// https://syzkaller.appspot.com/bug?id=c1fff11a9e9711bc3d7be9a67490bccc687f0a40
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/wait.h>
#include <string.h>
#include <errno.h>

#ifndef MADV_PAGEOUT
#define MADV_PAGEOUT 21
#endif

#define NUM_CHILDREN 8
#define NUM_GRANDCHILDREN 4

int main(void) {
    void *p = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (p == MAP_FAILED) {
        printf("[-] Failed to mmap: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mmap successful.\n");

    *(volatile char *)p = 1;

    int res = madvise(p, 4096, MADV_PAGEOUT);
    if (res < 0) {
        printf("[-] Failed to madvise(MADV_PAGEOUT): %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] madvise(MADV_PAGEOUT) successful.\n");

    printf("[+] Starting race loop...\n");
    
    int iterations = 0;
    while (1) {
        for (int i = 0; i < NUM_CHILDREN; i++) {
            pid_t pid = fork();
            if (pid < 0) {
                if (errno == EAGAIN) continue;
                printf("[-] Failed to fork child: %s\n", strerror(errno));
                exit(1);
            }
            if (pid == 0) {
                // Child
                for (int j = 0; j < NUM_GRANDCHILDREN; j++) {
                    pid_t gpid = fork();
                    if (gpid < 0) {
                        if (errno == EAGAIN) continue;
                        printf("[-] Failed to fork grandchild: %s\n", strerror(errno));
                        exit(1);
                    }
                    if (gpid == 0) {
                        // Grandchild
                        exit(0);
                    }
                }
                while (wait(NULL) > 0);
                exit(0);
            }
        }
        while (wait(NULL) > 0);
        
        iterations++;
        if (iterations % 1000 == 0) {
            printf("[+] Completed %d iterations.\n", iterations);
        }
    }

    return 0;
}