// https://syzkaller.appspot.com/bug?id=4522c4fb3896c243a66d4bda935f828e80899c2c
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf));
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

#ifndef __NR_mmap
#define __NR_mmap 192
#endif
#ifndef __NR_write
#define __NR_write 4
#endif
#ifndef __NR_readv
#define __NR_readv 145
#endif
#undef __NR_mmap
#define __NR_mmap __NR_mmap2

long r[1];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
  memcpy((void*)0x20005000, "/dev/sg#", 9);
  r[0] = syz_open_dev(0x20005000, 0, 0x8002);
  memcpy((void*)0x20dcf000,
         "\xb6\x39\xb8\x5e\x1e\x8d\x00\x1d\x00\x00\x00\x00\x00\x3e\x15\xd6\x1d"
         "\xcc\x43\x01\x17\x5e\xd2\xbc\x70\x18\xce\xbc\x02\x00\x00\x00\x00\x00"
         "\x00\x00\x67\x8c\xe2\x2c\x9b\x16\x00\x96\xaa\x1f\xae\x1a\x38\x0d\xe3"
         "\x70\x1e\x0c\xa2\xcc\x09\xd9\x8e\xeb\x2e\xbd\xa1\x09\xde\x5f\x99\x6c"
         "\xcd\x52\x59\xca\x1e\xaa\x20\xff\xaa\x00\x00\x63\xc9\xcb\x0e\xba\xb1"
         "\xc5\x00\x5d\x00\x04\x00\x00\x00\x00\x00\x00\xc1\xc6\xf1\xbc\x51\xd4"
         "\xdd\xf0\xf3\xcd\x2d\x33\x9d\x00\x64\x86\x72\x41\x4e\x74\x54\xc3\x37"
         "\xb0\x8e\x26\x1b\xe5\xdd\xc8\x5a\x00\x00\x00\x00\x78\xff\xff\xff\xff"
         "\x49\x70\xb7\x0d\xe2\xce\x1a\xa4\x06\x4f\x21\xec\x60\x3f\x22\xb3\xb4"
         "\x32\xc9\x8c\x62\xc5\x69\xa9\xab\x7e\xd5\x25\x84\x01\xc0\x18\x9d\xb6"
         "\x71\xcb\x9e\x04\xd8\xc8\x6c\x7a\x33\xa6\x71\x1b\x42\x81\x4f\x00\xe7"
         "\xfe\xad\xc0\xf3\xd4\xd6\x10\xc8\xf2\x18\x4f\x52\x8b\xa5\x08\x94\x8c"
         "\x41\x30\x4d\x35\x4f\x28\x40\x42\x98\x9d\xf8\xe1\x9f\x61\x11\xb3\x42"
         "\x46\x68\x68\x5f\x8b\xe5\xb4\x92\x5b\x69\x95\x08\xd9\x13\x56\x27\x5b"
         "\x8b\x40\xb9\x43\x85\xb6\xdb\xed\x1f\x41\x5c\x9e\x62\x98\x32\x24\xef"
         "\xd0\xbd\xf7\xd7\xb0\xc2\x46\xeb\x72\xa1\x60\x7b\xa5\x1e\x36\xbf\x08"
         "\x44\xe0\xdb\xf7\xb1\xab\x12\x40\xa8\xfc\xcc\x89\xb5\x24\xa6\x2c\xce"
         "\x09\xd6\xe0\x45\x41\x34\x74\x4b\x8d\x85\x89\x48\xd3\xaa\x38\xb3\x4c"
         "\xb5\xdf\x7e\xec\x95\xae\x12\x59\x37\xc4\xce\x27\xe9\x87\x8f\xc7\x04"
         "\x01\xdc\xbd\x6d\xa3\xcb\x05\x97\xf6\x6c\x26\xad\x9b\x2d\x25\xcf\x69"
         "\x7c\x90\x7d\x11\xec\x3d\x5d\x2e\xa3\x51",
         350);
  syscall(__NR_write, r[0], 0x20dcf000, 0x15e);
  *(uint32_t*)0x20bb7000 = 0x20701fc2;
  *(uint32_t*)0x20bb7004 = 0x3e;
  syscall(__NR_readv, r[0], 0x20bb7000, 1);
}

int main()
{
  loop();
  return 0;
}