// https://syzkaller.appspot.com/bug?id=0b210638616bb68109e9642158d4c0072770ae1c
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#ifndef __NR_mmap
#define __NR_mmap 222
#endif
#ifndef __NR_openat
#define __NR_openat 56
#endif
#ifndef __NR_write
#define __NR_write 64
#endif

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  openat$smackfs_ambient arguments: [
  //    fd: const = 0xffffffffffffff9c (8 bytes)
  //    file: ptr[in, buffer] {
  //      buffer: {2f 73 79 73 2f 66 73 2f 73 6d 61 63 6b 66 73 2f 61 6d 62 69
  //      65 6e 74 00} (length 0x18)
  //    }
  //    flags: const = 0x2 (4 bytes)
  //    mode: const = 0x0 (2 bytes)
  //  ]
  //  returns fd_smackfs_label
  memcpy((void*)0x20000280, "/sys/fs/smackfs/ambient\000", 24);
  res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000280ul,
                /*flags=*/2, /*mode=*/0);
  if (res != -1)
    r[0] = res;
  //  write arguments: [
  //    fd: fd (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {4f e5 33 74 89 de 16 70 44 39 d0 2c 82 72 68 48 18 c9 8d 8a
  //      0c 14 40 58 fb 4c e8 d1 c8 b3 24 d0 f4 60 28 6e 63 82 2e f5 69 2c 37
  //      79 6e af 3b b9 fb 30 68 d5 08 7a cf e8 db 9a a5 cc 2f 9a b4 04 3f 16
  //      6a 91 44 ff 7a 3a 49 09 65 c2 f0 42 d3 f6 14 e0 24 39 cc 25 49 d0 92
  //      5a e8 06 59 ec d2 f3 dd 06 eb 1b 85 97 48 8a 2b 6b f0 57 68 c2 70 23
  //      3d 08 de 68 6d df d5 98 a6 4d 42 55 a2 78 7b 78 8e 3f 80 22 e1 e5 1d
  //      a2 bc 52 e1 2e 95 86 9c 1d 02 58 8e 29 5d 82 e9 62 db 15 d9 c9 90 dc
  //      40 6b f2 43 15 47 6d 56 15 c7 7e 4a 8c a9 f6 8e 77 54 a6 45 7f 17 1c
  //      5e 3b 9c a0 b9 67 ae 7d 5f b4 67 40 7f 80 e9 93 e9 f6 93 2e b8 ee af
  //      a7 5c d8 0c 50 9c 54 70 21 d8 44 d1 eb 5d 67 7b 68 8b 9a 29 a2 3a 90
  //      0b 32 b1 37 76 37 bc 1d c1 65 90 92 6e a8 c5 6f 77} (length 0xf4)
  //    }
  //    count: len = 0xf4 (8 bytes)
  //  ]
  memcpy(
      (void*)0x20000100,
      "\x4f\xe5\x33\x74\x89\xde\x16\x70\x44\x39\xd0\x2c\x82\x72\x68\x48\x18\xc9"
      "\x8d\x8a\x0c\x14\x40\x58\xfb\x4c\xe8\xd1\xc8\xb3\x24\xd0\xf4\x60\x28\x6e"
      "\x63\x82\x2e\xf5\x69\x2c\x37\x79\x6e\xaf\x3b\xb9\xfb\x30\x68\xd5\x08\x7a"
      "\xcf\xe8\xdb\x9a\xa5\xcc\x2f\x9a\xb4\x04\x3f\x16\x6a\x91\x44\xff\x7a\x3a"
      "\x49\x09\x65\xc2\xf0\x42\xd3\xf6\x14\xe0\x24\x39\xcc\x25\x49\xd0\x92\x5a"
      "\xe8\x06\x59\xec\xd2\xf3\xdd\x06\xeb\x1b\x85\x97\x48\x8a\x2b\x6b\xf0\x57"
      "\x68\xc2\x70\x23\x3d\x08\xde\x68\x6d\xdf\xd5\x98\xa6\x4d\x42\x55\xa2\x78"
      "\x7b\x78\x8e\x3f\x80\x22\xe1\xe5\x1d\xa2\xbc\x52\xe1\x2e\x95\x86\x9c\x1d"
      "\x02\x58\x8e\x29\x5d\x82\xe9\x62\xdb\x15\xd9\xc9\x90\xdc\x40\x6b\xf2\x43"
      "\x15\x47\x6d\x56\x15\xc7\x7e\x4a\x8c\xa9\xf6\x8e\x77\x54\xa6\x45\x7f\x17"
      "\x1c\x5e\x3b\x9c\xa0\xb9\x67\xae\x7d\x5f\xb4\x67\x40\x7f\x80\xe9\x93\xe9"
      "\xf6\x93\x2e\xb8\xee\xaf\xa7\x5c\xd8\x0c\x50\x9c\x54\x70\x21\xd8\x44\xd1"
      "\xeb\x5d\x67\x7b\x68\x8b\x9a\x29\xa2\x3a\x90\x0b\x32\xb1\x37\x76\x37\xbc"
      "\x1d\xc1\x65\x90\x92\x6e\xa8\xc5\x6f\x77",
      244);
  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x20000100ul, /*count=*/0xf4ul);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  loop();
  return 0;
}