// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000, 0x1000000, 3, 0x1012, -1, 0); intptr_t res = 0; memcpy((void*)0x20000040, "./file0\000", 8); res = syscall(SYS_open, 0x20000040, 0x100682, 0); if (res != -1) r[0] = res; syscall(SYS_mmap, 0x20ffb000, 0x3000, 7, 0x11, r[0], 0); syscall(SYS_ftruncate, r[0], 0x227f); syscall(SYS_mlock, 0x20ffc000, 0x1000); memcpy((void*)0x20000080, "./file0\000", 8); res = syscall(SYS_open, 0x20000080, 0x11820a, 0); if (res != -1) r[1] = res; *(uint64_t*)0x20001ec0 = 0x20001f00; memcpy((void*)0x20001f00, "\x06\x35\x45\x40\x55\xee\xab\x60\x64\x15\x55\x4d\x3d\xf1\x75\x5f\xff" "\x5b\x57\x53\x50\x13\x43\x36\x19\xe6\xa2\x2d\xa8\x39\x64\xb5\x4a\xfc" "\xce\x63\x75\x58\x2a\x6e\x37\x33\xd9\x1e\xe8\x7c\xc7\x9f\x36\x25\x6b" "\xca\x78\xb9\x9b\x80\xaa", 57); *(uint64_t*)0x20001ec8 = 0x39; *(uint64_t*)0x20001ed0 = 0; *(uint64_t*)0x20001ed8 = 0; *(uint64_t*)0x20001ee0 = 0; *(uint64_t*)0x20001ee8 = 0; *(uint64_t*)0x20001ef0 = 0; *(uint64_t*)0x20001ef8 = 0; syscall(SYS_writev, r[1], 0x20001ec0, 4); res = syscall(SYS_dup2, r[0], r[1]); if (res != -1) r[2] = res; memcpy((void*)0x20000140, "./file0\000", 8); res = syscall(SYS_open, 0x20000140, 0, 0); if (res != -1) r[3] = res; res = syscall(SYS_socket, 0x1c, 1, 0x84); if (res != -1) r[4] = res; syscall(SYS_fsync, r[2]); *(uint8_t*)0x200000c0 = 0x1c; *(uint8_t*)0x200000c1 = 0x1c; *(uint16_t*)0x200000c2 = htobe16(0x4e22); *(uint32_t*)0x200000c4 = 0; *(uint8_t*)0x200000c8 = 0; *(uint8_t*)0x200000c9 = 0; *(uint8_t*)0x200000ca = 0; *(uint8_t*)0x200000cb = 0; *(uint8_t*)0x200000cc = 0; *(uint8_t*)0x200000cd = 0; *(uint8_t*)0x200000ce = 0; *(uint8_t*)0x200000cf = 0; *(uint8_t*)0x200000d0 = 0; *(uint8_t*)0x200000d1 = 0; *(uint8_t*)0x200000d2 = 0; *(uint8_t*)0x200000d3 = 0; *(uint8_t*)0x200000d4 = 0; *(uint8_t*)0x200000d5 = 0; *(uint8_t*)0x200000d6 = 0; *(uint8_t*)0x200000d7 = 0; *(uint32_t*)0x200000d8 = 0; syscall(SYS_bind, r[4], 0x200000c0, 0x1c); *(uint64_t*)0x20000500 = 0x20000080; *(uint8_t*)0x20000080 = 0x1c; *(uint8_t*)0x20000081 = 0x1c; *(uint16_t*)0x20000082 = htobe16(0x4e22); *(uint32_t*)0x20000084 = 0; *(uint64_t*)0x20000088 = htobe64(0); *(uint64_t*)0x20000090 = htobe64(1); *(uint32_t*)0x20000098 = 0; *(uint32_t*)0x20000508 = 0x1c; *(uint64_t*)0x20000510 = 0x20000480; *(uint64_t*)0x20000480 = 0x20000280; memcpy((void*)0x20000280, "\x1a", 1); *(uint64_t*)0x20000488 = 1; *(uint32_t*)0x20000518 = 1; *(uint64_t*)0x20000520 = 0; *(uint32_t*)0x20000528 = 0; *(uint32_t*)0x2000052c = 0; syscall(SYS_sendmsg, r[4], 0x20000500, 0); syscall(SYS_sendfile, r[3], r[4], 0, 0, 0, 0, 0); return 0; }