// https://syzkaller.appspot.com/bug?id=b76b68f9b8e925797122642c842997878ecdb30d
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

#define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len)               \
  *(type*)(addr) =                                                             \
      htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) |           \
            (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  memcpy((void*)0x200001c0, "/dev/bus/usb/00#/00#\000", 21);
  res = -1;
  res = syz_open_dev(0x200001c0, 0xc, 0x40001);
  if (res != -1)
    r[0] = res;
  *(uint32_t*)0x20000380 = 0;
  *(uint32_t*)0x20000384 = 0;
  memcpy(
      (void*)0x20000388,
      "\x78\x70\x8f\xb3\xfb\xe8\xcb\x75\xad\x8a\x1f\xb7\x6a\xc9\x09\x70\xf7\x49"
      "\x2f\x6e\x9c\x61\xb0\x47\xd9\xe9\x5f\xb2\x05\x6e\x30\xb8\x0c\x19\x55\x9a"
      "\xaf\x00\xf0\x8d\xd6\x45\x58\x63\xca\xe9\xc9\x63\x24\x3e\x3c\xb0\x9e\x1d"
      "\x9a\x09\x5d\xfe\x5c\x63\xfa\x0f\xd0\x37\xf9\xbc\xaa\x2d\x97\x4c\x57\x9c"
      "\xf3\xf3\x74\x50\x8c\xc5\xda\x75\x39\xe7\x37\x71\x13\x97\x3f\x2c\x99\x8a"
      "\x07\x3a\x74\x75\xd6\xc1\x9c\xfb\x8f\xd9\x3a\x93\x19\x70\x13\xfa\x05\xc0"
      "\x4c\x0d\x37\xb6\x9b\xe2\x49\xd0\x38\x10\xda\x5f\xca\x2e\xb3\x48\x80\xae"
      "\x62\xd1\x62\x59\x25\x35\xfa\x99\x23\x64\x7d\x27\x32\x07\xaf\x2b\x38\xab"
      "\x34\xb0\xcd\x28\x36\xea\x9b\x59\x2a\x80\xe2\xbb\xa2\x83\x91\x30\xe7\x49"
      "\x27\x7a\x10\xeb\xd4\xec\x81\x7d\xbb\xa3\xbc\xd9\x74\x26\x33\x63\x37\xf2"
      "\x08\x08\xec\x8e\xa2\xb8\x54\x30\x49\x5a\xf4\xf6\x5f\x02\xfa\x71\x05\x6a"
      "\x3b\x7f\x66\x88\x6d\x8d\x79\x30\x88\x0d\x71\x2b\x22\xcd\xcc\xc7\x10\x00"
      "\x55\x57\x1c\x37\xf8\xfa\xef\x14\x8d\x6c\xb6\x3a\x08\xa2\x40\x2d\xf1\xad"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00",
      256);
  syscall(__NR_ioctl, r[0], 0x8108551b, 0x20000380ul);
  STORE_BY_BITMASK(uint8_t, , 0x20000200, 1, 0, 7);
  STORE_BY_BITMASK(uint8_t, , 0x20000200, 1, 7, 1);
  *(uint32_t*)0x20000204 = 0xfe5f;
  *(uint32_t*)0x20000208 = 0;
  *(uint64_t*)0x20000210 = 0x20000940;
  memcpy(
      (void*)0x20000940,
      "\xbe\xcf\x05\x00\x00\x00\x00\x00\x00\x00\xe4\xfc\x6c\x69\xc0\x1d\xcd\x16"
      "\x9a\x86\xe5\xb0\xc4\xa7\xaa\xc5\x88\x84\x77\xe8\x5f\x6f\x80\xc1\xe1\xc4"
      "\xa4\xd3\x55\xfd\xdb\x15\x35\x25\x8d\x64\xf1\x87\x2c\x28\x2c\xa1\x21\xa9"
      "\xba\xb0\x90\x5b\x73\x41\x78\x1e\xe5\xd1\xc9\xb6\x03\xc9\xb7\x8e\x12\xfb"
      "\x39\x08\x05\x7f\x65\x70\x23\x1d\xa1\xff\xd6\xfc\x33\xd6\x63\xd5\x38\x19"
      "\xed\xec\xae\x44\x4c\xd6\x49\xc7\x18\x73\xe1\x93\x17\xba\x66\x83\xf5\xcb"
      "\x0f\xd3\x75\x10\xe4\xf9\xe7\x70\x65\x73\xfa\x5a\xb7\xc3\x75\xc8\x5c\xd7"
      "\x8e\xfc\x1e\xe5\x47\x2f\xa4\x52\x4c\x4e\x21\xa5\xae\xd0\x20\x69\x0a\xc9"
      "\x24\x67\x35\xe9\xa5\x6d\xe6\xf0\x44\x0a\xe8\x69\x5b\x8f\x72\x2a\x93\xa9"
      "\x54\xc5\x23\x90\xa1\x08\xed\x0e\x00\x00\x4b\xf7\xf1\x06\xae\x1b\x14\x73"
      "\xee\x63\xbd\xad\x30\x4a\x23\x8b\x94\x1b\x94\x72\x85\xe8\x25\x66\x11\x41"
      "\x49\x98\x80\x9c\x65\xe8\x85\x02\xde\xae\xd0\xa2\x1b\x79\xf7\xbd\x8b\x28"
      "\xd8\xb9\xbb\xbd\xe6\x45\xd3\xf0\x13\xaf\x99\x4d\xbd\x70\x03\xd5\x02\x4c"
      "\x4c\x0c\x4d\xdf\x17\xb2\x01\x5e\x45\xfe\xab\x36\xa8\x4e\x39\x58\x5c\xee"
      "\x5c\x32\xe6\x78\xf7\xbd\xcf\x50\x06\x14\xc6\x1b\x1d\x54\x60\x40\xdb\x3b"
      "\x35\xe3\xf0\x8a\x3c\xda\x2c\xe4\xa8\x00\x1e\x42\x4f\xb7\x20\x32\x70\x58"
      "\xfe\x1b\x4e\x26\x01\xd5\x49\x5f\x71\xe0\xcc\x42\x8d\x10\x41\x13\x73\xf7"
      "\xfc\x73\x5b\x78\x83\xc7\x42\xfb\x52\x08\xc8\xad\x09\x3f\x68\x2d\x07\x00"
      "\xf2\x1e\xd1\x40\xe3\xae\xdc\xe3\x25\xa0\x3f\xcf\x2b\x81\xd1\x71\x71\xe8"
      "\x1d\xcd\x37\x12\x75\xb5\x09\x31\x12\x0c\xbd\x7b\xce\x7d\xbe\x47\xe9\xb6"
      "\x36\xd4\x3a\xdb\x91\x1f\x3b\xc3\x51\x5f\xa7\xd7\xcf\x1a\xc0\x50\x82\x39"
      "\x2f\xcc\x71\x25\x02\x18\xaa\xf1\x09\x46\x2f\xd7\xc3\x5c\xe3\x59\x10\xfe"
      "\xab\x51\x0e\xd4\x0e\xc5\x21\x67\x97\x77\x81\x26\x4d\xa5\x9e\xb1\xa4\x25"
      "\x50\xdf\xa2\xf1\x26\x91\x2d\x85\x96\x72\x7f\xfc\x67\x56\x3e\x15\x9a\xe7"
      "\x02\x28\x62\x41\x78\x0a\x00\xbb\x33\x7c\x94\xdf\x00\x00\x00\x00\x00\x93"
      "\x59\xa0\x4f\xec\xc8\xe2\xcc\xa9\x57\x6a\x77\xb8\x9e\x93\x3e\x8d\xef\x16"
      "\x7d\xe6\xae\xd1\x76\xd2\x81\xe3\xa8\x4b\x79\x1b",
      480);
  syscall(__NR_ioctl, r[0], 0xc0185502, 0x20000200ul);
}
int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  loop();
  return 0;
}