// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } uint64_t r[1] = {0xffffffffffffffff}; void test() { long res; res = syscall(__NR_socket, 0x10, 3, 6); if (res != -1) r[0] = res; *(uint64_t*)0x2000b000 = 0x20000040; *(uint16_t*)0x20000040 = 0x10; *(uint16_t*)0x20000042 = 0; *(uint32_t*)0x20000044 = 0; *(uint32_t*)0x20000048 = 0x10000040; *(uint32_t*)0x2000b008 = 0xc; *(uint64_t*)0x2000b010 = 0x205a6ff0; *(uint64_t*)0x205a6ff0 = 0x20451ccc; *(uint32_t*)0x20451ccc = 0x138; *(uint16_t*)0x20451cd0 = 0x10; *(uint16_t*)0x20451cd2 = 0x713; *(uint32_t*)0x20451cd4 = 0; *(uint32_t*)0x20451cd8 = 0; *(uint8_t*)0x20451cdc = 0; *(uint8_t*)0x20451cdd = 0; *(uint8_t*)0x20451cde = 0; *(uint8_t*)0x20451cdf = 0; *(uint8_t*)0x20451ce0 = 0; *(uint8_t*)0x20451ce1 = 0; *(uint8_t*)0x20451ce2 = 0; *(uint8_t*)0x20451ce3 = 0; *(uint8_t*)0x20451ce4 = 0; *(uint8_t*)0x20451ce5 = 0; *(uint8_t*)0x20451ce6 = 0; *(uint8_t*)0x20451ce7 = 0; *(uint8_t*)0x20451ce8 = 0; *(uint8_t*)0x20451ce9 = 0; *(uint8_t*)0x20451cea = 0; *(uint8_t*)0x20451ceb = 0; *(uint32_t*)0x20451cec = htobe32(0); *(uint16_t*)0x20451cfc = htobe16(0); *(uint16_t*)0x20451cfe = htobe16(0); *(uint16_t*)0x20451d00 = htobe16(0); *(uint16_t*)0x20451d02 = htobe16(0); *(uint16_t*)0x20451d04 = 0; *(uint8_t*)0x20451d06 = 0; *(uint8_t*)0x20451d07 = 0; *(uint8_t*)0x20451d08 = 0; *(uint32_t*)0x20451d0c = 0; *(uint32_t*)0x20451d10 = 0; *(uint32_t*)0x20451d14 = htobe32(0x7f000001); *(uint32_t*)0x20451d24 = htobe32(0); *(uint8_t*)0x20451d28 = 0x6c; *(uint64_t*)0x20451d2c = htobe64(0); *(uint64_t*)0x20451d34 = htobe64(1); *(uint64_t*)0x20451d3c = 0; *(uint64_t*)0x20451d44 = 0; *(uint64_t*)0x20451d4c = 0; *(uint64_t*)0x20451d54 = 0; *(uint64_t*)0x20451d5c = 0; *(uint64_t*)0x20451d64 = 0; *(uint64_t*)0x20451d6c = 0; *(uint64_t*)0x20451d74 = 0; *(uint64_t*)0x20451d7c = 0; *(uint64_t*)0x20451d84 = 0; *(uint64_t*)0x20451d8c = 0; *(uint64_t*)0x20451d94 = 0; *(uint32_t*)0x20451d9c = 0; *(uint32_t*)0x20451da0 = 0; *(uint32_t*)0x20451da4 = 0; *(uint32_t*)0x20451da8 = 0; *(uint32_t*)0x20451dac = 0; *(uint16_t*)0x20451db0 = 2; *(uint8_t*)0x20451db2 = 0; *(uint8_t*)0x20451db3 = 0; *(uint8_t*)0x20451db4 = 0; *(uint16_t*)0x20451dbc = 0x48; *(uint16_t*)0x20451dbe = 3; memcpy((void*)0x20451dc0, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x20451e00 = 0; *(uint64_t*)0x205a6ff8 = 0x138; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (;;) { loop(); } }