| // WARNING in __mark_chain_precision (2) |
| // https://syzkaller.appspot.com/bug?id=8ff917f209ceefff8b5c5c56df8d1f4c100ef2f3 |
| // status:open |
| // autogenerated by syzkaller (https://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| |
| #include <endian.h> |
| #include <stdint.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <sys/syscall.h> |
| #include <sys/types.h> |
| #include <unistd.h> |
| |
| #ifndef __NR_bpf |
| #define __NR_bpf 321 |
| #endif |
| |
| int main(void) |
| { |
| syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); |
| |
| *(uint32_t*)0x20000200 = 0x10; |
| *(uint32_t*)0x20000204 = 0xe; |
| *(uint64_t*)0x20000208 = 0x20000a40; |
| memcpy( |
| (void*)0x20000a40, |
| "\xb7\x02\x00\x00\x00\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x16\x03" |
| "\x00\x00\xfd\xfd\xff\xf6\x7a\x03\xf0\xff\xf8\xff\xff\xff\x79\xa4\xf0\xff" |
| "\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05\x00\x00\x00" |
| "\x00\x00\x65\x04\x00\x00\x01\x00\x00\x40\x27\x04\x00\x00\x01\x00\x00\x00" |
| "\xb7\x05\x00\x00\x05\x00\x00\x00\x6a\x0a\x00\xfe\x00\x00\x00\x00\x85\x00" |
| "\x00\x00\x5a\x00\x00\x00\xb7\x00\x00\x00\x20\x00\x00\x00\x95\x00\x00\x00" |
| "\x00\x00\x00\x00\x9c\xc6\xb3\xfc\xd6\x2c\x7d\x1c\x62\x38\x97\x5d\x43\xa4" |
| "\x50\x5f\x80\xfc\x88\x9f\x3c\x53\x0c\xf0\x8e\x46\x7b\x59\x2f\x86\x8e\xe3" |
| "\xb0\xa4\x34\xdf\x0a\x0e\x8c\x1b\xf1\x76\xdb\x2a\x6b\x2f\xeb\x4b\x6f\xd3" |
| "\xd5\x70\x7b\xa3\xb1\x2c\xca\x02\xa5\xd0\x84\x13\x14\xdc\x79\xec\x08\x3f" |
| "\x28\xf9\xd4\xe9\x84\xc4\x6e\xa7\xe2\xb3\x47\xa3\x6f\x56\x62\x40\x3e\x1b" |
| "\x2b\xe4\xcc\x7c\x26\x83\x90\x8a\x24\x00\x1a\x98\x72\x97\x1c\x7c\x56\xf0" |
| "\x97\x9b\xd1\x0b\x97\x16\x3c\x1d\x6d\x78\x58\x9c\xd4\xfb\x21\xa6\xd0\x6b" |
| "\x50\xe5\x7b\x6e\xde\x4f\xab\x0e\x19\x6b\xf0\x2f\x46\xc7\x95\x3a\xb1\xab" |
| "\xda\x45\xcb\xe8\xf9\xde\x9c\xa3\xc0\x6c\x36\xef\xe1\x02\x0c\xcd\xee\x9c" |
| "\x81\x42\xe9\x1e\x0c\xb9\xbf\x4e\x41\x8d\x07\xfa\x22\xf0\x61\x0a\x70\xf2" |
| "\xbd\xf4\x00\x00\x00\x00\x00\x00\xb0\xc2\x94\x0d\xd8\xe2\x63\xf6\xa7\x28" |
| "\x32\x1e\x92\x79\x17\xb9\xbb\x64\xaa\xf9\x3f\xfa\x31\x4d\x03\x56\x53\x34" |
| "\xfb\x0e\x73\xf3\xb0\x5c\x98\xf0\x29\xdc\x6b\x0b\x99\x9b\x09\xed\xd9\xed" |
| "\x3e\x31\x63\xa1\x9f\x32\xb9\x89\x66\x15\x4a\xb3\xda\xfb\x23\x75\xec\xb3" |
| "\x3e\x12\xb3\x45\xe7\x70\x06\x08\x2e\xef\xdd\x77\x06\x12\xcb\xe8\x1e\x51" |
| "\xaf\x3b\x23\xbf\x5a\xdb\x01\x8e\x3f\x25\xe5\xcd\xdd\x57\xe2\x7d\x26\xe5" |
| "\x50\x93\x05\x7f\xb6\xf3\x99\x9e\x4f\x50\x45\xa6\x3f\x4d\x15\x53\x6b\x2b" |
| "\x44\xa2\xba\xce\x49\x62\x89\x36\x6b\xad\xfa\x85\x58\x55\x2f\x4a\x11\x04" |
| "\x71\x6f\x08\x00\x00\x00\x0c\x02\xdd\x18\xdf\xc8\x9d\xfa\x36\xc2\x05\xe6" |
| "\x3f\xaa\x26\x41\xbc\x46\x10\x3e\x1b\x54\x79\x93\xd7\x35\x1c\x9f\x83\x7c" |
| "\xb9\x4c\xba\x89\xd9\xb3\x4f\x68\x4a\xaa\xe1\x4e\x30\x29\xae\xe5\xeb\xbc" |
| "\x13\xe1\x0a\x29\xe7\xc0\x27\x11\xe7\x16\x5a\x4f\x65\x48\xe8\xe6\x6c\xf6" |
| "\xbf\xae\x4a\xc0\xd0\x38\xb8\x8f\x75\xcc\x7c\x01\x84\x05\x0f\x90\x1f\x36" |
| "\xc3\x7a\xfb\x31\x37\x47\x0e\x89\xa8\x4b\x13\xd3\x58\x10\x26\xe8\x74\x3d" |
| "\x75\x8d\xdf\x29\x11\x76\x88\x4d\x15\x8d\x63\xcc\xa1\x77\x63\x5f\xe7\xea" |
| "\x00\xf8\x0e\x10\x48\x12\x91\x96\x83\x23\xfc\x9a\x81\xe2\x3b\xf2\x62\x07" |
| "\x79\x21\xb9\xa9\x47\xd0\x4c\xee\x58\x43\x04\x0c\x08\x06\x57\xea\x04\xdc" |
| "\xad\xcc\x94\x14\x50\x6e\x9b\x10\x98\x2a\xfd\x41\xf5\xa6\x65\x77\xef\x7e" |
| "\xc2\x8f\x84\x54\x96\x19\xab\x75\xbf\x6c\x29\x0e\x88\x94\xe1\x52\xdd\x8f" |
| "\x22\xf0\xf2\x4d\x17\xaf\x36\x02\x41\x58\x63\x5d\x9d\xba\xc5\x82\xda\xa1" |
| "\xad\xf9\xcd\x80\x32\xc2\xa4\x44\x62\x68\xc5\x5c\xd8\x1e\x4d\xaf\x00\xb2" |
| "\x4a\xd5\x89\xbc\xd0\x34\x6e\x0c\xe6\xc3\xa9\x4e\x21\x55\x53\xd4\xfb\x1d" |
| "\xfe\x8b\x29\x21\x6c\x84\x2d\xd4\x10\xf3\xe4\xf1\xf3\x16\xd7\x40\x33\xaa" |
| "\xa0\x24\x2e\x10\xab\x97\x51\xd7\xb1\xbf\x3c\x06\x75\x9f\xea\xef\xbb\xbf" |
| "\xc7\x88\x35\x5c\xa6\xd6\x0d\x6f\x46\x90\x93\xd9\x21\x40\xfd\xa4\xb2\x94" |
| "\xe5\xde\x87\x9d\x86\x45\x7c\x8d\x04\x85\x3b\x84\x3a\xfa\x3a\x43\x47\x71" |
| "\x86\x3e\xb3\x29\x55\x94\xc1\x48\xd3\xd3\xf6\x27\x3c\xac\x49\x1d\x4a\xba" |
| "\x11\x98\xe7\x48\x36\x60\xef\x59\x4e\xe2\x5f\xc3\xf3\x1b\xc8\xa4\x07\x53" |
| "\xb7\x91\xaf\x13\x7d\x12\x15\x94\x83\x6c\x75\x08\x62\x7b\xdf\xc0\x56\x12" |
| "\x6d\x49\x90\x64\x86\x3a\xea\x2d\x4c\xf3\x5c\x7f\x4e\x72\x22\xd6\x3a\xd8" |
| "\x31\x84\x59\xa5\xb8\xb0\x88\x2a\xdb\xaa\x46\xd2\xf8\x4e\x64\x11\x11\x25" |
| "\x99\x29\x31\xfb\x00\x0e\x27\x80", |
| 854); |
| *(uint64_t*)0x20000210 = 0x20000340; |
| memcpy((void*)0x20000340, "GPL\000", 4); |
| *(uint32_t*)0x20000218 = 0; |
| *(uint32_t*)0x2000021c = 0; |
| *(uint64_t*)0x20000220 = 0; |
| *(uint32_t*)0x20000228 = 0; |
| *(uint32_t*)0x2000022c = 8; |
| *(uint8_t*)0x20000230 = 0; |
| *(uint8_t*)0x20000231 = 0; |
| *(uint8_t*)0x20000232 = 0; |
| *(uint8_t*)0x20000233 = 0; |
| *(uint8_t*)0x20000234 = 0; |
| *(uint8_t*)0x20000235 = 0; |
| *(uint8_t*)0x20000236 = 0; |
| *(uint8_t*)0x20000237 = 0; |
| *(uint8_t*)0x20000238 = 0; |
| *(uint8_t*)0x20000239 = 0; |
| *(uint8_t*)0x2000023a = 0; |
| *(uint8_t*)0x2000023b = 0; |
| *(uint8_t*)0x2000023c = 0; |
| *(uint8_t*)0x2000023d = 0; |
| *(uint8_t*)0x2000023e = 0; |
| *(uint8_t*)0x2000023f = 0; |
| *(uint32_t*)0x20000240 = 0; |
| *(uint32_t*)0x20000244 = 0; |
| *(uint32_t*)0x20000248 = -1; |
| *(uint32_t*)0x2000024c = 8; |
| *(uint64_t*)0x20000250 = 0x20000000; |
| *(uint32_t*)0x20000000 = 0; |
| *(uint32_t*)0x20000004 = 0; |
| *(uint32_t*)0x20000258 = 0; |
| *(uint32_t*)0x2000025c = 0x10; |
| *(uint64_t*)0x20000260 = 0x20000000; |
| *(uint32_t*)0x20000000 = 0; |
| *(uint32_t*)0x20000004 = 0; |
| *(uint32_t*)0x20000008 = 0; |
| *(uint32_t*)0x2000000c = 0; |
| *(uint32_t*)0x20000268 = 0; |
| syscall(__NR_bpf, 5, 0x20000200, 0x48); |
| return 0; |
| } |
