// https://syzkaller.appspot.com/bug?id=7ef63c67437650b80e78a4da4bd1d4b3d1fa8bc9 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #define __syscall syscall uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul); intptr_t res = 0; res = syscall(SYS_socket, 0x18ul, 1ul, 0); if (res != -1) r[0] = res; res = syscall(SYS_fcntl, r[0], 0ul, r[0]); if (res != -1) r[1] = res; syscall(SYS_setsockopt, -1, 0xffff, 1, 0ul, 0ul); syscall(SYS_setsockopt, -1, 0xffff, 0x1007, 0ul, 0ul); syscall(SYS_listen, r[1], 0); *(uint64_t*)0x20000380 = 0; *(uint32_t*)0x20000388 = 0; *(uint64_t*)0x20000390 = 0; *(uint64_t*)0x20000398 = 0; *(uint64_t*)0x200003a0 = 0x200008c0; *(uint64_t*)0x200008c0 = 0x10; *(uint32_t*)0x200008c8 = 1; *(uint32_t*)0x200008cc = 0xed7e; *(uint64_t*)0x200008d0 = 0x10; *(uint32_t*)0x200008d8 = 0xfffe; *(uint32_t*)0x200008dc = 5; *(uint64_t*)0x200008e0 = 0x90; *(uint32_t*)0x200008e8 = 1; *(uint32_t*)0x200008ec = 4; memcpy( (void*)0x200008f0, "\xfb\xdf\xad\x85\x14\x12\xf3\xd2\xbc\x22\xac\x64\x16\x80\xc3\xd9\x29\x99" "\x26\x6d\xff\x9f\x68\x4b\x3f\x7c\x31\xf9\x6d\x61\x15\x9f\x64\x8e\xff\x5f" "\x75\xc8\xda\xfe\xc7\xc0\x3b\x5b\x5f\xf9\x15\x8b\xb7\xa5\x8b\x57\xad\xb3" "\x3c\x8f\xd5\xa7\xf2\x1e\x50\x0e\x15\x12\x5f\xe1\x61\x85\xe2\x11\x99\xba" "\x17\x0b\x92\xa0\xbd\x23\x50\x8e\x7d\xca\x12\x7f\x1f\x15\x8b\x4d\x96\xe1" "\xc9\xf5\x3a\x7f\x16\xfb\x97\x32\x54\xb2\x3c\x6b\x75\xc7\x2d\x7d\x2b\xd2" "\xe4\xaf\x57\xa9\x8f\x17\x5e\x7e\xec\xc1\xf1\x0a\xc3\xe9", 122); *(uint64_t*)0x20000970 = 0x10; *(uint32_t*)0x20000978 = 0xffff; *(uint32_t*)0x2000097c = 3; *(uint64_t*)0x200003a8 = 0xc0; *(uint32_t*)0x200003b0 = 0; syscall(SYS_sendmsg, r[1], 0x20000380ul, 0ul); syscall(SYS_socketpair, 1ul, 5ul, 0, 0x20000180ul); return 0; }