// https://syzkaller.appspot.com/bug?id=7bd6fc42489ba2eb2a9e44977633abd1c2fe0624 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } struct csum_inet { uint32_t acc; }; static void csum_inet_init(struct csum_inet* csum) { csum->acc = 0; } static void csum_inet_update(struct csum_inet* csum, const uint8_t* data, size_t length) { if (length == 0) return; size_t i; for (i = 0; i < length - 1; i += 2) csum->acc += *(uint16_t*)&data[i]; if (length & 1) csum->acc += (uint16_t)data[length - 1]; while (csum->acc > 0xffff) csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16); } static uint16_t csum_inet_digest(struct csum_inet* csum) { return ~csum->acc; } long r[130]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x2ul, 0x3ul, 0x4ul); *(uint32_t*)0x20000000 = (uint32_t)0x0; *(uint8_t*)0x20000010 = (uint8_t)0xac; *(uint8_t*)0x20000011 = (uint8_t)0x14; *(uint8_t*)0x20000012 = (uint8_t)0x0; *(uint8_t*)0x20000013 = (uint8_t)0xbb; *(uint16_t*)0x20000020 = (uint16_t)0x204e; *(uint16_t*)0x20000022 = (uint16_t)0x0; *(uint16_t*)0x20000024 = (uint16_t)0x204e; *(uint16_t*)0x20000026 = (uint16_t)0x0; *(uint16_t*)0x20000028 = (uint16_t)0x2; *(uint8_t*)0x2000002a = (uint8_t)0x0; *(uint8_t*)0x2000002b = (uint8_t)0x0; *(uint8_t*)0x2000002c = (uint8_t)0x0; *(uint32_t*)0x20000030 = (uint32_t)0x0; *(uint32_t*)0x20000034 = (uint32_t)0x0; *(uint64_t*)0x20000038 = (uint64_t)0x0; *(uint64_t*)0x20000040 = (uint64_t)0x0; *(uint64_t*)0x20000048 = (uint64_t)0xfffffffffffffffc; *(uint64_t*)0x20000050 = (uint64_t)0x0; *(uint64_t*)0x20000058 = (uint64_t)0x0; *(uint64_t*)0x20000060 = (uint64_t)0x0; *(uint64_t*)0x20000068 = (uint64_t)0x0; *(uint64_t*)0x20000070 = (uint64_t)0x0; *(uint64_t*)0x20000078 = (uint64_t)0x0; *(uint64_t*)0x20000080 = (uint64_t)0x0; *(uint64_t*)0x20000088 = (uint64_t)0x0; *(uint64_t*)0x20000090 = (uint64_t)0x0; *(uint32_t*)0x20000098 = (uint32_t)0x0; *(uint32_t*)0x2000009c = (uint32_t)0x0; *(uint8_t*)0x200000a0 = (uint8_t)0x1; *(uint8_t*)0x200000a1 = (uint8_t)0x0; *(uint8_t*)0x200000a2 = (uint8_t)0x0; *(uint8_t*)0x200000a3 = (uint8_t)0x0; *(uint64_t*)0x200000a8 = (uint64_t)0x0; *(uint64_t*)0x200000b0 = (uint64_t)0x100000000000000; *(uint32_t*)0x200000b8 = (uint32_t)0x0; *(uint8_t*)0x200000bc = (uint8_t)0x81; *(uint16_t*)0x200000c0 = (uint16_t)0xa; *(uint64_t*)0x200000c4 = (uint64_t)0x0; *(uint64_t*)0x200000cc = (uint64_t)0x100000000000000; *(uint32_t*)0x200000d4 = (uint32_t)0x8000000; *(uint8_t*)0x200000d8 = (uint8_t)0x0; *(uint8_t*)0x200000d9 = (uint8_t)0x0; *(uint8_t*)0x200000da = (uint8_t)0x0; *(uint32_t*)0x200000dc = (uint32_t)0x0; *(uint32_t*)0x200000e0 = (uint32_t)0x0; *(uint32_t*)0x200000e4 = (uint32_t)0x0; r[49] = syscall(__NR_setsockopt, r[1], 0x0ul, 0x11ul, 0x20000000ul, 0xe8ul); *(uint16_t*)0x2000e000 = (uint16_t)0x2; *(uint16_t*)0x2000e002 = (uint16_t)0x204e; *(uint8_t*)0x2000e004 = (uint8_t)0xac; *(uint8_t*)0x2000e005 = (uint8_t)0x14; *(uint8_t*)0x2000e006 = (uint8_t)0x0; *(uint8_t*)0x2000e007 = (uint8_t)0xaa; *(uint8_t*)0x2000e008 = (uint8_t)0x0; *(uint8_t*)0x2000e009 = (uint8_t)0x0; *(uint8_t*)0x2000e00a = (uint8_t)0x0; *(uint8_t*)0x2000e00b = (uint8_t)0x0; *(uint8_t*)0x2000e00c = (uint8_t)0x0; *(uint8_t*)0x2000e00d = (uint8_t)0x0; *(uint8_t*)0x2000e00e = (uint8_t)0x0; *(uint8_t*)0x2000e00f = (uint8_t)0x0; r[64] = syscall(__NR_sendto, r[1], 0x2089b000ul, 0x0ul, 0x0ul, 0x2000e000ul, 0x10ul); memcpy((void*)0x20e7e000, "\xef\xa1\x06\xa7\x29\x0c", 6); *(uint8_t*)0x20e7e006 = (uint8_t)0xaa; *(uint8_t*)0x20e7e007 = (uint8_t)0xaa; *(uint8_t*)0x20e7e008 = (uint8_t)0xaa; *(uint8_t*)0x20e7e009 = (uint8_t)0xaa; *(uint8_t*)0x20e7e00a = (uint8_t)0xaa; *(uint8_t*)0x20e7e00b = (uint8_t)0x0; *(uint16_t*)0x20e7e00c = (uint16_t)0x8; STORE_BY_BITMASK(uint8_t, 0x20e7e00e, 0x5, 0, 4); STORE_BY_BITMASK(uint8_t, 0x20e7e00e, 0x4, 4, 4); STORE_BY_BITMASK(uint8_t, 0x20e7e00f, 0x0, 0, 2); STORE_BY_BITMASK(uint8_t, 0x20e7e00f, 0xfffffffffffffffd, 2, 6); *(uint16_t*)0x20e7e010 = (uint16_t)0x5400; *(uint16_t*)0x20e7e012 = (uint16_t)0x6400; *(uint16_t*)0x20e7e014 = (uint16_t)0x0; *(uint8_t*)0x20e7e016 = (uint8_t)0x0; *(uint8_t*)0x20e7e017 = (uint8_t)0x400000000001; *(uint16_t*)0x20e7e018 = (uint16_t)0x0; *(uint8_t*)0x20e7e01a = (uint8_t)0xac; *(uint8_t*)0x20e7e01b = (uint8_t)0x14; *(uint8_t*)0x20e7e01c = (uint8_t)0x0; *(uint8_t*)0x20e7e01d = (uint8_t)0xbb; *(uint8_t*)0x20e7e01e = (uint8_t)0xac; *(uint8_t*)0x20e7e01f = (uint8_t)0x14; *(uint8_t*)0x20e7e020 = (uint8_t)0x0; *(uint8_t*)0x20e7e021 = (uint8_t)0xaa; *(uint8_t*)0x20e7e022 = (uint8_t)0x3; *(uint8_t*)0x20e7e023 = (uint8_t)0x0; *(uint16_t*)0x20e7e024 = (uint16_t)0x0; *(uint8_t*)0x20e7e026 = (uint8_t)0x0; *(uint8_t*)0x20e7e027 = (uint8_t)0x0; *(uint16_t*)0x20e7e028 = (uint16_t)0x0; STORE_BY_BITMASK(uint8_t, 0x20e7e02a, 0xe, 0, 4); STORE_BY_BITMASK(uint8_t, 0x20e7e02a, 0x4, 4, 4); STORE_BY_BITMASK(uint8_t, 0x20e7e02b, 0x6, 0, 2); STORE_BY_BITMASK(uint8_t, 0x20e7e02b, 0x0, 2, 6); *(uint16_t*)0x20e7e02c = (uint16_t)0x0; *(uint16_t*)0x20e7e02e = (uint16_t)0x6400; *(uint16_t*)0x20e7e030 = (uint16_t)0x0; *(uint8_t*)0x20e7e032 = (uint8_t)0x0; *(uint8_t*)0x20e7e033 = (uint8_t)0x6; *(uint16_t*)0x20e7e034 = (uint16_t)0x0; *(uint8_t*)0x20e7e036 = (uint8_t)0xac; *(uint8_t*)0x20e7e037 = (uint8_t)0x14; *(uint8_t*)0x20e7e038 = (uint8_t)0x0; *(uint8_t*)0x20e7e039 = (uint8_t)0xaa; *(uint32_t*)0x20e7e03a = (uint32_t)0x100007f; *(uint8_t*)0x20e7e03e = (uint8_t)0x89; *(uint8_t*)0x20e7e03f = (uint8_t)0x1b; *(uint8_t*)0x20e7e040 = (uint8_t)0x7fffffff; *(uint32_t*)0x20e7e041 = (uint32_t)0x0; *(uint32_t*)0x20e7e045 = (uint32_t)0x10000e0; *(uint32_t*)0x20e7e049 = (uint32_t)0xffffffff; *(uint8_t*)0x20e7e04d = (uint8_t)0xac; *(uint8_t*)0x20e7e04e = (uint8_t)0x14; *(uint8_t*)0x20e7e04f = (uint8_t)0x0; *(uint8_t*)0x20e7e050 = (uint8_t)0xaa; *(uint32_t*)0x20e7e051 = (uint32_t)0x0; *(uint32_t*)0x20e7e055 = (uint32_t)0x10000e0; *(uint8_t*)0x20e7e059 = (uint8_t)0x86; *(uint8_t*)0x20e7e05a = (uint8_t)0x6; *(uint32_t*)0x20e7e05b = (uint32_t)0x0; struct csum_inet csum_127; csum_inet_init(&csum_127); csum_inet_update(&csum_127, (const uint8_t*)0x20e7e022, 64); *(uint16_t*)0x20e7e024 = csum_inet_digest(&csum_127); struct csum_inet csum_128; csum_inet_init(&csum_128); csum_inet_update(&csum_128, (const uint8_t*)0x20e7e00e, 20); *(uint16_t*)0x20e7e018 = csum_inet_digest(&csum_128); } int main() { loop(); return 0; }