// https://syzkaller.appspot.com/bug?id=3bf48abb447593ade9c7ba86c74b6eb3d9c75956
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <pthread.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}

#include <setjmp.h>
#include <signal.h>
#include <stdint.h>
#include <string.h>
#include <string.h>

static __thread int skip_segv;
static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* uctx)
{
  uintptr_t addr = (uintptr_t)info->si_addr;
  const uintptr_t prog_start = 1 << 20;
  const uintptr_t prog_end = 100 << 20;
  if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
      (addr < prog_start || addr > prog_end)) {
    _longjmp(segv_env, 1);
  }
  doexit(sig);
  for (;;) {
  }
}

static void install_segv_handler()
{
  struct sigaction sa;

  memset(&sa, 0, sizeof(sa));
  sa.sa_handler = SIG_IGN;
  syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
  syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);

  memset(&sa, 0, sizeof(sa));
  sa.sa_sigaction = segv_handler;
  sa.sa_flags = SA_NODEFER | SA_SIGINFO;
  sigaction(SIGSEGV, &sa, NULL);
  sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...)                                                \
  {                                                                    \
    __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);               \
    if (_setjmp(segv_env) == 0) {                                      \
      __VA_ARGS__;                                                     \
    }                                                                  \
    __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);               \
  }

static void test();

void loop()
{
  while (1) {
    test();
  }
}

long r[10];
void* thr(void* arg)
{
  switch ((long)arg) {
  case 0:
    r[0] = syscall(__NR_mmap, 0x20000000ul, 0x263000ul, 0x3ul, 0x32ul,
                   0xfffffffffffffffful, 0x0ul);
    break;
  case 1:
    r[1] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul);
    break;
  case 2:
    NONFAILING(memcpy(
        (void*)0x20002000,
        "\xf8\x63\xf3\xa3\x4f\xf0\x1b\x62\xd6\xb2\x8c\x2a\xcd\x6b\xba"
        "\x67\x6d\xd7\xd9\x71\x9c\xd8\x27\xc7\x8d\xb5\xa5\x82\x7b\x06"
        "\x19\x0d\x71\x6a\xe1\x02\xe5\x1d\xde\xb4\x69\x47\x1b\x86\x95"
        "\x44\x4c\xf8\xe3\x24\xe8\x9d\x25\xec\x85\x6b\x1c\xe1\x8b\xb9"
        "\xe0\x3d\x27\x93\xcc\x6a\x94\x2a\x8b\x6c\x5c\x6a\x4f\xf9\x5f"
        "\x15\xc2\xa9\x8d\x46\x77\xb8\x35\x55\xd9\x7e\x62\x0d\xd3\x16"
        "\xeb\xd7\x16\x7a\xab\xe7\xbc\x71\x96\x9b\xdc\xb1\xce\x85\x15"
        "\x8f\xde\x28\x91\xea\x99\x2e\xc6\x00\xff\x29\x7d\xeb\x40\x4e"
        "\xb7",
        121));
    r[3] = syscall(__NR_setsockopt, r[1], 0x117ul, 0x1ul, 0x20002000ul,
                   0x79ul);
    break;
  case 3:
    NONFAILING(*(uint16_t*)0x20002000 = (uint16_t)0x26);
    NONFAILING(memcpy(
        (void*)0x20002002,
        "\x68\x61\x73\x68\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
        14));
    NONFAILING(*(uint32_t*)0x20002010 = (uint32_t)0x0);
    NONFAILING(*(uint32_t*)0x20002014 = (uint32_t)0x0);
    NONFAILING(memcpy((void*)0x20002018,
                      "\x68\x6d\x61\x63\x28\x68\x6d\x61\x63\x28\x73\x68"
                      "\x61\x33\x2d\x35\x31\x32\x2d\x67\x65\x6e\x65\x72"
                      "\x69\x63\x29\x29\x00\x00\x00\x00\x00\x00\x00\x00"
                      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
                      "\x00\x00\x00\x00",
                      64));
    r[9] = syscall(__NR_bind, r[1], 0x20002000ul, 0x58ul);
    break;
  }
  return 0;
}

void test()
{
  long i;
  pthread_t th[8];

  memset(r, -1, sizeof(r));
  for (i = 0; i < 4; i++) {
    pthread_create(&th[i], 0, thr, (void*)i);
    usleep(rand() % 10000);
  }
  usleep(rand() % 100000);
}

int main()
{
  int i;
  for (i = 0; i < 8; i++) {
    if (fork() == 0) {
      install_segv_handler();
      loop();
      return 0;
    }
  }
  sleep(1000000);
  return 0;
}