// https://syzkaller.appspot.com/bug?id=f6d2a8b4c634f8510cb37a7c592c3b7f1fc56a17
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <sys/types.h>

#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static unsigned long long procid;

static __thread int skip_segv;
static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
  uintptr_t addr = (uintptr_t)info->si_addr;
  const uintptr_t prog_start = 1 << 20;
  const uintptr_t prog_end = 100 << 20;
  if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
      (addr < prog_start || addr > prog_end)) {
    _longjmp(segv_env, 1);
  }
  exit(sig);
}

static void install_segv_handler(void)
{
  struct sigaction sa;
  memset(&sa, 0, sizeof(sa));
  sa.sa_sigaction = segv_handler;
  sa.sa_flags = SA_NODEFER | SA_SIGINFO;
  sigaction(SIGSEGV, &sa, NULL);
  sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...)                                                        \
  {                                                                            \
    __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
    if (_setjmp(segv_env) == 0) {                                              \
      __VA_ARGS__;                                                             \
    }                                                                          \
    __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
  }

static void kill_and_wait(int pid, int* status)
{
  kill(pid, SIGKILL);
  while (waitpid(-1, status, 0) != pid) {
  }
}

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void thread_start(void* (*fn)(void*), void* arg)
{
  pthread_t th;
  pthread_attr_t attr;
  pthread_attr_init(&attr);
  pthread_attr_setstacksize(&attr, 128 << 10);
  int i;
  for (i = 0; i < 100; i++) {
    if (pthread_create(&th, &attr, fn, arg) == 0) {
      pthread_attr_destroy(&attr);
      return;
    }
    if (errno == EAGAIN) {
      usleep(50);
      continue;
    }
    break;
  }
  exit(1);
}

typedef struct {
  pthread_mutex_t mu;
  pthread_cond_t cv;
  int state;
} event_t;

static void event_init(event_t* ev)
{
  if (pthread_mutex_init(&ev->mu, 0))
    exit(1);
  if (pthread_cond_init(&ev->cv, 0))
    exit(1);
  ev->state = 0;
}

static void event_reset(event_t* ev)
{
  ev->state = 0;
}

static void event_set(event_t* ev)
{
  pthread_mutex_lock(&ev->mu);
  if (ev->state)
    exit(1);
  ev->state = 1;
  pthread_mutex_unlock(&ev->mu);
  pthread_cond_broadcast(&ev->cv);
}

static void event_wait(event_t* ev)
{
  pthread_mutex_lock(&ev->mu);
  while (!ev->state)
    pthread_cond_wait(&ev->cv, &ev->mu);
  pthread_mutex_unlock(&ev->mu);
}

static int event_isset(event_t* ev)
{
  pthread_mutex_lock(&ev->mu);
  int res = ev->state;
  pthread_mutex_unlock(&ev->mu);
  return res;
}

static int event_timedwait(event_t* ev, uint64_t timeout)
{
  uint64_t start = current_time_ms();
  uint64_t now = start;
  pthread_mutex_lock(&ev->mu);
  for (;;) {
    if (ev->state)
      break;
    uint64_t remain = timeout - (now - start);
    struct timespec ts;
    ts.tv_sec = remain / 1000;
    ts.tv_nsec = (remain % 1000) * 1000 * 1000;
    pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
    now = current_time_ms();
    if (now - start > timeout)
      break;
  }
  int res = ev->state;
  pthread_mutex_unlock(&ev->mu);
  return res;
}

struct thread_t {
  int created, call;
  event_t ready, done;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
  struct thread_t* th = (struct thread_t*)arg;
  for (;;) {
    event_wait(&th->ready);
    event_reset(&th->ready);
    execute_call(th->call);
    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
    event_set(&th->done);
  }
  return 0;
}

static void execute_one(void)
{
  int i, call, thread;
  for (call = 0; call < 3; call++) {
    for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
         thread++) {
      struct thread_t* th = &threads[thread];
      if (!th->created) {
        th->created = 1;
        event_init(&th->ready);
        event_init(&th->done);
        event_set(&th->done);
        thread_start(thr, th);
      }
      if (!event_isset(&th->done))
        continue;
      event_reset(&th->done);
      th->call = call;
      __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
      event_set(&th->ready);
      event_timedwait(&th->done, 45);
      break;
    }
  }
  for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
    sleep_ms(1);
}

static void execute_one(void);

#define WAIT_FLAGS 0

static void loop(void)
{
  int iter;
  for (iter = 0;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5 * 1000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_call(int call)
{
  intptr_t res;
  switch (call) {
  case 0:
    NONFAILING(memcpy((void*)0x20000040, "/dev/pf\000", 8));
    res = syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000040ul, 1ul, 0ul);
    if (res != -1)
      r[0] = res;
    break;
  case 1:
    syscall(SYS_ioctl, r[0], 0xcbe04404ul, 0x20000000ul);
    break;
  case 2:
    NONFAILING(memcpy(
        (void*)0x20000740,
        "\xfd\x26\x7f\x58\xec\x4f\x82\x16\x85\xa9\x9a\x63\xfd\x78\x2e\xd5\xf1"
        "\xba\x31\xde\x5d\xfc\xb6\xaa\x37\x4b\xf8\x82\xba\x11\x29\x95\x51\xf2"
        "\x1b\x81\xf8\x5b\xa0\x87\xa0\xd0\xc1\xf9\x62\xd8\x0d\xfa\xb6\xab\x4b"
        "\xe9\xb2\x09\x15\xad\x1a\x7c\xe6\x3c\x3a\xf3\xa3\x46\x78\xa6\xd5\x84"
        "\x6b\xd3\x6c\xf4\xa5\x31\x81\x0d\x10\x58\xb0\x0a\x6e\x44\xf4\x86\x66"
        "\x62\x36\xb6\x76\xcd\x89\xb0\x94\x17\x57\xc6\x5a\x4a\x0a\x4d\xb4\x05"
        "\xd9\xf6\xeb\xfa\x89\xb9\x61\x4d\x32\x30\xb3\x2a\xd5\x97\x9b\x48\x1e"
        "\xcb\xaf\x0e\x95\xfd\xce\x6f\x6b\x84\x69\x0e\xfc\xb9\x48\xf3\xb9\xc4"
        "\x23\x2f\xfa\x72\x76\x95\xd4\x43\xee\xc8\xb0\xcd\x0e\xee\xc6\xb1\x04"
        "\x7c\x26\x51\xd7\x30\x5b\x61\x54\xa3\x28\x43\xb3\x35\x99\x15\xb1\x02"
        "\xb3\xe5\x9f\x8b\x4f\x1c\xde\xb1\x65\x81\xdb\x30\xbd\xfa\xc9\xb4\xbe"
        "\xc7\x03\x10\x83\x57\x57\xf3\x96\x82\x55\x7d\x21\x1b\x51\x83\x0f\xf3"
        "\xb1\x5d\xb0\x4e\xd1\x23\x4a\x68\x19\x6b\x36\x50\x48\x31\x88\x98\xf4"
        "\x85\x8e\xaa\x36\x49\xc6\xd6\xca\x51\x8a\x37\xbc\xee\xa3\x0a\xf2\xe6"
        "\x02\x66\x6d\xe7\xf3\x9c\x83\x7e\xb7\xd9\x34\x0b\x4c\xbc\x36\xcc\x74"
        "\x5d\x96\xa7\xf3\x9b\x01\xe6\x21\x70\x25\xfb\xea\x00\x23\x21\x02\xd8"
        "\x9f\x4d\xe0\xe7\x1d\xaf\x9b\x48\xa5\x9d\xca\x5f\x0a\x8c\x1a\xe6\x58"
        "\xcc\xfd\x0a\x92\x05\x10\x72\x86\xb9\x33\xad\xac\x8a\x10\x53\x02\x21"
        "\x7e\x07\x9e\x21\xfe\x97\x2d\x20\xf8\x5c\xf8\xc5\xfd\x44\xb2\x24\xa1"
        "\x62\x9b\x3d\xf2\x0a\x04\xfa\x52\x91\x02\xd0\xcb\x71\xa9\xeb\x08\x05"
        "\x4c\x4a\x5b\x8e\xdc\x0f\x5e\x61\xb0\xa4\xb0\x45\x69\x4f\x15\xd7\x25"
        "\x25\xa7\xf9\x6d\x0a\x79\x4e\xc6\x26\x09\x56\x1f\x3b\xeb\x82\x06\xbf"
        "\xa6\x02\x65\x9d\xb3\x6a\x34\xe2\x87\xc5\xd9\x37\x7b\x1c\x5e\xc8\xb7"
        "\xd2\x5b\xda\x14\xb3\xbb\xe5\x5b\x39\x66\x2e\x3d\xc5\x65\x35\x1e\xdb"
        "\x29\xe5\x7c\x87\x2e\x5a\x4b\xd7\xd8\xe5\x7e\xbf\xc3\x70\xbc\xaa\xcd"
        "\x8e\x43\xa0\x50\xa3\x4f\xfd\x10\xdd\x63\xe6\xbe\x6a\xa3\x54\x8c\xf1"
        "\x57\xc3\xb3\xb5\xf5\x51\x29\xf2\xed\x55\xf1\xf4\x6c\xb9\x34\x94\xaf"
        "\x3e\x56\xba\xfd\xf9\x21\x9b\x82\x1c\x83\x5a\x31\xa3\x9a\x1a\x54\xb1"
        "\x80\x23\xe0\x0a\x23\x73\x29\x70\x25\x7e\xce\xa3\x4b\xa2\xe7\xc4\xca"
        "\x54\xa9\x3d\xe3\x44\x42\xb7\x66\xdc\x69\x03\xfb\x04\x67\xca\x8e\x26"
        "\xe0\x1f\xb3\xc0\xf8\xb6\xdb\x31\x5f\xe9\x0c\xc7\x25\x4b\x20\xfa\x16"
        "\x03\xd0\xc0\xed\xdd\xa5\xde\x41\x1d\xc1\x89\x19\xe8\x22\x1d\x09\xca"
        "\x80\xf5\x0e\x1c\xdd\x13\x3b\x89\xb9\xb2\xd0\x52\xdb\x1c\x49\x40\xbc"
        "\x67\xa4\x21\x7e\x74\x81\x4a\xc7\xd1\xe4\x71\x85\x77\x5b\xa4\xab\xd5"
        "\x67\x79\xed\xad\x9b\x86\x6f\xa0\x51\xf7\x0b\x8f\xe5\x1f\xfb\x92\x08"
        "\xdc\x63\x76\xa8\xdd\x59\x93\xa9\x19\x35\x23\x6e\xc8\x98\x28\x43\xf5"
        "\x55\xce\x61\xe1\x37\x76\x73\x5c\xd9\xde\x7a\xa2\xff\x9a\x2d\x73\xd4"
        "\xdb\xd0\xde\x45\x66\x8d\x34\x5f\xef\xbb\x5b\x49\x3a\xbd\xe4\xde\xa6"
        "\x47\x46\xd2\x27\x96\x15\x43\x42\xdd\x3d\x70\x24\x21\x2d\x26\x74\x75"
        "\xd2\x4f\x41\x16\x4e\xa6\x5f\x2b\xd3\xdf\x3b\xb3\xa9\x98\xd2\x29\xc3"
        "\x0c\xaa\xf2\x8c\xe0\xde\x65\xba\x1b\xcc\x6b\xe5\x21\xf9\x26\x32\x77"
        "\x56\x3e\xd8\xb8\xa8\x69\xaa\x48\x1a\x2b\x17\xeb\x97\x61\x8e\x4e\x16"
        "\xab\xb8\x10\xe5\xe5\xa8\x7c\xfe\x89\x88\x9e\x10\xbf\x1c\xc7\xc9\x92"
        "\x7d\xad\xc2\x3e\x67\x07\x1e\x55\xcb\x0f\x3d\x1e\x55\xd3\x95\x8c\xcb"
        "\x47\x54\x66\xcf\xd3\xd4\x40\x38\x5f\xec\x2f\xd2\x20\x71\xf3\xbe\xf5"
        "\x25\xb5\xfd\xe1\x0b\x88\xf6\xec\x00\xf2\x1a\x05\xaf\xea\x06\x56\xde"
        "\x43\xbf\xd0\x19\x41\xd4\xe7\x98\x2c\x29\x9d\xca\x8e\x28\x5b\xa3\x51"
        "\x6e\xf6\x67\x43\x43\x5b\xc6\xf9\x93\xa0\xd0\x7d\xca\x46\xd2\x6b\xdb"
        "\xed\xcb\x5d\x28\x88\x14\x63\x84\xbb\x41\x4a\xc5\xd8\x69\xc7\x7f\x89"
        "\x83\x3e\x6f\x73\x08\xab\x3e\x39\x6b\xdb\xd7\x58\x88\xdd\xc9\x8c\x9f"
        "\x72\xeb\xf8\xa5\x86\xcf\x91\xbc\x5c\x87\xc4\x80\xed\x7b\xc7\xee\x2e"
        "\x0a\xc3\x84\xe6\xcd\xd9\x44\x93\xcd\x3b\x37\xfb\x0e\x16\x78\x0f\x60"
        "\xa4\xf1\x16\x07\x7e\x01\xd5\x7d\xe8\xf4\xc4\xd2\x6e\xfd\xa5\xc0\x78"
        "\xe4\x4e\x57\x98\x78\x13\x39\xbe\x6f\x42\xbe\x7c\xc8\x42\x5c\x06\xdd"
        "\x3e\x74\x67\xcb\x83\x8f\xda\x40\x86\x8f\x62\x12\x86\xbc\x6b\x18\x7f"
        "\x7a\xcc\xa1\xd3\x19\x1e\x71\xd1\xd5\xbf\xe8\x41\xff\xf3\xf3\x60\x06"
        "\xd3\x6b\x0c\xa2\x31\x91\x23\xce\x0a\x31\xa4\x90\x0b\xc8\xf3\x93\x3c"
        "\xf1\xa4\x04\xff\xc1\xfe\x89\xe6\x34\x9d\x32\xd7\x91\x99\xc6\x2c\x01"
        "\x81\xdf\x9b\x98\xab\xbe\xe0\xf7\x1b\xe8\x51\x56\xe2\x1a\xf6\xdb\x7d"
        "\x4e\x62\x08\xfb\xa4\x95\x45\xe3\xbb\x00\x2e\x18\x47\x3a\x4f\x1d\xba"
        "\x25\x93\x2c\x3f",
        1024));
    NONFAILING(memcpy(
        (void*)0x20000b40,
        "\x03\xa8\x1b\x96\xfc\x60\x63\x12\x44\x62\x44\x23\xc6\xdb\x44\xf1\x46"
        "\x60\x90\x54\x7f\x0c\x5d\x72\x9d\xbb\x4b\x2f\x6c\xb1\xbd\x6f",
        32));
    NONFAILING(*(uint32_t*)0x20000b60 = 3);
    NONFAILING(*(uint8_t*)0x20000b64 = 2);
    NONFAILING(*(uint64_t*)0x20000b68 = 0);
    NONFAILING(*(uint64_t*)0x20000b70 = 0x800);
    NONFAILING(*(uint64_t*)0x20000b78 = 0);
    NONFAILING(*(uint64_t*)0x20000b80 = 5);
    NONFAILING(*(uint64_t*)0x20000b88 = 7);
    NONFAILING(*(uint64_t*)0x20000b90 = 0xd36d);
    NONFAILING(*(uint64_t*)0x20000b98 = 6);
    NONFAILING(*(uint64_t*)0x20000ba0 = 0x10000);
    NONFAILING(*(uint32_t*)0x20000ba8 = 6);
    syscall(SYS_ioctl, -1, 0xc4504445ul, 0x20000740ul);
    break;
  }
}
int main(void)
{
  syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
  install_segv_handler();
  for (procid = 0; procid < 4; procid++) {
    if (fork() == 0) {
      loop();
    }
  }
  sleep(1000000);
  return 0;
}