// https://syzkaller.appspot.com/bug?id=7bd6fc42489ba2eb2a9e44977633abd1c2fe0624 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_sendto #define __NR_sendto 369 #endif #ifndef __NR_mmap #define __NR_mmap 90 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[60]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x2ul, 0x2ul, 0x0ul); *(uint32_t*)0x20000000 = (uint32_t)0x80; *(uint8_t*)0x20000010 = (uint8_t)0xac; *(uint8_t*)0x20000011 = (uint8_t)0x14; *(uint8_t*)0x20000012 = (uint8_t)0x0; *(uint8_t*)0x20000013 = (uint8_t)0xbb; *(uint16_t*)0x20000020 = (uint16_t)0x204e; *(uint16_t*)0x20000022 = (uint16_t)0x0; *(uint16_t*)0x20000024 = (uint16_t)0x214e; *(uint16_t*)0x20000026 = (uint16_t)0x0; *(uint16_t*)0x20000028 = (uint16_t)0x2; *(uint8_t*)0x2000002a = (uint8_t)0x0; *(uint8_t*)0x2000002b = (uint8_t)0x0; *(uint8_t*)0x2000002c = (uint8_t)0x0; *(uint32_t*)0x20000030 = (uint32_t)0x0; *(uint32_t*)0x20000034 = (uint32_t)0x0; *(uint64_t*)0x20000038 = (uint64_t)0x0; *(uint64_t*)0x20000040 = (uint64_t)0x0; *(uint64_t*)0x20000048 = (uint64_t)0x4; *(uint64_t*)0x20000050 = (uint64_t)0x0; *(uint64_t*)0x20000058 = (uint64_t)0x0; *(uint64_t*)0x20000060 = (uint64_t)0x0; *(uint64_t*)0x20000068 = (uint64_t)0x0; *(uint64_t*)0x20000070 = (uint64_t)0x0; *(uint64_t*)0x20000078 = (uint64_t)0x0; *(uint64_t*)0x20000080 = (uint64_t)0x0; *(uint64_t*)0x20000088 = (uint64_t)0x3; *(uint64_t*)0x20000090 = (uint64_t)0x0; *(uint32_t*)0x20000098 = (uint32_t)0x0; *(uint32_t*)0x2000009c = (uint32_t)0x1; *(uint8_t*)0x200000a0 = (uint8_t)0x1; *(uint8_t*)0x200000a1 = (uint8_t)0x0; *(uint8_t*)0x200000a2 = (uint8_t)0x0; *(uint8_t*)0x200000a3 = (uint8_t)0x0; *(uint32_t*)0x200000a8 = (uint32_t)0x1000000; *(uint32_t*)0x200000b8 = (uint32_t)0xfffffffffffffffe; *(uint8_t*)0x200000bc = (uint8_t)0x200000000000000; *(uint16_t*)0x200000c0 = (uint16_t)0xa; *(uint32_t*)0x200000c4 = (uint32_t)0x100007f; *(uint32_t*)0x200000d4 = (uint32_t)0x0; *(uint8_t*)0x200000d8 = (uint8_t)0x0; *(uint8_t*)0x200000d9 = (uint8_t)0x0; *(uint8_t*)0x200000da = (uint8_t)0x0; *(uint32_t*)0x200000dc = (uint32_t)0x0; *(uint32_t*)0x200000e0 = (uint32_t)0x2; *(uint32_t*)0x200000e4 = (uint32_t)0x0; r[47] = syscall(__NR_setsockopt, r[1], 0x0ul, 0x11ul, 0x20000000ul, 0xe8ul); *(uint16_t*)0x202f9000 = (uint16_t)0x2; *(uint16_t*)0x202f9002 = (uint16_t)0x204e; *(uint32_t*)0x202f9004 = (uint32_t)0x0; *(uint8_t*)0x202f9008 = (uint8_t)0x0; *(uint8_t*)0x202f9009 = (uint8_t)0x0; *(uint8_t*)0x202f900a = (uint8_t)0x0; *(uint8_t*)0x202f900b = (uint8_t)0x0; *(uint8_t*)0x202f900c = (uint8_t)0x0; *(uint8_t*)0x202f900d = (uint8_t)0x0; *(uint8_t*)0x202f900e = (uint8_t)0x0; *(uint8_t*)0x202f900f = (uint8_t)0x0; r[59] = syscall(__NR_sendto, r[1], 0x2010affeul, 0x0ul, 0x2004487cul, 0x202f9000ul, 0x10ul); } int main() { loop(); return 0; }