// https://syzkaller.appspot.com/bug?id=039acba3450b2b9f32eb3c065f07874601f1e2ff
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

uint64_t r[3] = {0x0, 0x0, 0x0};

int main(void)
{
  syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  intptr_t res = 0;
  memcpy((void*)0x200000c0, "user\000", 5);
  memcpy((void*)0x20000000, "syz", 3);
  *(uint8_t*)0x20000003 = 0;
  *(uint8_t*)0x20000004 = 0;
  memcpy((void*)0x200002c0,
         "\x58\x5c\xcb\xe4\xed\x83\xb8\x36\xc1\xa6\x47\x49\x14\xdc\x55\xe7\x22"
         "\x06\x29\x7b\x68\x95\xb6\x61\x47\xb3\xc7\x21\x8a\x91\x87\x7b\x5e\xa0"
         "\xbd\xc9\xe1\x58\xbd\x83\x00\x00\x00\x00\x00\x00\x00\x42\xe3\x30\x89"
         "\x75\x4c\x81\x07\xc3\xcd\x39\x23\xdd\x4a\x71\xc2\xff\x06\x00\x7b\x6b"
         "\x48\x16\x12\x2d\x25\x50\x82\x9e\xaa\x94\x35\xc9\x99\x26\x02\x2b\x87"
         "\x53\xa1\x88\x74\x8c\x56\x9f\x43\x5f\xb3\xba\xe9\x6e\xfb\x74\xb5\x0e"
         "\xc9\x3c\x15\x2f\x5e\x8e\x19\x8a\x29\xe5\xc0\xd0\xc6\x00\x00\xce\x06"
         "\x37\xce\x00\x00\xb4\xec\x24\xc5\x3d\x3d\x66\x1f\xf5\xff\x70\xe4\x88"
         "\x84\xca\x00\x00\x18\xce\xa7\x1f\xcf\xac\xf4\x0d\x32\xe4\xb5\x8a\x8d"
         "\x27\x25\x56\x0a\x61\x10\xfd\x7b\x06\xf9\x0b\x52\x74\xcc\x5c\x1e\x29"
         "\x8a\x16\x32\x4f\xe2\x7d\xa2\xa9\xd5\xba\x9f\xf3\xc0\x09\xd3\x08\xbd"
         "\x73\xf4\x77\x25\x39",
         192);
  res = syscall(__NR_add_key, 0x200000c0ul, 0x20000000ul, 0x200002c0ul, 0x49cul,
                0xfffffffe);
  if (res != -1)
    r[0] = res;
  memcpy((void*)0x20000580, "keyring\000", 8);
  memcpy((void*)0x20000280, "syz", 3);
  *(uint8_t*)0x20000283 = 0x22;
  *(uint8_t*)0x20000284 = 0;
  res = syscall(__NR_add_key, 0x20000580ul, 0x20000280ul, 0ul, 0ul, -1);
  if (res != -1)
    r[1] = res;
  memcpy((void*)0x20000200, "user\000", 5);
  memcpy((void*)0x200005c0, "syz", 3);
  *(uint8_t*)0x200005c3 = 0x21;
  *(uint8_t*)0x200005c4 = 0;
  memcpy((void*)0x20000100, "\xcf", 1);
  res = syscall(__NR_add_key, 0x20000200ul, 0x200005c0ul, 0x20000100ul, 1ul,
                r[1]);
  if (res != -1)
    r[2] = res;
  *(uint32_t*)0x20000400 = r[2];
  *(uint32_t*)0x20000404 = r[0];
  *(uint32_t*)0x20000408 = r[2];
  *(uint64_t*)0x20000980 = 0x20000900;
  memcpy((void*)0x20000900, "poly1305\000\000\000\000\000\000\000\000\000\000"
                            "\000\000\000\000\000\000\000\000\000\000\000\000"
                            "\000\000\000\000\000\000\000\000\000\000\000\000"
                            "\000\000\000\000\000\000\000\000\000\000\000\000"
                            "\000\000\000\000\000\000\000\000\000\000",
         64);
  *(uint64_t*)0x20000988 = 0;
  *(uint32_t*)0x20000990 = 0;
  *(uint32_t*)0x20000994 = 0;
  *(uint32_t*)0x20000998 = 0;
  *(uint32_t*)0x2000099c = 0;
  *(uint32_t*)0x200009a0 = 0;
  *(uint32_t*)0x200009a4 = 0;
  *(uint32_t*)0x200009a8 = 0;
  *(uint32_t*)0x200009ac = 0;
  *(uint32_t*)0x200009b0 = 0;
  syscall(__NR_keyctl, 0x17ul, 0x20000400ul, 0x20000540ul, 3ul, 0x20000980ul);
  return 0;
}