|
Packit Service |
63ea89 |
/* SPDX-License-Identifier: MIT */
|
|
Packit Service |
63ea89 |
// autogenerated by syzkaller (https://github.com/google/syzkaller)
|
|
Packit Service |
63ea89 |
|
|
Packit Service |
63ea89 |
#include <endian.h>
|
|
Packit Service |
63ea89 |
#include <stdint.h>
|
|
Packit Service |
63ea89 |
#include <stdio.h>
|
|
Packit Service |
63ea89 |
#include <stdlib.h>
|
|
Packit Service |
63ea89 |
#include <string.h>
|
|
Packit Service |
63ea89 |
#include <sys/syscall.h>
|
|
Packit Service |
63ea89 |
#include <sys/types.h>
|
|
Packit Service |
63ea89 |
#include <sys/mman.h>
|
|
Packit Service |
63ea89 |
#include <unistd.h>
|
|
Packit Service |
63ea89 |
|
|
Packit Service |
63ea89 |
#ifndef __NR_io_uring_register
|
|
Packit Service |
63ea89 |
#define __NR_io_uring_register 427
|
|
Packit Service |
63ea89 |
#endif
|
|
Packit Service |
63ea89 |
#ifndef __NR_io_uring_setup
|
|
Packit Service |
63ea89 |
#define __NR_io_uring_setup 425
|
|
Packit Service |
63ea89 |
#endif
|
|
Packit Service |
63ea89 |
|
|
Packit Service |
63ea89 |
uint64_t r[1] = {0xffffffffffffffff};
|
|
Packit Service |
63ea89 |
|
|
Packit Service |
63ea89 |
int main(int argc, char *argv[])
|
|
Packit Service |
63ea89 |
{
|
|
Packit Service |
63ea89 |
if (argc > 1)
|
|
Packit Service |
63ea89 |
return 0;
|
|
Packit Service |
63ea89 |
mmap((void *) 0x20000000, 0x1000000, 3, 0x32, -1, 0);
|
|
Packit Service |
63ea89 |
intptr_t res = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x20000080 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x20000084 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x20000088 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x2000008c = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x20000090 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x20000094 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x20000098 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x2000009c = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000a0 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000a4 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000a8 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000ac = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000b0 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000b4 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000b8 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000bc = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000c0 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000c4 = 0;
|
|
Packit Service |
63ea89 |
*(uint64_t*)0x200000c8 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000d0 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000d4 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000d8 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000dc = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000e0 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000e4 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000e8 = 0;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x200000ec = 0;
|
|
Packit Service |
63ea89 |
*(uint64_t*)0x200000f0 = 0;
|
|
Packit Service |
63ea89 |
res = syscall(__NR_io_uring_setup, 0xa4, 0x20000080);
|
|
Packit Service |
63ea89 |
if (res != -1)
|
|
Packit Service |
63ea89 |
r[0] = res;
|
|
Packit Service |
63ea89 |
*(uint32_t*)0x20000280 = -1;
|
|
Packit Service |
63ea89 |
syscall(__NR_io_uring_register, r[0], 2, 0x20000280, 1);
|
|
Packit Service |
63ea89 |
return 0;
|
|
Packit Service |
63ea89 |
}
|