// https://syzkaller.appspot.com/bug?id=3de498da587da7cad00d7bad74933671c97cafb6 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_STREAM*/ 1ul, /*proto=*/0, /*fds=*/0x20000140ul); if (res != -1) { r[0] = *(uint32_t*)0x20000140; r[1] = *(uint32_t*)0x20000144; } *(uint64_t*)0x200000c0 = 0; *(uint32_t*)0x200000c8 = 0; *(uint64_t*)0x200000d0 = 0; *(uint64_t*)0x200000d8 = 0; *(uint64_t*)0x200000e0 = 0x20000100; memcpy((void*)0x20000100, "\x28\x00\x00\x00\xff\xff\x00\x00\x01", 9); *(uint64_t*)0x200000e8 = 0x28; *(uint32_t*)0x200000f0 = 0; syscall(SYS_sendmsg, /*fd=*/r[1], /*msg=*/0x200000c0ul, /*f=*/0ul); *(uint64_t*)0x20000080 = 0; *(uint64_t*)0x20000088 = 0; syscall(SYS_setrlimit, /*res=RLIMIT_NOFILE*/ 8ul, /*rlim=*/0x20000080ul); *(uint64_t*)0x20000000 = 0; *(uint32_t*)0x20000008 = 0; *(uint64_t*)0x20000010 = 0; *(uint64_t*)0x20000018 = 0; *(uint64_t*)0x20000020 = 0x20000180; *(uint64_t*)0x20000028 = 0x58; *(uint32_t*)0x20000030 = 0; syscall(SYS_recvmsg, /*fd=*/r[0], /*msg=*/0x20000000ul, /*f=*/0ul); return 0; }