// https://syzkaller.appspot.com/bug?id=baff5bfd0c148e6a6552e815fba942c1ac5e61b0
#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <errno.h>

int main(void)
{
	int fd = open("/dev/fuse", O_RDWR);
	if (fd < 0) {
		printf("[-] Failed to open /dev/fuse: %s\n", strerror(errno));
		exit(1);
	}
	printf("[+] /dev/fuse opened successfully.\n");

	if (mkdir("/tmp/fuse_mount", 0777) < 0 && errno != EEXIST) {
		printf("[-] Failed to mkdir /tmp/fuse_mount: %s\n", strerror(errno));
		exit(1);
	}
	printf("[+] /tmp/fuse_mount created successfully.\n");

	char mount_opts[256];
	sprintf(mount_opts, "fd=%d,rootmode=40000,user_id=0,group_id=0", fd);

	if (mount("fuse", "/tmp/fuse_mount", "fuse", 0, mount_opts) < 0) {
		printf("[-] Failed to mount fuse: %s\n", strerror(errno));
		exit(1);
	}
	printf("[+] fuse mounted successfully.\n");

	pid_t pid = fork();
	if (pid < 0) {
		printf("[-] Failed to fork: %s\n", strerror(errno));
		exit(1);
	}

	if (pid == 0) {
		// Child process
		printf("[+] Child process starting open()...\n");
		open("/tmp/fuse_mount/file", O_RDONLY);
		printf("[+] Child process open() finished (unexpected).\n");
		exit(0);
	}

	// Parent process
	sleep(1);

	int sys_power = open("/sys/power/state", O_WRONLY);
	if (sys_power < 0) {
		printf("[-] Failed to open /sys/power/state: %s\n", strerror(errno));
		// Cleanup
		kill(pid, SIGKILL);
		waitpid(pid, NULL, 0);
		umount2("/tmp/fuse_mount", MNT_FORCE);
		close(fd);
		exit(1);
	}
	printf("[+] /sys/power/state opened successfully.\n");

	printf("[+] Triggering hibernation...\n");
	if (write(sys_power, "disk", 4) < 0) {
		printf("[-] Failed to write to /sys/power/state: %s\n", strerror(errno));
	} else {
		printf("[+] write to /sys/power/state successful.\n");
	}
	close(sys_power);

	// Cleanup
	kill(pid, SIGKILL);
	waitpid(pid, NULL, 0);
	umount2("/tmp/fuse_mount", MNT_FORCE);
	close(fd);

	return 0;
}