// https://syzkaller.appspot.com/bug?id=69f509165ae1d5bf8e02df2df76713a03a49da08 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); *(uint64_t*)0x20002400 = 0x20000000; *(uint8_t*)0x20000000 = 0x10; *(uint8_t*)0x20000001 = 2; *(uint16_t*)0x20000002 = htobe16(0x4e21); *(uint8_t*)0x20000004 = 0xac; *(uint8_t*)0x20000005 = 0x14; *(uint8_t*)0x20000006 = 0; *(uint8_t*)0x20000007 = 0xbb; memset((void*)0x20000008, 0, 8); *(uint32_t*)0x20002408 = 0x10; *(uint64_t*)0x20002410 = 0; *(uint64_t*)0x20002418 = 0; *(uint64_t*)0x20002420 = 0x20002280; *(uint64_t*)0x20002280 = 0x68; *(uint32_t*)0x20002288 = 0; *(uint32_t*)0x2000228c = 0; memcpy((void*)0x20002290, "\x28\x2e\x95\xe6\xd0\x02\xe4\x40\x2d\xdc\xbc\x01\xa7\x43\x94\xc3\x70" "\xf1\xfb\x3a\x42\xea\x6f\x6a\x7b\x3f\x70\x03\x56\x36\x39\x0c\x16\x60" "\x2d\xd1\x2c\xc8\x8f\x71\x86\x17\x48\x63\x3a\x9b\x43\x62\xba\x84\x73" "\xfd\xbf\x81\xfb\xbf\xf2\x5a\xdb\x61\xcb\x28\x55\x39\x45\x3e\xc4\x9c" "\x15\x3e\xc4\x83\xf8\x14\x79\xd5\xda\xf5\x80\x0d\x1a", 81); *(uint64_t*)0x200022e8 = 0x108; *(uint32_t*)0x200022f0 = 0; *(uint32_t*)0x200022f4 = 0; memcpy( (void*)0x200022f8, "\x0d\xcc\xc6\xe3\x33\x7b\xfc\xae\xc5\xe3\x5e\xd4\x39\xc6\xce\x36\xb7\x68" "\x61\xae\x7b\xf1\xea\x46\xe2\x62\x33\xdb\x68\x3c\x90\x2c\x31\xd5\x1b\x37" "\x8b\x54\xe9\xdf\x0d\x4a\x89\x3f\x9d\x64\xcf\xf2\x0f\x39\x02\x01\xd6\xef" "\xc3\x9c\x72\x23\xb6\xf5\x7f\x84\x7c\x1e\xc3\xa5\x07\xb0\x49\xa8\x86\x8a" "\x34\xd2\x5c\xbe\x6e\x8e\x74\x7d\xf8\xa9\x8e\x2c\x7f\xd7\xd4\xdd\xc7\x32" "\x67\xb7\x01\xa5\x8c\xac\xb6\x41\x32\x78\x29\x78\x15\x8c\x3c\x08\x50\xd9" "\x6b\x46\xda\xc1\x31\x0f\x48\x35\xaa\x6a\x5b\x09\xfe\x03\xee\x34\xd4\x2c" "\x94\x3c\xf1\x92\x18\x3f\x8d\x40\x78\xbf\x52\x6c\x20\x42\xf2\x79\xf2\xe0" "\x01\x1f\xb2\x36\xcd\x24\x25\xd9\x52\x4a\x71\x02\xab\xb1\xa7\x80\xd3\xc5" "\x43\x9f\xdd\x26\x1e\x8d\x67\x63\x58\x8b\x4f\x85\xa5\x93\x5f\x78\x61\x47" "\x7e\x3f\xbf\x11\xfe\x2e\xae\xb1\xfb\x8b\xed\xf6\x5b\xa7\x17\x7b\xdc\xc3" "\xd1\x2e\x64\x74\xc7\x82\x94\xde\xb8\xa2\x26\xcf\x86\x47\x56\xf9\x3c\x19" "\x16\x88\x07\x4f\xf6\xdd\x9f\x4e\x19\x35\x5f\x98\xf5\x9d\xa8\x41\xe9\xd5" "\xdc\xfa\xcc\xe7\xe5\xd2\xf7", 241); *(uint64_t*)0x200023f0 = 0x18; *(uint32_t*)0x200023f8 = 0; *(uint32_t*)0x200023fc = 0; memcpy((void*)0x20002400, "\x58\xa4\x96\x3e\xb2\x9e", 6); *(uint64_t*)0x20002428 = 0x188; *(uint32_t*)0x20002430 = 0; syscall(SYS_sendmsg, -1, 0x20002400ul, 0ul); return 0; }