// https://syzkaller.appspot.com/bug?id=d38ed0177151ca71af235c613ab4897461cf9ff3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 2, 1, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000580 = 1; syscall(__NR_setsockopt, r[0], 6, 0x10000000013, 0x20000580, 4); *(uint32_t*)0x20000040 = 1; syscall(__NR_setsockopt, r[0], 6, 0x4000000000014, 0x20000040, 4); *(uint16_t*)0x200000c0 = 2; *(uint16_t*)0x200000c2 = htobe16(0); *(uint8_t*)0x200000c4 = 0xac; *(uint8_t*)0x200000c5 = 0x14; *(uint8_t*)0x200000c6 = 0x14; *(uint8_t*)0x200000c7 = 0x16; *(uint8_t*)0x200000c8 = 0; *(uint8_t*)0x200000c9 = 0; *(uint8_t*)0x200000ca = 0; *(uint8_t*)0x200000cb = 0; *(uint8_t*)0x200000cc = 0; *(uint8_t*)0x200000cd = 0; *(uint8_t*)0x200000ce = 0; *(uint8_t*)0x200000cf = 0; syscall(__NR_connect, r[0], 0x200000c0, 0x10); *(uint64_t*)0x20005c00 = 0x20004100; *(uint16_t*)0x20004100 = 0x1f; *(uint16_t*)0x20004102 = 0; *(uint8_t*)0x20004104 = 0; *(uint8_t*)0x20004105 = 0; *(uint8_t*)0x20004106 = 0; *(uint8_t*)0x20004107 = 0; *(uint8_t*)0x20004108 = 0; *(uint8_t*)0x20004109 = 0; *(uint16_t*)0x2000410a = 0; *(uint8_t*)0x2000410c = 0; *(uint32_t*)0x20005c08 = 0x80; *(uint64_t*)0x20005c10 = 0x20004540; *(uint64_t*)0x20004540 = 0x20000080; memcpy((void*)0x20000080, "\xe7", 1); *(uint64_t*)0x20004548 = 1; *(uint64_t*)0x20005c18 = 1; *(uint64_t*)0x20005c20 = 0x200045c0; *(uint64_t*)0x20005c28 = 0; *(uint32_t*)0x20005c30 = 0; *(uint32_t*)0x20005c38 = 0; syscall(__NR_sendmmsg, r[0], 0x20005c00, 1, 0); memcpy((void*)0x20000240, "\x8e", 1); *(uint16_t*)0x20000280 = 2; *(uint16_t*)0x20000282 = htobe16(0); *(uint32_t*)0x20000284 = htobe32(0xe0000002); *(uint8_t*)0x20000288 = 0; *(uint8_t*)0x20000289 = 0; *(uint8_t*)0x2000028a = 0; *(uint8_t*)0x2000028b = 0; *(uint8_t*)0x2000028c = 0; *(uint8_t*)0x2000028d = 0; *(uint8_t*)0x2000028e = 0; *(uint8_t*)0x2000028f = 0; syscall(__NR_sendto, r[0], 0x20000240, 1, 0, 0x20000280, 0x10); return 0; }