// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20003f00 = 0x20000980; *(uint16_t*)0x20000980 = 0x11; *(uint16_t*)0x20000982 = htobe16(1); *(uint32_t*)0x20000984 = 0; *(uint16_t*)0x20000988 = 1; *(uint8_t*)0x2000098a = 2; *(uint8_t*)0x2000098b = 6; memcpy((void*)0x2000098c, "\x2b\x07\x32\x28\xaa\x56", 6); *(uint8_t*)0x20000992 = 0; *(uint8_t*)0x20000993 = 0; *(uint32_t*)0x20003f08 = 0x80; *(uint64_t*)0x20003f10 = 0x20002a80; *(uint64_t*)0x20002a80 = 0x20000a00; *(uint64_t*)0x20002a88 = 0; *(uint64_t*)0x20002a90 = 0x20001a00; *(uint64_t*)0x20002a98 = 0; *(uint64_t*)0x20002aa0 = 0x20001a80; *(uint64_t*)0x20002aa8 = 0; *(uint64_t*)0x20003f18 = 3; *(uint64_t*)0x20003f20 = 0x20002ac0; *(uint64_t*)0x20003f28 = 0; *(uint32_t*)0x20003f30 = 0x20000004; syscall(__NR_sendmsg, r[0], 0x20003f00, 0x20000084); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }