// https://syzkaller.appspot.com/bug?id=f9d34178cb05596d85281201d051e2233ab4be6c // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul, /*proto=*/0, /*fds=*/0x20000080ul); if (res != -1) { r[0] = *(uint32_t*)0x20000080; r[1] = *(uint32_t*)0x20000084; } memcpy((void*)0x200002c0, "\x2d\x01\x2e\x2f\x66\x69\x6c\x65\x30", 9); syscall(SYS_bind, /*fd=*/r[1], /*addr=*/0x200002c0ul, /*addrlen=*/0xaul); syscall(SYS_dup2, /*oldfd=*/r[1], /*newfd=*/r[0]); syscall(SYS_listen, /*fd=*/r[1], /*backlog=*/0); { int i; for (i = 0; i < 64; i++) { syscall(SYS_listen, /*fd=*/r[1], /*backlog=*/0); } } res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul, /*proto=*/0, /*fds=*/0x20000040ul); if (res != -1) { r[2] = *(uint32_t*)0x20000040; r[3] = *(uint32_t*)0x20000044; } syscall(SYS_dup2, /*oldfd=*/r[3], /*newfd=*/r[2]); memcpy((void*)0x20000000, "\x00\x01\x2e\x2f\x66\x69\x6c\x65\x30", 9); syscall(SYS_connect, /*fd=*/r[3], /*addr=*/0x20000000ul, /*addrlen=*/0xaul); return 0; }