// https://syzkaller.appspot.com/bug?id=c0789e761577af6735c74541d6035c0a9a73cff9 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); intptr_t res = 0; *(uint32_t*)0x20000200 = 0xc; *(uint32_t*)0x20000204 = 0xe; *(uint64_t*)0x20000208 = 0x20000040; memcpy( (void*)0x20000040, "\xb7\x02\x00\x00\x03\x07\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07\x01" "\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4\xf0\xff" "\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05\x00\x00\x00" "\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00\xf5\x06\x7d\x60" "\xb7\x03\x00\x00\x00\x00\x00\x00\x6a\x0a\x00\xfe\x18\x00\x00\x00\x85\x00" "\x00\x00\x2b\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00" "\x00\x00\x00\x00\x0d\x7a\x28\x07\x3a\x41\x02\xe4\xae\xb5\x4f\x36\x63\x3e" "\x27\xc2\x79\x34\x1b\xf4\x89\x90\x3c\xfd\xb4\xc0\x5e\x96\xe3\x04\x6f\x04" "\xe7\x79\x69\xbe\x06\x34\x67\x4d\x09\x42\xb6\x6b\x24\x9b\x35\x18\x59\x8e" "\x7e\x29\x0b\x39\xa6\xf2\xfc\x2a\x5e\x01\x9b\xc6\xb4\x56\x84\xf0\x02\xcf" "\x57\xbf\x88\x7e\x83\xfb\xb2\x21\x5b\x8a\x34\xe6\xbd\xc4\xdc\x1e\xf6\xd3" "\xc6\x95\x8d\xa4\xbd\xda\xc6\x02\xe0\x04\x8b\xec\x11\xe8\x74\x60\x2f\x06" "\x00\x00\x00\x2a\xf2\x1b\x75\xfe\x26\xaa\x5e\x85\xae\x28\xaa\x60\xfe\x19" "\x93\xbf\xa2\x13\x92\x3b\xb7\x55\xc1\xf1\xab\xd1\x96\x40\x7b\x4c\x8f\xab" "\xe2\x7b\x21\x21\xa5\xf0\x3d\xff\x97\x87\xdf\xd6\xe7\x60\x8e\xb6\x38\xe6" "\xfc\x4e\x0b\xc6\xbd\x5f\xf3\x59\x28\xa5\xb5\xfa\x72\x30\x28\xeb\x6d\xdd" "\x35\xea\x79\xb9\x2b\xee\xb5\x22\x65\xa4\xb0\x4b\xa5\x0f\xd4\x6a\x50\x41" "\x16\xfb\x8e\xf8\x4c\x2b\xe0\x21\xa6\xc9\xda\xf3\xf2\x4a\xd7\xb9\x65\xaf" "\x8f\x52\x23\x71\xc9\xa4\x3c\x80\xee\x6b\x39\x7b\xea\x24\x7e\x2d\x71\x40" "\x90\xd4\x3f\xe6\x6b\xbf\x4f\x4f\xfe\x41\x0b\xd7\x01\xd0\x35\x0f\x8d\xde" "\x2a\x20\xa0\xae\xff\xb9\x84\x39\x47\xc3\xbc\xed\x2e\x00\x46\x3d\x9c\x03" "\x9b\xfd\xd5\x87\x09\xe8\x98\xc7\xeb\xad\x73\xfc\x48\xe7\x3c\x75\xb5\x05" "\xb8\x52\x62\x1a\xd1\x9c\x85\x46\x22\xf7\xc7\xd7\x9e\xc3\xab\x44\x94\x35" "\x3b\x9f\x6b\x82\x22\x11\xeb\x1a\xa4\x8c\xfc\xae\xbb", 427); *(uint64_t*)0x20000210 = 0x20000340; memcpy((void*)0x20000340, "syzkaller\000", 10); *(uint32_t*)0x20000218 = 0; *(uint32_t*)0x2000021c = 0; *(uint64_t*)0x20000220 = 0; *(uint32_t*)0x20000228 = 0; *(uint32_t*)0x2000022c = 0; *(uint8_t*)0x20000230 = 0; *(uint8_t*)0x20000231 = 0; *(uint8_t*)0x20000232 = 0; *(uint8_t*)0x20000233 = 0; *(uint8_t*)0x20000234 = 0; *(uint8_t*)0x20000235 = 0; *(uint8_t*)0x20000236 = 0; *(uint8_t*)0x20000237 = 0; *(uint8_t*)0x20000238 = 0; *(uint8_t*)0x20000239 = 0; *(uint8_t*)0x2000023a = 0; *(uint8_t*)0x2000023b = 0; *(uint8_t*)0x2000023c = 0; *(uint8_t*)0x2000023d = 0; *(uint8_t*)0x2000023e = 0; *(uint8_t*)0x2000023f = 0; *(uint32_t*)0x20000240 = 0; *(uint32_t*)0x20000244 = 0; *(uint32_t*)0x20000248 = -1; *(uint32_t*)0x2000024c = 8; *(uint64_t*)0x20000250 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000258 = 0; *(uint32_t*)0x2000025c = 0x10; *(uint64_t*)0x20000260 = 0x20000000; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x20000268 = 0; res = syscall(__NR_bpf, 5, 0x20000200, 0x48); if (res != -1) r[0] = res; *(uint32_t*)0x20000780 = r[0]; *(uint32_t*)0x20000784 = 0x2a0; *(uint32_t*)0x20000788 = 0xe; *(uint32_t*)0x2000078c = 0; *(uint64_t*)0x20000790 = 0x200006c0; memcpy((void*)0x200006c0, "\xb9\xff\x03\x00\x00\x0d\x69\x8c\xb8\x9e\x40\xf0\x2c\xea", 14); *(uint64_t*)0x20000798 = 0; *(uint32_t*)0x200007a0 = 0x102; *(uint32_t*)0x200007a4 = 0; *(uint32_t*)0x200007a8 = 0; *(uint32_t*)0x200007ac = 0; *(uint64_t*)0x200007b0 = 0x20000000; *(uint64_t*)0x200007b8 = 0x20000000; syscall(__NR_bpf, 0xa, 0x20000780, 0x28); return 0; }