// https://syzkaller.appspot.com/bug?id=be530268f841dd2d2b2b2498cbdbab0d0af63761 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include static void execute_one(); extern unsigned long long procid; void loop() { while (1) { execute_one(); } } uint64_t r[1] = {0xffffffffffffffff}; unsigned long long procid; void execute_one() { long res = 0; res = syscall(__NR_socket, 2, 1, 0); if (res != -1) r[0] = res; *(uint32_t*)0x20000040 = 2; memcpy((void*)0x20000044, "\x74\x75\x6e\x6c\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint32_t*)0x20000054 = 4; syscall(__NR_setsockopt, r[0], 0, 0x48b, 0x20000040, 0x18); syscall(__NR_socket, 2, 1, 8); *(uint32_t*)0x20000000 = 2; memcpy((void*)0x20000004, "\x62\x6f\x6e\x64\x5f\x73\x6c\x61\x76\x65\x00\x00\x00\x00\x00\x00", 16); *(uint32_t*)0x20000014 = 0; syscall(__NR_setsockopt, r[0], 0, 0x48c, 0x20000000, 0x18); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (procid = 0; procid < 8; procid++) { if (fork() == 0) { for (;;) { loop(); } } } sleep(1000000); return 0; }