// https://syzkaller.appspot.com/bug?id=e6d1ed219bd92dd9b3e653eda032852996a9b457
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <pthread.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

static uintptr_t syz_open_procfs(uintptr_t a0, uintptr_t a1)
{

  char buf[128];
  memset(buf, 0, sizeof(buf));
  if (a0 == 0) {
    snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1);
  } else if (a0 == (uintptr_t)-1) {
    snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1);
  } else {
    snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0, (char*)a1);
  }
  int fd = open(buf, O_RDWR);
  if (fd == -1)
    fd = open(buf, O_RDONLY);
  return fd;
}

struct thread_t {
  int created, running, call;
  pthread_t th;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
  struct thread_t* th = (struct thread_t*)arg;
  for (;;) {
    while (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE))
      syscall(SYS_futex, &th->running, FUTEX_WAIT, 0, 0);
    execute_call(th->call);
    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
    __atomic_store_n(&th->running, 0, __ATOMIC_RELEASE);
    syscall(SYS_futex, &th->running, FUTEX_WAKE);
  }
  return 0;
}

static void execute(int num_calls)
{
  int call, thread;
  running = 0;
  for (call = 0; call < num_calls; call++) {
    for (thread = 0; thread < sizeof(threads) / sizeof(threads[0]); thread++) {
      struct thread_t* th = &threads[thread];
      if (!th->created) {
        th->created = 1;
        pthread_attr_t attr;
        pthread_attr_init(&attr);
        pthread_attr_setstacksize(&attr, 128 << 10);
        pthread_create(&th->th, &attr, thr, th);
      }
      if (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) {
        th->call = call;
        __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
        __atomic_store_n(&th->running, 1, __ATOMIC_RELEASE);
        syscall(SYS_futex, &th->running, FUTEX_WAKE);
        struct timespec ts;
        ts.tv_sec = 0;
        ts.tv_nsec = 20 * 1000 * 1000;
        syscall(SYS_futex, &th->running, FUTEX_WAIT, 1, &ts);
        if (running)
          usleep((call == num_calls - 1) ? 10000 : 1000);
        break;
      }
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};
void execute_call(int call)
{
  long res;
  switch (call) {
  case 0:
    memcpy((void*)0x200000c0,
           "\x2f\x65\x78\x65\x00\x00\x00\x00\x00\x04\x09\x00\x4b\xdd\xd9\xde"
           "\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0f\x79\x80\x58\x43\x9e\xd5"
           "\x54\xfa\x07\x42\x4a\xde\xe9\x01\xd2\xda\x75\xaf\x1f\x02\x00\xf5"
           "\xab\x26\xd7\xa0\x71\xfb\x35\x33\x1c\xe3\x9c\x5a\x1a\x84\x4e\xaa"
           "\x55\x21\x5f\x8a\x1a\x8d\xdb\x17\xf9\x2e\xd7\x40\x3a\xc4\x68\xe8"
           "\xfa\x90\xf7\xc2\x02\xce\x2c\xc7\x83\x01\xd8\x7c\xb0\xf7\x6c\xb3"
           "\x4d\x36\x9c\x60\x0c\xaf\x5c\x6e\x91\xd1\xff\x4e\xa9\xe2\x0a\xf1"
           "\x8c\xcb\xd3\x2e\x85\x98\x58\xdc\x44\xbf\x04\x2a\xab\x74\x2b\x76"
           "\x00\x3a\xad\x0c\x44\xed\xa8\x50\x2a\x86\x38\xd5\xe9\x73\x1b\xe4"
           "\x5c\x12\xd1\xe1\x96\x16\x97\xd0\x7c\xde\xe4\x2c\xa9\x8a\x51\x24"
           "\xe8\x41\x08\x33\xb0\x53\x4d\xc8\xef\x63\xa7\x47\xad\x47\xfa\x19"
           "\x92\x5d\xa4\x03\x3c\x8c\x1c\x93\xd5\x8e\x60\x5b\x00\xbe\xc7\xac"
           "\x5b\x38\xce\xf4\x32\x3e\xb1\x8a\x83\xf2\x6a\x63\xe0\xfb\x6c\x24"
           "\x51\x65\x37\xaf\xa9\xd8\xee\x29\x03\xc4\x7b\x18\x06\x3b\xf1\x3b"
           "\x7f\xfb\x0c\x60\xfa\xa2\xf6\xf8\x76\xee\x7e\x2f\xb7\xf5\x24\xf5"
           "\xa2\x63\x5d\xa0\xf9\xc1\xe6\x71\x02\x07\x1c\xc0\xef\xce\x2d\x59"
           "\x71\x4d\xc2\x44\xcd\x96\xf2\xf2\x52\xad\xa8\x10\xfa\xc8\x51\x34"
           "\xec\xb4\x87\x5b\x2f\x1a\xd3\xd7\xf6\xd8\xa3\xcf\x78\x1b\x62\xa3"
           "\x48\xeb\xe0\x4c\xf3\x01\xb0\xc3\xff\x17\x8d\x93\x8d\xc0\xb4\x1c"
           "\x5e\x17\xfd\x4a\xdc\x63\x7c\xc7\x1e\x2c\x3d\x74\x14\x5d\x1c\x3d"
           "\xcd\xe7\xdc\x56\xf2\x87\x2c\xb9\xf2\x58\x70\xce\xc8\x83\x60\x3c"
           "\xd1\xe8\x9c\xe0\x85\xd2\x9c\x13\x27\x72\xf9\x9b",
           348);
    res = syz_open_procfs(0, 0x200000c0);
    if (res != -1)
      r[0] = res;
    break;
  case 1:
    syscall(__NR_ftruncate, r[0], 0xae);
    break;
  }
}

void loop()
{
  execute(2);
}

int main()
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  loop();
  return 0;
}