// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$kcm arguments: [ // domain: const = 0x10 (8 bytes) // type: kcm_socket_type = 0x2 (8 bytes) // proto: const = 0x4 (4 bytes) // ] // returns sock_kcm res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=SOCK_DGRAM*/ 2ul, /*proto=*/4); if (res != -1) r[0] = res; // sendmsg$inet arguments: [ // fd: sock (resource) // msg: ptr[in, msghdr_inet] { // msghdr_inet { // msg_name: nil // msg_namelen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // msg_iov: ptr[in, array[iovec[in, array[int8]]]] { // array[iovec[in, array[int8]]] { // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {5c 00 00 00 12 00 6b 04 00 00 00 d8 6e 6c 1d 00 02 // 88 7e a6 ea 65 67 00 00 00 00 00 00 00 90 f9 c3 dc 90 f8 f4 // 1f 8e cf f3 2c 6e 02 00 75 e3 00 25 00 45 58 6c 8d a7 18 ad // 4b 44 60 bc 24 ea b5 56 00 00 00 00 00 00 00 bf 93 67 b4 fa // 51 f6 0a 64 c9 f4 d4 93 80 37 e7 86 a6 d0 bd} (length 0x5c) // } // len: len = 0x5c (8 bytes) // } // } // } // msg_iovlen: len = 0x1 (8 bytes) // msg_control: nil // msg_controllen: bytesize = 0x0 (8 bytes) // msg_flags: const = 0x1f00c00e (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000200 = 0; *(uint32_t*)0x200000000208 = 0; *(uint64_t*)0x200000000210 = 0x2000000001c0; *(uint64_t*)0x2000000001c0 = 0x200000000240; memcpy((void*)0x200000000240, "\x5c\x00\x00\x00\x12\x00\x6b\x04\x00\x00\x00\xd8\x6e\x6c\x1d\x00\x02" "\x88\x7e\xa6\xea\x65\x67\x00\x00\x00\x00\x00\x00\x00\x90\xf9\xc3\xdc" "\x90\xf8\xf4\x1f\x8e\xcf\xf3\x2c\x6e\x02\x00\x75\xe3\x00\x25\x00\x45" "\x58\x6c\x8d\xa7\x18\xad\x4b\x44\x60\xbc\x24\xea\xb5\x56\x00\x00\x00" "\x00\x00\x00\x00\xbf\x93\x67\xb4\xfa\x51\xf6\x0a\x64\xc9\xf4\xd4\x93" "\x80\x37\xe7\x86\xa6\xd0\xbd", 92); *(uint64_t*)0x2000000001c8 = 0x5c; *(uint64_t*)0x200000000218 = 1; *(uint64_t*)0x200000000220 = 0; *(uint64_t*)0x200000000228 = 0; *(uint32_t*)0x200000000230 = 0x1f00c00e; syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x200000000200ul, /*f=*/0ul); return 0; }