#!/bin/sh

# panic: sbflush_internal: ccc 0 mb 0xfffff8004eee95f0 mbcnt 0
# cpuid = 9
# time = 1704448830
# KDB: stack backtrace:
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe016a2ccb70
# vpanic() at vpanic+0x131/frame 0xfffffe016a2ccca0
# panic() at panic+0x43/frame 0xfffffe016a2ccd00
# sbrelease_internal() at sbrelease_internal+0x7c/frame 0xfffffe016a2ccd20
# sbrelease() at sbrelease+0x5e/frame 0xfffffe016a2ccd50
# sorflush() at sorflush+0x66/frame 0xfffffe016a2ccd70
# soshutdown() at soshutdown+0x105/frame 0xfffffe016a2ccdb0
# kern_shutdown() at kern_shutdown+0x60/frame 0xfffffe016a2ccdf0
# ia32_syscall() at ia32_syscall+0x154/frame 0xfffffe016a2ccf30
# int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xffffdb44
# KDB: enter: panic
# [ thread pid 4927 tid 100275 ]
# Stopped at      : movq    $0,0xe37212(%rip)
# db> x/s version
# FreeBSD 15.0-CURRENT #0 main-n267418-24cd5c26fe3e: Fri Jan  5 08:21:43 CET 2024
# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
# db> 

[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1

. ../default.cfg
set -u
prog=$(basename "$0" .sh)
cat > /tmp/$prog.c <<EOF
// https://syzkaller.appspot.com/bug?id=a9e90e96743f3e20b4a66d9d0d4c08c57ea8cc7f
// autogenerated by syzkaller (https://github.com/google/syzkaller)
// Reported-by: syzbot+a58e1615881c01a51653@syzkaller.appspotmail.com

#define _GNU_SOURCE

#include <pwd.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <unistd.h>

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(SYS_mmap, /*addr=*/0x10000000, /*len=*/0x1000000, /*prot=*/7,
          /*flags=*/0x1012, /*fd=*/-1, /*offset=*/0);
  intptr_t res = 0;
  res = syscall(SYS_socket, /*domain=*/0x26, /*type=*/2, /*proto=*/0);
  if (res != -1)
    r[0] = res;
  syscall(SYS_shutdown, /*fd=*/(intptr_t)r[0], /*how=*/0);
  return 0;
}
EOF
mycc -o /tmp/$prog -m32 -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1

start=`date +%s`
while [ $((`date +%s` - start)) -lt 120 ]; do
	timeout 3m /tmp/$prog
done

rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core
exit 0