// https://syzkaller.appspot.com/bug?id=37bbe8832043dade78f838e7e4da5f0b374a46d4
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
                 0x0, 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  openat$tun arguments: [
  //    fd: const = 0xffffffffffffff9c (8 bytes)
  //    file: ptr[in, buffer] {
  //      buffer: {2f 64 65 76 2f 6e 65 74 2f 74 75 6e 00} (length 0xd)
  //    }
  //    flags: open_flags = 0xa2f01 (4 bytes)
  //    mode: const = 0x0 (2 bytes)
  //  ]
  //  returns fd_tun
  memcpy((void*)0x2000000001c0, "/dev/net/tun\000", 13);
  res = syscall(
      __NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x2000000001c0ul,
      /*flags=O_TRUNC|O_NONBLOCK|O_NOFOLLOW|O_NOCTTY|O_CLOEXEC|FASYNC|0x401*/
      0xa2f01, /*mode=*/0);
  if (res != -1)
    r[0] = res;
  //  ioctl$TUNSETIFF arguments: [
  //    fd: fd_tun (resource)
  //    cmd: const = 0x400454ca (4 bytes)
  //    arg: ptr[in, ifreq_dev_t[devnames, flags[tun_setiff_flags, int16]]] {
  //      ifreq_dev_t[devnames, flags[tun_setiff_flags, int16]] {
  //        ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 31 00 00 00 00 00 00}
  //        (length 0x10) elem: tun_setiff_flags = 0x6bf1c2d5adba8c32 (2 bytes)
  //        pad = 0x0 (22 bytes)
  //      }
  //    }
  //  ]
  memcpy((void*)0x2000000000c0, "syzkaller1\000\000\000\000\000\000", 16);
  *(uint16_t*)0x2000000000d0 = 0x8c32;
  syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x400454ca,
          /*arg=*/0x2000000000c0ul);
  //  bpf$PROG_LOAD arguments: [
  //    cmd: const = 0x5 (8 bytes)
  //    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32],
  //    bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
  //      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types,
  //      bpf_btf_id[opt], fd_bpf_prog[opt]] {
  //        type: bpf_prog_type = 0x6 (4 bytes)
  //        ninsn: bytesize8 = 0x3 (4 bytes)
  //        insns: ptr[inout, array[ANYUNION]] {
  //          array[ANYUNION] {
  //            union ANYUNION {
  //              ANYBLOB: buffer: {18 00 00 00 02 00 00 00 00 00 00 00 00 00 00
  //              00 95} (length 0x11)
  //            }
  //          }
  //        }
  //        license: ptr[in, buffer] {
  //          buffer: {47 50 4c 00} (length 0x4)
  //        }
  //        loglev: int32 = 0x0 (4 bytes)
  //        logsize: len = 0x0 (4 bytes)
  //        log: nil
  //        kern_version: bpf_kern_version = 0x0 (4 bytes)
  //        flags: bpf_prog_load_flags = 0x27 (4 bytes)
  //        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
  //        (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type:
  //        union bpf_prog_attach_types {
  //          xdp: xdp_attach_types = 0x25 (4 bytes)
  //        }
  //        btf_fd: fd_btf (resource)
  //        func_info_rec_size: const = 0x0 (4 bytes)
  //        func_info: nil
  //        func_info_cnt: len = 0x0 (4 bytes)
  //        line_info_rec_size: const = 0x0 (4 bytes)
  //        line_info: nil
  //        line_info_cnt: len = 0x0 (4 bytes)
  //        attach_btf_id: bpf_btf_id (resource)
  //        attach_prog_fd: fd_bpf_prog (resource)
  //        core_relo_cnt: len = 0x0 (4 bytes)
  //        fd_array: nil
  //        core_relos: nil
  //        core_relo_rec_size: const = 0x0 (4 bytes)
  //        log_true_size: int32 = 0x0 (4 bytes)
  //        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_prog_token_fd_wrapper {
  //          void: buffer: {} (length 0x0)
  //        }
  //        pad: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_pad_wrapper {
  //          value: const = 0x0 (4 bytes)
  //        }
  //      }
  //    }
  //    size: len = 0x94 (8 bytes)
  //  ]
  //  returns fd_bpf_prog
  *(uint32_t*)0x200000000540 = 6;
  *(uint32_t*)0x200000000544 = 3;
  *(uint64_t*)0x200000000548 = 0x200000000480;
  memcpy((void*)0x200000000480,
         "\x18\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x95",
         17);
  *(uint64_t*)0x200000000550 = 0x200000000500;
  memcpy((void*)0x200000000500, "GPL\000", 4);
  *(uint32_t*)0x200000000558 = 0;
  *(uint32_t*)0x20000000055c = 0;
  *(uint64_t*)0x200000000560 = 0;
  *(uint32_t*)0x200000000568 = 0;
  *(uint32_t*)0x20000000056c = 0x27;
  memset((void*)0x200000000570, 0, 16);
  *(uint32_t*)0x200000000580 = 0;
  *(uint32_t*)0x200000000584 = 0x25;
  *(uint32_t*)0x200000000588 = 0;
  *(uint32_t*)0x20000000058c = 0;
  *(uint64_t*)0x200000000590 = 0;
  *(uint32_t*)0x200000000598 = 0;
  *(uint32_t*)0x20000000059c = 0;
  *(uint64_t*)0x2000000005a0 = 0;
  *(uint32_t*)0x2000000005a8 = 0;
  *(uint32_t*)0x2000000005ac = 0;
  *(uint32_t*)0x2000000005b0 = 0;
  *(uint32_t*)0x2000000005b4 = 0;
  *(uint64_t*)0x2000000005b8 = 0;
  *(uint64_t*)0x2000000005c0 = 0;
  *(uint32_t*)0x2000000005c8 = 0;
  *(uint32_t*)0x2000000005cc = 0;
  *(uint32_t*)0x2000000005d0 = 0;
  res =
      syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000540ul, /*size=*/0x94ul);
  if (res != -1)
    r[1] = res;
  //  socket$nl_generic arguments: [
  //    domain: const = 0x10 (8 bytes)
  //    type: const = 0x3 (8 bytes)
  //    proto: const = 0x10 (4 bytes)
  //  ]
  //  returns sock_nl_generic
  res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
  if (res != -1)
    r[2] = res;
  //  ioctl$sock_SIOCGIFINDEX arguments: [
  //    fd: sock (resource)
  //    cmd: const = 0x8933 (4 bytes)
  //    arg: ptr[out, ifreq_dev_t[devnames, ifindex]] {
  //      ifreq_dev_t[devnames, ifindex] {
  //        ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 31 00 00 00 00 00 00}
  //        (length 0x10) elem: ifindex (resource) pad = 0x0 (20 bytes)
  //      }
  //    }
  //  ]
  memcpy((void*)0x2000000004c0, "syzkaller1\000\000\000\000\000\000", 16);
  res = syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0x8933,
                /*arg=*/0x2000000004c0ul);
  if (res != -1)
    r[3] = *(uint32_t*)0x2000000004d0;
  //  bpf$BPF_LINK_CREATE_XDP arguments: [
  //    cmd: const = 0x1c (8 bytes)
  //    arg: ptr[in, bpf_link_create_arg_t[fd_bpf_prog_xdp, ifindex,
  //    const[BPF_XDP, int32], flags[xdp_flags, int32]]] {
  //      bpf_link_create_arg_t[fd_bpf_prog_xdp, ifindex, const[BPF_XDP, int32],
  //      flags[xdp_flags, int32]] {
  //        prog_fd: fd_bpf_prog_xdp (resource)
  //        target_fd: ifindex (resource)
  //        attach_type: const = 0x25 (4 bytes)
  //        flags: xdp_flags = 0x4 (4 bytes)
  //        extra: union optional[link_create_arg_extra] {
  //          val: union link_create_arg_extra {
  //            uprobe_multi: link_create_uprobe_multi {
  //              path: nil
  //              offsets: nil
  //              ref_ctr_offsets: nil
  //              cookies: int64 = 0x8 (8 bytes)
  //              cnt: len = 0x0 (4 bytes)
  //              flags: bpf_link_create_uprobe_multi_flags = 0x0 (4 bytes)
  //              pid: pid (resource)
  //              pad = 0x0 (4 bytes)
  //            }
  //          }
  //        }
  //      }
  //    }
  //    size: len = 0x40 (8 bytes)
  //  ]
  //  returns fd_bpf_link
  *(uint32_t*)0x200000000980 = r[1];
  *(uint32_t*)0x200000000984 = r[3];
  *(uint32_t*)0x200000000988 = 0x25;
  *(uint32_t*)0x20000000098c = 4;
  *(uint64_t*)0x200000000990 = 0;
  *(uint64_t*)0x200000000998 = 0;
  *(uint64_t*)0x2000000009a0 = 0;
  *(uint64_t*)0x2000000009a8 = 8;
  *(uint32_t*)0x2000000009b0 = 0;
  *(uint32_t*)0x2000000009b4 = 0;
  *(uint32_t*)0x2000000009b8 = 0;
  syscall(__NR_bpf, /*cmd=*/0x1cul, /*arg=*/0x200000000980ul, /*size=*/0x40ul);
  //  socket$kcm arguments: [
  //    domain: const = 0x2 (8 bytes)
  //    type: kcm_socket_type = 0xa (8 bytes)
  //    proto: const = 0x2 (4 bytes)
  //  ]
  //  returns sock_kcm
  res = syscall(__NR_socket, /*domain=*/2ul, /*type=SOCK_DGRAM|0x8*/ 0xaul,
                /*proto=*/2);
  if (res != -1)
    r[4] = res;
  //  ioctl$SIOCSIFHWADDR arguments: [
  //    fd: fd_tun (resource)
  //    cmd: const = 0x8914 (4 bytes)
  //    arg: ptr[in, ifreq_dev_t[devnames, mac_addr]] {
  //      ifreq_dev_t[devnames, mac_addr] {
  //        ifr_ifrn: buffer: {73 79 7a 6b 61 6c 6c 65 72 31 00 00 00 00 00 00}
  //        (length 0x10) elem: union mac_addr {
  //          link_local: mac_addr_link_local {
  //            a0: const = 0x1 (1 bytes)
  //            a1: const = 0x80 (1 bytes)
  //            a2: const = 0xc2 (1 bytes)
  //            a3: const = 0x0 (1 bytes)
  //            a4: const = 0x0 (1 bytes)
  //            a5: mac_addr_link_local_values = 0x0 (1 bytes)
  //          }
  //        }
  //        pad = 0x0 (18 bytes)
  //      }
  //    }
  //  ]
  memcpy((void*)0x200000000180, "syzkaller1\000\000\000\000\000\000", 16);
  *(uint8_t*)0x200000000190 = 1;
  *(uint8_t*)0x200000000191 = 0x80;
  *(uint8_t*)0x200000000192 = 0xc2;
  *(uint8_t*)0x200000000193 = 0;
  *(uint8_t*)0x200000000194 = 0;
  *(uint8_t*)0x200000000195 = 0;
  syscall(__NR_ioctl, /*fd=*/r[4], /*cmd=*/0x8914, /*arg=*/0x200000000180ul);
  //  write$tun arguments: [
  //    fd: fd_tun (resource)
  //    buf: ptr[inout, array[ANYUNION]] {
  //      array[ANYUNION] {
  //      }
  //    }
  //    count: len = 0x4b (8 bytes)
  //  ]
  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000340ul, /*count=*/0x4bul);
  return 0;
}