syzkaller-repros/linux/bea1c185923957c5339d5b43bca13e71047453da.c - pub/scm/linux/kernel/git/shuah/linux-arts - Git at Google

 // WARNING: kernel stack regs has bad 'bp' value (3)
 // https://syzkaller.appspot.com/bug?id=bea1c185923957c5339d5b43bca13e71047453da
 // status:fixed
 // autogenerated by syzkaller (http://github.com/google/syzkaller)

 #define _GNU_SOURCE
 #include <endian.h>
 #include <errno.h>
 #include <linux/net.h>
 #include <netinet/in.h>
 #include <signal.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <sys/prctl.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
 #include <sys/time.h>
 #include <sys/wait.h>
 #include <time.h>
 #include <unistd.h>

 __attribute__((noreturn)) static void doexit(int status)
 {
   volatile unsigned i;
   syscall(__NR_exit_group, status);
   for (i = 0;; i++) {
   }
 }
 #include <setjmp.h>
 #include <signal.h>
 #include <stdint.h>
 #include <string.h>
 #include <string.h>

 const int kFailStatus = 67;
 const int kRetryStatus = 69;

 static void fail(const char* msg, ...)
 {
   int e = errno;
   va_list args;
   va_start(args, msg);
   vfprintf(stderr, msg, args);
   va_end(args);
   fprintf(stderr, " (errno %d)\n", e);
   doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
 }

 static __thread int skip_segv;
 static __thread jmp_buf segv_env;

 static void segv_handler(int sig, siginfo_t* info, void* uctx)
 {
   uintptr_t addr = (uintptr_t)info->si_addr;
   const uintptr_t prog_start = 1 << 20;
   const uintptr_t prog_end = 100 << 20;
   if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
       (addr < prog_start || addr > prog_end)) {
     _longjmp(segv_env, 1);
   }
   doexit(sig);
 }

 static void install_segv_handler()
 {
   struct sigaction sa;

   memset(&sa, 0, sizeof(sa));
   sa.sa_handler = SIG_IGN;
   syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
   syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);

   memset(&sa, 0, sizeof(sa));
   sa.sa_sigaction = segv_handler;
   sa.sa_flags = SA_NODEFER | SA_SIGINFO;
   sigaction(SIGSEGV, &sa, NULL);
   sigaction(SIGBUS, &sa, NULL);
 }

 #define NONFAILING(...)                                                        \
   {                                                                            \
     __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
     if (_setjmp(segv_env) == 0) {                                              \
       __VA_ARGS__;                                                             \
     }                                                                          \
     __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
   }

 static uint64_t current_time_ms()
 {
   struct timespec ts;

   if (clock_gettime(CLOCK_MONOTONIC, &ts))
     fail("clock_gettime failed");
   return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
 }

 struct ipt_getinfo {
   char name[32];
   unsigned int valid_hooks;
   unsigned int hook_entry[5];
   unsigned int underflow[5];
   unsigned int num_entries;
   unsigned int size;
 };

 struct ipt_get_entries {
   char name[32];
   unsigned int size;
   void* entrytable[1024 / sizeof(void*)];
 };

 struct xt_counters {
   uint64_t pcnt, bcnt;
 };

 struct ipt_replace {
   char name[32];
   unsigned int valid_hooks;
   unsigned int num_entries;
   unsigned int size;
   unsigned int hook_entry[5];
   unsigned int underflow[5];
   unsigned int num_counters;
   struct xt_counters* counters;
   char entrytable[1024];
 };

 struct ipt_table_desc {
   const char* name;
   struct ipt_getinfo info;
   struct ipt_get_entries entries;
   struct ipt_replace replace;
   struct xt_counters counters[10];
 };

 static struct ipt_table_desc ipv4_tables[] = {
     {.name = "filter"}, {.name = "nat"},      {.name = "mangle"},
     {.name = "raw"},    {.name = "security"},
 };

 #define IPT_BASE_CTL 64
 #define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
 #define IPT_SO_GET_INFO (IPT_BASE_CTL)
 #define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)

 static void checkpoint_net_namespace(void)
 {
   socklen_t optlen;
   unsigned i;
   int fd;

   fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
   if (fd == -1)
     fail("socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)");
   for (i = 0; i < sizeof(ipv4_tables) / sizeof(ipv4_tables[0]); i++) {
     struct ipt_table_desc* table = &ipv4_tables[i];
     strcpy(table->info.name, table->name);
     strcpy(table->entries.name, table->name);
     strcpy(table->replace.name, table->name);
     optlen = sizeof(table->info);
     if (getsockopt(fd, SOL_IP, IPT_SO_GET_INFO, &table->info, &optlen)) {
       switch (errno) {
       case EPERM:
       case ENOENT:
       case ENOPROTOOPT:
         continue;
       }
       fail("getsockopt(IPT_SO_GET_INFO)");
     }
     if (table->info.size > sizeof(table->entries.entrytable))
       fail("table size is too large: %u", table->info.size);
     if (table->info.num_entries >
         sizeof(table->counters) / sizeof(table->counters[0]))
       fail("too many counters: %u", table->info.num_entries);
     table->entries.size = table->info.size;
     optlen = sizeof(table->entries) - sizeof(table->entries.entrytable) +
              table->info.size;
     if (getsockopt(fd, SOL_IP, IPT_SO_GET_ENTRIES, &table->entries, &optlen))
       fail("getsockopt(IPT_SO_GET_ENTRIES)");
     table->replace.valid_hooks = table->info.valid_hooks;
     table->replace.num_entries = table->info.num_entries;
     table->replace.counters = table->counters;
     table->replace.size = table->info.size;
     memcpy(table->replace.hook_entry, table->info.hook_entry,
            sizeof(table->replace.hook_entry));
     memcpy(table->replace.underflow, table->info.underflow,
            sizeof(table->replace.underflow));
     memcpy(table->replace.entrytable, table->entries.entrytable,
            table->info.size);
   }
   close(fd);
 }

 static void reset_net_namespace(void)
 {
   struct ipt_get_entries entries;
   struct ipt_getinfo info;
   socklen_t optlen;
   unsigned i;
   int fd;

   memset(&info, 0, sizeof(info));
   memset(&entries, 0, sizeof(entries));
   fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
   if (fd == -1)
     fail("socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)");
   for (i = 0; i < sizeof(ipv4_tables) / sizeof(ipv4_tables[0]); i++) {
     struct ipt_table_desc* table = &ipv4_tables[i];
     if (table->info.valid_hooks == 0)
       continue;
     strcpy(info.name, table->name);
     optlen = sizeof(info);
     if (getsockopt(fd, SOL_IP, IPT_SO_GET_INFO, &info, &optlen))
       fail("getsockopt(IPT_SO_GET_INFO)");
     if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
       strcpy(entries.name, table->name);
       entries.size = table->info.size;
       optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
       if (getsockopt(fd, SOL_IP, IPT_SO_GET_ENTRIES, &entries, &optlen))
         fail("getsockopt(IPT_SO_GET_ENTRIES)");
       if (memcmp(&table->entries, &entries, optlen) == 0)
         continue;
     }
     table->replace.num_counters = info.num_entries;
     optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) +
              table->replace.size;
     if (setsockopt(fd, SOL_IP, IPT_SO_SET_REPLACE, &table->replace, optlen))
       fail("setsockopt(IPT_SO_SET_REPLACE)");
   }
   close(fd);
 }

 static void test();

 void loop()
 {
   int iter;
   checkpoint_net_namespace();
   for (iter = 0;; iter++) {
     int pid = fork();
     if (pid < 0)
       fail("loop fork failed");
     if (pid == 0) {
       prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
       setpgrp();
       test();
       doexit(0);
     }
     int status = 0;
     uint64_t start = current_time_ms();
     for (;;) {
       int res = waitpid(-1, &status, __WALL | WNOHANG);
       if (res == pid)
         break;
       usleep(1000);
       if (current_time_ms() - start > 5 * 1000) {
         kill(-pid, SIGKILL);
         kill(pid, SIGKILL);
         while (waitpid(-1, &status, __WALL) != pid) {
         }
         break;
       }
     }
     reset_net_namespace();
   }
 }

 long r[3];
 uint64_t procid;
 void test()
 {
   memset(r, -1, sizeof(r));
   syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
   r[0] = syscall(__NR_socket, 0x26, 5, 0);
   syscall(__NR_close, r[0]);
   r[1] = syscall(__NR_socket, 0x26, 5, 0);
   NONFAILING(*(uint16_t*)0x20219fa8 = 0x26);
   NONFAILING(memcpy((void*)0x20219faa,
                     "\x73\x6b\x63\x69\x70\x68\x65\x72\x00\x00\x00\x00\x00\x00",
                     14));
   NONFAILING(*(uint32_t*)0x20219fb8 = 0);
   NONFAILING(*(uint32_t*)0x20219fbc = 0);
   NONFAILING(memcpy((void*)0x20219fc0,
                     "\x73\x61\x6c\x73\x61\x32\x30\x00\x00\x00\x00\x00\x00\x00"
                     "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                     "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                     "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                     "\x00\x00\x00\x00\x00\x00\x00\x00",
                     64));
   syscall(__NR_bind, r[0], 0x20219fa8, 0x58);
   NONFAILING(memcpy(
       (void*)0x20001f3a,
       "\xad\x56\xb6\xc5\x82\x0f\xae\xb9\x95\x29\x89\x92\xea\x54\xc7\xbe", 16));
   syscall(__NR_setsockopt, r[1], 0x117, 1, 0x20001f3a, 0x10);
   r[2] = syscall(__NR_accept, r[1], 0, 0);
   NONFAILING(*(uint64_t*)0x20791000 = 0);
   NONFAILING(*(uint32_t*)0x20791008 = 0);
   NONFAILING(*(uint64_t*)0x20791010 = 0x20cf6000);
   NONFAILING(*(uint64_t*)0x20791018 = 1);
   NONFAILING(*(uint64_t*)0x20791020 = 0x20000000);
   NONFAILING(*(uint64_t*)0x20791028 = 0);
   NONFAILING(*(uint32_t*)0x20791030 = 0);
   NONFAILING(*(uint64_t*)0x20cf6000 = 0x20087000);
   NONFAILING(*(uint64_t*)0x20cf6008 = 0x80);
   NONFAILING(
       memcpy((void*)0x20087000,
              "\x51\xc8\xfb\x29\x29\x98\x9d\x20\xaf\xe7\x3d\xca\xc1\x12\x91\xb7"
              "\x20\xbd\x7b\x71\xdd\xeb\x91\x61\x96\x6d\x49\x86\xbc\x69\x33\x5f"
              "\xf6\x3b\x71\x1f\x36\x65\x3d\x33\xc3\xaf\x96\xb4\x27\x39\x38\x69"
              "\x50\x91\x95\xdb\xe3\xbb\xd7\x2d\x89\x61\x05\xf0\x20\x41\x6b\xbc"
              "\xa5\xf9\xc9\x6a\x03\x1e\xde\x84\xd7\x22\xa8\xca\x57\x49\x65\xa5"
              "\x35\x85\x02\x15\x33\x5d\x66\xef\xc5\xe1\x24\xd0\x25\xa7\x62\xf7"
              "\x7b\x51\xe2\xad\x1a\xe8\x86\x5d\xa4\xed\x5d\xde\x15\xbe\x35\xbe"
              "\x78\xfc\xdb\x66\x7a\x12\xe2\x45\x2c\x8b\x20\x14\x61\xf9\x62\xad",
              128));
   syscall(__NR_sendmmsg, r[2], 0x20791000, 1, 0);
   NONFAILING(*(uint64_t*)0x20b2f000 = 0x208e8000);
   NONFAILING(*(uint32_t*)0x20b2f008 = 0x10);
   NONFAILING(*(uint64_t*)0x20b2f010 = 0x204f3f73);
   NONFAILING(*(uint64_t*)0x20b2f018 = 2);
   NONFAILING(*(uint64_t*)0x20b2f020 = 0x20590000);
   NONFAILING(*(uint64_t*)0x20b2f028 = 0);
   NONFAILING(*(uint32_t*)0x20b2f030 = 0);
   NONFAILING(*(uint64_t*)0x204f3f73 = 0x20284f81);
   NONFAILING(*(uint64_t*)0x204f3f7b = 0x7f);
   NONFAILING(*(uint64_t*)0x204f3f83 = 0x203bc000);
   NONFAILING(*(uint64_t*)0x204f3f8b = 0xc6);
   syscall(__NR_recvmsg, r[2], 0x20b2f000, 0);
 }

 int main()
 {
   for (procid = 0; procid < 8; procid++) {
     if (fork() == 0) {
       install_segv_handler();
       for (;;) {
         loop();
       }
     }
   }
   sleep(1000000);
   return 0;
 }
	// WARNING: kernel stack regs has bad 'bp' value (3)
	// https://syzkaller.appspot.com/bug?id=bea1c185923957c5339d5b43bca13e71047453da
	// status:fixed
	// autogenerated by syzkaller (http://github.com/google/syzkaller)

	#define _GNU_SOURCE
	#include <endian.h>
	#include <errno.h>
	#include <linux/net.h>
	#include <netinet/in.h>
	#include <signal.h>
	#include <stdarg.h>
	#include <stdio.h>
	#include <sys/prctl.h>
	#include <sys/socket.h>
	#include <sys/syscall.h>
	#include <sys/time.h>
	#include <sys/wait.h>
	#include <time.h>
	#include <unistd.h>

	__attribute__((noreturn)) static void doexit(int status)
	{
	volatile unsigned i;
	syscall(__NR_exit_group, status);
	for (i = 0;; i++) {
	}
	}
	#include <setjmp.h>
	#include <signal.h>
	#include <stdint.h>
	#include <string.h>
	#include <string.h>

	const int kFailStatus = 67;
	const int kRetryStatus = 69;

	static void fail(const char* msg, ...)
	{
	int e = errno;
	va_list args;
	va_start(args, msg);
	vfprintf(stderr, msg, args);
	va_end(args);
	fprintf(stderr, " (errno %d)\n", e);
	doexit((e == ENOMEM \|\| e == EAGAIN) ? kRetryStatus : kFailStatus);
	}

	static __thread int skip_segv;
	static __thread jmp_buf segv_env;

	static void segv_handler(int sig, siginfo_t* info, void* uctx)
	{
	uintptr_t addr = (uintptr_t)info->si_addr;
	const uintptr_t prog_start = 1 << 20;
	const uintptr_t prog_end = 100 << 20;
	if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
	(addr < prog_start \|\| addr > prog_end)) {
	_longjmp(segv_env, 1);
	}
	doexit(sig);
	}

	static void install_segv_handler()
	{
	struct sigaction sa;

	memset(&sa, 0, sizeof(sa));
	sa.sa_handler = SIG_IGN;
	syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
	syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);

	memset(&sa, 0, sizeof(sa));
	sa.sa_sigaction = segv_handler;
	sa.sa_flags = SA_NODEFER \| SA_SIGINFO;
	sigaction(SIGSEGV, &sa, NULL);
	sigaction(SIGBUS, &sa, NULL);
	}

	#define NONFAILING(...) \
	{ \
	__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
	if (_setjmp(segv_env) == 0) { \
	__VA_ARGS__; \
	} \
	__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
	}

	static uint64_t current_time_ms()
	{
	struct timespec ts;

	if (clock_gettime(CLOCK_MONOTONIC, &ts))
	fail("clock_gettime failed");
	return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
	}

	struct ipt_getinfo {
	char name[32];
	unsigned int valid_hooks;
	unsigned int hook_entry[5];
	unsigned int underflow[5];
	unsigned int num_entries;
	unsigned int size;
	};

	struct ipt_get_entries {
	char name[32];
	unsigned int size;
	void* entrytable[1024 / sizeof(void*)];
	};

	struct xt_counters {
	uint64_t pcnt, bcnt;
	};

	struct ipt_replace {
	char name[32];
	unsigned int valid_hooks;
	unsigned int num_entries;
	unsigned int size;
	unsigned int hook_entry[5];
	unsigned int underflow[5];
	unsigned int num_counters;
	struct xt_counters* counters;
	char entrytable[1024];
	};

	struct ipt_table_desc {
	const char* name;
	struct ipt_getinfo info;
	struct ipt_get_entries entries;
	struct ipt_replace replace;
	struct xt_counters counters[10];
	};

	static struct ipt_table_desc ipv4_tables[] = {
	{.name = "filter"}, {.name = "nat"}, {.name = "mangle"},
	{.name = "raw"}, {.name = "security"},
	};

	#define IPT_BASE_CTL 64
	#define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
	#define IPT_SO_GET_INFO (IPT_BASE_CTL)
	#define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)

	static void checkpoint_net_namespace(void)
	{
	socklen_t optlen;
	unsigned i;
	int fd;

	fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (fd == -1)
	fail("socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)");
	for (i = 0; i < sizeof(ipv4_tables) / sizeof(ipv4_tables[0]); i++) {
	struct ipt_table_desc* table = &ipv4_tables[i];
	strcpy(table->info.name, table->name);
	strcpy(table->entries.name, table->name);
	strcpy(table->replace.name, table->name);
	optlen = sizeof(table->info);
	if (getsockopt(fd, SOL_IP, IPT_SO_GET_INFO, &table->info, &optlen)) {
	switch (errno) {
	case EPERM:
	case ENOENT:
	case ENOPROTOOPT:
	continue;
	}
	fail("getsockopt(IPT_SO_GET_INFO)");
	}
	if (table->info.size > sizeof(table->entries.entrytable))
	fail("table size is too large: %u", table->info.size);
	if (table->info.num_entries >
	sizeof(table->counters) / sizeof(table->counters[0]))
	fail("too many counters: %u", table->info.num_entries);
	table->entries.size = table->info.size;
	optlen = sizeof(table->entries) - sizeof(table->entries.entrytable) +
	table->info.size;
	if (getsockopt(fd, SOL_IP, IPT_SO_GET_ENTRIES, &table->entries, &optlen))
	fail("getsockopt(IPT_SO_GET_ENTRIES)");
	table->replace.valid_hooks = table->info.valid_hooks;
	table->replace.num_entries = table->info.num_entries;
	table->replace.counters = table->counters;
	table->replace.size = table->info.size;
	memcpy(table->replace.hook_entry, table->info.hook_entry,
	sizeof(table->replace.hook_entry));
	memcpy(table->replace.underflow, table->info.underflow,
	sizeof(table->replace.underflow));
	memcpy(table->replace.entrytable, table->entries.entrytable,
	table->info.size);
	}
	close(fd);
	}

	static void reset_net_namespace(void)
	{
	struct ipt_get_entries entries;
	struct ipt_getinfo info;
	socklen_t optlen;
	unsigned i;
	int fd;

	memset(&info, 0, sizeof(info));
	memset(&entries, 0, sizeof(entries));
	fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (fd == -1)
	fail("socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)");
	for (i = 0; i < sizeof(ipv4_tables) / sizeof(ipv4_tables[0]); i++) {
	struct ipt_table_desc* table = &ipv4_tables[i];
	if (table->info.valid_hooks == 0)
	continue;
	strcpy(info.name, table->name);
	optlen = sizeof(info);
	if (getsockopt(fd, SOL_IP, IPT_SO_GET_INFO, &info, &optlen))
	fail("getsockopt(IPT_SO_GET_INFO)");
	if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
	strcpy(entries.name, table->name);
	entries.size = table->info.size;
	optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
	if (getsockopt(fd, SOL_IP, IPT_SO_GET_ENTRIES, &entries, &optlen))
	fail("getsockopt(IPT_SO_GET_ENTRIES)");
	if (memcmp(&table->entries, &entries, optlen) == 0)
	continue;
	}
	table->replace.num_counters = info.num_entries;
	optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) +
	table->replace.size;
	if (setsockopt(fd, SOL_IP, IPT_SO_SET_REPLACE, &table->replace, optlen))
	fail("setsockopt(IPT_SO_SET_REPLACE)");
	}
	close(fd);
	}

	static void test();

	void loop()
	{
	int iter;
	checkpoint_net_namespace();
	for (iter = 0;; iter++) {
	int pid = fork();
	if (pid < 0)
	fail("loop fork failed");
	if (pid == 0) {
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	test();
	doexit(0);
	}
	int status = 0;
	uint64_t start = current_time_ms();
	for (;;) {
	int res = waitpid(-1, &status, __WALL \| WNOHANG);
	if (res == pid)
	break;
	usleep(1000);
	if (current_time_ms() - start > 5 * 1000) {
	kill(-pid, SIGKILL);
	kill(pid, SIGKILL);
	while (waitpid(-1, &status, __WALL) != pid) {
	}
	break;
	}
	}
	reset_net_namespace();
	}
	}

	long r[3];
	uint64_t procid;
	void test()
	{
	memset(r, -1, sizeof(r));
	syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
	r[0] = syscall(__NR_socket, 0x26, 5, 0);
	syscall(__NR_close, r[0]);
	r[1] = syscall(__NR_socket, 0x26, 5, 0);
	NONFAILING((uint16_t)0x20219fa8 = 0x26);
	NONFAILING(memcpy((void*)0x20219faa,
	"\x73\x6b\x63\x69\x70\x68\x65\x72\x00\x00\x00\x00\x00\x00",
	14));
	NONFAILING((uint32_t)0x20219fb8 = 0);
	NONFAILING((uint32_t)0x20219fbc = 0);
	NONFAILING(memcpy((void*)0x20219fc0,
	"\x73\x61\x6c\x73\x61\x32\x30\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00",
	64));
	syscall(__NR_bind, r[0], 0x20219fa8, 0x58);
	NONFAILING(memcpy(
	(void*)0x20001f3a,
	"\xad\x56\xb6\xc5\x82\x0f\xae\xb9\x95\x29\x89\x92\xea\x54\xc7\xbe", 16));
	syscall(__NR_setsockopt, r[1], 0x117, 1, 0x20001f3a, 0x10);
	r[2] = syscall(__NR_accept, r[1], 0, 0);
	NONFAILING((uint64_t)0x20791000 = 0);
	NONFAILING((uint32_t)0x20791008 = 0);
	NONFAILING((uint64_t)0x20791010 = 0x20cf6000);
	NONFAILING((uint64_t)0x20791018 = 1);
	NONFAILING((uint64_t)0x20791020 = 0x20000000);
	NONFAILING((uint64_t)0x20791028 = 0);
	NONFAILING((uint32_t)0x20791030 = 0);
	NONFAILING((uint64_t)0x20cf6000 = 0x20087000);
	NONFAILING((uint64_t)0x20cf6008 = 0x80);
	NONFAILING(
	memcpy((void*)0x20087000,
	"\x51\xc8\xfb\x29\x29\x98\x9d\x20\xaf\xe7\x3d\xca\xc1\x12\x91\xb7"
	"\x20\xbd\x7b\x71\xdd\xeb\x91\x61\x96\x6d\x49\x86\xbc\x69\x33\x5f"
	"\xf6\x3b\x71\x1f\x36\x65\x3d\x33\xc3\xaf\x96\xb4\x27\x39\x38\x69"
	"\x50\x91\x95\xdb\xe3\xbb\xd7\x2d\x89\x61\x05\xf0\x20\x41\x6b\xbc"
	"\xa5\xf9\xc9\x6a\x03\x1e\xde\x84\xd7\x22\xa8\xca\x57\x49\x65\xa5"
	"\x35\x85\x02\x15\x33\x5d\x66\xef\xc5\xe1\x24\xd0\x25\xa7\x62\xf7"
	"\x7b\x51\xe2\xad\x1a\xe8\x86\x5d\xa4\xed\x5d\xde\x15\xbe\x35\xbe"
	"\x78\xfc\xdb\x66\x7a\x12\xe2\x45\x2c\x8b\x20\x14\x61\xf9\x62\xad",
	128));
	syscall(__NR_sendmmsg, r[2], 0x20791000, 1, 0);
	NONFAILING((uint64_t)0x20b2f000 = 0x208e8000);
	NONFAILING((uint32_t)0x20b2f008 = 0x10);
	NONFAILING((uint64_t)0x20b2f010 = 0x204f3f73);
	NONFAILING((uint64_t)0x20b2f018 = 2);
	NONFAILING((uint64_t)0x20b2f020 = 0x20590000);
	NONFAILING((uint64_t)0x20b2f028 = 0);
	NONFAILING((uint32_t)0x20b2f030 = 0);
	NONFAILING((uint64_t)0x204f3f73 = 0x20284f81);
	NONFAILING((uint64_t)0x204f3f7b = 0x7f);
	NONFAILING((uint64_t)0x204f3f83 = 0x203bc000);
	NONFAILING((uint64_t)0x204f3f8b = 0xc6);
	syscall(__NR_recvmsg, r[2], 0x20b2f000, 0);
	}

	int main()
	{
	for (procid = 0; procid < 8; procid++) {
	if (fork() == 0) {
	install_segv_handler();
	for (;;) {
	loop();
	}
	}
	}
	sleep(1000000);
	return 0;
	}