// https://syzkaller.appspot.com/bug?id=0836129249da171badd9ae2a4c41df5b5821b858 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) { continue; } kill_and_wait(pid, &status); break; } } } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; res = syscall(__NR_socket, 0xaul, 1ul, 0); if (res != -1) r[0] = res; memcpy((void*)0x20000980, "filter\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 32); *(uint32_t*)0x200009a0 = 0xe; *(uint32_t*)0x200009a4 = 4; *(uint32_t*)0x200009a8 = 0x390; *(uint32_t*)0x200009ac = 0xd0; *(uint32_t*)0x200009b0 = 0; *(uint32_t*)0x200009b4 = 0xd0; *(uint32_t*)0x200009b8 = 0; *(uint32_t*)0x200009bc = 0xd0; *(uint32_t*)0x200009c0 = 0x2c0; *(uint32_t*)0x200009c4 = 0x2c0; *(uint32_t*)0x200009c8 = 0x2c0; *(uint32_t*)0x200009cc = 0x2c0; *(uint32_t*)0x200009d0 = 0x2c0; *(uint32_t*)0x200009d4 = 4; *(uint64_t*)0x200009d8 = 0; *(uint8_t*)0x200009e0 = 0; *(uint8_t*)0x200009e1 = 0; *(uint8_t*)0x200009e2 = 0; *(uint8_t*)0x200009e3 = 0; *(uint8_t*)0x200009e4 = 0; *(uint8_t*)0x200009e5 = 0; *(uint8_t*)0x200009e6 = 0; *(uint8_t*)0x200009e7 = 0; *(uint8_t*)0x200009e8 = 0; *(uint8_t*)0x200009e9 = 0; *(uint8_t*)0x200009ea = 0; *(uint8_t*)0x200009eb = 0; *(uint8_t*)0x200009ec = 0; *(uint8_t*)0x200009ed = 0; *(uint8_t*)0x200009ee = 0; *(uint8_t*)0x200009ef = 0; *(uint8_t*)0x200009f0 = 0; *(uint8_t*)0x200009f1 = 0; *(uint8_t*)0x200009f2 = 0; *(uint8_t*)0x200009f3 = 0; *(uint8_t*)0x200009f4 = 0; *(uint8_t*)0x200009f5 = 0; *(uint8_t*)0x200009f6 = 0; *(uint8_t*)0x200009f7 = 0; *(uint8_t*)0x200009f8 = 0; *(uint8_t*)0x200009f9 = 0; *(uint8_t*)0x200009fa = 0; *(uint8_t*)0x200009fb = 0; *(uint8_t*)0x200009fc = 0; *(uint8_t*)0x200009fd = 0; *(uint8_t*)0x200009fe = 0; *(uint8_t*)0x200009ff = 0; *(uint8_t*)0x20000a00 = 0; *(uint8_t*)0x20000a01 = 0; *(uint8_t*)0x20000a02 = 0; *(uint8_t*)0x20000a03 = 0; *(uint8_t*)0x20000a04 = 0; *(uint8_t*)0x20000a05 = 0; *(uint8_t*)0x20000a06 = 0; *(uint8_t*)0x20000a07 = 0; *(uint8_t*)0x20000a08 = 0; *(uint8_t*)0x20000a09 = 0; *(uint8_t*)0x20000a0a = 0; *(uint8_t*)0x20000a0b = 0; *(uint8_t*)0x20000a0c = 0; *(uint8_t*)0x20000a0d = 0; *(uint8_t*)0x20000a0e = 0; *(uint8_t*)0x20000a0f = 0; *(uint8_t*)0x20000a10 = 0; *(uint8_t*)0x20000a11 = 0; *(uint8_t*)0x20000a12 = 0; *(uint8_t*)0x20000a13 = 0; *(uint8_t*)0x20000a14 = 0; *(uint8_t*)0x20000a15 = 0; *(uint8_t*)0x20000a16 = 0; *(uint8_t*)0x20000a17 = 0; *(uint8_t*)0x20000a18 = 0; *(uint8_t*)0x20000a19 = 0; *(uint8_t*)0x20000a1a = 0; *(uint8_t*)0x20000a1b = 0; *(uint8_t*)0x20000a1c = 0; *(uint8_t*)0x20000a1d = 0; *(uint8_t*)0x20000a1e = 0; *(uint8_t*)0x20000a1f = 0; *(uint8_t*)0x20000a20 = 0; *(uint8_t*)0x20000a21 = 0; *(uint8_t*)0x20000a22 = 0; *(uint8_t*)0x20000a23 = 0; *(uint8_t*)0x20000a24 = 0; *(uint8_t*)0x20000a25 = 0; *(uint8_t*)0x20000a26 = 0; *(uint8_t*)0x20000a27 = 0; *(uint8_t*)0x20000a28 = 0; *(uint8_t*)0x20000a29 = 0; *(uint8_t*)0x20000a2a = 0; *(uint8_t*)0x20000a2b = 0; *(uint8_t*)0x20000a2c = 0; *(uint8_t*)0x20000a2d = 0; *(uint8_t*)0x20000a2e = 0; *(uint8_t*)0x20000a2f = 0; *(uint8_t*)0x20000a30 = 0; *(uint8_t*)0x20000a31 = 0; *(uint8_t*)0x20000a32 = 0; *(uint8_t*)0x20000a33 = 0; *(uint8_t*)0x20000a34 = 0; *(uint8_t*)0x20000a35 = 0; *(uint8_t*)0x20000a36 = 0; *(uint8_t*)0x20000a37 = 0; *(uint8_t*)0x20000a38 = 0; *(uint8_t*)0x20000a39 = 0; *(uint8_t*)0x20000a3a = 0; *(uint8_t*)0x20000a3b = 0; *(uint8_t*)0x20000a3c = 0; *(uint8_t*)0x20000a3d = 0; *(uint8_t*)0x20000a3e = 0; *(uint8_t*)0x20000a3f = 0; *(uint8_t*)0x20000a40 = 0; *(uint8_t*)0x20000a41 = 0; *(uint8_t*)0x20000a42 = 0; *(uint8_t*)0x20000a43 = 0; *(uint8_t*)0x20000a44 = 0; *(uint8_t*)0x20000a45 = 0; *(uint8_t*)0x20000a46 = 0; *(uint8_t*)0x20000a47 = 0; *(uint8_t*)0x20000a48 = 0; *(uint8_t*)0x20000a49 = 0; *(uint8_t*)0x20000a4a = 0; *(uint8_t*)0x20000a4b = 0; *(uint8_t*)0x20000a4c = 0; *(uint8_t*)0x20000a4d = 0; *(uint8_t*)0x20000a4e = 0; *(uint8_t*)0x20000a4f = 0; *(uint8_t*)0x20000a50 = 0; *(uint8_t*)0x20000a51 = 0; *(uint8_t*)0x20000a52 = 0; *(uint8_t*)0x20000a53 = 0; *(uint8_t*)0x20000a54 = 0; *(uint8_t*)0x20000a55 = 0; *(uint8_t*)0x20000a56 = 0; *(uint8_t*)0x20000a57 = 0; *(uint8_t*)0x20000a58 = 0; *(uint8_t*)0x20000a59 = 0; *(uint8_t*)0x20000a5a = 0; *(uint8_t*)0x20000a5b = 0; *(uint8_t*)0x20000a5c = 0; *(uint8_t*)0x20000a5d = 0; *(uint8_t*)0x20000a5e = 0; *(uint8_t*)0x20000a5f = 0; *(uint8_t*)0x20000a60 = 0; *(uint8_t*)0x20000a61 = 0; *(uint8_t*)0x20000a62 = 0; *(uint8_t*)0x20000a63 = 0; *(uint8_t*)0x20000a64 = 0; *(uint8_t*)0x20000a65 = 0; *(uint8_t*)0x20000a66 = 0; *(uint8_t*)0x20000a67 = 0; *(uint32_t*)0x20000a68 = 0; *(uint16_t*)0x20000a6c = 0xa8; *(uint16_t*)0x20000a6e = 0xd0; *(uint32_t*)0x20000a70 = 0; *(uint64_t*)0x20000a78 = 0; *(uint64_t*)0x20000a80 = 0; *(uint16_t*)0x20000a88 = 0x28; memcpy((void*)0x20000a8a, "SET\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000aa7 = 1; *(uint16_t*)0x20000aa8 = -1; *(uint8_t*)0x20000aaa = 0; *(uint8_t*)0x20000aab = 0; *(uint16_t*)0x20000aac = -1; *(uint8_t*)0x20000aae = 0; *(uint8_t*)0x20000aaf = 0; *(uint64_t*)0x20000ab0 = htobe64(0); *(uint64_t*)0x20000ab8 = htobe64(1); *(uint8_t*)0x20000ac0 = 0xfc; *(uint8_t*)0x20000ac1 = 0; *(uint8_t*)0x20000ac2 = 0; *(uint8_t*)0x20000ac3 = 0; *(uint8_t*)0x20000ac4 = 0; *(uint8_t*)0x20000ac5 = 0; *(uint8_t*)0x20000ac6 = 0; *(uint8_t*)0x20000ac7 = 0; *(uint8_t*)0x20000ac8 = 0; *(uint8_t*)0x20000ac9 = 0; *(uint8_t*)0x20000aca = 0; *(uint8_t*)0x20000acb = 0; *(uint8_t*)0x20000acc = 0; *(uint8_t*)0x20000acd = 0; *(uint8_t*)0x20000ace = 0; *(uint8_t*)0x20000acf = 0; *(uint32_t*)0x20000ad0 = htobe32(0); *(uint32_t*)0x20000ad4 = htobe32(0); *(uint32_t*)0x20000ad8 = htobe32(0); *(uint32_t*)0x20000adc = htobe32(0); *(uint32_t*)0x20000ae0 = htobe32(0); *(uint32_t*)0x20000ae4 = htobe32(0); *(uint32_t*)0x20000ae8 = htobe32(0); *(uint32_t*)0x20000aec = htobe32(0); memcpy((void*)0x20000af0, "veth1_to_bond\000\000\000", 16); memcpy((void*)0x20000b00, "macsec0\000\000\000\000\000\000\000\000\000", 16); *(uint8_t*)0x20000b10 = 0; *(uint8_t*)0x20000b20 = 0; *(uint16_t*)0x20000b30 = 0; *(uint8_t*)0x20000b32 = 0; *(uint8_t*)0x20000b33 = 0; *(uint8_t*)0x20000b34 = 0; *(uint32_t*)0x20000b38 = 0; *(uint16_t*)0x20000b3c = 0xa8; *(uint16_t*)0x20000b3e = 0xf0; *(uint32_t*)0x20000b40 = 0; *(uint64_t*)0x20000b48 = 0; *(uint64_t*)0x20000b50 = 0; *(uint16_t*)0x20000b58 = 0x48; memcpy((void*)0x20000b5a, "TEE\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000b77 = 1; *(uint8_t*)0x20000b78 = -1; *(uint8_t*)0x20000b79 = 2; *(uint8_t*)0x20000b7a = 0; *(uint8_t*)0x20000b7b = 0; *(uint8_t*)0x20000b7c = 0; *(uint8_t*)0x20000b7d = 0; *(uint8_t*)0x20000b7e = 0; *(uint8_t*)0x20000b7f = 0; *(uint8_t*)0x20000b80 = 0; *(uint8_t*)0x20000b81 = 0; *(uint8_t*)0x20000b82 = 0; *(uint8_t*)0x20000b83 = 0; *(uint8_t*)0x20000b84 = 0; *(uint8_t*)0x20000b85 = 0; *(uint8_t*)0x20000b86 = 0; *(uint8_t*)0x20000b87 = 1; memcpy((void*)0x20000b88, "netdevsim0\000\000\000\000\000\000", 16); *(uint64_t*)0x20000b98 = 0; *(uint8_t*)0x20000ba0 = 0xfe; *(uint8_t*)0x20000ba1 = 0x80; *(uint8_t*)0x20000ba2 = 0; *(uint8_t*)0x20000ba3 = 0; *(uint8_t*)0x20000ba4 = 0; *(uint8_t*)0x20000ba5 = 0; *(uint8_t*)0x20000ba6 = 0; *(uint8_t*)0x20000ba7 = 0; *(uint8_t*)0x20000ba8 = 0; *(uint8_t*)0x20000ba9 = 0; *(uint8_t*)0x20000baa = 0; *(uint8_t*)0x20000bab = 0; *(uint8_t*)0x20000bac = 0; *(uint8_t*)0x20000bad = 0; *(uint8_t*)0x20000bae = 0; *(uint8_t*)0x20000baf = 0xaa; *(uint8_t*)0x20000bb0 = 0xfe; *(uint8_t*)0x20000bb1 = 0x80; *(uint8_t*)0x20000bb2 = 0; *(uint8_t*)0x20000bb3 = 0; *(uint8_t*)0x20000bb4 = 0; *(uint8_t*)0x20000bb5 = 0; *(uint8_t*)0x20000bb6 = 0; *(uint8_t*)0x20000bb7 = 0; *(uint8_t*)0x20000bb8 = 0; *(uint8_t*)0x20000bb9 = 0; *(uint8_t*)0x20000bba = 0; *(uint8_t*)0x20000bbb = 0; *(uint8_t*)0x20000bbc = 0; *(uint8_t*)0x20000bbd = 0; *(uint8_t*)0x20000bbe = 0; *(uint8_t*)0x20000bbf = 0xaa; *(uint32_t*)0x20000bc0 = htobe32(0); *(uint32_t*)0x20000bc4 = htobe32(0); *(uint32_t*)0x20000bc8 = htobe32(0); *(uint32_t*)0x20000bcc = htobe32(0); *(uint32_t*)0x20000bd0 = htobe32(0); *(uint32_t*)0x20000bd4 = htobe32(0); *(uint32_t*)0x20000bd8 = htobe32(0); *(uint32_t*)0x20000bdc = htobe32(0); memcpy((void*)0x20000be0, "vlan1\000\000\000\000\000\000\000\000\000\000\000", 16); memcpy((void*)0x20000bf0, "ipvlan0\000\000\000\000\000\000\000\000\000", 16); *(uint8_t*)0x20000c00 = 0; *(uint8_t*)0x20000c10 = 0; *(uint16_t*)0x20000c20 = 0x11; *(uint8_t*)0x20000c22 = 0; *(uint8_t*)0x20000c23 = 0; *(uint8_t*)0x20000c24 = 0; *(uint32_t*)0x20000c28 = 0; *(uint16_t*)0x20000c2c = 0xd8; *(uint16_t*)0x20000c2e = 0x100; *(uint32_t*)0x20000c30 = 0; *(uint64_t*)0x20000c38 = 0; *(uint64_t*)0x20000c40 = 0; *(uint16_t*)0x20000c48 = 0x30; memcpy((void*)0x20000c4a, "l2tp\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000c67 = 0; *(uint32_t*)0x20000c68 = 0; *(uint32_t*)0x20000c6c = 0; *(uint8_t*)0x20000c70 = 2; *(uint8_t*)0x20000c71 = 0; *(uint8_t*)0x20000c72 = 0xc; *(uint16_t*)0x20000c78 = 0x28; memcpy((void*)0x20000c7a, "REJECT\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000c97 = 0; *(uint32_t*)0x20000c98 = 0; *(uint8_t*)0x20000ca0 = 0; *(uint8_t*)0x20000ca1 = 0; *(uint8_t*)0x20000ca2 = 0; *(uint8_t*)0x20000ca3 = 0; *(uint8_t*)0x20000ca4 = 0; *(uint8_t*)0x20000ca5 = 0; *(uint8_t*)0x20000ca6 = 0; *(uint8_t*)0x20000ca7 = 0; *(uint8_t*)0x20000ca8 = 0; *(uint8_t*)0x20000ca9 = 0; *(uint8_t*)0x20000caa = 0; *(uint8_t*)0x20000cab = 0; *(uint8_t*)0x20000cac = 0; *(uint8_t*)0x20000cad = 0; *(uint8_t*)0x20000cae = 0; *(uint8_t*)0x20000caf = 0; *(uint8_t*)0x20000cb0 = 0; *(uint8_t*)0x20000cb1 = 0; *(uint8_t*)0x20000cb2 = 0; *(uint8_t*)0x20000cb3 = 0; *(uint8_t*)0x20000cb4 = 0; *(uint8_t*)0x20000cb5 = 0; *(uint8_t*)0x20000cb6 = 0; *(uint8_t*)0x20000cb7 = 0; *(uint8_t*)0x20000cb8 = 0; *(uint8_t*)0x20000cb9 = 0; *(uint8_t*)0x20000cba = 0; *(uint8_t*)0x20000cbb = 0; *(uint8_t*)0x20000cbc = 0; *(uint8_t*)0x20000cbd = 0; *(uint8_t*)0x20000cbe = 0; *(uint8_t*)0x20000cbf = 0; *(uint8_t*)0x20000cc0 = 0; *(uint8_t*)0x20000cc1 = 0; *(uint8_t*)0x20000cc2 = 0; *(uint8_t*)0x20000cc3 = 0; *(uint8_t*)0x20000cc4 = 0; *(uint8_t*)0x20000cc5 = 0; *(uint8_t*)0x20000cc6 = 0; *(uint8_t*)0x20000cc7 = 0; *(uint8_t*)0x20000cc8 = 0; *(uint8_t*)0x20000cc9 = 0; *(uint8_t*)0x20000cca = 0; *(uint8_t*)0x20000ccb = 0; *(uint8_t*)0x20000ccc = 0; *(uint8_t*)0x20000ccd = 0; *(uint8_t*)0x20000cce = 0; *(uint8_t*)0x20000ccf = 0; *(uint8_t*)0x20000cd0 = 0; *(uint8_t*)0x20000cd1 = 0; *(uint8_t*)0x20000cd2 = 0; *(uint8_t*)0x20000cd3 = 0; *(uint8_t*)0x20000cd4 = 0; *(uint8_t*)0x20000cd5 = 0; *(uint8_t*)0x20000cd6 = 0; *(uint8_t*)0x20000cd7 = 0; *(uint8_t*)0x20000cd8 = 0; *(uint8_t*)0x20000cd9 = 0; *(uint8_t*)0x20000cda = 0; *(uint8_t*)0x20000cdb = 0; *(uint8_t*)0x20000cdc = 0; *(uint8_t*)0x20000cdd = 0; *(uint8_t*)0x20000cde = 0; *(uint8_t*)0x20000cdf = 0; *(uint8_t*)0x20000ce0 = 0; *(uint8_t*)0x20000ce1 = 0; *(uint8_t*)0x20000ce2 = 0; *(uint8_t*)0x20000ce3 = 0; *(uint8_t*)0x20000ce4 = 0; *(uint8_t*)0x20000ce5 = 0; *(uint8_t*)0x20000ce6 = 0; *(uint8_t*)0x20000ce7 = 0; *(uint8_t*)0x20000ce8 = 0; *(uint8_t*)0x20000ce9 = 0; *(uint8_t*)0x20000cea = 0; *(uint8_t*)0x20000ceb = 0; *(uint8_t*)0x20000cec = 0; *(uint8_t*)0x20000ced = 0; *(uint8_t*)0x20000cee = 0; *(uint8_t*)0x20000cef = 0; *(uint8_t*)0x20000cf0 = 0; *(uint8_t*)0x20000cf1 = 0; *(uint8_t*)0x20000cf2 = 0; *(uint8_t*)0x20000cf3 = 0; *(uint8_t*)0x20000cf4 = 0; *(uint8_t*)0x20000cf5 = 0; *(uint8_t*)0x20000cf6 = 0; *(uint8_t*)0x20000cf7 = 0; *(uint8_t*)0x20000cf8 = 0; *(uint8_t*)0x20000cf9 = 0; *(uint8_t*)0x20000cfa = 0; *(uint8_t*)0x20000cfb = 0; *(uint8_t*)0x20000cfc = 0; *(uint8_t*)0x20000cfd = 0; *(uint8_t*)0x20000cfe = 0; *(uint8_t*)0x20000cff = 0; *(uint8_t*)0x20000d00 = 0; *(uint8_t*)0x20000d01 = 0; *(uint8_t*)0x20000d02 = 0; *(uint8_t*)0x20000d03 = 0; *(uint8_t*)0x20000d04 = 0; *(uint8_t*)0x20000d05 = 0; *(uint8_t*)0x20000d06 = 0; *(uint8_t*)0x20000d07 = 0; *(uint8_t*)0x20000d08 = 0; *(uint8_t*)0x20000d09 = 0; *(uint8_t*)0x20000d0a = 0; *(uint8_t*)0x20000d0b = 0; *(uint8_t*)0x20000d0c = 0; *(uint8_t*)0x20000d0d = 0; *(uint8_t*)0x20000d0e = 0; *(uint8_t*)0x20000d0f = 0; *(uint8_t*)0x20000d10 = 0; *(uint8_t*)0x20000d11 = 0; *(uint8_t*)0x20000d12 = 0; *(uint8_t*)0x20000d13 = 0; *(uint8_t*)0x20000d14 = 0; *(uint8_t*)0x20000d15 = 0; *(uint8_t*)0x20000d16 = 0; *(uint8_t*)0x20000d17 = 0; *(uint8_t*)0x20000d18 = 0; *(uint8_t*)0x20000d19 = 0; *(uint8_t*)0x20000d1a = 0; *(uint8_t*)0x20000d1b = 0; *(uint8_t*)0x20000d1c = 0; *(uint8_t*)0x20000d1d = 0; *(uint8_t*)0x20000d1e = 0; *(uint8_t*)0x20000d1f = 0; *(uint8_t*)0x20000d20 = 0; *(uint8_t*)0x20000d21 = 0; *(uint8_t*)0x20000d22 = 0; *(uint8_t*)0x20000d23 = 0; *(uint8_t*)0x20000d24 = 0; *(uint8_t*)0x20000d25 = 0; *(uint8_t*)0x20000d26 = 0; *(uint8_t*)0x20000d27 = 0; *(uint32_t*)0x20000d28 = 0; *(uint16_t*)0x20000d2c = 0xa8; *(uint16_t*)0x20000d2e = 0xd0; *(uint32_t*)0x20000d30 = 0; *(uint64_t*)0x20000d38 = 0; *(uint64_t*)0x20000d40 = 0; *(uint16_t*)0x20000d48 = 0x28; memcpy((void*)0x20000d4a, "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000\000", 29); *(uint8_t*)0x20000d67 = 0; *(uint32_t*)0x20000d68 = 0xfffffffe; syscall(__NR_setsockopt, r[0], 0x29, 0x40, 0x20000980ul, 0x401ul); syscall(__NR_clone, 0xc75e43cfae22dd4ul, 0ul, 0x9999999999999999ul, 0ul, -1ul); syscall(__NR_openat, 0xffffffffffffff9cul, 0ul, 0x200000ul, 0ul); res = syscall(__NR_socket, 0x10ul, 3ul, 0xc); if (res != -1) r[1] = res; *(uint64_t*)0x200000c0 = 0; *(uint32_t*)0x200000c8 = 0; *(uint64_t*)0x200000d0 = 0x20000080; *(uint64_t*)0x20000080 = 0x20000040; *(uint32_t*)0x20000040 = 0x30; *(uint8_t*)0x20000044 = 0; *(uint8_t*)0x20000045 = 0xb; *(uint16_t*)0x20000046 = 0x401; *(uint32_t*)0x20000048 = 0; *(uint32_t*)0x2000004c = 0; *(uint8_t*)0x20000050 = 7; *(uint8_t*)0x20000051 = 0; *(uint16_t*)0x20000052 = htobe16(0); *(uint16_t*)0x20000054 = 8; STORE_BY_BITMASK(uint16_t, , 0x20000056, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x20000057, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x20000057, 0, 7, 1); *(uint32_t*)0x20000058 = htobe32(0); *(uint16_t*)0x2000005c = 8; STORE_BY_BITMASK(uint16_t, , 0x2000005e, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x2000005f, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x2000005f, 0, 7, 1); *(uint32_t*)0x20000060 = htobe32(1); *(uint16_t*)0x20000064 = 9; *(uint16_t*)0x20000066 = 1; memcpy((void*)0x20000068, "@])^\000", 5); *(uint64_t*)0x20000088 = 0x30; *(uint64_t*)0x200000d8 = 1; *(uint64_t*)0x200000e0 = 0; *(uint64_t*)0x200000e8 = 0; *(uint32_t*)0x200000f0 = 0; syscall(__NR_sendmsg, r[1], 0x200000c0ul, 0ul); } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); loop(); return 0; }