// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 6); *(uint64_t*)0x2000b000 = 0x205fe000; *(uint32_t*)0x2000b008 = 0xc; *(uint64_t*)0x2000b010 = 0x205a6ff0; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; *(uint16_t*)0x205fe000 = 0x10; *(uint16_t*)0x205fe002 = 0; *(uint32_t*)0x205fe004 = 0; *(uint32_t*)0x205fe008 = 0; *(uint64_t*)0x205a6ff0 = 0x20911eb4; *(uint64_t*)0x205a6ff8 = 0x148; *(uint32_t*)0x20911eb4 = 0x148; *(uint16_t*)0x20911eb8 = 0x10; *(uint16_t*)0x20911eba = 0x713; *(uint32_t*)0x20911ebc = 0; *(uint32_t*)0x20911ec0 = 0; *(uint8_t*)0x20911ec4 = -1; *(uint8_t*)0x20911ec5 = 1; *(uint8_t*)0x20911ec6 = 0; *(uint8_t*)0x20911ec7 = 0; *(uint8_t*)0x20911ec8 = 0; *(uint8_t*)0x20911ec9 = 0; *(uint8_t*)0x20911eca = 0; *(uint8_t*)0x20911ecb = 0; *(uint8_t*)0x20911ecc = 0; *(uint8_t*)0x20911ecd = 0; *(uint8_t*)0x20911ece = 0; *(uint8_t*)0x20911ecf = 0; *(uint8_t*)0x20911ed0 = 0; *(uint8_t*)0x20911ed1 = 0; *(uint8_t*)0x20911ed2 = 0; *(uint8_t*)0x20911ed3 = 1; *(uint64_t*)0x20911ed4 = htobe64(0); *(uint64_t*)0x20911edc = htobe64(1); *(uint16_t*)0x20911ee4 = 0; *(uint16_t*)0x20911ee6 = htobe16(0); *(uint16_t*)0x20911ee8 = 0; *(uint16_t*)0x20911eea = htobe16(0); *(uint16_t*)0x20911eec = 0; *(uint8_t*)0x20911eee = 0; *(uint8_t*)0x20911eef = 0; *(uint8_t*)0x20911ef0 = 0; *(uint32_t*)0x20911ef4 = 0; *(uint32_t*)0x20911ef8 = 0; *(uint32_t*)0x20911efc = htobe32(0); *(uint32_t*)0x20911f0c = 0; *(uint8_t*)0x20911f10 = 0x6c; *(uint64_t*)0x20911f14 = htobe64(0); *(uint64_t*)0x20911f1c = htobe64(1); *(uint64_t*)0x20911f24 = 0; *(uint64_t*)0x20911f2c = 0; *(uint64_t*)0x20911f34 = 0; *(uint64_t*)0x20911f3c = 0; *(uint64_t*)0x20911f44 = 0; *(uint64_t*)0x20911f4c = 0; *(uint64_t*)0x20911f54 = 0; *(uint64_t*)0x20911f5c = 0; *(uint64_t*)0x20911f64 = 0; *(uint64_t*)0x20911f6c = 0; *(uint64_t*)0x20911f74 = 0; *(uint64_t*)0x20911f7c = 0; *(uint32_t*)0x20911f84 = 0; *(uint32_t*)0x20911f88 = 0; *(uint32_t*)0x20911f8c = 0; *(uint32_t*)0x20911f90 = 0; *(uint32_t*)0x20911f94 = 0; *(uint16_t*)0x20911f98 = 2; *(uint8_t*)0x20911f9a = 0; *(uint8_t*)0x20911f9b = 0; *(uint8_t*)0x20911f9c = 0; *(uint16_t*)0x20911fa4 = 0x10; *(uint16_t*)0x20911fa6 = 0xa; *(uint32_t*)0x20911fa8 = 0; *(uint32_t*)0x20911fac = 0; *(uint32_t*)0x20911fb0 = 0; *(uint16_t*)0x20911fb4 = 0x48; *(uint16_t*)0x20911fb6 = 3; memcpy((void*)0x20911fb8, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x20911ff8 = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); } int main() { for (;;) { loop(); } }