// https://syzkaller.appspot.com/bug?id=4522c4fb3896c243a66d4bda935f828e80899c2c
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf));
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

#ifndef __NR_mmap
#define __NR_mmap 192
#endif
#ifndef __NR_ioctl
#define __NR_ioctl 54
#endif
#ifndef __NR_readv
#define __NR_readv 145
#endif
#undef __NR_mmap
#define __NR_mmap __NR_mmap2

long r[1];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
  memcpy((void*)0x20cacff7, "/dev/sg#", 9);
  r[0] = syz_open_dev(0x20cacff7, 0, 0);
  memcpy((void*)0x20b36000,
         "\x9f\x9f\x9f\x78\x6d\x26\x71\x6d\x14\x54\x73\xd9\x22\x23\x23\xe7\xa0"
         "\x51\x61\x53\xb7\xda\x7e\x4f\xb4\xa4\xee\x04\xf8\x5a\x5a\x83\xce\xed"
         "\x1b\x2e\x0f\xb4\x6a\xfb\xf7\xfb\xb8\x7d\xeb\x27\x31\xb1\x17\xf8\x05"
         "\x5c\x29\xc3\x5f\x9e\xce\xed\xd7\x1d\xc4\x1d\xed\xf4\x94\xe0\x18\x2e"
         "\x0c\xcb\xd7\x5a\x8b\x6d\x4c\xb5\x24\x46\x6b\x84\x9c\x51\x5b\x9f\x4f"
         "\x7d\xa6\x4c\x49\x48\x98\xbd\x44\x8d\xf0\x1d\xfa\x96\x6e\xc4\x1a\x1f"
         "\x28\x09\xe8\xda\xf1\x19\xd9\x19\x89\x74\xad\xd9\xdf\x06\xde\x62\x3d"
         "\x91\x9e\xb4\x9b\x96\x23\xf4\x1a\xd1\x50\xcb\x85\x07\x0a\x87\xdb\xec"
         "\xca\x08\xc9\x9d\x06\xf0\x98\x0a\xd4\x29\xa8\x46\x76\x87\xc6\x34\xe3"
         "\x34\x4b\x33\x39\xe0",
         158);
  syscall(__NR_ioctl, r[0], 0x2285, 0x20b36000);
  *(uint32_t*)0x20cea000 = 0x20188000;
  *(uint32_t*)0x20cea004 = 0x92;
  *(uint32_t*)0x20cea008 = 0x2027f000;
  *(uint32_t*)0x20cea00c = 0;
  *(uint32_t*)0x20cea010 = 0x20a86000;
  *(uint32_t*)0x20cea014 = 0;
  syscall(__NR_readv, r[0], 0x20cea000, 3);
}

int main()
{
  loop();
  return 0;
}