// https://syzkaller.appspot.com/bug?id=6efd1075e8b4ae617545e2175f9aca2130136e90
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <fcntl.h>
#include <unistd.h>
#include <pthread.h>

volatile int stop = 0;

void *writer_thread(void *arg)
{
    while (!stop) {
        mknod("mnt/test_fifo", S_IFIFO | 0666, 0);
        unlink("mnt/test_fifo");
    }
    return NULL;
}

void *reader_thread(void *arg)
{
    while (!stop) {
        int fd = open("mnt/test_fifo", O_RDONLY | O_NONBLOCK);
        if (fd >= 0) {
            close(fd);
        }
    }
    return NULL;
}

int main(void)
{
    setvbuf(stdout, NULL, _IONBF, 0);

    int res = mkdir("mnt", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to mkdir: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mkdir successful.\n");

    res = mount("tmpfs", "mnt", "tmpfs", 0, "");
    if (res < 0) {
        printf("[-] Failed to mount tmpfs: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mount tmpfs successful.\n");

    pthread_t writer;
    res = pthread_create(&writer, NULL, writer_thread, NULL);
    if (res != 0) {
        printf("[-] Failed to create writer thread: %s\n", strerror(res));
        exit(1);
    }

    #define NUM_READERS 8
    pthread_t readers[NUM_READERS];
    for (int i = 0; i < NUM_READERS; i++) {
        res = pthread_create(&readers[i], NULL, reader_thread, NULL);
        if (res != 0) {
            printf("[-] Failed to create reader thread %d: %s\n", i, strerror(res));
            exit(1);
        }
    }
    printf("[+] Threads started.\n");

    sleep(5);
    stop = 1;

    pthread_join(writer, NULL);
    for (int i = 0; i < NUM_READERS; i++) {
        pthread_join(readers[i], NULL);
    }
    printf("[+] Threads joined.\n");

    res = umount("mnt");
    if (res < 0) {
        printf("[-] Failed to umount: %s\n", strerror(errno));
    } else {
        printf("[+] umount successful.\n");
    }

    rmdir("mnt");

    printf("[+] Done.\n");
    return 0;
}