// https://syzkaller.appspot.com/bug?id=3fa29fa3f3080962e7cc84da549ba54c0be314db // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } memcpy((void*)0x200000000100, "/dev/comedi0\000", 13); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000100ul, /*flags=O_LARGEFILE|O_CLOEXEC*/ 0x88000, /*mode=*/0); if (res != -1) r[0] = res; memcpy((void*)0x200000000540, "c6xdigio\000\000\000\000\000\000\000\000\000\000\000\000", 20); *(uint32_t*)0x200000000554 = 0x4000109; *(uint32_t*)0x200000000558 = 0x80008000; *(uint32_t*)0x20000000055c = 0x86a; *(uint32_t*)0x200000000560 = 0xa; *(uint32_t*)0x200000000564 = 0x800; *(uint32_t*)0x200000000568 = 4; *(uint32_t*)0x20000000056c = 1; *(uint32_t*)0x200000000570 = 0xf; *(uint32_t*)0x200000000574 = 0x1000; *(uint32_t*)0x200000000578 = 1; *(uint32_t*)0x20000000057c = 8; *(uint32_t*)0x200000000580 = 5; *(uint32_t*)0x200000000584 = 6; *(uint32_t*)0x200000000588 = 1; *(uint32_t*)0x20000000058c = 0x1138fce9; *(uint32_t*)0x200000000590 = 6; *(uint32_t*)0x200000000594 = 0xffffffa7; *(uint32_t*)0x200000000598 = 0x2000001; *(uint32_t*)0x20000000059c = 0; *(uint32_t*)0x2000000005a0 = 0x65c; *(uint32_t*)0x2000000005a4 = 0x3ff; *(uint32_t*)0x2000000005a8 = 0x10004; *(uint32_t*)0x2000000005ac = 0x800; *(uint32_t*)0x2000000005b0 = 0xe2df; *(uint32_t*)0x2000000005b4 = 9; *(uint32_t*)0x2000000005b8 = 6; *(uint32_t*)0x2000000005bc = 4; *(uint32_t*)0x2000000005c0 = 3; *(uint32_t*)0x2000000005c4 = 7; *(uint32_t*)0x2000000005c8 = 5; *(uint32_t*)0x2000000005cc = 0x4080; *(uint32_t*)0x2000000005d0 = 0; syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40946400, /*arg=*/0x200000000540ul); return 0; }