// https://syzkaller.appspot.com/bug?id=fad611d7ddd914f0b4488742a63b93f31b321ca0
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <errno.h>
#include <string.h>

int main() {
    int res;

    // Try to mount configfs
    res = mount("configfs", "/sys/kernel/config", "configfs", 0, NULL);
    if (res < 0 && errno != EBUSY) {
        printf("[-] Failed to mount configfs: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] configfs mounted or already mounted.\n");

    // 1. Create gadget
    res = mkdir("/sys/kernel/config/usb_gadget/g1", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create usb_gadget: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] usb_gadget created.\n");

    // 2. Create tcm function (Establishes: gadget_subsys.su_mutex -> &opts->dep_lock)
    res = mkdir("/sys/kernel/config/usb_gadget/g1/functions/tcm.0", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create tcm function: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] tcm function created.\n");

    // 3. Create target fabric directory
    res = mkdir("/sys/kernel/config/target/usb_gadget", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create target fabric directory: %s\n", strerror(errno));
    } else {
        printf("[+] target fabric directory created.\n");
    }

    // 4. Create target fabric WWN
    res = mkdir("/sys/kernel/config/target/usb_gadget/naa.1", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create target fabric WWN: %s\n", strerror(errno));
    } else {
        printf("[+] target fabric WWN created.\n");
    }

    // 5. Create tpgt (Establishes: &opts->dep_lock -> inode_lock)
    res = mkdir("/sys/kernel/config/target/usb_gadget/naa.1/tpgt_1", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create tpgt: %s\n", strerror(errno));
    } else {
        printf("[+] tpgt created.\n");
    }

    // 6. Create and remove a directory (Establishes: inode_lock -> &p->frag_sem)
    res = mkdir("/sys/kernel/config/usb_gadget/g1/strings/0x409", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create strings dir: %s\n", strerror(errno));
    } else {
        res = rmdir("/sys/kernel/config/usb_gadget/g1/strings/0x409");
        if (res < 0) {
            printf("[-] Failed to remove strings dir: %s\n", strerror(errno));
        } else {
            printf("[+] strings dir created and removed.\n");
        }
    }

    // 7. Create uvc function
    res = mkdir("/sys/kernel/config/usb_gadget/g1/functions/uvc.0", 0777);
    if (res < 0 && errno != EEXIST) {
        printf("[-] Failed to create uvc function: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] uvc function created.\n");

    // 8. Read iTerminal (Establishes: &p->frag_sem -> gadget_subsys.su_mutex)
    int fd = open("/sys/kernel/config/usb_gadget/g1/functions/uvc.0/control/terminal/output/default/iTerminal", O_RDONLY);
    if (fd < 0) {
        printf("[-] Failed to open iTerminal: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] iTerminal opened.\n");

    char buf[16];
    res = read(fd, buf, sizeof(buf));
    if (res < 0) {
        printf("[-] Failed to read iTerminal: %s\n", strerror(errno));
    } else {
        printf("[+] iTerminal read.\n");
    }
    close(fd);

    printf("[+] Reproducer finished.\n");
    return 0;
}