// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

#include <stdint.h>
#include <string.h>

static uintptr_t syz_open_procfs(uintptr_t a0, uintptr_t a1)
{

  char buf[128];
  memset(buf, 0, sizeof(buf));
  if (a0 == 0) {
    snprintf(buf, sizeof(buf), "/proc/self/%s", (char*)a1);
  } else if (a0 == (uintptr_t)-1) {
    snprintf(buf, sizeof(buf), "/proc/thread-self/%s", (char*)a1);
  } else {
    snprintf(buf, sizeof(buf), "/proc/self/task/%d/%s", (int)a0,
             (char*)a1);
  }
  int fd = open(buf, O_RDWR);
  if (fd == -1)
    fd = open(buf, O_RDONLY);
  return fd;
}

long r[17];
void loop()
{
  memset(r, -1, sizeof(r));
  r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul,
                 0xfffffffffffffffful, 0x0ul);
  memcpy((void*)0x20006ffd, "\x69\x6f\x00", 3);
  r[2] = syz_open_procfs(0x0ul, 0x20006ffdul);
  r[3] = syscall(__NR_read, r[2], 0x20cb6000ul, 0x0ul);
  r[4] = syscall(__NR_pipe2, 0x2069f000ul, 0x80800ul);
  if (r[4] != -1)
    r[5] = *(uint32_t*)0x2069f004;
  memcpy((void*)0x205b5000, "\x73\x6d\x61\x70\x73\x00", 6);
  r[7] = syz_open_procfs(0x0ul, 0x205b5000ul);
  r[8] =
      syscall(__NR_splice, r[7], 0x0ul, r[5], 0x0ul, 0x10000ul, 0x1ul);
  memcpy((void*)0x20373ff8, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
  r[10] = syscall(__NR_mknod, 0x20373ff8ul, 0x103ful, 0x0ul);
  memcpy((void*)0x20f8aff8, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
  *(uint64_t*)0x20324ff0 = (uint64_t)0x20918ff4;
  *(uint64_t*)0x20324ff8 = (uint64_t)0x20257000;
  memcpy((void*)0x20918ff4,
         "\x2d\x70\x70\x70\x31\x76\x6d\x6e\x65\x74\x31\x00", 12);
  memcpy((void*)0x20257000,
         "\x70\x6b\x63\x73\x37\x5f\x74\x65\x73\x74\x00", 11);
  r[16] =
      syscall(__NR_execve, 0x20f8aff8ul, 0x20a7bfc8ul, 0x20324ff0ul);
}

int main()
{
  loop();
  return 0;
}