syzkaller-repros/linux/544067c32331f97801e2b5b5f83e4f7f7e2665ce.c

// BUG: unable to handle kernel paging request in crypto_chacha20_crypt
// https://syzkaller.appspot.com/bug?id=544067c32331f97801e2b5b5f83e4f7f7e2665ce
// status:dup
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <sys/syscall.h>
#include <unistd.h>

#include <stdint.h>
#include <string.h>

long r[42];
void loop()
{
  memset(r, -1, sizeof(r));
  r[0] = syscall(__NR_mmap, 0x20000000ul, 0xf76000ul, 0x3ul, 0x32ul,
                 0xfffffffffffffffful, 0x0ul);
  r[1] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul);
  *(uint16_t*)0x20d65000 = (uint16_t)0x26;
  memcpy((void*)0x20d65002,
         "\x73\x6b\x63\x69\x70\x68\x65\x72\x00\x00\x00\x00\x00\x00",
         14);
  *(uint32_t*)0x20d65010 = (uint32_t)0x20f;
  *(uint32_t*)0x20d65014 = (uint32_t)0x0;
  memcpy((void*)0x20d65018,
         "\x63\x68\x61\x63\x68\x61\x32\x30\x2d\x67\x65\x6e\x65\x72\x69"
         "\x63\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
         "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
         "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
         "\x00\x00\x00\x00",
         64);
  r[7] = syscall(__NR_bind, r[1], 0x20d65000ul, 0x58ul);
  memcpy((void*)0x20f73000, "\x0a\x07\x75\xb0\xd5\xe3\x71\xe5\xb3\xb6"
                            "\x0c\xed\x5c\x54\xdb\xb7\x29\x5d\xf0\xdf"
                            "\x82\x17\xad\x40\x00\x00\x00\x00\x00\x00"
                            "\x00\xe6",
         32);
  r[9] = syscall(__NR_setsockopt, r[1], 0x117ul, 0x1ul, 0x20f73000ul,
                 0x20ul);
  r[10] = syscall(__NR_accept, r[1], 0x0ul, 0x0ul);
  r[11] = syscall(__NR_io_setup, 0x1ul, 0x20479000ul);
  if (r[11] != -1)
    r[12] = *(uint64_t*)0x20479000;
  r[13] = syscall(__NR_eventfd, 0x4000ul);
  *(uint64_t*)0x20738000 = (uint64_t)0x20f73fc0;
  *(uint64_t*)0x20738008 = (uint64_t)0x208e8fc0;
  *(uint64_t*)0x20f73fc0 = (uint64_t)0x0;
  *(uint32_t*)0x20f73fc8 = (uint32_t)0x0;
  *(uint32_t*)0x20f73fcc = (uint32_t)0x0;
  *(uint16_t*)0x20f73fd0 = (uint16_t)0x0;
  *(uint16_t*)0x20f73fd2 = (uint16_t)0x9;
  *(uint32_t*)0x20f73fd4 = r[10];
  *(uint64_t*)0x20f73fd8 = (uint64_t)0x2079a000;
  *(uint64_t*)0x20f73fe0 = (uint64_t)0x19;
  *(uint64_t*)0x20f73fe8 = (uint64_t)0x0;
  *(uint64_t*)0x20f73ff0 = (uint64_t)0x0;
  *(uint32_t*)0x20f73ff8 = (uint32_t)0x1;
  *(uint32_t*)0x20f73ffc = r[13];
  memcpy((void*)0x2079a000, "\x16\x80\xb5\x6c\x88\xe4\x52\xf0\xc9\x0a"
                            "\xfe\xde\x60\x61\xa2\x0a\x17\x1f\xd8\x6d"
                            "\x1c\x7b\xb9\xe1\xc5",
         25);
  *(uint64_t*)0x208e8fc0 = (uint64_t)0x0;
  *(uint32_t*)0x208e8fc8 = (uint32_t)0x0;
  *(uint32_t*)0x208e8fcc = (uint32_t)0x0;
  *(uint16_t*)0x208e8fd0 = (uint16_t)0x8;
  *(uint16_t*)0x208e8fd2 = (uint16_t)0x1;
  *(uint32_t*)0x208e8fd4 = r[10];
  *(uint64_t*)0x208e8fd8 = (uint64_t)0x20435035;
  *(uint64_t*)0x208e8fe0 = (uint64_t)0x0;
  *(uint64_t*)0x208e8fe8 = (uint64_t)0x100000000;
  *(uint64_t*)0x208e8ff0 = (uint64_t)0x0;
  *(uint32_t*)0x208e8ff8 = (uint32_t)0x1;
  *(uint32_t*)0x208e8ffc = (uint32_t)0xffffffffffffffff;
  r[41] = syscall(__NR_io_submit, r[12], 0x2ul, 0x20738000ul);
}

int main()
{
  loop();
  return 0;
}