// https://syzkaller.appspot.com/bug?id=dfeb603a5afd6f34b6baff8292e5c168b1ed1fe0 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[16]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x20c76000, "\x2e\x64\x65\x61\x64\x00", 6); *(uint8_t*)0x203d1ffb = (uint8_t)0x73; *(uint8_t*)0x203d1ffc = (uint8_t)0x79; *(uint8_t*)0x203d1ffd = (uint8_t)0x7a; *(uint8_t*)0x203d1ffe = (uint8_t)0x23; *(uint8_t*)0x203d1fff = (uint8_t)0x0; memcpy((void*)0x20da8ffc, "\x65\x6d\x30\x00", 4); r[8] = syscall(__NR_request_key, 0x20c76000ul, 0x203d1ffbul, 0x20da8ffcul, 0xfffffffffffffffaul); memcpy((void*)0x20f4a000, "\x70\x6b\x63\x73\x37\x5f\x74\x65\x73\x74\x00", 11); *(uint8_t*)0x20f49ffb = (uint8_t)0x73; *(uint8_t*)0x20f49ffc = (uint8_t)0x79; *(uint8_t*)0x20f49ffd = (uint8_t)0x7a; *(uint8_t*)0x20f49ffe = (uint8_t)0x22; *(uint8_t*)0x20f49fff = (uint8_t)0x0; r[15] = syscall(__NR_add_key, 0x20f4a000ul, 0x20f49ffbul, 0x20000000ul, 0x0ul, r[8]); } int main() { loop(); return 0; }