// https://syzkaller.appspot.com/bug?id=263641babb7f77b96d3fd13670303e216edf87a3 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_sendto #define __NR_sendto 369 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xf01000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0xa, 2, 0); *(uint64_t*)0x206c3f18 = htobe64(0); *(uint64_t*)0x206c3f20 = htobe64(1); *(uint64_t*)0x206c3f28 = htobe64(0); *(uint64_t*)0x206c3f30 = htobe64(1); *(uint16_t*)0x206c3f38 = htobe16(0x4e20); *(uint16_t*)0x206c3f3a = 0; *(uint16_t*)0x206c3f3c = htobe16(0x4e20); *(uint16_t*)0x206c3f3e = 0; *(uint16_t*)0x206c3f40 = 0xa; *(uint8_t*)0x206c3f42 = 0; *(uint8_t*)0x206c3f43 = 0; *(uint8_t*)0x206c3f44 = 0; *(uint32_t*)0x206c3f48 = 0; *(uint32_t*)0x206c3f4c = 0; *(uint64_t*)0x206c3f50 = 0; *(uint64_t*)0x206c3f58 = 0; *(uint64_t*)0x206c3f60 = 0; *(uint64_t*)0x206c3f68 = 0; *(uint64_t*)0x206c3f70 = 0; *(uint64_t*)0x206c3f78 = 0; *(uint64_t*)0x206c3f80 = 0; *(uint64_t*)0x206c3f88 = 0; *(uint64_t*)0x206c3f90 = 0; *(uint64_t*)0x206c3f98 = 0; *(uint64_t*)0x206c3fa0 = 0; *(uint64_t*)0x206c3fa8 = 0; *(uint32_t*)0x206c3fb0 = 0; *(uint32_t*)0x206c3fb4 = 0; *(uint8_t*)0x206c3fb8 = 1; *(uint8_t*)0x206c3fb9 = 0; *(uint8_t*)0x206c3fba = 0; *(uint8_t*)0x206c3fbb = 0; *(uint32_t*)0x206c3fc0 = htobe32(0x7f000001); *(uint32_t*)0x206c3fd0 = 0; *(uint8_t*)0x206c3fd4 = 0; *(uint16_t*)0x206c3fd8 = 0; *(uint32_t*)0x206c3fdc = htobe32(-1); *(uint32_t*)0x206c3fec = 0; *(uint8_t*)0x206c3ff0 = 0; *(uint8_t*)0x206c3ff1 = 0; *(uint8_t*)0x206c3ff2 = 0; *(uint32_t*)0x206c3ff4 = 4; *(uint32_t*)0x206c3ff8 = 0; *(uint32_t*)0x206c3ffc = 0; syscall(__NR_setsockopt, r[0], 0x29, 0x23, 0x206c3f18, 0xe8); *(uint16_t*)0x20efc000 = 2; *(uint16_t*)0x20efc002 = htobe16(0x4e22); *(uint32_t*)0x20efc004 = htobe32(0); *(uint8_t*)0x20efc008 = 0; *(uint8_t*)0x20efc009 = 0; *(uint8_t*)0x20efc00a = 0; *(uint8_t*)0x20efc00b = 0; *(uint8_t*)0x20efc00c = 0; *(uint8_t*)0x20efc00d = 0; *(uint8_t*)0x20efc00e = 0; *(uint8_t*)0x20efc00f = 0; syscall(__NR_sendto, r[0], 0x20efcf90, 0, 0x4090, 0x20efc000, 0x10); } int main() { loop(); return 0; }