// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#ifndef __NR_bpf
#define __NR_bpf 280
#endif
#ifndef __NR_mmap
#define __NR_mmap 222
#endif

static __thread int clone_ongoing;
static __thread int skip_segv;
static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
  if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
    exit(sig);
  }
  uintptr_t addr = (uintptr_t)info->si_addr;
  const uintptr_t prog_start = 1 << 20;
  const uintptr_t prog_end = 100 << 20;
  int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
  int valid = addr < prog_start || addr > prog_end;
  if (skip && valid) {
    _longjmp(segv_env, 1);
  }
  exit(sig);
}

static void install_segv_handler(void)
{
  struct sigaction sa;
  memset(&sa, 0, sizeof(sa));
  sa.sa_handler = SIG_IGN;
  syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
  syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
  memset(&sa, 0, sizeof(sa));
  sa.sa_sigaction = segv_handler;
  sa.sa_flags = SA_NODEFER | SA_SIGINFO;
  sigaction(SIGSEGV, &sa, NULL);
  sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...)                                                        \
  ({                                                                           \
    int ok = 1;                                                                \
    __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
    if (_setjmp(segv_env) == 0) {                                              \
      __VA_ARGS__;                                                             \
    } else                                                                     \
      ok = 0;                                                                  \
    __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
    ok;                                                                        \
  })

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void use_temporary_dir(void)
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    exit(1);
  if (chmod(tmpdir, 0777))
    exit(1);
  if (chdir(tmpdir))
    exit(1);
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
  int iter = 0;
  DIR* dp = 0;
retry:
  while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
  }
  dp = opendir(dir);
  if (dp == NULL) {
    if (errno == EMFILE) {
      exit(1);
    }
    exit(1);
  }
  struct dirent* ep = 0;
  while ((ep = readdir(dp))) {
    if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
      continue;
    char filename[FILENAME_MAX];
    snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
    while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
    }
    struct stat st;
    if (lstat(filename, &st))
      exit(1);
    if (S_ISDIR(st.st_mode)) {
      remove_dir(filename);
      continue;
    }
    int i;
    for (i = 0;; i++) {
      if (unlink(filename) == 0)
        break;
      if (errno == EPERM) {
        int fd = open(filename, O_RDONLY);
        if (fd != -1) {
          long flags = 0;
          if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
          }
          close(fd);
          continue;
        }
      }
      if (errno == EROFS) {
        break;
      }
      if (errno != EBUSY || i > 100)
        exit(1);
      if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW))
        exit(1);
    }
  }
  closedir(dp);
  for (int i = 0;; i++) {
    if (rmdir(dir) == 0)
      break;
    if (i < 100) {
      if (errno == EPERM) {
        int fd = open(dir, O_RDONLY);
        if (fd != -1) {
          long flags = 0;
          if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
          }
          close(fd);
          continue;
        }
      }
      if (errno == EROFS) {
        break;
      }
      if (errno == EBUSY) {
        if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW))
          exit(1);
        continue;
      }
      if (errno == ENOTEMPTY) {
        if (iter < 100) {
          iter++;
          goto retry;
        }
      }
    }
    exit(1);
  }
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
  if (symlink("/dev/binderfs", "./binderfs")) {
  }
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    char cwdbuf[32];
    sprintf(cwdbuf, "./%d", iter);
    if (mkdir(cwdbuf, 0777))
      exit(1);
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      if (chdir(cwdbuf))
        exit(1);
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
    remove_dir(cwdbuf);
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  NONFAILING(*(uint32_t*)0x20000200 = 0xc);
  NONFAILING(*(uint32_t*)0x20000204 = 0xe);
  NONFAILING(*(uint64_t*)0x20000208 = 0x20000540);
  NONFAILING(memcpy(
      (void*)0x20000540,
      "\xb7\x02\x00\x00\x03\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07\x03"
      "\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\xf8\xff\xff\xff\x79\xa4\xf0\xff"
      "\x00\x00\x00\x00\xb7\x06\x00\x00\xff\xff\xff\xff\x2d\x64\x05\x00\x00\x00"
      "\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00\x01\x00\x7d\x60"
      "\xb7\x03\x00\x00\x00\x00\x00\x00\x6a\x0a\x00\xfe\x00\x00\x00\xf3\x85\x00"
      "\x00\x00\x0d\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00"
      "\x00\x00\x00\x00\x49\x6c\xf2\x82\x7f\xa4\x3a\x43\x1c\xa7\x11\xfc\xd0\xcd"
      "\xfa\x14\x6e\xc5\x61\x8e\x03\x79\x58\xe2\x71\xf6\x0d\x25\xb7\x97\x7f\x02"
      "\x00\x8b\x5e\x5a\x07\x6d\x83\x92\x3d\xd2\x9c\x03\x40\x55\xb6\x7d\xaf\xe6"
      "\xc8\xdc\x3d\x5d\x78\xbd\x7f\x34\xe4\xd5\xb3\x1a\xe2\xec\x0e\xfd\x49\x89"
      "\x7a\x74\xa0\x09\x1f\xf1\x10\x02\x6e\x6d\x2e\xfe\x31\xab\x7e\xa0\xc3\x4f"
      "\x17\xe3\xad\x6e\xf3\xbb\x78\x20\x03\xb5\x38\xdf\xd8\xe0\x12\xe7\x95\x78"
      "\xe5\x1b\xc5\x30\x99\xe9\x0f\x45\x80\xd7\x60\x55\x1b\x5b\x34\x1a\x2d\x7c"
      "\xbd\xb9\xcd\x38\xbd\xb2\xca\x8e\xeb\x9c\x15\xab\x3a\x14\x81\x7a\xc6\x1e"
      "\x4d\xd1\x11\x83\xa1\x34\x77\xbf\x7e\x06\x0e\x36\x70\xef\x0e\x78\x9f\x65"
      "\xf1\x32\x8d\x67\x04\x91\x2c\xbe\x7b\xc0\x4b\x82\xd2\x78\x9c\xb1\x32\xb8"
      "\x66\x7c\x21\x47\x66\x19\xf2\x8d\x99\x61\xb6\x3e\x1a\x9c\xf6\xc2\xa6\x60"
      "\xa1\x7e\x3c\xf5\x4a\x75\x1c\x51\x16\xcf\xed\xb7\xec\xe5\xa5\x2b\x0f\xbc"
      "\xbb\xf3\x5b\x1e\xd7\x77\x14\x8b\xa5\x32\xe6\xea\x09\xc3\x46\xdf\x08\xb3"
      "\x28\x08\xb8\x02\x00\x00\x00\x00\x00\x00\x00\x33\x4d\x83\x23\x9d\xd2\x70"
      "\x80\xe7\x11\x32\x7e\xf0\x1f\xb6\xc8\x6a\xda\xc1\x22\x33\xfa\xa1\x3e\xab"
      "\x30\x22\xd4\xa5\xbb\xfb\x9c\x2a\xec\x61\xce\x66\xa3\x8d\x2f\xd5\x01\x17"
      "\xb8\x9a\x9a\xb3\x59\xb4\xee\xa0\xc6\xe9\xc1\x8c\x46\xa0\x32\xf0\x2d\xa7"
      "\x83\xc2\x34\xaf\x4d\x6a\x32\x57\x67\xd4\x2b\x4e\x54\xfe\xc3\x74\x86\x1d"
      "\x02\x27\xdb\x64\x36\x30\x37\x67\xd2\xe2\x4f\x29\xe5\xda\xd9\x79\xc3\x28"
      "\x73\xcd\xc6\x4b\x4d\xf8\xab\xc1\x8c\xae\x2e\xd4\xb4\x39\x0a\xf9\xa9\xce"
      "\xaf\xd0\x7f\xd0\x0b\x00\x00\x2b\x71\x3f\xc8\x76\x95\xbc\x3e\x00\x2c\xab"
      "\x15\x4a\xd0\x29\xa1\x19\xca\x3c\x97\x27\x80\x87\x00\x14\x60\xaf\x81\xc5"
      "\xf4\xad\xad\xdd\x14\x10\xe8\x02\x07\xc1\x41\x40\xc4\x27\xdc\x16\xe8\xb0"
      "\x0d\x5e\xe4\xe5\xe3\xae\x70\x3f\x8e\xa4\xc3\xda\xb4\x5f\x91\x21\x91\xf9"
      "\xdf\x3d\x7c\x0c\xf0\xea\x4f\x31\xd4\x62\xd3\xd6\xe1\xd0\x9f\x04\x79\x2f"
      "\x3a\x57\xa6\x3c\x1d\x76\x76\xe0\x7e\x14\x85\xb9\xc9\xfb\x55\x01\x08\x40"
      "\x33\x1c\x98\x25\xf9\x38\x6c\xb5\xc8\xf7\xe4\x93\x48\xd2\x7d\x91\x5b\x8e"
      "\x93\x49\xb1\x7f\x7a\xab\x0d\x75\x69\x0d\x78\xd5\xf1\x48\x05\xe1\x27\xca"
      "\x2a\xa3\xbe\xaa\x07\x3a\x77\x12\x7f\xbe\x38\x93\x24\x00\x1a\xaa\xe7\xef"
      "\xad\x93\xaa\x48\xd3\x3a\x01\xe4\x1f\xb3\x17\x22\x73\x69\x05\x59\x77\x41"
      "\xe8\xfb\x75\x22\x22\xb6\xfb\x0d\x8e\x62\x22\xa1\x0f\xd7\xbf\xa6\x41\x63"
      "\x5e\x80\x77\xe7\x1d\xb2\x99\x39\x65\x91\xfb\x81\x97\xe4\xe8\x4a\xa1\x8a"
      "\x54\xd1\xef\x8e\xe1\x84\x49\xa2\xdb\xf3\xc7\x78\xe8\x6c\xc7\x43\x07\x26"
      "\x72\x06\xab\xb8\x01\x42\x6c\x3e\x95\x6d\x42\x01\x4a\x0b\xd5\x18\x15\xe1"
      "\x7b\x48\x9d\xe1\x46\x1f\x3d\x79\xb8\x7c\x3a\xc7\x74\xf9\xbb\x79\xd8\x8a"
      "\x08\x9c\xdd\xf2\x15\x50\x73\x00\x00\x00\x00\x00\x00\x00\x3d\xd3\x80\xa1"
      "\xaf\x24\x86\xd6\xcc\xf4\x91\x8a\x47\x31\x2c\x80\x6d\x02\x23\xf4\x58\x6f"
      "\x29\xb0\xd0\x12\x62\x0a\x7f\x84\x7d\xaa\x3a\x0e\xeb\xea\x81\x2c\x70\xa0"
      "\xa1\x11\x1a\x62\xef\x04\x72\x36\x49\xa4\x0e\x13\x4a\x2d\x53\x5e\x45\x0d"
      "\x36\xee\x32\x1e\x02\xc6\xc1\xd5\x51\x1c\x35\xf6\x65\x2b\xae\x1b\x35\x12"
      "\xac\x48\xc8\x47\x99\x66\xca\x33\x48\x6d\x34\x02\x41\xd9\x6d\x85\x84\x58"
      "\xf8\xfe\x20\xa6\xf3\x26\x3b\x4b\x1f\x96\xf0\x8a\xa3\xb4\xc9\x2f\xa4\xfa"
      "\x9f\x05\x69\xc0\xec\x83\x95\xf9\x51\x87\xe7\x2a\x9e\x70\x03\x52\xa3\xd4"
      "\x80\xff\xef\x3e\xb5\xbe\xb7\xae\xc0\xb0\x9f\x45\xb2\xf0\xac\x6b\x49\x4a"
      "\x82\x2e\x00\x96\xdc\x6e\xe9\x96\xb7\xf6\x6e\xaa\x09\x22\x00\x4b\xbc\x86"
      "\x52\x14\xa3\xe9\x21\x40\x8d\x6b\x3f\x6d\x00\x0a\xa7\xaa\x57\x29\xac\x90"
      "\x98\xe2\x8d\x73\x3b\x93\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x69\x22\x2f\xda\xaa\x49\xc8\x4a\xe8"
      "\xa0\x8d\x60\x39\x92\x10\xf3\x1d\x2a\xcd\x89\xb9\xe1\xa7\x23\xfd\x23\x1f"
      "\x6f\x9e\x57\x32\x73\xd3\x2b\x33\xd7\xe6\x0f\x4d\x7b\x9e\x87\x4e\x5c\x19"
      "\xc4\x4a\xc9\xb3\x54\xdb\xc0\xf3\xfe\xe1\xd4\xae\xb5\x67\x23\xda\x28\x9d"
      "\xa8\x9c\xc3\x25\xb6\xb9\x12\x56\x24\xa3\x48\xb2\xcc\xdf\x6f\x81\xb9\x4b"
      "\xa3\x1a\x03\x07\x09\x83\xc8\x57\xfa\xa5\xc5\x85\xce\x80\xa9\xed\x52\xdb"
      "\x65\x8e\xe7\xab\x80\x9c\xd7\x72\x2f\x77\x87\xfd\x46\x0d\x28\x33\x3b\x89"
      "\x5f\x11\x3e\xec\x4e\xf8\x4f\xad\x96\xb8\x07\x44\xc2\xb8\xdc\x29\xf9\xbb"
      "\x88\x6e\x62\xb0\x5e\xf0\x98\x3f\x6a\x2f\x6b\x6b\x05\x00\x22\xe1\xad\x40"
      "\xfe\xe9\x2e\x9b\x7b\x4a\x13\x58\xc7\x68\xbd\x21\xd9\x84\xdf\x66\x12\xf3"
      "\x1b\x17\x82\x90\x97\xda\xd5\x28\x72\x24\xe1\x8f\x54\xde\xa8\xf6\x49\x02"
      "\xd3\x6d\x17\xf4\xb8\x3b\x5b\x71\xbc\xca\x94\xe8\x80\xa6\x44\xb1\x0b\x74"
      "\xec\x47\x2e\xfc\xaf\xb5\xe4\xe9\x94\xa4\x54\x53\x4d\x54\x98\xc1\x2e\x19"
      "\x60\x3a\xbb\xca\x21\x27\xa0\x00\xb8\xce\xb2\x49\x12\x1c\x0a\x7e\x28\x57"
      "\x32\xed\x1d\x41\x6a\x6d\xeb\x79\x38\x41\x9a\xb6\xd9\xc2\xa5\xcb\xa3\xf8"
      "\xe2\x77\xc5\x48\xab\x83\x3f\x07\xd3\xe2\xc6\x33\xd1\xa2\x32\xfb\x88\x31"
      "\xd1\x17\xc3\xcc\x5d\x4f\xa7\xbb\x28\x00\x7c\xe3\x1c\x3d\x5f\xa7\xb9\x33"
      "\x7f\x89\x73\x4d\xd4\x35\x91\xe9\x8a\x5d\x43\xf3\xdd\x75\x9c\xab\xfd\xb8"
      "\x8e\xf3\xf4\x4b\xc6\xed\xdc\x1e\x9f\x9e\x36\x76\x3b\x05\xa6\x4d\x0c\x62"
      "\xe8\x58\x0e\x26\x76\xe0\x52\x57\x28\x07\x20\xf6\x43\xe5\xd4\x63\x3c\x8a"
      "\x9a\x10\x69\xc9\x75\xca\x06\x86\x00\x16\x52\xb0\x86\xef\xc7\xd7\x69\xfe"
      "\xa1\x9a\x33\xb6\x12\xe1\x76\x60\x7f\x39\xe9\xae\xba\x01\x00\x00\x00\xf8"
      "\x5a\xf2\x34\x99\x19\x21\x66\x94\x6e\x61\x41\x4c\xfb\xdd\x31\x8f\x46\xa1"
      "\xcc\x9e\x90\x56\x30\x25\x1a\x31\x89\x0e\xf4\xfc\xbd\x39\x36\xfd\x02\x99"
      "\x87\x5f\x2a\x4c\xe0\xc8\xa1\x59\x64\x31\xa4\x46\x7b\x5f\x3d\xcb\xe1\x05"
      "\x3c\x70\x30\xeb\xed\xd4\x40\xd5\x05\x9a\x5e\x9a\xa1\x6e\x32\x91\x43\xeb"
      "\xe3\xc8\x1c\x82\xcc\x09\xb6\xa8\x78\xc6\x03\x98\x05\xa8\x6a\x9a\xf8\x37"
      "\x29\x89\x52\x86\x32\xe7\x4f\x9f\xf1\x58\x83\xee\x4a\x60\xd4\x39\xa5\x88"
      "\x27\x7f\x62\x56\x1b\x1b\xfa\x40\xf0\x48\x2e\x81\x86\x25\xf3\xeb\x75\x92"
      "\x87\xd5\xa7\x75\xd7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5b\xa6\xee\x79"
      "\x31\x97\x93\xa6\xa1\x04\x00\x88\x58\x37\x2d\x52\xe5\xaf\xdd\xb4\x0e\x30"
      "\x12\x9a\x4e\x59\xf4\x57\xcf\x4e\x57\x33\xe4\xc9\x6e\x7f\x4a\x13\x54\xc0"
      "\x43\xd4\x85\x86\xfe\x70\xcd\x8d\xcd\x6b\x57\x2f\xe1\x78\xeb\xfc\xcb\x15"
      "\xde\x20\x38\x24\x76\xf7\x9e\x94\xdb\xb8\x24\x9d\xf1\x96\x3c\x16\x44\x64"
      "\x57\xf9\x98\x59\xf7\xb7\x57\x93\xb4\x1f\x15\xcd\x3b\xa4\x42\x79\x75\xb2"
      "\xc6\xd9\x52\xf1\xf7\xc9\x13\xe6\x65\x79\x9f\x99\xa5\xe1\x21\x77\x18\x3c"
      "\xa1\x82\x1b\xbd\x3b\xdc\xc9\x39\x06\xf1\x29\x73\x76\x83\xae\x1e\x8c\xac"
      "\xe2\x75\x3a\xf2\x84\x9f\x59\x5b\x46\x34\xc6\xf1\x37\xa0\xfa\x2d\x25\xf4"
      "\x6a\xc9\x99\xc9\xbc\x31\x4f\x2b\xb9\xe8\xcd\xa2\x8d\x83\x12\xaf\xbc\x0b"
      "\xec\x68\x9f\xe5\x54\x44\xd1\x1f\x80\xf8\x99\xf5\x04\x36\xdc\xeb\x2b\x7c"
      "\x67\xc8\xfc\x88\xc7\xe9\x54\xb6\x18\x57\xd8\xc4\x52\x92\x2b\x95\x1b\x66"
      "\xc3\x83\x27\xa2\xfc\x19\xf1\xf8\x05\xfd\xda\x77\x43\xd4\xbf\xea\xa4\xe1"
      "\x20\x1f\x9e\x74\x36\xe9\x62\x17\x37\x72\x66\x8c\x8a\x68\x10\xb6\xb5\xf1"
      "\x2c\xe1\xf5\x9e\x52\xb9\xe4\xff\xe9\x63\x39\x9e\x51\x36\xf2\x37\x1e\x8a"
      "\xef\xcc\x78\x0d\xbb\xcd\xe8\xf3\xa1\x50\x4c\xfc\x2d\x83\xcd\x8f\xf6\xf1"
      "\xef\x54\x47\x0a\x7f\xb5\x0b\xe8\x90\xe5\x78\x79\x0e\x2b\x4b\x68\xde\x6e"
      "\xf8\xd8\x0e\xcb\x1e\xfc\x71\xf4\xa8\x45\x3f\xcb\xb2\xa0\x77\xda\x76\xef"
      "\xd1\x04\x5f\x48\x53\x16\x9c\x25\x63\x07\x1d\x61\xec\x7b\x87\x4c\x97\xc4"
      "\x54\xf5\x9e\x17\x36\xe3\x2e\x3a\xf8\xf5\x1e\x52\xb4\xca\xe5\xbc\xff\xfc"
      "\xeb\xc3\x22\x75\xe7\x64\x99\x6e\x05\x26\x4d\x6c\xab\x07\x1b\x67\xa4\x65"
      "\xdd\x9e\xa5\xa6\x5a\x7e\x40\xd6\xb5\x6b\x04\x56\x4d\x46\x12\x66\x0e\x78"
      "\x6e\x3f\x3e\xa9\x69\x2d\xe7\x49\xfa\x24\xe7\x12\x9d\x1b\xd8\xbe\xcf\x5e"
      "\x4f\x92\x56\x51\x00\xc8\x88\xde\x73\x89\x68\x4e\x23\xf0\x3a\xc5\x7e\xcf"
      "\xec\x4a\xa1\xe9\x13\x2c\xd1\x9d\x30\x1e\x5e\x5d\x06\xb9\xf8\x2b\x62\xff"
      "\x11\xab\xd9\xf7\x58\xa2\xb9\xdb\xe2\x27\xa0\x2e\xbe\x9c\xf7\x1c\xc3\xde"
      "\x3e\xf1\x3f\xe1\x60\x14\x9a\x9d\x36\x74\x41\xf0\xe3\x4b\x95\x7b\xae\x29"
      "\x3c\x3c\x75\xa3\xd4\x85\x10\x9d\xab\xe8\xe5\xcc\x1c\x04\xc8\xf2\xcd\xc2"
      "\xd4\xe0\xf2\x3d\x07\xd2\x76\x58\xc9\x42\xd7\x31\x7f\x37\xa9\x3f\x65\x3e"
      "\x28\xc0\xf6\x0e\x62\xe6\x1b\x60\x31\xf8\x9f\xd6\x36\x23\xad\x68\xd8\x86"
      "\xd3\xe8\x77\x0a\x45\x9d\x45\xdf\xe3\xb2\xa2\x8c\xe9\xeb\xf4\xc9\x1d\x5b"
      "\x77\x2e\xed\x43\xee\x0b\xc9\x0b\x2f\xbb\x91\x4d\x0c\x8d\xb2\x91\xed\x3e"
      "\x6a\xef\xc5\xcb\xfe\x22\x45\x7d\x0b\x11\x91\x2c\x99\xf3\x6d\x3c\x9b\xca"
      "\x65\x81\x3d",
      2073));
  NONFAILING(*(uint64_t*)0x20000210 = 0x20000340);
  NONFAILING(memcpy((void*)0x20000340, "syzkaller\000", 10));
  NONFAILING(*(uint32_t*)0x20000218 = 0);
  NONFAILING(*(uint32_t*)0x2000021c = 0);
  NONFAILING(*(uint64_t*)0x20000220 = 0);
  NONFAILING(*(uint32_t*)0x20000228 = 0);
  NONFAILING(*(uint32_t*)0x2000022c = 0);
  NONFAILING(memset((void*)0x20000230, 0, 16));
  NONFAILING(*(uint32_t*)0x20000240 = 0);
  NONFAILING(*(uint32_t*)0x20000244 = 0);
  NONFAILING(*(uint32_t*)0x20000248 = -1);
  NONFAILING(*(uint32_t*)0x2000024c = 8);
  NONFAILING(*(uint64_t*)0x20000250 = 0x20000000);
  NONFAILING(*(uint32_t*)0x20000000 = 0);
  NONFAILING(*(uint32_t*)0x20000004 = 0);
  NONFAILING(*(uint32_t*)0x20000258 = 0);
  NONFAILING(*(uint32_t*)0x2000025c = 0x10);
  NONFAILING(*(uint64_t*)0x20000260 = 0x20000000);
  NONFAILING(*(uint32_t*)0x20000000 = 0);
  NONFAILING(*(uint32_t*)0x20000004 = 0);
  NONFAILING(*(uint32_t*)0x20000008 = 0);
  NONFAILING(*(uint32_t*)0x2000000c = 0);
  NONFAILING(*(uint32_t*)0x20000268 = 0);
  NONFAILING(*(uint32_t*)0x2000026c = 0);
  NONFAILING(*(uint32_t*)0x20000270 = -1);
  NONFAILING(*(uint32_t*)0x20000274 = 0);
  NONFAILING(*(uint64_t*)0x20000278 = 0);
  res = syscall(__NR_bpf, 5ul, 0x20000200ul, 0x48ul);
  if (res != -1)
    r[0] = res;
  NONFAILING(*(uint32_t*)0x20000080 = r[0]);
  NONFAILING(*(uint32_t*)0x20000084 = 0x2a0);
  NONFAILING(*(uint32_t*)0x20000088 = 0xf);
  NONFAILING(*(uint32_t*)0x2000008c = 0);
  NONFAILING(*(uint64_t*)0x20000090 = 0x20000500);
  NONFAILING(memcpy(
      (void*)0x20000500,
      "\xb9\xff\x03\x10\x60\x0d\x69\x8c\xb8\x9e\x14\xf0\x08\x00\x1f", 15));
  NONFAILING(*(uint64_t*)0x20000098 = 0);
  NONFAILING(*(uint32_t*)0x200000a0 = 0);
  NONFAILING(*(uint32_t*)0x200000a4 = 0x60000000);
  NONFAILING(*(uint32_t*)0x200000a8 = 0);
  NONFAILING(*(uint32_t*)0x200000ac = 0);
  NONFAILING(*(uint64_t*)0x200000b0 = 0);
  NONFAILING(*(uint64_t*)0x200000b8 = 0);
  NONFAILING(*(uint32_t*)0x200000c0 = 0);
  NONFAILING(*(uint32_t*)0x200000c4 = 0);
  syscall(__NR_bpf, 0xaul, 0x20000080ul, 0x48ul);
}
int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  install_segv_handler();
  use_temporary_dir();
  loop();
  return 0;
}