// https://syzkaller.appspot.com/bug?id=0a9bcf6ef68a6d01c7005e197d5b83e068c41fa7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; memcpy((void*)0x20001280, "/dev/dsp", 9); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20001280, 0x103000, 0); if (res != -1) r[0] = res; *(uint64_t*)0x200011c0 = 0x200000c0; *(uint64_t*)0x200011c8 = 0x1000; *(uint64_t*)0x200011d0 = 0x200010c0; *(uint64_t*)0x200011d8 = 0x3d; *(uint64_t*)0x200011e0 = 0x20001100; *(uint64_t*)0x200011e8 = 0x3b; *(uint64_t*)0x200011f0 = 0x20001140; *(uint64_t*)0x200011f8 = 0x3c; *(uint64_t*)0x20001200 = 0x20001180; *(uint64_t*)0x20001208 = 0xa; syscall(__NR_readv, r[0], 0x200011c0, 5); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }