// https://syzkaller.appspot.com/bug?id=94f0cce53da07178a94265fc34e945095df28928 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[18]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x10ul, 0x3ul, 0x6ul); *(uint64_t*)0x20f3efc8 = (uint64_t)0x20000000; *(uint32_t*)0x20f3efd0 = (uint32_t)0x0; *(uint64_t*)0x20f3efd8 = (uint64_t)0x20eacfe0; *(uint64_t*)0x20f3efe0 = (uint64_t)0x1; *(uint64_t*)0x20f3efe8 = (uint64_t)0x20000000; *(uint64_t*)0x20f3eff0 = (uint64_t)0x0; *(uint32_t*)0x20f3eff8 = (uint32_t)0x0; *(uint64_t*)0x20eacfe0 = (uint64_t)0x20127000; *(uint64_t*)0x20eacfe8 = (uint64_t)0x128; *(uint32_t*)0x20127000 = (uint32_t)0x128; *(uint16_t*)0x20127004 = (uint16_t)0x17; *(uint16_t*)0x20127006 = (uint16_t)0xd; *(uint32_t*)0x20127008 = (uint32_t)0x0; *(uint32_t*)0x2012700c = (uint32_t)0x0; memcpy((void*)0x20127010, "\xcc\xd4\x72\xae\x4e\x3c\x6f\x49\xa1\xc0\x94\x15\xa5\xf0\x40" "\x81\x38\x97\xcf\x9d\x52\xc7\x78\x51\x52\x92\x08\xbb\x66\x08" "\x7d\xde\x4e\x72\x1a\xc6\x02\x1a\xe0\x28\xee\xb4\xee\x5b\xad" "\x54\xab\x55\x0f\x8e\xb8\x05\x06\xc4\xf9\x00\x00\x00\x00\x00" "\x00\x00\x00\xc1\xb5\x30\x2c\x46\xc5\x08\x6c\x34\xbc\x24\x33" "\xd4\x15\x2f\x42\x86\x9a\xa9\x1c\x82\x52\x58\xaf\x9d\x66\xa2" "\x1c\xe7\xdf\xec\x8e\x42\x09\xa3\x7c\x39\xee\xea\x2c\xf3\x87" "\xdc\xd4\x75\xab\xdd\x90\xda\x6e\xb8\x3b\x6e\x7f\x36\xb8\x38" "\x0c\x05\x23\x51\xd6\xe4\x75\x02\xfb\xbd\x8d\x4d\x35\xe2\xda" "\x5a\x84\x8e\x64\x99\x4d\x13\x14\xe5\xc1\x2d\x24\xde\xd4\xd9" "\x04\x5c\x76\xcb\xe5\xbd\xaf\x1b\xa2\x3c\xcb\xea\x58\x9a\x94" "\xd3\x2c\x93\xe9\x1f\xcd\x41\x3f\x88\xdd\x09\xd4\xea\x23\x0e" "\x79\x59\x35\x32\x4e\x8f\x91\x51\x02\xd2\xc2\xb2\xef\xf8\x06" "\xf8\x24\xf0\xb0\xd7\xca\xb2\xdb\x01\x7e\xf9\xa7\xe9\x6c\xb8" "\xce\x63\x1a\xce\xa3\xc6\x7f\x74\xbe\x97\x9a\xb3\xfd\x88\x99" "\x71\x85\x12\x59\x9a\xc0\x5d\x5c\xf9\xd7\x93\x52\xe9\x31\xc7" "\x63\x0a\x81\x3e\x7f\x51\x1d\x9b\xbd\xd2\x07\xd4\x6a\xf3\x37" "\xa6\x82\xe6\xa4\x9b\x62\xa2\xe5\x34\xdd\xc6\xa1\xef\x60\xbb" "\x0a\x1d\x9e\xe4\x34\xff\xb0\x26\x0a\xee", 280); r[17] = syscall(__NR_sendmsg, r[1], 0x20f3efc8ul, 0x0ul); } int main() { loop(); return 0; }