// https://syzkaller.appspot.com/bug?id=6317bbb466ee7673fdb42563a2ba310c04a0eae9 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define __syscall syscall #ifndef SYS_connect #define SYS_connect 98 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_recvmsg #define SYS_recvmsg 27 #endif #ifndef SYS_socket #define SYS_socket 97 #endif uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x1012, -1, 0, 0); long res = 0; res = syscall(SYS_socket, 2, 3, 0); if (res != -1) r[0] = res; *(uint16_t*)0x20000000 = 0x282; memcpy((void*)0x20000002, "./file0", 8); syscall(SYS_connect, r[0], 0x20000000, 0x10); *(uint16_t*)0x20000240 = 1; *(uint8_t*)0x20000242 = 0; *(uint32_t*)0x20000244 = 0x4e21; syscall(SYS_connect, r[0], 0x20000240, 8); *(uint64_t*)0x20001340 = 0; *(uint32_t*)0x20001348 = 0; *(uint64_t*)0x20001350 = 0; *(uint64_t*)0x20001358 = 0; *(uint64_t*)0x20001360 = 0; *(uint64_t*)0x20001368 = 0; *(uint32_t*)0x20001370 = 2; syscall(SYS_recvmsg, r[0], 0x20001340, 0x41); return 0; }