// https://syzkaller.appspot.com/bug?id=910c84220f7ed55f124919cf54980c617e5fed76 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_sendmsg #define SYS_sendmsg 28 #endif #ifndef SYS_socket #define SYS_socket 394 #endif uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x1012, -1, 0, 0); long res = 0; res = syscall(SYS_socket, 2, 1, 0); if (res != -1) r[0] = res; res = syscall(SYS_dup2, r[0], r[0]); if (res != -1) r[1] = res; *(uint64_t*)0x200011c0 = 0; *(uint32_t*)0x200011c8 = 0; *(uint64_t*)0x200011d0 = 0; *(uint64_t*)0x200011d8 = 0; *(uint64_t*)0x200011e0 = 0x20001200; *(uint64_t*)0x20001200 = 0x20; *(uint32_t*)0x20001208 = 0xffff; *(uint32_t*)0x2000120c = 2; *(uint32_t*)0x20001210 = 0; *(uint32_t*)0x20001214 = 0; *(uint32_t*)0x20001218 = 0; *(uint64_t*)0x20001220 = 0x20; *(uint32_t*)0x20001228 = 0xffff; *(uint32_t*)0x2000122c = 2; *(uint32_t*)0x20001230 = 0; *(uint32_t*)0x20001234 = 0; *(uint32_t*)0x20001238 = 0; *(uint64_t*)0x200011e8 = 0x40; *(uint32_t*)0x200011f0 = 2; syscall(SYS_sendmsg, r[1], 0x200011c0, 0x3fd); return 0; }