// https://syzkaller.appspot.com/bug?id=f1834e1735946170a8a3a4c85edb978e94bada81 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[55]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xf79000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul); *(uint16_t*)0x2065ffa8 = (uint16_t)0x26; memcpy((void*)0x2065ffaa, "\x61\x65\x61\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 14); *(uint32_t*)0x2065ffb8 = (uint32_t)0x0; *(uint32_t*)0x2065ffbc = (uint32_t)0x0; memcpy((void*)0x2065ffc0, "\x67\x63\x6d\x28\x61\x65\x73\x29\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00", 64); r[7] = syscall(__NR_bind, r[1], 0x2065ffa8ul, 0x58ul); memcpy((void*)0x20f78ff0, "\x89\x07\x7e\xb0\xcf\x00\x13\x00\xe0\xef" "\xff\x00\x3f\x54\xcd\xd5", 16); r[9] = syscall(__NR_setsockopt, r[1], 0x117ul, 0x1ul, 0x20f78ff0ul, 0x10ul); r[10] = syscall(__NR_accept, r[1], 0x0ul, 0x0ul); *(uint64_t*)0x20630000 = (uint64_t)0x0; *(uint32_t*)0x20630008 = (uint32_t)0x0; *(uint64_t*)0x20630010 = (uint64_t)0x20f78ff0; *(uint64_t*)0x20630018 = (uint64_t)0x1; *(uint64_t*)0x20630020 = (uint64_t)0x20f78000; *(uint64_t*)0x20630028 = (uint64_t)0x60; *(uint32_t*)0x20630030 = (uint32_t)0x2000809c; *(uint64_t*)0x20f78ff0 = (uint64_t)0x2004b000; *(uint64_t*)0x20f78ff8 = (uint64_t)0x0; *(uint64_t*)0x20f78000 = (uint64_t)0x18; *(uint32_t*)0x20f78008 = (uint32_t)0x117; *(uint32_t*)0x20f7800c = (uint32_t)0x4; *(uint32_t*)0x20f78010 = (uint32_t)0x3f; *(uint64_t*)0x20f78018 = (uint64_t)0x18; *(uint32_t*)0x20f78020 = (uint32_t)0x117; *(uint32_t*)0x20f78024 = (uint32_t)0x3; *(uint32_t*)0x20f78028 = (uint32_t)0x1; *(uint64_t*)0x20f78030 = (uint64_t)0x18; *(uint32_t*)0x20f78038 = (uint32_t)0x117; *(uint32_t*)0x20f7803c = (uint32_t)0x4; *(uint32_t*)0x20f78040 = (uint32_t)0x100; *(uint64_t*)0x20f78048 = (uint64_t)0x18; *(uint32_t*)0x20f78050 = (uint32_t)0x117; *(uint32_t*)0x20f78054 = (uint32_t)0x4; *(uint32_t*)0x20f78058 = (uint32_t)0x100000000; r[36] = syscall(__NR_sendmsg, r[10], 0x20630000ul, 0x40ul); *(uint32_t*)0x20dc5000 = (uint32_t)0x6e; r[38] = syscall(__NR_accept4, r[1], 0x20f78000ul, 0x20dc5000ul, 0x80000ul); *(uint64_t*)0x20b2dfc8 = (uint64_t)0x207ebffa; *(uint32_t*)0x20b2dfd0 = (uint32_t)0x6; *(uint64_t*)0x20b2dfd8 = (uint64_t)0x20f75000; *(uint64_t*)0x20b2dfe0 = (uint64_t)0x4; *(uint64_t*)0x20b2dfe8 = (uint64_t)0x20ec7000; *(uint64_t*)0x20b2dff0 = (uint64_t)0x0; *(uint32_t*)0x20b2dff8 = (uint32_t)0xfbffdffb; *(uint64_t*)0x20f75000 = (uint64_t)0x2088bfef; *(uint64_t*)0x20f75008 = (uint64_t)0x0; *(uint64_t*)0x20f75010 = (uint64_t)0x2074b000; *(uint64_t*)0x20f75018 = (uint64_t)0x0; *(uint64_t*)0x20f75020 = (uint64_t)0x20f11000; *(uint64_t*)0x20f75028 = (uint64_t)0x0; *(uint64_t*)0x20f75030 = (uint64_t)0x20f75000; *(uint64_t*)0x20f75038 = (uint64_t)0xe4; r[54] = syscall(__NR_recvmsg, r[10], 0x20b2dfc8ul, 0x2021ul); } int main() { loop(); return 0; }