// https://syzkaller.appspot.com/bug?id=98d63da605bed36b52e9bd6ec90ac7d3d062e715
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>
#include <errno.h>
#include <sys/mount.h>

static void write_file(const char *path, const char *val)
{
	int fd = open(path, O_WRONLY);
	if (fd >= 0) {
		if (write(fd, val, strlen(val)) < 0) {
			printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
		}
		close(fd);
	} else {
		printf("[-] Failed to open %s: %s\n", path, strerror(errno));
	}
}

int main(void)
{
	int fd = -1;
	char buf[4096] = {0};

	printf("[*] Starting reproducer...\n");

	mkdir("/sys/kernel/config", 0755);
	if (mount("none", "/sys/kernel/config", "configfs", 0, NULL) < 0) {
		if (errno != EBUSY) {
			printf("[-] Failed to mount configfs: %s\n", strerror(errno));
			return 1;
		}
	}
	printf("[+] configfs mounted.\n");

	if (mkdir("/sys/kernel/config/nullb/syzdev", 0755) < 0) {
		if (errno != EEXIST) {
			printf("[-] Failed to create nullb device directory: %s\n", strerror(errno));
			return 1;
		}
	}
	printf("[+] nullb device directory created.\n");

	write_file("/sys/kernel/config/nullb/syzdev/memory_backed", "1");
	write_file("/sys/kernel/config/nullb/syzdev/shared_tags", "1");
	write_file("/sys/kernel/config/nullb/syzdev/power", "1");

	printf("[+] nullb device configured and powered on.\n");

	/* Wait a moment for udev/devtmpfs to create the device node */
	for (int i = 0; i < 10; i++) {
		fd = open("/dev/syzdev", O_WRONLY);
		if (fd >= 0)
			break;
		usleep(100000);
	}

	if (fd >= 0) {
		printf("[+] Successfully opened /dev/syzdev.\n");
		if (write(fd, buf, sizeof(buf)) < 0) {
			printf("[-] write failed: %s\n", strerror(errno));
		} else {
			printf("[+] write successful.\n");
		}
		fsync(fd);
		close(fd);
	} else {
		printf("[-] Failed to open /dev/syzdev: %s\n", strerror(errno));
		return 1;
	}

	/* Cleanup */
	write_file("/sys/kernel/config/nullb/syzdev/power", "0");
	rmdir("/sys/kernel/config/nullb/syzdev");

	printf("[+] Reproducer finished.\n");
	return 0;
}