// https://syzkaller.appspot.com/bug?id=afa4898cbe5d437d11771f32581a02ceee828363 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$inet6_udp arguments: [ // domain: const = 0x1c (8 bytes) // type: const = 0x2 (8 bytes) // proto: const = 0x0 (1 bytes) // ] // returns sock_udp6 res = syscall(SYS_socket, /*domain=*/0x1cul, /*type=*/2ul, /*proto=*/0); if (res != -1) r[0] = res; // setsockopt$inet6_int arguments: [ // fd: sock_in6 (resource) // level: const = 0x29 (4 bytes) // optname: inet6_option_types_int = 0x1b (4 bytes) // optval: nil // optlen: len = 0x0 (8 bytes) // ] syscall(SYS_setsockopt, /*fd=*/(intptr_t)-1, /*level=*/0x29, /*optname=IPV6_V6ONLY*/ 0x1b, /*optval=*/0ul, /*optlen=*/0ul); // chdir arguments: [ // dir: nil // ] syscall(SYS_chdir, /*dir=*/0ul); // setsockopt$inet6_int arguments: [ // fd: sock_in6 (resource) // level: const = 0x29 (4 bytes) // optname: inet6_option_types_int = 0x1b (4 bytes) // optval: ptr[in, int32] { // int32 = 0x0 (4 bytes) // } // optlen: len = 0x4 (8 bytes) // ] *(uint32_t*)0x200000000240 = 0; syscall(SYS_setsockopt, /*fd=*/r[0], /*level=*/0x29, /*optname=IPV6_V6ONLY*/ 0x1b, /*optval=*/0x200000000240ul, /*optlen=*/4ul); // sendto$inet6 arguments: [ // fd: sock_in6 (resource) // buf: nil // len: len = 0x0 (8 bytes) // f: send_flags = 0x100 (8 bytes) // addr: ptr[in, sockaddr_in6] { // sockaddr_in6 { // len: len = 0x1c (1 bytes) // family: const = 0x1c (1 bytes) // port: proc = 0x1 (2 bytes) // flow: int32 = 0x7 (4 bytes) // addr: union ipv6_addr { // loopback: ipv6_addr_loopback { // a0: const = 0x0 (8 bytes) // a1: const = 0x1 (8 bytes) // } // } // scope: int32 = 0x1 (4 bytes) // } // } // addrlen: len = 0x1c (8 bytes) // ] *(uint8_t*)0x200000000300 = 0x1c; *(uint8_t*)0x200000000301 = 0x1c; *(uint16_t*)0x200000000302 = htobe16(0x4e21); *(uint32_t*)0x200000000304 = 7; *(uint64_t*)0x200000000308 = htobe64(0); *(uint64_t*)0x200000000310 = htobe64(1); *(uint32_t*)0x200000000318 = 1; syscall(SYS_sendto, /*fd=*/r[0], /*buf=*/0ul, /*len=*/0ul, /*f=MSG_EOF*/ 0x100ul, /*addr=*/0x200000000300ul, /*addrlen=*/0x1cul); // connect$inet6 arguments: [ // fd: sock_in6 (resource) // addr: ptr[in, sockaddr_in6] { // sockaddr_in6 { // len: len = 0x1c (1 bytes) // family: const = 0x1c (1 bytes) // port: proc = 0x0 (2 bytes) // flow: int32 = 0x2 (4 bytes) // addr: union ipv6_addr { // ipv4: ipv6_addr_ipv4 { // a0: buffer: {00 00 00 00 00 00 00 00 00 00} (length 0xa) // a1: buffer: {ff ff} (length 0x2) // a3: union ipv4_addr { // multicast2: const = 0xe0000002 (4 bytes) // } // } // } // scope: int32 = 0x0 (4 bytes) // } // } // addrlen: len = 0x1c (8 bytes) // ] *(uint8_t*)0x200000000040 = 0x1c; *(uint8_t*)0x200000000041 = 0x1c; *(uint16_t*)0x200000000042 = htobe16(0x4e20); *(uint32_t*)0x200000000044 = 2; memset((void*)0x200000000048, 0, 10); memset((void*)0x200000000052, 255, 2); *(uint32_t*)0x200000000054 = htobe32(0xe0000002); *(uint32_t*)0x200000000058 = 0; syscall(SYS_connect, /*fd=*/r[0], /*addr=*/0x200000000040ul, /*addrlen=*/0x1cul); // write arguments: [ // fd: fd (resource) // buf: nil // count: len = 0x0 (8 bytes) // ] syscall(SYS_write, /*fd=*/r[0], /*buf=*/0ul, /*count=*/0ul); return 0; }