// autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[73]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_socket, 0x40000000015ul, 0x5ul, 0x0ul); *(uint16_t*)0x208a5ff0 = (uint16_t)0x2; *(uint16_t*)0x208a5ff2 = (uint16_t)0x204e; *(uint32_t*)0x208a5ff4 = (uint32_t)0x100007f; *(uint8_t*)0x208a5ff8 = (uint8_t)0x0; *(uint8_t*)0x208a5ff9 = (uint8_t)0x0; *(uint8_t*)0x208a5ffa = (uint8_t)0x0; *(uint8_t*)0x208a5ffb = (uint8_t)0x0; *(uint8_t*)0x208a5ffc = (uint8_t)0x0; *(uint8_t*)0x208a5ffd = (uint8_t)0x0; *(uint8_t*)0x208a5ffe = (uint8_t)0x0; *(uint8_t*)0x208a5fff = (uint8_t)0x0; r[13] = syscall(__NR_bind, r[1], 0x208a5ff0ul, 0x10ul); *(uint64_t*)0x2048cfe4 = (uint64_t)0x20477000; *(uint32_t*)0x2048cfec = (uint32_t)0x10; *(uint64_t*)0x2048cff4 = (uint64_t)0x20982fdf; *(uint64_t*)0x2048cffc = (uint64_t)0xa; *(uint64_t*)0x2048d004 = (uint64_t)0x20c07000; *(uint64_t*)0x2048d00c = (uint64_t)0xd0; *(uint32_t*)0x2048d014 = (uint32_t)0x4; *(uint16_t*)0x20477000 = (uint16_t)0x2; *(uint16_t*)0x20477002 = (uint16_t)0x214e; *(uint32_t*)0x20477004 = (uint32_t)0x10000e0; *(uint8_t*)0x20477008 = (uint8_t)0x0; *(uint8_t*)0x20477009 = (uint8_t)0x0; *(uint8_t*)0x2047700a = (uint8_t)0x0; *(uint8_t*)0x2047700b = (uint8_t)0x0; *(uint8_t*)0x2047700c = (uint8_t)0x0; *(uint8_t*)0x2047700d = (uint8_t)0x0; *(uint8_t*)0x2047700e = (uint8_t)0x0; *(uint8_t*)0x2047700f = (uint8_t)0x0; *(uint64_t*)0x20982fdf = (uint64_t)0x20885f46; *(uint64_t*)0x20982fe7 = (uint64_t)0x0; *(uint64_t*)0x20982fef = (uint64_t)0x20a1b000; *(uint64_t*)0x20982ff7 = (uint64_t)0x0; *(uint64_t*)0x20982fff = (uint64_t)0x20b4c000; *(uint64_t*)0x20983007 = (uint64_t)0x0; *(uint64_t*)0x2098300f = (uint64_t)0x20ebef3a; *(uint64_t*)0x20983017 = (uint64_t)0xc6; *(uint64_t*)0x2098301f = (uint64_t)0x20f4b000; *(uint64_t*)0x20983027 = (uint64_t)0x0; *(uint64_t*)0x2098302f = (uint64_t)0x2004f000; *(uint64_t*)0x20983037 = (uint64_t)0x0; *(uint64_t*)0x2098303f = (uint64_t)0x209e2f26; *(uint64_t*)0x20983047 = (uint64_t)0x0; *(uint64_t*)0x2098304f = (uint64_t)0x20ca7000; *(uint64_t*)0x20983057 = (uint64_t)0x0; *(uint64_t*)0x2098305f = (uint64_t)0x204ae000; *(uint64_t*)0x20983067 = (uint64_t)0x0; *(uint64_t*)0x2098306f = (uint64_t)0x20989ff6; *(uint64_t*)0x20983077 = (uint64_t)0x0; memcpy((void*)0x20ebef3a, "\x41\x44\xa3\xe5\x0c\x52\xf9\xfe\x09\x73\xd2\xe9\xd8\x40\x67" "\x26\x16\x72\x18\x46\x8e\xb3\x4b\x30\x9e\xa8\x37\xb2\x74\x38" "\x8c\xd9\xae\x02\xb3\xb5\x6c\x2b\xe7\xa4\x5a\xcf\x98\xca\x29" "\xef\x50\xfe\xd4\xac\xea\xb8\x68\xa1\x42\x2b\x97\xec\x04\x47" "\x6d\x72\x63\x0a\xf4\x80\x1c\x27\x77\x19\x09\x51\xbe\xe0\xa8" "\x4b\x99\x63\xd2\x34\x9a\x98\x15\x1c\xfb\x03\x48\x7b\x47\x51" "\xdd\xa6\x2f\x79\x79\xa1\x50\xd5\xc7\x55\xd1\x68\xfc\x59\x28" "\x3c\xc4\x0b\x7b\xd8\x7a\x88\x1a\x97\x8a\xcb\xc8\xba\xb7\xb1" "\xd9\x1a\x6a\xbf\x2f\x20\x7a\x90\xf6\xae\x2c\x67\xae\xfc\x7e" "\x8f\x1f\x1d\xbd\xd6\x62\x72\xd4\xef\x37\xf5\xca\xed\x97\x3f" "\xc5\xc2\xa4\x3d\xda\x33\x3a\x53\xa5\x72\x4b\x81\x84\xd3\xa6" "\x1b\xb0\xba\x78\xa3\x99\x61\x4e\xda\x06\x1a\xe9\x87\xe6\x54" "\x61\x59\x4f\x37\xca\x8f\xd7\x7e\x1a\x69\xde\x30\x98\xb7\x3d" "\x52\x3d\xc1", 198); *(uint64_t*)0x20c07000 = (uint64_t)0x10; *(uint32_t*)0x20c07008 = (uint32_t)0x1; *(uint32_t*)0x20c0700c = (uint32_t)0x4; *(uint64_t*)0x20c07010 = (uint64_t)0x10; *(uint32_t*)0x20c07018 = (uint32_t)0x1; *(uint32_t*)0x20c0701c = (uint32_t)0x4; *(uint64_t*)0x20c07020 = (uint64_t)0x10; *(uint32_t*)0x20c07028 = (uint32_t)0x11f; *(uint32_t*)0x20c0702c = (uint32_t)0x1; *(uint64_t*)0x20c07030 = (uint64_t)0x80; *(uint32_t*)0x20c07038 = (uint32_t)0x114; *(uint32_t*)0x20c0703c = (uint32_t)0x8; memcpy((void*)0x20c07040, "\x29\xbb\xfa\xdc\x77\xe6\xe6\xd7\x81\x02\x56\xbd\x99\xa2\x2c" "\xce\xe4\x52\x0f\xb7\xd5\x7d\x09\x7e\xf0\xdc\xca\xa0\xad\x74" "\x18\x3d\xa1\x27\x25\x35\x82\x3b\xa4\x41\xd5\xa4\xfd\x01\xf8" "\x22\x43\x7a\xa0\x46\xe7\x38\x14\x5a\xee\xdc\xf6\x57\xa3\xe1" "\xb5\x83\xeb\x57\xb4\x97\x34\x99\x96\xa1\x16\xb3\xc7\x64\x84" "\x06\xbc\xf2\x27\xc7\x3b\x46\x48\x52\x42\xb6\x2b\x56\x5d\x4a" "\x61\xd9\x39\x95\x94\xbb\x5b\xb7\x4a\x3f\x30\x2a\xb1\xa0\xdd" "\x63\x27\x53\x94\xa3\xd5", 111); *(uint64_t*)0x20c070b0 = (uint64_t)0x10; *(uint32_t*)0x20c070b8 = (uint32_t)0x13f; *(uint32_t*)0x20c070bc = (uint32_t)0x5; *(uint64_t*)0x20c070c0 = (uint64_t)0x10; *(uint32_t*)0x20c070c8 = (uint32_t)0x13b; *(uint32_t*)0x20c070cc = (uint32_t)0xf4b; r[72] = syscall(__NR_sendmsg, r[1], 0x2048cfe4ul, 0x40ul); } int main() { loop(); return 0; }