// https://syzkaller.appspot.com/bug?id=26cb120b31cd24d984fc16da67f50fb375c432a7 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #ifndef __NR_sendmsg #define __NR_sendmsg 370 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 long r[82]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xd51000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0xful, 0x3ul, 0x2ul); *(uint32_t*)0x205f5000 = (uint32_t)0x0; *(uint32_t*)0x205f5004 = (uint32_t)0x0; *(uint32_t*)0x205f5008 = (uint32_t)0x208feff0; *(uint32_t*)0x205f500c = (uint32_t)0x1; *(uint32_t*)0x205f5010 = (uint32_t)0x0; *(uint32_t*)0x205f5014 = (uint32_t)0x0; *(uint32_t*)0x205f5018 = (uint32_t)0x0; *(uint32_t*)0x208feff0 = (uint32_t)0x20d4cea8; *(uint32_t*)0x208feff4 = (uint32_t)0x78; *(uint8_t*)0x20d4cea8 = (uint8_t)0x2; *(uint8_t*)0x20d4cea9 = (uint8_t)0x3; *(uint8_t*)0x20d4ceaa = (uint8_t)0x0; *(uint8_t*)0x20d4ceab = (uint8_t)0x3; *(uint16_t*)0x20d4ceac = (uint16_t)0xf; *(uint16_t*)0x20d4ceae = (uint16_t)0x0; *(uint32_t*)0x20d4ceb0 = (uint32_t)0x0; *(uint32_t*)0x20d4ceb4 = (uint32_t)0x0; *(uint16_t*)0x20d4ceb8 = (uint16_t)0x1; *(uint16_t*)0x20d4ceba = (uint16_t)0x9; *(uint16_t*)0x20d4cebc = (uint16_t)0xfffffffffffffffe; *(uint16_t*)0x20d4cebe = (uint16_t)0x0; *(uint16_t*)0x20d4cec0 = (uint16_t)0x5; *(uint16_t*)0x20d4cec2 = (uint16_t)0x6; *(uint8_t*)0x20d4cec4 = (uint8_t)0x0; *(uint8_t*)0x20d4cec5 = (uint8_t)0x0; *(uint16_t*)0x20d4cec6 = (uint16_t)0x0; *(uint16_t*)0x20d4cec8 = (uint16_t)0xa; *(uint16_t*)0x20d4ceca = (uint16_t)0x204e; *(uint32_t*)0x20d4cecc = (uint32_t)0x0; *(uint8_t*)0x20d4ced0 = (uint8_t)0xfe; *(uint8_t*)0x20d4ced1 = (uint8_t)0x80; *(uint8_t*)0x20d4ced2 = (uint8_t)0x0; *(uint8_t*)0x20d4ced3 = (uint8_t)0x0; *(uint8_t*)0x20d4ced4 = (uint8_t)0x0; *(uint8_t*)0x20d4ced5 = (uint8_t)0x0; *(uint8_t*)0x20d4ced6 = (uint8_t)0x0; *(uint8_t*)0x20d4ced7 = (uint8_t)0x0; *(uint8_t*)0x20d4ced8 = (uint8_t)0x0; *(uint8_t*)0x20d4ced9 = (uint8_t)0x0; *(uint8_t*)0x20d4ceda = (uint8_t)0x0; *(uint8_t*)0x20d4cedb = (uint8_t)0x0; *(uint8_t*)0x20d4cedc = (uint8_t)0x0; *(uint8_t*)0x20d4cedd = (uint8_t)0x0; *(uint8_t*)0x20d4cede = (uint8_t)0x0; *(uint8_t*)0x20d4cedf = (uint8_t)0xbb; *(uint32_t*)0x20d4cee0 = (uint32_t)0x0; *(uint16_t*)0x20d4cee8 = (uint16_t)0x2; *(uint16_t*)0x20d4ceea = (uint16_t)0x1; *(uint32_t*)0x20d4ceec = (uint32_t)0x0; *(uint8_t*)0x20d4cef0 = (uint8_t)0x0; *(uint8_t*)0x20d4cef1 = (uint8_t)0x0; *(uint8_t*)0x20d4cef2 = (uint8_t)0x0; *(uint8_t*)0x20d4cef3 = (uint8_t)0xb; *(uint32_t*)0x20d4cef4 = (uint32_t)0x0; *(uint16_t*)0x20d4cef8 = (uint16_t)0x5; *(uint16_t*)0x20d4cefa = (uint16_t)0x5; *(uint8_t*)0x20d4cefc = (uint8_t)0x0; *(uint8_t*)0x20d4cefd = (uint8_t)0x0; *(uint16_t*)0x20d4cefe = (uint16_t)0x0; *(uint16_t*)0x20d4cf00 = (uint16_t)0xa; *(uint16_t*)0x20d4cf02 = (uint16_t)0x204e; *(uint32_t*)0x20d4cf04 = (uint32_t)0x0; *(uint8_t*)0x20d4cf08 = (uint8_t)0x0; *(uint8_t*)0x20d4cf09 = (uint8_t)0x0; *(uint8_t*)0x20d4cf0a = (uint8_t)0x0; *(uint8_t*)0x20d4cf0b = (uint8_t)0x0; *(uint8_t*)0x20d4cf0c = (uint8_t)0x0; *(uint8_t*)0x20d4cf0d = (uint8_t)0x0; *(uint8_t*)0x20d4cf0e = (uint8_t)0x0; *(uint8_t*)0x20d4cf0f = (uint8_t)0x0; *(uint8_t*)0x20d4cf10 = (uint8_t)0x0; *(uint8_t*)0x20d4cf11 = (uint8_t)0x0; *(uint8_t*)0x20d4cf12 = (uint8_t)0x0; *(uint8_t*)0x20d4cf13 = (uint8_t)0x0; *(uint8_t*)0x20d4cf14 = (uint8_t)0x0; *(uint8_t*)0x20d4cf15 = (uint8_t)0x0; *(uint8_t*)0x20d4cf16 = (uint8_t)0x0; *(uint8_t*)0x20d4cf17 = (uint8_t)0x0; *(uint32_t*)0x20d4cf18 = (uint32_t)0x0; r[81] = syscall(__NR_sendmsg, r[1], 0x205f5000ul, 0x0ul); } int main() { loop(); return 0; }