syzkaller-repros/linux/bbfe73a02a942da23358fa0accf886a7a24937cd.c

// KMSAN: uninit-value in __flow_hash_from_keys
// https://syzkaller.appspot.com/bug?id=bbfe73a02a942da23358fa0accf886a7a24937cd
// status:invalid
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void loop()
{
  long res = 0;
  res = syscall(__NR_socket, 0x11, 0x800000000002, 0x300);
  if (res != -1)
    r[0] = res;
  *(uint16_t*)0x2095bffc = 0;
  *(uint8_t*)0x2095bffe = 0;
  *(uint8_t*)0x2095bfff = 0;
  syscall(__NR_setsockopt, r[0], 0x107, 0x12, 0x2095bffc, 4);
  res = syscall(__NR_socket, 2, 3, 6);
  if (res != -1)
    r[1] = res;
  memcpy((void*)0x20000000, "c", 1);
  *(uint16_t*)0x205b5ff0 = 2;
  *(uint16_t*)0x205b5ff2 = htobe16(0);
  *(uint32_t*)0x205b5ff4 = htobe32(0);
  *(uint8_t*)0x205b5ff8 = 0;
  *(uint8_t*)0x205b5ff9 = 0;
  *(uint8_t*)0x205b5ffa = 0;
  *(uint8_t*)0x205b5ffb = 0;
  *(uint8_t*)0x205b5ffc = 0;
  *(uint8_t*)0x205b5ffd = 0;
  *(uint8_t*)0x205b5ffe = 0;
  *(uint8_t*)0x205b5fff = 0;
  syscall(__NR_sendto, r[1], 0x20000000, 1, 0x8000, 0x205b5ff0, 0x10);
  memcpy((void*)0x200001c0, "\x25\x10\x00", 3);
  *(uint16_t*)0x20cf9000 = 2;
  *(uint16_t*)0x20cf9002 = htobe16(0);
  *(uint32_t*)0x20cf9004 = htobe32(0);
  *(uint8_t*)0x20cf9008 = 0;
  *(uint8_t*)0x20cf9009 = 0;
  *(uint8_t*)0x20cf900a = 0;
  *(uint8_t*)0x20cf900b = 0;
  *(uint8_t*)0x20cf900c = 0;
  *(uint8_t*)0x20cf900d = 0;
  *(uint8_t*)0x20cf900e = 0;
  *(uint8_t*)0x20cf900f = 0;
  syscall(__NR_sendto, r[1], 0x200001c0, 3, 0, 0x20cf9000, 0x10);
  *(uint32_t*)0x20000100 = 0x41424344;
  *(uint32_t*)0x20000104 = 0x41424344;
  *(uint32_t*)0x200002c0 = 0;
  *(uint32_t*)0x200002c4 = 0;
  *(uint32_t*)0x200002c8 = 0;
  *(uint32_t*)0x200002cc = 0;
  *(uint32_t*)0x200002d0 = 0;
  *(uint32_t*)0x200002d4 = 0;
}

int main()
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  loop();
  return 0;
}