// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xf8d000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0xf, 3, 2); *(uint64_t*)0x20f56000 = 0; *(uint32_t*)0x20f56008 = 0; *(uint64_t*)0x20f56010 = 0x208feff0; *(uint64_t*)0x20f56018 = 1; *(uint64_t*)0x20f56020 = 0; *(uint64_t*)0x20f56028 = 0; *(uint32_t*)0x20f56030 = 0; *(uint64_t*)0x208feff0 = 0x20f86000; *(uint64_t*)0x208feff8 = 0x50; *(uint8_t*)0x20f86000 = 2; *(uint8_t*)0x20f86001 = 3; *(uint8_t*)0x20f86002 = 0; *(uint8_t*)0x20f86003 = 9; *(uint16_t*)0x20f86004 = 0xa; *(uint16_t*)0x20f86006 = 0; *(uint32_t*)0x20f86008 = 0; *(uint32_t*)0x20f8600c = 0; *(uint16_t*)0x20f86010 = 3; *(uint16_t*)0x20f86012 = 6; *(uint8_t*)0x20f86014 = 0; *(uint8_t*)0x20f86015 = 0; *(uint16_t*)0x20f86016 = 0; *(uint16_t*)0x20f86018 = 2; *(uint16_t*)0x20f8601a = 0; *(uint32_t*)0x20f8601c = htobe32(0xe0000001); *(uint8_t*)0x20f86020 = 0; *(uint8_t*)0x20f86021 = 0; *(uint8_t*)0x20f86022 = 0; *(uint8_t*)0x20f86023 = 0; *(uint8_t*)0x20f86024 = 0; *(uint8_t*)0x20f86025 = 0; *(uint8_t*)0x20f86026 = 0; *(uint8_t*)0x20f86027 = 0; *(uint16_t*)0x20f86028 = 2; *(uint16_t*)0x20f8602a = 1; *(uint32_t*)0x20f8602c = 0; *(uint8_t*)0x20f86030 = 0; *(uint8_t*)0x20f86031 = 0; *(uint8_t*)0x20f86032 = 0; *(uint8_t*)0x20f86033 = 2; *(uint32_t*)0x20f86034 = 0; *(uint16_t*)0x20f86038 = 3; *(uint16_t*)0x20f8603a = 5; *(uint8_t*)0x20f8603c = 0; *(uint8_t*)0x20f8603d = 0; *(uint16_t*)0x20f8603e = 0; *(uint16_t*)0x20f86040 = 2; *(uint16_t*)0x20f86042 = 0; *(uint32_t*)0x20f86044 = htobe32(0xe0000001); *(uint8_t*)0x20f86048 = 0; *(uint8_t*)0x20f86049 = 0; *(uint8_t*)0x20f8604a = 0; *(uint8_t*)0x20f8604b = 0; *(uint8_t*)0x20f8604c = 0; *(uint8_t*)0x20f8604d = 0; *(uint8_t*)0x20f8604e = 0; *(uint8_t*)0x20f8604f = 0; syscall(__NR_sendmsg, r[0], 0x20f56000, 0); } int main() { for (;;) { loop(); } }