// https://syzkaller.appspot.com/bug?id=90a60ac9052c9528d51de6882cfb71ce76234884
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <errno.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/genetlink.h>
#include <linux/netlink.h>

static long syz_genetlink_get_family_id(volatile long name)
{
  char buf[512] = {0};
  struct nlmsghdr* hdr = (struct nlmsghdr*)buf;
  struct genlmsghdr* genlhdr = (struct genlmsghdr*)NLMSG_DATA(hdr);
  struct nlattr* attr = (struct nlattr*)(genlhdr + 1);
  hdr->nlmsg_len =
      sizeof(*hdr) + sizeof(*genlhdr) + sizeof(*attr) + GENL_NAMSIZ;
  hdr->nlmsg_type = GENL_ID_CTRL;
  hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
  genlhdr->cmd = CTRL_CMD_GETFAMILY;
  attr->nla_type = CTRL_ATTR_FAMILY_NAME;
  attr->nla_len = sizeof(*attr) + GENL_NAMSIZ;
  strncpy((char*)(attr + 1), (char*)name, GENL_NAMSIZ);
  struct iovec iov = {hdr, hdr->nlmsg_len};
  struct sockaddr_nl addr = {0};
  addr.nl_family = AF_NETLINK;
  int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
  if (fd == -1) {
    return -1;
  }
  struct msghdr msg = {&addr, sizeof(addr), &iov, 1, NULL, 0, 0};
  if (sendmsg(fd, &msg, 0) == -1) {
    close(fd);
    return -1;
  }
  ssize_t n = recv(fd, buf, sizeof(buf), 0);
  close(fd);
  if (n <= 0) {
    return -1;
  }
  if (hdr->nlmsg_type != GENL_ID_CTRL) {
    return -1;
  }
  for (; (char*)attr < buf + n;
       attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
    if (attr->nla_type == CTRL_ATTR_FAMILY_ID)
      return *(uint16_t*)(attr + 1);
  }
  return -1;
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  intptr_t res = 0;
  res = syscall(__NR_socket, 0x10, 3, 0x10);
  if (res != -1)
    r[0] = res;
  memcpy((void*)0x200000c0, "TIPC\000", 5);
  res = syz_genetlink_get_family_id(0x200000c0);
  if (res != -1)
    r[1] = res;
  *(uint64_t*)0x200002c0 = 0;
  *(uint32_t*)0x200002c8 = 0;
  *(uint64_t*)0x200002d0 = 0x20000040;
  *(uint64_t*)0x20000040 = 0x20000480;
  memcpy((void*)0x20000480, "h\000\000\000", 4);
  *(uint16_t*)0x20000484 = r[1];
  memcpy(
      (void*)0x20000486,
      "\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
      "\x09\x41\x00\x00\x00\x4c\x00\x18\x00\x00\x00\x1f\x62\x72\x6f\x61\x64\x63"
      "\x61\x73\x74\x2d\x6c\x69\x6e\x6b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x83\xa0\xd9\xeb\x72"
      "\x57\xa7\x6d\x89\x9e\x8d\x5b\xd8\xf3\xe9\xd5\xc9\x1e\xe3\x44\xcd\xf5\x8f"
      "\xa6\x40\x0b\x33\xf9\xbc\x23\x88\x07\xbe\x3b\xed\x85\x10\xa5\xb5\xc4\x92"
      "\xf6\x04\x1a\x9a\x5d\x9c\x85\xdf\x03\x1e\x1b\xe1\xae\x88\x5c\x9e\x44\x73"
      "\x85\x4d\xdd\xbe\xa5\x81\x37\xc8\x7b\xc3\x94\x49\x0e\xd2\xfb\x72\x22\x12"
      "\xef\xb0\xec\x5e\x20\xa6\x60\x51\xb6\x69\xfe\x40\x43\xbe\xc0\xa2\x57\xf7"
      "\x07\x02\xfb\x21\xc1\x0b\x9c\xba\x9b\xed\x88\x10\x7a\xfb\x50\x56\xee\x60"
      "\xe3\x40\xe4\x8a\xff\x5a\x7d\xf3\xf9\xd5\x70\x2e\x8c\x94\x51\x6a\xca\x87"
      "\x8c\xd8\x4b\x34\x26\x58\xf9\x5b\x45\x12\xd2\x70\x3d\xf2\x3d\x1d\x1e\xdf"
      "\xae\x71\x88\x77\x9c\x43\xd6\x60\x1e\xe2\x08\x46\xf1\x61\xc5\x0b\x7c\xbf"
      "\xf3\x83\x32\xa8\x92\x26\x08\xd0\xf8\x7b\x58\x1a\xd7\x2d\x39\x80\x10\x61"
      "\x73\x51\xa8\x95\xa4\xd3\xd2\xbd\x15\x85\x13\x46\xf5\x8a\xfc\x16\x6a\xb4"
      "\xe6\x0c\xb0\xf4\xb2\xa0\xca\x47\x6e\x0d\x2e\x2c\x47\xca\x55\x9d\x1d\x0a"
      "\xfc\xb5\x13\xd3\x54\xd9\xe7\xad\x8f\x62\x3e\x4c\x26\x19\xa9\xad\x74\x42"
      "\xda\xd5\xdb\x24\x87\x3f\xcb\xa6\x55\x11\x2f\x1b\x2b\x7e\x90\xf7\x43\x0c"
      "\x7f\x1b\x56\x6c\x72\x7f\x21\xe2\x3f\xe4\x2d\x2f\xb0\x8b\xa2\xee\x63\xb2"
      "\x84\xb9\xa7\x50\x07\x67\xf2\x4d\xbd\xae\x6a\xd6\xe9\x11\xc0\xab\xb0\x6d"
      "\x88\xd5\x73\x35\x06\x1d\xf7\x00\x84\x31\x72\xca\x02\x88\x09\x75\xed\xb9"
      "\xb8\xd9\x56\xd3\xb6\x1c\x17\x86\x13\xc8\x44\x82\x5a\x26\xe9\x97\xe8\xb3"
      "\x19\x01\x7a\x43\x70\xb8\x8e\x75\xdb\x1d\xaa\xd4\xfc\x40\xa6\x5a\x84\x01"
      "\xc8\xff\xfa\x07\xfb\x8b\x0b\x02\xd5\x73\x2c\x1b\x6a\x93\x2f\x77\x8a\x01"
      "\x2e\x27\x9b\xda\x0c\xe7\x8f\xf0\xa7\x34\x08\xf8\xa9\xd7\x20\xb8\x59\x10"
      "\xf0\xff\xff\x9b\x37\x31\xa1\xd0\x99\x25\x75\xc5\x31\x6d\x29\xd9\x04\x84"
      "\x3a\x9f\x84\x9a\x18\x3e\x49\xa5\xee\x67\xe3\x4f\xd6\xec\x25\x60\x64\x62"
      "\x16\xd5\xdd\xd1\x2c\x4f\xeb\x0f\xaa\x5a\xab\x94\xb9\x04\x40\x4a\x0e\x26"
      "\xde\x9e\x90\xa7\x56\x72\xe9\x9d\x04\x88\xa7\xbc\x98\x20\xb9\x26\xd9\x0e"
      "\x05\xe8\x11\x97\xc6\x2c\x3b\x6f\xf1\xfe\xe1\x40\x31\x83\xf4\x9a\x76\x20"
      "\xaf\x75\x71\x4b\x7d\xda\xd5\x1c\x5f\x45\x90\x6d\x12\x00\xb0\xa5\xe0\xd0"
      "\x27\xdf\x64\xf3\xed\x7a\x11",
      583);
  *(uint64_t*)0x20000048 = 0x68;
  *(uint64_t*)0x200002d8 = 1;
  *(uint64_t*)0x200002e0 = 0;
  *(uint64_t*)0x200002e8 = 0;
  *(uint32_t*)0x200002f0 = 0;
  syscall(__NR_sendmsg, r[0], 0x200002c0, 0);
  return 0;
}