// https://syzkaller.appspot.com/bug?id=5735d842f7ea3ed9220aca64952ac4aba7ba741c
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stdio.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/sysmacros.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}
#include <errno.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

static void fail(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

static void use_temporary_dir()
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    fail("failed to mkdtemp");
  if (chmod(tmpdir, 0777))
    fail("failed to chmod");
  if (chdir(tmpdir))
    fail("failed to chdir");
}

static uintptr_t syz_fuse_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2,
                                uintptr_t a3, uintptr_t a4, uintptr_t a5)
{
  uint64_t target = a0;
  uint64_t mode = a1;
  uint64_t uid = a2;
  uint64_t gid = a3;
  uint64_t maxread = a4;
  uint64_t flags = a5;

  int fd = open("/dev/fuse", O_RDWR);
  if (fd == -1)
    return fd;
  char buf[1024];
  sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid,
          (long)gid, (unsigned)mode & ~3u);
  if (maxread != 0)
    sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread);
  if (mode & 1)
    strcat(buf, ",default_permissions");
  if (mode & 2)
    strcat(buf, ",allow_other");
  syscall(SYS_mount, "", target, "fuse", flags, buf);
  return fd;
}

static void execute_one();
extern unsigned long long procid;

void loop()
{
  while (1) {
    execute_one();
  }
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_one()
{
  long res = 0;
  res = syscall(__NR_socket, 0xa, 3, 0x4d);
  if (res != -1)
    r[0] = res;
  res = syscall(__NR_socket, 0x10, 3, 6);
  if (res != -1)
    r[1] = res;
  *(uint16_t*)0x20000080 = 0x10;
  *(uint16_t*)0x20000082 = 0;
  *(uint32_t*)0x20000084 = 0;
  *(uint32_t*)0x20000088 = 1;
  syscall(__NR_bind, r[1], 0x20000080, 0xc);
  *(uint8_t*)0x200001c0 = 0xfe;
  *(uint8_t*)0x200001c1 = 0x80;
  *(uint8_t*)0x200001c2 = 0;
  *(uint8_t*)0x200001c3 = 0;
  *(uint8_t*)0x200001c4 = 0;
  *(uint8_t*)0x200001c5 = 0;
  *(uint8_t*)0x200001c6 = 0;
  *(uint8_t*)0x200001c7 = 0;
  *(uint8_t*)0x200001c8 = 0;
  *(uint8_t*)0x200001c9 = 0;
  *(uint8_t*)0x200001ca = 0;
  *(uint8_t*)0x200001cb = 0;
  *(uint8_t*)0x200001cc = 0;
  *(uint8_t*)0x200001cd = 0;
  *(uint8_t*)0x200001ce = 0;
  *(uint8_t*)0x200001cf = 0xbb;
  *(uint8_t*)0x200001d0 = -1;
  *(uint8_t*)0x200001d1 = 1;
  *(uint8_t*)0x200001d2 = 0;
  *(uint8_t*)0x200001d3 = 0;
  *(uint8_t*)0x200001d4 = 0;
  *(uint8_t*)0x200001d5 = 0;
  *(uint8_t*)0x200001d6 = 0;
  *(uint8_t*)0x200001d7 = 0;
  *(uint8_t*)0x200001d8 = 0;
  *(uint8_t*)0x200001d9 = 0;
  *(uint8_t*)0x200001da = 0;
  *(uint8_t*)0x200001db = 0;
  *(uint8_t*)0x200001dc = 0;
  *(uint8_t*)0x200001dd = 0;
  *(uint8_t*)0x200001de = 0;
  *(uint8_t*)0x200001df = 1;
  *(uint16_t*)0x200001e0 = htobe16(0);
  *(uint16_t*)0x200001e2 = htobe16(0);
  *(uint16_t*)0x200001e4 = htobe16(0);
  *(uint16_t*)0x200001e6 = htobe16(0);
  *(uint16_t*)0x200001e8 = 0xa;
  *(uint8_t*)0x200001ea = 0;
  *(uint8_t*)0x200001eb = 0;
  *(uint8_t*)0x200001ec = 0;
  *(uint32_t*)0x200001f0 = 0;
  *(uint32_t*)0x200001f4 = 0;
  *(uint64_t*)0x200001f8 = 0;
  *(uint64_t*)0x20000200 = 0;
  *(uint64_t*)0x20000208 = 0;
  *(uint64_t*)0x20000210 = 0;
  *(uint64_t*)0x20000218 = 0;
  *(uint64_t*)0x20000220 = 0;
  *(uint64_t*)0x20000228 = 0;
  *(uint64_t*)0x20000230 = 0;
  *(uint64_t*)0x20000238 = 0;
  *(uint64_t*)0x20000240 = 0;
  *(uint64_t*)0x20000248 = 0;
  *(uint64_t*)0x20000250 = 0;
  *(uint32_t*)0x20000258 = 0;
  *(uint32_t*)0x2000025c = 0;
  *(uint8_t*)0x20000260 = 1;
  *(uint8_t*)0x20000261 = 0;
  *(uint8_t*)0x20000262 = 0;
  *(uint8_t*)0x20000263 = 0;
  *(uint64_t*)0x20000268 = htobe64(0);
  *(uint64_t*)0x20000270 = htobe64(1);
  *(uint32_t*)0x20000278 = htobe32(0);
  *(uint8_t*)0x2000027c = 0x2b;
  *(uint16_t*)0x20000280 = 2;
  *(uint32_t*)0x20000284 = htobe32(-1);
  *(uint32_t*)0x20000294 = 0;
  *(uint8_t*)0x20000298 = 0xfe;
  *(uint8_t*)0x20000299 = 0;
  *(uint8_t*)0x2000029a = 9;
  *(uint32_t*)0x2000029c = 0;
  *(uint32_t*)0x200002a0 = 0;
  *(uint32_t*)0x200002a4 = 0;
  syscall(__NR_setsockopt, r[0], 0x29, 0x23, 0x200001c0, 0xe8);
  *(uint16_t*)0x200000c0 = 0xa;
  *(uint16_t*)0x200000c2 = htobe16(0);
  *(uint32_t*)0x200000c4 = 1;
  *(uint8_t*)0x200000c8 = 0xfe;
  *(uint8_t*)0x200000c9 = 0x80;
  *(uint8_t*)0x200000ca = 0;
  *(uint8_t*)0x200000cb = 0;
  *(uint8_t*)0x200000cc = 0;
  *(uint8_t*)0x200000cd = 0;
  *(uint8_t*)0x200000ce = 0;
  *(uint8_t*)0x200000cf = 0;
  *(uint8_t*)0x200000d0 = 0;
  *(uint8_t*)0x200000d1 = 0;
  *(uint8_t*)0x200000d2 = 0;
  *(uint8_t*)0x200000d3 = 0;
  *(uint8_t*)0x200000d4 = 0;
  *(uint8_t*)0x200000d5 = 0;
  *(uint8_t*)0x200000d6 = 0;
  *(uint8_t*)0x200000d7 = 0xbb;
  *(uint32_t*)0x200000d8 = 5;
  syscall(__NR_connect, r[0], 0x200000c0, 0x1c);
  syscall(__NR_ioctl, -1, 0x5601, 0x20000040);
  *(uint64_t*)0x20000d80 = 0x20000ac0;
  *(uint32_t*)0x20000d88 = 0x80;
  *(uint64_t*)0x20000d90 = 0x20000d40;
  *(uint64_t*)0x20000d98 = 0;
  *(uint64_t*)0x20000da0 = 0;
  *(uint64_t*)0x20000da8 = 0;
  *(uint32_t*)0x20000db0 = 0;
  syscall(__NR_recvmsg, -1, 0x20000d80, 0);
  memcpy((void*)0x2053bff8, "./file0", 8);
  syscall(__NR_mkdir, 0x2053bff8, 0);
  memcpy((void*)0x20000180, "./file0", 8);
  syz_fuse_mount(0x20000180, 0x4000, 0, 0, 0, 0);
}

int main()
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  char* cwd = get_current_dir_name();
  for (;;) {
    if (chdir(cwd))
      fail("failed to chdir");
    use_temporary_dir();
    loop();
  }
}