// https://syzkaller.appspot.com/bug?id=4dd134118111ccc7f7ec35a0977b0d5a6e2dec5d
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <linux/loop.h>
#include <stdio.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}
#include <errno.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

static void fail(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

static __thread int skip_segv;
static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* uctx)
{
  uintptr_t addr = (uintptr_t)info->si_addr;
  const uintptr_t prog_start = 1 << 20;
  const uintptr_t prog_end = 100 << 20;
  if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
      (addr < prog_start || addr > prog_end)) {
    _longjmp(segv_env, 1);
  }
  doexit(sig);
}

static void install_segv_handler()
{
  struct sigaction sa;

  memset(&sa, 0, sizeof(sa));
  sa.sa_handler = SIG_IGN;
  syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
  syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);

  memset(&sa, 0, sizeof(sa));
  sa.sa_sigaction = segv_handler;
  sa.sa_flags = SA_NODEFER | SA_SIGINFO;
  sigaction(SIGSEGV, &sa, NULL);
  sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...)                                                        \
  {                                                                            \
    __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
    if (_setjmp(segv_env) == 0) {                                              \
      __VA_ARGS__;                                                             \
    }                                                                          \
    __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
  }

static void use_temporary_dir()
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    fail("failed to mkdtemp");
  if (chmod(tmpdir, 0777))
    fail("failed to chmod");
  if (chdir(tmpdir))
    fail("failed to chdir");
}

extern unsigned long long procid;

struct fs_image_segment {
  void* data;
  uintptr_t size;
  uintptr_t offset;
};

#define IMAGE_MAX_SEGMENTS 4096
#define IMAGE_MAX_SIZE (129 << 20)

#define SYZ_memfd_create 319

static uintptr_t syz_mount_image(uintptr_t fs, uintptr_t dir, uintptr_t size,
                                 uintptr_t nsegs, uintptr_t segments,
                                 uintptr_t flags, uintptr_t opts)
{
  char loopname[64];
  int loopfd, err = 0, res = -1;
  uintptr_t i;
  struct fs_image_segment* segs = (struct fs_image_segment*)segments;

  if (nsegs > IMAGE_MAX_SEGMENTS)
    nsegs = IMAGE_MAX_SEGMENTS;
  for (i = 0; i < nsegs; i++) {
    if (segs[i].size > IMAGE_MAX_SIZE)
      segs[i].size = IMAGE_MAX_SIZE;
    segs[i].offset %= IMAGE_MAX_SIZE;
    if (segs[i].offset > IMAGE_MAX_SIZE - segs[i].size)
      segs[i].offset = IMAGE_MAX_SIZE - segs[i].size;
    if (size < segs[i].offset + segs[i].offset)
      size = segs[i].offset + segs[i].offset;
  }
  if (size > IMAGE_MAX_SIZE)
    size = IMAGE_MAX_SIZE;
  int memfd = syscall(SYZ_memfd_create, "syz_mount_image", 0);
  if (memfd == -1) {
    err = errno;
    goto error;
  }
  if (ftruncate(memfd, size)) {
    err = errno;
    goto error_close_memfd;
  }
  for (i = 0; i < nsegs; i++) {
    if (pwrite(memfd, segs[i].data, segs[i].size, segs[i].offset) < 0) {
    }
  }
  snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
  loopfd = open(loopname, O_RDWR);
  if (loopfd == -1) {
    err = errno;
    goto error_close_memfd;
  }
  if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
    if (errno != EBUSY) {
      err = errno;
      goto error_close_loop;
    }
    ioctl(loopfd, LOOP_CLR_FD, 0);
    usleep(1000);
    if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
      err = errno;
      goto error_close_loop;
    }
  }
  mkdir((char*)dir, 0777);
  NONFAILING(if (strcmp((char*)fs, "iso9660") == 0) flags |= MS_RDONLY);
  if (mount(loopname, (char*)dir, (char*)fs, flags, (char*)opts)) {
    err = errno;
    goto error_clear_loop;
  }
  res = 0;
error_clear_loop:
  ioctl(loopfd, LOOP_CLR_FD, 0);
error_close_loop:
  close(loopfd);
error_close_memfd:
  close(memfd);
error:
  errno = err;
  return res;
}

static void execute_one();
extern unsigned long long procid;

void loop()
{
  while (1) {
    execute_one();
  }
}

unsigned long long procid;
void execute_one()
{
  NONFAILING(memcpy((void*)0x20000040, "\x63\x51\x2d\x1c\x00", 5));
  NONFAILING(memcpy((void*)0x20000080, "/", 2));
  NONFAILING(memcpy(
      (void*)0x20000180,
      "\x64\x65\x62\x75\x67\x5f\x77\x61\x6e\x74\x5f\x65\x78\x74\x72\x61\x5f\x69"
      "\x73\x69\x7a\x65\x3d\x37\x30\x34\x2c\x73\x79\x73\x76\x72\x69\x65\x72\x2c"
      "\x62\x73\x64\x64\x66\x2c\x6e\x6f\x6c\x61\x7a\x79\x74\x69\x6d\x65\x2c\x6e"
      "\x6f\x71\x75\x6f\x74\x61\x2c\x75\x73\x72\x71\x75\x6f\x74\x61\x2c\x00\xa5"
      "\x65\xeb\x49\xf1\xa7\x86\x66\x01\x5a\x93\x99\x05\xa5\x24\xec\x4d\x8f\xf1"
      "\xbb\x97\xb4\x64\x28\xd6\xaf\x59\x91\x55\x15\x60\xf0\xc7\x5d\xdd\x6a\x68"
      "\x40\x5d\xa3\xfd\x7d\x5d\x63\x07\xc4\x11\x64\xec\x71\x89\x7c\xcd\xff\xd2"
      "\xb4\xee\x47\x5f\x87\x57\xb2\xe8\xc7\xce\xe1\xfa\x78\xf9\x80\xd0\xb8\x39"
      "\x09\x9c\x76\x5a\xa1\x58\x2f\x33\xad\xbe\x72\x99\xea\x14\xd9\xaa\x2a\xbe"
      "\x1d\xd7\x6a\x20\x7b\x2a\x0d\xab\x2c\xc1\xbb\x31\xa2\xc6\xf1\xfa\xeb\xc2"
      "\xc1\xb5\xf7\xa4\x84\x16\xb3\xd7\x70\xba\x90\xa5\x7a\x3c\x7f\xdd\x5b\xeb"
      "\xc2\xfa\xaf\x02\x73\xe7\xd3\x51\xe7\x35\xce\xf6\x0c\x59\x4c\xe4\xe0\x29"
      "\xf6\x27\x62\x2a\x2d\xcd\x5e\xe5\x9f\xe0\x71\x32\xee\xf3\xd8\xc3\x93\x8a"
      "\x99\x59\x24\xf1\x84\x6b\xd6\xb3\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00",
      252));
  syz_mount_image(0x20000040, 0x20000080, 0, 0, 0x20000000, 0x28020,
                  0x20000180);
  NONFAILING(memcpy((void*)0x20000000, "ext4", 5));
  NONFAILING(memcpy((void*)0x200000c0, "./file0", 8));
  NONFAILING(*(uint64_t*)0x20000100 = 0x20000280);
  NONFAILING(*(uint64_t*)0x20000108 = 0);
  NONFAILING(*(uint64_t*)0x20000110 = 0x100000000);
  NONFAILING(*(uint64_t*)0x20000118 = 0x20001280);
  NONFAILING(*(uint64_t*)0x20000120 = 0);
  NONFAILING(*(uint64_t*)0x20000128 = 4);
  NONFAILING(*(uint64_t*)0x20000130 = 0x20001340);
  NONFAILING(*(uint64_t*)0x20000138 = 0);
  NONFAILING(*(uint64_t*)0x20000140 = 0x7fffffff);
  NONFAILING(memcpy((void*)0x20001440, "quota", 5));
  NONFAILING(*(uint8_t*)0x20001445 = 0x2c);
  NONFAILING(memcpy((void*)0x20001446, "acl", 3));
  NONFAILING(*(uint8_t*)0x20001449 = 0x2c);
  NONFAILING(memcpy((void*)0x2000144a, "noload", 6));
  NONFAILING(*(uint8_t*)0x20001450 = 0x2c);
  NONFAILING(memcpy((void*)0x20001451, "nojournal_checksum", 18));
  NONFAILING(*(uint8_t*)0x20001463 = 0x2c);
  NONFAILING(memcpy((void*)0x20001464, "nouid32", 7));
  NONFAILING(*(uint8_t*)0x2000146b = 0x2c);
  NONFAILING(memcpy((void*)0x2000146c, "journal_ioprio", 14));
  NONFAILING(*(uint8_t*)0x2000147a = 0x3d);
  NONFAILING(*(uint8_t*)0x2000147b = 0x78);
  NONFAILING(*(uint8_t*)0x2000147c = 0x7a);
  NONFAILING(*(uint8_t*)0x2000147d = 0x39);
  NONFAILING(*(uint8_t*)0x2000147e = 0x7f);
  NONFAILING(*(uint8_t*)0x2000147f = 0x37);
  NONFAILING(*(uint8_t*)0x20001480 = 0x2c);
  NONFAILING(memcpy((void*)0x20001481, "errors=remount-ro", 17));
  NONFAILING(*(uint8_t*)0x20001492 = 0x2c);
  NONFAILING(*(uint8_t*)0x20001493 = 0);
  syz_mount_image(0x20000000, 0x200000c0, 0x200, 3, 0x20000100, 0x1000000,
                  0x20001440);
  NONFAILING(memcpy((void*)0x20000180, "./file0", 8));
  NONFAILING(memcpy((void*)0x200001c0, "trusted.syz", 12));
  NONFAILING(memcpy(
      (void*)0x20000200,
      "\x47\x70\x4c\x62\x64\x65\x76\x7b\x6e\x6f\x64\x65\x76\x65\x6d\x31\x40\x00"
      "\xe2\xde\x85\x94\x4b\x84\xbc\x4e\xa5\x70\x39\xe0\x23\xaf\x88\x5e\x07\xd6"
      "\xba\x92\x9c\x00\xd8\x15\x90\xd9\x3a\xce\xd6\x8d\x05\xdf\xbd\xf5\x0a\xcf"
      "\xb8\x69\x1f\x2f\xcf\x1a\x1d\x55\x8a\xe7\xd7\x59\xf9\xd6\xa3\xc5\x9a\x2c"
      "\xd8\x7d\xcd\xca\x7b\x95\x09\x8a\xa0\x86\xbe\xdd\x99\x6b\x1e\x57\xbf\xf5"
      "\x8d\x7a\x68\x07\x2b\xf8\x2a\x4b\xbc\xad\x38\x12\x29\x33\xb3\x5d\x86\x79"
      "\x67\x52\x4a\xe6\x1e\x8f\x06\x89\xc9\x66\xbd\x9e\x14\xba\x6f\xc8\x5e\x65"
      "\xa5\xba\x0b\x31\xfc\x07\xa1\xa7\xbf\xd2\x40\x15\x6d\xdf\x9f\x69\xa0\xae"
      "\xb0\x08\x4a\xc6\x46\x52\x90\xd6\x52\xf9\xd0\x61\x69\x70\x65\xae\x68\xf3"
      "\x95\xf9\x1a\x1d\x6d\x34\xa2\xd6\xb4\x09\xe1\x31\xfd\x09\xdc\xb7\xb4\xe9"
      "\xb5\x63\x33\xe8\x9c\xf6\x3e\x00\x6c\x43\x09\xb9\xa1\x77\x43\xd0\xd3\x53"
      "\x3e\x32\x2b\xd7\xa5\x2e\xcb\xe3\xb7\x5f\x4a\xe8\x75\xe6\x74\x89\x40\x23"
      "\xa9\x74\xf0\xca\x21\xa0\x31\x93\xa1\xd8\x19\x82\x29\xc0\xee\x4c\x8a\xb2"
      "\xe2\x27\x24\xdf\x7c\x92\xe8\x2b\x2a\x0a\x2c\xb1\x90\xd5\x9f\xd0\x95\x02"
      "\x3e\xda\x20\x03\x5f\x99\x6d\x1d\xcd\x7f\x57\xe8\x46\x3a\xb6\x7c\x8b\xca"
      "\x67\x05\x92\xf6\x8c\x95\xb0\x1a\xf1\xe0\xec\xcd\xdd\x69\x1b\x7a\x81\xd1"
      "\x57\x4e\x56\xc2\xb1\x3d\x67\x54\x76\x4f\xcf\xc1\x9e\x1b\x66\x15\xef\xc3"
      "\xf0\xda\x8c\x70\x59\xe6\x6e\x29\x98\x33\xb5\x60\x52\xaa\x39\x46\x30\x7c"
      "\x14\xc9\x0a\x77\xcf\xc4\xda\xbf\x15\x69\xdf\x37\xc7\x83\xf1\xcd\xee\x5c"
      "\x0f\x2a\xf3\x7d\x3f\xc3\x72\xa5\xf5\xcd\x58\x47\x2b\x21\xd4\x41\x66\xc9"
      "\xe4\x37\xae\xc3\x11\x47\xb5\x70\x1b\xc2\xcf\x81",
      372));
  syscall(__NR_lsetxattr, 0x20000180, 0x200001c0, 0x20000200, 0x174, 0);
}

int main()
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  install_segv_handler();
  char* cwd = get_current_dir_name();
  for (;;) {
    if (chdir(cwd))
      fail("failed to chdir");
    use_temporary_dir();
    loop();
  }
}