// https://syzkaller.appspot.com/bug?id=583b200c0464331b3f9cf1d67566de0834f916d6
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

static void use_temporary_dir(void)
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    exit(1);
  if (chmod(tmpdir, 0777))
    exit(1);
  if (chdir(tmpdir))
    exit(1);
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  use_temporary_dir();
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  bpf$MAP_CREATE arguments: [
  //    cmd: const = 0x0 (8 bytes)
  //    arg: ptr[in, bpf_map_create_arg] {
  //      union bpf_map_create_arg {
  //        base: bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32,
  //        int32, flags[map_flags, int32], const[0, int64]] {
  //          type: bpf_map_type = 0x1 (4 bytes)
  //          ksize: int32 = 0x7 (4 bytes)
  //          vsize: int32 = 0x10001 (4 bytes)
  //          max: int32 = 0x9 (4 bytes)
  //          flags: map_flags = 0x1 (4 bytes)
  //          inner: fd_bpf_map (resource)
  //          node: int32 = 0x0 (4 bytes)
  //          map_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  //          00} (length 0x10) map_ifindex: ifindex (resource) btf_fd: fd_btf
  //          (resource) btf_key_type_id: int32 = 0x0 (4 bytes)
  //          btf_value_type_id: int32 = 0x0 (4 bytes)
  //          btf_vmlinux_type_id: int32 = 0x0 (4 bytes)
  //          map_extra: const = 0x0 (8 bytes)
  //          value_type_btf_obj_fd: union
  //          _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32,
  //          int32, flags[map_flags, int32], const[0,
  //          int64]]_value_type_btf_obj_fd_wrapper {
  //            void: buffer: {} (length 0x0)
  //          }
  //          pad1: union _bpf_map_create_arg_t[flags[bpf_map_type, int32],
  //          int32, int32, int32, flags[map_flags, int32], const[0,
  //          int64]]_pad1_wrapper {
  //            value: const = 0x0 (4 bytes)
  //          }
  //          map_token_fd: union _bpf_map_create_arg_t[flags[bpf_map_type,
  //          int32], int32, int32, int32, flags[map_flags, int32], const[0,
  //          int64]]_map_token_fd_wrapper {
  //            void: buffer: {} (length 0x0)
  //          }
  //          pad2: union _bpf_map_create_arg_t[flags[bpf_map_type, int32],
  //          int32, int32, int32, flags[map_flags, int32], const[0,
  //          int64]]_pad2_wrapper {
  //            value: const = 0x0 (4 bytes)
  //          }
  //        }
  //      }
  //    }
  //    size: len = 0x50 (8 bytes)
  //  ]
  //  returns fd_bpf_map
  *(uint32_t*)0x200000000680 = 1;
  *(uint32_t*)0x200000000684 = 7;
  *(uint32_t*)0x200000000688 = 0x10001;
  *(uint32_t*)0x20000000068c = 9;
  *(uint32_t*)0x200000000690 = 1;
  *(uint32_t*)0x200000000694 = -1;
  *(uint32_t*)0x200000000698 = 0;
  memset((void*)0x20000000069c, 0, 16);
  *(uint32_t*)0x2000000006ac = 0;
  *(uint32_t*)0x2000000006b0 = -1;
  *(uint32_t*)0x2000000006b4 = 0;
  *(uint32_t*)0x2000000006b8 = 0;
  *(uint32_t*)0x2000000006bc = 0;
  *(uint64_t*)0x2000000006c0 = 0;
  *(uint32_t*)0x2000000006c8 = 0;
  *(uint32_t*)0x2000000006cc = 0;
  res =
      syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200000000680ul, /*size=*/0x50ul);
  if (res != -1)
    r[0] = res;
  //  bpf$MAP_UPDATE_ELEM_TAIL_CALL arguments: [
  //    cmd: const = 0x2 (8 bytes)
  //    arg: ptr[inout, bpf_map_update_tail_call_arg] {
  //      bpf_map_update_tail_call_arg {
  //        map: tail_call_map_update {
  //          in: tail_call_map_fd (resource)
  //          out: tail_call_map (resource)
  //        }
  //        pad = 0x0 (4 bytes)
  //        key: ptr[in, const[0, const]] {
  //          const = 0x0 (4 bytes)
  //        }
  //        val: ptr[in, fd_bpf_prog] {
  //          fd_bpf_prog (resource)
  //        }
  //        flags: const = 0x0 (8 bytes)
  //      }
  //    }
  //    size: len = 0x20 (8 bytes)
  //  ]
  *(uint32_t*)0x200000000780 = r[0];
  *(uint64_t*)0x200000000788 = 0x2000000007c0;
  *(uint32_t*)0x2000000007c0 = 0;
  *(uint64_t*)0x200000000790 = 0x200000000800;
  *(uint32_t*)0x200000000800 = -1;
  *(uint64_t*)0x200000000798 = 0;
  res =
      syscall(__NR_bpf, /*cmd=*/2ul, /*arg=*/0x200000000780ul, /*size=*/0x20ul);
  if (res != -1)
    r[1] = *(uint32_t*)0x200000000780;
  //  bpf$PROG_LOAD arguments: [
  //    cmd: const = 0x5 (8 bytes)
  //    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32],
  //    bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
  //      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types,
  //      bpf_btf_id[opt], fd_bpf_prog[opt]] {
  //        type: bpf_prog_type = 0x11 (4 bytes)
  //        ninsn: bytesize8 = 0xd (4 bytes)
  //        insns: ptr[inout, array[ANYUNION]] {
  //          array[ANYUNION] {
  //            union ANYUNION {
  //              ANYBLOB: buffer: {18 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  //              00 85 00 00 00 23 00 00 00 18 11 00 00} (length 0x1c)
  //            }
  //            union ANYUNION {
  //              ANYRES32: ANYRES32 (resource)
  //            }
  //            union ANYUNION {
  //              ANYBLOB: buffer: {00 00 00 00 00 00 00 00 b7 08 00 00 00 00 00
  //              00 7b 8a f8 ff 00 00 00 00 bf a2 00 00 00 00 00 00 07 02 00 00
  //              f8 ff ff ff b7 03 00 00 08 00 00 00 b7 04 00 00 00 00 00 00 85
  //              00 00 00 03 00 00 00 95} (length 0x41)
  //            }
  //          }
  //        }
  //        license: ptr[in, buffer] {
  //          buffer: {47 50 4c 00} (length 0x4)
  //        }
  //        loglev: int32 = 0x0 (4 bytes)
  //        logsize: len = 0x0 (4 bytes)
  //        log: nil
  //        kern_version: bpf_kern_version = 0x0 (4 bytes)
  //        flags: bpf_prog_load_flags = 0x0 (4 bytes)
  //        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
  //        (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type:
  //        union bpf_prog_attach_types {
  //          fallback: bpf_attach_types = 0xf (4 bytes)
  //        }
  //        btf_fd: fd_btf (resource)
  //        func_info_rec_size: const = 0x0 (4 bytes)
  //        func_info: nil
  //        func_info_cnt: len = 0x0 (4 bytes)
  //        line_info_rec_size: const = 0x0 (4 bytes)
  //        line_info: nil
  //        line_info_cnt: len = 0x0 (4 bytes)
  //        attach_btf_id: bpf_btf_id (resource)
  //        attach_prog_fd: fd_bpf_prog (resource)
  //        core_relo_cnt: len = 0x0 (4 bytes)
  //        fd_array: nil
  //        core_relos: nil
  //        core_relo_rec_size: const = 0x0 (4 bytes)
  //        log_true_size: int32 = 0x0 (4 bytes)
  //        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_prog_token_fd_wrapper {
  //          void: buffer: {} (length 0x0)
  //        }
  //        pad: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_pad_wrapper {
  //          value: const = 0x0 (4 bytes)
  //        }
  //      }
  //    }
  //    size: len = 0x94 (8 bytes)
  //  ]
  //  returns fd_bpf_prog
  *(uint32_t*)0x200000000980 = 0x11;
  *(uint32_t*)0x200000000984 = 0xd;
  *(uint64_t*)0x200000000988 = 0x200000000a40;
  memcpy((void*)0x200000000a40,
         "\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x85"
         "\x00\x00\x00\x23\x00\x00\x00\x18\x11\x00\x00",
         28);
  *(uint32_t*)0x200000000a5c = r[1];
  memcpy((void*)0x200000000a60,
         "\x00\x00\x00\x00\x00\x00\x00\x00\xb7\x08\x00\x00\x00\x00\x00\x00\x7b"
         "\x8a\xf8\xff\x00\x00\x00\x00\xbf\xa2\x00\x00\x00\x00\x00\x00\x07\x02"
         "\x00\x00\xf8\xff\xff\xff\xb7\x03\x00\x00\x08\x00\x00\x00\xb7\x04\x00"
         "\x00\x00\x00\x00\x00\x85\x00\x00\x00\x03\x00\x00\x00\x95",
         65);
  *(uint64_t*)0x200000000990 = 0x200000000ac0;
  memcpy((void*)0x200000000ac0, "GPL\000", 4);
  *(uint32_t*)0x200000000998 = 0;
  *(uint32_t*)0x20000000099c = 0;
  *(uint64_t*)0x2000000009a0 = 0;
  *(uint32_t*)0x2000000009a8 = 0;
  *(uint32_t*)0x2000000009ac = 0;
  memset((void*)0x2000000009b0, 0, 16);
  *(uint32_t*)0x2000000009c0 = 0;
  *(uint32_t*)0x2000000009c4 = 0xf;
  *(uint32_t*)0x2000000009c8 = -1;
  *(uint32_t*)0x2000000009cc = 0;
  *(uint64_t*)0x2000000009d0 = 0;
  *(uint32_t*)0x2000000009d8 = 0;
  *(uint32_t*)0x2000000009dc = 0;
  *(uint64_t*)0x2000000009e0 = 0;
  *(uint32_t*)0x2000000009e8 = 0;
  *(uint32_t*)0x2000000009ec = 0;
  *(uint32_t*)0x2000000009f0 = 0;
  *(uint32_t*)0x2000000009f4 = 0;
  *(uint64_t*)0x2000000009f8 = 0;
  *(uint64_t*)0x200000000a00 = 0;
  *(uint32_t*)0x200000000a08 = 0;
  *(uint32_t*)0x200000000a0c = 0;
  *(uint32_t*)0x200000000a10 = 0;
  syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000980ul, /*size=*/0x94ul);
  return 0;
}