// https://syzkaller.appspot.com/bug?id=a2fe7f4413c3aedee84e226061d10a1b950b5528 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define CAST uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t,intptr_t,intptr_t))CAST(mmap))(/*addr=*/0x20000000, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ*/3, /*flags=MAP_ANONYMOUS|MAP_FIXED|MAP_PRIVATE*/0x1012, /*fd=*/-1, /*offset=*/0); intptr_t res = 0; res = -1; res = ((intptr_t(*)(intptr_t,intptr_t,intptr_t,intptr_t))CAST(socketpair))(/*domain=*/1, /*type=SOCK_DGRAM*/2, /*proto=*/0, /*fds=*/0x20000100); if (res != -1) { r[0] = *(uint32_t*)0x20000100; r[1] = *(uint32_t*)0x20000104; } memcpy((void*)0x200000c0, "\x2d\x01\x2e\x2f\x66\x69\x6c\x65\x30", 9); ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(bind))(/*fd=*/r[1], /*addr=*/0x200000c0, /*addrlen=*/0xa); ((intptr_t(*)(intptr_t,intptr_t))CAST(dup2))(/*oldfd=*/r[1], /*newfd=*/r[0]); ((intptr_t(*)(intptr_t,intptr_t))CAST(listen))(/*fd=*/r[1], /*backlog=*/0); *(uint32_t*)0x20000140 = r[1]; *(uint16_t*)0x20000144 = 0x40; *(uint16_t*)0x20000146 = 0; ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(poll))(/*fds=*/0x20000140, /*nfds=*/1, /*timeout=*/0x7d5); res = -1; res = ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(socket))(/*domain=*/1, /*type=SOCK_DGRAM*/2, /*proto=*/0); if (res != -1) r[2] = res; *(uint64_t*)0x20000080 = 0x20000000; *(uint16_t*)0x20000000 = 0x170; memcpy((void*)0x20000002, "./file0\000", 8); *(uint32_t*)0x20000088 = 0xa; *(uint64_t*)0x20000090 = 0; *(uint64_t*)0x20000098 = 0; *(uint64_t*)0x200000a0 = 0; *(uint64_t*)0x200000a8 = 0; *(uint32_t*)0x200000b0 = 0x401; ((intptr_t(*)(intptr_t,intptr_t,intptr_t))CAST(sendmsg))(/*fd=*/r[2], /*msg=*/0x20000080, /*f=*/0); return 0; }