// https://syzkaller.appspot.com/bug?id=6ec8d97a8de2a9305ac03fba7f98d9e112bbdf21
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#ifndef __NR_bpf
#define __NR_bpf 280
#endif
#ifndef __NR_mmap
#define __NR_mmap 222
#endif
#ifndef __NR_sendto
#define __NR_sendto 206
#endif
#ifndef __NR_socketpair
#define __NR_socketpair 199
#endif

uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
                 0xffffffffffffffff};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  socketpair$unix arguments: [
  //    domain: const = 0x1 (8 bytes)
  //    type: unix_socket_type = 0x1 (8 bytes)
  //    proto: const = 0x0 (4 bytes)
  //    fds: ptr[out, unix_pair] {
  //      unix_pair {
  //        fd0: sock_unix (resource)
  //        fd1: sock_unix (resource)
  //      }
  //    }
  //  ]
  res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=SOCK_STREAM*/ 1ul,
                /*proto=*/0, /*fds=*/0x20000040ul);
  if (res != -1) {
    r[0] = *(uint32_t*)0x20000040;
    r[1] = *(uint32_t*)0x20000044;
  }
  //  bpf$MAP_CREATE arguments: [
  //    cmd: const = 0x0 (8 bytes)
  //    arg: ptr[in, bpf_map_create_arg] {
  //      union bpf_map_create_arg {
  //        base: bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32,
  //        int32, flags[map_flags, int32], const[0, int64]] {
  //          type: bpf_map_type = 0xf (4 bytes)
  //          ksize: int32 = 0x4 (4 bytes)
  //          vsize: int32 = 0x4 (4 bytes)
  //          max: int32 = 0x4 (4 bytes)
  //          flags: map_flags = 0x0 (4 bytes)
  //          inner: fd_bpf_map (resource)
  //          node: int32 = 0x0 (4 bytes)
  //          map_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  //          00} (length 0x10) map_ifindex: ifindex (resource) btf_fd: fd_btf
  //          (resource) btf_key_type_id: int32 = 0x0 (4 bytes)
  //          btf_value_type_id: int32 = 0x0 (4 bytes)
  //          btf_vmlinux_type_id: int32 = 0x0 (4 bytes)
  //          map_extra: const = 0x0 (8 bytes)
  //          value_type_btf_obj_fd: union
  //          _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32,
  //          int32, flags[map_flags, int32], const[0,
  //          int64]]_value_type_btf_obj_fd_wrapper {
  //            void: buffer: {} (length 0x0)
  //          }
  //          pad1: union _bpf_map_create_arg_t[flags[bpf_map_type, int32],
  //          int32, int32, int32, flags[map_flags, int32], const[0,
  //          int64]]_pad1_wrapper {
  //            value: const = 0x0 (4 bytes)
  //          }
  //          map_token_fd: union _bpf_map_create_arg_t[flags[bpf_map_type,
  //          int32], int32, int32, int32, flags[map_flags, int32], const[0,
  //          int64]]_map_token_fd_wrapper {
  //            void: buffer: {} (length 0x0)
  //          }
  //          pad2: union _bpf_map_create_arg_t[flags[bpf_map_type, int32],
  //          int32, int32, int32, flags[map_flags, int32], const[0,
  //          int64]]_pad2_wrapper {
  //            value: const = 0x0 (4 bytes)
  //          }
  //        }
  //      }
  //    }
  //    size: len = 0x48 (8 bytes)
  //  ]
  //  returns fd_bpf_map
  *(uint32_t*)0x20000100 = 0xf;
  *(uint32_t*)0x20000104 = 4;
  *(uint32_t*)0x20000108 = 4;
  *(uint32_t*)0x2000010c = 4;
  *(uint32_t*)0x20000110 = 0;
  *(uint32_t*)0x20000114 = 0;
  *(uint32_t*)0x20000118 = 0;
  memset((void*)0x2000011c, 0, 16);
  *(uint32_t*)0x2000012c = 0;
  *(uint32_t*)0x20000130 = 0;
  *(uint32_t*)0x20000134 = 0;
  *(uint32_t*)0x20000138 = 0;
  *(uint32_t*)0x2000013c = 0;
  *(uint64_t*)0x20000140 = 0;
  *(uint32_t*)0x20000148 = 0;
  *(uint32_t*)0x2000014c = 0;
  res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x20000100ul, /*size=*/0x48ul);
  if (res != -1)
    r[2] = res;
  //  bpf$PROG_LOAD arguments: [
  //    cmd: const = 0x5 (8 bytes)
  //    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32],
  //    bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
  //      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types,
  //      bpf_btf_id[opt], fd_bpf_prog[opt]] {
  //        type: bpf_prog_type = 0xe (4 bytes)
  //        ninsn: bytesize8 = 0x6 (4 bytes)
  //        insns: ptr[inout, array[ANYUNION]] {
  //          array[ANYUNION] {
  //            union ANYUNION {
  //              ANYBLOB: buffer: {b7 02 00 00 01 00 00 00 b7 03 00 00 00 00 00
  //              00 b7 04 00 00 00 00 00 00 85 00 00 00 32 00 00 00 b7 00 00 00
  //              01 00 00 00 95 00 00 00 00 00 00 00} (length 0x30)
  //            }
  //          }
  //        }
  //        license: ptr[in, buffer] {
  //          buffer: {47 50 4c 00} (length 0x4)
  //        }
  //        loglev: int32 = 0x0 (4 bytes)
  //        logsize: len = 0x0 (4 bytes)
  //        log: nil
  //        kern_version: bpf_kern_version = 0x0 (4 bytes)
  //        flags: bpf_prog_load_flags = 0x0 (4 bytes)
  //        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
  //        (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type:
  //        union bpf_prog_attach_types {
  //          sk_skb: sk_skb_attach_types = 0x5 (4 bytes)
  //        }
  //        btf_fd: fd_btf (resource)
  //        func_info_rec_size: const = 0x0 (4 bytes)
  //        func_info: nil
  //        func_info_cnt: len = 0x0 (4 bytes)
  //        line_info_rec_size: const = 0x0 (4 bytes)
  //        line_info: nil
  //        line_info_cnt: len = 0x0 (4 bytes)
  //        attach_btf_id: bpf_btf_id (resource)
  //        attach_prog_fd: fd_bpf_prog (resource)
  //        core_relo_cnt: len = 0x0 (4 bytes)
  //        fd_array: nil
  //        core_relos: nil
  //        core_relo_rec_size: const = 0x0 (4 bytes)
  //        log_true_size: int32 = 0x0 (4 bytes)
  //        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_prog_token_fd_wrapper {
  //          void: buffer: {} (length 0x0)
  //        }
  //        pad: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_pad_wrapper {
  //          value: const = 0x0 (4 bytes)
  //        }
  //      }
  //    }
  //    size: len = 0x94 (8 bytes)
  //  ]
  //  returns fd_bpf_prog
  *(uint32_t*)0x20000200 = 0xe;
  *(uint32_t*)0x20000204 = 6;
  *(uint64_t*)0x20000208 = 0x20000300;
  memcpy((void*)0x20000300,
         "\xb7\x02\x00\x00\x01\x00\x00\x00\xb7\x03\x00\x00\x00\x00\x00\x00\xb7"
         "\x04\x00\x00\x00\x00\x00\x00\x85\x00\x00\x00\x32\x00\x00\x00\xb7\x00"
         "\x00\x00\x01\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00",
         48);
  *(uint64_t*)0x20000210 = 0x20000400;
  memcpy((void*)0x20000400, "GPL\000", 4);
  *(uint32_t*)0x20000218 = 0;
  *(uint32_t*)0x2000021c = 0;
  *(uint64_t*)0x20000220 = 0;
  *(uint32_t*)0x20000228 = 0;
  *(uint32_t*)0x2000022c = 0;
  memset((void*)0x20000230, 0, 16);
  *(uint32_t*)0x20000240 = 0;
  *(uint32_t*)0x20000244 = 5;
  *(uint32_t*)0x20000248 = 0;
  *(uint32_t*)0x2000024c = 0;
  *(uint64_t*)0x20000250 = 0;
  *(uint32_t*)0x20000258 = 0;
  *(uint32_t*)0x2000025c = 0;
  *(uint64_t*)0x20000260 = 0;
  *(uint32_t*)0x20000268 = 0;
  *(uint32_t*)0x2000026c = 0;
  *(uint32_t*)0x20000270 = 0;
  *(uint32_t*)0x20000274 = 0;
  *(uint64_t*)0x20000278 = 0;
  *(uint64_t*)0x20000280 = 0;
  *(uint32_t*)0x20000288 = 0;
  *(uint32_t*)0x2000028c = 0;
  *(uint32_t*)0x20000290 = 0;
  res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x20000200ul, /*size=*/0x94ul);
  if (res != -1)
    r[3] = res;
  //  bpf$BPF_PROG_ATTACH arguments: [
  //    cmd: const = 0x8 (8 bytes)
  //    arg: ptr[in, bpf_attach_arg] {
  //      bpf_attach_arg {
  //        target: union bpf_attach_targets {
  //          map: fd_bpf_map (resource)
  //        }
  //        attach_bpf_fd: fd_bpf_prog (resource)
  //        type: bpf_attach_types = 0x5 (4 bytes)
  //        flags: bpf_attach_flags = 0x0 (4 bytes)
  //        replace_bpf_fd: fd_bpf_prog (resource)
  //        relative_link_fd: union _bpf_attach_arg_relative_link_fd_wrapper {
  //          void: buffer: {} (length 0x0)
  //        }
  //        relative_prog_fd: union _bpf_attach_arg_relative_prog_fd_wrapper {
  //          value: fd_bpf_prog (resource)
  //        }
  //        relative_link_id: union _bpf_attach_arg_relative_link_id_wrapper {
  //          void: buffer: {} (length 0x0)
  //        }
  //        relative_prog_id: union _bpf_attach_arg_relative_prog_id_wrapper {
  //          void: buffer: {} (length 0x0)
  //        }
  //        exp_revision: bpf_revision (resource)
  //      }
  //    }
  //    size: len = 0x20 (8 bytes)
  //  ]
  *(uint32_t*)0x20000500 = r[2];
  *(uint32_t*)0x20000504 = r[3];
  *(uint32_t*)0x20000508 = 5;
  *(uint32_t*)0x2000050c = 0;
  *(uint32_t*)0x20000510 = 0;
  *(uint32_t*)0x20000514 = 0;
  *(uint64_t*)0x20000518 = 0;
  syscall(__NR_bpf, /*cmd=*/8ul, /*arg=*/0x20000500ul, /*size=*/0x20ul);
  //  bpf$MAP_UPDATE_ELEM arguments: [
  //    cmd: const = 0x2 (8 bytes)
  //    arg: ptr[in, bpf_map_update_arg] {
  //      bpf_map_update_arg {
  //        map: fd_bpf_map (resource)
  //        pad = 0x0 (4 bytes)
  //        key: ptr[in, buffer] {
  //          buffer: {} (length 0x0)
  //        }
  //        val: ptr[in, bpf_map_update_val] {
  //          union bpf_map_update_val {
  //            tcp: sock_tcp (resource)
  //          }
  //        }
  //        flags: bpf_map_flags = 0x0 (8 bytes)
  //      }
  //    }
  //    size: len = 0x20 (8 bytes)
  //  ]
  *(uint32_t*)0x20000600 = r[2];
  *(uint64_t*)0x20000608 = 0x20000640;
  *(uint64_t*)0x20000610 = 0x20000680;
  *(uint32_t*)0x20000680 = r[0];
  *(uint64_t*)0x20000618 = 0;
  syscall(__NR_bpf, /*cmd=*/2ul, /*arg=*/0x20000600ul, /*size=*/0x20ul);
  //  sendto arguments: [
  //    fd: sock (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {01 02 03 04} (length 0x4)
  //    }
  //    len: len = 0x4 (8 bytes)
  //    f: send_flags = 0x0 (8 bytes)
  //    addr: nil
  //    addrlen: len = 0x0 (8 bytes)
  //  ]
  memcpy((void*)0x20000800, "\x01\x02\x03\x04", 4);
  syscall(__NR_sendto, /*fd=*/r[1], /*buf=*/0x20000800ul, /*len=*/4ul,
          /*f=*/0ul, /*addr=*/0ul, /*addrlen=*/0ul);
  return 0;
}