// https://syzkaller.appspot.com/bug?id=fd5ec800aabd46be2fca1d58a2da5cc029dca7ad // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include const int kInitNetNsFd = 239; static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto) { return syscall(__NR_socket, domain, type, proto); } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = -1; res = syz_init_net_socket(0x10, 3, 0x10); if (res != -1) r[0] = res; *(uint64_t*)0x20000000 = 0; *(uint32_t*)0x20000008 = 0; *(uint64_t*)0x20000010 = 0x200004c0; *(uint64_t*)0x200004c0 = 0x20000040; memcpy((void*)0x20000040, "\x1c\x00\x00\x00\x2a\x00\x05\x00\x00\x00\x1a\x46\xab\xcf\xd9\x6d\x07" "\x60\x00\x80\x08\x00\x01\x00\x00\x00\x00\x00\x4d\xd0\x5c\xe5\x82\xa6" "\x78\x82\x5d\xe9\x07\x14\xd9\x04\xb3\x04\x97\x1a\x48\x30\x99\xe3\x28" "\xdd\x1f\x64\x4c\x1f\x83\x58\xcb\x2e\x82\x2e\x32\x45\xe2\x54\xbe\x37" "\x0f\x2b\x5b\x8e\x98\x87\x7c\x8a\x3c\xb8\x24\x14\x45\x61\x2e\xe0\xea" "\xec\x6b\x49\xf7\xff\xb4\xcc\xe3\x18\x82\x5c\x8b\xa2\x88\x99\x5b\xa8" "\x1c\xfd\x06\x7d\xe1\x66\x8b\x6d\x8b\x31\x06\x12\x59\x07\x9b\xde\x8c" "\x00\xcb\x78\x8a\x8f\xaa\x3f\x23\x62\xd3\xfb\x23\x00\xf6\x49\x0a\xa1" "\x1e\xb9\x77\xb3\x11\xf3\x5a\x58\x46\x7c\x12\x06\x66\xc0\x37\x09\x00" "\x00\x00\x2d\xeb\xd3\xb1\x11\x76\x31\x26\x58\xce\xc8\x88\x1b\x68\x45" "\x44\x66\xcc\x00\x2d\xf3\x8b\xb9\x4b\xe5\x05\x2e", 182); *(uint64_t*)0x200004c8 = 0x1c; *(uint64_t*)0x20000018 = 1; *(uint64_t*)0x20000020 = 0; *(uint64_t*)0x20000028 = 0; *(uint32_t*)0x20000030 = 0; syscall(__NR_sendmsg, r[0], 0x20000000ul, 0ul); return 0; }