// https://syzkaller.appspot.com/bug?id=7c7bd742d3b6b7473427759ad255c581dbd94412 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_ioctl #define __NR_ioctl 54 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_sendto #define __NR_sendto 369 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[2]; void loop() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[0] = syscall(__NR_socket, 0x2ul, 0x80aul, 0x0ul); memcpy((void*)0x208a3fe0, "\x6c\x6f\x00\x00\x00\x12\x00\x00\x03\x00" "\x00\x00\x00\x00\x00\x00", 16); *(uint16_t*)0x208a3ff0 = (uint16_t)0xfffffffffffffffd; syscall(__NR_ioctl, r[0], 0x8914ul, 0x208a3fe0ul); *(uint32_t*)0x20792fd8 = (uint32_t)0x20000e0; *(uint32_t*)0x20792fdc = (uint32_t)0x100007f; *(uint32_t*)0x20792fe0 = (uint32_t)0x0; *(uint32_t*)0x20792fe4 = (uint32_t)0x0; syscall(__NR_setsockopt, 0xfffffffffffffffful, 0x0ul, 0x29ul, 0x20792fd8ul, 0x10ul); r[1] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul); *(uint32_t*)0x20ffbffc = (uint32_t)0x1; syscall(__NR_setsockopt, r[1], 0x6ul, 0x13ul, 0x20ffbffcul, 0x4ul); *(uint32_t*)0x20ffdffc = (uint32_t)0x1; syscall(__NR_setsockopt, r[1], 0x6ul, 0x14ul, 0x20ffdffcul, 0x4ul); *(uint16_t*)0x20ffb379 = (uint16_t)0x2; *(uint16_t*)0x20ffb37b = (uint16_t)0x204e; *(uint32_t*)0x20ffb37d = (uint32_t)0x0; *(uint8_t*)0x20ffb381 = (uint8_t)0x0; *(uint8_t*)0x20ffb382 = (uint8_t)0x0; *(uint8_t*)0x20ffb383 = (uint8_t)0x0; *(uint8_t*)0x20ffb384 = (uint8_t)0x0; *(uint8_t*)0x20ffb385 = (uint8_t)0x0; *(uint8_t*)0x20ffb386 = (uint8_t)0x0; *(uint8_t*)0x20ffb387 = (uint8_t)0x0; *(uint8_t*)0x20ffb388 = (uint8_t)0x0; syscall(__NR_sendto, r[1], 0x20135000ul, 0x0ul, 0x20000002ul, 0x20ffb379ul, 0x10ul); memcpy((void*)0x20a17000, "\xbf", 1); *(uint16_t*)0x2005f000 = (uint16_t)0x2; *(uint16_t*)0x2005f002 = (uint16_t)0x204e; *(uint32_t*)0x2005f004 = (uint32_t)0x10000e0; *(uint8_t*)0x2005f008 = (uint8_t)0x0; *(uint8_t*)0x2005f009 = (uint8_t)0x0; *(uint8_t*)0x2005f00a = (uint8_t)0x0; *(uint8_t*)0x2005f00b = (uint8_t)0x0; *(uint8_t*)0x2005f00c = (uint8_t)0x0; *(uint8_t*)0x2005f00d = (uint8_t)0x0; *(uint8_t*)0x2005f00e = (uint8_t)0x0; *(uint8_t*)0x2005f00f = (uint8_t)0x0; syscall(__NR_sendto, r[1], 0x20a17000ul, 0x1ul, 0x0ul, 0x2005f000ul, 0x10ul); memcpy((void*)0x2006d000, "\x14", 1); *(uint16_t*)0x208e7ff0 = (uint16_t)0x2; *(uint16_t*)0x208e7ff2 = (uint16_t)0x204e; *(uint32_t*)0x208e7ff4 = (uint32_t)0x0; *(uint8_t*)0x208e7ff8 = (uint8_t)0x0; *(uint8_t*)0x208e7ff9 = (uint8_t)0x0; *(uint8_t*)0x208e7ffa = (uint8_t)0x0; *(uint8_t*)0x208e7ffb = (uint8_t)0x0; *(uint8_t*)0x208e7ffc = (uint8_t)0x0; *(uint8_t*)0x208e7ffd = (uint8_t)0x0; *(uint8_t*)0x208e7ffe = (uint8_t)0x0; *(uint8_t*)0x208e7fff = (uint8_t)0x0; syscall(__NR_sendto, r[1], 0x2006d000ul, 0x1ul, 0x0ul, 0x208e7ff0ul, 0x10ul); } int main() { loop(); return 0; }