// https://syzkaller.appspot.com/bug?id=e826b4d012da9963d581b16d665db3811588ffbe // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #ifndef __NR_sendto #define __NR_sendto 369 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_bind #define __NR_bind 361 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[1]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x15, 5, 0); *(uint16_t*)0x20989ff0 = 2; *(uint16_t*)0x20989ff2 = htobe16(0x4e20); *(uint32_t*)0x20989ff4 = htobe32(0x7f000001); *(uint8_t*)0x20989ff8 = 0; *(uint8_t*)0x20989ff9 = 0; *(uint8_t*)0x20989ffa = 0; *(uint8_t*)0x20989ffb = 0; *(uint8_t*)0x20989ffc = 0; *(uint8_t*)0x20989ffd = 0; *(uint8_t*)0x20989ffe = 0; *(uint8_t*)0x20989fff = 0; syscall(__NR_bind, r[0], 0x20989ff0, 0x10); *(uint16_t*)0x2069affb = 2; *(uint16_t*)0x2069affd = htobe16(0x4e20); *(uint32_t*)0x2069afff = htobe32(0x7f000001); *(uint8_t*)0x2069b003 = 0; *(uint8_t*)0x2069b004 = 0; *(uint8_t*)0x2069b005 = 0; *(uint8_t*)0x2069b006 = 0; *(uint8_t*)0x2069b007 = 0; *(uint8_t*)0x2069b008 = 0; *(uint8_t*)0x2069b009 = 0; *(uint8_t*)0x2069b00a = 0; syscall(__NR_sendto, r[0], 0x20fc2000, 0, 0, 0x2069affb, 0x10); } int main() { loop(); return 0; }