text: // general protection fault in process_init_reply
  // https://syzkaller.appspot.com/bug?id=69c1eb1079b9db12bec3d4c6c90cdfe37ab6012c
  // status:open
  // autogenerated by syzkaller (http://github.com/google/syzkaller)
  
  #define _GNU_SOURCE
  #include <endian.h>
  #include <linux/futex.h>
  #include <pthread.h>
  #include <stdint.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  #include <sys/syscall.h>
  #include <unistd.h>
  
  static void execute_one();
  extern unsigned long long procid;
  
  void loop()
  {
    while (1) {
      execute_one();
    }
  }
  
  struct thread_t {
    int created, running, call;
    pthread_t th;
  };
  
  static struct thread_t threads[16];
  static void execute_call(int call);
  static int running;
  static int collide;
  
  static void* thr(void* arg)
  {
    struct thread_t* th = (struct thread_t*)arg;
    for (;;) {
      while (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE))
        syscall(SYS_futex, &th->running, FUTEX_WAIT, 0, 0);
      execute_call(th->call);
      __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
      __atomic_store_n(&th->running, 0, __ATOMIC_RELEASE);
      syscall(SYS_futex, &th->running, FUTEX_WAKE);
    }
    return 0;
  }
  
  static void execute(int num_calls)
  {
    int call, thread;
    running = 0;
    for (call = 0; call < num_calls; call++) {
      for (thread = 0; thread < sizeof(threads) / sizeof(threads[0]); thread++) {
        struct thread_t* th = &threads[thread];
        if (!th->created) {
          th->created = 1;
          pthread_attr_t attr;
          pthread_attr_init(&attr);
          pthread_attr_setstacksize(&attr, 128 << 10);
          pthread_create(&th->th, &attr, thr, th);
        }
        if (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) {
          th->call = call;
          __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
          __atomic_store_n(&th->running, 1, __ATOMIC_RELEASE);
          syscall(SYS_futex, &th->running, FUTEX_WAKE);
          if (collide && call % 2)
            break;
          struct timespec ts;
          ts.tv_sec = 0;
          ts.tv_nsec = 20 * 1000 * 1000;
          syscall(SYS_futex, &th->running, FUTEX_WAIT, 1, &ts);
          if (__atomic_load_n(&running, __ATOMIC_RELAXED))
            usleep((call == num_calls - 1) ? 10000 : 1000);
          break;
        }
      }
    }
  }
  
  uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
  unsigned long long procid;
  void execute_call(int call)
  {
    long res;
    switch (call) {
    case 0:
      memcpy((void*)0x20000100, "./file0", 8);
      syscall(__NR_mknod, 0x20000100, 0, 0);
      break;
    case 1:
      memcpy((void*)0x20000740, "./file0", 8);
      res = syscall(__NR_open, 0x20000740, 0, 0);
      if (res != -1)
        r[0] = res;
      break;
    case 2:
      *(uint32_t*)0x20000780 = -1;
      syscall(__NR_ioctl, r[0], 0x541b, 0x20000780);
      break;
    case 3:
      memcpy((void*)0x20000000, "./file0", 8);
      syscall(__NR_mkdirat, 0xffffff9c, 0x20000000, 0);
      break;
    case 4:
      memcpy((void*)0x20000100, "/dev/fuse", 10);
      res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000100, 2, 0);
      if (res != -1)
        r[1] = res;
      break;
    case 5:
      memcpy((void*)0x20000200, "./file0", 8);
      memcpy((void*)0x20000300, "fuse", 5);
      memcpy((void*)0x20000400, "fd", 2);
      *(uint8_t*)0x20000402 = 0x3d;
      sprintf((char*)0x20000403, "0x%016llx", (long long)r[1]);
      *(uint8_t*)0x20000415 = 0x2c;
      memcpy((void*)0x20000416, "rootmode", 8);
      *(uint8_t*)0x2000041e = 0x3d;
      sprintf((char*)0x2000041f, "%023llo", (long long)0x4000);
      *(uint8_t*)0x20000436 = 0x2c;
      memcpy((void*)0x20000437, "user_id", 7);
      *(uint8_t*)0x2000043e = 0x3d;
      sprintf((char*)0x2000043f, "%020llu", (long long)0);
      *(uint8_t*)0x20000453 = 0x2c;
      memcpy((void*)0x20000454, "group_id", 8);
      *(uint8_t*)0x2000045c = 0x3d;
      sprintf((char*)0x2000045d, "%020llu", (long long)0);
      *(uint8_t*)0x20000471 = 0x2c;
      *(uint8_t*)0x20000472 = 0;
      syscall(__NR_mount, 0, 0x20000200, 0x20000300, 0, 0x20000400);
      break;
    case 6:
      syscall(__NR_read, r[1], 0x20001000, 0x1000);
      break;
    }
  }
  
  void execute_one()
  {
    execute(7);
    collide = 1;
    execute(7);
  }
  
  int main()
  {
    syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
    for (procid = 0; procid < 8; procid++) {
      if (fork() == 0) {
        for (;;) {
          loop();
        }
      }
    }
    sleep(1000000);
    return 0;
  }
  