// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } uint64_t r[1] = {0xffffffffffffffff}; void test() { long res; res = syscall(__NR_socket, 0xf, 3, 2); if (res != -1) r[0] = res; *(uint64_t*)0x20f56000 = 0; *(uint32_t*)0x20f56008 = 0; *(uint64_t*)0x20f56010 = 0x20f36000; *(uint64_t*)0x20f36000 = 0x20000080; *(uint8_t*)0x20000080 = 2; *(uint8_t*)0x20000081 = 3; *(uint8_t*)0x20000082 = 0; *(uint8_t*)0x20000083 = 9; *(uint16_t*)0x20000084 = 0xa; *(uint16_t*)0x20000086 = 0; *(uint32_t*)0x20000088 = 0; *(uint32_t*)0x2000008c = 0; *(uint16_t*)0x20000090 = 3; *(uint16_t*)0x20000092 = 6; *(uint8_t*)0x20000094 = 0; *(uint8_t*)0x20000095 = 0; *(uint16_t*)0x20000096 = 0; *(uint16_t*)0x20000098 = 2; *(uint16_t*)0x2000009a = htobe16(0); *(uint32_t*)0x2000009c = htobe32(0xe0000001); *(uint8_t*)0x200000a0 = 0; *(uint8_t*)0x200000a1 = 0; *(uint8_t*)0x200000a2 = 0; *(uint8_t*)0x200000a3 = 0; *(uint8_t*)0x200000a4 = 0; *(uint8_t*)0x200000a5 = 0; *(uint8_t*)0x200000a6 = 0; *(uint8_t*)0x200000a7 = 0; *(uint16_t*)0x200000a8 = 2; *(uint16_t*)0x200000aa = 1; *(uint32_t*)0x200000ac = htobe32(0); *(uint8_t*)0x200000b0 = 0; *(uint8_t*)0x200000b1 = 0; *(uint8_t*)0x200000b2 = 0; *(uint8_t*)0x200000b3 = 2; *(uint32_t*)0x200000b4 = 0; *(uint16_t*)0x200000b8 = 3; *(uint16_t*)0x200000ba = 5; *(uint8_t*)0x200000bc = 0; *(uint8_t*)0x200000bd = 0; *(uint16_t*)0x200000be = 0; *(uint16_t*)0x200000c0 = 2; *(uint16_t*)0x200000c2 = htobe16(0); *(uint32_t*)0x200000c4 = htobe32(0xe0000001); *(uint8_t*)0x200000c8 = 0; *(uint8_t*)0x200000c9 = 0; *(uint8_t*)0x200000ca = 0; *(uint8_t*)0x200000cb = 0; *(uint8_t*)0x200000cc = 0; *(uint8_t*)0x200000cd = 0; *(uint8_t*)0x200000ce = 0; *(uint8_t*)0x200000cf = 0; *(uint64_t*)0x20f36008 = 0x50; *(uint64_t*)0x20f56018 = 1; *(uint64_t*)0x20f56020 = 0; *(uint64_t*)0x20f56028 = 0; *(uint32_t*)0x20f56030 = 0; syscall(__NR_sendmsg, r[0], 0x20f56000, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (;;) { loop(); } }