// https://syzkaller.appspot.com/bug?id=4c80b6d2eb7aea5223a16d805f19847abd5cd5b9
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#define SIZEOF_IO_URING_SQE 64
#define SIZEOF_IO_URING_CQE 16
#define SQ_HEAD_OFFSET 0
#define SQ_TAIL_OFFSET 64
#define SQ_RING_MASK_OFFSET 256
#define SQ_RING_ENTRIES_OFFSET 264
#define SQ_FLAGS_OFFSET 276
#define SQ_DROPPED_OFFSET 272
#define CQ_HEAD_OFFSET 128
#define CQ_TAIL_OFFSET 192
#define CQ_RING_MASK_OFFSET 260
#define CQ_RING_ENTRIES_OFFSET 268
#define CQ_RING_OVERFLOW_OFFSET 284
#define CQ_FLAGS_OFFSET 280
#define CQ_CQES_OFFSET 320

struct io_uring_cqe {
  uint64_t user_data;
  uint32_t res;
  uint32_t flags;
};

static long syz_io_uring_complete(volatile long a0)
{
  char* ring_ptr = (char*)a0;
  uint32_t cq_ring_mask = *(uint32_t*)(ring_ptr + CQ_RING_MASK_OFFSET);
  uint32_t* cq_head_ptr = (uint32_t*)(ring_ptr + CQ_HEAD_OFFSET);
  uint32_t cq_head = *cq_head_ptr & cq_ring_mask;
  uint32_t cq_head_next = *cq_head_ptr + 1;
  char* cqe_src = ring_ptr + CQ_CQES_OFFSET + cq_head * SIZEOF_IO_URING_CQE;
  struct io_uring_cqe cqe;
  memcpy(&cqe, cqe_src, sizeof(cqe));
  __atomic_store_n(cq_head_ptr, cq_head_next, __ATOMIC_RELEASE);
  return (cqe.user_data == 0x12345 || cqe.user_data == 0x23456) ? (long)cqe.res
                                                                : (long)-1;
}

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  intptr_t res = 0;
  *(uint64_t*)0x20000000 = 0xa6d8;
  res = syscall(__NR_signalfd, -1, 0x20000000ul, 8ul);
  if (res != -1)
    r[0] = res;
  *(uint64_t*)0x200001c0 = 3;
  syscall(__NR_ioctl, r[0], 0x5452, 0x200001c0ul);
  syscall(__NR_fcntl, r[0], 8ul, -1);
  syz_io_uring_complete(0);
  return 0;
}