// https://syzkaller.appspot.com/bug?id=3a19a37460884d515a7ac660c32fe274550f264b
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  openat$nullb arguments: [
  //    fd: const = 0xffffffffffffff9c (8 bytes)
  //    file: ptr[in, buffer] {
  //      buffer: {2f 64 65 76 2f 6e 75 6c 6c 62 30 00} (length 0xc)
  //    }
  //    flags: open_flags = 0x105101 (4 bytes)
  //    mode: const = 0x0 (2 bytes)
  //  ]
  //  returns fd_block
  memcpy((void*)0x2000000000c0, "/dev/nullb0\000", 12);
  res = syscall(
      __NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x2000000000c0ul,
      /*flags=O_SYNC|O_NOCTTY|O_DIRECT|O_WRONLY*/ 0x105101, /*mode=*/0);
  if (res != -1)
    r[0] = res;
  //  writev arguments: [
  //    fd: fd (resource)
  //    vec: ptr[in, array[iovec[in, array[int8]]]] {
  //      array[iovec[in, array[int8]]] {
  //        iovec[in, array[int8]] {
  //          addr: ptr[in, buffer] {
  //            buffer: {e4 06 24 7c ce 54 f1 bf 1e 68 fd e8 9a 67 b3 df ea 30
  //            60 f9 2b b7 f4 24 3f da 11 8f 4f 15 35 50 b0 20 22 b6 f8 d5 14
  //            8b 46 5b 98 fd 98 f7 bd 9c c4 4c 96 31 e9 75 f0 55 24 76 c4 4f
  //            6c 2e 85 c7 0a cf d0 ee 1d 4a 24 86 d0 02 53 4c f6 71 59 96 67
  //            b6 9c 27 d0 27 19 8b 6e 43 69 90 58 09 d7 df 3c 37 51 33 02 cc
  //            af 88 2c 23 b2 dd c0 55 06 f6 8d 13 8c 17 c0 39 f3 97 c4 d0 c9
  //            11 c7 94 cb 1e 7e db 8e 9d 82 2f 34 09 07 8c ad 3e c5 f1 b3 c0
  //            4e a9 1c f1 37 1d 13 49 6b f8 91 70 b9 51 b3 9e e0 a6 0c 91 a0
  //            c9 e3 39 16 5c 20 9d a0 32 c4 27 33 c0 37 e5 00 a3 7c 14 c9 c0
  //            92 ff 95 98 8e 88 d7 9f d2 7a 90 96 8b 43 6d d9 8f 84 23 00 c3
  //            63 87 8a 55 b8 6f 0c af 80 2c 06 ca 3c 69 bc bf ff 80 c9 49 2d
  //            26 4c 4e 90 c0 75 8c bb f3 13 c3 82 4b 97 af 8a 78 7a c5 4a ea
  //            77 f1 12 8e 2b 65 c1 3c b6 d8 f4 65 f2 da 8d 1b 6b 5c 87 1a 14
  //            64 72 44 e3 f4 f4 42 41 a0 2e 49 ae 97 8c 1a 5a 8a 78 bd 72 74
  //            55 13 6f 95 24 d0 86 ee 15 d3 d5 b2 9c a5 d2 b1 12 13 6f a5 66
  //            3c 0f cd ec 7e 49 1d 0e ae 70 da d8 3b b9 51 00 e0 56 19 fd ce
  //            4b 68 9c d9 8a 13 c2 81 f0 c0 f0 35 86 31 f3 78 9f 98 2e 9e ad
  //            28 81 37 7b 70 6a 19 8a 85 c6 5a 0b 44 73 e9 6a dc 7b 8d 24 7d
  //            f0 3d b0 8e e9 c3 eb 96 6d b9 1b 12 48 17 43 89 ad 75 91 c0 0e
  //            88 62 c6 04 b9 9c 69 d6 e8 41 0d 26 fb 46 70 56 d6 47 94 c9 fe
  //            ec 3b 8a 90 18 0d 57 92 2d d4 68 4d 6b 39 b4 54 ab a5 77 ec 24
  //            da 7a 95 73 66 80 3f c8 08 35 73 e7 ae d6 98 17 27 19 a4 96 8f
  //            a8 e9 e2 3e c9 39 ba 27 ea ea bb 3b b2 d1 e0 11 2f 4e 3b 2e f9
  //            d6 8d 80 8d cb 1f 4c 6c b6 0a a6 59 f2 6e 8e 16 82 ad 13 d8 5a
  //            3a 31 47 41 5a 18 c1 bb 74 6b bf} (length 0x200)
  //          }
  //          len: len = 0x20000 (8 bytes)
  //        }
  //        iovec[in, array[int8]] {
  //          addr: nil
  //          len: len = 0x20000 (8 bytes)
  //        }
  //      }
  //    }
  //    vlen: len = 0x2 (8 bytes)
  //  ]
  *(uint64_t*)0x200000000100 = 0x200000000140;
  memcpy(
      (void*)0x200000000140,
      "\xe4\x06\x24\x7c\xce\x54\xf1\xbf\x1e\x68\xfd\xe8\x9a\x67\xb3\xdf\xea\x30"
      "\x60\xf9\x2b\xb7\xf4\x24\x3f\xda\x11\x8f\x4f\x15\x35\x50\xb0\x20\x22\xb6"
      "\xf8\xd5\x14\x8b\x46\x5b\x98\xfd\x98\xf7\xbd\x9c\xc4\x4c\x96\x31\xe9\x75"
      "\xf0\x55\x24\x76\xc4\x4f\x6c\x2e\x85\xc7\x0a\xcf\xd0\xee\x1d\x4a\x24\x86"
      "\xd0\x02\x53\x4c\xf6\x71\x59\x96\x67\xb6\x9c\x27\xd0\x27\x19\x8b\x6e\x43"
      "\x69\x90\x58\x09\xd7\xdf\x3c\x37\x51\x33\x02\xcc\xaf\x88\x2c\x23\xb2\xdd"
      "\xc0\x55\x06\xf6\x8d\x13\x8c\x17\xc0\x39\xf3\x97\xc4\xd0\xc9\x11\xc7\x94"
      "\xcb\x1e\x7e\xdb\x8e\x9d\x82\x2f\x34\x09\x07\x8c\xad\x3e\xc5\xf1\xb3\xc0"
      "\x4e\xa9\x1c\xf1\x37\x1d\x13\x49\x6b\xf8\x91\x70\xb9\x51\xb3\x9e\xe0\xa6"
      "\x0c\x91\xa0\xc9\xe3\x39\x16\x5c\x20\x9d\xa0\x32\xc4\x27\x33\xc0\x37\xe5"
      "\x00\xa3\x7c\x14\xc9\xc0\x92\xff\x95\x98\x8e\x88\xd7\x9f\xd2\x7a\x90\x96"
      "\x8b\x43\x6d\xd9\x8f\x84\x23\x00\xc3\x63\x87\x8a\x55\xb8\x6f\x0c\xaf\x80"
      "\x2c\x06\xca\x3c\x69\xbc\xbf\xff\x80\xc9\x49\x2d\x26\x4c\x4e\x90\xc0\x75"
      "\x8c\xbb\xf3\x13\xc3\x82\x4b\x97\xaf\x8a\x78\x7a\xc5\x4a\xea\x77\xf1\x12"
      "\x8e\x2b\x65\xc1\x3c\xb6\xd8\xf4\x65\xf2\xda\x8d\x1b\x6b\x5c\x87\x1a\x14"
      "\x64\x72\x44\xe3\xf4\xf4\x42\x41\xa0\x2e\x49\xae\x97\x8c\x1a\x5a\x8a\x78"
      "\xbd\x72\x74\x55\x13\x6f\x95\x24\xd0\x86\xee\x15\xd3\xd5\xb2\x9c\xa5\xd2"
      "\xb1\x12\x13\x6f\xa5\x66\x3c\x0f\xcd\xec\x7e\x49\x1d\x0e\xae\x70\xda\xd8"
      "\x3b\xb9\x51\x00\xe0\x56\x19\xfd\xce\x4b\x68\x9c\xd9\x8a\x13\xc2\x81\xf0"
      "\xc0\xf0\x35\x86\x31\xf3\x78\x9f\x98\x2e\x9e\xad\x28\x81\x37\x7b\x70\x6a"
      "\x19\x8a\x85\xc6\x5a\x0b\x44\x73\xe9\x6a\xdc\x7b\x8d\x24\x7d\xf0\x3d\xb0"
      "\x8e\xe9\xc3\xeb\x96\x6d\xb9\x1b\x12\x48\x17\x43\x89\xad\x75\x91\xc0\x0e"
      "\x88\x62\xc6\x04\xb9\x9c\x69\xd6\xe8\x41\x0d\x26\xfb\x46\x70\x56\xd6\x47"
      "\x94\xc9\xfe\xec\x3b\x8a\x90\x18\x0d\x57\x92\x2d\xd4\x68\x4d\x6b\x39\xb4"
      "\x54\xab\xa5\x77\xec\x24\xda\x7a\x95\x73\x66\x80\x3f\xc8\x08\x35\x73\xe7"
      "\xae\xd6\x98\x17\x27\x19\xa4\x96\x8f\xa8\xe9\xe2\x3e\xc9\x39\xba\x27\xea"
      "\xea\xbb\x3b\xb2\xd1\xe0\x11\x2f\x4e\x3b\x2e\xf9\xd6\x8d\x80\x8d\xcb\x1f"
      "\x4c\x6c\xb6\x0a\xa6\x59\xf2\x6e\x8e\x16\x82\xad\x13\xd8\x5a\x3a\x31\x47"
      "\x41\x5a\x18\xc1\xbb\x74\x6b\xbf",
      512);
  *(uint64_t*)0x200000000108 = 0x20000;
  *(uint64_t*)0x200000000110 = 0;
  *(uint64_t*)0x200000000118 = 0x20000;
  syscall(__NR_writev, /*fd=*/r[0], /*vec=*/0x200000000100ul, /*vlen=*/2ul);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  loop();
  return 0;
}