| // KASAN: stack-out-of-bounds Read in __nla_put |
| // https://syzkaller.appspot.com/bug?id=5ea2c9ac96fc3c1da4d7ee9572c8c7ed229f1b13 |
| // status:fixed |
| // autogenerated by syzkaller (http://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| #include <endian.h> |
| #include <stdint.h> |
| #include <string.h> |
| #include <sys/syscall.h> |
| #include <unistd.h> |
| |
| long r[1]; |
| void loop() |
| { |
| memset(r, -1, sizeof(r)); |
| syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); |
| r[0] = syscall(__NR_socket, 0x10, 3, 4); |
| memcpy((void*)0x20f67000, "\x9a\xdc\x01\xce", 4); |
| syscall(__NR_setsockopt, r[0], 0x10e, 0xb, 0x20f67000, 4); |
| *(uint64_t*)0x2058efc8 = 0x201e4000; |
| *(uint32_t*)0x2058efd0 = 0xc; |
| *(uint64_t*)0x2058efd8 = 0x20877000; |
| *(uint64_t*)0x2058efe0 = 1; |
| *(uint64_t*)0x2058efe8 = 0; |
| *(uint64_t*)0x2058eff0 = 0; |
| *(uint32_t*)0x2058eff8 = 0; |
| *(uint16_t*)0x201e4000 = 0x10; |
| *(uint16_t*)0x201e4002 = 0; |
| *(uint32_t*)0x201e4004 = 0; |
| *(uint32_t*)0x201e4008 = 0; |
| *(uint64_t*)0x20877000 = 0x20611000; |
| *(uint64_t*)0x20877008 = 0x14; |
| *(uint32_t*)0x20611000 = 0x14; |
| *(uint8_t*)0x20611004 = 0; |
| *(uint8_t*)0x20611005 = 0xb; |
| *(uint16_t*)0x20611006 = 0x10c; |
| *(uint32_t*)0x20611008 = 0; |
| *(uint32_t*)0x2061100c = 0; |
| *(uint8_t*)0x20611010 = 0; |
| *(uint8_t*)0x20611011 = 0; |
| *(uint16_t*)0x20611012 = htobe16(0); |
| syscall(__NR_sendmsg, r[0], 0x2058efc8, 0); |
| } |
| |
| int main() |
| { |
| loop(); |
| return 0; |
| } |