// https://syzkaller.appspot.com/bug?id=3030b0ef9cc955846dbe80f88101fd10e240a331
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if_arp.h>
#include <netinet/in.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/if.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
#include <linux/ip.h>
#include <linux/net.h>
#include <linux/netfilter_bridge/ebtables.h>
#include <linux/tcp.h>

unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void vsnprintf_check(char* str, size_t size, const char* format,
                            va_list args)
{
  int rv;
  rv = vsnprintf(str, size, format, args);
  if (rv < 0)
    exit(1);
  if ((size_t)rv >= size)
    exit(1);
}

#define COMMAND_MAX_LEN 128
#define PATH_PREFIX                                                            \
  "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin "
#define PATH_PREFIX_LEN (sizeof(PATH_PREFIX) - 1)

static void execute_command(bool panic, const char* format, ...)
{
  va_list args;
  char command[PATH_PREFIX_LEN + COMMAND_MAX_LEN];
  int rv;
  va_start(args, format);
  memcpy(command, PATH_PREFIX, PATH_PREFIX_LEN);
  vsnprintf_check(command + PATH_PREFIX_LEN, COMMAND_MAX_LEN, format, args);
  va_end(args);
  rv = system(command);
  if (rv) {
    if (panic)
      exit(1);
  }
}

static int tunfd = -1;
static int tun_frags_enabled;
#define SYZ_TUN_MAX_PACKET_SIZE 1000

#define TUN_IFACE "syz_tun"

#define LOCAL_MAC "aa:aa:aa:aa:aa:aa"
#define REMOTE_MAC "aa:aa:aa:aa:aa:bb"

#define LOCAL_IPV4 "172.20.20.170"
#define REMOTE_IPV4 "172.20.20.187"

#define LOCAL_IPV6 "fe80::aa"
#define REMOTE_IPV6 "fe80::bb"

#define IFF_NAPI 0x0010
#define IFF_NAPI_FRAGS 0x0020

static void initialize_tun(void)
{
  tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
  if (tunfd == -1) {
    printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n");
    printf("otherwise fuzzing or reproducing might not work as intended\n");
    return;
  }
  const int kTunFd = 240;
  if (dup2(tunfd, kTunFd) < 0)
    exit(1);
  close(tunfd);
  tunfd = kTunFd;
  struct ifreq ifr;
  memset(&ifr, 0, sizeof(ifr));
  strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ);
  ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_NAPI | IFF_NAPI_FRAGS;
  if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) {
    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
    if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0)
      exit(1);
  }
  if (ioctl(tunfd, TUNGETIFF, (void*)&ifr) < 0)
    exit(1);
  tun_frags_enabled = (ifr.ifr_flags & IFF_NAPI_FRAGS) != 0;
  execute_command(0, "sysctl -w net.ipv6.conf.%s.accept_dad=0", TUN_IFACE);
  execute_command(0, "sysctl -w net.ipv6.conf.%s.router_solicitations=0",
                  TUN_IFACE);
  execute_command(1, "ip link set dev %s address %s", TUN_IFACE, LOCAL_MAC);
  execute_command(1, "ip addr add %s/24 dev %s", LOCAL_IPV4, TUN_IFACE);
  execute_command(1, "ip neigh add %s lladdr %s dev %s nud permanent",
                  REMOTE_IPV4, REMOTE_MAC, TUN_IFACE);
  execute_command(0, "ip -6 addr add %s/120 dev %s", LOCAL_IPV6, TUN_IFACE);
  execute_command(0, "ip -6 neigh add %s lladdr %s dev %s nud permanent",
                  REMOTE_IPV6, REMOTE_MAC, TUN_IFACE);
  execute_command(1, "ip link set dev %s up", TUN_IFACE);
}

static int read_tun(char* data, int size)
{
  if (tunfd < 0)
    return -1;
  int rv = read(tunfd, data, size);
  if (rv < 0) {
    if (errno == EAGAIN)
      return -1;
    if (errno == EBADFD)
      return -1;
    exit(1);
  }
  return rv;
}

static void flush_tun()
{
  char data[SYZ_TUN_MAX_PACKET_SIZE];
  while (read_tun(&data[0], sizeof(data)) != -1) {
  }
}

#define XT_TABLE_SIZE 1536
#define XT_MAX_ENTRIES 10

struct xt_counters {
  uint64_t pcnt, bcnt;
};

struct ipt_getinfo {
  char name[32];
  unsigned int valid_hooks;
  unsigned int hook_entry[5];
  unsigned int underflow[5];
  unsigned int num_entries;
  unsigned int size;
};

struct ipt_get_entries {
  char name[32];
  unsigned int size;
  void* entrytable[XT_TABLE_SIZE / sizeof(void*)];
};

struct ipt_replace {
  char name[32];
  unsigned int valid_hooks;
  unsigned int num_entries;
  unsigned int size;
  unsigned int hook_entry[5];
  unsigned int underflow[5];
  unsigned int num_counters;
  struct xt_counters* counters;
  char entrytable[XT_TABLE_SIZE];
};

struct ipt_table_desc {
  const char* name;
  struct ipt_getinfo info;
  struct ipt_replace replace;
};

static struct ipt_table_desc ipv4_tables[] = {
    {.name = "filter"}, {.name = "nat"},      {.name = "mangle"},
    {.name = "raw"},    {.name = "security"},
};

static struct ipt_table_desc ipv6_tables[] = {
    {.name = "filter"}, {.name = "nat"},      {.name = "mangle"},
    {.name = "raw"},    {.name = "security"},
};

#define IPT_BASE_CTL 64
#define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
#define IPT_SO_GET_INFO (IPT_BASE_CTL)
#define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)

struct arpt_getinfo {
  char name[32];
  unsigned int valid_hooks;
  unsigned int hook_entry[3];
  unsigned int underflow[3];
  unsigned int num_entries;
  unsigned int size;
};

struct arpt_get_entries {
  char name[32];
  unsigned int size;
  void* entrytable[XT_TABLE_SIZE / sizeof(void*)];
};

struct arpt_replace {
  char name[32];
  unsigned int valid_hooks;
  unsigned int num_entries;
  unsigned int size;
  unsigned int hook_entry[3];
  unsigned int underflow[3];
  unsigned int num_counters;
  struct xt_counters* counters;
  char entrytable[XT_TABLE_SIZE];
};

struct arpt_table_desc {
  const char* name;
  struct arpt_getinfo info;
  struct arpt_replace replace;
};

static struct arpt_table_desc arpt_tables[] = {
    {.name = "filter"},
};

#define ARPT_BASE_CTL 96
#define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
#define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
#define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)

static void checkpoint_iptables(struct ipt_table_desc* tables, int num_tables,
                                int family, int level)
{
  struct ipt_get_entries entries;
  socklen_t optlen;
  int fd, i;
  fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < num_tables; i++) {
    struct ipt_table_desc* table = &tables[i];
    strcpy(table->info.name, table->name);
    strcpy(table->replace.name, table->name);
    optlen = sizeof(table->info);
    if (getsockopt(fd, level, IPT_SO_GET_INFO, &table->info, &optlen)) {
      switch (errno) {
      case EPERM:
      case ENOENT:
      case ENOPROTOOPT:
        continue;
      }
      exit(1);
    }
    if (table->info.size > sizeof(table->replace.entrytable))
      exit(1);
    if (table->info.num_entries > XT_MAX_ENTRIES)
      exit(1);
    memset(&entries, 0, sizeof(entries));
    strcpy(entries.name, table->name);
    entries.size = table->info.size;
    optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
    if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
      exit(1);
    table->replace.valid_hooks = table->info.valid_hooks;
    table->replace.num_entries = table->info.num_entries;
    table->replace.size = table->info.size;
    memcpy(table->replace.hook_entry, table->info.hook_entry,
           sizeof(table->replace.hook_entry));
    memcpy(table->replace.underflow, table->info.underflow,
           sizeof(table->replace.underflow));
    memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
  }
  close(fd);
}

static void reset_iptables(struct ipt_table_desc* tables, int num_tables,
                           int family, int level)
{
  struct xt_counters counters[XT_MAX_ENTRIES];
  struct ipt_get_entries entries;
  struct ipt_getinfo info;
  socklen_t optlen;
  int fd, i;
  fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < num_tables; i++) {
    struct ipt_table_desc* table = &tables[i];
    if (table->info.valid_hooks == 0)
      continue;
    memset(&info, 0, sizeof(info));
    strcpy(info.name, table->name);
    optlen = sizeof(info);
    if (getsockopt(fd, level, IPT_SO_GET_INFO, &info, &optlen))
      exit(1);
    if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
      memset(&entries, 0, sizeof(entries));
      strcpy(entries.name, table->name);
      entries.size = table->info.size;
      optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
      if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
        exit(1);
      if (memcmp(table->replace.entrytable, entries.entrytable,
                 table->info.size) == 0)
        continue;
    }
    table->replace.num_counters = info.num_entries;
    table->replace.counters = counters;
    optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) +
             table->replace.size;
    if (setsockopt(fd, level, IPT_SO_SET_REPLACE, &table->replace, optlen))
      exit(1);
  }
  close(fd);
}

static void checkpoint_arptables(void)
{
  struct arpt_get_entries entries;
  socklen_t optlen;
  unsigned i;
  int fd;
  fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
    struct arpt_table_desc* table = &arpt_tables[i];
    strcpy(table->info.name, table->name);
    strcpy(table->replace.name, table->name);
    optlen = sizeof(table->info);
    if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &table->info, &optlen)) {
      switch (errno) {
      case EPERM:
      case ENOENT:
      case ENOPROTOOPT:
        continue;
      }
      exit(1);
    }
    if (table->info.size > sizeof(table->replace.entrytable))
      exit(1);
    if (table->info.num_entries > XT_MAX_ENTRIES)
      exit(1);
    memset(&entries, 0, sizeof(entries));
    strcpy(entries.name, table->name);
    entries.size = table->info.size;
    optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
    if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
      exit(1);
    table->replace.valid_hooks = table->info.valid_hooks;
    table->replace.num_entries = table->info.num_entries;
    table->replace.size = table->info.size;
    memcpy(table->replace.hook_entry, table->info.hook_entry,
           sizeof(table->replace.hook_entry));
    memcpy(table->replace.underflow, table->info.underflow,
           sizeof(table->replace.underflow));
    memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
  }
  close(fd);
}

static void reset_arptables()
{
  struct xt_counters counters[XT_MAX_ENTRIES];
  struct arpt_get_entries entries;
  struct arpt_getinfo info;
  socklen_t optlen;
  unsigned i;
  int fd;
  fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
    struct arpt_table_desc* table = &arpt_tables[i];
    if (table->info.valid_hooks == 0)
      continue;
    memset(&info, 0, sizeof(info));
    strcpy(info.name, table->name);
    optlen = sizeof(info);
    if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &info, &optlen))
      exit(1);
    if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
      memset(&entries, 0, sizeof(entries));
      strcpy(entries.name, table->name);
      entries.size = table->info.size;
      optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
      if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
        exit(1);
      if (memcmp(table->replace.entrytable, entries.entrytable,
                 table->info.size) == 0)
        continue;
    } else {
    }
    table->replace.num_counters = info.num_entries;
    table->replace.counters = counters;
    optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) +
             table->replace.size;
    if (setsockopt(fd, SOL_IP, ARPT_SO_SET_REPLACE, &table->replace, optlen))
      exit(1);
  }
  close(fd);
}

struct ebt_table_desc {
  const char* name;
  struct ebt_replace replace;
  char entrytable[XT_TABLE_SIZE];
};

static struct ebt_table_desc ebt_tables[] = {
    {.name = "filter"}, {.name = "nat"}, {.name = "broute"},
};

static void checkpoint_ebtables(void)
{
  socklen_t optlen;
  unsigned i;
  int fd;
  fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
    struct ebt_table_desc* table = &ebt_tables[i];
    strcpy(table->replace.name, table->name);
    optlen = sizeof(table->replace);
    if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_INFO, &table->replace,
                   &optlen)) {
      switch (errno) {
      case EPERM:
      case ENOENT:
      case ENOPROTOOPT:
        continue;
      }
      exit(1);
    }
    if (table->replace.entries_size > sizeof(table->entrytable))
      exit(1);
    table->replace.num_counters = 0;
    table->replace.entries = table->entrytable;
    optlen = sizeof(table->replace) + table->replace.entries_size;
    if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_ENTRIES, &table->replace,
                   &optlen))
      exit(1);
  }
  close(fd);
}

static void reset_ebtables()
{
  struct ebt_replace replace;
  char entrytable[XT_TABLE_SIZE];
  socklen_t optlen;
  unsigned i, j, h;
  int fd;
  fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (fd == -1) {
    switch (errno) {
    case EAFNOSUPPORT:
    case ENOPROTOOPT:
      return;
    }
    exit(1);
  }
  for (i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
    struct ebt_table_desc* table = &ebt_tables[i];
    if (table->replace.valid_hooks == 0)
      continue;
    memset(&replace, 0, sizeof(replace));
    strcpy(replace.name, table->name);
    optlen = sizeof(replace);
    if (getsockopt(fd, SOL_IP, EBT_SO_GET_INFO, &replace, &optlen))
      exit(1);
    replace.num_counters = 0;
    table->replace.entries = 0;
    for (h = 0; h < NF_BR_NUMHOOKS; h++)
      table->replace.hook_entry[h] = 0;
    if (memcmp(&table->replace, &replace, sizeof(table->replace)) == 0) {
      memset(&entrytable, 0, sizeof(entrytable));
      replace.entries = entrytable;
      optlen = sizeof(replace) + replace.entries_size;
      if (getsockopt(fd, SOL_IP, EBT_SO_GET_ENTRIES, &replace, &optlen))
        exit(1);
      if (memcmp(table->entrytable, entrytable, replace.entries_size) == 0)
        continue;
    }
    for (j = 0, h = 0; h < NF_BR_NUMHOOKS; h++) {
      if (table->replace.valid_hooks & (1 << h)) {
        table->replace.hook_entry[h] =
            (struct ebt_entries*)table->entrytable + j;
        j++;
      }
    }
    table->replace.entries = table->entrytable;
    optlen = sizeof(table->replace) + table->replace.entries_size;
    if (setsockopt(fd, SOL_IP, EBT_SO_SET_ENTRIES, &table->replace, optlen))
      exit(1);
  }
  close(fd);
}

static void checkpoint_net_namespace(void)
{
  checkpoint_ebtables();
  checkpoint_arptables();
  checkpoint_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]),
                      AF_INET, SOL_IP);
  checkpoint_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]),
                      AF_INET6, SOL_IPV6);
}

static void reset_net_namespace(void)
{
  reset_ebtables();
  reset_arptables();
  reset_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]),
                 AF_INET, SOL_IP);
  reset_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]),
                 AF_INET6, SOL_IPV6);
}

static void setup_common()
{
  if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
  }
}

static void loop();

static void sandbox_common()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  setsid();
  struct rlimit rlim;
  rlim.rlim_cur = rlim.rlim_max = 160 << 20;
  setrlimit(RLIMIT_AS, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 8 << 20;
  setrlimit(RLIMIT_MEMLOCK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 136 << 20;
  setrlimit(RLIMIT_FSIZE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
  setrlimit(RLIMIT_STACK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 0;
  setrlimit(RLIMIT_CORE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 256;
  setrlimit(RLIMIT_NOFILE, &rlim);
  if (unshare(CLONE_NEWNS)) {
  }
  if (unshare(CLONE_NEWIPC)) {
  }
  if (unshare(0x02000000)) {
  }
  if (unshare(CLONE_NEWUTS)) {
  }
  if (unshare(CLONE_SYSVSEM)) {
  }
}

int wait_for_loop(int pid)
{
  if (pid < 0)
    exit(1);
  int status = 0;
  while (waitpid(-1, &status, __WALL) != pid) {
  }
  return WEXITSTATUS(status);
}

static int do_sandbox_none(void)
{
  if (unshare(CLONE_NEWPID)) {
  }
  int pid = fork();
  if (pid != 0)
    return wait_for_loop(pid);
  setup_common();
  sandbox_common();
  if (unshare(CLONE_NEWNET)) {
  }
  initialize_tun();
  loop();
  exit(1);
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  int i;
  for (i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

#define SYZ_HAVE_SETUP_LOOP 1
static void setup_loop()
{
  checkpoint_net_namespace();
}

#define SYZ_HAVE_RESET_LOOP 1
static void reset_loop()
{
  reset_net_namespace();
}

#define SYZ_HAVE_SETUP_TEST 1
static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  flush_tun();
}

#define SYZ_HAVE_RESET_TEST 1
static void reset_test()
{
  int fd;
  for (fd = 3; fd < 30; fd++)
    close(fd);
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  setup_loop();
  int iter;
  for (iter = 0;; iter++) {
    reset_loop();
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      reset_test();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5 * 1000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}
#ifndef __NR_seccomp
#define __NR_seccomp 317
#endif

void execute_one(void)
{
  syscall(__NR_sysinfo, 0x20000140);
  memcpy((void*)0x20000500, "./file0", 8);
  syscall(__NR_lremovexattr, 0x20000500, 0x20003f40);
  *(uint16_t*)0x20000100 = 1;
  *(uint64_t*)0x20000108 = 0x20000000;
  *(uint16_t*)0x20000000 = 6;
  *(uint8_t*)0x20000002 = 0;
  *(uint8_t*)0x20000003 = 0;
  *(uint32_t*)0x20000004 = 0x58fe4;
  syscall(__NR_seccomp, 1, 0, 0x20000100);
  syscall(__NR_socket, 0xa, 2, 0x88);
  *(uint64_t*)0x20003d40 = 0x20000540;
  *(uint16_t*)0x20000540 = 2;
  *(uint16_t*)0x20000542 = htobe16(0);
  *(uint32_t*)0x20000544 = htobe32(-1);
  *(uint8_t*)0x20000548 = 0;
  *(uint8_t*)0x20000549 = 0;
  *(uint8_t*)0x2000054a = 0;
  *(uint8_t*)0x2000054b = 0;
  *(uint8_t*)0x2000054c = 0;
  *(uint8_t*)0x2000054d = 0;
  *(uint8_t*)0x2000054e = 0;
  *(uint8_t*)0x2000054f = 0;
  *(uint32_t*)0x20003d48 = 0x80;
  *(uint64_t*)0x20003d50 = 0x20002ac0;
  *(uint64_t*)0x20003d58 = 0;
  *(uint64_t*)0x20003d60 = 0x20000d00;
  *(uint64_t*)0x20003d68 = 0;
  *(uint32_t*)0x20003d70 = 0;
  syscall(__NR_sendmsg, -1, 0x20003d40, 0);
  syscall(__NR_fcntl, -1, 0x10, 0x20000640);
  *(uint32_t*)0x20000040 = 0x31d;
  syscall(__NR_getsockopt, -1, 0, 0x11, 0x20000680, 0x20000040);
  syscall(__NR_getgid);
  syscall(__NR_gettid);
  *(uint32_t*)0x20000480 = 0xfffffd4d;
  syscall(__NR_getsockopt, -1, 0x29, 0x23, 0x20000c00, 0x20000480);
  memcpy(
      (void*)0x20000800,
      "\x40\x09\xa5\xcd\x93\x90\x58\xd8\x51\x14\x34\x5e\xf7\x59\x14\x9c\x97\x6f"
      "\x7a\x3e\x98\xdd\xfb\x9b\x88\x82\xef\xf2\x2b\x70\x86\x47\x5c\x5f\x89\xf3"
      "\x5d\x4f\x15\x4c\x04\xf4\x54\x4c\x70\x21\xb6\x98\x73\xa7\x87\x17\xf4\x78"
      "\x72\xd1\xd9\xf1\x77\xf0\x6b\xd7\xfa\x0c\x72\x54\x93\xd4\x33\x13\x5a\x8c"
      "\x11\x9d\x9a\xaa\x2f\x6b\xfe\xfd\x74\x25\xa0\x9a\xb4\x9d\x0d\x37\x00\x40"
      "\x33\xa7\xde\xe8\x48\xe0\xe3\xeb\x19\x84\x08\xeb\x75\xe3\x25\x46\x70\x53"
      "\x01\x28\x5b\xeb\xaa\xa4\x3f\xeb\xee\x08\xb9\x73\x42\xfb\xdd\xa7\xf4\x4d"
      "\xe5\xfd\xa3\xc4\xf8\x82\xd4\x55\x36\x8c\x41\xcf\xe1\x8a\x59\xa5\x47\xbc"
      "\x00\x51\x17\x44\xa2\xe7\x0a\x49\x22\xec\x41\x59\xe6\x79\xb0\xaa\xb4\xfb"
      "\x5a\xfa\xcb\x3f\xbf\x92\x44\x82\x43\xcd\x51\x51\x45\xe1\x35\xb4\xcc\x74"
      "\xef\x5f\xd6\x47\xa9\x68\x97\xa8\x8a\x24\xaa\x7c\x53\x0f\x14\xd6\x9e\xa1"
      "\xa5\xb1\xb7\x0b\xc6\x41\x6b\x3c\xc3\xe0\xcb\x88\x87\x54\x3e\xde\xd2\x7d"
      "\x79\xfc\xae\x47\xb1\x02\x4e\xc7\xa2\x67\xab\x8b\xad\xf3\x4d\x6a\x58\x9c"
      "\x9b\x5c\x04\x10\x8f\x13\x5b\x53\xae\x71\x3e\x8c\x42\xf9\x6f\x19\xbc\x67"
      "\x0e\x10\x6a\xa6\x1c\xd4\xb6\x39\xf1\xa9\x8d\xf5\x61\xeb\x6c\xb0\x9b\x0b"
      "\xb5\xec\x2e\xfe\xb8\xa5\xca\xe9\xc9\x48\x62\x60\x06\x58\xb1\x16\xde\x88"
      "\x60\xf4\xa8\xb8\xed\xf9\xca\xf2\xdf\x13\x6e\xf1\x04\xd1\xde\x82\x05\x2f"
      "\x22\x32\x7b\x31\x6d\x27\xd1\x7f\x02\xdb\x4c\x86\x47\x49\xc2\xb3\xf0\x14"
      "\x74\x15\x54\x44\xf8\xa2\x30\xbe\x80\x42\xa0\xf0\x0d\x05\x3a\xdf\x9f\x03"
      "\xa7\x6e\x5b\x2a\x4f\xb6\x06\xd7\xf8\x11\x26\xc3\xf4\x97\x30\x9f\x4a\xe2"
      "\xc9\x5b\xde\xc7\x94\x26\x3a\x7e\x18\x6d\xaf\x9a\xf3\x43\x97\x33\x47\xc4"
      "\x29\xdc\xf6\x4a\x4d\x6f\xcb\x75\x2c\x28\x48\xc0\x3c\xb7\x42\x12\x92\x31"
      "\xf8\x84\x18\x22\x9d\x29\x8c\x72\x8f\x73\x0f\xc0\x4e\x0e\xaf\x88\x87\x75"
      "\x9c\xff\xa5\xe2\x94\xe5\x9c\x61\x92\x23\x48\xf1\x28\x61\x5b\xf3\x64\x84"
      "\x9d\x9b\xa1\x82\x7e\xb5\x1a\x07\x6a\x33\x71\x1b\x21\x0e\xfd\x46\xe6\xac"
      "\x59\xf1\x74\xdf\x3c\xbc\x93\x30\xd0\xfd\xfa\x8e\x0f\x76\xf9\xdb\x27\x53"
      "\xae\x44\x95\x74\x94\xe0\x2d\x9d\x06\xc2\x15\xb8\xce\x2c\xc0\xed\xbb\x76"
      "\xdc\x48\xa3\x1b\xd6\x2f\xbc\x1e\xfb\xe4\x85\x5d\x5d\x6d\x29\x65\x2a\xb4"
      "\xa8\x58\xec\xa3\xf0\x3f\x22\xc2\x49\xf5\x85\x72\x47\x80\xfc\xb8\x4a\x37"
      "\xd0\x60\x4a\x7c\xf3\x16\xc7\xf4\x64\x28\xf9\xa6\xd8\xc9\x0b\xb2\xbf\x0e"
      "\x64\x01\xb7\xe8\x59\x68\xca\xa0\xba\x46\x93\xc2\x4c\xbd\x0d\xe3\xfd\x38"
      "\x96\x63\xc3\x05\xf8\x70\xf9\x64\x70\xc7\x12\x46\xab\x6a\x58\xbc\xb1\xbd"
      "\xbd\xa3\x76\x28\x8f\xc7\x66\xf2\x6f\x3e\x7b\xa2\xca\xc5\x24\x89\xee\x52"
      "\x1a\x77\x3e\xfa\xfb\x8c\xdc\xdf\xe9\x60\x5c\x5c\xe4\xe1\xfa\xb3\xd3\xce"
      "\x70\xf7\xdc\xf9\x83\x8f\x89\x46\x0f\x1a\x74\x8f\x80\xa1\x02\x8c\x74\x2c"
      "\x3b\xd2\x64\xb8\x4e\x09\x38\x1b\x6d\x96\xdd\xa1\x60\x0c\xe9\x08\x90\x9b"
      "\x27\x9c\x11\x99\xfd\xad\xe3\xc1\x17\x52\x8c\x21\xa1\xba\x91\x16\xa9\xba"
      "\x02\xfe\x09\xf3\x91\x8a\x77\x31\xfe\xbf\x85\xe9\x00\x20\x5d\xe8\xb9\xdf"
      "\xf4\x86\x73\x11\x24\x46\x7c\x49\x83\xa9\x98\x92\x64\x7c\x99\x06\x49\xa4"
      "\xd3\x47\x70\xb7\x20\xa9\x6d\xf4\x98\x40\x4e\xdb\x86\x73\x44\x7c\xf9\xa8"
      "\xeb\x25\x98\x47\xfa\x2e\x53\x7f\xb7\x70\xd7\xc5\x4a\xdf\x8c\xb3\x3b\xf2"
      "\x5e\xfb\xa9\xe4\xd0\xd7\x44\x76\x6b\x87\x43\x4d\x7f\x16\x09\xe5\x71\x62"
      "\xd5\xc6\xbf\xfe\x35\xe5\x75\xbc\xa9\x6d\xc8\xb0\xdf\xdf\x58\x28\xad\xe8"
      "\xf8\x6e\x36\xec\x26\x3e\xf5\x36\x20\x57\x77\x16\x69\x75\xd2\x1d\xc7\xa5"
      "\x21\xe1\xe0\x5b\x85\xf4\xf8\x46\x26\xdb\xcb\x02\xca\x9e\x57\x90\xd5\xd1"
      "\xf3\x2a\x4b\x27\xe1\x82\x71\xe1\xbd\x09\x7f\x8c\xc4\x0d\xbe\xfa\x05\xbe"
      "\xe5\x4b\xff\x39\xca\x6f\x90\xa5\x64\x46\xce\xc8\x63\xae\xa3\xaf\x7b\xe8"
      "\xd0\x0d\x11\x6c\x15\xb5\xb4\xd1\xc0\xd5\x0c\x2c\xa5\x8a\xb3\x35\x6b\x40"
      "\x5e\xa4\x8c\x0c\x20\xcb\xef\x5c\x78\x48\x8f\x85\x6b\x12\x49\x13\xdf\xb2"
      "\x58\x9e\xb7\x39\x40\x3e\x59\x89\xe7\x3b\x5d\xee\xa3\xd4\x83\x29\x59\xef"
      "\x85\x3f\x1e\x1a\xe6\xd3\xaa\x52\xdb\x17\x9d\x73\xc6\x00\xd4\xdc\x3e\x57"
      "\x2f\x62\x1b\x29\x77\x5e\x20\x45\xf7\xa5\x74\x07\x66\x00\x37\xf6\xff\x8a"
      "\xb9\xda\x78\x83\x40\xaa\xe3\x9f\x8f\xb1\x11\x9d\xc3\x2c\x58\x5b\x4b\xac"
      "\x9e\xbf\xb7\xec\x97\x99\xd4\x18\xdd\xad\xe8\xcd\x8b\x61\xee\x42\x43\x2d"
      "\x2d\x84\x22\xec\xb4\x20\x51\x13\xed\x05\x28\xe0\x05\x77\xb7\x7d\xbd\x92"
      "\xec\xc4\x1d\x18\x4e\xe0\x08\x37\xe6\x96\x92\x49\xa2\xd0\x49\x62\x02\x29"
      "\xdd\xc7\x64\xee\x6f\xb9\xa4\x1f\xe6\xf3\xff\xf3\xfc\xe0\x4d\x24",
      1024);
  syscall(__NR_ioctl, -1, 0x8400ae8e, 0x20000800);
  syscall(__NR_fstat, -1, 0x20002000);
  syscall(__NR_getpgrp, -1);
  syscall(__NR_fstat, -1, 0x200021c0);
  syscall(__NR_getpgid, -1);
}
int main(void)
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  for (procid = 0; procid < 6; procid++) {
    if (fork() == 0) {
      do_sandbox_none();
    }
  }
  sleep(1000000);
  return 0;
}