// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; syscall(__NR_epoll_create1, 0); res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20002580 = 0x20000080; *(uint16_t*)0x20000080 = 0x10; *(uint16_t*)0x20000082 = 0; *(uint32_t*)0x20000084 = 0; *(uint32_t*)0x20000088 = 0x4000; *(uint32_t*)0x20002588 = 0xc; *(uint64_t*)0x20002590 = 0x20002540; *(uint64_t*)0x20002540 = 0x20000100; *(uint32_t*)0x20000100 = 0x68; *(uint16_t*)0x20000104 = 0x14; *(uint16_t*)0x20000106 = 0x400; *(uint32_t*)0x20000108 = 0x70bd2b; *(uint32_t*)0x2000010c = 0x25dfdbfe; *(uint8_t*)0x20000110 = 0x1b; *(uint8_t*)0x20000111 = 0; *(uint16_t*)0x20000112 = 0; *(uint16_t*)0x20000114 = 8; *(uint16_t*)0x20000116 = 0x70; *(uint16_t*)0x20000118 = 4; *(uint16_t*)0x2000011a = 0x1c; *(uint16_t*)0x2000011c = 8; *(uint16_t*)0x2000011e = 0x37; *(uint32_t*)0x20000120 = htobe32(0); *(uint16_t*)0x20000124 = 0x18; *(uint16_t*)0x20000126 = 0x34; *(uint16_t*)0x20000128 = 0xc; *(uint16_t*)0x2000012a = 0x6c; *(uint64_t*)0x2000012c = 5; *(uint16_t*)0x20000134 = 8; *(uint16_t*)0x20000136 = 0x5d; *(uint32_t*)0x20000138 = htobe32(0x7f000001); *(uint16_t*)0x2000013c = 0x24; *(uint16_t*)0x2000013e = 3; *(uint16_t*)0x20000140 = 0xc; *(uint16_t*)0x20000142 = 0x8f; *(uint64_t*)0x20000144 = 7; *(uint16_t*)0x2000014c = 8; *(uint16_t*)0x2000014e = 0x25; memcpy((void*)0x20000150, "", 1); *(uint16_t*)0x20000154 = 8; *(uint16_t*)0x20000156 = 0x1d; *(uint32_t*)0x20000158 = 0; *(uint16_t*)0x2000015c = 4; *(uint16_t*)0x2000015e = 0x5b; *(uint16_t*)0x20000160 = 8; *(uint16_t*)0x20000162 = 0x70; *(uint32_t*)0x20000164 = htobe32(0x7f000001); *(uint64_t*)0x20002548 = 0x68; *(uint64_t*)0x20002598 = 1; *(uint64_t*)0x200025a0 = 0; *(uint64_t*)0x200025a8 = 0; *(uint32_t*)0x200025b0 = 0; syscall(__NR_sendmsg, r[0], 0x20002580, 0x20000801); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }