// https://syzkaller.appspot.com/bug?id=4383f618da77d7caee6212ce8921a61f92ba95d7
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <fcntl.h>
#include <unistd.h>

void make_dir(const char *path) {
    char tmp[256];
    snprintf(tmp, sizeof(tmp), "%s", path);
    char *p = tmp;
    for (p = tmp + 1; *p; p++) {
        if (*p == '/') {
            *p = 0;
            mkdir(tmp, 0777);
            *p = '/';
        }
    }
    if (mkdir(tmp, 0777) < 0 && errno != EEXIST) {
        printf("[-] mkdir(%s) failed: %s\n", tmp, strerror(errno));
    } else {
        printf("[+] mkdir(%s) successful or already exists.\n", tmp);
    }
}

int main(void) {
    printf("[*] Starting reproducer...\n");

    if (mount("configfs", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount configfs: %s\n", strerror(errno));
        }
    }

    const char *u1_path = "/sys/kernel/config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u1";
    
    printf("[*] Creating UVC uncompressed format directory...\n");
    make_dir(u1_path);
    
    printf("[*] Removing UVC uncompressed format directory...\n");
    if (rmdir(u1_path) < 0) {
        printf("[-] Failed to rmdir %s: %s\n", u1_path, strerror(errno));
    } else {
        printf("[+] rmdir successful.\n");
    }

    printf("[*] Recreating UVC uncompressed format directory...\n");
    make_dir(u1_path);

    printf("[*] Writing to bmaControls...\n");
    const char *bma_path = "/sys/kernel/config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u1/bmaControls";
    int fd = open(bma_path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, "0x01\n", 5) < 0) {
            printf("[-] Failed to write to bmaControls: %s\n", strerror(errno));
        } else {
            printf("[+] Write to bmaControls successful.\n");
        }
        close(fd);
    } else {
        printf("[-] Failed to open bmaControls: %s\n", strerror(errno));
    }

    printf("[*] Creating TCM function...\n");
    make_dir("/sys/kernel/config/usb_gadget/g1/functions/tcm.0");

    printf("[*] Creating TCM TPG...\n");
    make_dir("/sys/kernel/config/target/usb_gadget/naa.1234567890123456/tpgt_1");

    printf("[+] Reproducer finished.\n");
    
    // Sleep a bit to allow asynchronous lockdep splat to be printed
    sleep(2);
    
    return 0;
}