// https://syzkaller.appspot.com/bug?id=e5ec25c5282aa2341e7429e1db5725a773782635
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

const int kInitNetNsFd = 201;

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    unsigned long nb = a1;
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(nb % 10);
      nb /= 10;
    }
    return open(buf, a2 & ~O_CREAT, 0);
  }
}

static long syz_init_net_socket(volatile long domain, volatile long type,
                                volatile long proto)
{
  return syscall(__NR_socket, domain, type, proto);
}

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  mkdir arguments: [
  //    path: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 00} (length 0x7)
  //    }
  //    mode: open_mode = 0x1ff (8 bytes)
  //  ]
  memcpy((void*)0x200000000000, "config\000", 7);
  syscall(
      __NR_mkdir, /*path=*/0x200000000000ul,
      /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/
      0x1fful);
  //  mount arguments: [
  //    src: nil
  //    dst: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 00} (length 0x7)
  //    }
  //    type: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 66 73 00} (length 0x9)
  //    }
  //    flags: mount_flags = 0x0 (8 bytes)
  //    data: nil
  //  ]
  memcpy((void*)0x200000000100, "config\000", 7);
  memcpy((void*)0x200000000200, "configfs\000", 9);
  syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000100ul,
          /*type=*/0x200000000200ul, /*flags=*/0ul, /*data=*/0ul);
  //  mkdir arguments: [
  //    path: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 2f 75 73 62 5f 67 61 64 67 65 74 2f 67 31
  //      00} (length 0x15)
  //    }
  //    mode: open_mode = 0x1ff (8 bytes)
  //  ]
  memcpy((void*)0x200000000300, "config/usb_gadget/g1\000", 21);
  syscall(
      __NR_mkdir, /*path=*/0x200000000300ul,
      /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/
      0x1fful);
  //  mkdir arguments: [
  //    path: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 2f 75 73 62 5f 67 61 64 67 65 74 2f 67 31
  //      2f 66 75 6e 63 74 69 6f 6e 73 2f 75 61 63 32 2e 75 73 62 30 00}
  //      (length 0x29)
  //    }
  //    mode: open_mode = 0x1ff (8 bytes)
  //  ]
  memcpy((void*)0x200000000500, "config/usb_gadget/g1/functions/uac2.usb0\000",
         41);
  syscall(
      __NR_mkdir, /*path=*/0x200000000500ul,
      /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/
      0x1fful);
  //  openat arguments: [
  //    fd: fd_dir (resource)
  //    file: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 2f 75 73 62 5f 67 61 64 67 65 74 2f 67 31
  //      2f 66 75 6e 63 74 69 6f 6e 73 2f 75 61 63 32 2e 75 73 62 30 2f 63 5f
  //      73 72 61 74 65 00} (length 0x31)
  //    }
  //    flags: open_flags = 0x1 (4 bytes)
  //    mode: open_mode = 0x0 (2 bytes)
  //  ]
  //  returns fd
  memcpy((void*)0x200000000600,
         "config/usb_gadget/g1/functions/uac2.usb0/c_srate\000", 49);
  res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000600ul,
                /*flags=O_WRONLY*/ 1, /*mode=*/0);
  if (res != -1)
    r[0] = res;
  //  write arguments: [
  //    fd: fd (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {34 34 31 30 35 2c 1b 38 14 30 30 2c 39 36 30 30 30 00 90 9c
  //      6f c6 d2 00 44 24 c9 1b 0d fb df 59 16 10 1b 73 80 a3 07 58 bc c7 98
  //      09 61 ad 64 7d cf 3f 57 65 e3 ce 4b 29 79 24 50 cc a9 4f 28 85 af f7
  //      ea 68 a1 12 47 5e 80 c9 2d cf e4 9a 30 d5 60 87 fb 4d 54 61 67 33 02
  //      50 f3 f4 ec f0 b0 29 2c 20 02 71 72 e0 7d 2e 66 9a 29 18 87 c6 80 30
  //      05 29 90 07 09 90 52 3a 9a 61 49 dc 52 08 0c c5 42 bb d4 00 a5 a7 f8
  //      a1 a8 fd 77 7c e2 f8 bd 19 39 ca 1c b8 6c 63 ee 82 9c 2a cb 91 ef 97
  //      33 8b 98 2c 9c 5f 6a 8f cb 7b 98 76 df b5 59 c9 db a8 82 47 fc d4 df
  //      68 63 94 c7 dd 3b ba 30 98 68 6c d7 0b 6b 5c 8d 83 11 c4 af 09 26 47
  //      70 70 80 12 20 58 61 ee 78 fd a8 9c 76 1c 7a 2c 0c 82 bc be 1a f4 c5
  //      00 24 2e 77 17 00 24 b9 30 cb 7f d2 48 08 09 c8 af 5c 96 75} (length
  //      0xf7)
  //    }
  //    count: len = 0xf7 (8 bytes)
  //  ]
  memcpy(
      (void*)0x200000000d40,
      "\x34\x34\x31\x30\x35\x2c\x1b\x38\x14\x30\x30\x2c\x39\x36\x30\x30\x30\x00"
      "\x90\x9c\x6f\xc6\xd2\x00\x44\x24\xc9\x1b\x0d\xfb\xdf\x59\x16\x10\x1b\x73"
      "\x80\xa3\x07\x58\xbc\xc7\x98\x09\x61\xad\x64\x7d\xcf\x3f\x57\x65\xe3\xce"
      "\x4b\x29\x79\x24\x50\xcc\xa9\x4f\x28\x85\xaf\xf7\xea\x68\xa1\x12\x47\x5e"
      "\x80\xc9\x2d\xcf\xe4\x9a\x30\xd5\x60\x87\xfb\x4d\x54\x61\x67\x33\x02\x50"
      "\xf3\xf4\xec\xf0\xb0\x29\x2c\x20\x02\x71\x72\xe0\x7d\x2e\x66\x9a\x29\x18"
      "\x87\xc6\x80\x30\x05\x29\x90\x07\x09\x90\x52\x3a\x9a\x61\x49\xdc\x52\x08"
      "\x0c\xc5\x42\xbb\xd4\x00\xa5\xa7\xf8\xa1\xa8\xfd\x77\x7c\xe2\xf8\xbd\x19"
      "\x39\xca\x1c\xb8\x6c\x63\xee\x82\x9c\x2a\xcb\x91\xef\x97\x33\x8b\x98\x2c"
      "\x9c\x5f\x6a\x8f\xcb\x7b\x98\x76\xdf\xb5\x59\xc9\xdb\xa8\x82\x47\xfc\xd4"
      "\xdf\x68\x63\x94\xc7\xdd\x3b\xba\x30\x98\x68\x6c\xd7\x0b\x6b\x5c\x8d\x83"
      "\x11\xc4\xaf\x09\x26\x47\x70\x70\x80\x12\x20\x58\x61\xee\x78\xfd\xa8\x9c"
      "\x76\x1c\x7a\x2c\x0c\x82\xbc\xbe\x1a\xf4\xc5\x00\x24\x2e\x77\x17\x00\x24"
      "\xb9\x30\xcb\x7f\xd2\x48\x08\x09\xc8\xaf\x5c\x96\x75",
      247);
  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000d40ul, /*count=*/0xf7ul);
  //  syz_init_net_socket$nl_rdma arguments: [
  //    domain: const = 0x10 (8 bytes)
  //    type: const = 0x3 (8 bytes)
  //    proto: const = 0x10 (8 bytes)
  //  ]
  //  returns sock_nl_rdma
  syz_init_net_socket(/*domain=*/0x10, /*type=*/3, /*proto=*/0x10);
  //  syz_open_dev$vim2m arguments: [
  //    dev: nil
  //    id: intptr = 0x47b (8 bytes)
  //    flags: const = 0x2 (8 bytes)
  //  ]
  //  returns fd_vim2m
  syz_open_dev(/*dev=*/0, /*id=*/0x47b, /*flags=*/2);
  return 0;
}