// https://syzkaller.appspot.com/bug?id=3c1f47967b7cbd399d3ba3e65f297a29aa1c5f92
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <pthread.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf));
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

static void test();

void loop()
{
  while (1) {
    test();
  }
}

struct thread_t {
  int created, running, call;
  pthread_t th;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
  struct thread_t* th = (struct thread_t*)arg;
  for (;;) {
    while (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE))
      syscall(SYS_futex, &th->running, FUTEX_WAIT, 0, 0);
    execute_call(th->call);
    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
    __atomic_store_n(&th->running, 0, __ATOMIC_RELEASE);
    syscall(SYS_futex, &th->running, FUTEX_WAKE);
  }
  return 0;
}

static void execute(int num_calls)
{
  int call, thread;
  running = 0;
  for (call = 0; call < num_calls; call++) {
    for (thread = 0; thread < sizeof(threads) / sizeof(threads[0]); thread++) {
      struct thread_t* th = &threads[thread];
      if (!th->created) {
        th->created = 1;
        pthread_attr_t attr;
        pthread_attr_init(&attr);
        pthread_attr_setstacksize(&attr, 128 << 10);
        pthread_create(&th->th, &attr, thr, th);
      }
      if (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) {
        th->call = call;
        __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
        __atomic_store_n(&th->running, 1, __ATOMIC_RELEASE);
        syscall(SYS_futex, &th->running, FUTEX_WAKE);
        struct timespec ts;
        ts.tv_sec = 0;
        ts.tv_nsec = 20 * 1000 * 1000;
        syscall(SYS_futex, &th->running, FUTEX_WAIT, 1, &ts);
        if (running)
          usleep((call == num_calls - 1) ? 10000 : 1000);
        break;
      }
    }
  }
}

#ifndef __NR_mmap
#define __NR_mmap 192
#endif
#ifndef __NR_write
#define __NR_write 4
#endif
#ifndef __NR_read
#define __NR_read 3
#endif
#undef __NR_mmap
#define __NR_mmap __NR_mmap2

long r[1];
uint64_t procid;
void execute_call(int call)
{
  switch (call) {
  case 0:
    syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
    break;
  case 1:
    memcpy((void*)0x2002b000, "/dev/sg#", 9);
    r[0] = syz_open_dev(0x2002b000, 0, 0x142);
    break;
  case 2:
    memcpy((void*)0x20d74f6a,
           "\xb2\x1e\xb0\xc8\x07\xd7\x34\x7c\x0c\x2f\x20\x04\xab\x2e\x18\x5a"
           "\x59\x0c\x76\xd8\x53\x51\x20\xde\x49\xba\xaa\x0b\xa2\xc0\xb1\x41"
           "\x9b\x7d\x9a\xd5\x8d\x3c\x28\x29\x80\xc7\xbc\xf9\x8b\xcd\xe9\x96"
           "\x32\x82\x37\x46\xf1\x18\x8f\x75\xae\xb5\xee\x55\x5e\x09\x30\x5b"
           "\x75\x4a\xd1\x76\x46\xc2\xd8\x73\x9d\xe9\x1d\x12\x20\x4e\xd7\x33"
           "\x83\x2b\xd0\xed\x9e\x9a\xae\x38\x78\xcb\x93\x0b\xce\x2b\xdb\x29"
           "\x3c\xf9\x49\xd5\x88\xef\x39\xaf\x24\x53\x21\x1a\x50\x61\x8d\xfd"
           "\xb5\x29\xdb\x2e\x28\xf6\x32\xb2\xe6\x5c\x58\xe3\x8a\x73\x70\x41"
           "\x3c\xe9\xfb\xf7\x39\x0d\x4b\x61\xa5\x4c\x47\x00\xd9\x33\xef\x27"
           "\xe6\x1c\x36\x9f\xa3\xed",
           150);
    syscall(__NR_write, r[0], 0x20d74f6a, 0x96);
    break;
  case 3:
    syscall(__NR_read, r[0], 0x201e9fa6, 0);
    break;
  }
}

void test()
{
  memset(r, -1, sizeof(r));
  execute(4);
}

int main()
{
  for (procid = 0; procid < 8; procid++) {
    if (fork() == 0) {
      for (;;) {
        loop();
      }
    }
  }
  sleep(1000000);
  return 0;
}