// https://syzkaller.appspot.com/bug?id=cc1db8d77ba57ed1eb2eea45ac3d498da47f2a68
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
  if (a0 == 0xc || a0 == 0xb) {
    char buf[128];
    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
            (uint8_t)a2);
    return open(buf, O_RDWR, 0);
  } else {
    unsigned long nb = a1;
    char buf[1024];
    char* hash;
    strncpy(buf, (char*)a0, sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = 0;
    while ((hash = strchr(buf, '#'))) {
      *hash = '0' + (char)(nb % 10);
      nb /= 10;
    }
    return open(buf, a2 & ~O_CREAT, 0);
  }
}

uint64_t r[6] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0};

int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  syz_open_dev$dri arguments: [
  //    dev: ptr[in, buffer] {
  //      buffer: {2f 64 65 76 2f 64 72 69 2f 63 61 72 64 23 00} (length 0xf)
  //    }
  //    id: intptr = 0x1ff (8 bytes)
  //    flags: open_flags = 0x0 (8 bytes)
  //  ]
  //  returns fd_dri
  memcpy((void*)0x2000000000c0, "/dev/dri/card#\000", 15);
  res = -1;
  res = syz_open_dev(/*dev=*/0x2000000000c0, /*id=*/0x1ff, /*flags=*/0);
  if (res != -1)
    r[0] = res;
  //  syz_open_dev$dri arguments: [
  //    dev: ptr[in, buffer] {
  //      buffer: {2f 64 65 76 2f 64 72 69 2f 63 61 72 64 23 00} (length 0xf)
  //    }
  //    id: intptr = 0x40100001 (8 bytes)
  //    flags: open_flags = 0x0 (8 bytes)
  //  ]
  //  returns fd_dri
  memcpy((void*)0x200000000080, "/dev/dri/card#\000", 15);
  res = -1;
  res = syz_open_dev(/*dev=*/0x200000000080, /*id=*/0x40100001, /*flags=*/0);
  if (res != -1)
    r[1] = res;
  //  ioctl$DRM_IOCTL_SET_CLIENT_CAP arguments: [
  //    fd: fd_dri (resource)
  //    cmd: const = 0x4010640d (4 bytes)
  //    arg: ptr[in, drm_get_cap] {
  //      drm_get_cap {
  //        cap: drm_cap = 0x3 (8 bytes)
  //        val: const = 0x2 (8 bytes)
  //      }
  //    }
  //  ]
  *(uint64_t*)0x200000000000 = 3;
  *(uint64_t*)0x200000000008 = 2;
  syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x4010640d,
          /*arg=*/0x200000000000ul);
  //  ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES arguments: [
  //    fd: fd_dri (resource)
  //    cmd: const = 0xc01064b5 (4 bytes)
  //    arg: ptr[inout, drm_mode_get_plane_res] {
  //      drm_mode_get_plane_res {
  //        ids: ptr[out, array[drm_plane_id]] {
  //          array[drm_plane_id] {
  //            drm_plane_id (resource)
  //          }
  //        }
  //        cnt: len = 0x1 (4 bytes)
  //        pad = 0x0 (4 bytes)
  //      }
  //    }
  //  ]
  *(uint64_t*)0x200000000140 = 0x200000000100;
  *(uint32_t*)0x200000000148 = 1;
  res = syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xc01064b5,
                /*arg=*/0x200000000140ul);
  if (res != -1)
    r[2] = *(uint32_t*)0x200000000100;
  //  ioctl$DRM_IOCTL_MODE_GETPLANE arguments: [
  //    fd: fd_dri (resource)
  //    cmd: const = 0xc02064b6 (4 bytes)
  //    arg: ptr[inout, drm_mode_get_plane] {
  //      drm_mode_get_plane {
  //        plane_id: drm_plane_id (resource)
  //        crtc_id: drm_crtc_id (resource)
  //        fb_id: drm_fb_id (resource)
  //        possible_crtcs: const = 0x0 (4 bytes)
  //        gamma_size: const = 0x0 (4 bytes)
  //        count_format_types: len = 0x0 (4 bytes)
  //        format_type_ptr: nil
  //      }
  //    }
  //  ]
  *(uint32_t*)0x2000000002c0 = r[2];
  *(uint32_t*)0x2000000002c4 = 0;
  *(uint32_t*)0x2000000002c8 = 0;
  *(uint32_t*)0x2000000002cc = 0;
  *(uint32_t*)0x2000000002d0 = 0;
  *(uint32_t*)0x2000000002d4 = 0;
  *(uint64_t*)0x2000000002d8 = 0;
  res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc02064b6,
                /*arg=*/0x2000000002c0ul);
  if (res != -1) {
    r[3] = *(uint32_t*)0x2000000002c4;
    r[4] = *(uint32_t*)0x2000000002c8;
  }
  //  ioctl$DRM_IOCTL_MODE_GETRESOURCES arguments: [
  //    fd: fd_dri (resource)
  //    cmd: const = 0xc04064a0 (4 bytes)
  //    arg: ptr[inout, drm_mode_card_res] {
  //      drm_mode_card_res {
  //        fbid: nil
  //        crtcid: nil
  //        connid: ptr[out, array[drm_connector_id]] {
  //          array[drm_connector_id] {
  //            drm_connector_id (resource)
  //          }
  //        }
  //        encid: nil
  //        nfbid: len = 0x0 (4 bytes)
  //        ncrtcid: len = 0x0 (4 bytes)
  //        nconnid: len = 0x1 (4 bytes)
  //        nencid: len = 0x0 (4 bytes)
  //        maxw: const = 0x0 (4 bytes)
  //        maxh: const = 0x0 (4 bytes)
  //        minw: const = 0x0 (4 bytes)
  //        minh: const = 0x0 (4 bytes)
  //      }
  //    }
  //  ]
  *(uint64_t*)0x2000000006c0 = 0;
  *(uint64_t*)0x2000000006c8 = 0;
  *(uint64_t*)0x2000000006d0 = 0x200000000640;
  *(uint64_t*)0x2000000006d8 = 0;
  *(uint32_t*)0x2000000006e0 = 0;
  *(uint32_t*)0x2000000006e4 = 0;
  *(uint32_t*)0x2000000006e8 = 1;
  *(uint32_t*)0x2000000006ec = 0;
  *(uint32_t*)0x2000000006f0 = 0;
  *(uint32_t*)0x2000000006f4 = 0;
  *(uint32_t*)0x2000000006f8 = 0;
  *(uint32_t*)0x2000000006fc = 0;
  res = syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xc04064a0,
                /*arg=*/0x2000000006c0ul);
  if (res != -1)
    r[5] = *(uint32_t*)0x200000000640;
  //  ioctl$DRM_IOCTL_MODE_SETCRTC arguments: [
  //    fd: fd_dri (resource)
  //    cmd: const = 0xc06864a2 (4 bytes)
  //    arg: ptr[in, drm_mode_crtc$DRM_IOCTL_MODE_SETCRTC] {
  //      drm_mode_crtc$DRM_IOCTL_MODE_SETCRTC {
  //        set_connectors_ptr: ptr[in, array[drm_connector_id]] {
  //          array[drm_connector_id] {
  //            drm_connector_id (resource)
  //          }
  //        }
  //        count_connectors: len = 0x1 (4 bytes)
  //        crtc_id: drm_crtc_id (resource)
  //        fb_id: drm_fb_id (resource)
  //        x: int32 = 0x3 (4 bytes)
  //        y: int32 = 0x5 (4 bytes)
  //        gamma_size: int32 = 0x2 (4 bytes)
  //        mode_valid: int32 = 0x80003 (4 bytes)
  //        mode: drm_mode_modeinfo {
  //          clock: int32 = 0xac7c (4 bytes)
  //          hdisplay: int16 = 0x1 (2 bytes)
  //          hsync_start: int16 = 0x7 (2 bytes)
  //          hsync_end: int16 = 0x69 (2 bytes)
  //          htotal: int16 = 0xf4b (2 bytes)
  //          hskew: int16 = 0x2 (2 bytes)
  //          vdisplay: int16 = 0x2 (2 bytes)
  //          vsync_start: int16 = 0x5 (2 bytes)
  //          vsync_end: int16 = 0x412f (2 bytes)
  //          vtotal: int16 = 0xe154 (2 bytes)
  //          vscan: int16 = 0x24 (2 bytes)
  //          vrefresh: int32 = 0x7 (4 bytes)
  //          flags: int32 = 0xb2bf (4 bytes)
  //          type: int32 = 0x3 (4 bytes)
  //          name: buffer: {fe 1d 00 00 34 13 00 00 00 00 00 00 00 0c aa 00 00
  //          00 09 00 00 00 00 00 00 00 04 b4 27 18 00 10} (length 0x20)
  //        }
  //      }
  //    }
  //  ]
  *(uint64_t*)0x200000000300 = 0x200000000180;
  *(uint32_t*)0x200000000180 = r[5];
  *(uint32_t*)0x200000000308 = 1;
  *(uint32_t*)0x20000000030c = r[3];
  *(uint32_t*)0x200000000310 = r[4];
  *(uint32_t*)0x200000000314 = 3;
  *(uint32_t*)0x200000000318 = 5;
  *(uint32_t*)0x20000000031c = 2;
  *(uint32_t*)0x200000000320 = 0x80003;
  *(uint32_t*)0x200000000324 = 0xac7c;
  *(uint16_t*)0x200000000328 = 1;
  *(uint16_t*)0x20000000032a = 7;
  *(uint16_t*)0x20000000032c = 0x69;
  *(uint16_t*)0x20000000032e = 0xf4b;
  *(uint16_t*)0x200000000330 = 2;
  *(uint16_t*)0x200000000332 = 2;
  *(uint16_t*)0x200000000334 = 5;
  *(uint16_t*)0x200000000336 = 0x412f;
  *(uint16_t*)0x200000000338 = 0xe154;
  *(uint16_t*)0x20000000033a = 0x24;
  *(uint32_t*)0x20000000033c = 7;
  *(uint32_t*)0x200000000340 = 0xb2bf;
  *(uint32_t*)0x200000000344 = 3;
  memcpy((void*)0x200000000348,
         "\xfe\x1d\x00\x00\x34\x13\x00\x00\x00\x00\x00\x00\x00\x0c\xaa\x00\x00"
         "\x00\x09\x00\x00\x00\x00\x00\x00\x00\x04\xb4\x27\x18\x00\x10",
         32);
  syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc06864a2,
          /*arg=*/0x200000000300ul);
  return 0;
}