// https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x2b, 1, 0); if (res != -1) r[0] = res; *(uint64_t*)0x20000300 = 0x20000080; *(uint16_t*)0x20000080 = 0x10; *(uint16_t*)0x20000082 = 0; *(uint32_t*)0x20000084 = 0x25dfdbfe; *(uint32_t*)0x20000088 = 4; *(uint32_t*)0x20000308 = 0xc; *(uint64_t*)0x20000310 = 0x200002c0; *(uint64_t*)0x200002c0 = 0x200000c0; *(uint32_t*)0x200000c0 = 0x2c; *(uint16_t*)0x200000c4 = 0x40; *(uint16_t*)0x200000c6 = 0x202; *(uint32_t*)0x200000c8 = 0x70bd2b; *(uint32_t*)0x200000cc = 0x25dfdbff; *(uint16_t*)0x200000d0 = 0x1c; *(uint16_t*)0x200000d2 = 0x6c; *(uint16_t*)0x200000d4 = 8; *(uint16_t*)0x200000d6 = 0x3e; *(uint32_t*)0x200000d8 = htobe32(0); *(uint16_t*)0x200000dc = 8; *(uint16_t*)0x200000de = 0x94; *(uint32_t*)0x200000e0 = 4; *(uint16_t*)0x200000e4 = 8; *(uint16_t*)0x200000e6 = 0xd; memcpy((void*)0x200000e8, "", 1); *(uint64_t*)0x200002c8 = 0x2c; *(uint64_t*)0x20000318 = 1; *(uint64_t*)0x20000320 = 0; *(uint64_t*)0x20000328 = 0; *(uint32_t*)0x20000330 = 0x24008040; syscall(__NR_sendmsg, r[0], 0x20000300, 0x20000000); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }