// https://syzkaller.appspot.com/bug?id=9463343a39f66062536eca45450081f837781f88 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); intptr_t res = 0; res = syscall(SYS_socket, 0x1cul, 5ul, 0x84); if (res != -1) r[0] = res; *(uint64_t*)0x20000480 = 0x20000000; *(uint8_t*)0x20000000 = 0x1c; *(uint8_t*)0x20000001 = 0x1c; *(uint16_t*)0x20000002 = htobe16(0x4e23); *(uint32_t*)0x20000004 = 0xffffff4d; *(uint64_t*)0x20000008 = htobe64(0); *(uint64_t*)0x20000010 = htobe64(1); *(uint32_t*)0x20000018 = 0xac; *(uint32_t*)0x20000488 = 0x1c; *(uint64_t*)0x20000490 = 0x200003c0; *(uint64_t*)0x200003c0 = 0x20000040; memcpy( (void*)0x20000040, "\x93\x05\xaa\x6c\x07\x95\x0c\x08\xbe\x9e\xc6\x8e\xa8\xcd\xfd\x73\x4f\x60" "\x23\xed\x14\x17\xc9\xb2\x67\x68\x8c\x61\x4e\x2f\xea\x4c\xb4\x47\xbb\x22" "\x2e\x59\xbf\x43\xf8\x28\x50\xf0\xfa\xff\x2d\x89\xbc\x92\xe9\x23\x7a\xd6" "\x67\xfb\xf1\x1d\x15\x2d\x7d\x0e\x0c\x44\x72\xee\x9b\x95\xae\xe9\x92\x9a" "\x12\xef\xaa\xa0\xc0\xe4\x56\x21\xc2\x44\x70\x7c\x79\xd2\x15\x4e\xbe\x49" "\x4b\xfb\x27\x32\xfa\x05\x6d\x47\x89\x13\x5e\x24\xc7\x33\x0b\x93\x46\x1f" "\x82\xb8\xb0\x13\x47\x97\xf2\xf5\xde\x99\xf7\xce\x69\xbe\x0f\x53\xf9\xdf" "\xf6\xa7\xd4\xa8\x9c\xdd\xa7\xe5\xba\x22\x1f\xa6\xfc\x26\x95\x02\x7c\x97" "\x2d\xc8\xd0\xed\xb3\x0f\x1c\x41\x38\x78\x8a\x85\x74\x58\x1e\x32\x68\xce" "\x30\xb3\x62\x00\x86\xee\xd6\xbe\xcc\xc6\x39\xcc\x7e\xf3\xf3\xf0\x82\x9a" "\x42\x45\xe1\xc3\x68\xae\x93\x67\x88\xeb\xd8\xeb\xc2\xd2\x77\x74\x0b\x6f" "\x42\xa6\x78\xf7\x06\x15\x72\xbc\x2b\xf5\x43\x29\xd0\xcd\x2a\x1f\x5e\xdf" "\x8f\xa3\x88\x7a\x3b\xbf\x62\x00\x5d\xee\x02\x3e\x38\x12", 230); *(uint64_t*)0x200003c8 = 0xe6; *(uint64_t*)0x200003d0 = 0; *(uint64_t*)0x200003d8 = 0; *(uint64_t*)0x200003e0 = 0; *(uint64_t*)0x200003e8 = 0; *(uint64_t*)0x200003f0 = 0; *(uint64_t*)0x200003f8 = 0; *(uint64_t*)0x20000400 = 0; *(uint64_t*)0x20000408 = 0; *(uint32_t*)0x20000498 = 5; *(uint64_t*)0x200004a0 = 0; *(uint32_t*)0x200004a8 = 0; *(uint32_t*)0x200004ac = 0x2008f; syscall(SYS_sendmsg, r[0], 0x20000480ul, 0x20045ul); { int i; for (i = 0; i < 64; i++) { syscall(SYS_sendmsg, r[0], 0x20000480ul, 0x20045ul); } } return 0; }