// https://syzkaller.appspot.com/bug?id=3c1f47967b7cbd399d3ba3e65f297a29aa1c5f92
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf));
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

#ifndef __NR_mmap
#define __NR_mmap 192
#endif
#ifndef __NR_write
#define __NR_write 4
#endif
#ifndef __NR_read
#define __NR_read 3
#endif
#undef __NR_mmap
#define __NR_mmap __NR_mmap2

long r[1];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
  memcpy((void*)0x2002b000, "/dev/sg#", 9);
  r[0] = syz_open_dev(0x2002b000, 0, 0x142);
  *(uint8_t*)0x20671f39 = 0x23;
  *(uint8_t*)0x20671f3a = 0;
  *(uint8_t*)0x20671f3b = 8;
  *(uint8_t*)0x20671f3c = 3;
  *(uint32_t*)0x20671f3d = 0;
  *(uint32_t*)0x20671f41 = 0;
  *(uint8_t*)0x20671f45 = 9;
  *(uint8_t*)0x20671f46 = 8;
  *(uint8_t*)0x20671f47 = 0x8a;
  *(uint8_t*)0x20671f48 = -1;
  *(uint32_t*)0x20671f49 = 0x77359400;
  *(uint32_t*)0x20671f4d = 0;
  *(uint8_t*)0x20671f55 = 4;
  *(uint8_t*)0x20671f56 = -1;
  *(uint8_t*)0x20671f57 = 6;
  *(uint8_t*)0x20671f58 = 3;
  *(uint32_t*)0x20671f59 = 2;
  *(uint8_t*)0x20671f61 = 1;
  *(uint8_t*)0x20671f62 = 9;
  *(uint8_t*)0x20671f63 = 0xb2;
  *(uint8_t*)0x20671f64 = 0x92;
  *(uint8_t*)0x20671f65 = 2;
  *(uint8_t*)0x20671f66 = 9;
  *(uint8_t*)0x20671f67 = 5;
  *(uint8_t*)0x20671f68 = 9;
  *(uint8_t*)0x20671f71 = 0;
  *(uint8_t*)0x20671f72 = 2;
  *(uint8_t*)0x20671f73 = 0xfa;
  *(uint8_t*)0x20671f74 = 0x20;
  *(uint32_t*)0x20671f75 = 8;
  *(uint8_t*)0x20671f7d = 0x20;
  *(uint8_t*)0x20671f7e = 1;
  *(uint8_t*)0x20671f7f = -1;
  *(uint8_t*)0x20671f80 = 1;
  *(uint32_t*)0x20671f81 = 4;
  *(uint32_t*)0x20671f85 = 0x7fff;
  *(uint32_t*)0x20671f89 = 3;
  *(uint8_t*)0x20671f8d = 0xf9;
  *(uint8_t*)0x20671f8e = 0xb5;
  *(uint8_t*)0x20671f8f = 1;
  *(uint8_t*)0x20671f90 = 0x39;
  *(uint32_t*)0x20671f91 = 0;
  *(uint32_t*)0x20671f95 = 0;
  *(uint8_t*)0x20671f99 = 4;
  *(uint8_t*)0x20671f9a = 0xdf;
  *(uint8_t*)0x20671f9b = 0;
  *(uint8_t*)0x20671f9c = 7;
  *(uint8_t*)0x20671f9d = 0xfc;
  *(uint32_t*)0x20671fa1 = 0xd5;
  *(uint32_t*)0x20671fa5 = 0xfffff571;
  *(uint8_t*)0x20671fa9 = 0x6f;
  *(uint8_t*)0x20671faa = 0;
  *(uint8_t*)0x20671fab = 0xb8;
  *(uint8_t*)0x20671fac = 0;
  *(uint32_t*)0x20671fad = 0;
  *(uint32_t*)0x20671fb1 = 0x1c9c380;
  *(uint8_t*)0x20671fb5 = 0x7d;
  *(uint8_t*)0x20671fb6 = 0xac;
  *(uint8_t*)0x20671fb7 = -1;
  *(uint8_t*)0x20671fb8 = 0x8a;
  *(uint32_t*)0x20671fb9 = 7;
  *(uint32_t*)0x20671fbd = 0;
  *(uint8_t*)0x20671fc5 = 6;
  *(uint8_t*)0x20671fc6 = 0;
  *(uint8_t*)0x20671fc7 = 6;
  *(uint8_t*)0x20671fc8 = 0;
  *(uint32_t*)0x20671fc9 = 0x77359400;
  *(uint32_t*)0x20671fcd = 0;
  *(uint8_t*)0x20671fd1 = 0;
  *(uint8_t*)0x20671fd2 = 5;
  *(uint8_t*)0x20671fd3 = 0x4a;
  *(uint8_t*)0x20671fd4 = 0;
  *(uint8_t*)0x20671fd5 = 8;
  *(uint8_t*)0x20671fd6 = 0x40;
  *(uint8_t*)0x20671fe1 = 7;
  *(uint8_t*)0x20671fe2 = 3;
  *(uint8_t*)0x20671fe3 = 8;
  *(uint8_t*)0x20671fe4 = 0x13;
  *(uint32_t*)0x20671fe5 = 9;
  *(uint8_t*)0x20671fed = 0;
  *(uint8_t*)0x20671fee = 1;
  *(uint8_t*)0x20671fef = 7;
  *(uint8_t*)0x20671ff0 = 2;
  *(uint32_t*)0x20671ff1 = 0;
  *(uint32_t*)0x20671ff5 = 0x2077b000;
  *(uint8_t*)0x20671ffd = 0;
  *(uint8_t*)0x20671ffe = 0x94;
  *(uint8_t*)0x20671fff = 1;
  *(uint8_t*)0x20672000 = 0;
  *(uint32_t*)0x20672001 = 0x77359400;
  *(uint32_t*)0x20672005 = 0;
  *(uint8_t*)0x20672009 = 0x1f;
  *(uint8_t*)0x2067200a = 4;
  *(uint8_t*)0x2067200b = 9;
  *(uint8_t*)0x2067200c = 0x88;
  *(uint32_t*)0x2067200d = 0xfffffbff;
  syscall(__NR_write, r[0], 0x20671f39, 0x180);
  syscall(__NR_read, r[0], 0x2042a000, 0);
}

int main()
{
  loop();
  return 0;
}