// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x200011c0 = 0x20000180; *(uint16_t*)0x20000180 = 0x18; *(uint32_t*)0x20000182 = 0; *(uint16_t*)0x20000186 = 4; *(uint8_t*)0x20000188 = 0; *(uint8_t*)0x20000189 = 0; *(uint8_t*)0x2000018a = 0; *(uint8_t*)0x2000018b = 0; *(uint8_t*)0x2000018c = 0; *(uint8_t*)0x2000018d = 0; memcpy((void*)0x2000018e, "\x72\x6f\x73\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint32_t*)0x200011c8 = 0x80; *(uint64_t*)0x200011d0 = 0x200006c0; *(uint64_t*)0x200006c0 = 0x20000200; *(uint64_t*)0x200006c8 = 0; *(uint64_t*)0x200006d0 = 0x20000240; *(uint64_t*)0x200006d8 = 0; *(uint64_t*)0x200006e0 = 0x20000340; *(uint64_t*)0x200006e8 = 0; *(uint64_t*)0x200006f0 = 0x200003c0; *(uint64_t*)0x200006f8 = 0; *(uint64_t*)0x20000700 = 0x20000400; *(uint64_t*)0x20000708 = 0; *(uint64_t*)0x20000710 = 0x20000480; *(uint64_t*)0x20000718 = 0; *(uint64_t*)0x20000720 = 0x20000580; *(uint64_t*)0x20000728 = 0; *(uint64_t*)0x20000730 = 0x20000600; *(uint64_t*)0x20000738 = 0; *(uint64_t*)0x200011d8 = 8; *(uint64_t*)0x200011e0 = 0x200012c0; *(uint64_t*)0x200011e8 = 0; *(uint32_t*)0x200011f0 = 0x41; *(uint32_t*)0x200011f8 = 0x40; *(uint64_t*)0x20001200 = 0; *(uint32_t*)0x20001208 = 0; *(uint64_t*)0x20001210 = 0x20000a80; *(uint64_t*)0x20000a80 = 0x20000840; *(uint64_t*)0x20000a88 = 0; *(uint64_t*)0x20000a90 = 0x20000940; *(uint64_t*)0x20000a98 = 0; *(uint64_t*)0x20000aa0 = 0x200009c0; *(uint64_t*)0x20000aa8 = 0; *(uint64_t*)0x20001218 = 3; *(uint64_t*)0x20001220 = 0x20000ac0; *(uint64_t*)0x20000ac0 = 0x10; *(uint32_t*)0x20000ac8 = 0x100; *(uint32_t*)0x20000acc = 5; *(uint64_t*)0x20000ad0 = 0x10; *(uint32_t*)0x20000ad8 = 0; *(uint32_t*)0x20000adc = 3; *(uint64_t*)0x20001228 = 0x20; *(uint32_t*)0x20001230 = 0x2000c841; *(uint32_t*)0x20001238 = 4; *(uint64_t*)0x20001240 = 0x20000bc0; *(uint16_t*)0x20000bc0 = 0x10; *(uint16_t*)0x20000bc2 = 0; *(uint32_t*)0x20000bc4 = 0; *(uint32_t*)0x20000bc8 = 0x80008000; *(uint32_t*)0x20001248 = 0x80; *(uint64_t*)0x20001250 = 0x20000dc0; *(uint64_t*)0x20000dc0 = 0x20000c40; *(uint64_t*)0x20000dc8 = 0; *(uint64_t*)0x20000dd0 = 0x20000cc0; *(uint64_t*)0x20000dd8 = 0; *(uint64_t*)0x20001258 = 2; *(uint64_t*)0x20001260 = 0x20000e00; *(uint64_t*)0x20000e00 = 0x10; *(uint32_t*)0x20000e08 = 0x11b; *(uint32_t*)0x20000e0c = 0; *(uint64_t*)0x20000e10 = 0x10; *(uint32_t*)0x20000e18 = 0x113; *(uint32_t*)0x20000e1c = 0x7ff; *(uint64_t*)0x20000e20 = 0x10; *(uint32_t*)0x20000e28 = 0x1ff; *(uint32_t*)0x20000e2c = 1; *(uint64_t*)0x20000e30 = 0x10; *(uint32_t*)0x20000e38 = 0x10b; *(uint32_t*)0x20000e3c = 0; *(uint64_t*)0x20000e40 = 0x10; *(uint32_t*)0x20000e48 = 0x118; *(uint32_t*)0x20000e4c = 7; *(uint64_t*)0x20001268 = 0x50; *(uint32_t*)0x20001270 = 0; *(uint32_t*)0x20001278 = 0xf54; *(uint64_t*)0x20001280 = 0x20001080; *(uint16_t*)0x20001080 = 0x27; *(uint32_t*)0x20001084 = 1; *(uint32_t*)0x20001088 = 0; *(uint32_t*)0x2000108c = 2; *(uint32_t*)0x20001288 = 0x80; *(uint64_t*)0x20001290 = 0x20001180; *(uint64_t*)0x20001180 = 0x20001100; *(uint64_t*)0x20001188 = 0; *(uint64_t*)0x20001298 = 1; *(uint64_t*)0x200012a0 = 0; *(uint64_t*)0x200012a8 = 0; *(uint32_t*)0x200012b0 = 0x10; *(uint32_t*)0x200012b8 = 0x3f; syscall(__NR_sendmmsg, r[0], 0x200011c0, 4, 0x20000000); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }