map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
const int kInitNetNsFd = 201;
static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto)
{
return syscall(__NR_socket, domain, type, proto);
}
uint64_t r[1] = {0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// syz_init_net_socket$bt_l2cap arguments: [
// fam: const = 0x1f (8 bytes)
// type: bt_l2cap_type = 0x3 (8 bytes)
// proto: const = 0x0 (8 bytes)
// ]
// returns sock_bt_l2cap
res = -1;
res = syz_init_net_socket(/*fam=*/0x1f, /*type=SOCK_RAW*/3, /*proto=*/0);
if (res != -1)
r[0] = res;
// setsockopt$sock_timeval arguments: [
// fd: sock (resource)
// level: const = 0x1 (4 bytes)
// optname: sockopt_opt_sock_timeval = 0x15 (4 bytes)
// optval: ptr[in, timeval] {
// timeval {
// sec: time_sec (resource)
// usec: time_usec (resource)
// }
// }
// optlen: len = 0x10 (8 bytes)
// ]
*(uint64_t*)0x200000000140 = 0;
*(uint64_t*)0x200000000148 = 0x2710;
syscall(__NR_setsockopt, /*fd=*/r[0], /*level=*/1, /*optname=SO_SNDTIMEO_OLD*/0x15, /*optval=*/0x200000000140ul, /*optlen=*/0x10ul);
// connect arguments: [
// fd: sock (resource)
// addr: ptr[in, sockaddr_storage] {
// union sockaddr_storage {
// hci: sockaddr_hci {
// hci_family: const = 0x1f (2 bytes)
// hci_dev: int16 = 0x0 (2 bytes)
// hci_channel: bt_hci_chan = 0x0 (2 bytes)
// }
// }
// }
// addrlen: len = 0x80 (8 bytes)
// ]
*(uint16_t*)0x2000000000c0 = 0x1f;
*(uint16_t*)0x2000000000c2 = 0;
*(uint16_t*)0x2000000000c4 = 0;
syscall(__NR_connect, /*fd=*/r[0], /*addr=*/0x2000000000c0ul, /*addrlen=*/0x80ul);
return 0;
}
]