// https://syzkaller.appspot.com/bug?id=8c73f3470322d6ae758d6feced0518977a3a20d1
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_mkdirat
#define __NR_mkdirat 296
#endif
#ifndef __NR_mmap
#define __NR_mmap 192
#endif
#ifndef __NR_mount
#define __NR_mount 21
#endif
#ifndef __NR_openat
#define __NR_openat 295
#endif
#ifndef __NR_write
#define __NR_write 4
#endif
#undef __NR_mmap
#define __NR_mmap __NR_mmap2

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x7ffff000, /*len=*/0x1000, /*prot=*/0,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32,
          /*fd=*/(intptr_t)-1, /*offset=*/0);
  syscall(__NR_mmap, /*addr=*/0x80000000, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32,
          /*fd=*/(intptr_t)-1, /*offset=*/0);
  syscall(__NR_mmap, /*addr=*/0x81000000, /*len=*/0x1000, /*prot=*/0,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32,
          /*fd=*/(intptr_t)-1, /*offset=*/0);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  mkdirat arguments: [
  //    fd: fd_dir (resource)
  //    path: ptr[in, buffer] {
  //      buffer: {2e 2f 73 79 73 00} (length 0x6)
  //    }
  //    mode: open_mode = 0x9d (4 bytes)
  //  ]
  memcpy((void*)0x80000380, "./sys\000", 6);
  syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x80000380,
          /*mode=S_IXOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IWUSR*/ 0x9d);
  //  mount arguments: [
  //    src: nil
  //    dst: ptr[in, buffer] {
  //      buffer: {2e 2f 73 79 73 00} (length 0x6)
  //    }
  //    type: ptr[in, buffer] {
  //      buffer: {73 79 73 66 73 00} (length 0x6)
  //    }
  //    flags: mount_flags = 0x0 (4 bytes)
  //    data: nil
  //  ]
  memcpy((void*)0x80000080, "./sys\000", 6);
  memcpy((void*)0x800000c0, "sysfs\000", 6);
  syscall(__NR_mount, /*src=*/0, /*dst=*/0x80000080, /*type=*/0x800000c0,
          /*flags=*/0, /*data=*/0);
  //  openat arguments: [
  //    fd: fd_dir (resource)
  //    file: ptr[in, buffer] {
  //      buffer: {2e 2f 73 79 73 2f 62 75 73 2f 61 63 70 69 2f 64 65 76 69 63
  //      65 73 2f 64 65 76 69 63 65 3a 30 30 2f 75 65 76 65 6e 74 00} (length
  //      0x28)
  //    }
  //    flags: open_flags = 0x1 (4 bytes)
  //    mode: open_mode = 0x0 (2 bytes)
  //  ]
  //  returns fd
  memcpy((void*)0x80000100, "./sys/bus/acpi/devices/device:00/uevent\000", 40);
  res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x80000100,
                /*flags=O_WRONLY*/ 1, /*mode=*/0);
  if (res != -1)
    r[0] = res;
  //  write arguments: [
  //    fd: fd (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {61 64 64 00 b4 e0 7f cf 22 16 9c f1 97 2e 94 8e 8a 77 81 d8
  //      3e 62 04 df 33 1f a5 0a 94 3c e7 33 cc 3b 7f a9 ac 36 ad 1b 70 a8 04
  //      3d 3d 5d 95 16 3c 32 5d 39 08 09 d0 ab fb 5d 43 cd 89 3f a9 87 a8 60
  //      fb 56 bf ac 8e fe 5e 23 d0 c0 bb 02 6f 68 d8 0b 80 ac 60 ab e0 dd 4d
  //      d4 73 27 82 1d b7 9a 41 be e0 ee 68 b0 d5 aa 01 6e 03 13 fb e2 08 16
  //      43 3f e7 aa 84 b9 a8 28 3c 96 fd 3b 35 31} (length 0x7e)
  //    }
  //    count: len = 0x7e (4 bytes)
  //  ]
  memcpy((void*)0x80000300,
         "\x61\x64\x64\x00\xb4\xe0\x7f\xcf\x22\x16\x9c\xf1\x97\x2e\x94\x8e\x8a"
         "\x77\x81\xd8\x3e\x62\x04\xdf\x33\x1f\xa5\x0a\x94\x3c\xe7\x33\xcc\x3b"
         "\x7f\xa9\xac\x36\xad\x1b\x70\xa8\x04\x3d\x3d\x5d\x95\x16\x3c\x32\x5d"
         "\x39\x08\x09\xd0\xab\xfb\x5d\x43\xcd\x89\x3f\xa9\x87\xa8\x60\xfb\x56"
         "\xbf\xac\x8e\xfe\x5e\x23\xd0\xc0\xbb\x02\x6f\x68\xd8\x0b\x80\xac\x60"
         "\xab\xe0\xdd\x4d\xd4\x73\x27\x82\x1d\xb7\x9a\x41\xbe\xe0\xee\x68\xb0"
         "\xd5\xaa\x01\x6e\x03\x13\xfb\xe2\x08\x16\x43\x3f\xe7\xaa\x84\xb9\xa8"
         "\x28\x3c\x96\xfd\x3b\x35\x31",
         126);
  syscall(__NR_write, /*fd=*/(intptr_t)r[0], /*buf=*/0x80000300,
          /*count=*/0x7e);
  return 0;
}