// https://syzkaller.appspot.com/bug?id=690d8b9f1d6a8b18f60e3001342c31ae1da018bc
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <errno.h>
#include <pthread.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>

#include <linux/futex.h>

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void thread_start(void* (*fn)(void*), void* arg)
{
  pthread_t th;
  pthread_attr_t attr;
  pthread_attr_init(&attr);
  pthread_attr_setstacksize(&attr, 128 << 10);
  int i;
  for (i = 0; i < 100; i++) {
    if (pthread_create(&th, &attr, fn, arg) == 0) {
      pthread_attr_destroy(&attr);
      return;
    }
    if (errno == EAGAIN) {
      usleep(50);
      continue;
    }
    break;
  }
  exit(1);
}

typedef struct {
  int state;
} event_t;

static void event_init(event_t* ev)
{
  ev->state = 0;
}

static void event_reset(event_t* ev)
{
  ev->state = 0;
}

static void event_set(event_t* ev)
{
  if (ev->state)
    exit(1);
  __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
  syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
  while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

static int event_isset(event_t* ev)
{
  return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}

static int event_timedwait(event_t* ev, uint64_t timeout)
{
  uint64_t start = current_time_ms();
  uint64_t now = start;
  for (;;) {
    uint64_t remain = timeout - (now - start);
    struct timespec ts;
    ts.tv_sec = remain / 1000;
    ts.tv_nsec = (remain % 1000) * 1000 * 1000;
    syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
    if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
      return 1;
    now = current_time_ms();
    if (now - start > timeout)
      return 0;
  }
}

struct thread_t {
  int created, call;
  event_t ready, done;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
  struct thread_t* th = (struct thread_t*)arg;
  for (;;) {
    event_wait(&th->ready);
    event_reset(&th->ready);
    execute_call(th->call);
    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
    event_set(&th->done);
  }
  return 0;
}

static void loop(void)
{
  int i, call, thread;
  for (call = 0; call < 3; call++) {
    for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
         thread++) {
      struct thread_t* th = &threads[thread];
      if (!th->created) {
        th->created = 1;
        event_init(&th->ready);
        event_init(&th->done);
        event_set(&th->done);
        thread_start(thr, th);
      }
      if (!event_isset(&th->done))
        continue;
      event_reset(&th->done);
      th->call = call;
      __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
      event_set(&th->ready);
      event_timedwait(&th->done, 45);
      break;
    }
  }
  for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
    sleep_ms(1);
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_call(int call)
{
  intptr_t res;
  switch (call) {
  case 0:
    *(uint64_t*)0x20000280 = 0;
    *(uint32_t*)0x20000288 = 0;
    *(uint64_t*)0x20000290 = 0x20000240;
    *(uint64_t*)0x20000240 = 0x200002c0;
    memcpy(
        (void*)0x200002c0,
        "\x70\x00\x00\x00\x00\x01\x19\x05\x03\x00\x00\x00\x00\x00\xf2\x79\xb8"
        "\xee\x00\x00\x24\x00\x01\x00\x14\x00\x01\x00\x08\x00\x01\x00\xff\xff"
        "\xff\xff\x08\x00\x02\x00\xac\x1e\x00\x01\x0c\x00\x02\x00\x05\x00\x01"
        "\x00\x00\x00\x00\x00\x24\x00\x02\x00\x0c\x00\x02\x00\x05\x00\x01\x00"
        "\x00\x00\x00\x00\x14\x00\x01\x00\x08\x00\x01\x00\xe0\x00\x01\x02\x08"
        "\x00\x02\x00\xff\x00\x00\x00\x08\x00\x07\x00\x00\x00\x00\x00\x0c\x00"
        "\x0d\x00\x08\x00\x01\x00\x7f\x00\x00\x01\x9e\x58\xe0\xc4\xe4\x89\xc3"
        "\xc2\x1a\xf1\x09\x59\xa3\xd6\xa4\xc3\x48\xe7\xed\x14\x1e\xb9\x0b\x40"
        "\xb5\xba\x80\xc6\xa9\x70\x14\x8d\xfb\x92\xca\x5f\xe7\x9e\x7f\xe5\x80"
        "\x22\x50\xb0\x8a\xb3\x0f\x73\x93\x90\xb0\x8b\x7b\xbd\xc9\xf4\x41\x12"
        "\x04\x62\x95\xfc\xa6\x2a\xbc\x72\x31\x86\x3f\x4e\x10\xbf\x13\x90\xf0"
        "\x37\xe6\xc5\xb9\x1c\x16\x45\xa4\xf9\xd3\x33\xd9\x07\x3a\x25\xdb\xd0"
        "\xfb\x73\x22\x3d\x5c\x1d\x29\x69\x40\x75\x07\x15\x7c\x49\x65\x84\xe5"
        "\x75\xcd\x4f\x5d\x92\x72\x98\x5b\x23\xe8\x7d\x0a\x16\x26\x8f\x84\x6a"
        "\x83\x88\x4b\x10\x92\x23\x61\x83\xe5\xcf\xec\xdf\x88\x6a\x32\xdd\xef"
        "\x2c\xea\xe9\xd1\x33\xd4\x8a\x73\x2d\x20\x24\x48\x71\x70\x23\x8a\x8e"
        "\xc9\x86\x82\xce\x75\x52\xac\xe4\x0d\x73\xc6\x77\xaf\x38\xcd\xcc\xca"
        "\x60\xb5\x8d\x63\xcd\xb2\x66\xeb\x73\xb1\x42\x93\x82\x6d\xb6\xc8\x8c"
        "\x26\x49\x8d\x0d\xb7\x73\x49\x45\xa8\xff\xa1\x47\x94\xb5\x8e\x95\xc8"
        "\x91\x56\xb9\x0c\x77\x84\xdd\xb6\x91\x9b\x39\x3d\x6a\x34\x42\xec\xa7"
        "\x63\x96\xc5\x30\x6e\xf8\x2a\xf2\xa1\x7c\x3d\x28\x6b\xfc\x6c\x1b\x0f"
        "\x84\x16\xdc\xeb\xc8\xa5\xe3\x1c\xe4\xa5\x46\xcc\xea\x0b\xc9\x99\x8c"
        "\xfd\x9e\x8e\xb4\x93\xca\xf9\x15\x4c\xf8\x91\xf9\x53\xf5\x0d\x36\xb0"
        "\x6d\x0d\xde\xdc\xbb\x09\x1b\x20\x27\xa7\xb8\x8c\x46\x49\x6b\x22\x25"
        "\x21\xaa\xce\x92\xbf\xf4\x7c\xba\x00\x54\x78\xc0\xd7\xcc\x27\xe6\xe4"
        "\x51\x9f\xaa\x80\xe3\x10\xa5\x4f\xc7\xe8\x19\xd3\x24\x77\xc5\xa2\x16"
        "\xc1\x2f\xce\x80\x76\x63\xc1\x80\xb6\xfe\x2d\xdc\xee\x4b\xd5\x3c\xef"
        "\xac\x6b\x12\x60\x37\x33\xd1\x97\x1b\x6e\x77\x09\x6e\xef\xdb\x95\x1a"
        "\xdc\x16\x9c\x99\x0b\x4a\x37\x5a\x64\x84\x23\x69\xc7\x04\xc2\x3f\x4f"
        "\x0e\xa7\x86\xd8\xdc\xaf\x11\xbc\xf7\xcb\x46\xd5\x89\xb9\x57\x12\x1a"
        "\xb1\x0e\xd3\x45\x64\xb7\xd5\xd5\xc0\x97\xfe\xad\x7a\x44\xd3\x3f\xf5"
        "\x70\xab\x5f\x2e\x8c\xa0\xd4\x53\xa9\x41\xf3\x3f\x06\xc1\xab\x1f\xa9"
        "\x0d\xd7\xd7\xf6\xa6\xfd\xff\x13\xbf\xd5\x09\xc1\x15\x83\x56\xb3\x94"
        "\x41\x1f\x48\x7e\xc1\x71\x84\x83\x5e\x82\xa8\xcb\x44\xa8\xf1\x5b\x2a"
        "\x20\xcc\x13\xb5\x2e\x75\x6f\x48\x73\xc1\xc2\xc3\xae\x3e\xeb\x08\x23"
        "\xc5\x86\x18\x4f\x8d\xa5\x1b\x5d\x4c\x23\x0f\xf4\xff\x52\xe6\xda\xad"
        "\xcf\xc8\xc4\xad\xbb\x1f\x45\x76\x10\xb3\x1d\x54\x4b\xba\x29\x07\x5d"
        "\xea\xb4\x03\xbe\x7c",
        634);
    *(uint64_t*)0x20000248 = 0x70;
    *(uint64_t*)0x20000298 = 1;
    *(uint64_t*)0x200002a0 = 0;
    *(uint64_t*)0x200002a8 = 0;
    *(uint32_t*)0x200002b0 = 0;
    syscall(__NR_sendmsg, -1, 0x20000280ul, 0ul);
    break;
  case 1:
    res = syscall(__NR_socket, 0x10ul, 3ul, 0xc);
    if (res != -1)
      r[0] = res;
    break;
  case 2:
    *(uint64_t*)0x20000640 = 0;
    *(uint32_t*)0x20000648 = 0;
    *(uint64_t*)0x20000650 = 0x20000200;
    *(uint64_t*)0x20000200 = 0;
    *(uint64_t*)0x20000208 = 0;
    *(uint64_t*)0x20000658 = 8;
    *(uint64_t*)0x20000660 = 0;
    *(uint64_t*)0x20000668 = 0;
    *(uint32_t*)0x20000670 = 0;
    syscall(__NR_sendmsg, r[0], 0x20000640ul, 0ul);
    break;
  }
}
int main(void)
{
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0ul);
  loop();
  return 0;
}