// https://syzkaller.appspot.com/bug?id=2668718853a3764ffe6976db2451c75e34780d67 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include static long syz_execute_func(long text) { ((void (*)(void))(text))(); return 0; } int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); memcpy((void*)0x20000140, "\x36\x66\x44\x0f\x50\xf5\x23\xc4\xe2\xc9\xc4\xc2" "\x79\x22\xda\x42\x42\x0f\x1b\x99\x00\x10\x00\x02" "\x66\x42\x0f\xe2\xe3\x3e\x0f\x11\x10\xd3\x19\x6f" "\x66\x43\x0f\x29\x02", 41); syz_execute_func(0x20000140); *(uint64_t*)0x20001500 = 0; *(uint32_t*)0x20001508 = 0; *(uint64_t*)0x20001510 = 0x20001480; *(uint64_t*)0x20001480 = 0x20000180; *(uint64_t*)0x20001488 = 0; *(uint64_t*)0x20001490 = 0x20000240; *(uint64_t*)0x20001498 = 0; *(uint64_t*)0x200014a0 = 0x200000c0; *(uint64_t*)0x200014a8 = 0; *(uint64_t*)0x200014b0 = 0x20000340; *(uint64_t*)0x200014b8 = 0; *(uint64_t*)0x200014c0 = 0x20000100; memcpy((void*)0x20000100, "\x36\x76\xda\x0d\xd8\x21\x34\xfc\x24\xb5\x1d\xbf" "\x32\xed\xac\xe8\x0e\x57\x1e\xb1\xef\x40\x44\xef" "\x17\xc9\x83\x29\xa1\x18\x10\x5e\xde\x8d\xb0\xec" "\xc0\xa8\x21\x2d\xad\x62\x0c\xa2\x68\x44\xf6\xe8" "\xbe\x8f\x61\x3b", 52); *(uint64_t*)0x200014c8 = 0x34; *(uint64_t*)0x200014d0 = 0x20001340; *(uint64_t*)0x200014d8 = 0; *(uint64_t*)0x200014e0 = 0x20001440; *(uint64_t*)0x200014e8 = 0; *(uint64_t*)0x20001518 = 7; *(uint64_t*)0x20001520 = 0; *(uint64_t*)0x20001528 = 0; *(uint32_t*)0x20001530 = 0x800; syscall(__NR_sendmsg, -1, 0x20001500, 0x8c0); return 0; }