// https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/fcntl.h>
#include <unistd.h>

#include <errno.h>

#include <linux/fb.h>

int verbose = 0;

void
dumpit(unsigned char *buf, int count, int addr)
{
    int i, j;
    char bp[256];

    memset(bp, 0, 256);

    for (i = j = 0; i < count; i++, j++) {
        if (j == 16) {
            j = 0;
            printf("%s\n", bp);
            memset(bp, 0, 256);
        }
        if (j == 0) {
            sprintf(&bp[strlen(bp)], "%x: ", addr + i);
        }
        sprintf(&bp[strlen(bp)], "%02x ", buf[i]);
    }
    if (j != 0) {
        printf("%s\n", bp);
    }
}

uint64_t r[1] = {0xffffffffffffffff};

int main(int argc, char **argv)
{
  syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0);
  intptr_t res = 0;
  uint32_t activate = FB_ACTIVATE_NOW;
  struct fb_var_screeninfo *varp = (struct fb_var_screeninfo *)0x200001c0;
  struct fb_var_screeninfo *starting_varp = malloc(sizeof(struct fb_var_screeninfo *));
  char *vp = (char *)varp;
  int i, sum, rtn, c;
  extern char *optarg;
  int limit = 0, passes = 0;
  unsigned int start_address = 0;
  unsigned int pattern = 0;
  int breakit = 1;
	
	while ((c = getopt (argc, argv, "a:v")) != -1)
	switch (c)
	{
	case 'a':
		activate = strtol(optarg, 0, 0);
		break;
	case 'v':
		verbose++;
		break;
	default:
		fprintf(stderr, "\nusage: %s [-a <activate code>] [-v]\n\n", argv[0]);
		return -1;
	}

	int fd = open("/dev/fb0", O_RDWR);
	if (fd < 0) {
		perror("open");
		return 0;
	}
	printf("fd: %d\n", fd);
	r[0] = fd;


	rtn = syscall(__NR_ioctl, r[0], 0x4600ul, 0x200001c0ul);
	if (rtn < 0) {
		perror("ioctl");
		fprintf(stderr, "rtn=%d, errno=%d\n", rtn, errno);
	}

	if (verbose) {
		printf("FBIOGET_VSCREENINFO:\n");
		dumpit((unsigned char *)vp, sizeof(struct fb_var_screeninfo), 0x200001c0);
	}

	memcpy(starting_varp, varp, sizeof(struct fb_var_screeninfo));

	fprintf(stderr, "activate = %d\n", activate);

	varp->activate = activate;

	if (verbose) {
		printf("Pre FBIOPUT_VSCREENINFO:\n");
		dumpit((unsigned char *)vp, sizeof(struct fb_var_screeninfo), 0x200001c0);

		sleep(2);
	}

	rtn = syscall(__NR_ioctl, r[0], 0x4601ul, 0x200001c0ul);
	if (rtn < 0) {
		perror("ioctl");
		fprintf(stderr, "rtn=%d, errno=%d\n", rtn, errno);
	}
	limit = 2;
	for (pattern = 0 ; pattern < 8 ; pattern++) {
		unsigned long addr = 0x200001c0;
		passes = 0;
		printf("\nWalk START addr = 0x%x, Break pattern=%x\n", addr, pattern);
		while (addr <= 0x2000025c) {
			fprintf(stderr, "======================== %d: addr=%x ========================\n", passes, addr);
			memcpy(varp, starting_varp, sizeof(struct fb_var_screeninfo));
			*(uint32_t*)addr = pattern;
			varp->activate = activate;
			printf("Pre FBIOPUT_VSCREENINFO: pattern=%x\n", pattern);
			dumpit((unsigned char *)vp, sizeof(struct fb_var_screeninfo), 0x200001c0);
			sleep(3);
			rtn = syscall(__NR_ioctl, r[0], 0x4601ul, 0x200001c0ul);
			if (rtn < 0) {
				perror("ioctl");
				fprintf(stderr, "rtn=%d, errno=%d\n", rtn, errno);
			}
			addr += 4;
			passes++;
			if (passes == limit)
				break;
		}
	}
	close(fd);

	return 0;
}