// https://syzkaller.appspot.com/bug?id=80e42cefc7004dbe7e24ca709ddb1aa03a531b73
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

#define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1)

#define BITMASK_LEN_OFF(type, bf_off, bf_len)                                  \
  (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))

#define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len)                      \
  if ((bf_off) == 0 && (bf_len) == 0) {                                        \
    *(type*)(addr) = (type)(val);                                              \
  } else {                                                                     \
    type new_val = *(type*)(addr);                                             \
    new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len));                     \
    new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off);          \
    *(type*)(addr) = new_val;                                                  \
  }

static uintptr_t syz_open_procfs(uintptr_t a0, uintptr_t a1)
{

  char buf[128];
  memset(buf, 0, sizeof(buf));
  if (a0 == 0) {
    snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1);
  } else if (a0 == (uintptr_t)-1) {
    snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1);
  } else {
    snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0, (char*)a1);
  }
  int fd = open(buf, O_RDWR);
  if (fd == -1)
    fd = open(buf, O_RDONLY);
  return fd;
}

static void execute_one();
extern unsigned long long procid;

void loop()
{
  while (1) {
    execute_one();
  }
}

#ifndef __NR_getrandom
#define __NR_getrandom 318
#endif

uint64_t r[7] = {0x0,
                 0xffffffffffffffff,
                 0xffffffffffffffff,
                 0x0,
                 0xffffffffffffffff,
                 0xffffffffffffffff,
                 0xffffffffffffffff};
void execute_one()
{
  long res = 0;
  syscall(__NR_sysinfo, 0x20000140);
  memcpy((void*)0x20000200, "big_key", 8);
  *(uint8_t*)0x20000240 = 0x73;
  *(uint8_t*)0x20000241 = 0x79;
  *(uint8_t*)0x20000242 = 0x7a;
  *(uint8_t*)0x20000243 = 0x22;
  *(uint8_t*)0x20000244 = 0;
  syscall(__NR_add_key, 0x20000200, 0x20000240, 0x20000280, 0, 0xfffffffb);
  *(uint32_t*)0x200003c0 = 8;
  *(uint32_t*)0x200003c4 = -1;
  *(uint32_t*)0x200003c8 = 0x3400;
  STORE_BY_BITMASK(uint32_t, 0x200003cc, 6, 0, 1);
  STORE_BY_BITMASK(uint32_t, 0x200003cc, 3, 1, 2);
  STORE_BY_BITMASK(uint32_t, 0x200003cc, 3, 3, 1);
  STORE_BY_BITMASK(uint32_t, 0x200003cc, 3, 4, 1);
  STORE_BY_BITMASK(uint32_t, 0x200003cc, 0x3f, 5, 1);
  STORE_BY_BITMASK(uint32_t, 0x200003cc, 0xe6d, 6, 1);
  STORE_BY_BITMASK(uint32_t, 0x200003cc, 0, 7, 1);
  syscall(__NR_modify_ldt, 1, 0x200003c0, 0x10);
  *(uint32_t*)0x20000440 = 0xc;
  res = syscall(__NR_getsockopt, -1, 1, 0x11, 0x20000400, 0x20000440);
  if (res != -1)
    r[0] = *(uint32_t*)0x20000400;
  memcpy((void*)0x200006c0, "syz1", 4);
  syscall(__NR_write, -1, 0x200006c0, 4);
  memcpy((void*)0x20001700, "syz0", 5);
  syscall(__NR_openat, -1, 0x20001700, 0x200002, 0);
  memcpy((void*)0x20001780, "tasks", 6);
  syscall(__NR_openat, -1, 0x20001780, 2, 0);
  syscall(__NR_tgkill, r[0], r[0], 0x32);
  memcpy((void*)0x20000100, "/dev/null", 10);
  syscall(__NR_openat, 0xffffffffffffff9c, 0x20000100, 0x802, 0);
  memcpy((void*)0x20000000, "./file0", 8);
  syscall(__NR_creat, 0x20000000, 2);
  *(uint32_t*)0x20001140 = 0;
  *(uint16_t*)0x20001148 = 2;
  *(uint16_t*)0x2000114a = htobe16(0);
  *(uint8_t*)0x2000114c = 0xac;
  *(uint8_t*)0x2000114d = 0x14;
  *(uint8_t*)0x2000114e = 0x14;
  *(uint8_t*)0x2000114f = 0xaa;
  *(uint8_t*)0x20001150 = 0;
  *(uint8_t*)0x20001151 = 0;
  *(uint8_t*)0x20001152 = 0;
  *(uint8_t*)0x20001153 = 0;
  *(uint8_t*)0x20001154 = 0;
  *(uint8_t*)0x20001155 = 0;
  *(uint8_t*)0x20001156 = 0;
  *(uint8_t*)0x20001157 = 0;
  *(uint16_t*)0x200011c8 = 2;
  *(uint16_t*)0x200011ca = htobe16(0);
  *(uint32_t*)0x200011cc = htobe32(0xe0000002);
  *(uint8_t*)0x200011d0 = 0;
  *(uint8_t*)0x200011d1 = 0;
  *(uint8_t*)0x200011d2 = 0;
  *(uint8_t*)0x200011d3 = 0;
  *(uint8_t*)0x200011d4 = 0;
  *(uint8_t*)0x200011d5 = 0;
  *(uint8_t*)0x200011d6 = 0;
  *(uint8_t*)0x200011d7 = 0;
  syscall(__NR_setsockopt, -1, 0, 0, 0x20001140, 0xffffffffffffff30);
  syscall(__NR_getrandom, 0x20000000, 0x51, 3);
  syscall(__NR_mmap, 0x20000000, 0x7fffdffff000, 0, 0x31, -1, 0);
  res = syscall(__NR_socketpair, 2, 2, 0, 0x20000000);
  if (res != -1)
    r[1] = *(uint32_t*)0x20000004;
  syscall(__NR_fcntl, r[1], 0xb);
  syscall(__NR_shmget, 0, 0x4000, 0x800, 0x20ff9000);
  memcpy((void*)0x20000080, "/dev/zero", 10);
  syscall(__NR_openat, 0xffffffffffffff9c, 0x20000080, 0x40, 0);
  syscall(__NR_socket, 0x10, 3, 0);
  memcpy((void*)0x200000c0, "./file0", 8);
  memcpy((void*)0x20000100, "./file0", 8);
  syscall(__NR_linkat, -1, 0x200000c0, -1, 0x20000100, 0x1400);
  memcpy((void*)0x20000000, "cpuacct.usage_percpu", 21);
  syscall(__NR_openat, -1, 0x20000000, 0, 0);
  res = syscall(__NR_socket, 0x10, 3, 0);
  if (res != -1)
    r[2] = res;
  syscall(__NR_fcntl, r[2], 9);
  syscall(__NR_ioctl, -1, 0x5429, 0x20002440);
  syscall(__NR_getgid);
  memcpy((void*)0x20002a80, "./file0", 8);
  syscall(__NR_lstat, 0x20002a80, 0x20002ac0);
  *(uint16_t*)0x20000040 = 0;
  *(uint16_t*)0x20000042 = 0;
  *(uint32_t*)0x20000044 = 0;
  *(uint32_t*)0x20000048 = 0;
  syscall(__NR_connect, -1, 0x20000040, 0xc);
  syscall(__NR_io_destroy, 0);
  syscall(__NR_fstat, -1, 0x200001c0);
  *(uint32_t*)0x20000180 = 0xe8;
  res = syscall(__NR_getsockopt, -1, 0, 0x10, 0x20000080, 0x20000180);
  if (res != -1)
    r[3] = *(uint32_t*)0x200000b0;
  *(uint32_t*)0x20000240 = r[3];
  *(uint8_t*)0x20000244 = 0xac;
  *(uint8_t*)0x20000245 = 0x14;
  *(uint8_t*)0x20000246 = 0x14;
  *(uint8_t*)0x20000247 = 0xbb;
  *(uint32_t*)0x20000248 = htobe32(-1);
  syscall(__NR_setsockopt, -1, 0, 8, 0x20000240, 0xc);
  *(uint32_t*)0x20000200 = 0xc;
  syscall(__NR_getsockopt, -1, 1, 0x11, 0x200001c0, 0x20000200);
  *(uint32_t*)0x200000c0 = 0;
  res = syscall(__NR_accept, 0xffffff9c, 0, 0x200000c0);
  if (res != -1)
    r[4] = res;
  res = syscall(__NR_dup, 0xffffff9c);
  if (res != -1)
    r[5] = res;
  *(uint64_t*)0x200004c0 = 0x20000200;
  *(uint64_t*)0x20000200 = 0;
  *(uint32_t*)0x20000208 = 0;
  *(uint32_t*)0x2000020c = 0;
  *(uint16_t*)0x20000210 = 0x5396;
  *(uint16_t*)0x20000212 = 0x3ff;
  *(uint32_t*)0x20000214 = r[4];
  *(uint64_t*)0x20000218 = 0x20000100;
  memcpy((void*)0x20000100,
         "\xc8\x8b\x5a\x61\xe6\x27\x31\xed\x29\x7f\x20\x88\x4a\x83\x61\xff\x76"
         "\x99\x2d\x3e\x36\xcf\xe6\xdc\xf5\xfe\xcb\x53\xa7\x8f\x26\xb2\xb9\x6f"
         "\x6f\x1d\xe5\x31\x56\x7c\x01\x29\xbc\xfc\xf5\xe6\xf6\xf3\x46\x1a\xda"
         "\xc0\xbe\xf5\xa1\x17\xa0\xe6\xf1\xdf\x8d\x95\x71\xb0\xdd\xbf\x9c\xaf"
         "\x37\x48\x13\x01\xbb\x34\x1a\x56\xf5\x13\xba\xa4\x3d\x69\xc7\x31\x34"
         "\xbe\x42\x30\x0e\x0e\xc3\x37\x01\x71\xf9\x87\x29\xd5\x18\x59\x67\x02"
         "\x09\x0e\x99\xaf\xc8\xf8\x4c\x67\xea\x8d\xf9\x17\xbe\x30\x8f\xc9\xb5"
         "\xf5\x29\x62\x9b\xd6\x6e\x6f\xcb\xfe\xd7\xf7\xf3\xa0\x4a\x3c\x10\xd9"
         "\x85\xc7\x97\x97\x2d\x3d\x41\xdf\x1a\xe3\xc4\x1f\xeb\x68\x45\x3c\xce"
         "\xfd\xc1\x86\x91\x70\x41\x07\xba\x5d\xc2\xbc\x85\xec\xf4\x06\xd1\xe6"
         "\xc1\x11\xa6\x2a\xc8\x33\xa0\x7c\xeb\x82\xc1\xbc\xeb\xc2\x97\xc0\xa5"
         "\x4f\x6f\x24\x5c\x8f\x85\xf6\x69\xc0\xd1\x01\x7c\xdf\x43\xef\xbe\x4c"
         "\x07\x7d\xde\x57\x6c\xee\xb6\x0c\x7d\xa4\x06\x8a\x1f\x78\x48\xd0\xb7"
         "\x7c\xb2\x8e\xc5\xf5\x8a\x54\xa2\x05\x84\xa1\x84\x36\x5b\x8e\x0a\x07"
         "\x31\x93\x43\xc7\xf1\x77\xf3\x08\xfc\x6b\x20\x79\x07\x2d",
         252);
  *(uint64_t*)0x20000220 = 0xfc;
  *(uint64_t*)0x20000228 = 8;
  *(uint64_t*)0x20000230 = 0;
  *(uint32_t*)0x20000238 = 0;
  *(uint32_t*)0x2000023c = r[5];
  *(uint64_t*)0x200004c8 = 0x200002c0;
  *(uint64_t*)0x200002c0 = 0;
  *(uint32_t*)0x200002c8 = 0;
  *(uint32_t*)0x200002cc = 0;
  *(uint16_t*)0x200002d0 = 0xd;
  *(uint16_t*)0x200002d2 = 7;
  *(uint32_t*)0x200002d4 = r[4];
  *(uint64_t*)0x200002d8 = 0x20000240;
  *(uint64_t*)0x200002e0 = 0;
  *(uint64_t*)0x200002e8 = 0x7fffffff;
  *(uint64_t*)0x200002f0 = 0;
  *(uint32_t*)0x200002f8 = 0;
  *(uint32_t*)0x200002fc = r[5];
  *(uint64_t*)0x200004d0 = 0x20000380;
  *(uint64_t*)0x20000380 = 0;
  *(uint32_t*)0x20000388 = 0;
  *(uint32_t*)0x2000038c = 0;
  *(uint16_t*)0x20000390 = 1;
  *(uint16_t*)0x20000392 = 0xf800;
  *(uint32_t*)0x20000394 = r[4];
  *(uint64_t*)0x20000398 = 0x20000300;
  *(uint64_t*)0x200003a0 = 0;
  *(uint64_t*)0x200003a8 = 8;
  *(uint64_t*)0x200003b0 = 0;
  *(uint32_t*)0x200003b8 = 1;
  *(uint32_t*)0x200003bc = r[5];
  *(uint64_t*)0x200004d8 = 0x20000480;
  *(uint64_t*)0x20000480 = 0;
  *(uint32_t*)0x20000488 = 0;
  *(uint32_t*)0x2000048c = 0;
  *(uint16_t*)0x20000490 = 0;
  *(uint16_t*)0x20000492 = 0xe6;
  *(uint32_t*)0x20000494 = r[5];
  *(uint64_t*)0x20000498 = 0x200003c0;
  memcpy((void*)0x200003c0,
         "\xff\x4f\x90\x7c\xbc\x54\xde\x3a\x79\xc4\x12\x87\x6d\x80\x0d\x54\x12"
         "\x2d\x8c\xd0\xb6\x64\xe1\xf8\x13\x08\x04\x2b\x18\xb3\x8f\x4b\x0f\x18"
         "\x22\xb0\x62\x0b\x70\x07\xea\x19\xba\xfb\xb2\xbf\x65\x41\x0d\x6a\xd8"
         "\x9e\xb2\x06\xfe\xb2\x7d\xe5\x90\xa9\xae\x0d\xf1\x1c\x6b\xa1\xfb\x13"
         "\x65\x90\x0d\xaf\xd9\x2b\x50\xfc\x03\xf5\x9c\xd6\x89\x0d\x5d\x6b\xd1"
         "\xd1\x77\xeb\xd6\x05\xa2\xb9\x83\xe8\xaa\x78\x49\xa4\x71\x90\xc8\xf9"
         "\x78\x44\x3f\xcf\xdf\x36\xf0\x07\xdb\x93\x7f\xae\x4b\x87\xc5\xc8\xfb"
         "\x80\x5d\x9a\x26\xad\xc6\xc6\x4e\x72\xa9\xdd\x6c\x47\xff\xa9\x80\x5c"
         "\x54\x55\xbc\x62\xe5\xb6\x18\xb4\x63\x01\xc1\xa8\x5b\x9b\x67\x78\xe6"
         "\x57\x21\xeb\xdd\xb7\x9e\x57\x79\x56\x47\x83\x3d\xd6\x7b\x94\x74\x66"
         "\xd3\xc3\xee\xf9\x49\x33\x26",
         177);
  *(uint64_t*)0x200004a0 = 0xb1;
  *(uint64_t*)0x200004a8 = 0x8000;
  *(uint64_t*)0x200004b0 = 0;
  *(uint32_t*)0x200004b8 = 0;
  *(uint32_t*)0x200004bc = r[5];
  syscall(__NR_io_submit, 0, 4, 0x200004c0);
  syscall(__NR_io_submit, 0, 0xffffffffffffffd5, 0x20000180);
  memcpy((void*)0x20000080,
         "\x74\x65\x61\x6d\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
         16);
  *(uint16_t*)0x20000090 = 2;
  *(uint16_t*)0x20000092 = htobe16(0x4e21);
  *(uint32_t*)0x20000094 = htobe32(0x7f000001);
  *(uint8_t*)0x20000098 = 0;
  *(uint8_t*)0x20000099 = 0;
  *(uint8_t*)0x2000009a = 0;
  *(uint8_t*)0x2000009b = 0;
  *(uint8_t*)0x2000009c = 0;
  *(uint8_t*)0x2000009d = 0;
  *(uint8_t*)0x2000009e = 0;
  *(uint8_t*)0x2000009f = 0;
  syscall(__NR_ioctl, -1, 0x8916, 0x20000080);
  res = syscall(__NR_fcntl, -1, 0, -1);
  if (res != -1)
    r[6] = res;
  *(uint32_t*)0x20000180 = 0;
  *(uint16_t*)0x20000188 = 0xa;
  *(uint16_t*)0x2000018a = htobe16(0);
  *(uint32_t*)0x2000018c = 0;
  *(uint8_t*)0x20000190 = -1;
  *(uint8_t*)0x20000191 = 1;
  *(uint8_t*)0x20000192 = 0;
  *(uint8_t*)0x20000193 = 0;
  *(uint8_t*)0x20000194 = 0;
  *(uint8_t*)0x20000195 = 0;
  *(uint8_t*)0x20000196 = 0;
  *(uint8_t*)0x20000197 = 0;
  *(uint8_t*)0x20000198 = 0;
  *(uint8_t*)0x20000199 = 0;
  *(uint8_t*)0x2000019a = 0;
  *(uint8_t*)0x2000019b = 0;
  *(uint8_t*)0x2000019c = 0;
  *(uint8_t*)0x2000019d = 0;
  *(uint8_t*)0x2000019e = 0;
  *(uint8_t*)0x2000019f = 1;
  *(uint32_t*)0x200001a0 = 0;
  *(uint16_t*)0x20000208 = 0xa;
  *(uint16_t*)0x2000020a = htobe16(0);
  *(uint32_t*)0x2000020c = 0;
  *(uint8_t*)0x20000210 = 0;
  *(uint8_t*)0x20000211 = 0;
  *(uint8_t*)0x20000212 = 0;
  *(uint8_t*)0x20000213 = 0;
  *(uint8_t*)0x20000214 = 0;
  *(uint8_t*)0x20000215 = 0;
  *(uint8_t*)0x20000216 = 0;
  *(uint8_t*)0x20000217 = 0;
  *(uint8_t*)0x20000218 = 0;
  *(uint8_t*)0x20000219 = 0;
  *(uint8_t*)0x2000021a = -1;
  *(uint8_t*)0x2000021b = -1;
  *(uint32_t*)0x2000021c = htobe32(0xe0000002);
  *(uint32_t*)0x20000220 = 0;
  syscall(__NR_setsockopt, r[6], 0x29, 0, 0x20000180, 0x108);
  *(uint32_t*)0x20000080 = 6;
  *(uint32_t*)0x20000084 = 2;
  *(uint32_t*)0x20000088 = 0;
  *(uint32_t*)0x2000008c = 0x835d;
  *(uint8_t*)0x20000090 = 9;
  *(uint8_t*)0x20000091 = 3;
  *(uint8_t*)0x20000092 = 0x93;
  *(uint8_t*)0x20000093 = 8;
  *(uint32_t*)0x20000094 = -1;
  *(uint32_t*)0x20000098 = 8;
  *(uint32_t*)0x2000009c = 0x80;
  *(uint32_t*)0x200000a0 = 9;
  syscall(__NR_ioctl, -1, 0x5404, 0x20000080);
  *(uint32_t*)0x20000100 = 0xc;
  syscall(__NR_getsockopt, -1, 0, 8, 0x200000c0, 0x20000100);
  syscall(__NR_lseek, -1, 1, 0);
  syscall(__NR_ioctl, -1, 0x5411, 0x20000040);
  memcpy((void*)0x20000080, "net/ip_tables_targets", 22);
  syz_open_procfs(0, 0x20000080);
  syscall(__NR_getrusage, 1, 0x20000080);
  syscall(__NR_io_destroy, 0);
  syscall(__NR_io_setup, 3, 0x20000000);
  *(uint32_t*)0x20000500 = 0x57;
  *(uint32_t*)0x20000504 = 8;
  *(uint32_t*)0x20000508 = 1;
  *(uint32_t*)0x2000050c = 0x81;
  *(uint8_t*)0x20000510 = 0x21;
  *(uint8_t*)0x20000511 = 0xd8;
  *(uint8_t*)0x20000512 = -1;
  *(uint8_t*)0x20000513 = -1;
  *(uint32_t*)0x20000514 = 0x20;
  *(uint32_t*)0x20000518 = 0xbf6d;
  *(uint32_t*)0x2000051c = 1;
  *(uint32_t*)0x20000520 = 0xad9c;
  syscall(__NR_ioctl, -1, 0x5403, 0x20000500);
  *(uint8_t*)0x20000600 = 0xfe;
  *(uint8_t*)0x20000601 = 0x80;
  *(uint8_t*)0x20000602 = 0;
  *(uint8_t*)0x20000603 = 0;
  *(uint8_t*)0x20000604 = 0;
  *(uint8_t*)0x20000605 = 0;
  *(uint8_t*)0x20000606 = 0;
  *(uint8_t*)0x20000607 = 0;
  *(uint8_t*)0x20000608 = 0;
  *(uint8_t*)0x20000609 = 0;
  *(uint8_t*)0x2000060a = 0;
  *(uint8_t*)0x2000060b = 0;
  *(uint8_t*)0x2000060c = 0;
  *(uint8_t*)0x2000060d = 0;
  *(uint8_t*)0x2000060e = 0;
  *(uint8_t*)0x2000060f = 0x1f;
  *(uint32_t*)0x20000610 = 0;
  syscall(__NR_setsockopt, -1, 0x29, 0x15, 0x20000600, 0x14);
  memcpy((void*)0x20000080, "tls", 4);
  syscall(__NR_setsockopt, -1, 6, 0x1f, 0x20000080, 4);
  *(uint64_t*)0x200001c0 = 0;
  *(uint64_t*)0x200001c8 = 0;
  syscall(__NR_io_getevents, 0, 0xfffffffbffff1001, 0x7fffffffffffc5d,
          0x20000140, 0x200001c0);
  syscall(__NR_io_setup, 0, 0x200000c0);
}

int main()
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  for (;;) {
    loop();
  }
}