// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0x422000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 6); *(uint64_t*)0x2000b000 = 0x201a4ff4; *(uint32_t*)0x2000b008 = 0xc; *(uint64_t*)0x2000b010 = 0x20008000; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; *(uint16_t*)0x201a4ff4 = 0x10; *(uint16_t*)0x201a4ff6 = 0; *(uint32_t*)0x201a4ff8 = 0; *(uint32_t*)0x201a4ffc = 0; *(uint64_t*)0x20008000 = 0x2000bcc4; *(uint64_t*)0x20008008 = 0x138; *(uint32_t*)0x2000bcc4 = 0x138; *(uint16_t*)0x2000bcc8 = 0x10; *(uint16_t*)0x2000bcca = 0x713; *(uint32_t*)0x2000bccc = 0; *(uint32_t*)0x2000bcd0 = 0; *(uint8_t*)0x2000bcd4 = 0; *(uint8_t*)0x2000bcd5 = 0; *(uint8_t*)0x2000bcd6 = 0; *(uint8_t*)0x2000bcd7 = 0; *(uint8_t*)0x2000bcd8 = 0; *(uint8_t*)0x2000bcd9 = 0; *(uint8_t*)0x2000bcda = 0; *(uint8_t*)0x2000bcdb = 0; *(uint8_t*)0x2000bcdc = 0; *(uint8_t*)0x2000bcdd = 0; *(uint8_t*)0x2000bcde = 0; *(uint8_t*)0x2000bcdf = 0; *(uint8_t*)0x2000bce0 = 0; *(uint8_t*)0x2000bce1 = 0; *(uint8_t*)0x2000bce2 = 0; *(uint8_t*)0x2000bce3 = 0; *(uint32_t*)0x2000bce4 = htobe32(0xe0000002); *(uint16_t*)0x2000bcf4 = 0; *(uint16_t*)0x2000bcf6 = htobe16(0); *(uint16_t*)0x2000bcf8 = 0; *(uint16_t*)0x2000bcfa = htobe16(0); *(uint16_t*)0x2000bcfc = 0; *(uint8_t*)0x2000bcfe = 0; *(uint8_t*)0x2000bcff = 0; *(uint8_t*)0x2000bd00 = 0; *(uint32_t*)0x2000bd04 = 0; *(uint32_t*)0x2000bd08 = 0; *(uint32_t*)0x2000bd0c = htobe32(0x7f000001); *(uint32_t*)0x2000bd1c = 0; *(uint8_t*)0x2000bd20 = 0x6c; *(uint64_t*)0x2000bd24 = htobe64(0); *(uint64_t*)0x2000bd2c = htobe64(1); *(uint64_t*)0x2000bd34 = 0; *(uint64_t*)0x2000bd3c = 0; *(uint64_t*)0x2000bd44 = 0; *(uint64_t*)0x2000bd4c = 0; *(uint64_t*)0x2000bd54 = 0; *(uint64_t*)0x2000bd5c = 0; *(uint64_t*)0x2000bd64 = 0; *(uint64_t*)0x2000bd6c = 0; *(uint64_t*)0x2000bd74 = 0; *(uint64_t*)0x2000bd7c = 0; *(uint64_t*)0x2000bd84 = 0; *(uint64_t*)0x2000bd8c = 0; *(uint32_t*)0x2000bd94 = 0; *(uint32_t*)0x2000bd98 = 0; *(uint32_t*)0x2000bd9c = 0; *(uint32_t*)0x2000bda0 = 0; *(uint32_t*)0x2000bda4 = 0; *(uint16_t*)0x2000bda8 = 0xa; *(uint8_t*)0x2000bdaa = 0; *(uint8_t*)0x2000bdab = 0; *(uint8_t*)0x2000bdac = 0; *(uint16_t*)0x2000bdb4 = 0x48; *(uint16_t*)0x2000bdb6 = 3; memcpy((void*)0x2000bdb8, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\xf1\xff\xff\xff\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x2000bdf8 = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); } int main() { for (;;) { loop(); } }