// https://syzkaller.appspot.com/bug?id=18ea4982789de0c2d4e215eaabaf89d727449a34 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); intptr_t res = 0; *(uint64_t*)0x20000280 = 0; *(uint32_t*)0x20000288 = 0; *(uint64_t*)0x20000290 = 0x20000240; *(uint64_t*)0x20000240 = 0x200002c0; memcpy( (void*)0x200002c0, "\x70\x00\x00\x00\x00\x01\x19\x05\x03\x01\x00\x00\x08\x00\x00\xcd\x55\x78" "\x57\x00\x24\x00\x01\x00\x14\x00\x01\x00\x08\x00\x01\x00\xff\xff\xff\xf7" "\x08\x00\x02\x00\xac\x1e\x54\x01\x0c\x00\x02\x00\x05\x00\x01\x00\x00\x00" "\x00\x00\x24\x00\x02\x00\x0c\x00\x02\x00\x05\x00\x01\x00\x00\x00\x00\x00" "\x14\x00\x01\x00\x08\x00\x01\x00\xe0\x00\x00\x02\x08\x00\x02\x00\x00\x00" "\x00\x00\x08\x00\x07\x00\x00\x00\x00\x00\x0c\x00\x06\x00\x08\x00\x03\xa7" "\xe0\x09\xf5\x44\x1a\xad\x67\x57\xfd\x28\x96\xac\x41\x73\x80\x9c\x5f\x93" "\x6c\x24\x7e\x45\x06\x97\x28\xcd\x80\xdf\x09\x80\x68\x1a\x78\x16\x78\x8e" "\x23\x74\x6d\xca\x7e\x22\xd0\x0a\x46\xfa\xf6\x0b\x00\x9c\xf6\xe8\x51\xb9" "\x27\xe3\x9e\x0a\x5e\xb2\x7e\x0c\x65\x66\x13\xa4\x9b\x99\x74\xda\xb2\x45" "\xc0\x23\x90\x59\x45\x47\x49\xfd\xcc\xec\x45\x72\x61\x05\xfa\xe5\xaf\xda" "\x92\x41\x8c\xf4\x54\x4c\xe2\x48\x03\xac\x8f\x3e\x3d\x4d\x0f\x0c\xfb\xe7" "\x9e\x7c\x49\xbb\x5d\x98\x02\x7c\x26\x69\xf7\xd6\x93\xd7\x42\x76\x0b\xf0" "\xd7\x0e\xad\xb4\xcc\xd5\x0b\x58\xfa\x65\x1e\x89\x47\xcd\x87\x13\x0d\x14" "\x97\x92\x8a\x90\x64\x97\x35\xce\x9f\xe6\xe0\x14\x19\x9c\x76\xa5\x41\xa8" "\x94\xfd\xa9\xb6\x45\x80\x8e\x98\xc0\x60\xc8\xad\x2c\x0e\x3c\xd1\x30\x91" "\xbf\xf2\xda\x83\x6d\x57\xc3\xb9\x3b\x4e\x2e\xeb\x5f\xcd\x28\x23\x5c\x7c" "\x9b\xd8\x1c\xbd\x5f\xa6\x2a\x65\xf1\x1e\xa6\xd5\x91\x5e\x64\xb0\x58\x96" "\xd4\x55\xf0\x44\x2e\xb7\xa3\x99\x8c\x9d\x1d\x0c\x49\x11\x59\x69\x4e\xf2" "\x89\x01\x8b\xda\x55\x33\x67\x1e\x73\xcb\x79\x92\x77\xa2\x5f\x22\x5d\x69" "\x6a\x2f\x08\xc1\xbb\xc2\x5e\xcf\xfc\x80\x7d\x19\x03\x87\x83\x18\x6b\xe9" "\xac\x3c\x10\x12\x04\x41\xb9\x60\xbd\x65\xc9\x51\x57\x64\xe9\x6b\x5e\x05" "\x55\x67\x34\x31\xc3\x51\x65\x8b\x2b\xa5\x63\x8e\x44\xc0\xf2\x38\xc9\xb1" "\xbc\x9f\xcb\x85\x10\xc0\xae\xb4\x34\x73\x1e\xfb\x49\x92\x13\x14\xee\x9d" "\x60\xd3\x87\x0b\xb9\xe5\x03\x32\x2a\xf5\xf5\x25\x4b\xa9", 446); *(uint64_t*)0x20000248 = 0x70; *(uint64_t*)0x20000298 = 1; *(uint64_t*)0x200002a0 = 0; *(uint64_t*)0x200002a8 = 0; *(uint32_t*)0x200002b0 = 0; syscall(__NR_sendmsg, -1, 0x20000280ul, 0ul); res = syscall(__NR_socket, 0x10ul, 3ul, 0xc); if (res != -1) r[0] = res; *(uint64_t*)0x20000040 = 0; *(uint32_t*)0x20000048 = 0; *(uint64_t*)0x20000050 = 0x20000200; *(uint64_t*)0x20000200 = 0; *(uint64_t*)0x20000208 = 0; *(uint64_t*)0x20000058 = 8; *(uint64_t*)0x20000060 = 0; *(uint64_t*)0x20000068 = 0; *(uint32_t*)0x20000070 = 0x20000040; syscall(__NR_sendmsg, r[0], 0x20000040ul, 0ul); return 0; }