// https://syzkaller.appspot.com/bug?id=d369eafab7836fe0dd2e027d2689da06cad8e1a3
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <errno.h>
#include <pthread.h>
#include <signal.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}

__attribute__((noreturn)) static void fail(const char* msg, ...)
{
  int e = errno;
  fflush(stdout);
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

__attribute__((noreturn)) static void exitf(const char* msg, ...)
{
  int e = errno;
  fflush(stdout);
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit(kRetryStatus);
}

#define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1)

#define BITMASK_LEN_OFF(type, bf_off, bf_len)                          \
  (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))

#define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len)              \
  if ((bf_off) == 0 && (bf_len) == 0) {                                \
    *(type*)(addr) = (type)(val);                                      \
  } else {                                                             \
    type new_val = *(type*)(addr);                                     \
    new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len));             \
    new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off);  \
    *(type*)(addr) = new_val;                                          \
  }

struct csum_inet {
  uint32_t acc;
};

static void csum_inet_init(struct csum_inet* csum)
{
  csum->acc = 0;
}

static void csum_inet_update(struct csum_inet* csum,
                             const uint8_t* data, size_t length)
{
  if (length == 0)
    return;

  size_t i;
  for (i = 0; i < length - 1; i += 2)
    csum->acc += *(uint16_t*)&data[i];

  if (length & 1)
    csum->acc += (uint16_t)data[length - 1];

  while (csum->acc > 0xffff)
    csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16);
}

static uint16_t csum_inet_digest(struct csum_inet* csum)
{
  return ~csum->acc;
}

static uint64_t current_time_ms()
{
  struct timespec ts;

  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    fail("clock_gettime failed");
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void test();

void loop()
{
  int iter;
  for (iter = 0;; iter++) {
    int pid = fork();
    if (pid < 0)
      fail("clone failed");
    if (pid == 0) {
      prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
      setpgrp();
      test();
      doexit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      int res = waitpid(-1, &status, __WALL | WNOHANG);
      if (res == pid)
        break;
      usleep(1000);
      if (current_time_ms() - start > 5 * 1000) {
        kill(-pid, SIGKILL);
        kill(pid, SIGKILL);
        while (waitpid(-1, &status, __WALL) != pid) {
        }
        break;
      }
    }
  }
}

long r[58];
void* thr(void* arg)
{
  switch ((long)arg) {
  case 0:
    r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul,
                   0xfffffffffffffffful, 0x0ul);
    break;
  case 1:
    *(uint8_t*)0x20974000 = (uint8_t)0xaa;
    *(uint8_t*)0x20974001 = (uint8_t)0xaa;
    *(uint8_t*)0x20974002 = (uint8_t)0xaa;
    *(uint8_t*)0x20974003 = (uint8_t)0xaa;
    *(uint8_t*)0x20974004 = (uint8_t)0xaa;
    *(uint8_t*)0x20974005 = (uint8_t)0x0;
    memcpy((void*)0x20974006, "\xd8\x66\x7a\x79\xea\xc5", 6);
    *(uint16_t*)0x2097400c = (uint16_t)0xdd86;
    STORE_BY_BITMASK(uint8_t, 0x2097400e, 0x7, 0, 4);
    STORE_BY_BITMASK(uint8_t, 0x2097400e, 0x4, 4, 4);
    STORE_BY_BITMASK(uint8_t, 0x2097400f, 0x0, 0, 2);
    STORE_BY_BITMASK(uint8_t, 0x2097400f, 0x0, 2, 6);
    *(uint16_t*)0x20974010 = (uint16_t)0x4400;
    *(uint16_t*)0x20974012 = (uint16_t)0x6400;
    *(uint16_t*)0x20974014 = (uint16_t)0x0;
    *(uint8_t*)0x20974016 = (uint8_t)0x1;
    *(uint8_t*)0x20974017 = (uint8_t)0x0;
    *(uint16_t*)0x20974018 = (uint16_t)0x0;
    *(uint32_t*)0x2097401a = (uint32_t)0x0;
    *(uint8_t*)0x2097401e = (uint8_t)0xac;
    *(uint8_t*)0x2097401f = (uint8_t)0x14;
    *(uint8_t*)0x20974020 = (uint8_t)0x0;
    *(uint8_t*)0x20974021 = (uint8_t)0xaa;
    *(uint8_t*)0x20974022 = (uint8_t)0xcf;
    *(uint8_t*)0x20974023 = (uint8_t)0x5;
    memcpy((void*)0x20974024, "\xcf\x5e\x74", 3);
    *(uint16_t*)0x2097402a = (uint16_t)0x234e;
    *(uint16_t*)0x2097402c = (uint16_t)0x214e;
    *(uint32_t*)0x2097402e = (uint32_t)0x42424242;
    *(uint32_t*)0x20974032 = (uint32_t)0x42424242;
    STORE_BY_BITMASK(uint8_t, 0x20974036, 0xff, 0, 1);
    STORE_BY_BITMASK(uint8_t, 0x20974036, 0x0, 1, 3);
    STORE_BY_BITMASK(uint8_t, 0x20974036, 0xa, 4, 4);
    *(uint8_t*)0x20974037 = (uint8_t)0x1;
    *(uint16_t*)0x20974038 = (uint16_t)0x2;
    *(uint16_t*)0x2097403a = (uint16_t)0x0;
    *(uint16_t*)0x2097403c = (uint16_t)0x200;
    *(uint8_t*)0x2097403e = (uint8_t)0x3;
    *(uint8_t*)0x2097403f = (uint8_t)0x3;
    *(uint8_t*)0x20974040 = (uint8_t)0x61c79906;
    *(uint8_t*)0x20974041 = (uint8_t)0x8;
    *(uint8_t*)0x20974042 = (uint8_t)0xa;
    *(uint32_t*)0x20974043 = (uint32_t)0x0;
    *(uint32_t*)0x20974047 = (uint32_t)0xdb000000;
    *(uint8_t*)0x2097404b = (uint8_t)0x4;
    *(uint8_t*)0x2097404c = (uint8_t)0x2;
    *(uint8_t*)0x2097404d = (uint8_t)0x2;
    *(uint8_t*)0x2097404e = (uint8_t)0x4;
    *(uint16_t*)0x2097404f = (uint16_t)0x9;
    struct csum_inet csum_50;
    csum_inet_init(&csum_50);
    csum_inet_update(&csum_50, (const uint8_t*)0x2097401a, 4);
    csum_inet_update(&csum_50, (const uint8_t*)0x2097401e, 4);
    uint16_t csum_50_chunk_2 = 0x600;
    csum_inet_update(&csum_50, (const uint8_t*)&csum_50_chunk_2, 2);
    uint16_t csum_50_chunk_3 = 0x2800;
    csum_inet_update(&csum_50, (const uint8_t*)&csum_50_chunk_3, 2);
    csum_inet_update(&csum_50, (const uint8_t*)0x2097402a, 40);
    *(uint16_t*)0x2097403a = csum_inet_digest(&csum_50);
    struct csum_inet csum_51;
    csum_inet_init(&csum_51);
    csum_inet_update(&csum_51, (const uint8_t*)0x2097400e, 28);
    *(uint16_t*)0x20974018 = csum_inet_digest(&csum_51);
    break;
  case 2:
    r[53] = syscall(__NR_ioctl, 0xfffffffffffffffful, 0xae01ul, 0x0ul);
    break;
  case 3:
    r[54] = syscall(__NR_ioctl, r[53], 0xae41ul, 0x0ul);
    break;
  case 4:
    memcpy((void*)0x20ed7000, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d\x00",
           9);
    r[56] = syscall(__NR_openat, 0xffffffffffffff9cul, 0x20ed7000ul,
                    0x0ul, 0x0ul);
    break;
  case 5:
    r[57] = syscall(__NR_ioctl, r[56], 0xae01ul, 0x0ul);
    break;
  }
  return 0;
}

void test()
{
  long i;
  pthread_t th[12];

  memset(r, -1, sizeof(r));
  srand(getpid());
  for (i = 0; i < 6; i++) {
    pthread_create(&th[i], 0, thr, (void*)i);
    usleep(rand() % 10000);
  }
  for (i = 0; i < 6; i++) {
    pthread_create(&th[6 + i], 0, thr, (void*)i);
    if (rand() % 2)
      usleep(rand() % 10000);
  }
  usleep(rand() % 100000);
}

int main()
{
  int i;
  for (i = 0; i < 8; i++) {
    if (fork() == 0) {
      loop();
      return 0;
    }
  }
  sleep(1000000);
  return 0;
}