// autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include static void test(); void loop() { while (1) { test(); } } long r[10]; void* thr(void* arg) { switch ((long)arg) { case 0: r[0] = syscall(__NR_mmap, 0x20000000ul, 0x263000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); break; case 1: r[1] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul); break; case 2: memcpy((void*)0x20002000, "\xf8\x63\xf3\xa3\x4f\xf0\x1b\x62\xd6\xb2\x8c\x2a\xcd\x6b" "\xba\x67\x6d\xd7\xd9\x71\x9c\xd8\x27\xc7\x8d\xb5\xa5\x82" "\x7b\x06\x19\x0d\x71\x6a\xe1\x02\xe5\x1d\xde\xb4\x69\x47" "\x1b\x86\x95\x44\x4c\xf8\xe3\x24\xe8\x9d\x25\xec\x85\x6b" "\x1c\xe1\x8b\xb9\xe0\x3d\x27\x93\xcc\x6a\x94\x2a\x8b\x6c" "\x5c\x6a\x4f\xf9\x5f\x15\xc2\xa9\x8d\x46\x77\xb8\x35\x55" "\xd9\x7e\x62\x0d\xd3\x16\xeb\xd7\x16\x7a\xab\xe7\xbc\x71" "\x96\x9b\xdc\xb1\xce\x85\x15\x8f\xde\x28\x91\xea\x99\x2e" "\xc6\x00\xff\x29\x7d\xeb\x40\x4e\xb7", 121); r[3] = syscall(__NR_setsockopt, r[1], 0x117ul, 0x1ul, 0x20002000ul, 0x79ul); break; case 3: *(uint16_t*)0x20002000 = (uint16_t)0x26; memcpy((void*)0x20002002, "\x68\x61\x73\x68\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 14); *(uint32_t*)0x20002010 = (uint32_t)0x0; *(uint32_t*)0x20002014 = (uint32_t)0x0; memcpy((void*)0x20002018, "\x68\x6d\x61\x63\x28\x68\x6d\x61\x63\x28\x73\x68\x61\x33" "\x2d\x35\x31\x32\x2d\x67\x65\x6e\x65\x72\x69\x63\x29\x29" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 64); r[9] = syscall(__NR_bind, r[1], 0x20002000ul, 0x58ul); break; } return 0; } void test() { long i; pthread_t th[8]; memset(r, -1, sizeof(r)); srand(getpid()); for (i = 0; i < 4; i++) { pthread_create(&th[i], 0, thr, (void*)i); usleep(rand() % 10000); } for (i = 0; i < 4; i++) { pthread_create(&th[4 + i], 0, thr, (void*)i); if (rand() % 2) usleep(rand() % 10000); } usleep(rand() % 100000); } int main() { loop(); return 0; }