// https://syzkaller.appspot.com/bug?id=8c395e04c4328bea2ab76b21856c36bd48c79576
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif
#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fsmount
#define __NR_fsmount 432
#endif
#ifndef __NR_fsopen
#define __NR_fsopen 430
#endif

const int kInitNetNsFd = 201;

static long syz_init_net_socket(volatile long domain, volatile long type,
                                volatile long proto)
{
  return syscall(__NR_socket, domain, type, proto);
}

uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
                 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  bpf$PROG_LOAD arguments: [
  //    cmd: const = 0x5 (8 bytes)
  //    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32],
  //    bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
  //      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types,
  //      bpf_btf_id[opt], fd_bpf_prog[opt]] {
  //        type: bpf_prog_type = 0x19 (4 bytes)
  //        ninsn: bytesize8 = 0x3 (4 bytes)
  //        insns: ptr[inout, array[ANYUNION]] {
  //          array[ANYUNION] {
  //            union ANYUNION {
  //              ANYBLOB: buffer: {18 00 00 00 01 00 00 00 00 00 00 00 00 00 00
  //              00 95} (length 0x11)
  //            }
  //          }
  //        }
  //        license: ptr[in, buffer] {
  //          buffer: {47 50 4c 00} (length 0x4)
  //        }
  //        loglev: int32 = 0x0 (4 bytes)
  //        logsize: len = 0x0 (4 bytes)
  //        log: nil
  //        kern_version: bpf_kern_version = 0x0 (4 bytes)
  //        flags: bpf_prog_load_flags = 0x9 (4 bytes)
  //        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
  //        (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type:
  //        union bpf_prog_attach_types {
  //          cgroup_sockopt: cgroup_sockopt_attach_types = 0x16 (4 bytes)
  //        }
  //        btf_fd: fd_btf (resource)
  //        func_info_rec_size: const = 0x0 (4 bytes)
  //        func_info: nil
  //        func_info_cnt: len = 0x0 (4 bytes)
  //        line_info_rec_size: const = 0x0 (4 bytes)
  //        line_info: nil
  //        line_info_cnt: len = 0x0 (4 bytes)
  //        attach_btf_id: bpf_btf_id (resource)
  //        attach_prog_fd: fd_bpf_prog (resource)
  //        core_relo_cnt: len = 0x0 (4 bytes)
  //        fd_array: nil
  //        core_relos: nil
  //        core_relo_rec_size: const = 0x0 (4 bytes)
  //        log_true_size: int32 = 0x0 (4 bytes)
  //        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_prog_token_fd_wrapper {
  //          void: buffer: {} (length 0x0)
  //        }
  //        pad: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_pad_wrapper {
  //          value: const = 0x0 (4 bytes)
  //        }
  //      }
  //    }
  //    size: len = 0x94 (8 bytes)
  //  ]
  //  returns fd_bpf_prog
  *(uint32_t*)0x200000000100 = 0x19;
  *(uint32_t*)0x200000000104 = 3;
  *(uint64_t*)0x200000000108 = 0x2000000003c0;
  memcpy((void*)0x2000000003c0,
         "\x18\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x95",
         17);
  *(uint64_t*)0x200000000110 = 0x200000000200;
  memcpy((void*)0x200000000200, "GPL\000", 4);
  *(uint32_t*)0x200000000118 = 0;
  *(uint32_t*)0x20000000011c = 0;
  *(uint64_t*)0x200000000120 = 0;
  *(uint32_t*)0x200000000128 = 0;
  *(uint32_t*)0x20000000012c = 9;
  memset((void*)0x200000000130, 0, 16);
  *(uint32_t*)0x200000000140 = 0;
  *(uint32_t*)0x200000000144 = 0x16;
  *(uint32_t*)0x200000000148 = -1;
  *(uint32_t*)0x20000000014c = 0;
  *(uint64_t*)0x200000000150 = 0;
  *(uint32_t*)0x200000000158 = 0;
  *(uint32_t*)0x20000000015c = 0;
  *(uint64_t*)0x200000000160 = 0;
  *(uint32_t*)0x200000000168 = 0;
  *(uint32_t*)0x20000000016c = 0;
  *(uint32_t*)0x200000000170 = 0;
  *(uint32_t*)0x200000000174 = 0;
  *(uint64_t*)0x200000000178 = 0;
  *(uint64_t*)0x200000000180 = 0;
  *(uint32_t*)0x200000000188 = 0;
  *(uint32_t*)0x20000000018c = 0;
  *(uint32_t*)0x200000000190 = 0;
  res =
      syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000100ul, /*size=*/0x94ul);
  if (res != -1)
    r[0] = res;
  //  fsopen arguments: [
  //    type: ptr[in, buffer] {
  //      buffer: {63 67 72 6f 75 70 32 00} (length 0x8)
  //    }
  //    flags: fsopen_flags = 0x0 (8 bytes)
  //  ]
  //  returns fd_fscontext
  memcpy((void*)0x200000000000, "cgroup2\000", 8);
  res = syscall(__NR_fsopen, /*type=*/0x200000000000ul, /*flags=*/0ul);
  if (res != -1)
    r[1] = res;
  //  fsconfig$FSCONFIG_CMD_CREATE arguments: [
  //    fd: fd_fscontext (resource)
  //    cmd: const = 0x6 (8 bytes)
  //    key: const = 0x0 (8 bytes)
  //    value: const = 0x0 (8 bytes)
  //    aux: const = 0x0 (8 bytes)
  //  ]
  syscall(__NR_fsconfig, /*fd=*/r[1], /*cmd=*/6ul, /*key=*/0ul, /*value=*/0ul,
          /*aux=*/0ul);
  //  fsmount arguments: [
  //    fs_fd: fd_fscontext (resource)
  //    flags: fsmount_flags = 0x0 (8 bytes)
  //    attr_flags: fsmount_attr_flags = 0x80 (8 bytes)
  //  ]
  //  returns fd
  res = syscall(__NR_fsmount, /*fs_fd=*/r[1], /*flags=*/0ul,
                /*attr_flags=MOUNT_ATTR_NODIRATIME*/ 0x80ul);
  if (res != -1)
    r[2] = res;
  //  bpf$BPF_LINK_CREATE arguments: [
  //    cmd: const = 0x1c (8 bytes)
  //    arg: ptr[in, bpf_link_create_arg_t[fd_bpf_prog, fd_cgroup,
  //    flags[bpf_attach_types_link_create, int32], const[0, int32]]] {
  //      bpf_link_create_arg_t[fd_bpf_prog, fd_cgroup,
  //      flags[bpf_attach_types_link_create, int32], const[0, int32]] {
  //        prog_fd: fd_bpf_prog (resource)
  //        target_fd: fd_cgroup (resource)
  //        attach_type: bpf_attach_types_link_create = 0x16 (4 bytes)
  //        flags: const = 0x0 (4 bytes)
  //        extra: union optional[link_create_arg_extra] {
  //          void: buffer: {} (length 0x0)
  //        }
  //      }
  //    }
  //    size: len = 0x10 (8 bytes)
  //  ]
  //  returns fd_bpf_link
  *(uint32_t*)0x2000000000c0 = r[0];
  *(uint32_t*)0x2000000000c4 = r[2];
  *(uint32_t*)0x2000000000c8 = 0x16;
  *(uint32_t*)0x2000000000cc = 0;
  syscall(__NR_bpf, /*cmd=*/0x1cul, /*arg=*/0x2000000000c0ul, /*size=*/0x10ul);
  //  syz_init_net_socket$bt_hci arguments: [
  //    fam: const = 0x1f (8 bytes)
  //    type: const = 0x3 (8 bytes)
  //    proto: const = 0x1 (8 bytes)
  //  ]
  //  returns sock_bt_hci
  res = -1;
  res = syz_init_net_socket(/*fam=*/0x1f, /*type=*/3, /*proto=*/1);
  if (res != -1)
    r[3] = res;
  //  setsockopt$bt_hci_HCI_TIME_STAMP arguments: [
  //    fd: sock_bt_hci (resource)
  //    level: const = 0x0 (4 bytes)
  //    opt: const = 0x3 (4 bytes)
  //    arg: ptr[in, int32] {
  //      int32 = 0x8000 (4 bytes)
  //    }
  //    arglen: len = 0x1 (8 bytes)
  //  ]
  *(uint32_t*)0x200000000000 = 0x8000;
  syscall(__NR_setsockopt, /*fd=*/r[3], /*level=*/0, /*opt=*/3,
          /*arg=*/0x200000000000ul, /*arglen=*/1ul);
  return 0;
}