// https://syzkaller.appspot.com/bug?id=33965bc983eb2f2b7897d86580995f82f74ceadf // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[4] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88); if (res != -1) r[0] = res; memcpy((void*)0x200006c0, "lo\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 16); res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x200006c0ul); if (res != -1) r[1] = *(uint32_t*)0x200006d0; res = syscall(__NR_socket, /*domain=AF_NETLINK*/ 0x10ul, /*type=SOCK_RAW*/ 3ul, /*proto=*/0); if (res != -1) r[2] = res; *(uint64_t*)0x200007c0 = 0; *(uint32_t*)0x200007c8 = 0; *(uint64_t*)0x200007d0 = 0x20000780; *(uint64_t*)0x20000780 = 0x20000080; *(uint32_t*)0x20000080 = 0x48; *(uint16_t*)0x20000084 = 0x24; *(uint16_t*)0x20000086 = 0xd0b; *(uint32_t*)0x20000088 = 0; *(uint32_t*)0x2000008c = 0; *(uint8_t*)0x20000090 = 0; *(uint8_t*)0x20000091 = 0; *(uint16_t*)0x20000092 = 0; *(uint32_t*)0x20000094 = r[1]; *(uint16_t*)0x20000098 = 0; *(uint16_t*)0x2000009a = 0; *(uint16_t*)0x2000009c = -1; *(uint16_t*)0x2000009e = -1; *(uint16_t*)0x200000a0 = 0; *(uint16_t*)0x200000a2 = 0; *(uint16_t*)0x200000a4 = 8; *(uint16_t*)0x200000a6 = 1; memcpy((void*)0x200000a8, "cbs\000", 4); *(uint16_t*)0x200000ac = 0x1c; *(uint16_t*)0x200000ae = 2; *(uint16_t*)0x200000b0 = 0x18; *(uint16_t*)0x200000b2 = 1; *(uint8_t*)0x200000b4 = 0; memset((void*)0x200000b5, 0, 3); *(uint32_t*)0x200000b8 = 0; *(uint32_t*)0x200000bc = 0; *(uint32_t*)0x200000c0 = 0; *(uint32_t*)0x200000c4 = 0; *(uint64_t*)0x20000788 = 0x48; *(uint64_t*)0x200007d8 = 1; *(uint64_t*)0x200007e0 = 0x8100000018000000; *(uint64_t*)0x200007e8 = 0; *(uint32_t*)0x200007f0 = 0; syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x200007c0ul, /*f=*/0ul); res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0); if (res != -1) r[3] = res; *(uint32_t*)0x20000000 = 0xbf; syscall(__NR_setsockopt, /*fd=*/r[3], /*level=*/6, /*optname=TCP_WINDOW_CLAMP*/ 0xa, /*optval=*/0x20000000ul, /*optlen=*/4ul); *(uint16_t*)0x20d84000 = 0xa; *(uint16_t*)0x20d84002 = htobe16(2); *(uint32_t*)0x20d84004 = htobe32(0); *(uint64_t*)0x20d84008 = htobe64(0); *(uint64_t*)0x20d84010 = htobe64(1); *(uint32_t*)0x20d84018 = 0; syscall(__NR_bind, /*fd=*/r[3], /*addr=*/0x20d84000ul, /*addrlen=*/0x1cul); *(uint32_t*)0x20000200 = 1; syscall(__NR_setsockopt, /*fd=*/r[3], /*level=*/6, /*optname=TCP_FASTOPEN_NO_COOKIE*/ 0x22, /*optval=*/0x20000200ul, /*optlen=*/4ul); memcpy((void*)0x200000c0, "\x04\x4a\xac\x2f\x20\x2c\x5f\xed\xa7\x1e\x03\x9a\x57\xa9\x30\x88\xfd" "\xcc\xe4\xaf\xe2\x8a\xac\x61\x83\x77\x92\x74\x1a\x19\x06\x70\xcc\xbe" "\x1a\x2b\x00\xaa\x77\xa8\x7d\x56\xa3\xf1\x2c\x79\x20\xad\x02\x92\x8a" "\x5d\x10\x14\xe5\xb8\x96\xf0\x00\xfc\xf6\x52\x19\x28\x48\x0b\xe9\xaf" "\x82\x61\x3a\x5c\x66\x1f\x41\x10\xad\xba\x35\x8a\xfd\x8b\x5b\x4e\xf1" "\x70\x20\x51\xe3\x93\xed\xe2\x69\x81\x12\xa1\xf1\xbd\xf1\xd0\xf5\x68" "\x54\x6e\xd3\x22\xab\x4c\x53\x54\x5b\xd2\xcd\x6e\x48\x52\x2f\x0c\x15" "\x4c\xb3\xc6\x86\x4d\xc3\x0a\xe9\x21\xdb\x10\x0f\x1e\xe9\x7a\x23\x45" "\x03\x33\x8f\x8f\xdf\x35\x64\x72\xda\x0c\x7a\xb6\x2f\x27\x4f\x34", 152); *(uint16_t*)0x20b63fe4 = 0xa; *(uint16_t*)0x20b63fe6 = htobe16(2); *(uint32_t*)0x20b63fe8 = htobe32(0); memset((void*)0x20b63fec, 0, 16); *(uint32_t*)0x20b63ffc = 0; syscall(__NR_sendto, /*fd=*/r[3], /*buf=*/0x200000c0ul, /*len=*/0x116d962d5f73552ul, /*f=MSG_FASTOPEN|MSG_OOB|MSG_DONTWAIT|MSG_DONTROUTE|MSG_CONFIRM*/ 0x20000845ul, /*addr=*/0x20b63fe4ul, /*addrlen=*/0x1cul); syscall(__NR_shutdown, /*fd=*/r[3], /*how=SHUT_WR*/ 1ul); *(uint64_t*)0x20000bc0 = 0; *(uint32_t*)0x20000bc8 = 0; *(uint64_t*)0x20000bd0 = 0x20000400; *(uint64_t*)0x20000400 = 0x20000c00; *(uint64_t*)0x20000408 = 0xd80; *(uint64_t*)0x20000bd8 = 1; *(uint64_t*)0x20000be0 = 0; *(uint64_t*)0x20000be8 = 0; *(uint32_t*)0x20000bf0 = 0; *(uint32_t*)0x20000bf8 = 0; syscall(__NR_recvmmsg, /*fd=*/r[3], /*mmsg=*/0x20000bc0ul, /*vlen=*/1ul, /*f=MSG_WAITALL|MSG_TRUNC|MSG_PEEK*/ 0x122ul, /*timeout=*/0ul); return 0; }