// https://syzkaller.appspot.com/bug?id=54f4ce6239e6e0d0d5583488421c6fa3ba7ed6b4 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[1]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0x10, 3, 6); *(uint64_t*)0x2000b000 = 0x2000f000; *(uint32_t*)0x2000b008 = 0x2fb; *(uint64_t*)0x2000b010 = 0x205a6ff0; *(uint64_t*)0x2000b018 = 1; *(uint64_t*)0x2000b020 = 0; *(uint64_t*)0x2000b028 = 0; *(uint32_t*)0x2000b030 = 0; *(uint16_t*)0x2000f000 = 0x10; *(uint16_t*)0x2000f002 = 0; *(uint32_t*)0x2000f004 = 0; *(uint32_t*)0x2000f008 = 0; *(uint64_t*)0x205a6ff0 = 0x2090e000; *(uint64_t*)0x205a6ff8 = 0x144; *(uint32_t*)0x2090e000 = 0x144; *(uint16_t*)0x2090e004 = 0x10; *(uint16_t*)0x2090e006 = 0x713; *(uint32_t*)0x2090e008 = 0; *(uint32_t*)0x2090e00c = 0; *(uint8_t*)0x2090e010 = 0; *(uint8_t*)0x2090e011 = 0; *(uint8_t*)0x2090e012 = 0; *(uint8_t*)0x2090e013 = 0; *(uint8_t*)0x2090e014 = 0; *(uint8_t*)0x2090e015 = 0; *(uint8_t*)0x2090e016 = 0; *(uint8_t*)0x2090e017 = 0; *(uint8_t*)0x2090e018 = 0; *(uint8_t*)0x2090e019 = 0; *(uint8_t*)0x2090e01a = 0; *(uint8_t*)0x2090e01b = 0; *(uint8_t*)0x2090e01c = 0; *(uint8_t*)0x2090e01d = 0; *(uint8_t*)0x2090e01e = 0; *(uint8_t*)0x2090e01f = 0; *(uint32_t*)0x2090e020 = htobe32(0xe0000002); *(uint16_t*)0x2090e030 = 0; *(uint16_t*)0x2090e032 = htobe16(0); *(uint16_t*)0x2090e034 = 0; *(uint16_t*)0x2090e036 = htobe16(0); *(uint16_t*)0x2090e038 = 0; *(uint8_t*)0x2090e03a = 0; *(uint8_t*)0x2090e03b = 0; *(uint8_t*)0x2090e03c = 0; *(uint32_t*)0x2090e040 = 0; *(uint32_t*)0x2090e044 = 0; *(uint8_t*)0x2090e048 = 0xfe; *(uint8_t*)0x2090e049 = 0x80; *(uint8_t*)0x2090e04a = 0; *(uint8_t*)0x2090e04b = 0; *(uint8_t*)0x2090e04c = 0; *(uint8_t*)0x2090e04d = 0; *(uint8_t*)0x2090e04e = 0; *(uint8_t*)0x2090e04f = 0; *(uint8_t*)0x2090e050 = 0; *(uint8_t*)0x2090e051 = 0; *(uint8_t*)0x2090e052 = 0; *(uint8_t*)0x2090e053 = 0; *(uint8_t*)0x2090e054 = 0; *(uint8_t*)0x2090e055 = 0; *(uint8_t*)0x2090e056 = 0; *(uint8_t*)0x2090e057 = 0; *(uint32_t*)0x2090e058 = 0; *(uint8_t*)0x2090e05c = 0x6c; *(uint64_t*)0x2090e060 = htobe64(0); *(uint64_t*)0x2090e068 = htobe64(1); *(uint64_t*)0x2090e070 = 0; *(uint64_t*)0x2090e078 = 0; *(uint64_t*)0x2090e080 = 0; *(uint64_t*)0x2090e088 = 0; *(uint64_t*)0x2090e090 = 0; *(uint64_t*)0x2090e098 = 0; *(uint64_t*)0x2090e0a0 = 0; *(uint64_t*)0x2090e0a8 = 0; *(uint64_t*)0x2090e0b0 = 0; *(uint64_t*)0x2090e0b8 = 0; *(uint64_t*)0x2090e0c0 = 0; *(uint64_t*)0x2090e0c8 = 0; *(uint32_t*)0x2090e0d0 = 0; *(uint32_t*)0x2090e0d4 = 0; *(uint32_t*)0x2090e0d8 = 0; *(uint32_t*)0x2090e0dc = 0; *(uint32_t*)0x2090e0e0 = 0; *(uint16_t*)0x2090e0e4 = 2; *(uint8_t*)0x2090e0e6 = 0; *(uint8_t*)0x2090e0e7 = 0; *(uint8_t*)0x2090e0e8 = 0; *(uint16_t*)0x2090e0f0 = 0xc; *(uint16_t*)0x2090e0f2 = 0x15; *(uint32_t*)0x2090e0f4 = 0; *(uint32_t*)0x2090e0f8 = 0; *(uint16_t*)0x2090e0fc = 0x48; *(uint16_t*)0x2090e0fe = 3; memcpy((void*)0x2090e100, "\x64\x65\x66\x6c\x61\x74\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); *(uint32_t*)0x2090e140 = 0; syscall(__NR_sendmsg, r[0], 0x2000b000, 0); } int main() { for (;;) { loop(); } }