// https://syzkaller.appspot.com/bug?id=d38ed0177151ca71af235c613ab4897461cf9ff3 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_connect #define __NR_connect 362 #endif #ifndef __NR_mmap #define __NR_mmap 192 #endif #ifndef __NR_sendmmsg #define __NR_sendmmsg 345 #endif #ifndef __NR_sendto #define __NR_sendto 369 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 366 #endif #ifndef __NR_socket #define __NR_socket 359 #endif #undef __NR_mmap #define __NR_mmap __NR_mmap2 uint64_t r[1] = {0xffffffffffffffff}; int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; res = syscall(__NR_socket, 2, 1, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000580 = 1; syscall(__NR_setsockopt, (long)r[0], 6, 0x13, 0x20000580, 4); *(uint32_t*)0x20000040 = 1; syscall(__NR_setsockopt, (long)r[0], 6, 0x14, 0x20000040, 4); *(uint16_t*)0x200000c0 = 2; *(uint16_t*)0x200000c2 = htobe16(0); *(uint8_t*)0x200000c4 = 0xac; *(uint8_t*)0x200000c5 = 0x14; *(uint8_t*)0x200000c6 = 0x14; *(uint8_t*)0x200000c7 = 0x16; *(uint8_t*)0x200000c8 = 0; *(uint8_t*)0x200000c9 = 0; *(uint8_t*)0x200000ca = 0; *(uint8_t*)0x200000cb = 0; *(uint8_t*)0x200000cc = 0; *(uint8_t*)0x200000cd = 0; *(uint8_t*)0x200000ce = 0; *(uint8_t*)0x200000cf = 0; syscall(__NR_connect, (long)r[0], 0x200000c0, 0x10); *(uint32_t*)0x20005c00 = 0x20004100; *(uint16_t*)0x20004100 = 0x1f; *(uint16_t*)0x20004102 = 0; *(uint8_t*)0x20004104 = 0; *(uint8_t*)0x20004105 = 0; *(uint8_t*)0x20004106 = 0; *(uint8_t*)0x20004107 = 0; *(uint8_t*)0x20004108 = 0; *(uint8_t*)0x20004109 = 0; *(uint16_t*)0x2000410a = 0; *(uint8_t*)0x2000410c = 0; *(uint32_t*)0x20005c04 = 0x80; *(uint32_t*)0x20005c08 = 0x20004540; *(uint32_t*)0x20004540 = 0x20000080; memcpy((void*)0x20000080, "\xe7", 1); *(uint32_t*)0x20004544 = 1; *(uint32_t*)0x20005c0c = 1; *(uint32_t*)0x20005c10 = 0x200045c0; *(uint32_t*)0x20005c14 = 0; *(uint32_t*)0x20005c18 = 0; *(uint32_t*)0x20005c1c = 0; syscall(__NR_sendmmsg, (long)r[0], 0x20005c00, 1, 0); memcpy((void*)0x20000240, "\x8e", 1); *(uint16_t*)0x20000280 = 2; *(uint16_t*)0x20000282 = htobe16(0); *(uint32_t*)0x20000284 = htobe32(0xe0000002); *(uint8_t*)0x20000288 = 0; *(uint8_t*)0x20000289 = 0; *(uint8_t*)0x2000028a = 0; *(uint8_t*)0x2000028b = 0; *(uint8_t*)0x2000028c = 0; *(uint8_t*)0x2000028d = 0; *(uint8_t*)0x2000028e = 0; *(uint8_t*)0x2000028f = 0; syscall(__NR_sendto, (long)r[0], 0x20000240, 1, 0, 0x20000280, 0x10); return 0; }