// https://syzkaller.appspot.com/bug?id=d5346cf7f8dfa39e8f25b5b085dfec6cf6bb288e
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <sys/time.h>
#include <sched.h>
#include <sys/wait.h>
#include <pthread.h>
#include <errno.h>

#ifndef MAP_FIXED_NOREPLACE
#define MAP_FIXED_NOREPLACE 0x100000
#endif

void set_rt_priority() {
    struct sched_param param;
    param.sched_priority = sched_get_priority_max(SCHED_FIFO);
    int res = sched_setscheduler(0, SCHED_FIFO, &param);
    if (res < 0) {
        printf("[-] Failed to sched_setscheduler: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] sched_setscheduler successful.\n");
}

void pin_to_cpu(int cpu) {
    cpu_set_t set;
    CPU_ZERO(&set);
    CPU_SET(cpu, &set);
    int res = sched_setaffinity(0, sizeof(set), &set);
    if (res < 0) {
        printf("[-] Failed to sched_setaffinity: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] sched_setaffinity successful.\n");
}

void *netns_thread(void *arg) {
    while (1) {
        int pid = fork();
        if (pid < 0) {
            printf("[-] Failed to fork: %s\n", strerror(errno));
            sleep(1);
            continue;
        }
        if (pid == 0) {
            int res = unshare(CLONE_NEWNET);
            if (res < 0) {
                exit(1);
            }
            exit(0);
        } else {
            waitpid(pid, NULL, 0);
        }
    }
    return NULL;
}

void run_worker(int cpu) {
    pin_to_cpu(cpu);
    set_rt_priority();
    
    char filename[256];
    sprintf(filename, "testfile_%d", cpu);
    
    int fd = open(filename, O_RDWR | O_CREAT | O_TRUNC, 0666);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", filename, strerror(errno));
        exit(1);
    }
    printf("[+] open %s successful.\n", filename);
    
    int res = ftruncate(fd, 0x600000);
    if (res < 0) {
        printf("[-] Failed to ftruncate: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] ftruncate successful.\n");
    
    void *addr = (void *)(0x1b2e964000ULL + cpu * 0x1000000ULL);
    size_t len = 0x5c0000;
    
    while (1) {
        struct timespec times[2];
        times[0].tv_sec = 0;
        times[0].tv_nsec = 0;
        times[1].tv_sec = 0;
        times[1].tv_nsec = UTIME_OMIT;
        res = futimens(fd, times);
        if (res < 0) {
            printf("[-] Failed to futimens: %s\n", strerror(errno));
            exit(1);
        }
        
        void *p = mmap(addr, len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED_NOREPLACE, fd, 0x40000);
        if (p != MAP_FAILED) {
            munmap(p, len);
        }
    }
    exit(0);
}

int main() {
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);
    
    int fd_sys = open("/proc/sys/kernel/hung_task_timeout_secs", O_WRONLY);
    if (fd_sys < 0) {
        printf("[-] Failed to open hung_task_timeout_secs: %s\n", strerror(errno));
        // Do not exit here, as /proc/sys might be read-only in some test environments,
        // but we still want to attempt to trigger the bug.
    } else {
        int res = write(fd_sys, "15\n", 3);
        if (res < 0) {
            printf("[-] Failed to write hung_task_timeout_secs: %s\n", strerror(errno));
        } else {
            printf("[+] write hung_task_timeout_secs successful.\n");
        }
        close(fd_sys);
    }

    printf("[+] Starting netns threads...\n");
    for (int i = 0; i < 4; i++) {
        pthread_t t;
        int res = pthread_create(&t, NULL, netns_thread, NULL);
        if (res != 0) {
            printf("[-] Failed to pthread_create: %s\n", strerror(res));
            exit(1);
        }
    }
    printf("[+] pthread_create successful.\n");

    sleep(2);

    printf("[+] Starting mmap worker on CPU 0...\n");
    pid_t worker_pid = fork();
    if (worker_pid < 0) {
        printf("[-] Failed to fork worker: %s\n", strerror(errno));
        exit(1);
    }
    if (worker_pid == 0) {
        run_worker(0);
    }
    printf("[+] fork worker successful.\n");

    while (1) {
        sleep(10);
    }

    return 0;
}