// https://syzkaller.appspot.com/bug?id=700e987a1adbf1c4ca750ca19639bf884782f336 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #define __syscall syscall uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); intptr_t res = 0; memcpy((void*)0x200000c0, "\xb1\x00\x05\x03\x00\x00\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00" "\x00\x00\x00\xce\xa1\xfe\xa7\xfe\xf9\x6e\xcf\xc7\x3f\xd3\x35\x7a\xe2" "\x6c\xaa\x04\x16\xfa\x4f\x37\x3f\x00\xac\xf0\x0b\x78\x04\xbe\x78\x1e" "\x49\x91\xf7\xc8\xdf\x5f\x88\x2b\x29\x7b\xe1\xab\x5b\x23\xed\x00\xf4" "\xc8\x07\x00\x00\x00\x00\x00\x00\x00\x1f\x13\x2e\x27\xac\xbd\xd6\x02" "\x00\x0d\x7d\x02\x6b\xa8\xaf\x63\xff\x37\x28\x29\x02\xe4\xfd\x89\x72" "\x0f\xd3\x87\x2b\xab\xfb\xb7\x70\xc1\xff\xff\x00\x00\x0f\x90\x00\x6e" "\xe0\x1b\xc4\x3e\xae\xac\xc5\x00\x00\xfa\x02\x00\x00\x00\x00\x00\x00" "\x02\x02\x08\xa3\x71\xa3\xf8\x00\x04\x00\x00\x00\x04\x00\x00\x00\x01" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 164); syscall(SYS_sendto, -1, 0x200000c0ul, 0xb1ul, 0ul, 0ul, 0xfffffffffffffd41ul); memcpy((void*)0x20000000, "/dev/pf\000\000", 9); res = syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000000ul, 0ul, 0ul); if (res != -1) r[0] = res; *(uint32_t*)0x20000080 = 0; syscall(SYS_ioctl, r[0], 0xc0504417ul, 0x20000080ul); return 0; }