// https://syzkaller.appspot.com/bug?id=2809bbb59fca11eb37dda7ef11f4f820a1a40de1 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0x10, 3, 0); if (res != -1) r[0] = res; memcpy((void*)0x20000040, "dummy0\000\000\000\000\000\000\000\000\000\000", 16); *(uint32_t*)0x20000050 = 0; res = syscall(__NR_ioctl, r[0], 0x8933, 0x20000040); if (res != -1) r[1] = *(uint32_t*)0x20000050; *(uint64_t*)0x2000a000 = 0; *(uint32_t*)0x2000a008 = 0; *(uint64_t*)0x2000a010 = 0x20000080; *(uint64_t*)0x20000080 = 0x20000280; memcpy((void*)0x20000280, "\x38\x00\x00\x00\x13\x00\x01\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 20); *(uint32_t*)0x20000294 = r[1]; memcpy((void*)0x20000298, "\xff\xff\xff\xfa\x00\x00\x00\x00\x18\x00\x16\x00\x14\x00\x01\x00\x10" "\x00\x02\x00\x00\x00\x00\xae\xfd\x02\x00\x1b\x00\x21\x15\x96\x05\xfd" "\x22\x15\x80\x15\xf7\x60\x4f\xdf\xa7\x96\x14\x45\x42\x56\xc6\x9c\xf2" "\xfb\x3b\x34\x80\x39\x10\x2e\xd8\xb9\xf1\xf4\xe1\x7d\x61\xad\x0f\xae" "\x6b\xb0\x47\x85\xf1\xef\x5c\x8c\xa4\xd9\xd2\x17\xf5\x0d\x03\x61\x98" "\x52\x54\xee\x4e\x98\xaf\x7d\xcf\x72\x63\xf1\x0e\x74\x25\x8a\x7f\xa5" "\xbb\x0b\x67\xed\x13\xe6\x2f\x9b\x0e\xf7\x6e\xb5\xa5\x08\xf2\x70\xba" "\x0b\x0b\x6f\xec\x11\x45\x74\x34\x79\x44\x25\xeb\x37\xe1\x97\x57\x2c" "\xd1\xe3\x3a\xb7\x0e\xfe\x3d\x13\xf6\xb2\xc8\xe7\x09\x5d\x2d\x8a\x8d" "\xe9\x7a\x0d\x8e\x10\x92\x59\xe6\x5c\x06\x00\x3e\xcc\x10\xc1\xad\x23" "\xc0\x2a\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x68\xd8\xc8\xc3\x20" "\x62\xc2\x79\x6f\xf3\xf2\xa6\x65\x9a\x51\xaa\xad\xe6\xca\x70\x3e\x50" "\xcf\x76\xbc\x54\x4e\x80\xa2\xf9\x24\xa6\x5e\xff\x5e\x87\x69\x74\x34" "\x5b\x6d\x7d\x35\x50\x97\x63\x5a\x42\xb4\x17\x84\x23\xb5\x65\xec\x84" "\xf2\x2e\xf9\xca\x36\x15\x91\x97\xc3\x68\xe2\xf3\x15\x34\xbf\x73\x6f" "\x14\x0d\x28\x8c\x3e\x07\xd3\xc2\x77\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00", 276); *(uint64_t*)0x20000088 = 0x38; *(uint64_t*)0x2000a018 = 1; *(uint64_t*)0x2000a020 = 0; *(uint64_t*)0x2000a028 = 0; *(uint32_t*)0x2000a030 = 0; syscall(__NR_sendmsg, r[0], 0x2000a000, 0); return 0; }