// https://syzkaller.appspot.com/bug?id=566325c29e627765e4f5d223163e5c15191f0f46 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; void loop() { long res = 0; *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 0; *(uint32_t*)0x20000010 = 0; *(uint32_t*)0x20000014 = 0; res = syscall(__NR_socket, 2, 2, 0); if (res != -1) r[0] = res; *(uint16_t*)0x208d2000 = 2; *(uint16_t*)0x208d2002 = htobe16(0x4e21); *(uint32_t*)0x208d2004 = htobe32(0x7f000001); *(uint8_t*)0x208d2008 = 0; *(uint8_t*)0x208d2009 = 0; *(uint8_t*)0x208d200a = 0; *(uint8_t*)0x208d200b = 0; *(uint8_t*)0x208d200c = 0; *(uint8_t*)0x208d200d = 0; *(uint8_t*)0x208d200e = 0; *(uint8_t*)0x208d200f = 0; syscall(__NR_sendto, r[0], 0x20168f26, 0, 0x48000, 0x208d2000, 0x10); *(uint16_t*)0x20778000 = 2; *(uint16_t*)0x20778002 = htobe16(0); *(uint32_t*)0x20778004 = htobe32(0x7f000001); *(uint8_t*)0x20778008 = 0; *(uint8_t*)0x20778009 = 0; *(uint8_t*)0x2077800a = 0; *(uint8_t*)0x2077800b = 0; *(uint8_t*)0x2077800c = 0; *(uint8_t*)0x2077800d = 0; *(uint8_t*)0x2077800e = 0; *(uint8_t*)0x2077800f = 0; syscall(__NR_sendto, r[0], 0x2029b000, 0x287, 0, 0x20778000, 0x10); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }