// https://syzkaller.appspot.com/bug?id=d0d8879a66b36bd60a0d815b7755e558a9afc82f
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  memcpy((void*)0x20000040, "/dev/sequencer\000", 15);
  res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000040ul,
                /*flags=O_LARGEFILE|O_RDWR*/ 0x8002ul, /*mode=*/0ul);
  if (res != -1)
    r[0] = res;
  *(uint32_t*)0x200016c0 = 0x465;
  *(uint8_t*)0x200016c4 = 0x7d;
  *(uint16_t*)0x200016c5 = 0;
  *(uint16_t*)0x200016c7 = 0x500;
  *(uint16_t*)0x200016c9 = 0x14f;
  *(uint16_t*)0x200016cb = 0;
  *(uint32_t*)0x200016cd = 0;
  *(uint8_t*)0x200016d1 = 0;
  *(uint32_t*)0x200016d2 = 0;
  *(uint64_t*)0x200016d6 = 0;
  *(uint32_t*)0x200016de = 0;
  *(uint32_t*)0x200016e2 = 0;
  *(uint32_t*)0x200016e6 = 0;
  *(uint64_t*)0x200016ea = 0;
  *(uint16_t*)0x200016f2 = 0x2e;
  memcpy((void*)0x200016f4,
         "\004nodZ=\277d\0027\374b%"
         "\377\377\377\200\005\000\000\000\000\000\000\377\003\377\222\351\026"
         "\000\005\233eq,\223\313=\266\3021\321\031\252\241",
         46);
  *(uint16_t*)0x20001722 = 0x39;
  memcpy((void*)0x20001724,
         "p\002\000}\372g>\377\353\t\2655\037[\336\005@\000\000\000\000\030{"
         "\202\331\265i(\373\277\v\000\000+Y_"
         "\313\024\003CT\271\375\236\361\226\245\034\325\025z\334\201\006\264"
         "\224\341",
         57);
  *(uint16_t*)0x2000175d = 0x60;
  memcpy(
      (void*)0x2000175f,
      "\317`7-j\314\352\270\310\216A\223\371\264\314\366\000\214F\305m\317\325~"
      "\250\241\3104\312hD\274d\016\016\214\332~A\233C\356\357\312T\371&\f\376!"
      "\302S~\234\223`A\214Nf\224\006."
      "\231\217\246rOp\323Z\250\250d\vbXa\3010l\003\252\314\031\000\000\000\000"
      "\000\000\000\000\000\000\000",
      96);
  *(uint16_t*)0x200017bf = 0x55;
  memcpy((void*)0x200017c1,
         "\370\366i\373qm\3171^\312\363\205@\232\306[\224\bg\214,;"
         "\236\035R\303l\336{"
         "\244\244\000\264\260\264\361t\246f\250R\232E\0334\a\333\332\262\210K"
         "\257\005\000\000\000\000\000\000\000G\354!"
         "\312\277\362\017\234\034\2766\364\375\032L\333\200\350\324\a\000\000"
         "\0007\000",
         85);
  *(uint16_t*)0x20001816 = 0x301;
  memcpy(
      (void*)0x20001818,
      "odev/"
      "n\261{#\000\371\332\245\356#&n\317\205\376\246^"
      "B\331y\243\375\345\364u\332\360;\021r\331{"
      "\255\307\tZ\375v\376O\fA\367\367t\036\254\003\000\000\354\377\000\000"
      "\333\240\302\367\360\237\365<~M\032\326n-"
      "\a\001\230\001\2370\021\204G\252u\370$"
      "k\314B\352\250\3061\300\305\000\225\232t\365\026\205\365\006\256\211H"
      "\006\207\202g\325\241)\215y,J7\362\341\313\275$"
      "\202\222\232\r\211r\265\317s.\245\260\327#\205\223\256\323\264."
      "\347\312\300}\340\235\035h\246\0033\250\202F}+1\252\373V\305}}\306&"
      "\3449\a\226\241\353H\'Fi\253\023\370\261\035\024`Y\363\020\342cMY?"
      "\354e\325)\363\202\006fd\300\373NL\220W\np\004\2379\237\006\037u\267y|"
      "\341\376\021\352\221\226\t\325\032A\335=\343\004\275|~"
      "\320\244V\360\256\022.a\005\311\316\210}\365\246\340\266\247}"
      "Yl\370\213\246\345\3069|}P!\327\230\225("
      "\375\0279\341\302\330\177\302\000\000\0000\344\356+"
      "\374\177\200P\205\021C\345\026\032\315G\025\n\313\257t8\"\337\342\003"
      "\261\b\323~\221M\301\345>#LP\236\312A\a\241q,\252\235\245="
      "\005\0346\210Ly\030&a\363\3126\274\333\373\275&"
      "q\t\3701\235\215\325\300p\231\353\033\021\003\006U\365biOat="
      "\031B\033J\031\357\213\213L\351\311\223\307\326\3130\fNezNP\243["
      "\\\301k\214\026\032\216=\371\003k\274\362\212\334\321\232lL)"
      "\027\t\256\345\253>[\305\256)\364u\344\322D\b\265\026}\017\257_"
      "\301Vkp\\\213`\257\250\254\244/"
      "~\004i\030\212\016\360b\312\030\343\217\236\341\n\307}+~"
      "\271\326\016\247\237\333Ud\021H[\033\023\333\270\242\246b."
      "\274\370Lio\244\332!\272\3222\r\rh\351\277CF\360ha\031\243\236@"
      "\003\225\310\362\202^\240i\256\016\024;\321\244Ay\355lTp,^"
      "\232\031\314\177\372P\017\244\033l\200I\275\344X\'\325N\311\001\322z\321"
      "%\005h\211\2633k?\006\203\214[fz\342.\376;\301[\202_\177\274\344\200\'("
      "\034\371\376\217\302\037\307|$=\342g\0051\016\270\034\367M\340)"
      "1\222\241?j\320W\336a\375\212\272\216\364C\233\300jE\262\2601bQZ#C:"
      "\376\265*\355\265\253o3FS8\005\025\367y\363]\310\247\2147w$\222\242(L!"
      "\322\023V\324s\360\017\205\023|{\360cou}5(\206\233?"
      "\000w5\317\370\\\235\227\213\365]\314&\326-%"
      "\343\b\360\210\'\251\037\364{"
      "\354\222\370\351\036y\bfT\000\252N9\263Y\206#\235\\{\224\222\305\273&"
      "\274U\265[I\355pHnn}\243\214 "
      "\204P\371\367\236\033A\000\000\000\000\000\000\000\000\000\000\000\000"
      "\000",
      769);
  *(uint32_t*)0x20001b19 = -1;
  *(uint32_t*)0x20001b1d = 0;
  *(uint32_t*)0x20001b21 = 0;
  syscall(__NR_write, /*fd=*/r[0], /*data=*/0x200016c0ul, /*size=*/0x465ul);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  loop();
  return 0;
}