// https://syzkaller.appspot.com/bug?id=5cf01aa760647bcea3b9ecdbb97f70975582f64f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); use_temporary_dir(); intptr_t res = 0; memcpy((void*)0x20000440, "/dev/vcsa\000", 10); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20000440ul, 0ul, 0ul); if (res != -1) r[0] = res; *(uint64_t*)0x20001b00 = 0x20001b40; *(uint64_t*)0x20001b08 = 0x19008; syscall(__NR_preadv, r[0], 0x20001b00ul, 6ul, 3, 0); return 0; }