// https://syzkaller.appspot.com/bug?id=913598f2ef4504460d88ae845830e245d00debd5
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1)

#define BITMASK_LEN_OFF(type, bf_off, bf_len)                                  \
  (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))

#define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len)                      \
  if ((bf_off) == 0 && (bf_len) == 0) {                                        \
    *(type*)(addr) = (type)(val);                                              \
  } else {                                                                     \
    type new_val = *(type*)(addr);                                             \
    new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len));                     \
    new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off);          \
    *(type*)(addr) = new_val;                                                  \
  }

#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
                 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  long res = 0;
  *(uint32_t*)0x200004c0 = 2;
  *(uint32_t*)0x200004c4 = 0x70;
  *(uint8_t*)0x200004c8 = 0x72;
  *(uint8_t*)0x200004c9 = 0;
  *(uint8_t*)0x200004ca = 0;
  *(uint8_t*)0x200004cb = 0;
  *(uint32_t*)0x200004cc = 0;
  *(uint64_t*)0x200004d0 = 1;
  *(uint64_t*)0x200004d8 = 0;
  *(uint64_t*)0x200004e0 = 0;
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 0, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 1, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 2, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 3, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 4, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 5, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 6, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 7, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 8, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 9, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 10, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 11, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 12, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 13, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 14, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 15, 2);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 17, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 18, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 19, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 20, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 21, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 22, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0xfffffffffffffffb, 23, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 24, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 25, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 26, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 27, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 28, 1);
  STORE_BY_BITMASK(uint64_t, 0x200004e8, 0, 29, 35);
  *(uint32_t*)0x200004f0 = 0;
  *(uint32_t*)0x200004f4 = 0;
  *(uint64_t*)0x200004f8 = 0;
  *(uint64_t*)0x20000500 = 0;
  *(uint64_t*)0x20000508 = 0;
  *(uint64_t*)0x20000510 = 0;
  *(uint32_t*)0x20000518 = 0;
  *(uint32_t*)0x2000051c = 0;
  *(uint64_t*)0x20000520 = 0;
  *(uint32_t*)0x20000528 = 0;
  *(uint16_t*)0x2000052c = 0;
  *(uint16_t*)0x2000052e = 0;
  res = syscall(__NR_perf_event_open, 0x200004c0, -1, 0, -1, 0);
  if (res != -1)
    r[0] = res;
  memcpy((void*)0x20000300, "user", 5);
  syscall(__NR_ioctl, r[0], 0x40082406, 0x20000300);
  memcpy((void*)0x20b4508a, "/dev/ashmem", 12);
  res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20b4508a, 0, 0);
  if (res != -1)
    r[1] = res;
  syscall(__NR_ioctl, r[1], 0x40087703, 0x28113e26);
  syscall(__NR_mmap, 0x20ffa000, 0x3000, 0x80002, 0x400000000002012, r[1], 0);
  memcpy((void*)0x20000000, "", 1);
  syscall(__NR_ioctl, r[1], 0x40087708, 0x20000000);
  syscall(__NR_ioctl, r[1], 0x770a, 0);
  res = syscall(__NR_socketpair, 1, 1, 0, 0x20000100);
  if (res != -1)
    r[2] = *(uint32_t*)0x20000100;
  memcpy((void*)0x20000140,
         "\x23\x7d\x00\x9a\x1b\xc2\x5f\x52\xea\xd3\xdd\x54\xd0\xec\x3b\xa4\x9d"
         "\x56\x3e\xa4\x11\xa4\xac\x9e\x1e\xac\xaa\x54\xd5\xd3\xf8\x3c\xd7\x59"
         "\x62\x04\x49\xdc\x74\x2c\x26\xe9\x30\xa8\xaf\xff\xd3\xcd\xcd\x2d\x90"
         "\x27\xa2\x76\xba\x6c\xa3\x6c\x22\xa0\x47\xeb\x44\x1d\x8c\x8e\x15\x8d"
         "\x60\x60\xb2\xdb\x9e\x27\xef\x5f\xde\x3f\x69\xac\x6c\x03\xaa\xdc\x28"
         "\x96\xbe\x64\x9b\x1d\x95\x13\xbe\xe7\xb8\xa3\x13\x3e\xdd\x7d\x87\xc7"
         "\x59\xf1\x92\xe3\x42\x49\x6b\x79\xe8\x85\xe9\x5e\x1d\xb2\xd2\x59\x63"
         "\x6e\x9d\xaf\x51\xb1\x02\x99\x7a\x81\xff\xc2\xdd\x29\xfe\x27\xb8\x22"
         "\x58\x40\xd6\x2c\xb5\xa6\xa2\xe1\x3a\xec\x47\x1d\xfe\x86\x85\xe7\xd4"
         "\xf6\x21\x43\xa3\xcf\xf3\x53\xea\x41\xd7\x11\xc9\x4f\x8e\x2b\x94\x8c"
         "\x1f\xd6\x88\x97\xd0\xdd\x2a\x90\x29\x22\xda",
         181);
  res = syscall(__NR_memfd_create, 0x20000140, 2);
  if (res != -1)
    r[3] = res;
  syscall(__NR_ftruncate, r[3], 0x40001);
  *(uint64_t*)0x20000240 = 0;
  syscall(__NR_sendfile, r[2], r[3], 0x20000240, 0x100000000002);
  syscall(__NR_fcntl, r[3], 0x409, 8);
  return 0;
}