// https://syzkaller.appspot.com/bug?id=8bf9a9a2638fc9e95348d4398decb1b5c80beecb // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[8]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xffc000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0xaul, 0x1ul, 0x0ul); r[2] = syscall(__NR_pipe, 0x20502ff8ul); if (r[2] != -1) r[3] = *(uint32_t*)0x20502ff8; if (r[2] != -1) r[4] = *(uint32_t*)0x20502ffc; memcpy((void*)0x208acf61, "\x34\x30\xf1\x18\x10\x95\xd1\xdb\x98\x03\x16\xfd\xef\x99\x91" "\xd9\x11\x45\x48\x42\xb9\x60\xd8\xc1\x7f\x7c\x47\x49\x32\xac" "\x09\xcf\x18\xf7\x53\xda\x88\xdc\x53\xa3\x7b\x0d\x3b\x78\x5d" "\x46\xb7\x49\x7b\x50\xf4\xb1\xde\x81\x52\xa2\xed\x9e\x16\x92" "\x79\xdc\x83\x11\xb5\x8c\x4a\xd6\xa0", 69); r[6] = syscall(__NR_write, r[4], 0x208acf61ul, 0x45ul); r[7] = syscall(__NR_splice, r[3], 0x0ul, r[1], 0x0ul, 0x800000004ul, 0x0ul); } int main() { loop(); return 0; }