// https://syzkaller.appspot.com/bug?id=ed37ff7af4f0cc3ebbad64f58ac3fdd223b42e5f
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  memcpy((void*)0x200000000200, "/dev/kvm\000", 9);
  res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
                /*file=*/0x200000000200ul, /*flags=O_EXCL|O_WRONLY*/ 0x81,
                /*mode=*/0);
  if (res != -1)
    r[0] = res;
  res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xae01, /*type=*/0ul);
  if (res != -1)
    r[1] = res;
  *(uint32_t*)0x200000000040 = 0x79;
  *(uint32_t*)0x200000000044 = 0;
  *(uint64_t*)0x200000000048 = 0xc;
  syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x4068aea3,
          /*arg=*/0x200000000040ul);
  res = syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xae41, /*id=*/2ul);
  if (res != -1)
    r[2] = res;
  memcpy(
      (void*)0x200000000240,
      "\xde\xf4\x05\xbd\x13\xff\xfe\xdc\xa0\x37\x99\xbc\xbd\x1b\x54\x9c\xe9\x42"
      "\xc5\xac\xf5\xc6\x95\xd1\x0d\x5d\xad\xcd\xaf\x9f\x67\xb1\x25\x1d\x51\x30"
      "\xaf\xd7\x30\xef\x68\x72\xcd\xd3\xaf\x29\x0b\x9a\xc5\x02\x56\x5a\x29\x28"
      "\x9a\xb6\xcf\xf8\x23\xa2\x3a\x93\x4f\xb0\xf4\x57\x37\x9c\x6b\x35\x8e\xdb"
      "\x83\x89\x5a\xb4\x02\xcb\x42\xd4\xec\x31\xc6\x9e\x36\xa2\xb7\xd1\x17\x61"
      "\x2d\x25\x99\x71\x70\xff\xff\xff\xff\xff\xff\xff\x7f\x91\x0e\xfb\x41\x68"
      "\xda\x4c\x3d\xb0\xf1\xd8\x47\x70\x9d\xef\x72\x5d\xfa\x7a\xe3\x45\xc0\xa8"
      "\x24\x5d\xaf\x4e\x8e\x4c\xf3\x5e\x98\xd4\x37\x5b\x48\x4c\xc2\x0e\xac\x1f"
      "\xe4\xeb\x50\xaa\x83\xac\xcb\x9e\x1e\x55\x8d\xf7\xc2\x5b\xa7\x3f\x14\x8f"
      "\xc5\x13\x97\x39\x31\x3f\xff\x70\xce\x3f\xd2\xd9\xfd\x60\x51\xc5\x7c\x73"
      "\xdd\x8f\xc5\x83\xf2\xab\xfa\xb6\xf6\x9d\x95\x07\xc6\x1b\xa2\x43\xe8\x12"
      "\x56\x44\x45\x4b\xd0\x49\x23\x77\xf7\x72\x03\xfe\x7a\x90\x78\x61\xda\x7b"
      "\xe8\x07\xe1\xab\x9a\x12\xed\x01\xfa\x50\xc2\x0e\x0f\xe8\x37\x2e\x59\x04"
      "\x47\x6e\x7c\xab\x8a\xd4\xea\x8d\x43\xca\x16\x7d\xbe\x76\xdb\xc0\xd6\x1a"
      "\xd5\x82\x86\x4b\x2c\xf0\x76\x85\xfe\x01\x79\x55\x80\xe1\xff\xd7\x3b\x92"
      "\x69\xa0\xac\xc3\xb4\x4b\x8b\x5c\xf4\x0a\xb6\x84\xed\xee\x8b\x02\x82\x8f"
      "\x3c\xc9\xa9\x39\xf2\x38\xbb\xe5\xb3\x70\xb8\x60\xc7\x02\xe3\x00\x21\xb2"
      "\x5d\xb0\x51\x89\x48\x9c\x64\x84\xe0\xe3\x13\x12\x64\xc1\xa4\xd0\x6d\x82"
      "\x7d\x45\x0f\x19\x8b\x21\xb0\x4a\x54\x55\x3f\xc9\x34\x6b\x18\xd3\x6a\x04"
      "\x0b\x48\x54\xc4\x1b\xb0\xa5\xb4\xb4\xd8\xcf\xc2\x18\x63\x56\xc3\x1e\x38"
      "\x1b\x50\xda\x79\x67\x73\x01\x34\xfc\x70\xe6\x48\x65\x68\x79\x87\x72\xaa"
      "\xf9\x53\x00\x80\xf5\xef\xbd\x6f\x02\xc8\x6b\x0f\xd5\xb6\x42\x2a\xb6\xc5"
      "\xc1\x33\x07\x6d\x31\x4d\x32\x61\x9a\x47\x99\x44\x00\xaa\x65\xb6\x96\xc5"
      "\x47\x52\xa5\xb7\xe7\x18\x13\x41\x73\x92\xd9\x5c\x23\x4b\x10\x1c\x9d\xba"
      "\x59\x92\x55\xa7\x7f\x01\x5c\x87\x48\xb0\x75\xbb\xf1\x13\xd0\x11\xdf\x34"
      "\xc2\x9b\xc3\x3a\x52\x91\x42\x68\xea\x6d\xac\xb4\x10\xf8\xb6\x32\x60\xd4"
      "\xc0\x07\x9c\x22\x00\x21\x72\x12\x6c\x27\x25\xa7\xce\x9c\xb7\x9f\x59\x80"
      "\x98\x62\x43\x10\x1a\xc6\xf6\x5e\x0f\xeb\xc4\x6f\xff\x1d\x49\xa4\xa8\x3e"
      "\xae\x60\x78\xef\xfd\x38\x92\xfc\x9a\xa1\x73\xc0\x04\x76\x10\x2f\x4c\xc5"
      "\x2d\x4e\x0a\x41\x7d\xca\xec\xf8\xf3\x42\xf7\x51\x5a\xe2\x3d\x9c\x2b\x98"
      "\x49\xa8\xef\xf8\x83\x09\xfb\x53\xf0\x19\x3d\x2e\x97\x79\x70\xc6\x00\x35"
      "\xb9\xd6\xc3\x7f\xa1\xdf\x1d\x35\xa5\xa0\xf3\xaa\x1f\x69\xbe\xc9\xe8\x18"
      "\x67\x00\x29\xb0\xd8\x3e\xfd\x8e\xf0\x90\x7c\x4d\xb2\x2f\x0e\xf5\xbe\xe2"
      "\x77\x59\xc5\xc4\x15\x9e\x63\xb3\x93\x02\x1d\xbe\x39\x28\x2b\xd2\x68\xe1"
      "\xab\x7f\xee\x80\xd9\xcc\xf9\x50\x9d\x1a\x95\x6f\x0d\x2a\xeb\x94\x2c\x96"
      "\xc9\x1e\x89\x18\x3e\x56\x4a\x84\xc4\x31\xe3\xd3\xa1\xd6\xb1\xd7\x36\x4c"
      "\x36\x9b\xb6\x93\x19\x35\xd7\x66\xb9\x19\x6b\xa3\xd8\x66\xdc\x0e\xe4\x23"
      "\xa1\x4d\xb8\x30\x75\x6f\x99\x2c\x4a\xcc\x74\xc1\x66\xf7\x99\x2c\x74\x52"
      "\xe6\xb5\x7a\x43\xc5\x61\x94\xee\x25\xac\xca\x5b\x41\xaf\xcf\xa6\x1f\x96"
      "\x3d\x1e\x98\x51\xeb\x8d\x47\x1d\xfa\x43\x5d\xeb\x14\xca\x35\x0b\x1b\x50"
      "\xe8\xe5\x0e\xce\x91\xf7\x58\x77\xd0\x2a\x7a\x68\x56\xbe\xaf\x0d\x90\x25"
      "\x9f\xb7\x5a\xdb\x86\x24\x22\x83\xfd\x9e\x3e\x1d\xb9\x72\xe8\x10\x88\x5d"
      "\xd9\x41\xc2\xb5\x06\xd9\x2a\x67\xf6\xb2\xaf\x70\xc7\x26\xe9\x5b\x35\x15"
      "\x25\xe4\xc1\xb2\xfe\x4f\x38\x87\x43\x21\xa3\x06\xb4\xaf\x9d\x9b\x48\x22"
      "\x80\x71\xe4\xe3\x76\x3b\xf7\xfb\xe9\xc8\xaa\x66\x71\xc1\x51\xf8\xc7\xe6"
      "\xac\xb6\xcf\x39\x21\x7d\x13\x1d\x9f\x34\xf3\x53\x4c\x0c\xb2\x2e\xe4\xbf"
      "\x9f\x8c\x98\x15\x17\x63\x73\x17\xc8\x79\xa2\xa6\x93\xf4\xc0\x5b\xcc\xda"
      "\xa7\xc4\xec\xda\xf5\x1d\x16\xae\xe1\x72\x84\xb4\x88\xc7\x72\x98\x30\x6d"
      "\xdc\x0c\xdc\x4e\x89\x8d\x67\xc4\xcf\x61\x45\xe5\xd1\x48\x9c\x4e\x2a\xe5"
      "\x8c\xfc\x3e\x77\xfd\xe1\x74\x83\x6c\x1b\x3d\x7a\xb2\x90\x20\x5f\x49\x00"
      "\x77\x37\xea\xa2\x5a\xcd\x5e\xf6\x23\x44\xba\x13\x7e\xcc\x47\x15\x43\x9b"
      "\x25\x31\x3e\x0d\xdd\x71\x25\x62\xa8\x3f\x52\xf2\xfc\x80\xc5\x09\x65\xdf"
      "\xf0\x3c\x4d\x65\xa7\xd4\x80\x4f\xe8\x70\xd0\x70\x33\xe7\xc3\x9a\xf4\x09"
      "\x12\xbc\xb8\x4f\x2e\x02\x12\x2e\x6b\xf4\x60\xc2\x08\xb0\x4f\x7a\x24\x68"
      "\x75\xab\x1e\x75\x65\x7c\xa4\x60\x51\x93\x4b\xc5\x64\x57\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
      1024);
  syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0x4400ae8f,
          /*arg=*/0x200000000240ul);
  syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0xae80, /*arg=*/0ul);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  loop();
  return 0;
}