// https://syzkaller.appspot.com/bug?id=d032fa1fac0054b4a7175676d8860731162f4a68
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(a1 % 10);
      a1 /= 10;
    }
    return open(buf, a2, 0);
  }
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  memcpy((void*)0x200000000140, "/dev/loop#\000", 11);
  res = -1;
  res = syz_open_dev(
      /*dev=*/0x200000000140, /*id=*/0x75f,
      /*flags=O_TRUNC|O_NOFOLLOW|O_NOCTTY|O_LARGEFILE|O_EXCL|FASYNC|0x2*/
      0x2a382);
  if (res != -1)
    r[0] = res;
  memcpy(
      (void*)0x200000000880,
      "C\023\3742\225WD\252\272^\220\375\215\302\261["
      "\201\332\332\326\214\3119\354\016*||\344\263\304\266\v\252\025\206,"
      "\254\215\211cu\020\334\223\233\264\223\257E*:\344\335\245\2475\270\036;"
      "7\267.V\334rw[\r\230\223j\234\366\370\231\357F_\315\337!"
      "b\305\354\ntb\377\b\252F?!"
      "\237\a\032\003\f\3514\035eU\006zS\3110\271voI\245/"
      "\264\247@\241\\B\302@\r_b\232\353\b\201\000V\326/"
      "N\305\306f\261\225Z\345w^"
      "\330\347J\200\367\256\257uv\204\236G\321\347\233\360_"
      "9\302\233\375\303\363\344\225P\361m\317\302\341\346\246\214\021\373\270S"
      "\213\222\\\asW-Ee\002\000\000\000\320;Q\301~"
      "\211\354\310\233\210\a\362\223\202("
      "\213\000\330\264T\200\225\223\2345\317\t\004\000\000\000\000\000\000v"
      "\357\356+\253\234\000^R\262n?i="
      "\276\026\212\277\343\315B\355\3414\350\320\267\377\376Q\034\205n8\033"
      "\301\b\000\000\000\000\000\000\000\027\224\337W<"
      "GE\361\351\361q\214\360\256\230\214\340\301g}\256W\252\241\220\214\n$"
      "\246\273\020\257\307~\021\003<v\351\307K\366]\021)u\323\025\001}\3425$"
      "\260\206v\200\r\234\270\346\323(\240G2s\251&\263QU~u\023\005kKp\246&"
      "\216u\035\262\251!\311\372\320dG5\313f<}r\253\234\331f6iN\252>"
      "\222z\276\262R)\361K\327\257\231\366d\350\354\267\275+T3\246\251\372Y-"
      "1qs\202\357n*\226\311\036\364\321\002Dt\300\031\367\211\226.D "
      "[F\356YW\225\023\307;\224\023^"
      "\023\257\360C\234\253f\035aCS2\002\260\357\307\214\236\355\a\n<"
      "V\252\277Z1\2502\205\231\016$"
      "U\264X\307\372\f\b\217\304\276It\344\3051\272\271H\350\226\224\327\334"
      "\201\0211\t\257l\227\330T\3240\220ON\252FY\264\263\364\370JT\305:"
      "\305\aGc\265\022\220\177\000\221\316@\345\323A\314\325|"
      "\237\2165\0042\232\301\241\a\267\365\274,\321\323k8\305",
      557);
  res = syscall(__NR_memfd_create, /*name=*/0x200000000880ul,
                /*flags=MFD_CLOEXEC*/ 1ul);
  if (res != -1)
    r[1] = res;
  syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x4c00, /*arg=*/r[1]);
  *(uint32_t*)0x200000000080 = 0;
  *(uint16_t*)0x200000000088 = 0;
  *(uint64_t*)0x200000000090 = 0;
  *(uint16_t*)0x200000000098 = 0;
  *(uint32_t*)0x2000000000a0 = 1;
  *(uint32_t*)0x2000000000a4 = 2;
  *(uint32_t*)0x2000000000a8 = 0x1c;
  *(uint32_t*)0x2000000000ac = 0x15;
  memcpy((void*)0x2000000000b0,
         "\xdb\x64\x10\xa1\xe6\xfb\x92\x8c\x17\x7e\xc5\x6c\x0c\x3f\x1d\x70\x4f"
         "\xca\xdf\x25\x07\x8e\x4c\x7b\xf4\x6f\xdb\xb7\x22\xb1\x86\xbe\x31\xd4"
         "\xf3\x53\x62\x39\x9f\x4e\x7e\xbe\xff\xdf\x06\x28\xa8\x1f\xbb\x3b\xb6"
         "\x17\x7f\x84\xd6\x83\xdd\x9c\xb5\xdf\x81\x7b\x12\xda",
         64);
  memcpy((void*)0x2000000000f0,
         "\x5c\x2d\x64\x59\xa1\x57\x69\xd5\x9a\xdd\x6a\x21\x44\x39\xb6\x4a\x74"
         "\x1f\x26\x09\xe6\x40\xf6\xc4\x8d\x21\xe8\xac\xe9\x39\x89\x34",
         32);
  *(uint64_t*)0x200000000110 = 1;
  *(uint64_t*)0x200000000118 = 1;
  *(uint32_t*)0x200000000120 = 0;
  syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x4c02, /*arg=*/0x200000000080ul);
  return 0;
}