// https://syzkaller.appspot.com/bug?id=8af2597890938b642c3bf44a85859691fb9d5cfa // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[2]; uint64_t procid; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0xa, 1, 0); memcpy((void*)0x20000000, "tls", 4); syscall(__NR_setsockopt, r[0], 6, 0x1f, 0x20000000, 4); *(uint16_t*)0x20aa1000 = 2; *(uint16_t*)0x20aa1002 = htobe16(0x4e22 + procid * 4); *(uint32_t*)0x20aa1004 = htobe32(0x7f000001); *(uint8_t*)0x20aa1008 = 0; *(uint8_t*)0x20aa1009 = 0; *(uint8_t*)0x20aa100a = 0; *(uint8_t*)0x20aa100b = 0; *(uint8_t*)0x20aa100c = 0; *(uint8_t*)0x20aa100d = 0; *(uint8_t*)0x20aa100e = 0; *(uint8_t*)0x20aa100f = 0; syscall(__NR_sendto, r[0], 0x20aa1000, 0, 0x23ffffff, 0x20aa1000, 0x10); r[1] = syscall(__NR_socket, 0x10, 3, 0); memcpy((void*)0x2008d000, "\x26\x00\x00\x00\x13\x00\x47\xf1\x07\x03\xc1\xb0" "\x0e\x00\x00\x00\x00\x00\xb1\x00\x01\x00\x00\x00" "\x09\x05\x19\x00\x09\x08\xf1\x26\x05\x00\x27\x00" "\x6e\x35", 38); syscall(__NR_write, r[1], 0x2008d000, 0x26); } int main() { for (procid = 0; procid < 8; procid++) { if (fork() == 0) { for (;;) { loop(); } } } sleep(1000000); return 0; }