| // general protection fault in __lock_acquire |
| // https://syzkaller.appspot.com/bug?id=6a2569b47dbe868e0ef1563cc53f1557781efcf2 |
| // status:open |
| // autogenerated by syzkaller (http://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| #include <endian.h> |
| #include <stdint.h> |
| #include <string.h> |
| #include <sys/syscall.h> |
| #include <unistd.h> |
| |
| long r[1]; |
| void loop() |
| { |
| memset(r, -1, sizeof(r)); |
| syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); |
| r[0] = syscall(__NR_socket, 0x10, 3, 0xc); |
| *(uint64_t*)0x20d73fc8 = 0x20de2ff4; |
| *(uint32_t*)0x20d73fd0 = 0xc; |
| *(uint64_t*)0x20d73fd8 = 0x20023000; |
| *(uint64_t*)0x20d73fe0 = 1; |
| *(uint64_t*)0x20d73fe8 = 0; |
| *(uint64_t*)0x20d73ff0 = 0; |
| *(uint32_t*)0x20d73ff8 = 0; |
| *(uint16_t*)0x20de2ff4 = 0x10; |
| *(uint16_t*)0x20de2ff6 = 0; |
| *(uint32_t*)0x20de2ff8 = 0; |
| *(uint32_t*)0x20de2ffc = 0; |
| *(uint64_t*)0x20023000 = 0x20008f68; |
| *(uint64_t*)0x20023008 = 0x30; |
| *(uint32_t*)0x20008f68 = 0x30; |
| *(uint8_t*)0x20008f6c = 1; |
| *(uint8_t*)0x20008f6d = 4; |
| *(uint16_t*)0x20008f6e = 1; |
| *(uint32_t*)0x20008f70 = 0; |
| *(uint32_t*)0x20008f74 = 0; |
| *(uint8_t*)0x20008f78 = 0; |
| *(uint8_t*)0x20008f79 = 0; |
| *(uint16_t*)0x20008f7a = htobe16(0); |
| *(uint16_t*)0x20008f7c = 0xc; |
| *(uint16_t*)0x20008f7e = 6; |
| *(uint16_t*)0x20008f80 = 8; |
| *(uint16_t*)0x20008f82 = 0; |
| *(uint16_t*)0x20008f88 = 0x10; |
| *(uint16_t*)0x20008f8a = 1; |
| *(uint16_t*)0x20008f8c = 0xc; |
| *(uint16_t*)0x20008f8e = 4; |
| memcpy((void*)0x20008f94, "/", 2); |
| syscall(__NR_sendmsg, r[0], 0x20d73fc8, 0); |
| } |
| |
| int main() |
| { |
| loop(); |
| return 0; |
| } |
