// https://syzkaller.appspot.com/bug?id=de6519e18a472f06a6b530c84c3be8a29c554900 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #ifndef __NR_bpf #define __NR_bpf 321 #endif long r[39]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socketpair, 0x1ul, 0x5ul, 0x0ul, 0x2000dff8ul); if (r[1] != -1) r[2] = *(uint32_t*)0x2000dff8; if (r[1] != -1) r[3] = *(uint32_t*)0x2000dffc; *(uint32_t*)0x20b4cfd0 = (uint32_t)0x1; *(uint32_t*)0x20b4cfd4 = (uint32_t)0x2; *(uint64_t*)0x20b4cfd8 = (uint64_t)0x20ef3000; *(uint64_t*)0x20b4cfe0 = (uint64_t)0x20ccdffa; *(uint32_t*)0x20b4cfe8 = (uint32_t)0x1; *(uint32_t*)0x20b4cfec = (uint32_t)0x80; *(uint64_t*)0x20b4cff0 = (uint64_t)0x2000a000; *(uint32_t*)0x20b4cff8 = (uint32_t)0x0; *(uint32_t*)0x20b4cffc = (uint32_t)0x1; *(uint8_t*)0x20ef3000 = (uint8_t)0x8db7; *(uint8_t*)0x20ef3001 = (uint8_t)0x0; *(uint16_t*)0x20ef3002 = (uint16_t)0x0; *(uint32_t*)0x20ef3004 = (uint32_t)0x0; *(uint8_t*)0x20ef3008 = (uint8_t)0xd395; *(uint8_t*)0x20ef3009 = (uint8_t)0x0; *(uint16_t*)0x20ef300a = (uint16_t)0x0; *(uint32_t*)0x20ef300c = (uint32_t)0x0; memcpy((void*)0x20ccdffa, "\x73\x79\x73\x65\x4f\x00", 6); r[22] = syscall(__NR_bpf, 0x5ul, 0x20b4cfd0ul, 0x30ul); r[23] = syscall(__NR_socket, 0x29ul, 0x5ul, 0x0ul); *(uint32_t*)0x2096a000 = r[2]; *(uint32_t*)0x2096a004 = r[22]; r[26] = syscall(__NR_ioctl, r[23], 0x89e0ul, 0x2096a000ul); *(uint64_t*)0x20019fb0 = (uint64_t)0x205e9f7e; *(uint64_t*)0x20019fb8 = (uint64_t)0x0; *(uint64_t*)0x20019fc0 = (uint64_t)0x20f0c000; *(uint64_t*)0x20019fc8 = (uint64_t)0x0; *(uint64_t*)0x20019fd0 = (uint64_t)0x20cfa000; *(uint64_t*)0x20019fd8 = (uint64_t)0x0; *(uint64_t*)0x20019fe0 = (uint64_t)0x203ed000; *(uint64_t*)0x20019fe8 = (uint64_t)0x0; *(uint64_t*)0x20019ff0 = (uint64_t)0x20f40ff2; *(uint64_t*)0x20019ff8 = (uint64_t)0xe; memcpy((void*)0x20f40ff2, "\x2b\x9d\x73\xc5\x6d\x71\x9d\x50\xb4\x02\x60\x17\xf3\x2b", 14); r[38] = syscall(__NR_writev, r[3], 0x20019fb0ul, 0x5ul); } int main() { loop(); return 0; }