| // WARNING: suspicious RCU usage in rds_loop_conn_alloc |
| // https://syzkaller.appspot.com/bug?id=e826b4d012da9963d581b16d665db3811588ffbe |
| // status:fixed |
| // autogenerated by syzkaller (http://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| #include <endian.h> |
| #include <stdint.h> |
| #include <string.h> |
| #include <sys/syscall.h> |
| #include <unistd.h> |
| |
| long r[1]; |
| void loop() |
| { |
| memset(r, -1, sizeof(r)); |
| syscall(__NR_mmap, 0x20001000, 0x1e000, 3, 0x32, -1, 0); |
| r[0] = syscall(__NR_socket, 0x15, 5, 0); |
| *(uint16_t*)0x20002ff0 = 2; |
| *(uint16_t*)0x20002ff2 = 0; |
| *(uint32_t*)0x20002ff4 = htobe32(0x7f000001); |
| *(uint8_t*)0x20002ff8 = 0; |
| *(uint8_t*)0x20002ff9 = 0; |
| *(uint8_t*)0x20002ffa = 0; |
| *(uint8_t*)0x20002ffb = 0; |
| *(uint8_t*)0x20002ffc = 0; |
| *(uint8_t*)0x20002ffd = 0; |
| *(uint8_t*)0x20002ffe = 0; |
| *(uint8_t*)0x20002fff = 0; |
| syscall(__NR_bind, r[0], 0x20002ff0, 0x10); |
| *(uint64_t*)0x2000dfc8 = 0x20014000; |
| *(uint32_t*)0x2000dfd0 = 0x10; |
| *(uint64_t*)0x2000dfd8 = 0x2001c000; |
| *(uint64_t*)0x2000dfe0 = 0; |
| *(uint64_t*)0x2000dfe8 = 0x2000f000; |
| *(uint64_t*)0x2000dff0 = 0x48; |
| *(uint32_t*)0x2000dff8 = 0; |
| *(uint16_t*)0x20014000 = 2; |
| *(uint16_t*)0x20014002 = 0; |
| *(uint32_t*)0x20014004 = htobe32(0xe0000001); |
| *(uint8_t*)0x20014008 = 0; |
| *(uint8_t*)0x20014009 = 0; |
| *(uint8_t*)0x2001400a = 0; |
| *(uint8_t*)0x2001400b = 0; |
| *(uint8_t*)0x2001400c = 0; |
| *(uint8_t*)0x2001400d = 0; |
| *(uint8_t*)0x2001400e = 0; |
| *(uint8_t*)0x2001400f = 0; |
| *(uint64_t*)0x2000f000 = 0x48; |
| *(uint32_t*)0x2000f008 = 0x114; |
| *(uint32_t*)0x2000f00c = 1; |
| *(uint32_t*)0x2000f010 = 0; |
| *(uint32_t*)0x2000f014 = 0; |
| *(uint64_t*)0x2000f018 = 0x2001bf46; |
| *(uint64_t*)0x2000f020 = 0xba; |
| *(uint64_t*)0x2000f028 = 0x2001c000; |
| *(uint64_t*)0x2000f030 = 1; |
| *(uint64_t*)0x2000f038 = 0; |
| *(uint64_t*)0x2000f040 = 0; |
| *(uint64_t*)0x2001c000 = 0x20013f97; |
| *(uint64_t*)0x2001c008 = 0x7a; |
| syscall(__NR_sendmsg, r[0], 0x2000dfc8, 0); |
| } |
| |
| int main() |
| { |
| loop(); |
| return 0; |
| } |