// https://syzkaller.appspot.com/bug?id=08967990c042213d9aea7b6e111cb6ad7e746fd1 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; memcpy((void*)0x20000000, "/dev/snd/timer\000", 15); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000000ul, 0ul, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000040 = 1; syscall(__NR_ioctl, r[0], 0x40045402, 0x20000040ul); *(uint32_t*)0x20000080 = 1; *(uint32_t*)0x20000084 = 0; *(uint32_t*)0x20000088 = 0; *(uint32_t*)0x2000008c = 0; *(uint32_t*)0x20000090 = 0; memset((void*)0x20000094, 0, 32); syscall(__NR_ioctl, r[0], 0x40345410, 0x20000080ul); *(uint32_t*)0x20000440 = 0; *(uint32_t*)0x20000444 = 0x20000006; *(uint32_t*)0x20000448 = 0; *(uint32_t*)0x2000044c = 0; *(uint32_t*)0x20000450 = 0xd; memset((void*)0x20000454, 0, 60); syscall(__NR_ioctl, r[0], 0x40505412, 0x20000440ul); *(uint64_t*)0x20000240 = 0xffffffffffffff00; syscall(__NR_ioctl, r[0], 0x5452, 0x20000240ul); syscall(__NR_ioctl, r[0], 0x54a0, 0); memcpy((void*)0x20000280, ".\000", 2); res = syscall(__NR_open, 0x20000280ul, 0ul, 0ul); if (res != -1) r[1] = res; syscall(__NR_fcntl, r[1], 8ul, -1); syscall(__NR_fcntl, r[1], 0x402ul, 0x25ul); memcpy((void*)0x20000040, "./file0\000", 8); syscall(__NR_creat, 0x20000040ul, 0ul); memcpy((void*)0x20000b40, "/dev/dsp\000", 9); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000b40ul, 0x41081ul, 0ul); if (res != -1) r[2] = res; *(uint8_t*)0x20004240 = 0x7f; *(uint8_t*)0x20004241 = 0x45; *(uint8_t*)0x20004242 = 0x4c; *(uint8_t*)0x20004243 = 0x46; *(uint8_t*)0x20004244 = 0; *(uint8_t*)0x20004245 = 0; *(uint8_t*)0x20004246 = 0; *(uint8_t*)0x20004247 = 0; *(uint64_t*)0x20004248 = 0; *(uint16_t*)0x20004250 = 0; *(uint16_t*)0x20004252 = 0; *(uint32_t*)0x20004254 = 0; *(uint32_t*)0x20004258 = 0; *(uint32_t*)0x2000425c = 0x38; *(uint32_t*)0x20004260 = 0; *(uint32_t*)0x20004264 = 0; *(uint16_t*)0x20004268 = 0; *(uint16_t*)0x2000426a = 0x20; *(uint16_t*)0x2000426c = 0; *(uint16_t*)0x2000426e = 0; *(uint16_t*)0x20004270 = 0; *(uint16_t*)0x20004272 = 0; *(uint32_t*)0x20004278 = 0; *(uint32_t*)0x2000427c = 0; *(uint32_t*)0x20004280 = 0; *(uint32_t*)0x20004284 = 0; *(uint32_t*)0x20004288 = 0; *(uint32_t*)0x2000428c = 0; *(uint32_t*)0x20004290 = 0; *(uint32_t*)0x20004294 = 0; memset((void*)0x20004298, 0, 256); memset((void*)0x20004398, 0, 256); memset((void*)0x20004498, 0, 256); memset((void*)0x20004598, 0, 256); memset((void*)0x20004698, 0, 256); syscall(__NR_write, r[2], 0x20004240ul, 0x558ul); return 0; }