// https://syzkaller.appspot.com/bug?id=21b568a338b9c418c40ac4d9a150aeedeb4f7350
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  mkdir arguments: [
  //    path: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 00} (length 0x7)
  //    }
  //    mode: open_mode = 0x1ff (8 bytes)
  //  ]
  memcpy((void*)0x200000000000, "config\000", 7);
  syscall(
      __NR_mkdir, /*path=*/0x200000000000ul,
      /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/
      0x1fful);
  //  mount arguments: [
  //    src: nil
  //    dst: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 00} (length 0x7)
  //    }
  //    type: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 66 73 00} (length 0x9)
  //    }
  //    flags: mount_flags = 0x0 (8 bytes)
  //    data: nil
  //  ]
  memcpy((void*)0x200000000100, "config\000", 7);
  memcpy((void*)0x200000000200, "configfs\000", 9);
  syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000100ul,
          /*type=*/0x200000000200ul, /*flags=*/0ul, /*data=*/0ul);
  //  mkdir arguments: [
  //    path: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 2f 75 73 62 5f 67 61 64 67 65 74 2f 67 31
  //      00} (length 0x15)
  //    }
  //    mode: open_mode = 0x1ff (8 bytes)
  //  ]
  memcpy((void*)0x200000000300, "config/usb_gadget/g1\000", 21);
  syscall(
      __NR_mkdir, /*path=*/0x200000000300ul,
      /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/
      0x1fful);
  //  mkdir arguments: [
  //    path: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 2f 75 73 62 5f 67 61 64 67 65 74 2f 67 31
  //      2f 66 75 6e 63 74 69 6f 6e 73 2f 75 61 63 32 2e 75 73 62 30 00}
  //      (length 0x29)
  //    }
  //    mode: open_mode = 0x1ff (8 bytes)
  //  ]
  memcpy((void*)0x200000000500, "config/usb_gadget/g1/functions/uac2.usb0\000",
         41);
  syscall(
      __NR_mkdir, /*path=*/0x200000000500ul,
      /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/
      0x1fful);
  //  openat arguments: [
  //    fd: fd_dir (resource)
  //    file: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 2f 75 73 62 5f 67 61 64 67 65 74 2f 67 31
  //      2f 66 75 6e 63 74 69 6f 6e 73 2f 75 61 63 32 2e 75 73 62 30 2f 70 5f
  //      73 72 61 74 65 00} (length 0x31)
  //    }
  //    flags: open_flags = 0x1 (4 bytes)
  //    mode: open_mode = 0x0 (2 bytes)
  //  ]
  //  returns fd
  memcpy((void*)0x200000000800,
         "config/usb_gadget/g1/functions/uac2.usb0/p_srate\000", 49);
  res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000800ul,
                /*flags=O_WRONLY*/ 1, /*mode=*/0);
  if (res != -1)
    r[0] = res;
  //  write arguments: [
  //    fd: fd (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {34 34 31 30 1d 44 34 38 30 30 30 2c 39 36 30 30 30 00 b8 6e
  //      04 84 d7 d8 27 d3 b9 a9 1a ed 13 fd 06 63 9e 0c a6 b2 06 12 5f d7 8b
  //      e6 87 d5 5c e0 d7 67 f5 4f 6f 28 0a 37 00 80 6c 26 3b cc c3 fb 66 07
  //      6e 31 ca 48 6f e3 82 23 41 67 1a c4 7a bf 01 0a 3f e2 c2 80 81 5c 5d
  //      44 70 f0 c8 cf 38 42 02 00 00 00 00 00 00 00 42 da 90 08 8a 41 16 ce
  //      6c 3d f6 07 b4 aa 82 79 c5 50 00 04 1c 0f c1 de e2 b8 08 00 00 00 ea
  //      d0 18 2d 51 e8 c7 6a 74 a1 cb c2 2f 98 31 d6 df 8c 26 52 ef 67 43 6e
  //      4b 10 46 2a be cb 66 e2 98 e8 b8 ff b2 11 dc f0 ab 6f 57 40 16 2d 6f
  //      ea c5 23 e9 50 80 f6 d7 d5 47 19 90 ea 9d cf aa 11 ee 90 e4 6d bb 55
  //      8b 2f e4 d6 00 16 92 4a 1b 34 df 81 17 17 48 9b ad 20 a0 09 ca 0d 2d
  //      71 57 73 80 48 56 2e d2 da ed 31 46 f5 9d 14 e7 00 00 00 00 00 00 00
  //      00 00 00 00 00 00 00} (length 0x101)
  //    }
  //    count: len = 0x101 (8 bytes)
  //  ]
  memcpy(
      (void*)0x200000000d40,
      "\x34\x34\x31\x30\x1d\x44\x34\x38\x30\x30\x30\x2c\x39\x36\x30\x30\x30\x00"
      "\xb8\x6e\x04\x84\xd7\xd8\x27\xd3\xb9\xa9\x1a\xed\x13\xfd\x06\x63\x9e\x0c"
      "\xa6\xb2\x06\x12\x5f\xd7\x8b\xe6\x87\xd5\x5c\xe0\xd7\x67\xf5\x4f\x6f\x28"
      "\x0a\x37\x00\x80\x6c\x26\x3b\xcc\xc3\xfb\x66\x07\x6e\x31\xca\x48\x6f\xe3"
      "\x82\x23\x41\x67\x1a\xc4\x7a\xbf\x01\x0a\x3f\xe2\xc2\x80\x81\x5c\x5d\x44"
      "\x70\xf0\xc8\xcf\x38\x42\x02\x00\x00\x00\x00\x00\x00\x00\x42\xda\x90\x08"
      "\x8a\x41\x16\xce\x6c\x3d\xf6\x07\xb4\xaa\x82\x79\xc5\x50\x00\x04\x1c\x0f"
      "\xc1\xde\xe2\xb8\x08\x00\x00\x00\xea\xd0\x18\x2d\x51\xe8\xc7\x6a\x74\xa1"
      "\xcb\xc2\x2f\x98\x31\xd6\xdf\x8c\x26\x52\xef\x67\x43\x6e\x4b\x10\x46\x2a"
      "\xbe\xcb\x66\xe2\x98\xe8\xb8\xff\xb2\x11\xdc\xf0\xab\x6f\x57\x40\x16\x2d"
      "\x6f\xea\xc5\x23\xe9\x50\x80\xf6\xd7\xd5\x47\x19\x90\xea\x9d\xcf\xaa\x11"
      "\xee\x90\xe4\x6d\xbb\x55\x8b\x2f\xe4\xd6\x00\x16\x92\x4a\x1b\x34\xdf\x81"
      "\x17\x17\x48\x9b\xad\x20\xa0\x09\xca\x0d\x2d\x71\x57\x73\x80\x48\x56\x2e"
      "\xd2\xda\xed\x31\x46\xf5\x9d\x14\xe7\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00",
      257);
  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000d40ul, /*count=*/0x101ul);
  return 0;
}