// https://syzkaller.appspot.com/bug?id=059cee5623ce519359e7440ba6d0d6af8b82694e
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}
#include <errno.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

static void fail(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

#define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1)

#define BITMASK_LEN_OFF(type, bf_off, bf_len)                                  \
  (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))

#define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len)                      \
  if ((bf_off) == 0 && (bf_len) == 0) {                                        \
    *(type*)(addr) = (type)(val);                                              \
  } else {                                                                     \
    type new_val = *(type*)(addr);                                             \
    new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len));                     \
    new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off);          \
    *(type*)(addr) = new_val;                                                  \
  }

static uint64_t current_time_ms()
{
  struct timespec ts;

  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    fail("clock_gettime failed");
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void execute_one();
extern unsigned long long procid;

static void loop()
{
  int iter;
  for (iter = 0;; iter++) {
    int pid = fork();
    if (pid < 0)
      fail("clone failed");
    if (pid == 0) {
      prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
      setpgrp();
      execute_one();
      int fd;
      for (fd = 3; fd < 30; fd++)
        close(fd);
      doexit(0);
    }

    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      int res = waitpid(-1, &status, __WALL | WNOHANG);
      if (res == pid) {
        break;
      }
      usleep(1000);
      if (current_time_ms() - start < 5 * 1000)
        continue;
      kill(-pid, SIGKILL);
      kill(pid, SIGKILL);
      while (waitpid(-1, &status, __WALL) != pid) {
      }
      break;
    }
  }
}

#ifndef __NR_bpf
#define __NR_bpf 321
#endif
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
void execute_one()
{
  long res = 0;
  syscall(__NR_write, -1, 0x200003c0, 0);
  memcpy((void*)0x20000100, "./file0", 8);
  memcpy((void*)0x20000140, "user.", 5);
  memcpy((void*)0x20000145, "cgroup.", 8);
  memcpy((void*)0x200002c0, "ext4", 5);
  syscall(__NR_lsetxattr, 0x20000100, 0x20000140, 0x200002c0, 5, 0);
  *(uint8_t*)0x20000040 = 0;
  *(uint8_t*)0x20000041 = 0;
  *(uint8_t*)0x20000042 = 0;
  STORE_BY_BITMASK(uint8_t, 0x20000043, 0, 0, 1);
  STORE_BY_BITMASK(uint8_t, 0x20000043, 0, 1, 2);
  STORE_BY_BITMASK(uint8_t, 0x20000043, 0, 3, 5);
  *(uint32_t*)0x20000044 = 0;
  syscall(__NR_setsockopt, -1, 0x29, 0x36, 0x20000040, 8);
  *(uint32_t*)0x20000200 = 0xc;
  *(uint32_t*)0x20000204 = 0xe;
  *(uint64_t*)0x20000208 = 0x20000000;
  memcpy((void*)0x20000000,
         "\xb7\x02\x00\x00\x02\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07"
         "\x03\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4"
         "\xf0\xff\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05"
         "\x00\x00\x00\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00"
         "\x01\x00\x00\x00\xb7\x03\x00\x00\x00\x00\x00\x00\x6a\x0a\x00\xfe\x00"
         "\x00\x00\x00\x85\x00\x00\x00\x2b\x00\x00\x00\xb7\x00\x00\x00\x00\x00"
         "\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00",
         112);
  *(uint64_t*)0x20000210 = 0x20000340;
  memcpy((void*)0x20000340, "syzkaller", 10);
  *(uint32_t*)0x20000218 = 0;
  *(uint32_t*)0x2000021c = 0;
  *(uint64_t*)0x20000220 = 0;
  *(uint32_t*)0x20000228 = 0;
  *(uint32_t*)0x2000022c = 0;
  *(uint8_t*)0x20000230 = 0;
  *(uint8_t*)0x20000231 = 0;
  *(uint8_t*)0x20000232 = 0;
  *(uint8_t*)0x20000233 = 0;
  *(uint8_t*)0x20000234 = 0;
  *(uint8_t*)0x20000235 = 0;
  *(uint8_t*)0x20000236 = 0;
  *(uint8_t*)0x20000237 = 0;
  *(uint8_t*)0x20000238 = 0;
  *(uint8_t*)0x20000239 = 0;
  *(uint8_t*)0x2000023a = 0;
  *(uint8_t*)0x2000023b = 0;
  *(uint8_t*)0x2000023c = 0;
  *(uint8_t*)0x2000023d = 0;
  *(uint8_t*)0x2000023e = 0;
  *(uint8_t*)0x2000023f = 0;
  *(uint32_t*)0x20000240 = 0;
  *(uint32_t*)0x20000244 = 0;
  res = syscall(__NR_bpf, 5, 0x20000200, 0x48);
  if (res != -1)
    r[0] = res;
  *(uint32_t*)0x20000140 = r[0];
  *(uint32_t*)0x20000144 = 0;
  *(uint32_t*)0x20000148 = 0xe;
  *(uint32_t*)0x2000014c = 0xe4;
  *(uint64_t*)0x20000150 = 0x20000080;
  memcpy((void*)0x20000080,
         "\x2e\x1e\x6c\x22\xc5\xcf\x50\x77\x21\xc8\x22\xa5\x4a\x75", 14);
  *(uint64_t*)0x20000158 = 0x20000380;
  *(uint32_t*)0x20000160 = -1;
  *(uint32_t*)0x20000164 = 0;
  syscall(__NR_bpf, 0xa, 0x20000140, 0x28);
  res = syscall(__NR_socket, 0x28, 1, 0);
  if (res != -1)
    r[1] = res;
  syscall(__NR_mmap, 0x20ffd000, 0x2000, 0x1000000, 0x110, r[1], 0);
  *(uint64_t*)0x20001000 = 0;
  syscall(__NR_sendfile, -1, -1, 0x20001000, 0x400000000fee);
  syscall(__NR_msgctl, 0, 0xb, 0x20000280);
  *(uint32_t*)0x20000140 = -1;
  syscall(__NR_write, -1, 0x20000140, 0xfffffdf5);
  *(uint64_t*)0x200000c0 = 0x20000080;
  *(uint16_t*)0x20000080 = 0x10;
  *(uint16_t*)0x20000082 = 0xf50c;
  *(uint32_t*)0x20000084 = 0;
  *(uint32_t*)0x20000088 = 0;
  *(uint32_t*)0x200000c8 = 0xc;
  *(uint64_t*)0x200000d0 = 0x20000100;
  *(uint64_t*)0x20000100 = 0x20000040;
  *(uint32_t*)0x20000040 = 0x20;
  *(uint16_t*)0x20000044 = 0x27;
  *(uint16_t*)0x20000046 = 1;
  *(uint32_t*)0x20000048 = 0;
  *(uint32_t*)0x2000004c = 0;
  *(uint8_t*)0x20000050 = 0xc;
  *(uint8_t*)0x20000051 = 0;
  *(uint16_t*)0x20000052 = 0;
  *(uint16_t*)0x20000054 = 0xc;
  *(uint16_t*)0x20000056 = 5;
  *(uint64_t*)0x20000058 = 0;
  *(uint64_t*)0x20000108 = 0x20;
  *(uint64_t*)0x200000d8 = 1;
  *(uint64_t*)0x200000e0 = 0;
  *(uint64_t*)0x200000e8 = 0;
  *(uint32_t*)0x200000f0 = 0;
  syscall(__NR_sendmsg, -1, 0x200000c0, 0);
  *(uint64_t*)0x20000800 = 0x200000c0;
  *(uint32_t*)0x20000808 = 0;
  *(uint64_t*)0x20000810 = 0x20000940;
  *(uint64_t*)0x20000940 = 0x20000880;
  *(uint64_t*)0x20000948 = 0;
  *(uint64_t*)0x20000818 = 0;
  *(uint64_t*)0x20000820 = 0x20000680;
  *(uint64_t*)0x20000828 = 0;
  *(uint32_t*)0x20000830 = 0;
  *(uint32_t*)0x20000838 = 0;
  *(uint64_t*)0x20000840 = 0;
  *(uint32_t*)0x20000848 = 0;
  *(uint64_t*)0x20000850 = 0x200007c0;
  *(uint64_t*)0x200007c0 = 0x20000700;
  *(uint64_t*)0x200007c8 = 0;
  *(uint64_t*)0x20000858 = 0x3c3;
  *(uint64_t*)0x20000860 = 0;
  *(uint64_t*)0x20000868 = 0;
  *(uint32_t*)0x20000870 = 0;
  *(uint32_t*)0x20000878 = 3;
  syscall(__NR_recvmmsg, -1, 0x20000800, 0x4000000000000eb, 0, 0);
  *(uint32_t*)0x20000200 = 2;
  *(uint32_t*)0x20000204 = 0x70;
  *(uint8_t*)0x20000208 = 0xe6;
  *(uint8_t*)0x20000209 = 0;
  *(uint8_t*)0x2000020a = 0;
  *(uint8_t*)0x2000020b = 0;
  *(uint32_t*)0x2000020c = 0;
  *(uint64_t*)0x20000210 = 0;
  *(uint64_t*)0x20000218 = 0;
  *(uint64_t*)0x20000220 = 0;
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 0, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 1, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 2, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 3, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 4, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 5, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 6, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 7, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 8, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 9, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 10, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 11, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 12, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 13, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 14, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 15, 2);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 17, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 18, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 19, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 20, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 21, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 22, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 23, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 24, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 25, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 26, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 27, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 28, 1);
  STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 29, 35);
  *(uint32_t*)0x20000230 = 0;
  *(uint32_t*)0x20000234 = 0;
  *(uint64_t*)0x20000238 = 0;
  *(uint64_t*)0x20000240 = 0;
  *(uint64_t*)0x20000248 = 0;
  *(uint64_t*)0x20000250 = 0;
  *(uint32_t*)0x20000258 = 0;
  *(uint32_t*)0x2000025c = 0;
  *(uint64_t*)0x20000260 = 0;
  *(uint32_t*)0x20000268 = 0;
  *(uint16_t*)0x2000026c = 0;
  *(uint16_t*)0x2000026e = 0;
  syscall(__NR_perf_event_open, 0x20000200, 0, 0, -1, 0);
  syscall(__NR_socket, 0, 0, 0);
  syscall(__NR_dup, -1);
  syscall(__NR_sendmmsg, -1, 0x20005240, 0, 0);
  *(uint64_t*)0x20004e40 = 0x20000000;
  *(uint32_t*)0x20004e48 = 0x80;
  *(uint64_t*)0x20004e50 = 0x200006c0;
  *(uint64_t*)0x20004e58 = 0;
  *(uint64_t*)0x20004e60 = 0x20000080;
  *(uint64_t*)0x20004e68 = 9;
  *(uint32_t*)0x20004e70 = 0;
  *(uint32_t*)0x20004e78 = 0;
  *(uint64_t*)0x200050c0 = 0x77359400;
  *(uint64_t*)0x200050c8 = 0;
  syscall(__NR_recvmmsg, -1, 0x20004e40, 0x37a, 0, 0x200050c0);
  memcpy((void*)0x200000c0, "./file0", 8);
  memcpy((void*)0x20000340, "9p", 3);
  memcpy((void*)0x200001c0, "trans=fd,", 9);
  memcpy((void*)0x200001c9, "rfdno", 5);
  *(uint8_t*)0x200001ce = 0x3d;
  sprintf((char*)0x200001cf, "0x%016llx", (long long)-1);
  *(uint8_t*)0x200001e1 = 0x2c;
  memcpy((void*)0x200001e2, "wfdno", 5);
  *(uint8_t*)0x200001e7 = 0x3d;
  sprintf((char*)0x200001e8, "0x%016llx", (long long)-1);
  *(uint8_t*)0x200001fa = 0x2c;
  *(uint8_t*)0x200001fb = 0;
  syscall(__NR_mount, 0, 0x200000c0, 0x20000340, 0, 0x200001c0);
  res = syscall(__NR_socket, 0xa, 0x2000000000001, 0);
  if (res != -1)
    r[2] = res;
  syscall(__NR_socket, 0xa, 0x1000000000002, 0);
  *(uint8_t*)0x20000040 = 0;
  *(uint8_t*)0x20000041 = 0;
  *(uint8_t*)0x20000042 = 0;
  STORE_BY_BITMASK(uint8_t, 0x20000043, 0, 0, 1);
  STORE_BY_BITMASK(uint8_t, 0x20000043, 0, 1, 2);
  STORE_BY_BITMASK(uint8_t, 0x20000043, 0, 3, 5);
  *(uint32_t*)0x20000044 = 0;
  syscall(__NR_setsockopt, r[2], 0x29, 0x36, 0x20000040, 8);
  *(uint16_t*)0x20402000 = 0xa;
  *(uint16_t*)0x20402002 = htobe16(0x4e20);
  *(uint32_t*)0x20402004 = 0;
  *(uint64_t*)0x20402008 = htobe64(0);
  *(uint64_t*)0x20402010 = htobe64(1);
  *(uint32_t*)0x20402018 = 0;
  syscall(__NR_bind, r[2], 0x20402000, 0x1c);
  *(uint16_t*)0x200001c0 = 0xa;
  *(uint16_t*)0x200001c2 = htobe16(0x4e20);
  *(uint32_t*)0x200001c4 = 0;
  *(uint64_t*)0x200001c8 = htobe64(0);
  *(uint64_t*)0x200001d0 = htobe64(1);
  *(uint32_t*)0x200001d8 = 0;
  syscall(__NR_sendto, r[2], 0x207a8fff, 0x3a7, 0x20000000, 0x200001c0, 0x1c);
  syscall(__NR_setsockopt, -1, 1, 9, 0x20000040, 0);
  memcpy((void*)0x200000c0,
         "wlan1*{em0vboxnet1Uvboxnet0Jvboxnet0,em0cpusetem1}-:", 53);
  syscall(__NR_memfd_create, 0x200000c0, 1);
  memcpy((void*)0x20000140,
         "\x62\x72\x69\x64\x67\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00",
         16);
  *(uint16_t*)0x20000150 = 0;
  syscall(__NR_ioctl, -1, 0x89a1, 0x20000140);
  memcpy((void*)0x20000000, "/dev/audio", 11);
  syscall(__NR_openat, 0xffffffffffffff9c, 0x20000000, 0x800, 0);
  *(uint32_t*)0x200039c0 = 0x80;
  syscall(__NR_getsockname, -1, 0x20003940, 0x200039c0);
}

int main()
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  for (;;) {
    loop();
  }
}