// https://syzkaller.appspot.com/bug?id=6c02bbd0eede15e778c5b23b809fe045f24f9ed6
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/mount.h>

static void write_file(const char *path, const char *val)
{
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        exit(1);
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        close(fd);
        exit(1);
    }
    close(fd);
    printf("[+] Successfully wrote to %s\n", path);
}

int main(void)
{
    setvbuf(stdout, NULL, _IONBF, 0);

    // Try to mount configfs
    if (mount("none", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount configfs: %s\n", strerror(errno));
            // We don't exit here, maybe it's already mounted but we don't have mount privileges
        }
    }

    // Create a Ramdisk HBA
    if (mkdir("/sys/kernel/config/target/core/rd_mcp_0", 0777) < 0) {
        if (errno != EEXIST) {
            printf("[-] Failed to mkdir rd_mcp_0: %s\n", strerror(errno));
            exit(1);
        }
    }
    printf("[+] Created rd_mcp_0\n");

    // Create a Ramdisk device
    if (mkdir("/sys/kernel/config/target/core/rd_mcp_0/dev1", 0777) < 0) {
        if (errno != EEXIST) {
            printf("[-] Failed to mkdir dev1: %s\n", strerror(errno));
            exit(1);
        }
    }
    printf("[+] Created dev1\n");

    // Set an extremely large page count to force a huge kmalloc
    // 2147483647 is INT_MAX, which will cause a huge allocation in rd_build_device_space
    write_file("/sys/kernel/config/target/core/rd_mcp_0/dev1/control", "rd_pages=2147483647\n");

    // Enable the device, triggering the allocation and the warning
    write_file("/sys/kernel/config/target/core/rd_mcp_0/dev1/enable", "1\n");

    return 0;
}