// https://syzkaller.appspot.com/bug?id=f9c94b10e49ae0433f27c4838c7e0f0a321606f5 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void loop() { long res; res = syscall(__NR_socket, 0x10, 3, 6); if (res != -1) r[0] = res; *(uint64_t*)0x20ffefc8 = 0x2059cff4; *(uint16_t*)0x2059cff4 = 0x10; *(uint16_t*)0x2059cff6 = 0; *(uint32_t*)0x2059cff8 = 0; *(uint32_t*)0x2059cffc = 0; *(uint32_t*)0x20ffefd0 = 0xc; *(uint64_t*)0x20ffefd8 = 0x20f9bff0; *(uint64_t*)0x20f9bff0 = 0x208dff3c; *(uint32_t*)0x208dff3c = 0xb8; *(uint16_t*)0x208dff40 = 0x19; *(uint16_t*)0x208dff42 = 0x401; *(uint32_t*)0x208dff44 = 0; *(uint32_t*)0x208dff48 = 0; *(uint32_t*)0x208dff4c = htobe32(-1); *(uint8_t*)0x208dff5c = 0xac; *(uint8_t*)0x208dff5d = 0x14; *(uint8_t*)0x208dff5e = 0; *(uint8_t*)0x208dff5f = 0; *(uint16_t*)0x208dff6c = htobe16(0x4e20); *(uint16_t*)0x208dff6e = htobe16(0); *(uint16_t*)0x208dff70 = htobe16(0x4e20); *(uint16_t*)0x208dff72 = htobe16(0); *(uint16_t*)0x208dff74 = 0xa; *(uint8_t*)0x208dff76 = 0; *(uint8_t*)0x208dff77 = 0; *(uint8_t*)0x208dff78 = 0; *(uint32_t*)0x208dff7c = 0; *(uint32_t*)0x208dff80 = 0; *(uint64_t*)0x208dff84 = 0; *(uint64_t*)0x208dff8c = 0; *(uint64_t*)0x208dff94 = 0; *(uint64_t*)0x208dff9c = 0; *(uint64_t*)0x208dffa4 = 0; *(uint64_t*)0x208dffac = 0; *(uint64_t*)0x208dffb4 = 0; *(uint64_t*)0x208dffbc = 0; *(uint64_t*)0x208dffc4 = 0; *(uint64_t*)0x208dffcc = 0; *(uint64_t*)0x208dffd4 = 0; *(uint64_t*)0x208dffdc = 0; *(uint32_t*)0x208dffe4 = 0; *(uint32_t*)0x208dffe8 = 0; *(uint8_t*)0x208dffec = 0; *(uint8_t*)0x208dffed = 0; *(uint8_t*)0x208dffee = 0; *(uint8_t*)0x208dffef = 0; *(uint64_t*)0x20f9bff8 = 0xb8; *(uint64_t*)0x20ffefe0 = 1; *(uint64_t*)0x20ffefe8 = 0; *(uint64_t*)0x20ffeff0 = 0; *(uint32_t*)0x20ffeff8 = 0; syscall(__NR_sendmsg, r[0], 0x20ffefc8, 0); *(uint8_t*)0x20edd000 = 1; *(uint8_t*)0x20edd001 = 0x80; *(uint8_t*)0x20edd002 = 0xc2; *(uint8_t*)0x20edd003 = 0; *(uint8_t*)0x20edd004 = 0; *(uint8_t*)0x20edd005 = 0; *(uint8_t*)0x20edd006 = 0xaa; *(uint8_t*)0x20edd007 = 0xaa; *(uint8_t*)0x20edd008 = 0xaa; *(uint8_t*)0x20edd009 = 0xaa; *(uint8_t*)0x20edd00a = 0; *(uint8_t*)0x20edd00b = 0; *(uint16_t*)0x20edd00c = htobe16(0x8864); *(uint32_t*)0x20efe000 = 0; *(uint32_t*)0x20efe004 = 0; *(uint32_t*)0x20efe008 = 0; *(uint32_t*)0x20efe00c = 0; *(uint32_t*)0x20efe010 = 0; *(uint32_t*)0x20efe014 = 0; res = syscall(__NR_socket, 0xa, 0x80002, 0x88); if (res != -1) r[1] = res; *(uint16_t*)0x208a8000 = 0xa; *(uint16_t*)0x208a8002 = htobe16(0x4e23); *(uint32_t*)0x208a8004 = 0; *(uint8_t*)0x208a8008 = 0; *(uint8_t*)0x208a8009 = 0; *(uint8_t*)0x208a800a = 0; *(uint8_t*)0x208a800b = 0; *(uint8_t*)0x208a800c = 0; *(uint8_t*)0x208a800d = 0; *(uint8_t*)0x208a800e = 0; *(uint8_t*)0x208a800f = 0; *(uint8_t*)0x208a8010 = 0; *(uint8_t*)0x208a8011 = 0; *(uint8_t*)0x208a8012 = 0; *(uint8_t*)0x208a8013 = 0; *(uint8_t*)0x208a8014 = 0; *(uint8_t*)0x208a8015 = 0; *(uint8_t*)0x208a8016 = 0; *(uint8_t*)0x208a8017 = 0; *(uint32_t*)0x208a8018 = 0; syscall(__NR_bind, r[1], 0x208a8000, 0x1c); res = syscall(__NR_socket, 0xa, 0x8000000000000802, 0); if (res != -1) r[2] = res; syscall(__NR_dup2, r[1], r[2]); *(uint64_t*)0x20a29000 = 0x20685ff0; *(uint16_t*)0x20685ff0 = 2; *(uint16_t*)0x20685ff2 = htobe16(0x4e23); *(uint32_t*)0x20685ff4 = htobe32(0); *(uint8_t*)0x20685ff8 = 0; *(uint8_t*)0x20685ff9 = 0; *(uint8_t*)0x20685ffa = 0; *(uint8_t*)0x20685ffb = 0; *(uint8_t*)0x20685ffc = 0; *(uint8_t*)0x20685ffd = 0; *(uint8_t*)0x20685ffe = 0; *(uint8_t*)0x20685fff = 0; *(uint32_t*)0x20a29008 = 0x10; *(uint64_t*)0x20a29010 = 0x20fc5fc0; *(uint64_t*)0x20a29018 = 0; *(uint64_t*)0x20a29020 = 0; *(uint64_t*)0x20a29028 = 0; *(uint32_t*)0x20a29030 = 0; syscall(__NR_sendmsg, r[2], 0x20a29000, 0x8000); *(uint16_t*)0x2089cfe4 = 0xa; *(uint16_t*)0x2089cfe6 = htobe16(0x4e20); *(uint32_t*)0x2089cfe8 = 0; *(uint8_t*)0x2089cfec = 0; *(uint8_t*)0x2089cfed = 0; *(uint8_t*)0x2089cfee = 0; *(uint8_t*)0x2089cfef = 0; *(uint8_t*)0x2089cff0 = 0; *(uint8_t*)0x2089cff1 = 0; *(uint8_t*)0x2089cff2 = 0; *(uint8_t*)0x2089cff3 = 0; *(uint8_t*)0x2089cff4 = 0; *(uint8_t*)0x2089cff5 = 0; *(uint8_t*)0x2089cff6 = 0; *(uint8_t*)0x2089cff7 = 0; *(uint8_t*)0x2089cff8 = 0; *(uint8_t*)0x2089cff9 = 0; *(uint8_t*)0x2089cffa = 0; *(uint8_t*)0x2089cffb = 0; *(uint32_t*)0x2089cffc = 0; syscall(__NR_sendto, r[2], 0x20000080, 0, 0, 0x2089cfe4, 0x1c); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }