)0x20d49ff4 = 0x10; *(uint16_t*)0x20d49ff6 = 0; *(uint32_t*)0x20d49ff8 = 0; *(uint32_t*)0x20d49ffc = 0; *(uint32_t*)0x20007000 = 0x20d64000; *(uint32_t*)0x20007004 = 0x28; *(uint32_t*)0x20d64000 = 0x28; *(uint16_t*)0x20d64004 = 0x1c; *(uint16_t*)0x20d64006 = 0x109; *(uint32_t*)0x20d64008 = 0; *(uint32_t*)0x20d6400c = 0; *(uint8_t*)0x20d64010 = 4; *(uint8_t*)0x20d64011 = 0; *(uint16_t*)0x20d64012 = 0; *(uint16_t*)0x20d64014 = 0x14; *(uint16_t*)0x20d64016 = 9; *(uint16_t*)0x20d64018 = 0x10; *(uint16_t*)0x20d6401a = 0x67; *(uint64_t*)0x20d64020 = 0x81; syscall(__NR_sendmsg, r[0], 0x2038bfc8, 0); } int main() { loop(); return 0; }