// https://syzkaller.appspot.com/bug?id=d76b65a985a4cbf10165b3cbb882f59a0ab090bd // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 0x10, 3, 0xc); if (res != -1) r[0] = res; *(uint32_t*)0x20000600 = 0x20000100; *(uint16_t*)0x20000100 = 0x10; *(uint16_t*)0x20000102 = 0; *(uint32_t*)0x20000104 = 0; *(uint32_t*)0x20000108 = 0; *(uint32_t*)0x20000604 = 0xc; *(uint32_t*)0x20000608 = 0x200005c0; *(uint32_t*)0x200005c0 = 0x20000240; *(uint32_t*)0x20000240 = 0x14; *(uint8_t*)0x20000244 = 0x10; *(uint8_t*)0x20000245 = 0; *(uint16_t*)0x20000246 = 0; *(uint32_t*)0x20000248 = 0; *(uint32_t*)0x2000024c = 0; *(uint8_t*)0x20000250 = 0; *(uint8_t*)0x20000251 = 0; *(uint16_t*)0x20000252 = htobe16(2); *(uint32_t*)0x200005c4 = 0x14; *(uint32_t*)0x2000060c = 1; *(uint32_t*)0x20000610 = 0; *(uint32_t*)0x20000614 = 0; *(uint32_t*)0x20000618 = 0; syscall(__NR_sendmsg, (long)r[0], 0x20000600, 0); return 0; }