// https://syzkaller.appspot.com/bug?id=ed27fa17fde97218578a0f64a9cc69ccadfc8fb8 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[46]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xf7b000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul); *(uint16_t*)0x20f7a000 = (uint16_t)0x26; memcpy((void*)0x20f7a002, "\x61\x65\x61\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 14); *(uint32_t*)0x20f7a010 = (uint32_t)0x0; *(uint32_t*)0x20f7a014 = (uint32_t)0xf; memcpy((void*)0x20f7a018, "\x72\x66\x63\x37\x35\x33\x39\x28\x63\x74\x72\x28\x74\x77\x6f" "\x66\x69\x73\x68\x2d\x67\x65\x6e\x65\x72\x69\x63\x29\x2c\x72" "\x6d\x64\x32\x35\x36\x29\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00", 64); r[7] = syscall(__NR_bind, r[1], 0x20f7a000ul, 0x58ul); memcpy((void*)0x201ec000, "\x0a\x07\x75\xb0\xd5\xe3\x83\xe5\xb3\xb6" "\x0c\xed\x5c\x54\xdb\xb7\x29\x5d\xf0\xdf" "\x82\x17\xad\x40\x00\x00\x00\x00\x00\x00" "\x00\xe6", 32); r[9] = syscall(__NR_setsockopt, r[1], 0x117ul, 0x1ul, 0x201ec000ul, 0x20ul); r[10] = syscall(__NR_accept, r[1], 0x0ul, 0x0ul); *(uint64_t*)0x20368000 = (uint64_t)0x0; *(uint32_t*)0x20368008 = (uint32_t)0x0; *(uint64_t*)0x20368010 = (uint64_t)0x20931fd0; *(uint64_t*)0x20368018 = (uint64_t)0x1; *(uint64_t*)0x20368020 = (uint64_t)0x20335fe8; *(uint64_t*)0x20368028 = (uint64_t)0x18; *(uint32_t*)0x20368030 = (uint32_t)0x8000; *(uint64_t*)0x20368038 = (uint64_t)0x0; *(uint32_t*)0x20368040 = (uint32_t)0x0; *(uint64_t*)0x20368048 = (uint64_t)0x203d7000; *(uint64_t*)0x20368050 = (uint64_t)0x1; *(uint64_t*)0x20368058 = (uint64_t)0x20000000; *(uint64_t*)0x20368060 = (uint64_t)0x0; *(uint32_t*)0x20368068 = (uint32_t)0x12; *(uint64_t*)0x20931fd0 = (uint64_t)0x20f71f38; *(uint64_t*)0x20931fd8 = (uint64_t)0x0; *(uint64_t*)0x20335fe8 = (uint64_t)0x18; *(uint32_t*)0x20335ff0 = (uint32_t)0x117; *(uint32_t*)0x20335ff4 = (uint32_t)0x3; *(uint32_t*)0x20335ff8 = (uint32_t)0x1; *(uint64_t*)0x203d7000 = (uint64_t)0x20ef8000; *(uint64_t*)0x203d7008 = (uint64_t)0x0; r[33] = syscall(__NR_sendmmsg, r[10], 0x20368000ul, 0x2ul, 0x4040040ul); *(uint64_t*)0x201f5000 = (uint64_t)0x20a06000; *(uint32_t*)0x201f5008 = (uint32_t)0x58; *(uint64_t*)0x201f5010 = (uint64_t)0x20233fd0; *(uint64_t*)0x201f5018 = (uint64_t)0x2; *(uint64_t*)0x201f5020 = (uint64_t)0x208e5fa9; *(uint64_t*)0x201f5028 = (uint64_t)0x0; *(uint32_t*)0x201f5030 = (uint32_t)0x8a; *(uint64_t*)0x20233fd0 = (uint64_t)0x20be4ffb; *(uint64_t*)0x20233fd8 = (uint64_t)0x0; *(uint64_t*)0x20233fe0 = (uint64_t)0x20f71fc6; *(uint64_t*)0x20233fe8 = (uint64_t)0x3a; r[45] = syscall(__NR_recvmsg, r[10], 0x201f5000ul, 0x20ul); } int main() { loop(); return 0; }