// https://syzkaller.appspot.com/bug?id=e63c0c8da08031799e676d3004e1e4b60453cdaf
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

#define KMEMLEAK_FILE "/sys/kernel/debug/kmemleak"

static const char* setup_leak()
{
  if (!write_file(KMEMLEAK_FILE, "scan=off")) {
    if (errno == EBUSY)
      return "KMEMLEAK disabled: increase CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE"
             " or unset CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF";
    return "failed to write(kmemleak, \"scan=off\")";
  }
  if (!write_file(KMEMLEAK_FILE, "scan"))
    return "failed to write(kmemleak, \"scan\")";
  sleep(5);
  if (!write_file(KMEMLEAK_FILE, "scan"))
    return "failed to write(kmemleak, \"scan\")";
  if (!write_file(KMEMLEAK_FILE, "clear"))
    return "failed to write(kmemleak, \"clear\")";
  return NULL;
}

static void check_leaks(void)
{
  int fd = open(KMEMLEAK_FILE, O_RDWR);
  if (fd == -1)
    exit(1);
  uint64_t start = current_time_ms();
  if (write(fd, "scan", 4) != 4)
    exit(1);
  sleep(1);
  while (current_time_ms() - start < 4 * 1000)
    sleep(1);
  if (write(fd, "scan", 4) != 4)
    exit(1);
  static char buf[128 << 10];
  ssize_t n = read(fd, buf, sizeof(buf) - 1);
  if (n < 0)
    exit(1);
  int nleaks = 0;
  if (n != 0) {
    sleep(1);
    if (write(fd, "scan", 4) != 4)
      exit(1);
    if (lseek(fd, 0, SEEK_SET) < 0)
      exit(1);
    n = read(fd, buf, sizeof(buf) - 1);
    if (n < 0)
      exit(1);
    buf[n] = 0;
    char* pos = buf;
    char* end = buf + n;
    while (pos < end) {
      char* next = strstr(pos + 1, "unreferenced object");
      if (!next)
        next = end;
      char prev = *next;
      *next = 0;
      fprintf(stderr, "BUG: memory leak\n%s\n", pos);
      *next = prev;
      pos = next;
      nleaks++;
    }
  }
  if (write(fd, "clear", 5) != 5)
    exit(1);
  close(fd);
  if (nleaks)
    exit(1);
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
    check_leaks();
  }
}

void execute_one(void)
{
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  write$RDMA_USER_CM_CMD_REJECT arguments: [
  //    fd: fd_rdma_cm (resource)
  //    data: ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_REJECT, rdma_ucm_reject]]
  //    {
  //      rdma_ucm_cmd_t[RDMA_USER_CM_CMD_REJECT, rdma_ucm_reject] {
  //        cmd: const = 0x9 (4 bytes)
  //        in: bytesize = 0x108 (2 bytes)
  //        out: const = 0xfa00 (2 bytes)
  //        msg: rdma_ucm_reject {
  //          id: rdma_cm_id (resource)
  //          private_data_len: int8 = 0x0 (1 bytes)
  //          reserved: buffer: {23 53 50} (length 0x3)
  //          private_data: buffer: {d5 4a 1e a6 e2 b9 5d 3e fd 47 dc db b5 fb
  //          1f 11 2a af 00 64 d7 94 86 cd f5 0f 62 06 54 08 90 b3 55 29 e0 47
  //          d3 82 9c 53 d4 6e e1 3e 92 47 91 27 dc a6 a9 3a 8e 4c 9c 21 56 0c
  //          97 c0 6c 9c bd 9f 48 aa 43 08 e5 8a 1f 9a 85 a0 97 2b 8f 9f 4a d8
  //          2d 37 a0 f0 15 8b 4a f6 b1 02 1f 8a 83 d5 fe 55 dd d5 42 e2 94 d8
  //          eb c0 a2 23 dc 07 0c 8b 06 5b 87 5d 1d 86 03 ba 1a 62 59 9c 91 19
  //          f0 9f 68 79 de 15 1b 90 22 6d f1 49 ca e7 21 7a 7c 43 dd c0 d6 8a
  //          3d 40 61 6f db 18 6a 18 cd d5 fa ac aa 55 87 5d 56 40 df 0b 9a 89
  //          ed da d7 50 b0 37 dc 48 0c 92 60 3e 12 15 62 92 7a 59 8e 5c 71 21
  //          dc 99 34 a8 49 7e b4 3f 25 96 20 94 ad 4e 8d a3 88 59 d6 f1 f0 d1
  //          26 30 e1 7a 2f 1b 08 88 2b f0 6b 3f 26 9c 40 31 72 bd 61 18 6a 02
  //          17 a9 3d 47 e8 79 8f 6f 2b 00 00 00 00 00 00 00 00 00 00 00 00 00}
  //          (length 0x100)
  //        }
  //      }
  //    }
  //    len: bytesize = 0x110 (8 bytes)
  //  ]
  *(uint32_t*)0x200000000100 = 9;
  *(uint16_t*)0x200000000104 = 0x108;
  *(uint16_t*)0x200000000106 = 0xfa00;
  *(uint32_t*)0x200000000108 = -1;
  *(uint8_t*)0x20000000010c = 0;
  memcpy((void*)0x20000000010d, "#SP", 3);
  memcpy(
      (void*)0x200000000110,
      "\xd5\x4a\x1e\xa6\xe2\xb9\x5d\x3e\xfd\x47\xdc\xdb\xb5\xfb\x1f\x11\x2a\xaf"
      "\x00\x64\xd7\x94\x86\xcd\xf5\x0f\x62\x06\x54\x08\x90\xb3\x55\x29\xe0\x47"
      "\xd3\x82\x9c\x53\xd4\x6e\xe1\x3e\x92\x47\x91\x27\xdc\xa6\xa9\x3a\x8e\x4c"
      "\x9c\x21\x56\x0c\x97\xc0\x6c\x9c\xbd\x9f\x48\xaa\x43\x08\xe5\x8a\x1f\x9a"
      "\x85\xa0\x97\x2b\x8f\x9f\x4a\xd8\x2d\x37\xa0\xf0\x15\x8b\x4a\xf6\xb1\x02"
      "\x1f\x8a\x83\xd5\xfe\x55\xdd\xd5\x42\xe2\x94\xd8\xeb\xc0\xa2\x23\xdc\x07"
      "\x0c\x8b\x06\x5b\x87\x5d\x1d\x86\x03\xba\x1a\x62\x59\x9c\x91\x19\xf0\x9f"
      "\x68\x79\xde\x15\x1b\x90\x22\x6d\xf1\x49\xca\xe7\x21\x7a\x7c\x43\xdd\xc0"
      "\xd6\x8a\x3d\x40\x61\x6f\xdb\x18\x6a\x18\xcd\xd5\xfa\xac\xaa\x55\x87\x5d"
      "\x56\x40\xdf\x0b\x9a\x89\xed\xda\xd7\x50\xb0\x37\xdc\x48\x0c\x92\x60\x3e"
      "\x12\x15\x62\x92\x7a\x59\x8e\x5c\x71\x21\xdc\x99\x34\xa8\x49\x7e\xb4\x3f"
      "\x25\x96\x20\x94\xad\x4e\x8d\xa3\x88\x59\xd6\xf1\xf0\xd1\x26\x30\xe1\x7a"
      "\x2f\x1b\x08\x88\x2b\xf0\x6b\x3f\x26\x9c\x40\x31\x72\xbd\x61\x18\x6a\x02"
      "\x17\xa9\x3d\x47\xe8\x79\x8f\x6f\x2b\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00",
      256);
  syscall(__NR_write, /*fd=*/(intptr_t)-1, /*data=*/0x200000000100ul,
          /*len=*/0x110ul);
  //  prctl$PR_SCHED_CORE arguments: [
  //    option: const = 0x4d (8 bytes)
  //    cmd: intptr = 0x1 (8 bytes)
  //    pid: pid (resource)
  //    type: pid_type = 0x0 (8 bytes)
  //    uaddr: nil
  //  ]
  syscall(__NR_prctl, /*option=*/0x4dul, /*cmd=*/1ul, /*pid=*/0, /*type=*/0ul,
          /*uaddr=*/0ul);
  //  timer_create arguments: [
  //    id: clock_id = 0x2 (8 bytes)
  //    ev: nil
  //    timerid: nil
  //  ]
  syscall(__NR_timer_create, /*id=CLOCK_PROCESS_CPUTIME_ID*/ 2ul, /*ev=*/0ul,
          /*timerid=*/0ul);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  if ((reason = setup_leak()))
    printf("the reproducer may not work as expected: leak checking setup "
           "failed: %s\n",
           reason);
  loop();
  return 0;
}