// https://syzkaller.appspot.com/bug?id=0b37b0c24bc95eb3ed6bf096b19b504ecd3f7144
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/usb/ch9.h>

unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

#define USB_DEBUG 0

#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32

struct usb_iface_index {
  struct usb_interface_descriptor* iface;
  struct usb_endpoint_descriptor* eps[USB_MAX_EP_NUM];
  unsigned eps_num;
};

struct usb_device_index {
  struct usb_device_descriptor* dev;
  struct usb_config_descriptor* config;
  unsigned config_length;
  struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
  unsigned ifaces_num;
};

static bool parse_usb_descriptor(char* buffer, size_t length,
                                 struct usb_device_index* index)
{
  if (length < sizeof(*index->dev) + sizeof(*index->config))
    return false;
  memset(index, 0, sizeof(*index));
  index->dev = (struct usb_device_descriptor*)buffer;
  index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
  index->config_length = length - sizeof(*index->dev);
  size_t offset = 0;
  while (true) {
    if (offset + 1 >= length)
      break;
    uint8_t desc_length = buffer[offset];
    uint8_t desc_type = buffer[offset + 1];
    if (desc_length <= 2)
      break;
    if (offset + desc_length > length)
      break;
    if (desc_type == USB_DT_INTERFACE &&
        index->ifaces_num < USB_MAX_IFACE_NUM) {
      struct usb_interface_descriptor* iface =
          (struct usb_interface_descriptor*)(buffer + offset);
      index->ifaces[index->ifaces_num++].iface = iface;
    }
    if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
      struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
      if (iface->eps_num < USB_MAX_EP_NUM)
        iface->eps[iface->eps_num++] =
            (struct usb_endpoint_descriptor*)(buffer + offset);
    }
    offset += desc_length;
  }
  return true;
}

enum usb_fuzzer_event_type {
  USB_FUZZER_EVENT_INVALID,
  USB_FUZZER_EVENT_CONNECT,
  USB_FUZZER_EVENT_DISCONNECT,
  USB_FUZZER_EVENT_SUSPEND,
  USB_FUZZER_EVENT_RESUME,
  USB_FUZZER_EVENT_CONTROL,
};

struct usb_fuzzer_event {
  uint32_t type;
  uint32_t length;
  char data[0];
};

struct usb_fuzzer_init {
  uint64_t speed;
  const char* driver_name;
  const char* device_name;
};

struct usb_fuzzer_ep_io {
  uint16_t ep;
  uint16_t flags;
  uint32_t length;
  char data[0];
};

#define USB_FUZZER_IOCTL_INIT _IOW('U', 0, struct usb_fuzzer_init)
#define USB_FUZZER_IOCTL_RUN _IO('U', 1)
#define USB_FUZZER_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_fuzzer_event)
#define USB_FUZZER_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_fuzzer_ep_io)
#define USB_FUZZER_IOCTL_EP0_READ _IOWR('U', 4, struct usb_fuzzer_ep_io)
#define USB_FUZZER_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_FUZZER_IOCTL_EP_WRITE _IOW('U', 7, struct usb_fuzzer_ep_io)
#define USB_FUZZER_IOCTL_EP_READ _IOWR('U', 8, struct usb_fuzzer_ep_io)
#define USB_FUZZER_IOCTL_CONFIGURE _IO('U', 9)
#define USB_FUZZER_IOCTL_VBUS_DRAW _IOW('U', 10, uint32_t)

int usb_fuzzer_open()
{
  return open("/sys/kernel/debug/usb-fuzzer", O_RDWR);
}

int usb_fuzzer_init(int fd, uint32_t speed, const char* driver,
                    const char* device)
{
  struct usb_fuzzer_init arg;
  arg.speed = speed;
  arg.driver_name = driver;
  arg.device_name = device;
  return ioctl(fd, USB_FUZZER_IOCTL_INIT, &arg);
}

int usb_fuzzer_run(int fd)
{
  return ioctl(fd, USB_FUZZER_IOCTL_RUN, 0);
}

int usb_fuzzer_event_fetch(int fd, struct usb_fuzzer_event* event)
{
  return ioctl(fd, USB_FUZZER_IOCTL_EVENT_FETCH, event);
}

int usb_fuzzer_ep0_write(int fd, struct usb_fuzzer_ep_io* io)
{
  return ioctl(fd, USB_FUZZER_IOCTL_EP0_WRITE, io);
}

int usb_fuzzer_ep0_read(int fd, struct usb_fuzzer_ep_io* io)
{
  return ioctl(fd, USB_FUZZER_IOCTL_EP0_READ, io);
}

int usb_fuzzer_ep_write(int fd, struct usb_fuzzer_ep_io* io)
{
  return ioctl(fd, USB_FUZZER_IOCTL_EP_WRITE, io);
}

int usb_fuzzer_ep_read(int fd, struct usb_fuzzer_ep_io* io)
{
  return ioctl(fd, USB_FUZZER_IOCTL_EP_READ, io);
}

int usb_fuzzer_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
  return ioctl(fd, USB_FUZZER_IOCTL_EP_ENABLE, desc);
}

int usb_fuzzer_configure(int fd)
{
  return ioctl(fd, USB_FUZZER_IOCTL_CONFIGURE, 0);
}

int usb_fuzzer_vbus_draw(int fd, uint32_t power)
{
  return ioctl(fd, USB_FUZZER_IOCTL_VBUS_DRAW, power);
}

#define USB_MAX_PACKET_SIZE 1024

struct usb_fuzzer_control_event {
  struct usb_fuzzer_event inner;
  struct usb_ctrlrequest ctrl;
  char data[USB_MAX_PACKET_SIZE];
};

struct usb_fuzzer_ep_io_data {
  struct usb_fuzzer_ep_io inner;
  char data[USB_MAX_PACKET_SIZE];
};

struct vusb_connect_string_descriptor {
  uint32_t len;
  char* str;
} __attribute__((packed));

struct vusb_connect_descriptors {
  uint32_t qual_len;
  char* qual;
  uint32_t bos_len;
  char* bos;
  uint32_t strs_len;
  struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));

static const char default_string[] = {8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0};

static const char default_lang_id[] = {4, USB_DT_STRING, 0x09, 0x04};

static bool lookup_connect_response(struct vusb_connect_descriptors* descs,
                                    struct usb_device_index* index,
                                    struct usb_ctrlrequest* ctrl,
                                    char** response_data,
                                    uint32_t* response_length)
{
  uint8_t str_idx;
  switch (ctrl->bRequestType & USB_TYPE_MASK) {
  case USB_TYPE_STANDARD:
    switch (ctrl->bRequest) {
    case USB_REQ_GET_DESCRIPTOR:
      switch (ctrl->wValue >> 8) {
      case USB_DT_DEVICE:
        *response_data = (char*)index->dev;
        *response_length = sizeof(*index->dev);
        return true;
      case USB_DT_CONFIG:
        *response_data = (char*)index->config;
        *response_length = index->config_length;
        return true;
      case USB_DT_STRING:
        str_idx = (uint8_t)ctrl->wValue;
        if (descs && str_idx < descs->strs_len) {
          *response_data = descs->strs[str_idx].str;
          *response_length = descs->strs[str_idx].len;
          return true;
        }
        if (str_idx == 0) {
          *response_data = (char*)&default_lang_id[0];
          *response_length = default_lang_id[0];
          return true;
        }
        *response_data = (char*)&default_string[0];
        *response_length = default_string[0];
        return true;
      case USB_DT_BOS:
        *response_data = descs->bos;
        *response_length = descs->bos_len;
        return true;
      case USB_DT_DEVICE_QUALIFIER:
        if (!descs->qual) {
          struct usb_qualifier_descriptor* qual =
              (struct usb_qualifier_descriptor*)response_data;
          qual->bLength = sizeof(*qual);
          qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
          qual->bcdUSB = index->dev->bcdUSB;
          qual->bDeviceClass = index->dev->bDeviceClass;
          qual->bDeviceSubClass = index->dev->bDeviceSubClass;
          qual->bDeviceProtocol = index->dev->bDeviceProtocol;
          qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
          qual->bNumConfigurations = index->dev->bNumConfigurations;
          qual->bRESERVED = 0;
          *response_length = sizeof(*qual);
          return true;
        }
        *response_data = descs->qual;
        *response_length = descs->qual_len;
        return true;
      default:
        exit(1);
        return false;
      }
      break;
    default:
      exit(1);
      return false;
    }
    break;
  default:
    exit(1);
    return false;
  }
  return false;
}

static volatile long syz_usb_connect(volatile long a0, volatile long a1,
                                     volatile long a2, volatile long a3)
{
  uint64_t speed = a0;
  uint64_t dev_len = a1;
  char* dev = (char*)a2;
  struct vusb_connect_descriptors* descs = (struct vusb_connect_descriptors*)a3;
  if (!dev) {
    return -1;
  }
  struct usb_device_index index;
  memset(&index, 0, sizeof(index));
  int rv = 0;
  rv = parse_usb_descriptor(dev, dev_len, &index);
  if (!rv) {
    return rv;
  }
  int fd = usb_fuzzer_open();
  if (fd < 0) {
    return fd;
  }
  char device[32];
  sprintf(&device[0], "dummy_udc.%llu", procid);
  rv = usb_fuzzer_init(fd, speed, "dummy_udc", &device[0]);
  if (rv < 0) {
    return rv;
  }
  rv = usb_fuzzer_run(fd);
  if (rv < 0) {
    return rv;
  }
  bool done = false;
  while (!done) {
    struct usb_fuzzer_control_event event;
    event.inner.type = 0;
    event.inner.length = sizeof(event.ctrl);
    rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event);
    if (rv < 0) {
      return rv;
    }
    if (event.inner.type != USB_FUZZER_EVENT_CONTROL)
      continue;
    bool response_found = false;
    char* response_data = NULL;
    uint32_t response_length = 0;
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      response_found = lookup_connect_response(
          descs, &index, &event.ctrl, &response_data, &response_length);
      if (!response_found) {
        return -1;
      }
    } else {
      if ((event.ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD ||
          event.ctrl.bRequest != USB_REQ_SET_CONFIGURATION) {
        exit(1);
        return -1;
      }
      done = true;
    }
    if (done) {
      rv = usb_fuzzer_vbus_draw(fd, index.config->bMaxPower);
      if (rv < 0) {
        return rv;
      }
      rv = usb_fuzzer_configure(fd);
      if (rv < 0) {
        return rv;
      }
      unsigned ep;
      for (ep = 0; ep < index.ifaces[0].eps_num; ep++) {
        rv = usb_fuzzer_ep_enable(fd, index.ifaces[0].eps[ep]);
        if (rv < 0) {
        } else {
        }
      }
    }
    struct usb_fuzzer_ep_io_data response;
    response.inner.ep = 0;
    response.inner.flags = 0;
    if (response_length > sizeof(response.data))
      response_length = 0;
    if (event.ctrl.wLength < response_length)
      response_length = event.ctrl.wLength;
    response.inner.length = response_length;
    if (response_data)
      memcpy(&response.data[0], response_data, response_length);
    else
      memset(&response.data[0], 0, response_length);
    if (event.ctrl.bRequestType & USB_DIR_IN) {
      rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response);
    } else {
      rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response);
    }
    if (rv < 0) {
      return rv;
    }
  }
  sleep_ms(200);
  return fd;
}

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  intptr_t res = 0;
  memcpy(
      (void*)0x20000280,
      "\x12\x01\x00\x00\x6d\x9a\x32\x10\x45\x0c\x10\x10\xc1\xa5\x00\x00\x00\x01"
      "\x09\x02\x1b\x00\x01\x00\x00\x00\x00\x09\x04\x65\x00\x11\x03\x00\x02\x00"
      "\x07\x05\x8c\x03\x00\xff\xff\xff\xdf\xd8\xf5\x08\xc0\xa7\xdd\x3d\x4c\x25"
      "\x92\x31\xde\xb8\xee\x07\xd2\xf5\xbd\xb9\x03\x98\xa6\x0f\x44\x2e\x04\x32"
      "\xf2\x79\xd9\x5d\xe5\x9f\xa4\xd5\x0f\x00\xcd\xd6\x5d\x10\x31\xe9\x8f\x90"
      "\xaf\xb4\xbf\xd9\x3e\xa3\x7e\x5e\x03\x74\xdf\xb6\xe1\xb8\x5a\xa5\x69\x4b"
      "\xe0\xc4\x21\x47\x69\xb2\xff\x09\x9a\x7f\xcd\x49\x40\x6e\x58\x48\xbc\xe3"
      "\x48\xdc\x7b\xbb\x61\x40\x1a\x0a\x4d\xe8\x2d\x68\x68\x1e\x95\x2c\x25\xb4"
      "\x54\x5f\xc1\x58\xb3\x96\x98\xf1\xa6\xe2\x19\x9e\xfc\x5f\x2c\x97\xc9\x0c"
      "\xd2\xec\xad\xea\x10\x3a\x57\x74\x09\x74\x51\x61\x23\x79\x74\xcd\x55\xfd"
      "\x34\x85\x4e\xeb\x2c\x6a\x75\x99\x84\xd0\x6b\x45\x34\x53\x95\xd0\x92\x48"
      "\x32\xc4\x7a\xfa\xca\x26\x42\x84\x1d\x69\x2d\x51\x1d\xc1\x25\xbd\xc2\x21"
      "\x17\xc7\xde\xe5\x9e\x61\xf9\x0c\xb3\x8a\xdc\x93\x17\x06\xf1\x2d\x7a\x48"
      "\x82\x77\xca\xdb\x04\xba\x63\x63\xf5\x79\x0e\x36\x16\x34\x09\x9c\x19\x73"
      "\x64\xe2\x54\x88\x8b\x7a\x1f\xb6\x42\x27\x20\x69\x2f\x26\x38\x07\xde\xd4"
      "\xd7\x42\xf0\x63\x18\x17\x80\x1e\xe2\x34\x01\xf0\xed\x3d\x67\x3e\x36\xa7"
      "\xcf\xe8\x51\x14\xcc\x29\x2a\x9b\x27\xcb\xcd\x04\x59\xf1\x06\xfa\x06\xe1"
      "\x4e\x9d\x78\x1e\x11\x8f\x7b\x13\x31\xa6\xef\xec\xed\x8b\x04\x15\x1c\x8e"
      "\xd4\x92\x82\xf3\x93\x5e\x4e\xde\xa3\x2a\xb0\x97\x2d\x55\x7a\x7c\xda\x90"
      "\xa2\xa8\x11\x1c\x2d\xb5\x69\xa8\xb4\x75\xfd\x32\xff\x5f\x92\x95\xe0\x7f"
      "\x32\x67\x08\x02\xca\xd4\xff\x0d\xd9\x08\xcc\x8f\xdd\xcd\x2d\xb5\x4f\x51"
      "\x15\xab\x98\x6f\x52\x48\x90\xf2\x29\x9a\xec\x0c\x93\x2e\xb1\x86\x49\xdd"
      "\x4c\x6d\xff\x8e\x3a\x96\x09\xac\xa6\x36\xe8\x8e\x71\x79\x99\x16\x19\x6e"
      "\x9a\xb0\x69\xc0\x68\xd0\x7d\x38\x62\xe0\x15\x1e\xae\xa8\x6c\x04\x5d\x57"
      "\xdd\x6a\xc4\x06\x4f\x27\x23\x78\x80\xa7\x45\x20\xb3\x55\x14\xec\xe8\xc2"
      "\x89\x9e\x7b\xfa\x97\x1a\xc0\x22\xcf\x3a\x02\x58\x5f\x14\x5d\x75\xeb\x35"
      "\x1d\xb1\x16\x21\xdf\x7a\x85\x18\x54\x9b\x45\xd6\xdd\x44\xb8\x13\x6f\x0f"
      "\xd3\xd4\x77\x32\xb5\x42\x56\x3e\x27\xc6\xf4\x05\xce\x0c\xc3\xdd\x6f\xb1"
      "\x6c\x5d\x2d\x21\x0d\xc0\xc1\xb5\xe1\x03\xb0\xcd\x8c\x70\x22\x05\xb7\x1e"
      "\xd8\x00\x9a\xa2\x13\x53\x12\x48\x09\x76\xa3\x94\xe1\x4b\x27\xdc\x22\x8e"
      "\x50\x25\xdd\x19\x0b\x00\x02\x40\x9b\xf6\x5f\xab\xe1\x71\x71\x33\xa9\x7b"
      "\xc5\x0c\xc6\x32\x7a\x35\x8b\x81\xb1\x2c\x71\xbf\x62\x5f\xae\x46\xcb\x8a"
      "\x3b\x28\x15\x26\x92\xdf\x8f\x08\xe8\x99\x34\x60\x67\x54\xf3\x63\xef\xe2"
      "\xab\xb0\x80\xd2\x10\xb3\x14\xeb\x18\xdf\x26\xad\x3a\xdf\x66\xf0\x02\x22"
      "\x0c\xd7\x13\xee\xfa\x08\x4f\xff\x0d\x9e\xc9\xa8\x41\x94\xc8\x91\xbb\x15"
      "\xd8\x13\x44\xa2\x3d\xfe\xc6\x01\xc1\x97\xf6\x13\x92\xda\x93\x41\x32\x27"
      "\x86\x9b\x30\xa6\xe1\x12\x87\xbb\x65\x61\x74\xc9\xbc\x80\xa1\x93\x20\x8b"
      "\x1f\x81\x17\xd8\x68\xcf\xc9\xb2\xae\x30\x05\xe2\x1d\x7d\x77\xfe\xcb\xdd"
      "\xaf\xe6\x6a\x47\x97\xc3\x58\x7f\x65\xc8\x0f\x74\x2c\xf4\x04\x25\x16\x56"
      "\x11\x10\xc6\x1f\xd8\xde\x55\x44\x80\x89\x8e\x47\xc0\x13\xf7\x26\x74\xd2"
      "\xde\x44\x44\xaa\x51\x01\x0f\xf8\x48\x6f\x9a\x47\xb4\x80\x77\x36\x1f\xbd"
      "\xf1\x2e\xd9\x4a\xb1\x39\x55\x3d\x3a\x49\x77\x4d\xc0\x2f\x55\x3f\xfb\xd3"
      "\x49\x56\x3f\x4e\x65\x47\x5c\x26\x15\x9f\xee\x38\xfc\x55\x8c\xe6\xa9\xd3"
      "\xc1\x2d\xdc\x77\x11\x18\x2d\xab\xc4\x47\x2f\xe5\x4f\x75\x9b\x0c\x22\x87"
      "\x2a\xa1\x7a\x2d\x40\x19\x18\xe3\x63\x42\x1d\x96\xf2\x5c\x02\x3f\x78\x98"
      "\x67\x97\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
      826);
  syz_usb_connect(0, 0x3b, 0x20000280, 0);
  res = syz_open_dev(0xc, 0xb4, 0);
  if (res != -1)
    r[0] = res;
  memcpy((void*)0x20000000, "0", 1);
  syscall(__NR_write, r[0], 0x20000000, 1);
  return 0;
}