// https://syzkaller.appspot.com/bug?id=6e70e31c3b50bd0c9fdd11ca42caef00131f5ad4
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <pthread.h>
#include <sys/wait.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Warning: Failed to open %s: %s\n", path, strerror(errno));
        return;
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] Warning: Failed to write to %s: %s\n", path, strerror(errno));
    }
    close(fd);
}

void *clock_changer(void *arg) {
    int fd = open("/sys/kernel/tracing/trace_clock", O_WRONLY);
    if (fd < 0) {
        fd = open("/sys/kernel/debug/tracing/trace_clock", O_WRONLY);
        if (fd < 0) {
            printf("[-] Failed to open trace_clock: %s\n", strerror(errno));
            exit(1);
        }
    }
    
    while (1) {
        if (write(fd, "local", 5) < 0) {}
        if (write(fd, "counter", 7) < 0) {}
    }
    return NULL;
}

void *event_generator(void *arg) {
    int fd = open("/sys/kernel/tracing/trace_marker", O_WRONLY);
    if (fd < 0) {
        fd = open("/sys/kernel/debug/tracing/trace_marker", O_WRONLY);
        if (fd < 0) {
            printf("[-] Failed to open trace_marker: %s\n", strerror(errno));
            exit(1);
        }
    }
    
    while (1) {
        if (write(fd, "x", 1) < 0) {}
    }
    return NULL;
}

void *fork_generator(void *arg) {
    while (1) {
        pid_t pid = fork();
        if (pid < 0) {
            usleep(1000);
        } else if (pid == 0) {
            exit(0);
        } else {
            waitpid(pid, NULL, 0);
        }
    }
    return NULL;
}

int main() {
    setvbuf(stdout, NULL, _IONBF, 0);
    printf("[*] Starting reproducer...\n");

    write_file("/sys/kernel/tracing/events/sched/sched_process_fork/enable", "1");
    write_file("/sys/kernel/debug/tracing/events/sched/sched_process_fork/enable", "1");
    write_file("/sys/kernel/tracing/tracing_on", "1");
    write_file("/sys/kernel/debug/tracing/tracing_on", "1");

    pthread_t clock_thread;
    int res = pthread_create(&clock_thread, NULL, clock_changer, NULL);
    if (res != 0) {
        printf("[-] Failed to create clock thread: %s\n", strerror(res));
        exit(1);
    }

    int num_event_threads = 4;
    pthread_t event_threads[4];
    for (int i = 0; i < num_event_threads; i++) {
        res = pthread_create(&event_threads[i], NULL, event_generator, NULL);
        if (res != 0) {
            printf("[-] Failed to create event thread %d: %s\n", i, strerror(res));
            exit(1);
        }
    }

    int num_fork_threads = 2;
    pthread_t fork_threads[2];
    for (int i = 0; i < num_fork_threads; i++) {
        res = pthread_create(&fork_threads[i], NULL, fork_generator, NULL);
        if (res != 0) {
            printf("[-] Failed to create fork thread %d: %s\n", i, strerror(res));
            exit(1);
        }
    }

    printf("[+] Threads started. Waiting for crash...\n");
    
    while (1) {
        sleep(10);
    }

    return 0;
}