// https://syzkaller.appspot.com/bug?id=e338c5864b12cfa0d66733fa5d2ac5995db3a0ae
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        if (write(fd, val, strlen(val)) < 0) {
            printf("[-] Failed to write to %s: %s\n", path, strerror(errno));
        } else {
            printf("[+] Wrote '%s' to %s\n", val, path);
        }
        close(fd);
    } else {
        printf("[-] Failed to open %s: %s\n", path, strerror(errno));
    }
}

int main() {
    const char *instances_dir = "/sys/kernel/tracing/instances";
    struct stat st;
    if (stat(instances_dir, &st) < 0) {
        instances_dir = "/sys/kernel/debug/tracing/instances";
        if (stat(instances_dir, &st) < 0) {
            printf("[-] Tracing instances directory not found.\n");
            exit(1);
        }
    }
    printf("[+] Using instances directory: %s\n", instances_dir);

    // Enable fault injection specifically for tracefs_inode_cache
    write_file("/sys/kernel/slab/tracefs_inode_cache/failslab", "1");
    
    // Restrict fault injection to only caches with failslab=1
    write_file("/sys/kernel/debug/failslab/cache-filter", "1");

    // Allow fault injection for GFP_KERNEL allocations (which can sleep)
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "0");

    // Set a 50% probability of failure to allow the first inode allocations
    // to succeed and the subsequent ones to fail.
    write_file("/sys/kernel/debug/failslab/probability", "50");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    
    // Restrict fault injection to the current task
    write_file("/sys/kernel/debug/failslab/task-filter", "1");
    write_file("/proc/self/make-it-fail", "1");

    printf("[+] Starting to create instances...\n");
    // Trigger the bug by creating new trace instances in a loop.
    // With 50% probability, the instance dir allocation succeeds and the
    // events dir allocation fails, hitting the exact error path.
    for (int i = 0; i < 1000; i++) {
        char path[256];
        snprintf(path, sizeof(path), "%s/test_bug_%d", instances_dir, i);
        mkdir(path, 0755);
    }

    printf("[+] Reproducer finished.\n");
    return 0;
}