// https://syzkaller.appspot.com/bug?id=a5c74eee04149854dd8b59fdfc0529a60be422a7
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

#include <stdint.h>
#include <string.h>

#define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1)

#define BITMASK_LEN_OFF(type, bf_off, bf_len)                          \
  (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))

#define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len)              \
  if ((bf_off) == 0 && (bf_len) == 0) {                                \
    *(type*)(addr) = (type)(val);                                      \
  } else {                                                             \
    type new_val = *(type*)(addr);                                     \
    new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len));             \
    new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off);  \
    *(type*)(addr) = new_val;                                          \
  }

struct csum_inet {
  uint32_t acc;
};

static void csum_inet_init(struct csum_inet* csum)
{
  csum->acc = 0;
}

static void csum_inet_update(struct csum_inet* csum,
                             const uint8_t* data, size_t length)
{
  if (length == 0)
    return;

  size_t i;
  for (i = 0; i < length - 1; i += 2)
    csum->acc += *(uint16_t*)&data[i];

  if (length & 1)
    csum->acc += (uint16_t)data[length - 1];

  while (csum->acc > 0xffff)
    csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16);
}

static uint16_t csum_inet_digest(struct csum_inet* csum)
{
  return ~csum->acc;
}

static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block",
            (uint8_t)a1, (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf));
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

long r[184];
void loop()
{
  memset(r, -1, sizeof(r));
  r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul,
                 0xfffffffffffffffful, 0x0ul);
  r[1] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul);
  memcpy((void*)0x20c55000,
         "\x2f\x64\x65\x76\x2f\x6e\x65\x74\x2f\x74\x75\x6e\x00", 13);
  r[3] = syz_open_dev(0x20c55000ul, 0x0ul, 0x0ul);
  r[4] = syscall(__NR_fcntl, r[3], 0x0ul, r[3]);
  r[5] = syscall(__NR_socket, 0x2000000011ul, 0x8000000080003ul, 0x0ul);
  memcpy((void*)0x20176000, "\x6b\x64\xb2\x2e", 4);
  r[7] = syscall(__NR_setsockopt, r[5], 0x107ul, 0xful, 0x20176000ul,
                 0x4ul);
  *(uint8_t*)0x20927fd8 = (uint8_t)0x73;
  *(uint8_t*)0x20927fd9 = (uint8_t)0x79;
  *(uint8_t*)0x20927fda = (uint8_t)0x7a;
  *(uint8_t*)0x20927fdb = (uint8_t)0x30;
  *(uint8_t*)0x20927fdc = (uint8_t)0x0;
  *(uint32_t*)0x20927fe8 = (uint32_t)0x5;
  *(uint32_t*)0x20927fec = (uint32_t)0x0;
  *(uint64_t*)0x20927ff0 = (uint64_t)0x201a3ff4;
  *(uint32_t*)0x201a3ff4 = (uint32_t)0x0;
  *(uint32_t*)0x201a3ff8 = (uint32_t)0x0;
  *(uint16_t*)0x201a3ffc = (uint16_t)0x0;
  r[19] = syscall(__NR_ioctl, r[3], 0x400454caul, 0x20927fd8ul);
  *(uint8_t*)0x2062ffe0 = (uint8_t)0x73;
  *(uint8_t*)0x2062ffe1 = (uint8_t)0x79;
  *(uint8_t*)0x2062ffe2 = (uint8_t)0x7a;
  *(uint8_t*)0x2062ffe3 = (uint8_t)0x30;
  *(uint8_t*)0x2062ffe4 = (uint8_t)0x0;
  *(uint16_t*)0x2062fff0 = (uint16_t)0x20301;
  r[26] = syscall(__NR_ioctl, r[1], 0x8914ul, 0x2062ffe0ul);
  *(uint8_t*)0x20b13000 = (uint8_t)0x73;
  *(uint8_t*)0x20b13001 = (uint8_t)0x79;
  *(uint8_t*)0x20b13002 = (uint8_t)0x7a;
  *(uint8_t*)0x20b13003 = (uint8_t)0x30;
  *(uint8_t*)0x20b13004 = (uint8_t)0x0;
  *(uint32_t*)0x20b13010 = (uint32_t)0x0;
  *(uint8_t*)0x20b13014 = (uint8_t)0x0;
  *(uint8_t*)0x20b13015 = (uint8_t)0x0;
  *(uint8_t*)0x20b13016 = (uint8_t)0x0;
  *(uint8_t*)0x20b13017 = (uint8_t)0x0;
  *(uint8_t*)0x20b13018 = (uint8_t)0x0;
  *(uint8_t*)0x20b13019 = (uint8_t)0x0;
  *(uint8_t*)0x20b1301a = (uint8_t)0x0;
  *(uint8_t*)0x20b1301b = (uint8_t)0x0;
  *(uint8_t*)0x20b1301c = (uint8_t)0x0;
  *(uint8_t*)0x20b1301d = (uint8_t)0x0;
  *(uint8_t*)0x20b1301e = (uint8_t)0x0;
  *(uint8_t*)0x20b1301f = (uint8_t)0x0;
  *(uint8_t*)0x20b13020 = (uint8_t)0x0;
  *(uint8_t*)0x20b13021 = (uint8_t)0x0;
  *(uint8_t*)0x20b13022 = (uint8_t)0x0;
  *(uint8_t*)0x20b13023 = (uint8_t)0x0;
  *(uint8_t*)0x20b13024 = (uint8_t)0x0;
  *(uint8_t*)0x20b13025 = (uint8_t)0x0;
  *(uint8_t*)0x20b13026 = (uint8_t)0x0;
  *(uint8_t*)0x20b13027 = (uint8_t)0x0;
  r[53] = syscall(__NR_ioctl, r[5], 0x8933ul, 0x20b13000ul);
  if (r[53] != -1)
    r[54] = *(uint32_t*)0x20b13010;
  *(uint16_t*)0x20c85000 = (uint16_t)0x11;
  *(uint16_t*)0x20c85002 = (uint16_t)0x0;
  *(uint32_t*)0x20c85004 = r[54];
  *(uint16_t*)0x20c85008 = (uint16_t)0x1;
  *(uint8_t*)0x20c8500a = (uint8_t)0x0;
  *(uint8_t*)0x20c8500b = (uint8_t)0x6;
  *(uint8_t*)0x20c8500c = (uint8_t)0xbb;
  *(uint8_t*)0x20c8500d = (uint8_t)0xbb;
  *(uint8_t*)0x20c8500e = (uint8_t)0xbb;
  *(uint8_t*)0x20c8500f = (uint8_t)0xbb;
  *(uint8_t*)0x20c85010 = (uint8_t)0xbb;
  *(uint8_t*)0x20c85011 = (uint8_t)0x0;
  *(uint8_t*)0x20c85012 = (uint8_t)0x0;
  *(uint8_t*)0x20c85013 = (uint8_t)0x0;
  r[69] = syscall(__NR_bind, r[5], 0x20c85000ul, 0x14ul);
  r[70] = syscall(__NR_dup2, r[5], r[4]);
  *(uint8_t*)0x205c2000 = (uint8_t)0x0;
  *(uint8_t*)0x205c2001 = (uint8_t)0x1;
  *(uint16_t*)0x205c2002 = (uint16_t)0x101;
  *(uint16_t*)0x205c2004 = (uint16_t)0x7f;
  *(uint16_t*)0x205c2006 = (uint16_t)0x3;
  *(uint16_t*)0x205c2008 = (uint16_t)0x40;
  STORE_BY_BITMASK(uint8_t, 0x205c200a, 0xd2ce, 0, 4);
  STORE_BY_BITMASK(uint8_t, 0x205c200a, 0x6, 4, 4);
  memcpy((void*)0x205c200b, "\x6d\x4f\x70", 3);
  *(uint16_t*)0x205c200e = (uint16_t)0x6001;
  *(uint8_t*)0x205c2010 = (uint8_t)0x0;
  *(uint8_t*)0x205c2011 = (uint8_t)0x3;
  *(uint8_t*)0x205c2012 = (uint8_t)0xfe;
  *(uint8_t*)0x205c2013 = (uint8_t)0x80;
  *(uint8_t*)0x205c2014 = (uint8_t)0x0;
  *(uint8_t*)0x205c2015 = (uint8_t)0x0;
  *(uint8_t*)0x205c2016 = (uint8_t)0x0;
  *(uint8_t*)0x205c2017 = (uint8_t)0x0;
  *(uint8_t*)0x205c2018 = (uint8_t)0x0;
  *(uint8_t*)0x205c2019 = (uint8_t)0x0;
  *(uint8_t*)0x205c201a = (uint8_t)0x0;
  *(uint8_t*)0x205c201b = (uint8_t)0x0;
  *(uint8_t*)0x205c201c = (uint8_t)0x0;
  *(uint8_t*)0x205c201d = (uint8_t)0x0;
  *(uint8_t*)0x205c201e = (uint8_t)0x0;
  *(uint8_t*)0x205c201f = (uint8_t)0x0;
  *(uint8_t*)0x205c2020 = (uint8_t)0x0;
  *(uint8_t*)0x205c2021 = (uint8_t)0xaa;
  *(uint64_t*)0x205c2022 = (uint64_t)0x0;
  *(uint64_t*)0x205c202a = (uint64_t)0x100000000000000;
  *(uint8_t*)0x205c2032 = (uint8_t)0xff;
  *(uint8_t*)0x205c2033 = (uint8_t)0x6;
  *(uint8_t*)0x205c2034 = (uint8_t)0x0;
  *(uint8_t*)0x205c2035 = (uint8_t)0x4;
  *(uint32_t*)0x205c2036 = (uint32_t)0x4000000;
  *(uint64_t*)0x205c203a = (uint64_t)0x0;
  *(uint64_t*)0x205c2042 = (uint64_t)0x100000000000000;
  *(uint8_t*)0x205c204a = (uint8_t)0xfe;
  *(uint8_t*)0x205c204b = (uint8_t)0x80;
  *(uint8_t*)0x205c204c = (uint8_t)0x0;
  *(uint8_t*)0x205c204d = (uint8_t)0x0;
  *(uint8_t*)0x205c204e = (uint8_t)0x0;
  *(uint8_t*)0x205c204f = (uint8_t)0x0;
  *(uint8_t*)0x205c2050 = (uint8_t)0x0;
  *(uint8_t*)0x205c2051 = (uint8_t)0x0;
  *(uint8_t*)0x205c2052 = (uint8_t)0x0;
  *(uint8_t*)0x205c2053 = (uint8_t)0x0;
  *(uint8_t*)0x205c2054 = (uint8_t)0x0;
  *(uint8_t*)0x205c2055 = (uint8_t)0x0;
  *(uint8_t*)0x205c2056 = (uint8_t)0x0;
  *(uint8_t*)0x205c2057 = (uint8_t)0x0;
  *(uint8_t*)0x205c2058 = (uint8_t)0x0;
  *(uint8_t*)0x205c2059 = (uint8_t)0xbb;
  *(uint8_t*)0x205c205a = (uint8_t)0xfe;
  *(uint8_t*)0x205c205b = (uint8_t)0x80;
  *(uint8_t*)0x205c205c = (uint8_t)0x0;
  *(uint8_t*)0x205c205d = (uint8_t)0x0;
  *(uint8_t*)0x205c205e = (uint8_t)0x0;
  *(uint8_t*)0x205c205f = (uint8_t)0x0;
  *(uint8_t*)0x205c2060 = (uint8_t)0x0;
  *(uint8_t*)0x205c2061 = (uint8_t)0x0;
  *(uint8_t*)0x205c2062 = (uint8_t)0x0;
  *(uint8_t*)0x205c2063 = (uint8_t)0x0;
  *(uint8_t*)0x205c2064 = (uint8_t)0x0;
  *(uint8_t*)0x205c2065 = (uint8_t)0x0;
  *(uint8_t*)0x205c2066 = (uint8_t)0x0;
  *(uint8_t*)0x205c2067 = (uint8_t)0x0;
  *(uint8_t*)0x205c2068 = (uint8_t)0x0;
  *(uint8_t*)0x205c2069 = (uint8_t)0xbb;
  *(uint8_t*)0x205c206a = (uint8_t)0x2c;
  *(uint8_t*)0x205c206b = (uint8_t)0x20;
  *(uint8_t*)0x205c206c = (uint8_t)0x0;
  *(uint8_t*)0x205c206d = (uint8_t)0x0;
  *(uint8_t*)0x205c206e = (uint8_t)0x0;
  *(uint8_t*)0x205c206f = (uint8_t)0x0;
  *(uint8_t*)0x205c2070 = (uint8_t)0x0;
  *(uint8_t*)0x205c2071 = (uint8_t)0x0;
  *(uint8_t*)0x205c2072 = (uint8_t)0x7;
  *(uint8_t*)0x205c2073 = (uint8_t)0x0;
  *(uint8_t*)0x205c2074 = (uint8_t)0x0;
  *(uint8_t*)0x205c2075 = (uint8_t)0x0;
  *(uint8_t*)0x205c2076 = (uint8_t)0x7;
  *(uint8_t*)0x205c2077 = (uint8_t)0x0;
  *(uint8_t*)0x205c2078 = (uint8_t)0x7;
  *(uint8_t*)0x205c2079 = (uint8_t)0x0;
  *(uint8_t*)0x205c207a = (uint8_t)0xff;
  *(uint8_t*)0x205c207b = (uint8_t)0x0;
  *(uint8_t*)0x205c207c = (uint8_t)0xc2;
  *(uint8_t*)0x205c207d = (uint8_t)0xf6;
  memcpy((void*)0x205c207e,
         "\x9a\x68\x2c\x60\x0a\x47\x5f\x82\xe3\x9f\x76\x02\x7b\x86\x84"
         "\xf4\x60\xbd\x7b\xc3\x7e\x68\x7d\x77\x83\x96\x3b\xec\x69\xa9"
         "\xa4\xa0\xc3\xb2\x56\x45\x43\x5f\xb6\x71\x79\xed\xbe\xab\xf5"
         "\x5f\xf7\x8d\xaf\x92\xd3\xd9\x93\x77\x23\xaf\x32\xb0\xe9\xfd"
         "\x28\xf8\x3c\x6a\xd2\x99\x08\xd4\x83\x77\x77\x1c\x4a\x6b\x45"
         "\xee\xad\xd2\x09\x10\x12\x19\x33\xf7\x01\x93\x58\x80\xdc\xd7"
         "\x9e\x22\xdf\xfe\x85\x29\xd2\x28\x79\x8e\xfe\x3f\x0f\xef\x2f"
         "\xd8\x2a\x50\xfb\x13\x9e\xd9\x76\x76\x37\x24\x28\xa9\x65\x02"
         "\x90\x69\xde\x7b\x81\xc6\x7f\x68\x29\x0c\x4f\x2a\xb7\x78\xb9"
         "\xe8\x10\xcb\xe5\x5c\x2f\x5a\x40\x46\x7a\x18\xbc\x09\x0b\xc6"
         "\x5d\x89\x7b\x74\x74\x8e\x63\xfe\x91\x01\xec\x29\x83\xc7\xaf"
         "\xc3\xa0\x30\x29\xc3\xd2\xf8\xb6\x52\x50\x14\x8c\xbd\x65\xe7"
         "\xdd\x4a\x6b\xba\x17\x06\xc1\x67\x44\x05\xe8\x5c\x07\x48\xac"
         "\x58\x1b\x53\x28\xa1\x9a\xf5\xe9\x75\xd6\xed\xd9\x73\x79\x17"
         "\x64\x6f\xe3\xfd\x0c\x47\x41\x49\x24\xa0\x07\x00\xab\x21\x40"
         "\x1c\xfc\x00\x5f\x4e\x3a\x86\x72\x19\xa2\x2b\x53\xc0\xa0\xe7"
         "\x7f\x23\x8e\x13\x13\xe4",
         246);
  *(uint8_t*)0x205c2174 = (uint8_t)0xc2;
  *(uint8_t*)0x205c2175 = (uint8_t)0x0;
  *(uint8_t*)0x205c217a = (uint8_t)0x37;
  *(uint8_t*)0x205c217b = (uint8_t)0x1;
  *(uint8_t*)0x205c217c = (uint8_t)0xd4;
  STORE_BY_BITMASK(uint8_t, 0x205c217d, 0x2, 0, 1);
  STORE_BY_BITMASK(uint8_t, 0x205c217d, 0x10001, 1, 2);
  STORE_BY_BITMASK(uint8_t, 0x205c217d, 0x8, 3, 5);
  *(uint32_t*)0x205c217e = (uint32_t)0x65;
  *(uint16_t*)0x205c2182 = (uint16_t)0x204e;
  *(uint16_t*)0x205c2184 = (uint16_t)0x204e;
  *(uint8_t*)0x205c2186 = (uint8_t)0x4;
  STORE_BY_BITMASK(uint8_t, 0x205c2187, 0x1, 0, 4);
  STORE_BY_BITMASK(uint8_t, 0x205c2187, 0x9, 4, 4);
  *(uint16_t*)0x205c2188 = (uint16_t)0x0;
  STORE_BY_BITMASK(uint8_t, 0x205c218a, 0x0, 0, 1);
  STORE_BY_BITMASK(uint8_t, 0x205c218a, 0x7, 1, 4);
  STORE_BY_BITMASK(uint8_t, 0x205c218a, 0x1, 5, 3);
  memcpy((void*)0x205c218b, "\xec\x42\x47", 3);
  *(uint8_t*)0x205c218e = (uint8_t)0x6;
  memcpy((void*)0x205c218f, "\x22\xa0\x81", 3);
  struct csum_inet csum_182;
  csum_inet_init(&csum_182);
  csum_inet_update(&csum_182, (const uint8_t*)0x205c2012, 16);
  csum_inet_update(&csum_182, (const uint8_t*)0x205c2022, 16);
  uint32_t csum_182_chunk_2 = 0x10000000;
  csum_inet_update(&csum_182, (const uint8_t*)&csum_182_chunk_2, 4);
  uint32_t csum_182_chunk_3 = 0x21000000;
  csum_inet_update(&csum_182, (const uint8_t*)&csum_182_chunk_3, 4);
  csum_inet_update(&csum_182, (const uint8_t*)0x205c2182, 16);
  *(uint16_t*)0x205c2188 = csum_inet_digest(&csum_182);
  r[183] = syscall(__NR_write, r[4], 0x205c2000ul, 0x192ul);
}

int main()
{
  loop();
  return 0;
}