// https://syzkaller.appspot.com/bug?id=f8d4f67fe01399591448f63f31ffe3bc49116c06
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

__attribute__((noreturn)) static void doexit(int status)
{
  volatile unsigned i;
  syscall(__NR_exit_group, status);
  for (i = 0;; i++) {
  }
}

#include <errno.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>

const int kFailStatus = 67;
const int kRetryStatus = 69;

static void fail(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

static void exitf(const char* msg, ...)
{
  int e = errno;
  va_list args;
  va_start(args, msg);
  vfprintf(stderr, msg, args);
  va_end(args);
  fprintf(stderr, " (errno %d)\n", e);
  doexit(kRetryStatus);
}

static uint64_t current_time_ms()
{
  struct timespec ts;

  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    fail("clock_gettime failed");
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void use_temporary_dir()
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    fail("failed to mkdtemp");
  if (chmod(tmpdir, 0777))
    fail("failed to chmod");
  if (chdir(tmpdir))
    fail("failed to chdir");
}

static void remove_dir(const char* dir)
{
  DIR* dp;
  struct dirent* ep;
  int iter = 0;
retry:
  dp = opendir(dir);
  if (dp == NULL) {
    if (errno == EMFILE) {
      exitf("opendir(%s) failed due to NOFILE, exiting");
    }
    exitf("opendir(%s) failed", dir);
  }
  while ((ep = readdir(dp))) {
    if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
      continue;
    char filename[FILENAME_MAX];
    snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
    struct stat st;
    if (lstat(filename, &st))
      exitf("lstat(%s) failed", filename);
    if (S_ISDIR(st.st_mode)) {
      remove_dir(filename);
      continue;
    }
    int i;
    for (i = 0;; i++) {
      if (unlink(filename) == 0)
        break;
      if (errno == EROFS) {
        break;
      }
      if (errno != EBUSY || i > 100)
        exitf("unlink(%s) failed", filename);
      if (umount2(filename, MNT_DETACH))
        exitf("umount(%s) failed", filename);
    }
  }
  closedir(dp);
  int i;
  for (i = 0;; i++) {
    if (rmdir(dir) == 0)
      break;
    if (i < 100) {
      if (errno == EROFS) {
        break;
      }
      if (errno == EBUSY) {
        if (umount2(dir, MNT_DETACH))
          exitf("umount(%s) failed", dir);
        continue;
      }
      if (errno == ENOTEMPTY) {
        if (iter < 100) {
          iter++;
          goto retry;
        }
      }
    }
    exitf("rmdir(%s) failed", dir);
  }
}

static void test();

void loop()
{
  int iter;
  for (iter = 0;; iter++) {
    char cwdbuf[256];
    sprintf(cwdbuf, "./%d", iter);
    if (mkdir(cwdbuf, 0777))
      fail("failed to mkdir");
    int pid = fork();
    if (pid < 0)
      fail("loop fork failed");
    if (pid == 0) {
      prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
      setpgrp();
      if (chdir(cwdbuf))
        fail("failed to chdir");
      test();
      doexit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      int res = waitpid(-1, &status, __WALL | WNOHANG);
      if (res == pid)
        break;
      usleep(1000);
      if (current_time_ms() - start > 5 * 1000) {
        kill(-pid, SIGKILL);
        kill(pid, SIGKILL);
        while (waitpid(-1, &status, __WALL) != pid) {
        }
        break;
      }
    }
    remove_dir(cwdbuf);
  }
}

long r[189];
void* thr(void* arg)
{
  switch ((long)arg) {
  case 0:
    r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul,
                   0xfffffffffffffffful, 0x0ul);
    break;
  case 1:
    r[1] = syscall(__NR_socket, 0x26ul, 0x5ul, 0x0ul);
    break;
  case 2:
    *(uint16_t*)0x20939fa8 = (uint16_t)0x26;
    memcpy((void*)0x20939faa,
           "\x61\x65\x61\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
           14);
    *(uint32_t*)0x20939fb8 = (uint32_t)0x0;
    *(uint32_t*)0x20939fbc = (uint32_t)0x0;
    memcpy((void*)0x20939fc0,
           "\x72\x66\x63\x34\x35\x34\x33\x28\x67\x63\x6d\x28\x61\x65"
           "\x73\x29\x29\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x00\x00\x00\x00\x00\x00",
           64);
    r[7] = syscall(__NR_bind, r[1], 0x20939fa8ul, 0x58ul);
    break;
  case 3:
    memcpy((void*)0x20890fec, "\x79\x73\x39\x76\xd8\xc3\x0a\x4a\xea\xd9"
                              "\x60\x10\xbe\x13\xcf\xe6\x27\x85\xce"
                              "\x10",
           20);
    r[9] = syscall(__NR_setsockopt, r[1], 0x117ul, 0x1ul, 0x20890fecul,
                   0x14ul);
    break;
  case 4:
    r[10] = syscall(__NR_accept, r[1], 0x0ul, 0x0ul);
    break;
  case 5:
    *(uint64_t*)0x20e5b000 = (uint64_t)0x0;
    *(uint32_t*)0x20e5b008 = (uint32_t)0x0;
    *(uint64_t*)0x20e5b010 = (uint64_t)0x20bbe000;
    *(uint64_t*)0x20e5b018 = (uint64_t)0x0;
    *(uint64_t*)0x20e5b020 = (uint64_t)0x203aa000;
    *(uint64_t*)0x20e5b028 = (uint64_t)0x18;
    *(uint32_t*)0x20e5b030 = (uint32_t)0x0;
    *(uint64_t*)0x203aa000 = (uint64_t)0x18;
    *(uint32_t*)0x203aa008 = (uint32_t)0x117;
    *(uint32_t*)0x203aa00c = (uint32_t)0x3;
    *(uint32_t*)0x203aa010 = (uint32_t)0x1;
    r[22] = syscall(__NR_sendmmsg, r[10], 0x20e5b000ul, 0x1ul, 0x0ul);
    break;
  case 6:
    *(uint64_t*)0x20fd9fc8 = (uint64_t)0x202fc000;
    *(uint32_t*)0x20fd9fd0 = (uint32_t)0x9;
    *(uint64_t*)0x20fd9fd8 = (uint64_t)0x20f7dfc0;
    *(uint64_t*)0x20fd9fe0 = (uint64_t)0x1;
    *(uint64_t*)0x20fd9fe8 = (uint64_t)0x20aa5000;
    *(uint64_t*)0x20fd9ff0 = (uint64_t)0x0;
    *(uint32_t*)0x20fd9ff8 = (uint32_t)0x4;
    *(uint64_t*)0x20f7dfc0 = (uint64_t)0x20249000;
    *(uint64_t*)0x20f7dfc8 = (uint64_t)0x480;
    r[32] = syscall(__NR_recvmsg, r[10], 0x20fd9fc8ul, 0x2002ul);
    break;
  case 7:
    *(uint64_t*)0x20e78000 = (uint64_t)0x0;
    *(uint32_t*)0x20e78008 = (uint32_t)0x0;
    *(uint64_t*)0x20e78010 = (uint64_t)0x205dbf80;
    *(uint64_t*)0x20e78018 = (uint64_t)0x0;
    *(uint64_t*)0x20e78020 = (uint64_t)0x20b7cfe8;
    *(uint64_t*)0x20e78028 = (uint64_t)0x18;
    *(uint32_t*)0x20e78030 = (uint32_t)0x4001;
    *(uint64_t*)0x20e78038 = (uint64_t)0x0;
    *(uint32_t*)0x20e78040 = (uint32_t)0x0;
    *(uint64_t*)0x20e78048 = (uint64_t)0x20d51ff0;
    *(uint64_t*)0x20e78050 = (uint64_t)0x1;
    *(uint64_t*)0x20e78058 = (uint64_t)0x200fd000;
    *(uint64_t*)0x20e78060 = (uint64_t)0xd8;
    *(uint32_t*)0x20e78068 = (uint32_t)0x4;
    *(uint64_t*)0x20e78070 = (uint64_t)0x0;
    *(uint32_t*)0x20e78078 = (uint32_t)0x0;
    *(uint64_t*)0x20e78080 = (uint64_t)0x20a9dfe0;
    *(uint64_t*)0x20e78088 = (uint64_t)0x2;
    *(uint64_t*)0x20e78090 = (uint64_t)0x200261eb;
    *(uint64_t*)0x20e78098 = (uint64_t)0x30;
    *(uint32_t*)0x20e780a0 = (uint32_t)0x20008040;
    *(uint64_t*)0x20e780a8 = (uint64_t)0x0;
    *(uint32_t*)0x20e780b0 = (uint32_t)0x0;
    *(uint64_t*)0x20e780b8 = (uint64_t)0x20de3000;
    *(uint64_t*)0x20e780c0 = (uint64_t)0x7;
    *(uint64_t*)0x20e780c8 = (uint64_t)0x20e4dfb8;
    *(uint64_t*)0x20e780d0 = (uint64_t)0x48;
    *(uint32_t*)0x20e780d8 = (uint32_t)0x20000000;
    *(uint64_t*)0x20e780e0 = (uint64_t)0x0;
    *(uint32_t*)0x20e780e8 = (uint32_t)0x0;
    *(uint64_t*)0x20e780f0 = (uint64_t)0x20358fd0;
    *(uint64_t*)0x20e780f8 = (uint64_t)0x3;
    *(uint64_t*)0x20e78100 = (uint64_t)0x20000000;
    *(uint64_t*)0x20e78108 = (uint64_t)0x0;
    *(uint32_t*)0x20e78110 = (uint32_t)0x8001;
    *(uint64_t*)0x20e78118 = (uint64_t)0x0;
    *(uint32_t*)0x20e78120 = (uint32_t)0x0;
    *(uint64_t*)0x20e78128 = (uint64_t)0x2069d000;
    *(uint64_t*)0x20e78130 = (uint64_t)0x3;
    *(uint64_t*)0x20e78138 = (uint64_t)0x20d34000;
    *(uint64_t*)0x20e78140 = (uint64_t)0x18;
    *(uint32_t*)0x20e78148 = (uint32_t)0x0;
    *(uint64_t*)0x20e78150 = (uint64_t)0x0;
    *(uint32_t*)0x20e78158 = (uint32_t)0x0;
    *(uint64_t*)0x20e78160 = (uint64_t)0x209bfff0;
    *(uint64_t*)0x20e78168 = (uint64_t)0x1;
    *(uint64_t*)0x20e78170 = (uint64_t)0x207ab000;
    *(uint64_t*)0x20e78178 = (uint64_t)0x30;
    *(uint32_t*)0x20e78180 = (uint32_t)0x8004;
    *(uint64_t*)0x20b7cfe8 = (uint64_t)0x18;
    *(uint32_t*)0x20b7cff0 = (uint32_t)0x117;
    *(uint32_t*)0x20b7cff4 = (uint32_t)0x4;
    *(uint32_t*)0x20b7cff8 = (uint32_t)0x0;
    *(uint64_t*)0x20d51ff0 = (uint64_t)0x2098af09;
    *(uint64_t*)0x20d51ff8 = (uint64_t)0x0;
    *(uint64_t*)0x200fd000 = (uint64_t)0x18;
    *(uint32_t*)0x200fd008 = (uint32_t)0x117;
    *(uint32_t*)0x200fd00c = (uint32_t)0x3;
    *(uint32_t*)0x200fd010 = (uint32_t)0x1;
    *(uint64_t*)0x200fd018 = (uint64_t)0x18;
    *(uint32_t*)0x200fd020 = (uint32_t)0x117;
    *(uint32_t*)0x200fd024 = (uint32_t)0x4;
    *(uint32_t*)0x200fd028 = (uint32_t)0x7;
    *(uint64_t*)0x200fd030 = (uint64_t)0x18;
    *(uint32_t*)0x200fd038 = (uint32_t)0x117;
    *(uint32_t*)0x200fd03c = (uint32_t)0x4;
    *(uint32_t*)0x200fd040 = (uint32_t)0x401;
    *(uint64_t*)0x200fd048 = (uint64_t)0x18;
    *(uint32_t*)0x200fd050 = (uint32_t)0x117;
    *(uint32_t*)0x200fd054 = (uint32_t)0x4;
    *(uint32_t*)0x200fd058 = (uint32_t)0x8;
    *(uint64_t*)0x200fd060 = (uint64_t)0x18;
    *(uint32_t*)0x200fd068 = (uint32_t)0x117;
    *(uint32_t*)0x200fd06c = (uint32_t)0x4;
    *(uint32_t*)0x200fd070 = (uint32_t)0x3;
    *(uint64_t*)0x200fd078 = (uint64_t)0x18;
    *(uint32_t*)0x200fd080 = (uint32_t)0x117;
    *(uint32_t*)0x200fd084 = (uint32_t)0x3;
    *(uint32_t*)0x200fd088 = (uint32_t)0x0;
    *(uint64_t*)0x200fd090 = (uint64_t)0x18;
    *(uint32_t*)0x200fd098 = (uint32_t)0x117;
    *(uint32_t*)0x200fd09c = (uint32_t)0x4;
    *(uint32_t*)0x200fd0a0 = (uint32_t)0x7f;
    *(uint64_t*)0x200fd0a8 = (uint64_t)0x18;
    *(uint32_t*)0x200fd0b0 = (uint32_t)0x117;
    *(uint32_t*)0x200fd0b4 = (uint32_t)0x4;
    *(uint32_t*)0x200fd0b8 = (uint32_t)0xffffffff;
    *(uint64_t*)0x200fd0c0 = (uint64_t)0x18;
    *(uint32_t*)0x200fd0c8 = (uint32_t)0x117;
    *(uint32_t*)0x200fd0cc = (uint32_t)0x3;
    *(uint32_t*)0x200fd0d0 = (uint32_t)0x1;
    *(uint64_t*)0x20a9dfe0 = (uint64_t)0x204b8000;
    *(uint64_t*)0x20a9dfe8 = (uint64_t)0x0;
    *(uint64_t*)0x20a9dff0 = (uint64_t)0x20d50000;
    *(uint64_t*)0x20a9dff8 = (uint64_t)0x0;
    *(uint64_t*)0x200261eb = (uint64_t)0x18;
    *(uint32_t*)0x200261f3 = (uint32_t)0x117;
    *(uint32_t*)0x200261f7 = (uint32_t)0x2;
    *(uint32_t*)0x200261fb = (uint32_t)0x0;
    *(uint64_t*)0x20026203 = (uint64_t)0x18;
    *(uint32_t*)0x2002620b = (uint32_t)0x117;
    *(uint32_t*)0x2002620f = (uint32_t)0x2;
    *(uint32_t*)0x20026213 = (uint32_t)0x0;
    *(uint64_t*)0x20de3000 = (uint64_t)0x20c47000;
    *(uint64_t*)0x20de3008 = (uint64_t)0x0;
    *(uint64_t*)0x20de3010 = (uint64_t)0x20f62f72;
    *(uint64_t*)0x20de3018 = (uint64_t)0x0;
    *(uint64_t*)0x20de3020 = (uint64_t)0x207b8f6f;
    *(uint64_t*)0x20de3028 = (uint64_t)0x0;
    *(uint64_t*)0x20de3030 = (uint64_t)0x206dc000;
    *(uint64_t*)0x20de3038 = (uint64_t)0x0;
    *(uint64_t*)0x20de3040 = (uint64_t)0x20936000;
    *(uint64_t*)0x20de3048 = (uint64_t)0x0;
    *(uint64_t*)0x20de3050 = (uint64_t)0x20de4f99;
    *(uint64_t*)0x20de3058 = (uint64_t)0x0;
    *(uint64_t*)0x20de3060 = (uint64_t)0x2097e000;
    *(uint64_t*)0x20de3068 = (uint64_t)0x0;
    *(uint64_t*)0x20e4dfb8 = (uint64_t)0x18;
    *(uint32_t*)0x20e4dfc0 = (uint32_t)0x117;
    *(uint32_t*)0x20e4dfc4 = (uint32_t)0x4;
    *(uint32_t*)0x20e4dfc8 = (uint32_t)0x7;
    *(uint64_t*)0x20e4dfd0 = (uint64_t)0x18;
    *(uint32_t*)0x20e4dfd8 = (uint32_t)0x117;
    *(uint32_t*)0x20e4dfdc = (uint32_t)0x4;
    *(uint32_t*)0x20e4dfe0 = (uint32_t)0x1fffe0000000;
    *(uint64_t*)0x20e4dfe8 = (uint64_t)0x18;
    *(uint32_t*)0x20e4dff0 = (uint32_t)0x117;
    *(uint32_t*)0x20e4dff4 = (uint32_t)0x3;
    *(uint32_t*)0x20e4dff8 = (uint32_t)0x1;
    *(uint64_t*)0x20358fd0 = (uint64_t)0x20ca7000;
    *(uint64_t*)0x20358fd8 = (uint64_t)0x0;
    *(uint64_t*)0x20358fe0 = (uint64_t)0x20d0ef7a;
    *(uint64_t*)0x20358fe8 = (uint64_t)0x0;
    *(uint64_t*)0x20358ff0 = (uint64_t)0x20319f36;
    *(uint64_t*)0x20358ff8 = (uint64_t)0x0;
    *(uint64_t*)0x2069d000 = (uint64_t)0x20023000;
    *(uint64_t*)0x2069d008 = (uint64_t)0x0;
    *(uint64_t*)0x2069d010 = (uint64_t)0x20f6c000;
    *(uint64_t*)0x2069d018 = (uint64_t)0x0;
    *(uint64_t*)0x2069d020 = (uint64_t)0x20a6a000;
    *(uint64_t*)0x2069d028 = (uint64_t)0x0;
    *(uint64_t*)0x20d34000 = (uint64_t)0x18;
    *(uint32_t*)0x20d34008 = (uint32_t)0x117;
    *(uint32_t*)0x20d3400c = (uint32_t)0x4;
    *(uint32_t*)0x20d34010 = (uint32_t)0x2;
    *(uint64_t*)0x209bfff0 = (uint64_t)0x20dcf000;
    *(uint64_t*)0x209bfff8 = (uint64_t)0x0;
    *(uint64_t*)0x207ab000 = (uint64_t)0x18;
    *(uint32_t*)0x207ab008 = (uint32_t)0x117;
    *(uint32_t*)0x207ab00c = (uint32_t)0x3;
    *(uint32_t*)0x207ab010 = (uint32_t)0x0;
    *(uint64_t*)0x207ab018 = (uint64_t)0x18;
    *(uint32_t*)0x207ab020 = (uint32_t)0x117;
    *(uint32_t*)0x207ab024 = (uint32_t)0x3;
    *(uint32_t*)0x207ab028 = (uint32_t)0x0;
    r[188] = syscall(__NR_sendmmsg, r[10], 0x20e78000ul, 0x7ul, 0x4ul);
    break;
  }
  return 0;
}

void test()
{
  long i;
  pthread_t th[16];

  memset(r, -1, sizeof(r));
  for (i = 0; i < 8; i++) {
    pthread_create(&th[i], 0, thr, (void*)i);
    usleep(rand() % 10000);
  }
  usleep(rand() % 100000);
}

int main()
{
  int i;
  for (i = 0; i < 8; i++) {
    if (fork() == 0) {
      use_temporary_dir();
      loop();
      return 0;
    }
  }
  sleep(1000000);
  return 0;
}