// https://syzkaller.appspot.com/bug?id=6599b79e52059759a0af877a925ae07482a3dd64 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_ioctl #define __NR_ioctl 54 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_mprotect #define __NR_mprotect 125 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); memcpy((void*)0x200001c0, "\x69\x70\x36\x67\x72\x65\x74\x61\x70\x30\x00\x00\x00\x00\x00\x00", 16); *(uint32_t*)0x200001d0 = 0x200000c0; *(uint32_t*)0x200000c0 = 0x17; *(uint32_t*)0x200000c4 = 0; *(uint8_t*)0x200000c8 = 0; *(uint8_t*)0x200000c9 = 0; *(uint8_t*)0x200000ca = 0; *(uint8_t*)0x200000cb = 0; *(uint8_t*)0x200000cc = 0; *(uint8_t*)0x200000cd = 0; *(uint8_t*)0x200000ce = 0; *(uint8_t*)0x200000cf = 0; *(uint32_t*)0x200000d0 = 0; *(uint32_t*)0x200000d4 = 0; *(uint32_t*)0x200000d8 = 0; *(uint32_t*)0x200000dc = 0; *(uint32_t*)0x200000e0 = 0; *(uint32_t*)0x200000e4 = 0; *(uint32_t*)0x200000e8 = 0; *(uint32_t*)0x200000ec = 0; syscall(__NR_ioctl, -1, 0x8946, 0x200001c0); syscall(__NR_mprotect, 0x20000000, 0x800000, 0); return 0; }