// https://syzkaller.appspot.com/bug?id=1855ef8b2f9dbca23329412c936dc2ffeb6f32fb // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; res = syscall(__NR_socket, /*domain=*/0x26ul, /*type=*/5ul, /*proto=*/0); if (res != -1) r[0] = res; *(uint16_t*)0x20000e40 = 0x26; memcpy((void*)0x20000e42, "aead\000\000\000\000\000\000\000\000\000\000", 14); *(uint32_t*)0x20000e50 = 0; *(uint32_t*)0x20000e54 = 0; memcpy((void*)0x20000e58, "pcrypt(generic-gcm-aesni)" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000", 64); syscall(__NR_bind, /*fd=*/r[0], /*addr=*/0x20000e40ul, /*addrlen=*/0x58ul); res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0); if (res != -1) r[1] = res; *(uint32_t*)0x20000000 = 1; syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/6, /*optname=*/0x13, /*optval=*/0x20000000ul, /*optlen=*/4ul); *(uint16_t*)0x20000200 = 0xa; *(uint16_t*)0x20000202 = htobe16(0); *(uint32_t*)0x20000204 = htobe32(0); *(uint64_t*)0x20000208 = htobe64(0); *(uint64_t*)0x20000210 = htobe64(1); *(uint32_t*)0x20000218 = 0; syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x20000200ul, /*addrlen=*/0x1cul); memcpy((void*)0x200000c0, "tls\000", 4); syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/6, /*optname=*/0x1f, /*optval=*/0x200000c0ul, /*optlen=*/4ul); *(uint16_t*)0x20000080 = 0x304; *(uint16_t*)0x20000082 = 0x33; memcpy((void*)0x20000084, "\x83\x7a\xd5\x52\xee\xd2\x2b\x08", 8); memcpy((void*)0x2000008c, "\xa4\x61\x6b\xf4\x5c\x64\xc5\x00\x00\x00\x87\x8f\x00\x00\x00\x00", 16); memcpy((void*)0x2000009c, "ZD\000\b", 4); memset((void*)0x200000a0, 255, 8); syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/0x11a, /*optname=*/1, /*optval=*/0x20000080ul, /*optlen=*/0x28ul); memset((void*)0x20000240, 92, 1); syscall(__NR_write, /*fd=*/r[1], /*buf=*/0x20000240ul, /*count=*/1ul); return 0; }