// https://syzkaller.appspot.com/bug?id=5689aff48689f3ca418d44391fe4a4390a1ac21a
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <pthread.h>

#define NUM_SPAMMERS 10

int sleep_time = 200;

void set_hung_task_timeout() {
    int fd = open("/proc/sys/kernel/hung_task_timeout_secs", O_WRONLY);
    if (fd >= 0) {
        if (write(fd, "15\n", 3) < 0) {
            printf("[-] Failed to write to hung_task_timeout_secs: %s\n", strerror(errno));
        } else {
            printf("[+] Reduced hung task timeout to 15 seconds.\n");
            sleep_time = 60;
        }
        close(fd);
    } else {
        printf("[-] Failed to open hung_task_timeout_secs: %s\n", strerror(errno));
    }
}

void disable_printk_ratelimit() {
    int fd = open("/proc/sys/kernel/printk_devkmsg", O_WRONLY);
    if (fd >= 0) {
        if (write(fd, "on\n", 3) < 0) {
            printf("[-] Failed to write to printk_devkmsg: %s\n", strerror(errno));
        } else {
            printf("[+] Disabled printk ratelimiting.\n");
        }
        close(fd);
    } else {
        printf("[-] Failed to open printk_devkmsg: %s\n", strerror(errno));
    }
}

void *kmsg_spammer(void *arg) {
    char msg[1025];
    memset(msg, 'A', 1023);
    msg[1023] = '\n';
    msg[1024] = '\0';
    
    int fd = open("/dev/kmsg", O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open /dev/kmsg: %s\n", strerror(errno));
        return NULL;
    }
    
    while (1) {
        if (write(fd, msg, 1024) < 0) {
            // Ignore write errors
        }
    }
    close(fd);
    return NULL;
}

void *tty_opener(void *arg) {
    sleep(1); // Wait for spam to start
    printf("[+] Opening /dev/tty63 to block on console_sem while holding tty_mutex\n");
    int fd = open("/dev/tty63", O_RDWR | O_NOCTTY);
    if (fd < 0) {
        printf("[-] Failed to open /dev/tty63: %s\n", strerror(errno));
    } else {
        printf("[+] Successfully opened /dev/tty63 (unexpected)\n");
        close(fd);
    }
    return NULL;
}

void *ptmx_opener(void *arg) {
    sleep(2); // Wait for tty_opener to acquire tty_mutex
    printf("[+] Opening /dev/ptmx to block on tty_mutex\n");
    int fd = open("/dev/ptmx", O_RDWR | O_NOCTTY);
    if (fd < 0) {
        printf("[-] Failed to open /dev/ptmx: %s\n", strerror(errno));
    } else {
        printf("[+] Successfully opened /dev/ptmx (unexpected)\n");
        close(fd);
    }
    return NULL;
}

int main() {
    pthread_t spammers[NUM_SPAMMERS];
    pthread_t tty_thread, ptmx_thread;

    set_hung_task_timeout();
    disable_printk_ratelimit();

    printf("[+] Starting kmsg spammers\n");
    for (int i = 0; i < NUM_SPAMMERS; i++) {
        if (pthread_create(&spammers[i], NULL, kmsg_spammer, NULL) != 0) {
            printf("[-] Failed to create spammer thread: %s\n", strerror(errno));
            exit(1);
        }
    }

    if (pthread_create(&tty_thread, NULL, tty_opener, NULL) != 0) {
        printf("[-] Failed to create tty thread: %s\n", strerror(errno));
        exit(1);
    }

    if (pthread_create(&ptmx_thread, NULL, ptmx_opener, NULL) != 0) {
        printf("[-] Failed to create ptmx thread: %s\n", strerror(errno));
        exit(1);
    }

    printf("[+] Waiting for hung task timeout (approx %d seconds)...\n", sleep_time);
    sleep(sleep_time);

    printf("[+] Test completed.\n");
    return 0;
}