// https://syzkaller.appspot.com/bug?id=4a70b4f4cc6f5ec71852023effc9995560fa3fea // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; res = syscall(__NR_pipe, 0x20000d00ul); if (res != -1) { r[0] = *(uint32_t*)0x20000d00; r[1] = *(uint32_t*)0x20000d04; } res = syscall(__NR_socket, 2ul, 2ul, 0); if (res != -1) r[2] = res; syscall(__NR_close, r[2]); memcpy((void*)0x20000300, "#! ", 3); memcpy((void*)0x20000303, "./file0", 7); *(uint8_t*)0x2000030a = 0x20; memcpy((void*)0x2000030b, "#%-r@%", 6); *(uint8_t*)0x20000311 = 0x20; *(uint8_t*)0x20000312 = 0x20; memcpy((void*)0x20000313, "memory.events\000", 14); *(uint8_t*)0x20000321 = 0x20; memcpy((void*)0x20000322, "memory.events\000", 14); *(uint8_t*)0x20000330 = 0x20; *(uint8_t*)0x20000331 = 0x20; memcpy((void*)0x20000332, "-\\\'.", 4); *(uint8_t*)0x20000336 = 0x20; memcpy((void*)0x20000337, "memory.events\000", 14); *(uint8_t*)0x20000345 = 0x20; memcpy((void*)0x20000346, "syz0", 4); *(uint8_t*)0x2000034a = 0xa; syscall(__NR_write, r[1], 0x20000300ul, 0x4bul); res = syscall(__NR_socket, 2ul, 3ul, 1); if (res != -1) r[3] = res; *(uint16_t*)0x20000080 = 2; *(uint16_t*)0x20000082 = htobe16(0); *(uint8_t*)0x20000084 = 0xac; *(uint8_t*)0x20000085 = 0x14; *(uint8_t*)0x20000086 = 0x14; *(uint8_t*)0x20000087 = 0xaa; syscall(__NR_bind, r[3], 0x20000080ul, 0x10ul); *(uint16_t*)0x200000c0 = 2; *(uint16_t*)0x200000c2 = htobe16(0); *(uint32_t*)0x200000c4 = htobe32(0xe0000001); syscall(__NR_connect, r[3], 0x200000c0ul, 0x10ul); syscall(__NR_splice, r[0], 0ul, r[2], 0ul, 0x4ffddul, 0xdul); return 0; }