// https://syzkaller.appspot.com/bug?id=e4ffb8b46d363add6bfda13799cc0b0f81af4b60 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 0x11ul, 0x800000003ul, 0); if (res != -1) r[0] = res; *(uint16_t*)0x20000080 = 0x11; memcpy((void*)0x20000082, "\x00\x00\x01\x00\x00\x00\x00\x00\x08\x00\x44\x94\x4e\xeb\xa7\x1a\x49" "\x76\xe2\x52\x92\x2c\xb1\x8f\x6e\x2e\x2a\xba\x00\x00\x00\x01\x2e\x0b" "\x38\x36\x00\x54\x04\xb0\xe0\x30\x1a\x4c\xe8\x75\xf2\xe3\xff\x5f\x16" "\x3e\xe3\x40\xb7\x67\x95\x00\x80\x00\x00\x00\x00\x00\x00\x01\x01\x01" "\x3c\x58\x11\x03\x9e\x15\x77\x50\x27\xec\xce\x66\xfd\x79\x2b\xbf\x0e" "\x5b\xf5\xff\x1b\x08\x16\xf3\xf6\xdb\x1c\x00\x01\x00\x00\x00\x00\x00" "\x00\x00\x49\x74\x00\x00\x00\x00\x00\x00\x00\x06\xad\x8e\x5e\xcc\x32" "\x6d\x3a\x09\xff\xc2\xc6\x54", 126); syscall(__NR_bind, r[0], 0x20000080ul, 0x80ul); *(uint32_t*)0x20000000 = 0x14; res = syscall(__NR_getsockname, r[0], 0x200003c0ul, 0x20000000ul); if (res != -1) r[1] = *(uint32_t*)0x200003c4; res = syscall(__NR_socket, 0x10ul, 3ul, 0); if (res != -1) r[2] = res; *(uint64_t*)0x20000800 = 0; *(uint32_t*)0x20000808 = 0; *(uint64_t*)0x20000810 = 0x20000780; *(uint64_t*)0x20000780 = 0x20000ac0; *(uint32_t*)0x20000ac0 = 0x45c; *(uint16_t*)0x20000ac4 = 0x24; *(uint16_t*)0x20000ac6 = 0xf0b; *(uint32_t*)0x20000ac8 = 0; *(uint32_t*)0x20000acc = 0; *(uint8_t*)0x20000ad0 = 0; *(uint8_t*)0x20000ad1 = 0; *(uint16_t*)0x20000ad2 = 0; *(uint32_t*)0x20000ad4 = r[1]; *(uint16_t*)0x20000ad8 = 0; *(uint16_t*)0x20000ada = 0; *(uint16_t*)0x20000adc = -1; *(uint16_t*)0x20000ade = -1; *(uint16_t*)0x20000ae0 = 0; *(uint16_t*)0x20000ae2 = 0; *(uint16_t*)0x20000ae4 = 8; *(uint16_t*)0x20000ae6 = 1; memcpy((void*)0x20000ae8, "tbf\000", 4); *(uint16_t*)0x20000aec = 0x430; *(uint16_t*)0x20000aee = 2; *(uint16_t*)0x20000af0 = 0x28; *(uint16_t*)0x20000af2 = 1; *(uint8_t*)0x20000af4 = 0x81; *(uint8_t*)0x20000af5 = 0; *(uint16_t*)0x20000af6 = 0; *(uint16_t*)0x20000af8 = 0; *(uint16_t*)0x20000afa = 0; *(uint32_t*)0x20000afc = 6; *(uint8_t*)0x20000b00 = 0; *(uint8_t*)0x20000b01 = 0; *(uint16_t*)0x20000b02 = 0; *(uint16_t*)0x20000b04 = 0; *(uint16_t*)0x20000b06 = 0; *(uint32_t*)0x20000b08 = 0; *(uint32_t*)0x20000b0c = 0; *(uint32_t*)0x20000b10 = 0; *(uint32_t*)0x20000b14 = 0; *(uint16_t*)0x20000b18 = 0x404; *(uint16_t*)0x20000b1a = 2; *(uint32_t*)0x20000b1c = 0; *(uint32_t*)0x20000b20 = 0; *(uint32_t*)0x20000b24 = 0; *(uint32_t*)0x20000b28 = 0; *(uint32_t*)0x20000b2c = 0; *(uint32_t*)0x20000b30 = 0; *(uint32_t*)0x20000b34 = 0; *(uint32_t*)0x20000b38 = 0; *(uint32_t*)0x20000b3c = 0; *(uint32_t*)0x20000b40 = 0; *(uint32_t*)0x20000b44 = 0; *(uint32_t*)0x20000b48 = 0; *(uint32_t*)0x20000b4c = 0; *(uint32_t*)0x20000b50 = 0; *(uint32_t*)0x20000b54 = 0; *(uint32_t*)0x20000b58 = 0; *(uint32_t*)0x20000b5c = 0; *(uint32_t*)0x20000b60 = 0; *(uint32_t*)0x20000b64 = 0; *(uint32_t*)0x20000b68 = 0; *(uint32_t*)0x20000b6c = 0; *(uint32_t*)0x20000b70 = 0; *(uint32_t*)0x20000b74 = 0; *(uint32_t*)0x20000b78 = 0; *(uint32_t*)0x20000b7c = 0; *(uint32_t*)0x20000b80 = 0; *(uint32_t*)0x20000b84 = 0; *(uint32_t*)0x20000b88 = 0; *(uint32_t*)0x20000b8c = 0; *(uint32_t*)0x20000b90 = 0; *(uint32_t*)0x20000b94 = 0; *(uint32_t*)0x20000b98 = 0; *(uint32_t*)0x20000b9c = 0; *(uint32_t*)0x20000ba0 = 0; *(uint32_t*)0x20000ba4 = 0; *(uint32_t*)0x20000ba8 = 0; *(uint32_t*)0x20000bac = 0; *(uint32_t*)0x20000bb0 = 0; *(uint32_t*)0x20000bb4 = 0; *(uint32_t*)0x20000bb8 = 0; *(uint32_t*)0x20000bbc = 0; *(uint32_t*)0x20000bc0 = 0; *(uint32_t*)0x20000bc4 = 0; *(uint32_t*)0x20000bc8 = 0; *(uint32_t*)0x20000bcc = 0; *(uint32_t*)0x20000bd0 = 0; *(uint32_t*)0x20000bd4 = 0; *(uint32_t*)0x20000bd8 = 0; *(uint32_t*)0x20000bdc = 0; *(uint32_t*)0x20000be0 = 0; *(uint32_t*)0x20000be4 = 0; *(uint32_t*)0x20000be8 = 0; *(uint32_t*)0x20000bec = 0; *(uint32_t*)0x20000bf0 = 0; *(uint32_t*)0x20000bf4 = 0; *(uint32_t*)0x20000bf8 = 0; *(uint32_t*)0x20000bfc = 0; *(uint32_t*)0x20000c00 = 0; *(uint32_t*)0x20000c04 = 0; *(uint32_t*)0x20000c08 = 0; *(uint32_t*)0x20000c0c = 0; *(uint32_t*)0x20000c10 = 0; *(uint32_t*)0x20000c14 = 0; *(uint32_t*)0x20000c18 = 0; *(uint32_t*)0x20000c1c = 0; *(uint32_t*)0x20000c20 = 0; *(uint32_t*)0x20000c24 = 0; *(uint32_t*)0x20000c28 = 0; *(uint32_t*)0x20000c2c = 0; *(uint32_t*)0x20000c30 = 0; *(uint32_t*)0x20000c34 = 0; *(uint32_t*)0x20000c38 = 0; *(uint32_t*)0x20000c3c = 0; *(uint32_t*)0x20000c40 = 0; *(uint32_t*)0x20000c44 = 0; *(uint32_t*)0x20000c48 = 0; *(uint32_t*)0x20000c4c = 0; *(uint32_t*)0x20000c50 = 0; *(uint32_t*)0x20000c54 = 0; *(uint32_t*)0x20000c58 = 0; *(uint32_t*)0x20000c5c = 0; *(uint32_t*)0x20000c60 = 0; *(uint32_t*)0x20000c64 = 0; *(uint32_t*)0x20000c68 = 0; *(uint32_t*)0x20000c6c = 0; *(uint32_t*)0x20000c70 = 0; *(uint32_t*)0x20000c74 = 0; *(uint32_t*)0x20000c78 = 0; *(uint32_t*)0x20000c7c = 0; *(uint32_t*)0x20000c80 = 0; *(uint32_t*)0x20000c84 = 0; *(uint32_t*)0x20000c88 = 0; *(uint32_t*)0x20000c8c = 0; *(uint32_t*)0x20000c90 = 0; *(uint32_t*)0x20000c94 = 0; *(uint32_t*)0x20000c98 = 0; *(uint32_t*)0x20000c9c = 0; *(uint32_t*)0x20000ca0 = 0; *(uint32_t*)0x20000ca4 = 0; *(uint32_t*)0x20000ca8 = 0; *(uint32_t*)0x20000cac = 0; *(uint32_t*)0x20000cb0 = 0; *(uint32_t*)0x20000cb4 = 0; *(uint32_t*)0x20000cb8 = 0; *(uint32_t*)0x20000cbc = 0; *(uint32_t*)0x20000cc0 = 0; *(uint32_t*)0x20000cc4 = 0; *(uint32_t*)0x20000cc8 = 0; *(uint32_t*)0x20000ccc = 0; *(uint32_t*)0x20000cd0 = 0; *(uint32_t*)0x20000cd4 = 0; *(uint32_t*)0x20000cd8 = 0; *(uint32_t*)0x20000cdc = 0; *(uint32_t*)0x20000ce0 = 0; *(uint32_t*)0x20000ce4 = 0; *(uint32_t*)0x20000ce8 = 0; *(uint32_t*)0x20000cec = 0; *(uint32_t*)0x20000cf0 = 0; *(uint32_t*)0x20000cf4 = 0; *(uint32_t*)0x20000cf8 = 0; *(uint32_t*)0x20000cfc = 0; *(uint32_t*)0x20000d00 = 0; *(uint32_t*)0x20000d04 = 0; *(uint32_t*)0x20000d08 = 0; *(uint32_t*)0x20000d0c = 0; *(uint32_t*)0x20000d10 = 0; *(uint32_t*)0x20000d14 = 0; *(uint32_t*)0x20000d18 = 0; *(uint32_t*)0x20000d1c = 0; *(uint32_t*)0x20000d20 = 0; *(uint32_t*)0x20000d24 = 0; *(uint32_t*)0x20000d28 = 0; *(uint32_t*)0x20000d2c = 0; *(uint32_t*)0x20000d30 = 0; *(uint32_t*)0x20000d34 = 0; *(uint32_t*)0x20000d38 = 0; *(uint32_t*)0x20000d3c = 0; *(uint32_t*)0x20000d40 = 0; *(uint32_t*)0x20000d44 = 0; *(uint32_t*)0x20000d48 = 0; *(uint32_t*)0x20000d4c = 0; *(uint32_t*)0x20000d50 = 0; *(uint32_t*)0x20000d54 = 0; *(uint32_t*)0x20000d58 = 0; *(uint32_t*)0x20000d5c = 0; *(uint32_t*)0x20000d60 = 0; *(uint32_t*)0x20000d64 = 0; *(uint32_t*)0x20000d68 = 0; *(uint32_t*)0x20000d6c = 0; *(uint32_t*)0x20000d70 = 0; *(uint32_t*)0x20000d74 = 0; *(uint32_t*)0x20000d78 = 0; *(uint32_t*)0x20000d7c = 0; *(uint32_t*)0x20000d80 = 0; *(uint32_t*)0x20000d84 = 0; *(uint32_t*)0x20000d88 = 0; *(uint32_t*)0x20000d8c = 0; *(uint32_t*)0x20000d90 = 0; *(uint32_t*)0x20000d94 = 0; *(uint32_t*)0x20000d98 = 0; *(uint32_t*)0x20000d9c = 0; *(uint32_t*)0x20000da0 = 0; *(uint32_t*)0x20000da4 = 0; *(uint32_t*)0x20000da8 = 0; *(uint32_t*)0x20000dac = 0; *(uint32_t*)0x20000db0 = 0; *(uint32_t*)0x20000db4 = 0; *(uint32_t*)0x20000db8 = 0; *(uint32_t*)0x20000dbc = 0; *(uint32_t*)0x20000dc0 = 0; *(uint32_t*)0x20000dc4 = 0; *(uint32_t*)0x20000dc8 = 0; *(uint32_t*)0x20000dcc = 0; *(uint32_t*)0x20000dd0 = 0; *(uint32_t*)0x20000dd4 = 0; *(uint32_t*)0x20000dd8 = 0; *(uint32_t*)0x20000ddc = 0; *(uint32_t*)0x20000de0 = 0; *(uint32_t*)0x20000de4 = 0; *(uint32_t*)0x20000de8 = 0; *(uint32_t*)0x20000dec = 0; *(uint32_t*)0x20000df0 = 0; *(uint32_t*)0x20000df4 = 0; *(uint32_t*)0x20000df8 = 0; *(uint32_t*)0x20000dfc = 0; *(uint32_t*)0x20000e00 = 0; *(uint32_t*)0x20000e04 = 0; *(uint32_t*)0x20000e08 = 0; *(uint32_t*)0x20000e0c = 0; *(uint32_t*)0x20000e10 = 0; *(uint32_t*)0x20000e14 = 0; *(uint32_t*)0x20000e18 = 0; *(uint32_t*)0x20000e1c = 0; *(uint32_t*)0x20000e20 = 0; *(uint32_t*)0x20000e24 = 0; *(uint32_t*)0x20000e28 = 0; *(uint32_t*)0x20000e2c = 0; *(uint32_t*)0x20000e30 = 0; *(uint32_t*)0x20000e34 = 0; *(uint32_t*)0x20000e38 = 0; *(uint32_t*)0x20000e3c = 0; *(uint32_t*)0x20000e40 = 0; *(uint32_t*)0x20000e44 = 0; *(uint32_t*)0x20000e48 = 0; *(uint32_t*)0x20000e4c = 0; *(uint32_t*)0x20000e50 = 0; *(uint32_t*)0x20000e54 = 0; *(uint32_t*)0x20000e58 = 0; *(uint32_t*)0x20000e5c = 0; *(uint32_t*)0x20000e60 = 0; *(uint32_t*)0x20000e64 = 0; *(uint32_t*)0x20000e68 = 0; *(uint32_t*)0x20000e6c = 0; *(uint32_t*)0x20000e70 = 0; *(uint32_t*)0x20000e74 = 0; *(uint32_t*)0x20000e78 = 0; *(uint32_t*)0x20000e7c = 0; *(uint32_t*)0x20000e80 = 0; *(uint32_t*)0x20000e84 = 0; *(uint32_t*)0x20000e88 = 0; *(uint32_t*)0x20000e8c = 0; *(uint32_t*)0x20000e90 = 0; *(uint32_t*)0x20000e94 = 0; *(uint32_t*)0x20000e98 = 0; *(uint32_t*)0x20000e9c = 0; *(uint32_t*)0x20000ea0 = 0; *(uint32_t*)0x20000ea4 = 0; *(uint32_t*)0x20000ea8 = 0; *(uint32_t*)0x20000eac = 0; *(uint32_t*)0x20000eb0 = 0; *(uint32_t*)0x20000eb4 = 0; *(uint32_t*)0x20000eb8 = 0; *(uint32_t*)0x20000ebc = 0; *(uint32_t*)0x20000ec0 = 0; *(uint32_t*)0x20000ec4 = 0; *(uint32_t*)0x20000ec8 = 0; *(uint32_t*)0x20000ecc = 0; *(uint32_t*)0x20000ed0 = 0; *(uint32_t*)0x20000ed4 = 0; *(uint32_t*)0x20000ed8 = 0; *(uint32_t*)0x20000edc = 0; *(uint32_t*)0x20000ee0 = 0; *(uint32_t*)0x20000ee4 = 0; *(uint32_t*)0x20000ee8 = 0; *(uint32_t*)0x20000eec = 0; *(uint32_t*)0x20000ef0 = 0; *(uint32_t*)0x20000ef4 = 0; *(uint32_t*)0x20000ef8 = 0; *(uint32_t*)0x20000efc = 0; *(uint32_t*)0x20000f00 = 0; *(uint32_t*)0x20000f04 = 0; *(uint32_t*)0x20000f08 = 0; *(uint32_t*)0x20000f0c = 0; *(uint32_t*)0x20000f10 = 0; *(uint32_t*)0x20000f14 = 0; *(uint32_t*)0x20000f18 = 0; *(uint64_t*)0x20000788 = 0x45c; *(uint64_t*)0x20000818 = 1; *(uint64_t*)0x20000820 = 0; *(uint64_t*)0x20000828 = 0; *(uint32_t*)0x20000830 = 0; syscall(__NR_sendmsg, r[2], 0x20000800ul, 0ul); return 0; }