// https://syzkaller.appspot.com/bug?id=53475b9f7c745934a7c7efda058095c49491c747 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void loop() { long res = 0; res = syscall(__NR_socket, 0x26, 5, 0); if (res != -1) r[0] = res; *(uint16_t*)0x2065ffa8 = 0x26; memcpy((void*)0x2065ffaa, "\x61\x65\x61\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 14); *(uint32_t*)0x2065ffb8 = 0; *(uint32_t*)0x2065ffbc = 0; memcpy((void*)0x2065ffc0, "\x67\x63\x6d\x5f\x62\x61\x73\x65\x28\x63\x74\x72\x28\x61\x65\x73\x2d" "\x61\x65\x73\x6e\x69\x29\x2c\x67\x68\x61\x73\x68\x2d\x67\x65\x6e\x65" "\x72\x69\x63\x29\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 64); syscall(__NR_bind, r[0], 0x2065ffa8, 0x58); memcpy((void*)0x201ec000, "\x0a\x07\x75\xb0\xd5\xe3\x83\xe5\xb3\xb6\x0c\xed\x5c\x54\xdb\xb7", 16); syscall(__NR_setsockopt, r[0], 0x117, 1, 0x201ec000, 0x10); res = syscall(__NR_accept, r[0], 0, 0); if (res != -1) r[1] = res; *(uint64_t*)0x20f7e000 = 0; *(uint32_t*)0x20f7e008 = 0; *(uint64_t*)0x20f7e010 = 0x20f7efd0; *(uint64_t*)0x20f7e018 = 0; *(uint64_t*)0x20f7e020 = 0x20000000; *(uint64_t*)0x20000000 = 0x18; *(uint32_t*)0x20000008 = 0x117; *(uint32_t*)0x2000000c = 3; *(uint32_t*)0x20000010 = 1; *(uint64_t*)0x20f7e028 = 0x18; *(uint32_t*)0x20f7e030 = 0; syscall(__NR_sendmsg, r[1], 0x20f7e000, 0); *(uint64_t*)0x20b2dfc8 = 0x207ebffa; *(uint32_t*)0x20b2dfd0 = 6; *(uint64_t*)0x20b2dfd8 = 0x20f75000; *(uint64_t*)0x20f75000 = 0x2088bfef; *(uint64_t*)0x20f75008 = 0x4ac40b10; *(uint64_t*)0x20f75010 = 0x20f75000; *(uint64_t*)0x20f75018 = 0xaf; *(uint64_t*)0x20b2dfe0 = 2; *(uint64_t*)0x20b2dfe8 = 0x20ec7000; *(uint64_t*)0x20b2dff0 = 0x2bc; *(uint32_t*)0x20b2dff8 = 0; syscall(__NR_recvmsg, r[1], 0x20b2dfc8, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); loop(); return 0; }