// https://syzkaller.appspot.com/bug?id=c0c9134d03b2a5beddd724cb46c1a2506ada5fe2 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; *(uint32_t*)0x20000040 = 0xc; *(uint32_t*)0x20000044 = 0xe; *(uint64_t*)0x20000048 = 0x20000140; memcpy((void*)0x20000140, "\xb7\x02\x00\x00\x00\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07" "\x01\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4" "\xf0\xff\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05" "\x00\x00\x00\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00" "\x01\x00\x00\x00\xb7\x05\x00\x00\x23\x00\x00\x00\x6a\x0a\x00\xfe\x00" "\x00\x00\x00\x85\x00\x00\x00\x0b\x00\x00\x00\xb7\x00\x00\x00\x00\x00" "\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00", 112); *(uint64_t*)0x20000050 = 0x20000000; memcpy((void*)0x20000000, "syzkaller", 10); *(uint32_t*)0x20000058 = 0; *(uint32_t*)0x2000005c = 0; *(uint64_t*)0x20000060 = 0; *(uint32_t*)0x20000068 = 0; *(uint32_t*)0x2000006c = 0; *(uint8_t*)0x20000070 = 0; *(uint8_t*)0x20000071 = 0; *(uint8_t*)0x20000072 = 0; *(uint8_t*)0x20000073 = 0; *(uint8_t*)0x20000074 = 0; *(uint8_t*)0x20000075 = 0; *(uint8_t*)0x20000076 = 0; *(uint8_t*)0x20000077 = 0; *(uint8_t*)0x20000078 = 0; *(uint8_t*)0x20000079 = 0; *(uint8_t*)0x2000007a = 0; *(uint8_t*)0x2000007b = 0; *(uint8_t*)0x2000007c = 0; *(uint8_t*)0x2000007d = 0; *(uint8_t*)0x2000007e = 0; *(uint8_t*)0x2000007f = 0; *(uint32_t*)0x20000080 = 0; *(uint32_t*)0x20000084 = 0; res = syscall(__NR_bpf, 5, 0x20000040, 0x48); if (res != -1) r[0] = res; *(uint32_t*)0x20000240 = r[0]; *(uint32_t*)0x20000244 = 0; *(uint32_t*)0x20000248 = 0x10; *(uint32_t*)0x2000024c = 0x58; *(uint64_t*)0x20000250 = 0x20000100; memcpy((void*)0x20000100, "\x19\x55\x32\x2b\x23\xa8\x84\xa2\x33\xcf\x8a\xd3\x57\x7a\x44\x13", 16); *(uint64_t*)0x20000258 = 0x200001c0; *(uint32_t*)0x20000260 = 0x7ff; *(uint32_t*)0x20000264 = 0; syscall(__NR_bpf, 0xa, 0x20000240, 0x28); return 0; }