// https://syzkaller.appspot.com/bug?id=f9c94b10e49ae0433f27c4838c7e0f0a321606f5
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <errno.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}

#include <stdint.h>
#include <string.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

static void fail(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

static uint64_t current_time_ms()
{
  struct timespec ts;

  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    fail("clock_gettime failed");
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void test();

void loop()
{
  int iter;
  for (iter = 0;; iter++) {
    int pid = fork();
    if (pid < 0)
      fail("loop fork failed");
    if (pid == 0) {
      prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
      setpgrp();
      test();
      doexit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      int res = waitpid(-1, &status, __WALL | WNOHANG);
      if (res == pid)
        break;
      usleep(1000);
      if (current_time_ms() - start > 5 * 1000) {
        kill(-pid, SIGKILL);
        kill(pid, SIGKILL);
        while (waitpid(-1, &status, __WALL) != pid) {
        }
        break;
      }
    }
  }
}

long r[147];
void test()
{
  memset(r, -1, sizeof(r));
  r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul,
                 0xfffffffffffffffful, 0x0ul);
  r[1] = syscall(__NR_socket, 0xaul, 0x80002ul, 0x88ul);
  *(uint16_t*)0x20e4d000 = (uint16_t)0xa;
  *(uint16_t*)0x20e4d002 = (uint16_t)0x234e;
  *(uint32_t*)0x20e4d004 = (uint32_t)0x100000000;
  *(uint8_t*)0x20e4d008 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d009 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d00a = (uint8_t)0x0;
  *(uint8_t*)0x20e4d00b = (uint8_t)0x0;
  *(uint8_t*)0x20e4d00c = (uint8_t)0x0;
  *(uint8_t*)0x20e4d00d = (uint8_t)0x0;
  *(uint8_t*)0x20e4d00e = (uint8_t)0x0;
  *(uint8_t*)0x20e4d00f = (uint8_t)0x0;
  *(uint8_t*)0x20e4d010 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d011 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d012 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d013 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d014 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d015 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d016 = (uint8_t)0x0;
  *(uint8_t*)0x20e4d017 = (uint8_t)0x0;
  *(uint32_t*)0x20e4d018 = (uint32_t)0x6;
  r[22] = syscall(__NR_bind, r[1], 0x20e4d000ul, 0x1cul);
  *(uint16_t*)0x20353000 = (uint16_t)0xa;
  *(uint16_t*)0x20353002 = (uint16_t)0x234e;
  *(uint32_t*)0x20353004 = (uint32_t)0x0;
  *(uint8_t*)0x20353008 = (uint8_t)0x0;
  *(uint8_t*)0x20353009 = (uint8_t)0x0;
  *(uint8_t*)0x2035300a = (uint8_t)0x0;
  *(uint8_t*)0x2035300b = (uint8_t)0x0;
  *(uint8_t*)0x2035300c = (uint8_t)0x0;
  *(uint8_t*)0x2035300d = (uint8_t)0x0;
  *(uint8_t*)0x2035300e = (uint8_t)0x0;
  *(uint8_t*)0x2035300f = (uint8_t)0x0;
  *(uint8_t*)0x20353010 = (uint8_t)0x0;
  *(uint8_t*)0x20353011 = (uint8_t)0x0;
  *(uint8_t*)0x20353012 = (uint8_t)0x0;
  *(uint8_t*)0x20353013 = (uint8_t)0x0;
  *(uint8_t*)0x20353014 = (uint8_t)0x0;
  *(uint8_t*)0x20353015 = (uint8_t)0x0;
  *(uint8_t*)0x20353016 = (uint8_t)0x0;
  *(uint8_t*)0x20353017 = (uint8_t)0x0;
  *(uint32_t*)0x20353018 = (uint32_t)0x0;
  r[43] = syscall(__NR_sendto, r[1], 0x20c5effcul, 0x0ul, 0x48004ul,
                  0x20353000ul, 0x1cul);
  *(uint16_t*)0x20cf6000 = (uint16_t)0xa;
  *(uint16_t*)0x20cf6002 = (uint16_t)0x224e;
  *(uint32_t*)0x20cf6004 = (uint32_t)0x85c;
  *(uint8_t*)0x20cf6008 = (uint8_t)0x0;
  *(uint8_t*)0x20cf6009 = (uint8_t)0x0;
  *(uint8_t*)0x20cf600a = (uint8_t)0x0;
  *(uint8_t*)0x20cf600b = (uint8_t)0x0;
  *(uint8_t*)0x20cf600c = (uint8_t)0x0;
  *(uint8_t*)0x20cf600d = (uint8_t)0x0;
  *(uint8_t*)0x20cf600e = (uint8_t)0x0;
  *(uint8_t*)0x20cf600f = (uint8_t)0x0;
  *(uint8_t*)0x20cf6010 = (uint8_t)0x0;
  *(uint8_t*)0x20cf6011 = (uint8_t)0x0;
  *(uint8_t*)0x20cf6012 = (uint8_t)0x0;
  *(uint8_t*)0x20cf6013 = (uint8_t)0x0;
  *(uint8_t*)0x20cf6014 = (uint8_t)0x0;
  *(uint8_t*)0x20cf6015 = (uint8_t)0x0;
  *(uint8_t*)0x20cf6016 = (uint8_t)0x0;
  *(uint8_t*)0x20cf6017 = (uint8_t)0x0;
  *(uint32_t*)0x20cf6018 = (uint32_t)0x10000000;
  r[64] = syscall(__NR_sendto, r[1], 0x2071cffeul, 0x0ul, 0x0ul,
                  0x20cf6000ul, 0x1cul);
  r[65] = syscall(__NR_socket, 0xful, 0x3ul, 0x2ul);
  *(uint64_t*)0x20001000 = (uint64_t)0x0;
  *(uint32_t*)0x20001008 = (uint32_t)0x0;
  *(uint64_t*)0x20001010 = (uint64_t)0x20003ff0;
  *(uint64_t*)0x20001018 = (uint64_t)0x1;
  *(uint64_t*)0x20001020 = (uint64_t)0x0;
  *(uint64_t*)0x20001028 = (uint64_t)0x0;
  *(uint32_t*)0x20001030 = (uint32_t)0x0;
  *(uint64_t*)0x20003ff0 = (uint64_t)0x20001e50;
  *(uint64_t*)0x20003ff8 = (uint64_t)0x80;
  *(uint8_t*)0x20001e50 = (uint8_t)0x2;
  *(uint8_t*)0x20001e51 = (uint8_t)0xe;
  *(uint8_t*)0x20001e52 = (uint8_t)0x0;
  *(uint8_t*)0x20001e53 = (uint8_t)0x0;
  *(uint16_t*)0x20001e54 = (uint16_t)0x10;
  *(uint16_t*)0x20001e56 = (uint16_t)0x0;
  *(uint32_t*)0x20001e58 = (uint32_t)0x0;
  *(uint32_t*)0x20001e5c = (uint32_t)0x0;
  *(uint16_t*)0x20001e60 = (uint16_t)0x4;
  *(uint16_t*)0x20001e62 = (uint16_t)0x12;
  *(uint16_t*)0x20001e64 = (uint16_t)0x1;
  *(uint8_t*)0x20001e66 = (uint8_t)0x1;
  *(uint8_t*)0x20001e67 = (uint8_t)0x0;
  *(uint32_t*)0x20001e68 = (uint32_t)0x0;
  *(uint32_t*)0x20001e6c = (uint32_t)0x0;
  *(uint16_t*)0x20001e70 = (uint16_t)0x0;
  *(uint16_t*)0x20001e72 = (uint16_t)0x0;
  *(uint8_t*)0x20001e74 = (uint8_t)0x3;
  *(uint8_t*)0x20001e75 = (uint8_t)0x1;
  *(uint16_t*)0x20001e76 = (uint16_t)0x0;
  *(uint32_t*)0x20001e78 = (uint32_t)0x1;
  *(uint32_t*)0x20001e7c = (uint32_t)0x0;
  *(uint16_t*)0x20001e80 = (uint16_t)0x3;
  *(uint16_t*)0x20001e82 = (uint16_t)0x6;
  *(uint8_t*)0x20001e84 = (uint8_t)0x0;
  *(uint8_t*)0x20001e85 = (uint8_t)0x0;
  *(uint16_t*)0x20001e86 = (uint16_t)0x0;
  *(uint16_t*)0x20001e88 = (uint16_t)0x2;
  *(uint16_t*)0x20001e8a = (uint16_t)0x204e;
  *(uint8_t*)0x20001e8c = (uint8_t)0xac;
  *(uint8_t*)0x20001e8d = (uint8_t)0x14;
  *(uint8_t*)0x20001e8e = (uint8_t)0x0;
  *(uint8_t*)0x20001e8f = (uint8_t)0xbb;
  *(uint8_t*)0x20001e90 = (uint8_t)0x0;
  *(uint8_t*)0x20001e91 = (uint8_t)0x0;
  *(uint8_t*)0x20001e92 = (uint8_t)0x0;
  *(uint8_t*)0x20001e93 = (uint8_t)0x0;
  *(uint8_t*)0x20001e94 = (uint8_t)0x0;
  *(uint8_t*)0x20001e95 = (uint8_t)0x0;
  *(uint8_t*)0x20001e96 = (uint8_t)0x0;
  *(uint8_t*)0x20001e97 = (uint8_t)0x0;
  *(uint16_t*)0x20001e98 = (uint16_t)0x3;
  *(uint16_t*)0x20001e9a = (uint16_t)0x5;
  *(uint8_t*)0x20001e9c = (uint8_t)0x0;
  *(uint8_t*)0x20001e9d = (uint8_t)0x0;
  *(uint16_t*)0x20001e9e = (uint16_t)0x0;
  *(uint16_t*)0x20001ea0 = (uint16_t)0x2;
  *(uint16_t*)0x20001ea2 = (uint16_t)0x204e;
  *(uint8_t*)0x20001ea4 = (uint8_t)0xac;
  *(uint8_t*)0x20001ea5 = (uint8_t)0x14;
  *(uint8_t*)0x20001ea6 = (uint8_t)0x0;
  *(uint8_t*)0x20001ea7 = (uint8_t)0xbb;
  *(uint8_t*)0x20001ea8 = (uint8_t)0x0;
  *(uint8_t*)0x20001ea9 = (uint8_t)0x0;
  *(uint8_t*)0x20001eaa = (uint8_t)0x0;
  *(uint8_t*)0x20001eab = (uint8_t)0x0;
  *(uint8_t*)0x20001eac = (uint8_t)0x0;
  *(uint8_t*)0x20001ead = (uint8_t)0x0;
  *(uint8_t*)0x20001eae = (uint8_t)0x0;
  *(uint8_t*)0x20001eaf = (uint8_t)0x0;
  *(uint16_t*)0x20001eb0 = (uint16_t)0x4;
  *(uint16_t*)0x20001eb2 = (uint16_t)0x4;
  *(uint32_t*)0x20001eb4 = (uint32_t)0x0;
  *(uint64_t*)0x20001eb8 = (uint64_t)0x3;
  *(uint64_t*)0x20001ec0 = (uint64_t)0x81;
  *(uint64_t*)0x20001ec8 = (uint64_t)0x9;
  r[141] = syscall(__NR_sendmsg, r[65], 0x20001000ul, 0x48000ul);
  r[142] = syscall(__NR_socket, 0x10ul, 0x3ul, 0x0ul);
  *(uint64_t*)0x2097fff0 = (uint64_t)0x200f0000;
  *(uint64_t*)0x2097fff8 = (uint64_t)0x3b;
  memcpy((void*)0x200f0000,
         "\x34\x00\x00\x00\x13\x00\x19\x47\x04\x00\xff\x00\x00\x09\x00"
         "\xff\xef\xff\xdf\xe6\x01\x00\x00\x00\x2b\x78\xff\xff\xff\xec"
         "\x80\x05\x11\x00\x01\x00\x00\x00\xf2\xff\xfe\x00\x00\x00\x03"
         "\x11\x00\x01\x00\x18\xe9\x07\x00\x00\x00\x00\x00\x6f\xcb",
         59);
  r[146] = syscall(__NR_writev, r[142], 0x2097fff0ul, 0x1ul);
}

int main()
{
  loop();
  return 0;
}