// https://syzkaller.appspot.com/bug?id=6e7a938b13746549c797108d904ac2c46375fbbd
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/capability.h>

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

#define MAX_FDS 30

static void setup_gadgetfs();
static void setup_binderfs();
static void setup_fusectl();
static void sandbox_common_mount_tmpfs(void)
{
  write_file("/proc/sys/fs/mount-max", "100000");
  if (mkdir("./syz-tmp", 0777))
    exit(1);
  if (mount("", "./syz-tmp", "tmpfs", 0, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot", 0777))
    exit(1);
  if (mkdir("./syz-tmp/newroot/dev", 0700))
    exit(1);
  unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE;
  if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot/proc", 0700))
    exit(1);
  if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot/selinux", 0700))
    exit(1);
  const char* selinux_path = "./syz-tmp/newroot/selinux";
  if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) {
    if (errno != ENOENT)
      exit(1);
    if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) &&
        errno != ENOENT)
      exit(1);
  }
  if (mkdir("./syz-tmp/newroot/sys", 0700))
    exit(1);
  if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL))
    exit(1);
  if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL,
            bind_mount_flags, NULL) &&
      errno != ENOENT)
    exit(1);
  if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL,
            bind_mount_flags, NULL) &&
      errno != ENOENT)
    exit(1);
  if (mount("/proc/sys/fs/binfmt_misc",
            "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags,
            NULL) &&
      errno != ENOENT)
    exit(1);
  if (mkdir("./syz-tmp/newroot/syz-inputs", 0700))
    exit(1);
  if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL,
            bind_mount_flags | MS_RDONLY, NULL) &&
      errno != ENOENT)
    exit(1);
  if (mkdir("./syz-tmp/pivot", 0777))
    exit(1);
  if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) {
    if (chdir("./syz-tmp"))
      exit(1);
  } else {
    if (chdir("/"))
      exit(1);
    if (umount2("./pivot", MNT_DETACH))
      exit(1);
  }
  if (chroot("./newroot"))
    exit(1);
  if (chdir("/"))
    exit(1);
  setup_gadgetfs();
  setup_binderfs();
  setup_fusectl();
}

static void setup_gadgetfs()
{
  if (mkdir("/dev/gadgetfs", 0777)) {
  }
  if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) {
  }
}

static void setup_fusectl()
{
  if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
  }
}

static void setup_binderfs()
{
  if (mkdir("/dev/binderfs", 0777)) {
  }
  if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
  }
  if (symlink("/dev/binderfs", "./binderfs")) {
  }
}

static void loop();

static void sandbox_common()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  if (getppid() == 1)
    exit(1);
  struct rlimit rlim;
  rlim.rlim_cur = rlim.rlim_max = (200 << 20);
  setrlimit(RLIMIT_AS, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 32 << 20;
  setrlimit(RLIMIT_MEMLOCK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 136 << 20;
  setrlimit(RLIMIT_FSIZE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
  setrlimit(RLIMIT_STACK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 128 << 20;
  setrlimit(RLIMIT_CORE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 256;
  setrlimit(RLIMIT_NOFILE, &rlim);
  if (unshare(CLONE_NEWNS)) {
  }
  if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
  }
  if (unshare(CLONE_NEWIPC)) {
  }
  if (unshare(0x02000000)) {
  }
  if (unshare(CLONE_NEWUTS)) {
  }
  if (unshare(CLONE_SYSVSEM)) {
  }
  typedef struct {
    const char* name;
    const char* value;
  } sysctl_t;
  static const sysctl_t sysctls[] = {
      {"/proc/sys/kernel/shmmax", "16777216"},
      {"/proc/sys/kernel/shmall", "536870912"},
      {"/proc/sys/kernel/shmmni", "1024"},
      {"/proc/sys/kernel/msgmax", "8192"},
      {"/proc/sys/kernel/msgmni", "1024"},
      {"/proc/sys/kernel/msgmnb", "1024"},
      {"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
  };
  unsigned i;
  for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
    write_file(sysctls[i].name, sysctls[i].value);
}

static int wait_for_loop(int pid)
{
  if (pid < 0)
    exit(1);
  int status = 0;
  while (waitpid(-1, &status, __WALL) != pid) {
  }
  return WEXITSTATUS(status);
}

static void drop_caps(void)
{
  struct __user_cap_header_struct cap_hdr = {};
  struct __user_cap_data_struct cap_data[2] = {};
  cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
  cap_hdr.pid = getpid();
  if (syscall(SYS_capget, &cap_hdr, &cap_data))
    exit(1);
  const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
  cap_data[0].effective &= ~drop;
  cap_data[0].permitted &= ~drop;
  cap_data[0].inheritable &= ~drop;
  if (syscall(SYS_capset, &cap_hdr, &cap_data))
    exit(1);
}

static int do_sandbox_none(void)
{
  if (unshare(CLONE_NEWPID)) {
  }
  int pid = fork();
  if (pid != 0)
    return wait_for_loop(pid);
  sandbox_common();
  drop_caps();
  if (unshare(CLONE_NEWNET)) {
  }
  write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
  sandbox_common_mount_tmpfs();
  loop();
  exit(1);
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void close_fds()
{
  for (int fd = 3; fd < MAX_FDS; fd++)
    close(fd);
}

static void setup_sysctl()
{
  int cad_pid = fork();
  if (cad_pid < 0)
    exit(1);
  if (cad_pid == 0) {
    for (;;)
      sleep(100);
  }
  char tmppid[32];
  snprintf(tmppid, sizeof(tmppid), "%d", cad_pid);
  struct {
    const char* name;
    const char* data;
  } files[] = {
      {"/sys/kernel/debug/x86/nmi_longest_ns", "10000000000"},
      {"/proc/sys/kernel/hung_task_check_interval_secs", "20"},
      {"/proc/sys/net/core/bpf_jit_kallsyms", "1"},
      {"/proc/sys/net/core/bpf_jit_harden", "0"},
      {"/proc/sys/kernel/kptr_restrict", "0"},
      {"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"},
      {"/proc/sys/fs/mount-max", "100"},
      {"/proc/sys/vm/oom_dump_tasks", "0"},
      {"/proc/sys/debug/exception-trace", "0"},
      {"/proc/sys/kernel/printk", "7 4 1 3"},
      {"/proc/sys/kernel/keys/gc_delay", "1"},
      {"/proc/sys/vm/oom_kill_allocating_task", "1"},
      {"/sys/kernel/debug/failslab/task-filter", "Y"},
      {"/sys/kernel/debug/fail_page_alloc/task-filter", "Y"},
      {"/sys/kernel/debug/fail_futex/task-filter", "Y"},
      {"/sys/kernel/debug/fail_usercopy/task-filter", "Y"},
      {"/sys/kernel/debug/fail_make_request/task-filter", "Y"},
      {"/sys/kernel/debug/fail_io_timeout/task-filter", "Y"},
      {"/sys/kernel/debug/fail_iommufd/task-filter", "Y"},
      {"/proc/sys/kernel/ctrl-alt-del", "0"},
      {"/proc/sys/kernel/cad_pid", tmppid},
  };
  for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
    if (!write_file(files[i].name, files[i].data)) {
    }
  }
  kill(cad_pid, SIGKILL);
  while (waitpid(cad_pid, NULL, 0) != cad_pid)
    ;
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      close_fds();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  mkdirat arguments: [
  //    fd: fd_dir (resource)
  //    path: ptr[in, buffer] {
  //      buffer: {2e 2f 73 79 73 00} (length 0x6)
  //    }
  //    mode: open_mode = 0x1ff (8 bytes)
  //  ]
  memcpy((void*)0x200000000000, "./sys\000", 6);
  syscall(
      __NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000000ul,
      /*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/
      0x1fful);
  //  mount arguments: [
  //    src: nil
  //    dst: ptr[in, buffer] {
  //      buffer: {2e 2f 73 79 73 00} (length 0x6)
  //    }
  //    type: ptr[in, buffer] {
  //      buffer: {73 79 73 66 73 00} (length 0x6)
  //    }
  //    flags: mount_flags = 0x0 (8 bytes)
  //    data: nil
  //  ]
  memcpy((void*)0x200000000000, "./sys\000", 6);
  memcpy((void*)0x200000000040, "sysfs\000", 6);
  syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000000ul,
          /*type=*/0x200000000040ul, /*flags=*/0ul, /*data=*/0ul);
  //  creat arguments: [
  //    file: ptr[in, buffer] {
  //      buffer: {2e 2f 73 79 73 2f 62 75 73 2f 70 63 69 2f 64 65 76 69 63 65
  //      73 2f 30 30 30 30 3a 30 30 3a 30 33 2e 30 2f 63 6f 6e 66 69 67 00}
  //      (length 0x2a)
  //    }
  //    mode: open_mode = 0x60 (8 bytes)
  //  ]
  //  returns fd
  memcpy((void*)0x200000000100, "./sys/bus/pci/devices/0000:00:03.0/config\000",
         42);
  res = syscall(__NR_creat, /*file=*/0x200000000100ul,
                /*mode=S_IRGRP|S_IXUSR*/ 0x60ul);
  if (res != -1)
    r[0] = res;
  //  write$char_usb arguments: [
  //    fd: fd_char_usb (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {a4 70 91 a8 06 5d 33 1b 17 f6 fc 21 84 a1 0d 25 f7 24 60 17
  //      fe 9f b7 8d e1 68 55 67 4c 57 3b 8b 95 44 ea 26 ba c6 e5 1c a3 41 15
  //      3a e2 ae 2f 19 e0 8a 6d 71 91 7e ac 17 89 33 61 b5 9d 2a ca 5d d9 e4
  //      47 7a 85 3b ab 0c 46 94 3c fb 56 0c ac cf 6f 7c 5d 18 0b 08 49 89 0f
  //      f3 37 64 57 b7 ae ba 12 de ea bc e7 c1 c2 fc bd f6 a4 41 60 63 b8 0b
  //      6c cb e9 22 5f d2 42 f1 cc 61 cb 92 ac 5b 8b 28 a2 9c be c6 09 62 ad
  //      7e 27 35 aa c6 35 d6 e5 5e 51 d0 23 7d b1 8e 47 99 3d 89 a7 0f d8 07
  //      33 05 9a d6 25 70 04 44 49 61 8c 79 79 68 a9 cf 2e c0 24 ae 3c e0 7e
  //      b7 7f 87 09 4a aa 1f bc 87 dc 6e ea 5a b0 95 dc 81 fa 70 de 81 ac 3b
  //      7e 9b a8 fb f9 db 9d 05 80 70 0f 5c a3 cc f9 0f 59 b4 9b f0 69 57 85
  //      ab 72 12 1d 44 8d ac b0 4d 46 05 6b 24 2c 9f 63 92 40 7e 7a 37 cf 3a
  //      67 39 0a a2 9f c2 fb f4 0d 22 67 df f2 6b 87 62 5e 4d 2f e4 35 b6 14
  //      5d 3a 0b da f4 90 40 d9 45 60 28 b5 7b 25 ff af 7b 7f 35 cd 9a df a4
  //      97 47 ee f6 85 af fd 25 a0 e7 11 46 17 4b 08 bc d2 21 0c e0 b3 cc 5a
  //      63 85 31 1a 2c ea 86 46 e8 6a d2 cf 64 e1 d3 92 68 22 df 09 28 2a 6a
  //      96 50 f8 ca 62 97 9c 77 30 33 85 53 2a 83 28 46 82 bf 2a e8 8a 72 a3
  //      de 41 d7 e4 53 e0 9a 7d 53 9b 90 b7 74 21 e1 c1 0a c2 cb 1f 30 5e 06
  //      2a d7 d5 9e 9c 68 74 57 a8 44 5e 5c 3b fd c8 e8 66 16 21 5c 3c fb 32
  //      ed de b2 4d 27 1e 9a 8a f2 77 fd 34 b2 a7 73 10 e3 8f 6c 89 60 73 1c
  //      79 05 69 b0 b9 00 7b 53 06 20 28 67 76 d7 d7 0a 4c 8a fe 70 22 97 28
  //      c9 9a ba 02 71 fd 2b 00 87} (length 0x1d2)
  //    }
  //    count: len = 0x1d2 (8 bytes)
  //  ]
  memcpy(
      (void*)0x200000000d40,
      "\xa4\x70\x91\xa8\x06\x5d\x33\x1b\x17\xf6\xfc\x21\x84\xa1\x0d\x25\xf7\x24"
      "\x60\x17\xfe\x9f\xb7\x8d\xe1\x68\x55\x67\x4c\x57\x3b\x8b\x95\x44\xea\x26"
      "\xba\xc6\xe5\x1c\xa3\x41\x15\x3a\xe2\xae\x2f\x19\xe0\x8a\x6d\x71\x91\x7e"
      "\xac\x17\x89\x33\x61\xb5\x9d\x2a\xca\x5d\xd9\xe4\x47\x7a\x85\x3b\xab\x0c"
      "\x46\x94\x3c\xfb\x56\x0c\xac\xcf\x6f\x7c\x5d\x18\x0b\x08\x49\x89\x0f\xf3"
      "\x37\x64\x57\xb7\xae\xba\x12\xde\xea\xbc\xe7\xc1\xc2\xfc\xbd\xf6\xa4\x41"
      "\x60\x63\xb8\x0b\x6c\xcb\xe9\x22\x5f\xd2\x42\xf1\xcc\x61\xcb\x92\xac\x5b"
      "\x8b\x28\xa2\x9c\xbe\xc6\x09\x62\xad\x7e\x27\x35\xaa\xc6\x35\xd6\xe5\x5e"
      "\x51\xd0\x23\x7d\xb1\x8e\x47\x99\x3d\x89\xa7\x0f\xd8\x07\x33\x05\x9a\xd6"
      "\x25\x70\x04\x44\x49\x61\x8c\x79\x79\x68\xa9\xcf\x2e\xc0\x24\xae\x3c\xe0"
      "\x7e\xb7\x7f\x87\x09\x4a\xaa\x1f\xbc\x87\xdc\x6e\xea\x5a\xb0\x95\xdc\x81"
      "\xfa\x70\xde\x81\xac\x3b\x7e\x9b\xa8\xfb\xf9\xdb\x9d\x05\x80\x70\x0f\x5c"
      "\xa3\xcc\xf9\x0f\x59\xb4\x9b\xf0\x69\x57\x85\xab\x72\x12\x1d\x44\x8d\xac"
      "\xb0\x4d\x46\x05\x6b\x24\x2c\x9f\x63\x92\x40\x7e\x7a\x37\xcf\x3a\x67\x39"
      "\x0a\xa2\x9f\xc2\xfb\xf4\x0d\x22\x67\xdf\xf2\x6b\x87\x62\x5e\x4d\x2f\xe4"
      "\x35\xb6\x14\x5d\x3a\x0b\xda\xf4\x90\x40\xd9\x45\x60\x28\xb5\x7b\x25\xff"
      "\xaf\x7b\x7f\x35\xcd\x9a\xdf\xa4\x97\x47\xee\xf6\x85\xaf\xfd\x25\xa0\xe7"
      "\x11\x46\x17\x4b\x08\xbc\xd2\x21\x0c\xe0\xb3\xcc\x5a\x63\x85\x31\x1a\x2c"
      "\xea\x86\x46\xe8\x6a\xd2\xcf\x64\xe1\xd3\x92\x68\x22\xdf\x09\x28\x2a\x6a"
      "\x96\x50\xf8\xca\x62\x97\x9c\x77\x30\x33\x85\x53\x2a\x83\x28\x46\x82\xbf"
      "\x2a\xe8\x8a\x72\xa3\xde\x41\xd7\xe4\x53\xe0\x9a\x7d\x53\x9b\x90\xb7\x74"
      "\x21\xe1\xc1\x0a\xc2\xcb\x1f\x30\x5e\x06\x2a\xd7\xd5\x9e\x9c\x68\x74\x57"
      "\xa8\x44\x5e\x5c\x3b\xfd\xc8\xe8\x66\x16\x21\x5c\x3c\xfb\x32\xed\xde\xb2"
      "\x4d\x27\x1e\x9a\x8a\xf2\x77\xfd\x34\xb2\xa7\x73\x10\xe3\x8f\x6c\x89\x60"
      "\x73\x1c\x79\x05\x69\xb0\xb9\x00\x7b\x53\x06\x20\x28\x67\x76\xd7\xd7\x0a"
      "\x4c\x8a\xfe\x70\x22\x97\x28\xc9\x9a\xba\x02\x71\xfd\x2b\x00\x87",
      466);
  syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000d40ul, /*count=*/0x1d2ul);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  setup_sysctl();
  const char* reason;
  (void)reason;
  do_sandbox_none();
  return 0;
}