// https://syzkaller.appspot.com/bug?id=c9f717b49aca3872ae156bace9e55918b9b65e59
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <pthread.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>

#include <stdint.h>
#include <string.h>

static void test();

void loop()
{
  while (1) {
    test();
  }
}

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

long r[64];
void* thr(void* arg)
{
  switch ((long)arg) {
  case 0:
    r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul,
                   0xfffffffffffffffful, 0x0ul);
    break;
  case 1:
    r[1] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul);
    break;
  case 2:
    *(uint32_t*)0x20105000 = (uint32_t)0x1;
    *(uint32_t*)0x20105004 = (uint32_t)0x2;
    *(uint64_t*)0x20105008 = (uint64_t)0x20414ff0;
    *(uint64_t*)0x20105010 = (uint64_t)0x20ef4ffa;
    *(uint32_t*)0x20105018 = (uint32_t)0x1;
    *(uint32_t*)0x2010501c = (uint32_t)0x80;
    *(uint64_t*)0x20105020 = (uint64_t)0x2000a000;
    *(uint32_t*)0x20105028 = (uint32_t)0x0;
    *(uint32_t*)0x2010502c = (uint32_t)0x0;
    *(uint8_t*)0x20414ff0 = (uint8_t)0x8db7;
    *(uint8_t*)0x20414ff1 = (uint8_t)0x0;
    *(uint16_t*)0x20414ff2 = (uint16_t)0x0;
    *(uint32_t*)0x20414ff4 = (uint32_t)0x0;
    *(uint8_t*)0x20414ff8 = (uint8_t)0xd395;
    *(uint8_t*)0x20414ff9 = (uint8_t)0x0;
    *(uint16_t*)0x20414ffa = (uint16_t)0x0;
    *(uint32_t*)0x20414ffc = (uint32_t)0x0;
    memcpy((void*)0x20ef4ffa, "\x73\x79\x73\x65\x4f\x00", 6);
    r[20] = syscall(__NR_bpf, 0x5ul, 0x20105000ul, 0x30ul);
    break;
  case 3:
    r[21] = syscall(__NR_socket, 0x29ul, 0x2ul, 0x0ul);
    break;
  case 4:
    *(uint32_t*)0x20a9e000 = r[1];
    *(uint32_t*)0x20a9e004 = r[20];
    r[24] = syscall(__NR_ioctl, r[21], 0x89e0ul, 0x20a9e000ul);
    break;
  case 5:
    *(uint16_t*)0x20248ff0 = (uint16_t)0x2;
    *(uint16_t*)0x20248ff2 = (uint16_t)0x234e;
    *(uint32_t*)0x20248ff4 = (uint32_t)0xffffffff;
    *(uint8_t*)0x20248ff8 = (uint8_t)0x0;
    *(uint8_t*)0x20248ff9 = (uint8_t)0x0;
    *(uint8_t*)0x20248ffa = (uint8_t)0x0;
    *(uint8_t*)0x20248ffb = (uint8_t)0x0;
    *(uint8_t*)0x20248ffc = (uint8_t)0x0;
    *(uint8_t*)0x20248ffd = (uint8_t)0x0;
    *(uint8_t*)0x20248ffe = (uint8_t)0x0;
    *(uint8_t*)0x20248fff = (uint8_t)0x0;
    r[36] = syscall(__NR_bind, r[1], 0x20248ff0ul, 0x10ul);
    break;
  case 6:
    *(uint16_t*)0x20868ff0 = (uint16_t)0x2;
    *(uint16_t*)0x20868ff2 = (uint16_t)0x234e;
    *(uint32_t*)0x20868ff4 = (uint32_t)0x0;
    *(uint8_t*)0x20868ff8 = (uint8_t)0x0;
    *(uint8_t*)0x20868ff9 = (uint8_t)0x0;
    *(uint8_t*)0x20868ffa = (uint8_t)0x0;
    *(uint8_t*)0x20868ffb = (uint8_t)0x0;
    *(uint8_t*)0x20868ffc = (uint8_t)0x0;
    *(uint8_t*)0x20868ffd = (uint8_t)0x0;
    *(uint8_t*)0x20868ffe = (uint8_t)0x0;
    *(uint8_t*)0x20868fff = (uint8_t)0x0;
    r[48] = syscall(__NR_connect, r[1], 0x20868ff0ul, 0x10ul);
    break;
  case 7:
    r[49] = syscall(__NR_recvfrom, r[1], 0x20302000ul, 0x0ul, 0x0ul,
                    0x20000000ul, 0x0ul);
    break;
  case 8:
    *(uint32_t*)0x20c53ffc = (uint32_t)0xffffffffffffffff;
    r[51] = syscall(__NR_ioctl, r[21], 0x89e2ul, 0x20c53ffcul);
    if (r[51] != -1)
      r[52] = *(uint32_t*)0x20c53ffc;
    break;
  case 9:
    *(uint64_t*)0x20814ff0 = (uint64_t)0x0;
    *(uint64_t*)0x20814ff8 = (uint64_t)0x2710;
    r[55] = syscall(__NR_setsockopt, r[1], 0x1ul, 0x14ul, 0x20814ff0ul,
                    0x10ul);
    break;
  case 10:
    memcpy((void*)0x20ff5000,
           "\x4b\x50\x20\x8b\xe1\x3b\x4d\x7a\xee\x66\x77\x5c\x35\xbb"
           "\x65\xa7\xe4\x72\xed\xef\x27\x87\x07\xfa\x9d\xe1\xc0\x5e"
           "\x8b\x96\xfd\xea\xb1\x1b\x67\x12\x9a\x95\x21\x94\x06\xca"
           "\x9d\x9f\x49\x83\x85\xa4\xa7\x5f",
           50);
    *(uint16_t*)0x20ff5000 = (uint16_t)0x0;
    memcpy((void*)0x20ff5002, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
    r[59] = syscall(__NR_sendto, r[52], 0x20ff5000ul, 0x32ul, 0x0ul,
                    0x20ff5000ul, 0xaul);
    break;
  case 11:
    r[60] = syscall(__NR_socket, 0x2ul, 0x806ul, 0x0ul);
    break;
  case 12:
    memcpy((void*)0x2000d000, "\x6c\x6f\x00\x00\x00\x00\x00\x00\x00\x00"
                              "\x00\x00\x00\x00\x00\x00",
           16);
    *(uint16_t*)0x2000d010 = (uint16_t)0xfffffffffffffffd;
    r[63] = syscall(__NR_ioctl, r[60], 0x8914ul, 0x2000d000ul);
    break;
  }
  return 0;
}

void test()
{
  long i;
  pthread_t th[26];

  memset(r, -1, sizeof(r));
  for (i = 0; i < 13; i++) {
    pthread_create(&th[i], 0, thr, (void*)i);
    usleep(rand() % 10000);
  }
  usleep(rand() % 100000);
}

int main()
{
  int i;
  for (i = 0; i < 8; i++) {
    if (fork() == 0) {
      loop();
      return 0;
    }
  }
  sleep(1000000);
  return 0;
}