// https://syzkaller.appspot.com/bug?id=25a1493afe91dc8f1ee7d56dda1e9983ea33a33e
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

#include <stdint.h>
#include <string.h>

static uintptr_t syz_open_procfs(uintptr_t a0, uintptr_t a1)
{

  char buf[128];
  memset(buf, 0, sizeof(buf));
  if (a0 == 0) {
    snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1);
  } else if (a0 == (uintptr_t)-1) {
    snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1);
  } else {
    snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0,
             (char*)a1);
  }
  int fd = open(buf, O_RDWR);
  if (fd == -1)
    fd = open(buf, O_RDONLY);
  return fd;
}

#ifndef __NR_mmap
#define __NR_mmap 192
#endif
#ifndef __NR_preadv
#define __NR_preadv 333
#endif
#ifndef __NR_timer_create
#define __NR_timer_create 259
#endif
#undef __NR_mmap
#define __NR_mmap __NR_mmap2

long r[26];
void* thr(void* arg)
{
  switch ((long)arg) {
  case 0:
    r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul,
                   0xfffffffffffffffful, 0x0ul);
    break;
  case 1:
    memcpy((void*)0x20337ff2, "\x74\x69\x6d\x65\x72\x73\x00", 7);
    r[2] = syz_open_procfs(0x0ul, 0x20337ff2ul);
    break;
  case 2:
    *(uint32_t*)0x20f40000 = (uint32_t)0x201ee000;
    *(uint32_t*)0x20f40004 = (uint32_t)0x0;
    *(uint32_t*)0x20f40008 = (uint32_t)0x20fe3000;
    *(uint32_t*)0x20f4000c = (uint32_t)0x0;
    *(uint32_t*)0x20f40010 = (uint32_t)0x209f0f31;
    *(uint32_t*)0x20f40014 = (uint32_t)0x0;
    *(uint32_t*)0x20f40018 = (uint32_t)0x2083e000;
    *(uint32_t*)0x20f4001c = (uint32_t)0x1000;
    r[11] =
        syscall(__NR_preadv, r[2], 0x20f40000ul, 0x4ul, 0x2000004ul);
    break;
  case 3:
    *(uint32_t*)0x202ba000 = (uint32_t)0x0;
    *(uint32_t*)0x202ba004 = (uint32_t)0x1d;
    *(uint32_t*)0x202ba008 = (uint32_t)0x1000002;
    *(uint32_t*)0x202ba00c = (uint32_t)0x207db000;
    *(uint32_t*)0x202ba010 = (uint32_t)0x20568fd4;
    *(uint64_t*)0x202ba018 = (uint64_t)0x0;
    *(uint64_t*)0x202ba020 = (uint64_t)0x0;
    *(uint64_t*)0x202ba028 = (uint64_t)0x0;
    *(uint64_t*)0x202ba030 = (uint64_t)0x0;
    *(uint64_t*)0x202ba038 = (uint64_t)0x0;
    *(uint64_t*)0x202ba040 = (uint64_t)0x0;
    *(uint64_t*)0x202ba048 = (uint64_t)0x0;
    *(uint64_t*)0x202ba050 = (uint64_t)0x0;
    r[25] =
        syscall(__NR_timer_create, 0x0ul, 0x202ba000ul, 0x201e6ffcul);
    break;
  }
  return 0;
}

void loop()
{
  long i;
  pthread_t th[8];

  memset(r, -1, sizeof(r));
  srand(getpid());
  for (i = 0; i < 4; i++) {
    pthread_create(&th[i], 0, thr, (void*)i);
    usleep(rand() % 10000);
  }
  for (i = 0; i < 4; i++) {
    pthread_create(&th[4 + i], 0, thr, (void*)i);
    if (rand() % 2)
      usleep(rand() % 10000);
  }
  usleep(rand() % 100000);
}

int main()
{
  loop();
  return 0;
}