// https://syzkaller.appspot.com/bug?id=ae870e8c5da584612949f8de2e5fa5f3e3ea09a3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 0x10ul, 3ul, 6); if (res != -1) r[0] = res; *(uint64_t*)0x20000180 = 0; *(uint32_t*)0x20000188 = 0; *(uint64_t*)0x20000190 = 0x20000340; *(uint64_t*)0x20000340 = 0x200034c0; *(uint32_t*)0x200034c0 = 0x138; *(uint16_t*)0x200034c4 = 0x10; *(uint16_t*)0x200034c6 = 0x713; *(uint32_t*)0x200034c8 = 0; *(uint32_t*)0x200034cc = 0; *(uint8_t*)0x200034d0 = 0xfe; *(uint8_t*)0x200034d1 = 0x88; *(uint8_t*)0x200034d2 = 0; *(uint8_t*)0x200034d3 = 0; *(uint8_t*)0x200034d4 = 0; *(uint8_t*)0x200034d5 = 0; *(uint8_t*)0x200034d6 = 0; *(uint8_t*)0x200034d7 = 0; *(uint8_t*)0x200034d8 = 0; *(uint8_t*)0x200034d9 = 0; *(uint8_t*)0x200034da = 0; *(uint8_t*)0x200034db = 0; *(uint8_t*)0x200034dc = 0; *(uint8_t*)0x200034dd = 0; *(uint8_t*)0x200034de = 0; *(uint8_t*)0x200034df = 1; *(uint8_t*)0x200034e0 = 0xac; *(uint8_t*)0x200034e1 = 0x1e; *(uint8_t*)0x200034e2 = 0; *(uint8_t*)0x200034e3 = 1; *(uint16_t*)0x200034f0 = htobe16(0); *(uint16_t*)0x200034f2 = htobe16(0); *(uint16_t*)0x200034f4 = htobe16(0); *(uint16_t*)0x200034f6 = htobe16(0); *(uint16_t*)0x200034f8 = 0; *(uint8_t*)0x200034fa = 0; *(uint8_t*)0x200034fb = 0; *(uint8_t*)0x200034fc = 0; *(uint32_t*)0x20003500 = 0; *(uint32_t*)0x20003504 = 0; *(uint8_t*)0x20003508 = 0xac; *(uint8_t*)0x20003509 = 0x14; *(uint8_t*)0x2000350a = 0x14; *(uint8_t*)0x2000350b = 0xbb; *(uint32_t*)0x20003518 = htobe32(0); *(uint8_t*)0x2000351c = 0x6c; *(uint8_t*)0x20003520 = 0xac; *(uint8_t*)0x20003521 = 0x14; *(uint8_t*)0x20003522 = 0x14; *(uint8_t*)0x20003523 = 0xbb; *(uint64_t*)0x20003530 = 0; *(uint64_t*)0x20003538 = 0; *(uint64_t*)0x20003540 = 0; *(uint64_t*)0x20003548 = 0; *(uint64_t*)0x20003550 = 0; *(uint64_t*)0x20003558 = 0; *(uint64_t*)0x20003560 = 0; *(uint64_t*)0x20003568 = 0; *(uint64_t*)0x20003570 = 0; *(uint64_t*)0x20003578 = 0; *(uint64_t*)0x20003580 = 0; *(uint64_t*)0x20003588 = 0; *(uint32_t*)0x20003590 = 0; *(uint32_t*)0x20003594 = 0; *(uint32_t*)0x20003598 = 0; *(uint32_t*)0x2000359c = 0; *(uint32_t*)0x200035a0 = 0; *(uint16_t*)0x200035a4 = 0xa; *(uint8_t*)0x200035a6 = 1; *(uint8_t*)0x200035a7 = 0; *(uint8_t*)0x200035a8 = 0; *(uint16_t*)0x200035b0 = 0x48; *(uint16_t*)0x200035b2 = 3; memcpy((void*)0x200035b4, "deflate\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 64); *(uint32_t*)0x200035f4 = 0; *(uint64_t*)0x20000348 = 0x138; *(uint64_t*)0x20000198 = 1; *(uint64_t*)0x200001a0 = 0; *(uint64_t*)0x200001a8 = 0; *(uint32_t*)0x200001b0 = 0; syscall(__NR_sendmsg, r[0], 0x20000180ul, 0ul); return 0; }