// https://syzkaller.appspot.com/bug?id=77e2cfee3bc0fdd3bcaf05ea83a9c26a59ddbf6c // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res; memcpy((void*)0x200001c0, "/dev/infiniband/rdma_cm", 24); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x200001c0, 2, 0); if (res != -1) r[0] = res; memcpy((void*)0x20000200, "\x00\x00\x00\x00\x18\x00\x00\xfa\xe7\x7c\x00\x51\xc6\xb5\x53\xe8\x45" "\x58\x0f\x0f\x4d\x56\x24\x3c\x02\x00\xf4\xff\xff\xff\x00\x00\xc1\x8b" "\x10\x15\x67\x8b\x42\xde\xb2\x4a\xbe\xa1\xb1\x48\x1a\xf3\x3f\xde\xde" "\xb1\x54\xbb\x02\xca\x54\x00\xca\x94\x6c\x83\x49\xe2\x6e\x87\x11\x05" "\x17\x40\x57\x65\x7e\x86\xc0\xc5\x51\x99\x00\x56\x1c\x00\x1d\x3a\x1c" "\xdb\x95\xe3\x5d\xe7\x0f\xbf\x63\x28\x0b\x64\x3d\x05\x25\xb1\xae\xef" "\x4a\x0b\x9d\x47\x2a\x9f\x09\xf4\x43\x73\x1b\x73\x45\x4e\x13\x66\x8c" "\xc9\x18\x23\xd4\x55\xd3\xde\x8f\xf8\x33\x20\xc0\x0c\xfb\xce\xff\xa7" "\x50\xd2\x36\x3f\x8d\xcb\x89\x4e\x6f\xf3\xe1\x06\x0b\x11\x78\x62\x3c" "\x00\xfe\xc8\x3e\x58\x7f\x8c\x81\xff\x4b\x13\xc5\xa1\xad\x6b\x39\xba" "\x21\x65\x5f\x0a\x0b\xb3\x50\xac\x7d\x66\x08\x8a\x62\xf1\x88\x10\x1d" "\xe7\xfd\x95\x91\x1d\xc5\x84\xd5\x79\x38\xf0\xca\xa0\x86\x48\x31\xdb" "\xec\xe4\xa6\x25\xc2\x70\xde\x23\x6d\x56\xc9\x50\xe5\x86\xf4\x01\x42" "\x88\xbc\xa7\xd4\xc4\x47\xb5\x0d\x22\xde\xa0\xae\x72\x97\xd4\x65\x70" "\xa9\x4f\xde\xef\x95\xa0\xc4\x03\x0c\x4d\x87\xf4\x01\x47\x7d\x5b", 254); *(uint64_t*)0x200002fe = 0x200029c0; *(uint32_t*)0x200029c0 = -1; syscall(__NR_write, r[0], 0x20000200, 0x106); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }