// https://syzkaller.appspot.com/bug?id=c8dc33e0c988f2e77ecf4481a79fc9ec044ca41b // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_socket, 1ul, 1ul, 0); if (res != -1) r[0] = res; *(uint64_t*)0x200004c0 = 0; *(uint32_t*)0x200004c8 = 0; *(uint64_t*)0x200004d0 = 0; *(uint64_t*)0x200004d8 = 0; *(uint64_t*)0x200004e0 = 0x200003c0; *(uint64_t*)0x200003c0 = 0x78; *(uint32_t*)0x200003c8 = 1; *(uint32_t*)0x200003cc = 0x1d; memcpy((void*)0x200003d0, "\xf7\x02\x55\x2d\xea\xe0\x54\x35\xb0\x91\x04\x7c\x53\x37\xdf\x91\xba" "\xb0\x66\x6e\xca\x74\xf6\x0b\x3f\x07\x4f\xe7\x0a\x28\xd9\xaa\x8a\xd4" "\xcc\x22\x00\xd7\x4f\x2d\xbf\xac\x8b\xa4\xd6\x3c\x24\x98\xd6\xa2\xf8" "\xed\x4a\xf1\x5e\x99\xcc\x93\xb6\x0b\xab\x5f\x65\x21\x0d\xec\xdf\xc1" "\x01\x45\x28\x31\x26\xfb\x5c\x9d\x47\xef\x4b\x6d\x3d\x68\xd7\x38\x86" "\x2e\xf5\x8b\xd4\x74\x24\x3f\xee\x89\x5d\x8e\xf2\x09\xae\x87", 100); *(uint64_t*)0x20000438 = 0x10; *(uint32_t*)0x20000440 = 0xff; *(uint32_t*)0x20000444 = 0x3ff; *(uint64_t*)0x200004e8 = 0x88; *(uint32_t*)0x200004f0 = 0; syscall(__NR_sendmsg, r[0], 0x200004c0ul, 0x40ul); return 0; }