// https://syzkaller.appspot.com/bug?id=589697e4c5206661852fa9c1cb2beefe953dfed8 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0x10ul, 3ul, 0ul); if (res != -1) r[0] = res; res = syscall(__NR_socketpair, 1ul, 5ul, 0ul, 0x200000c0ul); if (res != -1) r[1] = *(uint32_t*)0x200000c4; res = syscall(__NR_dup, r[1]); if (res != -1) r[2] = res; *(uint32_t*)0x20000140 = 0x14; res = syscall(__NR_getsockname, r[2], 0x200000c0ul, 0x20000140ul); if (res != -1) r[3] = *(uint32_t*)0x200000c4; *(uint64_t*)0x20000040 = 0; *(uint32_t*)0x20000048 = 0; *(uint64_t*)0x20000050 = 0x200000c0; *(uint64_t*)0x200000c0 = 0x20000200; memcpy((void*)0x20000200, "\x38\x00\x00\x00\x6c\x00\x05\x07\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 20); *(uint32_t*)0x20000214 = r[3]; memcpy((void*)0x20000218, "\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x34\x80" "\x14\x00\x35\x00\x76\x65\x74\x68\x30\x5f\x74\x6f" "\xe3\x4c\x4c\x79\xae\x9c\x7d\xd4\x73\x31\xea\x8e" "\xb1\x5f\x62\x72\x69\x64\x67\x65\x00", 45); *(uint64_t*)0x200000c8 = 0x38; *(uint64_t*)0x20000058 = 1; *(uint64_t*)0x20000060 = 0; *(uint64_t*)0x20000068 = 0; *(uint32_t*)0x20000070 = 0; syscall(__NR_sendmsg, r[0], 0x20000040ul, 0ul); return 0; }