// https://syzkaller.appspot.com/bug?id=fad611d7ddd914f0b4488742a63b93f31b321ca0
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <errno.h>
#include <string.h>

void write_file(const char *path, const char *val)
{
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
        return;
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
    } else {
        printf("[+] Wrote %s to %s\n", val, path);
    }
    close(fd);
}

int main(void)
{
    int res;

    // Ensure configfs is mounted
    res = mount("configfs", "/sys/kernel/config", "configfs", 0, NULL);
    if (res < 0 && errno != EBUSY) {
        printf("[-] Failed to mount configfs: %s\n", strerror(errno));
    } else {
        printf("[+] configfs mounted or already mounted.\n");
    }

    // Setup USB Gadget & TCM Function
    res = mkdir("/sys/kernel/config/usb_gadget/g1", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create g1: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] g1 created.\n");

    res = mkdir("/sys/kernel/config/usb_gadget/g1/functions/tcm.0", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create tcm.0: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] tcm.0 created.\n");

    // Setup Target Fabric & WWN
    mkdir("/sys/kernel/config/target/core", 0777);
    res = mkdir("/sys/kernel/config/target/usb_gadget", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create target/usb_gadget: %s\n", strerror(errno));
    } else {
        printf("[+] target/usb_gadget created.\n");
    }

    res = mkdir("/sys/kernel/config/target/usb_gadget/naa.6001405123456789", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create wwn: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] wwn created.\n");

    // Trigger the Lockdep Cycle
    // Step A
    res = mkdir("/sys/kernel/config/target/usb_gadget/naa.6001405123456789/tpgt_1", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create tpgt_1: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] tpgt_1 created.\n");

    // Step B
    write_file("/sys/kernel/config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable", "1\n");

    // Step C
    res = rmdir("/sys/kernel/config/target/usb_gadget/naa.6001405123456789/tpgt_1");
    if (res < 0) {
        printf("[-] Failed to rmdir tpgt_1: %s\n", strerror(errno));
    } else {
        printf("[+] tpgt_1 removed.\n");
    }

    // Clean up
    rmdir("/sys/kernel/config/target/usb_gadget/naa.6001405123456789");
    rmdir("/sys/kernel/config/usb_gadget/g1/functions/tcm.0");
    rmdir("/sys/kernel/config/usb_gadget/g1");

    printf("[+] Reproducer finished.\n");
    return 0;
}