// https://syzkaller.appspot.com/bug?id=c1047683a8f0f1b0e12907fdeaf03f7f4f17e8a5
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#ifndef __NR_io_uring_enter
#define __NR_io_uring_enter 426
#endif
#ifndef __NR_io_uring_setup
#define __NR_io_uring_setup 425
#endif

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

#define SIZEOF_IO_URING_SQE 64
#define SIZEOF_IO_URING_CQE 16
#define SQ_HEAD_OFFSET 0
#define SQ_TAIL_OFFSET 64
#define SQ_RING_MASK_OFFSET 256
#define SQ_RING_ENTRIES_OFFSET 264
#define SQ_FLAGS_OFFSET 276
#define SQ_DROPPED_OFFSET 272
#define CQ_HEAD_OFFSET 128
#define CQ_TAIL_OFFSET 192
#define CQ_RING_MASK_OFFSET 260
#define CQ_RING_ENTRIES_OFFSET 268
#define CQ_RING_OVERFLOW_OFFSET 284
#define CQ_FLAGS_OFFSET 280
#define CQ_CQES_OFFSET 320

struct io_sqring_offsets {
  uint32_t head;
  uint32_t tail;
  uint32_t ring_mask;
  uint32_t ring_entries;
  uint32_t flags;
  uint32_t dropped;
  uint32_t array;
  uint32_t resv1;
  uint64_t resv2;
};

struct io_cqring_offsets {
  uint32_t head;
  uint32_t tail;
  uint32_t ring_mask;
  uint32_t ring_entries;
  uint32_t overflow;
  uint32_t cqes;
  uint64_t resv[2];
};

struct io_uring_params {
  uint32_t sq_entries;
  uint32_t cq_entries;
  uint32_t flags;
  uint32_t sq_thread_cpu;
  uint32_t sq_thread_idle;
  uint32_t features;
  uint32_t resv[4];
  struct io_sqring_offsets sq_off;
  struct io_cqring_offsets cq_off;
};

#define IORING_OFF_SQ_RING 0
#define IORING_OFF_SQES 0x10000000ULL

static long syz_io_uring_setup(volatile long a0, volatile long a1,
                               volatile long a2, volatile long a3,
                               volatile long a4, volatile long a5)
{
  uint32_t entries = (uint32_t)a0;
  struct io_uring_params* setup_params = (struct io_uring_params*)a1;
  void* vma1 = (void*)a2;
  void* vma2 = (void*)a3;
  void** ring_ptr_out = (void**)a4;
  void** sqes_ptr_out = (void**)a5;
  uint32_t fd_io_uring = syscall(__NR_io_uring_setup, entries, setup_params);
  uint32_t sq_ring_sz =
      setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
  uint32_t cq_ring_sz = setup_params->cq_off.cqes +
                        setup_params->cq_entries * SIZEOF_IO_URING_CQE;
  uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
  *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE,
                       MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
                       IORING_OFF_SQ_RING);
  uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
  *sqes_ptr_out =
      mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE,
           MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES);
  return fd_io_uring;
}

static long syz_io_uring_submit(volatile long a0, volatile long a1,
                                volatile long a2, volatile long a3)
{
  char* ring_ptr = (char*)a0;
  char* sqes_ptr = (char*)a1;
  char* sqe = (char*)a2;
  uint32_t sqes_index = (uint32_t)a3;
  uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET);
  uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET);
  uint32_t sq_array_off =
      (CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63;
  if (sq_ring_entries)
    sqes_index %= sq_ring_entries;
  char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE;
  memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE);
  uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET);
  uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET);
  uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask;
  uint32_t sq_tail_next = *sq_tail_ptr + 1;
  uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off);
  *(sq_array + sq_tail) = sqes_index;
  __atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE);
  return 0;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[3] = {0xffffffffffffffff, 0x0, 0x0};

void execute_one(void)
{
  intptr_t res = 0;
  *(uint32_t*)0x20000244 = 0;
  *(uint32_t*)0x20000248 = 0;
  *(uint32_t*)0x2000024c = 0;
  *(uint32_t*)0x20000250 = 0;
  *(uint32_t*)0x20000258 = -1;
  memset((void*)0x2000025c, 0, 12);
  res = -1;
  res = syz_io_uring_setup(0x3ede, 0x20000240, 0x20002000, 0x20003000,
                           0x20000040, 0x20000180);
  if (res != -1) {
    r[0] = res;
    r[1] = *(uint64_t*)0x20000040;
    r[2] = *(uint64_t*)0x20000180;
  }
  *(uint8_t*)0x20000000 = 2;
  *(uint8_t*)0x20000001 = 0x10;
  *(uint16_t*)0x20000002 = 0;
  *(uint32_t*)0x20000004 = 0;
  *(uint64_t*)0x20000008 = 0;
  *(uint64_t*)0x20000010 = 0x20000c00;
  *(uint64_t*)0x20000c00 = 0x20000540;
  memcpy((void*)0x20000540,
         "\xce\x60\xdd\x68\xac\x5a\xb5\xc3\x1e\x67\x7b\x3f\x67\x72\x15\x41\xe0"
         "\x11\x02\x20\x07\x46\x35\xe8\x83\x55\xaa\x75\x04\xe1\x9f\x74\x7a\xee"
         "\x17\x25\x46\x98\x8a\xfc\xd7\x5b\xb9\xa9\xd4\xba\x49\x8a\x7f\x89\xf4"
         "\x0e\xb3\x4b\x20\x8a\x47\x0c\xc9\x89\x3b\x93\xd1\x50\x27\x71\x1d\x3c"
         "\x09\x98\x79\xc3\x16\x85\xdc\x31\xd8\x3f\x36\x79\x7e",
         81);
  *(uint64_t*)0x20000c08 = 0xfffffffffffffef2;
  *(uint64_t*)0x20000c10 = 0x20000600;
  memcpy((void*)0x20000600,
         "\xd9\x0c\xec\xcf\x70\x8f\x68\xe2\x3e\xba\x0b\x6b\x22\x93\xdf\x28\xfd"
         "\xb4\x3f\x9f\x25\xb8\x5d\x7d\x79\xd7\x98\x97\xca\x32\x12\xf9\x3e\xa0"
         "\x14\x77\xe0",
         37);
  *(uint64_t*)0x20000c18 = 0x25;
  *(uint64_t*)0x20000c20 = 0x20000640;
  memcpy(
      (void*)0x20000640,
      "\x20\x46\xeb\x10\x62\xe0\x66\x24\x89\xf4\x63\xcc\x87\xaa\xde\x26\x25\x3e"
      "\xeb\xda\x62\x70\x68\xec\x14\xf0\xfd\x42\x50\xec\xa8\xc4\x8a\x29\x9c\xb0"
      "\xe8\x39\x82\x3c\xe4\xed\xed\x1d\x6e\x70\x31\x2f\xf7\xdb\xd8\xe2\x67\x80"
      "\x96\x42\xc7\x12\x7d\x4c\x50\xee\x97\xf6\x99\xad\xbf\x84\xf7\x5c\xd1\xe3"
      "\xf9\xef\x6e\x42\x8f\xfb\x5f\xbf\x7e\xb7\x5b\x56\x6c\x27\x30\x0e\xda\x8c"
      "\x66\x2c\xa4\x1d\xb4\xfa\xbf\xbb\x44\x72\xc1\xed\xe9\x24\x5e\x73\x5d\x8f"
      "\x5a\x4c\xc5\x3f\x14\xac\x03\xfa\x59\x18\x8b\x9a\xed\x95\x32\x76\xcb\x02"
      "\xac\x2e\x19\xd8\x99\x2d\x55\x22\xa2\x90\x50\x41\x68\x1d\x9d\x9f\x73\xb1"
      "\xa9\x92\x37\xeb\x82\x7c\x27\x34\x16\x45\xfd\x8c\x68\x81\xb3\x3c\x4d\xcb"
      "\x62\x54\xdd\x56\xe7\x1b\xf1\xfc\xce\x20\x7e\xfb\xb9\x7b\xdf\x3e\x03\xc1"
      "\x83\x1c\x0d\xec\x22\xb7\xce\x5a\x5f\xbd\x2d\x28\xb8\x68\xee\x36\x24\xf0"
      "\x9d\x85\xc9\x88\x4e\x12\x92\xcb\x3e\x8a\xd7\x80\x44\xed\xf3\x10\xa8\x51"
      "\xd1\xd0\x30\x7c\x97\x48\x1e\x1c",
      224);
  *(uint64_t*)0x20000c28 = 0xe0;
  *(uint64_t*)0x20000c30 = 0x20000400;
  memcpy((void*)0x20000400,
         "\x76\xa3\x46\x67\xfe\x1e\xc2\xa4\x7c\x40\xbb\xc4\x9c\x7e\x98\x72\x31"
         "\xf8\xb5\xca\x23\x26\x14\x46\xa9\x3c\xa7\x07\x44\x9d\x3c\x87\x16\x0d"
         "\x68\xbd\x5d\x2c\x42\xa1\x85\xd0\xb5\xfb\x0d\xce\x5c\x02\x52\x53\xab"
         "\xfa\xb3\x60\x88\x77\x46\xd8\x28\x90\x96\x2f\x3e\x23\xf0\x27\x40\x30"
         "\x53\xf9\x27\x45\xfe\x7a\xdc\x5a\x38\xca\xcc\x0b\x59\x43\xdb\x81\x37"
         "\x69\xe5\x0b\x9f\xcf\x53\x2d\xe5\xa2\xd0\x25\x19\x18\x0d\xc7\x31\x09"
         "\x86\x43\x79\x58\xf0\xd2\x3c\x59\x00\x22\x6b\xfa\x07\xaf\xe3\x1d\xf6"
         "\xb4\x69\xa7\x90\xf5\x0d\xbf\x24\xbc\xac\xc6\x3c\x2c\xd9\x36",
         134);
  *(uint64_t*)0x20000c38 = 0x86;
  *(uint64_t*)0x20000c40 = 0x20000880;
  memcpy(
      (void*)0x20000880,
      "\x6b\x58\x88\xce\x9b\xb8\x95\xd0\x61\x0a\x03\x65\x82\x48\x2e\xa0\xc0\x7a"
      "\xf7\xdf\x7b\xbb\x41\x2c\xf1\x2c\x16\xb5\xba\x77\x7b\x7f\xa6\xfa\xd4\xd8"
      "\xc7\x39\xaf\x96\xff\xbc\xd6\x3b\x86\x4e\xa9\x72\x0a\x6c\xc6\x23\x4b\xca"
      "\x29\xd7\x76\x5d\x4a\x9f\xab\x87\x2f\x4a\x65\xc2\x01\x67\xfa\x3b\x76\x79"
      "\xb6\xa2\xc8\x84\x8b\x10\x38\x5f\x83\x34\x72\x9b\xf7\x7f\xfb\x88\x4e\xab"
      "\xd1\x22\x4b\x99\x7a\x0c\xd8\xc4\xa9\xa6\x26\xd0\x71\xe5\xc0\x27\xdb\xa6"
      "\x39\xbc\x0a\x00\x8f\x7c\xee\x65\x3e\x5d\x4b\xb8\xea\x59\x48\x81\x81\xc5"
      "\xa2\xdc\x48\x88\x65\x40\xcb\xaa\xff\xc7\xa9\x82\x91\xd0\x61\xa8\x44\xac"
      "\x44\xf0\x25\x28\xf2\xb4\x09\xe0\xa0\x83\x78\x33\x08\x2e\x32",
      159);
  *(uint64_t*)0x20000c48 = 0x9f;
  *(uint64_t*)0x20000c50 = 0x20000940;
  memcpy(
      (void*)0x20000940,
      "\xc9\x4e\xd5\x81\xad\xce\x6a\x3a\xad\xf3\x15\x5f\xd0\xcc\x82\x92\x4b\x2a"
      "\xbb\x89\x40\x17\xc9\xa5\x0d\x10\x69\x2b\x3a\xfc\x47\x58\x0b\xf9\xd7\x64"
      "\x26\xbd\x5e\x88\xc8\x57\x00\xaf\x26\x3b\xe9\x02\x00\x49\x06\x51\x8b\xdf"
      "\xb6\x0e\x4b\xc7\x59\x1a\x7c\xe4\x95\x71\x10\x2f\xac\x81\x65\x32\x52\x43"
      "\xa5\x46\x14\x13\x69\x3c\x57\x9c\x8c\xe1\x81\xdd\x06\x58\x78\x2e\x90\xfc"
      "\x09\xa9\x9a\xe4\xaa\x9d\x0a\x65\xf7\xb2\x81\x4d\xc0\x08\x64\xde\x7f\xa7"
      "\x4e\xae\x5b\xf2\xfc\x79\xe1\xdc\x5f\xc2\x31\x54\xb0\x5e\xb4\x30\x9a\x34"
      "\xbc\x12\x15\x79\xf6\x32\xdb\xfd\xb5\x19\x4a\x88\x26\x98\xba\x5e\x30\x33"
      "\xca\xe0\x9a\x6f\xb2\x1f\x19\xca\x1e\xa5\xe2\xb4\x71\x63\xf3\x7d\x15\x76"
      "\x8a\xdb\x78\x7e\x9b\x9b\x94\x50\x5d\x19\x0a\x07\xe3\x30\xa2\x29\xb0\xab"
      "\x10\x2c\xc7\xaa\x87\x79\xfc\x23\xbd\x65\xf1\xce\xae\xb4\x1b",
      195);
  *(uint64_t*)0x20000c58 = 0xc3;
  *(uint64_t*)0x20000c60 = 0x20000800;
  memcpy((void*)0x20000800,
         "\x9b\x05\xda\xb0\xd1\xff\x10\x7c\x27\x4b\x13\xde\x02\x95\x4c\xd9\x59"
         "\x62\x32\x37\x23\xa8\x5f\xc6\x60\x58\xa5\x1c\x23\x72\xb1\xa2\xab\x12"
         "\xd7\x04\x4d\x0c\x3e\x19\x7f\xc0\x41\x3d\xcb\xc5\x0d\x77\xc6\x2d\x0c"
         "\x4c\x0e\x70\x0c\xf4",
         56);
  *(uint64_t*)0x20000c68 = 0x38;
  *(uint64_t*)0x20000c70 = 0;
  *(uint64_t*)0x20000c78 = 0;
  *(uint64_t*)0x20000c80 = 0x20000a40;
  memcpy((void*)0x20000a40,
         "\xd4\x24\xd6\x77\xcc\x3d\x62\x66\xc5\x98\x58\xf3\x4e\x22\xae\x3a\x0f"
         "\x19\x6c\xf4\x20\xa0\x6a\x42\x4d\x2a\x7f\x4a\x42\xff\xa7\x2c\xd9\xee"
         "\xda\xa7\x34\xf1\x9e\xc1\xbc\x90\x00\xac\xea\x93\xad\x75\x3c\x2a\x7d"
         "\xec\x1f\xf5\x34\x00\x4c\x36\x54\x29\x10\xbe\x23\x0e\x6c\x66\x79\xd1"
         "\xca\x70\x26\x08\x0b\x42\x65\xc8\xa6\xee\x4f\xd3\x1b\xab\x46\x2a\x34"
         "\xc2\x28\x1c\xfe\x57\x45\xa9\x9a\x26\x14\xd6\xed\xa9\xf8\x70\xf4\x62"
         "\x39\xd5\x7a\x43\x29\x9a\x59\x98\x99\x2b\xc2\x30\x42\xb6\x8a\x3d\xab"
         "\x23\xc0\xcb\xbb\x57\x5f\x30\x6e\xf9\x53\x1d\x46\x9e\xb9\xc5\xa7\xe1"
         "\xe6\x6b\x19\x7c\x20\x33\xd4\xff\xb6\x51\x9f\x24\xd4\x98\x34\x23\x54"
         "\x86\x81\xf3\x4b\xaa\xf6\x33\x23\xd8\x87\xa8\xbc\x1c\x4a",
         167);
  *(uint64_t*)0x20000c88 = 0xa7;
  *(uint32_t*)0x20000018 = 9;
  *(uint32_t*)0x2000001c = 0;
  *(uint64_t*)0x20000020 = 0;
  *(uint16_t*)0x20000028 = 3;
  *(uint16_t*)0x2000002a = 0;
  memset((void*)0x2000002c, 0, 20);
  syz_io_uring_submit(r[1], r[2], 0x20000000, 0);
  syscall(__NR_io_uring_enter, r[0], 0x2ff, 0, 0ul, 0ul, 0x1e00ul);
}
int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  loop();
  return 0;
}