stress2: Add syzkaller reproducers
This commit is contained in:
Peter Holm
@@ -25,6 +25,7 @@ gnop13.sh https://people.freebsd.org/~pho/stress/log/log0386.txt 20221113
|
||||
gnop7.sh Waiting for patch commit 20190820
|
||||
gnop8.sh Waiting for patch commit 20201214
|
||||
gnop9.sh Waiting for patch commit 20201214
|
||||
graid1_3.sh Hang seen 20250915
|
||||
graid1_8.sh Known issue 20170909
|
||||
graid1_9.sh panic: Bad effnlink 20180212
|
||||
lockf5.sh Spinning threads seen 20160718
|
||||
@@ -74,10 +75,13 @@ syzkaller67.sh panic: ASan: Invalid access, 8-byte read at ... 20230621
|
||||
syzkaller80.sh panic 20250711
|
||||
syzkaller81.sh panic 20250711
|
||||
syzkaller82.sh panic: m_apply, length > size of mbuf chain 20250724
|
||||
syzkaller84.sh panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) 20250810
|
||||
syzkaller85.sh panic: Assertion uio->uio_resid < 0 failed 20250928
|
||||
syzkaller86.sh Fatal trap 12: page fault while in kernel mode 20251001
|
||||
write2.sh panic: sndbuf_acquire: count 255 > free 0 20251003
|
||||
quota3.sh https://people.freebsd.org/~pho/stress/log/log0604.txt 20250728
|
||||
quota6.sh https://people.freebsd.org/~pho/stress/log/log0456.txt 20240707
|
||||
truss3.sh WiP 20200915
|
||||
zfs18.sh https://people.freebsd.org/~pho/stress/log/log0560.txt 20241118
|
||||
zfs9.sh panic: sacked_bytes < 0 20250711
|
||||
|
||||
# Test not to run for other reasons:
|
||||
|
||||
Executable
+402
@@ -0,0 +1,402 @@
|
||||
#!/bin/sh
|
||||
|
||||
# panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) failed at ../../../kern/uipc_usrreq.c:1549
|
||||
# cpuid = 6
|
||||
# time = 1754809105
|
||||
# KDB: stack backtrace:
|
||||
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0176ef6a80
|
||||
# vpanic() at vpanic+0x136/frame 0xfffffe0176ef6bb0
|
||||
# panic() at panic+0x43/frame 0xfffffe0176ef6c10
|
||||
# uipc_soreceive_stream_or_seqpacket() at uipc_soreceive_stream_or_seqpacket+0x968/frame 0xfffffe0176ef6cd0
|
||||
# soreceive() at soreceive+0x45/frame 0xfffffe0176ef6cf0
|
||||
# kern_recvit() at kern_recvit+0x181/frame 0xfffffe0176ef6da0
|
||||
# sys_recvmsg() at sys_recvmsg+0x67/frame 0xfffffe0176ef6e00
|
||||
# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0176ef6f30
|
||||
# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0176ef6f30
|
||||
# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x821d3da8a, rsp = 0x824440f68, rbp = 0x824440f90 ---
|
||||
# KDB: enter: panic
|
||||
# [ thread pid 17448 tid 292963 ]
|
||||
# Stopped at kdb_enter+0x33: movq $0,0x12304a2(%rip)
|
||||
# db> x/s version
|
||||
# version: FreeBSD 15.0-PRERELEASE #0 main-n279510-db7c0e32a05d-dirty: Sat Aug 9 17:21:54 CEST 2025
|
||||
# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
|
||||
# db>
|
||||
|
||||
[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
|
||||
|
||||
. ../default.cfg
|
||||
set -u
|
||||
prog=$(basename "$0" .sh)
|
||||
cat > /tmp/$prog.c <<EOF
|
||||
// https://syzkaller.appspot.com/bug?id=79d6de939eb5c7de69e8e4993b6239aa0ae67335
|
||||
// autogenerated by syzkaller (https://github.com/google/syzkaller)
|
||||
// syzbot+ffcc3612ea266e36604e@syzkaller.appspotmail.com
|
||||
|
||||
#define _GNU_SOURCE
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#include <errno.h>
|
||||
#include <pthread.h>
|
||||
#include <pwd.h>
|
||||
#include <signal.h>
|
||||
#include <stdarg.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/endian.h>
|
||||
#include <sys/resource.h>
|
||||
#include <sys/syscall.h>
|
||||
#include <sys/wait.h>
|
||||
#include <time.h>
|
||||
#include <unistd.h>
|
||||
|
||||
static unsigned long long procid;
|
||||
|
||||
static void kill_and_wait(int pid, int* status)
|
||||
{
|
||||
kill(pid, SIGKILL);
|
||||
while (waitpid(-1, status, 0) != pid) {
|
||||
}
|
||||
}
|
||||
|
||||
static void sleep_ms(uint64_t ms)
|
||||
{
|
||||
usleep(ms * 1000);
|
||||
}
|
||||
|
||||
static uint64_t current_time_ms(void)
|
||||
{
|
||||
struct timespec ts;
|
||||
if (clock_gettime(CLOCK_MONOTONIC, &ts))
|
||||
exit(1);
|
||||
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
|
||||
}
|
||||
|
||||
static void thread_start(void* (*fn)(void*), void* arg)
|
||||
{
|
||||
pthread_t th;
|
||||
pthread_attr_t attr;
|
||||
pthread_attr_init(&attr);
|
||||
pthread_attr_setstacksize(&attr, 128 << 10);
|
||||
int i = 0;
|
||||
for (; i < 100; i++) {
|
||||
if (pthread_create(&th, &attr, fn, arg) == 0) {
|
||||
pthread_attr_destroy(&attr);
|
||||
return;
|
||||
}
|
||||
if (errno == EAGAIN) {
|
||||
usleep(50);
|
||||
continue;
|
||||
}
|
||||
break;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
|
||||
typedef struct {
|
||||
pthread_mutex_t mu;
|
||||
pthread_cond_t cv;
|
||||
int state;
|
||||
} event_t;
|
||||
|
||||
static void event_init(event_t* ev)
|
||||
{
|
||||
if (pthread_mutex_init(&ev->mu, 0))
|
||||
exit(1);
|
||||
if (pthread_cond_init(&ev->cv, 0))
|
||||
exit(1);
|
||||
ev->state = 0;
|
||||
}
|
||||
|
||||
static void event_reset(event_t* ev)
|
||||
{
|
||||
ev->state = 0;
|
||||
}
|
||||
|
||||
static void event_set(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
if (ev->state)
|
||||
exit(1);
|
||||
ev->state = 1;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
pthread_cond_broadcast(&ev->cv);
|
||||
}
|
||||
|
||||
static void event_wait(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
while (!ev->state)
|
||||
pthread_cond_wait(&ev->cv, &ev->mu);
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
}
|
||||
|
||||
static int event_isset(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
int res = ev->state;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
return res;
|
||||
}
|
||||
|
||||
static int event_timedwait(event_t* ev, uint64_t timeout)
|
||||
{
|
||||
uint64_t start = current_time_ms();
|
||||
uint64_t now = start;
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
for (;;) {
|
||||
if (ev->state)
|
||||
break;
|
||||
uint64_t remain = timeout - (now - start);
|
||||
struct timespec ts;
|
||||
ts.tv_sec = remain / 1000;
|
||||
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
|
||||
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
|
||||
now = current_time_ms();
|
||||
if (now - start > timeout)
|
||||
break;
|
||||
}
|
||||
int res = ev->state;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
return res;
|
||||
}
|
||||
|
||||
static void sandbox_common()
|
||||
{
|
||||
struct rlimit rlim;
|
||||
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
|
||||
setrlimit(RLIMIT_AS, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
|
||||
setrlimit(RLIMIT_MEMLOCK, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
|
||||
setrlimit(RLIMIT_FSIZE, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
|
||||
setrlimit(RLIMIT_STACK, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 0;
|
||||
setrlimit(RLIMIT_CORE, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 256;
|
||||
setrlimit(RLIMIT_NOFILE, &rlim);
|
||||
}
|
||||
|
||||
static void loop();
|
||||
|
||||
static int do_sandbox_none(void)
|
||||
{
|
||||
sandbox_common();
|
||||
loop();
|
||||
return 0;
|
||||
}
|
||||
|
||||
struct thread_t {
|
||||
int created, call;
|
||||
event_t ready, done;
|
||||
};
|
||||
|
||||
static struct thread_t threads[16];
|
||||
static void execute_call(int call);
|
||||
static int running;
|
||||
|
||||
static void* thr(void* arg)
|
||||
{
|
||||
struct thread_t* th = (struct thread_t*)arg;
|
||||
for (;;) {
|
||||
event_wait(&th->ready);
|
||||
event_reset(&th->ready);
|
||||
execute_call(th->call);
|
||||
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
|
||||
event_set(&th->done);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void execute_one(void)
|
||||
{
|
||||
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
|
||||
}
|
||||
int i, call, thread;
|
||||
for (call = 0; call < 4; call++) {
|
||||
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
|
||||
thread++) {
|
||||
struct thread_t* th = &threads[thread];
|
||||
if (!th->created) {
|
||||
th->created = 1;
|
||||
event_init(&th->ready);
|
||||
event_init(&th->done);
|
||||
event_set(&th->done);
|
||||
thread_start(thr, th);
|
||||
}
|
||||
if (!event_isset(&th->done))
|
||||
continue;
|
||||
event_reset(&th->done);
|
||||
th->call = call;
|
||||
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
|
||||
event_set(&th->ready);
|
||||
event_timedwait(&th->done, 50);
|
||||
break;
|
||||
}
|
||||
}
|
||||
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
|
||||
sleep_ms(1);
|
||||
}
|
||||
|
||||
static void execute_one(void);
|
||||
|
||||
#define WAIT_FLAGS 0
|
||||
|
||||
static void loop(void)
|
||||
{
|
||||
// int iter = 0;
|
||||
for (;; /*iter++*/) {
|
||||
int pid = fork();
|
||||
if (pid < 0)
|
||||
exit(1);
|
||||
if (pid == 0) {
|
||||
execute_one();
|
||||
exit(0);
|
||||
}
|
||||
int status = 0;
|
||||
uint64_t start = current_time_ms();
|
||||
for (;;) {
|
||||
sleep_ms(10);
|
||||
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
|
||||
break;
|
||||
if (current_time_ms() - start < 5000)
|
||||
continue;
|
||||
kill_and_wait(pid, &status);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
|
||||
|
||||
void execute_call(int call)
|
||||
{
|
||||
intptr_t res = 0;
|
||||
switch (call) {
|
||||
case 0:
|
||||
// socketpair\$unix arguments: [
|
||||
// domain: const = 0x1 (8 bytes)
|
||||
// type: unix_socket_type = 0x5 (8 bytes)
|
||||
// proto: const = 0x0 (1 bytes)
|
||||
// fds: ptr[out, unix_pair] {
|
||||
// unix_pair {
|
||||
// fd0: sock_unix (resource)
|
||||
// fd1: sock_unix (resource)
|
||||
// }
|
||||
// }
|
||||
// ]
|
||||
res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul,
|
||||
/*proto=*/0, /*fds=*/0x200000000440ul);
|
||||
if (res != -1) {
|
||||
r[0] = *(uint32_t*)0x200000000440;
|
||||
r[1] = *(uint32_t*)0x200000000444;
|
||||
}
|
||||
break;
|
||||
case 1:
|
||||
// sendmsg arguments: [
|
||||
// fd: sock (resource)
|
||||
// msg: ptr[in, send_msghdr] {
|
||||
// send_msghdr {
|
||||
// msg_name: nil
|
||||
// msg_namelen: len = 0x0 (4 bytes)
|
||||
// pad = 0x0 (4 bytes)
|
||||
// msg_iov: nil
|
||||
// msg_iovlen: len = 0x0 (8 bytes)
|
||||
// msg_control: ptr[inout, array[ANYUNION]] {
|
||||
// array[ANYUNION] {
|
||||
// union ANYUNION {
|
||||
// ANYBLOB: buffer: {04 01 00 00 ff ff 00 00 01} (length 0x9)
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// msg_controllen: bytesize = 0x104 (8 bytes)
|
||||
// msg_flags: const = 0x0 (4 bytes)
|
||||
// pad = 0x0 (4 bytes)
|
||||
// }
|
||||
// }
|
||||
// f: send_flags = 0x0 (8 bytes)
|
||||
// ]
|
||||
*(uint64_t*)0x200000000000 = 0;
|
||||
*(uint32_t*)0x200000000008 = 0;
|
||||
*(uint64_t*)0x200000000010 = 0;
|
||||
*(uint64_t*)0x200000000018 = 0;
|
||||
*(uint64_t*)0x200000000020 = 0x2000000007c0;
|
||||
memcpy((void*)0x2000000007c0, "\x04\x01\x00\x00\xff\xff\x00\x00\x01", 9);
|
||||
*(uint64_t*)0x200000000028 = 0x104;
|
||||
*(uint32_t*)0x200000000030 = 0;
|
||||
syscall(SYS_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000000ul, /*f=*/0ul);
|
||||
for (int i = 0; i < 32; i++) {
|
||||
syscall(SYS_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000000ul, /*f=*/0ul);
|
||||
}
|
||||
break;
|
||||
case 2:
|
||||
// close arguments: [
|
||||
// fd: fd (resource)
|
||||
// ]
|
||||
syscall(SYS_close, /*fd=*/r[1]);
|
||||
break;
|
||||
case 3:
|
||||
// recvmsg arguments: [
|
||||
// fd: sock (resource)
|
||||
// msg: ptr[inout, recv_msghdr] {
|
||||
// recv_msghdr {
|
||||
// msg_name: nil
|
||||
// msg_namelen: len = 0x0 (4 bytes)
|
||||
// pad = 0x0 (4 bytes)
|
||||
// msg_iov: nil
|
||||
// msg_iovlen: len = 0x0 (8 bytes)
|
||||
// msg_control: ptr[out, buffer] {
|
||||
// buffer: (DirOut)
|
||||
// }
|
||||
// msg_controllen: len = 0x19 (8 bytes)
|
||||
// msg_flags: const = 0x0 (4 bytes)
|
||||
// pad = 0x0 (4 bytes)
|
||||
// }
|
||||
// }
|
||||
// f: recv_flags = 0x80 (8 bytes)
|
||||
// ]
|
||||
*(uint64_t*)0x2000000005c0 = 0;
|
||||
*(uint32_t*)0x2000000005c8 = 0;
|
||||
*(uint64_t*)0x2000000005d0 = 0;
|
||||
*(uint64_t*)0x2000000005d8 = 0;
|
||||
*(uint64_t*)0x2000000005e0 = 0x200000000580;
|
||||
*(uint64_t*)0x2000000005e8 = 0x19;
|
||||
*(uint32_t*)0x2000000005f0 = 0;
|
||||
syscall(SYS_recvmsg, /*fd=*/r[0], /*msg=*/0x2000000005c0ul,
|
||||
/*f=MSG_DONTWAIT*/ 0x80ul);
|
||||
break;
|
||||
}
|
||||
}
|
||||
int main(void)
|
||||
{
|
||||
syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
|
||||
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
|
||||
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
|
||||
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
|
||||
const char* reason;
|
||||
(void)reason;
|
||||
for (procid = 0; procid < 4; procid++) {
|
||||
if (fork() == 0) {
|
||||
do_sandbox_none();
|
||||
}
|
||||
}
|
||||
sleep(1000000);
|
||||
return 0;
|
||||
}
|
||||
EOF
|
||||
mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
|
||||
|
||||
work=/tmp/$prog.dir
|
||||
rm -rf $work
|
||||
mkdir $work
|
||||
cd /tmp/$prog.dir
|
||||
kldstat | grep -q sctp || { kldload sctp.ko && loaded=1; }
|
||||
timeout 3m /tmp/$prog > /dev/null 2>&1
|
||||
|
||||
rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core $work
|
||||
[ $loaded ] && kldunload sctp.ko
|
||||
exit 0
|
||||
Executable
+499
@@ -0,0 +1,499 @@
|
||||
#!/bin/sh
|
||||
|
||||
# panic: Assertion uio->uio_resid < 0 failed at ../../../netlink/netlink_domain.c:808
|
||||
# cpuid = 8
|
||||
# time = 1759044376
|
||||
# KDB: stack backtrace:
|
||||
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0184d17a70
|
||||
# vpanic() at vpanic+0x136/frame 0xfffffe0184d17ba0
|
||||
# panic() at panic+0x43/frame 0xfffffe0184d17c00
|
||||
# nl_soreceive() at nl_soreceive+0x433/frame 0xfffffe0184d17ca0
|
||||
# soreceive() at soreceive+0x45/frame 0xfffffe0184d17cc0
|
||||
# kern_recvit() at kern_recvit+0x181/frame 0xfffffe0184d17d70
|
||||
# sys_recvfrom() at sys_recvfrom+0xa2/frame 0xfffffe0184d17e00
|
||||
# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0184d17f30
|
||||
# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0184d17f30
|
||||
# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x822882cca, rsp = 0x823572e88, rbp = 0x823572f90 ---
|
||||
# KDB: enter: panic
|
||||
# [ thread pid 11012 tid 138112 ]
|
||||
# Stopped at $0,0x121a722(%rip)
|
||||
# db> x/s version
|
||||
# version: FreeBSD 16.0-CURRENT #0 main-n280667-52eb7e394a7e-dirty: Sun Sep 28 08:56:14 CEST 2025
|
||||
# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
|
||||
# db>
|
||||
|
||||
[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
|
||||
|
||||
. ../default.cfg
|
||||
set -u
|
||||
prog=$(basename "$0" .sh)
|
||||
cat > /tmp/$prog.c <<EOF
|
||||
// https://syzkaller.appspot.com/bug?id=e33cdff88b17af77553159c4b372cac4e4bcd652
|
||||
// autogenerated by syzkaller (https://github.com/google/syzkaller)
|
||||
// syzbot+194f95f2c5fdffef1ef5@syzkaller.appspotmail.com
|
||||
|
||||
#define _GNU_SOURCE
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#include <dirent.h>
|
||||
#include <errno.h>
|
||||
#include <pthread.h>
|
||||
#include <pwd.h>
|
||||
#include <setjmp.h>
|
||||
#include <signal.h>
|
||||
#include <stdarg.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/endian.h>
|
||||
#include <sys/resource.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/syscall.h>
|
||||
#include <sys/wait.h>
|
||||
#include <time.h>
|
||||
#include <unistd.h>
|
||||
|
||||
static unsigned long long procid;
|
||||
|
||||
static __thread int clone_ongoing;
|
||||
static __thread int skip_segv;
|
||||
static __thread jmp_buf segv_env;
|
||||
|
||||
static void segv_handler(int sig, siginfo_t* info, void* ctx __unused)
|
||||
{
|
||||
if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
|
||||
exit(sig);
|
||||
}
|
||||
uintptr_t addr = (uintptr_t)info->si_addr;
|
||||
const uintptr_t prog_start = 1 << 20;
|
||||
const uintptr_t prog_end = 100 << 20;
|
||||
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
|
||||
int valid = addr < prog_start || addr > prog_end;
|
||||
if (sig == SIGBUS)
|
||||
valid = 1;
|
||||
if (skip && valid) {
|
||||
_longjmp(segv_env, 1);
|
||||
}
|
||||
exit(sig);
|
||||
}
|
||||
|
||||
static void install_segv_handler(void)
|
||||
{
|
||||
struct sigaction sa;
|
||||
memset(&sa, 0, sizeof(sa));
|
||||
sa.sa_sigaction = segv_handler;
|
||||
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
|
||||
sigaction(SIGSEGV, &sa, NULL);
|
||||
sigaction(SIGBUS, &sa, NULL);
|
||||
}
|
||||
|
||||
#define NONFAILING(...) \
|
||||
({ \
|
||||
int ok = 1; \
|
||||
__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
|
||||
if (_setjmp(segv_env) == 0) { \
|
||||
__VA_ARGS__; \
|
||||
} else \
|
||||
ok = 0; \
|
||||
__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
|
||||
ok; \
|
||||
})
|
||||
|
||||
static void kill_and_wait(int pid, int* status)
|
||||
{
|
||||
kill(pid, SIGKILL);
|
||||
while (waitpid(-1, status, 0) != pid) {
|
||||
}
|
||||
}
|
||||
|
||||
static void sleep_ms(uint64_t ms)
|
||||
{
|
||||
usleep(ms * 1000);
|
||||
}
|
||||
|
||||
static uint64_t current_time_ms(void)
|
||||
{
|
||||
struct timespec ts;
|
||||
if (clock_gettime(CLOCK_MONOTONIC, &ts))
|
||||
exit(1);
|
||||
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
|
||||
}
|
||||
|
||||
static void use_temporary_dir(void)
|
||||
{
|
||||
char tmpdir_template[] = "./syzkaller.XXXXXX";
|
||||
char* tmpdir = mkdtemp(tmpdir_template);
|
||||
if (!tmpdir)
|
||||
exit(1);
|
||||
if (chmod(tmpdir, 0777))
|
||||
exit(1);
|
||||
if (chdir(tmpdir))
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void reset_flags(const char* filename)
|
||||
{
|
||||
struct stat st;
|
||||
if (lstat(filename, &st))
|
||||
exit(1);
|
||||
st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE |
|
||||
SF_APPEND | UF_APPEND);
|
||||
if (lchflags(filename, st.st_flags))
|
||||
exit(1);
|
||||
}
|
||||
static void __attribute__((noinline)) remove_dir(const char* dir)
|
||||
{
|
||||
DIR* dp = opendir(dir);
|
||||
if (dp == NULL) {
|
||||
if (errno == EACCES) {
|
||||
if (rmdir(dir))
|
||||
exit(1);
|
||||
return;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
struct dirent* ep = 0;
|
||||
while ((ep = readdir(dp))) {
|
||||
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
|
||||
continue;
|
||||
char filename[FILENAME_MAX];
|
||||
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
|
||||
struct stat st;
|
||||
if (lstat(filename, &st))
|
||||
exit(1);
|
||||
if (S_ISDIR(st.st_mode)) {
|
||||
remove_dir(filename);
|
||||
continue;
|
||||
}
|
||||
if (unlink(filename)) {
|
||||
if (errno == EPERM) {
|
||||
reset_flags(filename);
|
||||
reset_flags(dir);
|
||||
if (unlink(filename) == 0)
|
||||
continue;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
closedir(dp);
|
||||
while (rmdir(dir)) {
|
||||
if (errno == EPERM) {
|
||||
reset_flags(dir);
|
||||
if (rmdir(dir) == 0)
|
||||
break;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
static void thread_start(void* (*fn)(void*), void* arg)
|
||||
{
|
||||
pthread_t th;
|
||||
pthread_attr_t attr;
|
||||
pthread_attr_init(&attr);
|
||||
pthread_attr_setstacksize(&attr, 128 << 10);
|
||||
int i = 0;
|
||||
for (; i < 100; i++) {
|
||||
if (pthread_create(&th, &attr, fn, arg) == 0) {
|
||||
pthread_attr_destroy(&attr);
|
||||
return;
|
||||
}
|
||||
if (errno == EAGAIN) {
|
||||
usleep(50);
|
||||
continue;
|
||||
}
|
||||
break;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
|
||||
typedef struct {
|
||||
pthread_mutex_t mu;
|
||||
pthread_cond_t cv;
|
||||
int state;
|
||||
} event_t;
|
||||
|
||||
static void event_init(event_t* ev)
|
||||
{
|
||||
if (pthread_mutex_init(&ev->mu, 0))
|
||||
exit(1);
|
||||
if (pthread_cond_init(&ev->cv, 0))
|
||||
exit(1);
|
||||
ev->state = 0;
|
||||
}
|
||||
|
||||
static void event_reset(event_t* ev)
|
||||
{
|
||||
ev->state = 0;
|
||||
}
|
||||
|
||||
static void event_set(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
if (ev->state)
|
||||
exit(1);
|
||||
ev->state = 1;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
pthread_cond_broadcast(&ev->cv);
|
||||
}
|
||||
|
||||
static void event_wait(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
while (!ev->state)
|
||||
pthread_cond_wait(&ev->cv, &ev->mu);
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
}
|
||||
|
||||
static int event_isset(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
int res = ev->state;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
return res;
|
||||
}
|
||||
|
||||
static int event_timedwait(event_t* ev, uint64_t timeout)
|
||||
{
|
||||
uint64_t start = current_time_ms();
|
||||
uint64_t now = start;
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
for (;;) {
|
||||
if (ev->state)
|
||||
break;
|
||||
uint64_t remain = timeout - (now - start);
|
||||
struct timespec ts;
|
||||
ts.tv_sec = remain / 1000;
|
||||
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
|
||||
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
|
||||
now = current_time_ms();
|
||||
if (now - start > timeout)
|
||||
break;
|
||||
}
|
||||
int res = ev->state;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
return res;
|
||||
}
|
||||
|
||||
static void sandbox_common()
|
||||
{
|
||||
struct rlimit rlim;
|
||||
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
|
||||
setrlimit(RLIMIT_AS, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
|
||||
setrlimit(RLIMIT_MEMLOCK, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
|
||||
setrlimit(RLIMIT_FSIZE, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
|
||||
setrlimit(RLIMIT_STACK, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 0;
|
||||
setrlimit(RLIMIT_CORE, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 256;
|
||||
setrlimit(RLIMIT_NOFILE, &rlim);
|
||||
}
|
||||
|
||||
static void loop();
|
||||
|
||||
static int do_sandbox_none(void)
|
||||
{
|
||||
sandbox_common();
|
||||
loop();
|
||||
return 0;
|
||||
}
|
||||
|
||||
struct thread_t {
|
||||
int created, call;
|
||||
event_t ready, done;
|
||||
};
|
||||
|
||||
static struct thread_t threads[16];
|
||||
static void execute_call(int call);
|
||||
static int running;
|
||||
|
||||
static void* thr(void* arg)
|
||||
{
|
||||
struct thread_t* th = (struct thread_t*)arg;
|
||||
for (;;) {
|
||||
event_wait(&th->ready);
|
||||
event_reset(&th->ready);
|
||||
execute_call(th->call);
|
||||
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
|
||||
event_set(&th->done);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void execute_one(void)
|
||||
{
|
||||
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
|
||||
}
|
||||
int i, call, thread;
|
||||
for (call = 0; call < 3; call++) {
|
||||
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
|
||||
thread++) {
|
||||
struct thread_t* th = &threads[thread];
|
||||
if (!th->created) {
|
||||
th->created = 1;
|
||||
event_init(&th->ready);
|
||||
event_init(&th->done);
|
||||
event_set(&th->done);
|
||||
thread_start(thr, th);
|
||||
}
|
||||
if (!event_isset(&th->done))
|
||||
continue;
|
||||
event_reset(&th->done);
|
||||
th->call = call;
|
||||
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
|
||||
event_set(&th->ready);
|
||||
event_timedwait(&th->done, 50);
|
||||
break;
|
||||
}
|
||||
}
|
||||
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
|
||||
sleep_ms(1);
|
||||
}
|
||||
|
||||
static void execute_one(void);
|
||||
|
||||
#define WAIT_FLAGS 0
|
||||
|
||||
static void loop(void)
|
||||
{
|
||||
int iter = 0;
|
||||
for (;; iter++) {
|
||||
char cwdbuf[32];
|
||||
sprintf(cwdbuf, "./%d", iter);
|
||||
if (mkdir(cwdbuf, 0777))
|
||||
exit(1);
|
||||
int pid = fork();
|
||||
if (pid < 0)
|
||||
exit(1);
|
||||
if (pid == 0) {
|
||||
if (chdir(cwdbuf))
|
||||
exit(1);
|
||||
execute_one();
|
||||
exit(0);
|
||||
}
|
||||
int status = 0;
|
||||
uint64_t start = current_time_ms();
|
||||
for (;;) {
|
||||
sleep_ms(10);
|
||||
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
|
||||
break;
|
||||
if (current_time_ms() - start < 5000)
|
||||
continue;
|
||||
kill_and_wait(pid, &status);
|
||||
break;
|
||||
}
|
||||
remove_dir(cwdbuf);
|
||||
}
|
||||
}
|
||||
|
||||
uint64_t r[1] = {0xffffffffffffffff};
|
||||
|
||||
void execute_call(int call)
|
||||
{
|
||||
intptr_t res = 0;
|
||||
switch (call) {
|
||||
case 0:
|
||||
// socket arguments: [
|
||||
// domain: socket_domain = 0x26 (8 bytes)
|
||||
// type: socket_type = 0x2 (8 bytes)
|
||||
// proto: int8 = 0x0 (1 bytes)
|
||||
// ]
|
||||
// returns sock
|
||||
res = syscall(SYS_socket, /*domain=AF_INET|0x24*/ 0x26ul,
|
||||
/*type=SOCK_DGRAM*/ 2ul, /*proto=*/0);
|
||||
if (res != -1)
|
||||
r[0] = res;
|
||||
break;
|
||||
case 1:
|
||||
// bind arguments: [
|
||||
// fd: sock (resource)
|
||||
// addr: ptr[in, sockaddr_storage] {
|
||||
// union sockaddr_storage {
|
||||
// in6: sockaddr_in6 {
|
||||
// len: len = 0x22 (1 bytes)
|
||||
// family: const = 0x1c (1 bytes)
|
||||
// port: proc = 0x3 (2 bytes)
|
||||
// flow: int32 = 0x0 (4 bytes)
|
||||
// addr: union ipv6_addr {
|
||||
// mcast1: ipv6_addr_multicast1 {
|
||||
// a0: const = 0xff (1 bytes)
|
||||
// a1: const = 0x1 (1 bytes)
|
||||
// a2: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00} (length
|
||||
// 0xd) a3: const = 0x1 (1 bytes)
|
||||
// }
|
||||
// }
|
||||
// scope: int32 = 0x0 (4 bytes)
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// addrlen: len = 0xc (8 bytes)
|
||||
// ]
|
||||
NONFAILING(*(uint8_t*)0x200000000040 = 0x22);
|
||||
NONFAILING(*(uint8_t*)0x200000000041 = 0x1c);
|
||||
NONFAILING(*(uint16_t*)0x200000000042 = htobe16(0x4e23 + procid * 4));
|
||||
NONFAILING(*(uint32_t*)0x200000000044 = 0);
|
||||
NONFAILING(*(uint8_t*)0x200000000048 = -1);
|
||||
NONFAILING(*(uint8_t*)0x200000000049 = 1);
|
||||
NONFAILING(memset((void*)0x20000000004a, 0, 13));
|
||||
NONFAILING(*(uint8_t*)0x200000000057 = 1);
|
||||
NONFAILING(*(uint32_t*)0x200000000058 = 0);
|
||||
syscall(SYS_bind, /*fd=*/r[0], /*addr=*/0x200000000040ul,
|
||||
/*addrlen=*/0xcul);
|
||||
break;
|
||||
case 2:
|
||||
// recvfrom\$inet arguments: [
|
||||
// fd: sock_in (resource)
|
||||
// buf: nil
|
||||
// len: len = 0x51 (8 bytes)
|
||||
// f: recv_flags = 0x401313ab1a02f21f (8 bytes)
|
||||
// addr: nil
|
||||
// addrlen: len = 0x0 (8 bytes)
|
||||
// ]
|
||||
syscall(SYS_recvfrom, /*fd=*/r[0], /*buf=*/0ul, /*len=*/0x51ul,
|
||||
/*f=MSG_PEEK|MSG_OOB|0x401313ab1a02f21c*/ 0x401313ab1a02f21ful,
|
||||
/*addr=*/0ul, /*addrlen=*/0ul);
|
||||
break;
|
||||
}
|
||||
}
|
||||
int main(void)
|
||||
{
|
||||
syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
|
||||
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
|
||||
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
|
||||
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
|
||||
const char* reason;
|
||||
(void)reason;
|
||||
install_segv_handler();
|
||||
for (procid = 0; procid < 4; procid++) {
|
||||
if (fork() == 0) {
|
||||
use_temporary_dir();
|
||||
do_sandbox_none();
|
||||
}
|
||||
}
|
||||
sleep(1000000);
|
||||
return 0;
|
||||
}
|
||||
EOF
|
||||
mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
|
||||
|
||||
(cd ../testcases/swap; ./swap -t 5m -i 20 -l 100 > /dev/null 2>&1) &
|
||||
sleep 5
|
||||
|
||||
work=/tmp/$prog.dir
|
||||
rm -rf $work
|
||||
mkdir $work
|
||||
cd /tmp/$prog.dir
|
||||
|
||||
timeout 5m /tmp/$prog > /dev/null 2>&1
|
||||
|
||||
while pkill swap; do :; done
|
||||
wait
|
||||
|
||||
rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/syzkaller.?????? $work
|
||||
exit 0
|
||||
Executable
+555
@@ -0,0 +1,555 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Fatal trap 12: page fault while in kernel mode
|
||||
# cpuid = 1; apic id = 01
|
||||
# fault virtual address = 0x18
|
||||
# fault code = supervisor read data, page not present
|
||||
# instruction pointer = 0x20:0xffffffff80b69835
|
||||
# stack pointer = 0x28:0xfffffe00ff8e7d90
|
||||
# frame pointer = 0x28:0xfffffe00ff8e7d90
|
||||
# code segment = base 0x0, limit 0xfffff, type 0x1b
|
||||
# = DPL 0, pres 1, long 1, def32 0, gran 1
|
||||
# processor eflags = interrupt enabled, resume, IOPL = 0
|
||||
# current process = 0 (thread taskq)
|
||||
# rdi: 0000000000000018 rsi: 0000000000000004 rdx: ffffffff812b3f65
|
||||
# rcx: 00000000000008ba r8: fffff800044b8780 r9: fffff80003397000
|
||||
# rax: 0000000000000001 rbx: fffff8004221fa00 rbp: fffffe00ff8e7d90
|
||||
# r10: 0000000000000001 r11: fffffe00dc47b000 r12: fffffe0177ed0000
|
||||
# r13: fffff800044b8780 r14: fffff8004221f800 r15: fffff8004221f800
|
||||
# trap number = 12
|
||||
# panic: page fault
|
||||
# cpuid = 1
|
||||
# time = 1759322830
|
||||
# KDB: stack backtrace:
|
||||
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00ff8e7ac0
|
||||
# vpanic() at vpanic+0x136/frame 0xfffffe00ff8e7bf0
|
||||
# panic() at panic+0x43/frame 0xfffffe00ff8e7c50
|
||||
# trap_pfault() at trap_pfault+0x47c/frame 0xfffffe00ff8e7cc0
|
||||
# calltrap() at calltrap+0x8/frame 0xfffffe00ff8e7cc0
|
||||
# --- trap 0xc, rip = 0xffffffff80b69835, rsp = 0xfffffe00ff8e7d90, rbp = 0xfffffe00ff8e7d90 ---
|
||||
# __mtx_assert() at __mtx_assert+0x35/frame 0xfffffe00ff8e7d90
|
||||
# ktls_check_rx() at ktls_check_rx+0x2f/frame 0xfffffe00ff8e7dd0
|
||||
# socantrcvmore() at socantrcvmore+0x5e/frame 0xfffffe00ff8e7df0
|
||||
# unp_gc() at unp_gc+0x5df/frame 0xfffffe00ff8e7e40
|
||||
# taskqueue_run_locked() at taskqueue_run_locked+0x1c2/frame 0xfffffe00ff8e7ec0
|
||||
# taskqueue_thread_loop() at taskqueue_thread_loop+0xd3/frame 0xfffffe00ff8e7ef0
|
||||
# fork_exit() at fork_exit+0x82/frame 0xfffffe00ff8e7f30
|
||||
# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00ff8e7f30
|
||||
# --- trap 0, rip = 0, rsp = 0, rbp = 0 ---
|
||||
# KDB: enter: panic
|
||||
# [ thread pid 0 tid 100045 ]
|
||||
# Stopped at kdb_enter+0x33: movq $0,0x121a9e2(%rip)
|
||||
# db> x/s version
|
||||
# version: FreeBSD 16.0-CURRENT #0 vmfqe-n280784-b7f165e45d6d: Wed Oct 1 13:48:43 CEST 2025
|
||||
# pho@mercat1.netperf.freebsd.org:/var/tmp/deviant3/sys/amd64/compile/PHO
|
||||
# db>
|
||||
|
||||
[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
|
||||
|
||||
. ../default.cfg
|
||||
set -u
|
||||
prog=$(basename "$0" .sh)
|
||||
cat > /tmp/$prog.c <<EOF
|
||||
// https://syzkaller.appspot.com/bug?id=ec40fe3e3e2b41218d1d417bc10d0be2517bf751
|
||||
// autogenerated by syzkaller (https://github.com/google/syzkaller)
|
||||
// syzbot+a62883292a5c257703be@syzkaller.appspotmail.com
|
||||
|
||||
#define _GNU_SOURCE
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#include <dirent.h>
|
||||
#include <errno.h>
|
||||
#include <pthread.h>
|
||||
#include <pwd.h>
|
||||
#include <signal.h>
|
||||
#include <stdarg.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/endian.h>
|
||||
#include <sys/resource.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/syscall.h>
|
||||
#include <sys/wait.h>
|
||||
#include <time.h>
|
||||
#include <unistd.h>
|
||||
|
||||
static unsigned long long procid;
|
||||
|
||||
static void kill_and_wait(int pid, int* status)
|
||||
{
|
||||
kill(pid, SIGKILL);
|
||||
while (waitpid(-1, status, 0) != pid) {
|
||||
}
|
||||
}
|
||||
|
||||
static void sleep_ms(uint64_t ms)
|
||||
{
|
||||
usleep(ms * 1000);
|
||||
}
|
||||
|
||||
static uint64_t current_time_ms(void)
|
||||
{
|
||||
struct timespec ts;
|
||||
if (clock_gettime(CLOCK_MONOTONIC, &ts))
|
||||
exit(1);
|
||||
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
|
||||
}
|
||||
|
||||
static void use_temporary_dir(void)
|
||||
{
|
||||
char tmpdir_template[] = "./syzkaller.XXXXXX";
|
||||
char* tmpdir = mkdtemp(tmpdir_template);
|
||||
if (!tmpdir)
|
||||
exit(1);
|
||||
if (chmod(tmpdir, 0777))
|
||||
exit(1);
|
||||
if (chdir(tmpdir))
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void reset_flags(const char* filename)
|
||||
{
|
||||
struct stat st;
|
||||
if (lstat(filename, &st))
|
||||
exit(1);
|
||||
st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE |
|
||||
SF_APPEND | UF_APPEND);
|
||||
if (lchflags(filename, st.st_flags))
|
||||
exit(1);
|
||||
}
|
||||
static void __attribute__((noinline)) remove_dir(const char* dir)
|
||||
{
|
||||
DIR* dp = opendir(dir);
|
||||
if (dp == NULL) {
|
||||
if (errno == EACCES) {
|
||||
if (rmdir(dir))
|
||||
exit(1);
|
||||
return;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
struct dirent* ep = 0;
|
||||
while ((ep = readdir(dp))) {
|
||||
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
|
||||
continue;
|
||||
char filename[FILENAME_MAX];
|
||||
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
|
||||
struct stat st;
|
||||
if (lstat(filename, &st))
|
||||
exit(1);
|
||||
if (S_ISDIR(st.st_mode)) {
|
||||
remove_dir(filename);
|
||||
continue;
|
||||
}
|
||||
if (unlink(filename)) {
|
||||
if (errno == EPERM) {
|
||||
reset_flags(filename);
|
||||
reset_flags(dir);
|
||||
if (unlink(filename) == 0)
|
||||
continue;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
closedir(dp);
|
||||
while (rmdir(dir)) {
|
||||
if (errno == EPERM) {
|
||||
reset_flags(dir);
|
||||
if (rmdir(dir) == 0)
|
||||
break;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
static void thread_start(void* (*fn)(void*), void* arg)
|
||||
{
|
||||
pthread_t th;
|
||||
pthread_attr_t attr;
|
||||
pthread_attr_init(&attr);
|
||||
pthread_attr_setstacksize(&attr, 128 << 10);
|
||||
int i = 0;
|
||||
for (; i < 100; i++) {
|
||||
if (pthread_create(&th, &attr, fn, arg) == 0) {
|
||||
pthread_attr_destroy(&attr);
|
||||
return;
|
||||
}
|
||||
if (errno == EAGAIN) {
|
||||
usleep(50);
|
||||
continue;
|
||||
}
|
||||
break;
|
||||
}
|
||||
exit(1);
|
||||
}
|
||||
|
||||
typedef struct {
|
||||
pthread_mutex_t mu;
|
||||
pthread_cond_t cv;
|
||||
int state;
|
||||
} event_t;
|
||||
|
||||
static void event_init(event_t* ev)
|
||||
{
|
||||
if (pthread_mutex_init(&ev->mu, 0))
|
||||
exit(1);
|
||||
if (pthread_cond_init(&ev->cv, 0))
|
||||
exit(1);
|
||||
ev->state = 0;
|
||||
}
|
||||
|
||||
static void event_reset(event_t* ev)
|
||||
{
|
||||
ev->state = 0;
|
||||
}
|
||||
|
||||
static void event_set(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
if (ev->state)
|
||||
exit(1);
|
||||
ev->state = 1;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
pthread_cond_broadcast(&ev->cv);
|
||||
}
|
||||
|
||||
static void event_wait(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
while (!ev->state)
|
||||
pthread_cond_wait(&ev->cv, &ev->mu);
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
}
|
||||
|
||||
static int event_isset(event_t* ev)
|
||||
{
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
int res = ev->state;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
return res;
|
||||
}
|
||||
|
||||
static int event_timedwait(event_t* ev, uint64_t timeout)
|
||||
{
|
||||
uint64_t start = current_time_ms();
|
||||
uint64_t now = start;
|
||||
pthread_mutex_lock(&ev->mu);
|
||||
for (;;) {
|
||||
if (ev->state)
|
||||
break;
|
||||
uint64_t remain = timeout - (now - start);
|
||||
struct timespec ts;
|
||||
ts.tv_sec = remain / 1000;
|
||||
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
|
||||
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
|
||||
now = current_time_ms();
|
||||
if (now - start > timeout)
|
||||
break;
|
||||
}
|
||||
int res = ev->state;
|
||||
pthread_mutex_unlock(&ev->mu);
|
||||
return res;
|
||||
}
|
||||
|
||||
static void sandbox_common()
|
||||
{
|
||||
struct rlimit rlim;
|
||||
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
|
||||
setrlimit(RLIMIT_AS, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
|
||||
setrlimit(RLIMIT_MEMLOCK, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
|
||||
setrlimit(RLIMIT_FSIZE, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
|
||||
setrlimit(RLIMIT_STACK, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 0;
|
||||
setrlimit(RLIMIT_CORE, &rlim);
|
||||
rlim.rlim_cur = rlim.rlim_max = 256;
|
||||
setrlimit(RLIMIT_NOFILE, &rlim);
|
||||
}
|
||||
|
||||
static void loop();
|
||||
|
||||
static int do_sandbox_none(void)
|
||||
{
|
||||
sandbox_common();
|
||||
loop();
|
||||
return 0;
|
||||
}
|
||||
|
||||
struct thread_t {
|
||||
int created, call;
|
||||
event_t ready, done;
|
||||
};
|
||||
|
||||
static struct thread_t threads[16];
|
||||
static void execute_call(int call);
|
||||
static int running;
|
||||
|
||||
static void* thr(void* arg)
|
||||
{
|
||||
struct thread_t* th = (struct thread_t*)arg;
|
||||
for (;;) {
|
||||
event_wait(&th->ready);
|
||||
event_reset(&th->ready);
|
||||
execute_call(th->call);
|
||||
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
|
||||
event_set(&th->done);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void execute_one(void)
|
||||
{
|
||||
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
|
||||
}
|
||||
int i, call, thread;
|
||||
for (call = 0; call < 8; call++) {
|
||||
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
|
||||
thread++) {
|
||||
struct thread_t* th = &threads[thread];
|
||||
if (!th->created) {
|
||||
th->created = 1;
|
||||
event_init(&th->ready);
|
||||
event_init(&th->done);
|
||||
event_set(&th->done);
|
||||
thread_start(thr, th);
|
||||
}
|
||||
if (!event_isset(&th->done))
|
||||
continue;
|
||||
event_reset(&th->done);
|
||||
th->call = call;
|
||||
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
|
||||
event_set(&th->ready);
|
||||
event_timedwait(&th->done, 50);
|
||||
break;
|
||||
}
|
||||
}
|
||||
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
|
||||
sleep_ms(1);
|
||||
}
|
||||
|
||||
static void execute_one(void);
|
||||
|
||||
#define WAIT_FLAGS 0
|
||||
|
||||
static void loop(void)
|
||||
{
|
||||
int iter = 0;
|
||||
for (;; iter++) {
|
||||
char cwdbuf[32];
|
||||
sprintf(cwdbuf, "./%d", iter);
|
||||
if (mkdir(cwdbuf, 0777))
|
||||
exit(1);
|
||||
int pid = fork();
|
||||
if (pid < 0)
|
||||
exit(1);
|
||||
if (pid == 0) {
|
||||
if (chdir(cwdbuf))
|
||||
exit(1);
|
||||
execute_one();
|
||||
exit(0);
|
||||
}
|
||||
int status = 0;
|
||||
uint64_t start = current_time_ms();
|
||||
for (;;) {
|
||||
sleep_ms(10);
|
||||
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
|
||||
break;
|
||||
if (current_time_ms() - start < 5000)
|
||||
continue;
|
||||
kill_and_wait(pid, &status);
|
||||
break;
|
||||
}
|
||||
remove_dir(cwdbuf);
|
||||
}
|
||||
}
|
||||
|
||||
uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
|
||||
|
||||
void execute_call(int call)
|
||||
{
|
||||
intptr_t res = 0;
|
||||
switch (call) {
|
||||
case 0:
|
||||
// freebsd10_pipe arguments: [
|
||||
// pipefd: ptr[out, pipefd] {
|
||||
// pipefd {
|
||||
// rfd: fd (resource)
|
||||
// wfd: fd (resource)
|
||||
// }
|
||||
// }
|
||||
// ]
|
||||
res = syscall(SYS_freebsd10_pipe, /*pipefd=*/0x2000000001c0ul);
|
||||
if (res != -1)
|
||||
r[0] = *(uint32_t*)0x2000000001c4;
|
||||
break;
|
||||
case 1:
|
||||
// close arguments: [
|
||||
// fd: fd (resource)
|
||||
// ]
|
||||
syscall(SYS_close, /*fd=*/r[0]);
|
||||
break;
|
||||
case 2:
|
||||
// socket\$unix arguments: [
|
||||
// domain: const = 0x1 (8 bytes)
|
||||
// type: unix_socket_type = 0x5 (8 bytes)
|
||||
// proto: const = 0x0 (1 bytes)
|
||||
// ]
|
||||
// returns sock_unix
|
||||
res = syscall(SYS_socket, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul,
|
||||
/*proto=*/0);
|
||||
if (res != -1)
|
||||
r[1] = res;
|
||||
break;
|
||||
case 3:
|
||||
// bind\$unix arguments: [
|
||||
// fd: sock_unix (resource)
|
||||
// addr: ptr[in, sockaddr_un] {
|
||||
// union sockaddr_un {
|
||||
// file: sockaddr_un_file {
|
||||
// len: len = 0xa (1 bytes)
|
||||
// family: unix_socket_family = 0x1 (1 bytes)
|
||||
// path: buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// addrlen: len = 0xa (8 bytes)
|
||||
// ]
|
||||
*(uint8_t*)0x2000000002c0 = 0xa;
|
||||
*(uint8_t*)0x2000000002c1 = 1;
|
||||
memcpy((void*)0x2000000002c2, "./file1\000", 8);
|
||||
syscall(SYS_bind, /*fd=*/r[1], /*addr=*/0x2000000002c0ul,
|
||||
/*addrlen=*/0xaul);
|
||||
break;
|
||||
case 4:
|
||||
// listen arguments: [
|
||||
// fd: sock (resource)
|
||||
// backlog: int32 = 0xfffffffe (4 bytes)
|
||||
// ]
|
||||
syscall(SYS_listen, /*fd=*/r[1], /*backlog=*/0xfffffffe);
|
||||
break;
|
||||
case 5:
|
||||
// sendmsg\$unix arguments: [
|
||||
// fd: sock_unix (resource)
|
||||
// msg: ptr[in, msghdr_un] {
|
||||
// msghdr_un {
|
||||
// addr: nil
|
||||
// addrlen: len = 0x0 (4 bytes)
|
||||
// pad = 0x0 (4 bytes)
|
||||
// vec: nil
|
||||
// vlen: len = 0x0 (8 bytes)
|
||||
// ctrl: ptr[inout, array[ANYUNION]] {
|
||||
// array[ANYUNION] {
|
||||
// union ANYUNION {
|
||||
// ANYBLOB: buffer: {89 00 00 00 ff ff 00 00 01} (length 0x9)
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// ctrllen: bytesize = 0x9 (8 bytes)
|
||||
// f: send_flags = 0x0 (4 bytes)
|
||||
// pad = 0x0 (4 bytes)
|
||||
// }
|
||||
// }
|
||||
// f: send_flags = 0x0 (8 bytes)
|
||||
// ]
|
||||
*(uint64_t*)0x200000000080 = 0;
|
||||
*(uint32_t*)0x200000000088 = 0;
|
||||
*(uint64_t*)0x200000000090 = 0;
|
||||
*(uint64_t*)0x200000000098 = 0;
|
||||
*(uint64_t*)0x2000000000a0 = 0x200000000000;
|
||||
memcpy((void*)0x200000000000, "\x89\x00\x00\x00\xff\xff\x00\x00\x01", 9);
|
||||
*(uint64_t*)0x2000000000a8 = 9;
|
||||
*(uint32_t*)0x2000000000b0 = 0;
|
||||
syscall(SYS_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0x200000000080ul,
|
||||
/*f=*/0ul);
|
||||
break;
|
||||
case 6:
|
||||
// socketpair\$unix arguments: [
|
||||
// domain: const = 0x1 (8 bytes)
|
||||
// type: unix_socket_type = 0x2 (8 bytes)
|
||||
// proto: const = 0x0 (1 bytes)
|
||||
// fds: ptr[out, unix_pair] {
|
||||
// unix_pair {
|
||||
// fd0: sock_unix (resource)
|
||||
// fd1: sock_unix (resource)
|
||||
// }
|
||||
// }
|
||||
// ]
|
||||
res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_DGRAM*/ 2ul,
|
||||
/*proto=*/0, /*fds=*/0x200000000040ul);
|
||||
if (res != -1)
|
||||
r[2] = *(uint32_t*)0x200000000040;
|
||||
break;
|
||||
case 7:
|
||||
// sendmsg arguments: [
|
||||
// fd: sock (resource)
|
||||
// msg: ptr[in, send_msghdr] {
|
||||
// send_msghdr {
|
||||
// msg_name: nil
|
||||
// msg_namelen: len = 0x32c (4 bytes)
|
||||
// pad = 0x0 (4 bytes)
|
||||
// msg_iov: nil
|
||||
// msg_iovlen: len = 0x0 (8 bytes)
|
||||
// msg_control: ptr[in, array[cmsghdr]] {
|
||||
// array[cmsghdr] {
|
||||
// }
|
||||
// }
|
||||
// msg_controllen: bytesize = 0x90 (8 bytes)
|
||||
// msg_flags: const = 0x0 (4 bytes)
|
||||
// pad = 0x0 (4 bytes)
|
||||
// }
|
||||
// }
|
||||
// f: send_flags = 0x0 (8 bytes)
|
||||
// ]
|
||||
*(uint64_t*)0x200000000380 = 0;
|
||||
*(uint32_t*)0x200000000388 = 0x32c;
|
||||
*(uint64_t*)0x200000000390 = 0;
|
||||
*(uint64_t*)0x200000000398 = 0;
|
||||
*(uint64_t*)0x2000000003a0 = 0x200000000000;
|
||||
*(uint64_t*)0x2000000003a8 = 0x90;
|
||||
*(uint32_t*)0x2000000003b0 = 0;
|
||||
syscall(SYS_sendmsg, /*fd=*/r[2], /*msg=*/0x200000000380ul, /*f=*/0ul);
|
||||
break;
|
||||
}
|
||||
}
|
||||
int main(void)
|
||||
{
|
||||
syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
|
||||
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
|
||||
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
|
||||
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
|
||||
const char* reason;
|
||||
(void)reason;
|
||||
for (procid = 0; procid < 4; procid++) {
|
||||
if (fork() == 0) {
|
||||
use_temporary_dir();
|
||||
do_sandbox_none();
|
||||
}
|
||||
}
|
||||
sleep(1000000);
|
||||
return 0;
|
||||
}
|
||||
EOF
|
||||
mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
|
||||
|
||||
work=/tmp/$prog.dir
|
||||
rm -rf $work
|
||||
mkdir $work
|
||||
cd /tmp/$prog.dir
|
||||
for i in `jot 30`; do
|
||||
(
|
||||
mkdir d$i
|
||||
cd d$i
|
||||
timeout 3m /tmp/$prog > /dev/null 2>&1 &
|
||||
)
|
||||
done
|
||||
while pgrep -q $prog; do sleep 2; done
|
||||
wait
|
||||
|
||||
rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core $work
|
||||
exit 0
|
||||
Reference in New Issue
Block a user