// https://syzkaller.appspot.com/bug?id=502c872feb9bbb5ad6494c349c7faa87a9f1777b // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xa000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 0x10); *(uint32_t*)0x20002000 = 3; syscall(__NR_setsockopt, r[0], 0x10e, 0xb, 0x20002000, 4); *(uint32_t*)0x20008000 = 0x20000ff4; *(uint32_t*)0x20008004 = 0xc; *(uint32_t*)0x20008008 = 0x20006000; *(uint32_t*)0x2000800c = 1; *(uint32_t*)0x20008010 = 0; *(uint32_t*)0x20008014 = 0; *(uint32_t*)0x20008018 = 0; *(uint16_t*)0x20000ff4 = 0x10; *(uint16_t*)0x20000ff6 = 0; *(uint32_t*)0x20000ff8 = 0; *(uint32_t*)0x20000ffc = 0; *(uint32_t*)0x20006000 = 0x20007000; *(uint32_t*)0x20006004 = 0x14; *(uint32_t*)0x20007000 = 0x14; *(uint16_t*)0x20007004 = 0; *(uint16_t*)0x20007006 = 0x514; *(uint32_t*)0x20007008 = 0; *(uint32_t*)0x2000700c = 0; *(uint8_t*)0x20007010 = 0; *(uint8_t*)0x20007011 = 0; *(uint16_t*)0x20007012 = 0; syscall(__NR_sendmsg, r[0], 0x20008000, 0); } int main() { loop(); return 0; }