// https://syzkaller.appspot.com/bug?id=4462682cd32aee8ff03a43c8b9be3963743bc506
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <fcntl.h>
#include <stdio.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

#include <stdint.h>
#include <string.h>

static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block",
            (uint8_t)a1, (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf));
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

long r[8];
void loop()
{
  memset(r, -1, sizeof(r));
  r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul,
                 0xfffffffffffffffful, 0x0ul);
  r[1] = syscall(__NR_pipe2, 0x204fa000ul, 0x0ul);
  if (r[1] != -1)
    r[2] = *(uint32_t*)0x204fa004;
  memcpy((void*)0x20000000, "\x2f\x64\x65\x76\x2f\x73\x67\x23\x00", 9);
  r[4] = syz_open_dev(0x20000000ul, 0x0ul, 0x2ul);
  memcpy((void*)0x208aff35,
         "\x2a\x10\x99\x53\xf9\x3c\x33\x59\xc9\xb8\xd1\x4b\xb7\x10\x8c"
         "\xab\x19\x0d\xff\x2a\xdf\x43\x99\x94\x5a\x32\x95\xbb\x11\x68"
         "\x54\xac\x69\x6c\xc3\x88\xc5\x62\x11\x6d\xe7\xfa\x8d\xdb\x62"
         "\xe9\x73\x9c\xad\xbc\xfe\x85\x04\x2c\xe2\x23\xcd\x15\x8a\x91"
         "\x4c\x4f\x27\x99\xf1\xb6\x80\x64\x26\xc2\x28\x7e\x8d\x02\xbe"
         "\x16\x8d\xa7\x40\xc1\x51\xc7\x7e\xf5\x67\x17\x93\xfb\x08\xa2"
         "\x04\xf1\x10\x88\xe6\x99\xd1\x45\x89\x06\xe7\xf5\x69\x6f\x02"
         "\xe2\xa7\xc5\x6e\x36\x71\x55\xbf\x83\x24\x98\x06\xe6\x60\x10"
         "\xcf\x1e\x52\xdf\x5d\xb5\xac\xc3\x3b\xab\x43\xff\x7f\xad\xa8"
         "\x8a\xbb\x0d\x11\x0e\x20\x95\x89\xa6\xa0\x79\x52\x66\x20\x42"
         "\x8b\x35\xe7\x6d\x13\x59\xbb\x9b\xba\xc1\xb4\x5e\x65\xf0\x0c"
         "\xb5\x51\x9b\x35\x64\xa0\xc8\xb8\x7d\xf6\xc1\x16\x83\x67\xde"
         "\xc9\xa1\xb9\xe0\x30\x57\xd4\xb0\xd5\x6d\xa7\xd5\x3f\xf6\xd0"
         "\xa8\x89\xb8\x3e\x39\x33\x64\xc9",
         203);
  r[6] = syscall(__NR_write, r[4], 0x208aff35ul, 0xcbul);
  r[7] = syscall(__NR_splice, r[4], 0x0ul, r[2], 0x0ul, 0x100000001ul,
                 0x0ul);
}

int main()
{
  loop();
  return 0;
}