| // INFO: task hung |
| // https://syzkaller.appspot.com/bug?id=9c557bdc7328e1ab4f0325699da821c22e47ab93 |
| // status:fixed |
| // autogenerated by syzkaller (http://github.com/google/syzkaller) |
| |
| #ifndef __NR_bpf |
| #define __NR_bpf 321 |
| #endif |
| |
| #define _GNU_SOURCE |
| |
| #include <stdint.h> |
| #include <string.h> |
| #include <sys/syscall.h> |
| #include <unistd.h> |
| |
| static void test(); |
| |
| void loop() |
| { |
| while (1) { |
| test(); |
| } |
| } |
| |
| long r[29]; |
| void test() |
| { |
| memset(r, -1, sizeof(r)); |
| r[0] = syscall(__NR_mmap, 0x20000000ul, 0xef8000ul, 0x3ul, 0x32ul, |
| 0xfffffffffffffffful, 0x0ul); |
| *(uint32_t*)0x20b4cfd0 = (uint32_t)0x1; |
| *(uint32_t*)0x20b4cfd4 = (uint32_t)0x2; |
| *(uint64_t*)0x20b4cfd8 = (uint64_t)0x20ef3000; |
| *(uint64_t*)0x20b4cfe0 = (uint64_t)0x20b4d000; |
| *(uint32_t*)0x20b4cfe8 = (uint32_t)0x1; |
| *(uint32_t*)0x20b4cfec = (uint32_t)0x80; |
| *(uint64_t*)0x20b4cff0 = (uint64_t)0x2000a000; |
| *(uint32_t*)0x20b4cff8 = (uint32_t)0x0; |
| *(uint8_t*)0x20ef3000 = (uint8_t)0x8db7; |
| *(uint8_t*)0x20ef3001 = (uint8_t)0x0; |
| *(uint16_t*)0x20ef3002 = (uint16_t)0x0; |
| *(uint32_t*)0x20ef3004 = (uint32_t)0x0; |
| *(uint8_t*)0x20ef3008 = (uint8_t)0xd395; |
| *(uint8_t*)0x20ef3009 = (uint8_t)0x0; |
| *(uint16_t*)0x20ef300a = (uint16_t)0x0; |
| *(uint32_t*)0x20ef300c = (uint32_t)0x0; |
| memcpy((void*)0x20b4d000, "\x73\x79\x73\x65\x4f\x00", 6); |
| r[18] = syscall(__NR_bpf, 0x5ul, 0x20b4cfd0ul, 0x30ul); |
| r[19] = syscall(__NR_socket, 0x29ul, 0x5ul, 0x0ul); |
| *(uint32_t*)0x20ef4000 = r[19]; |
| *(uint32_t*)0x20ef4004 = r[18]; |
| r[22] = syscall(__NR_ioctl, r[19], 0x89e0ul, 0x20ef4000ul); |
| *(uint32_t*)0x20ef6ffc = r[19]; |
| r[24] = syscall(__NR_ioctl, r[19], 0x89e2ul, 0x20ef6ffcul); |
| if (r[24] != -1) |
| r[25] = *(uint32_t*)0x20ef6ffc; |
| memcpy((void*)0x206d4fed, "\x2e\x6c\x9b\x1f\x66\x9d\x5e\xf3\xf5\xd3" |
| "\x67\xd6\x8f\x23\x5d\x02\x1b\x35\x73", |
| 19); |
| r[27] = syscall(__NR_sendto, r[25], 0x206d4fedul, 0x13ul, 0x4080ul, |
| 0x20000000ul, 0x0ul); |
| r[28] = syscall(__NR_close, r[19]); |
| } |
| |
| int main() |
| { |
| loop(); |
| return 0; |
| } |