1 // https://syzkaller.appspot.com/bug?id=99f4ea77bb9b9ef24cefb66469be319f4aa9f162
2 // autogenerated by syzkaller (https://github.com/google/syzkaller)
3
4 #include <dirent.h>
5 #include <endian.h>
6 #include <errno.h>
7 #include <fcntl.h>
8 #include <signal.h>
9 #include <stdarg.h>
10 #include <stdbool.h>
11 #include <stdint.h>
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <string.h>
15 #include <sys/mman.h>
16 #include <sys/prctl.h>
17 #include <sys/stat.h>
18 #include <sys/types.h>
19 #include <sys/wait.h>
20 #include <time.h>
21 #include <unistd.h>
22
23 #include "liburing.h"
24 #include "../src/syscall.h"
25
sleep_ms(uint64_t ms)26 static void sleep_ms(uint64_t ms)
27 {
28 usleep(ms * 1000);
29 }
30
current_time_ms(void)31 static uint64_t current_time_ms(void)
32 {
33 struct timespec ts;
34 if (clock_gettime(CLOCK_MONOTONIC, &ts))
35 exit(1);
36 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
37 }
38
write_file(const char * file,const char * what,...)39 static bool write_file(const char* file, const char* what, ...)
40 {
41 char buf[1024];
42 va_list args;
43 va_start(args, what);
44 vsnprintf(buf, sizeof(buf), what, args);
45 va_end(args);
46 buf[sizeof(buf) - 1] = 0;
47 int len = strlen(buf);
48 int fd = open(file, O_WRONLY | O_CLOEXEC);
49 if (fd == -1)
50 return false;
51 if (write(fd, buf, len) != len) {
52 int err = errno;
53 close(fd);
54 errno = err;
55 return false;
56 }
57 close(fd);
58 return true;
59 }
60
61 #define SIZEOF_IO_URING_SQE 64
62 #define SIZEOF_IO_URING_CQE 16
63 #define SQ_HEAD_OFFSET 0
64 #define SQ_TAIL_OFFSET 64
65 #define SQ_RING_MASK_OFFSET 256
66 #define SQ_RING_ENTRIES_OFFSET 264
67 #define SQ_FLAGS_OFFSET 276
68 #define SQ_DROPPED_OFFSET 272
69 #define CQ_HEAD_OFFSET 128
70 #define CQ_TAIL_OFFSET 192
71 #define CQ_RING_MASK_OFFSET 260
72 #define CQ_RING_ENTRIES_OFFSET 268
73 #define CQ_RING_OVERFLOW_OFFSET 284
74 #define CQ_FLAGS_OFFSET 280
75 #define CQ_CQES_OFFSET 320
76
syz_io_uring_setup(volatile long a0,volatile long a1,volatile long a2,volatile long a3,volatile long a4,volatile long a5)77 static long syz_io_uring_setup(volatile long a0, volatile long a1,
78 volatile long a2, volatile long a3,
79 volatile long a4, volatile long a5)
80 {
81 uint32_t entries = (uint32_t)a0;
82 struct io_uring_params* setup_params = (struct io_uring_params*)a1;
83 void* vma1 = (void*)a2;
84 void* vma2 = (void*)a3;
85 void** ring_ptr_out = (void**)a4;
86 void** sqes_ptr_out = (void**)a5;
87 uint32_t fd_io_uring = __sys_io_uring_setup(entries, setup_params);
88 uint32_t sq_ring_sz =
89 setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
90 uint32_t cq_ring_sz = setup_params->cq_off.cqes +
91 setup_params->cq_entries * SIZEOF_IO_URING_CQE;
92 uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
93 *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE,
94 MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
95 IORING_OFF_SQ_RING);
96 uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
97 *sqes_ptr_out =
98 mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE,
99 MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES);
100 return fd_io_uring;
101 }
102
kill_and_wait(int pid,int * status)103 static void kill_and_wait(int pid, int* status)
104 {
105 kill(-pid, SIGKILL);
106 kill(pid, SIGKILL);
107 for (int i = 0; i < 100; i++) {
108 if (waitpid(-1, status, WNOHANG | __WALL) == pid)
109 return;
110 usleep(1000);
111 }
112 DIR* dir = opendir("/sys/fs/fuse/connections");
113 if (dir) {
114 for (;;) {
115 struct dirent* ent = readdir(dir);
116 if (!ent)
117 break;
118 if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
119 continue;
120 char abort[300];
121 snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
122 ent->d_name);
123 int fd = open(abort, O_WRONLY);
124 if (fd == -1) {
125 continue;
126 }
127 if (write(fd, abort, 1) < 0) {
128 }
129 close(fd);
130 }
131 closedir(dir);
132 } else {
133 }
134 while (waitpid(-1, status, __WALL) != pid) {
135 }
136 }
137
setup_test()138 static void setup_test()
139 {
140 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
141 setpgrp();
142 write_file("/proc/self/oom_score_adj", "1000");
143 }
144
145 static void execute_one(void);
146
147 #define WAIT_FLAGS __WALL
148
loop(void)149 static void loop(void)
150 {
151 int iter = 0;
152 for (; iter < 100; iter++) {
153 int pid = fork();
154 if (pid < 0)
155 exit(1);
156 if (pid == 0) {
157 setup_test();
158 execute_one();
159 exit(0);
160 }
161 int status = 0;
162 uint64_t start = current_time_ms();
163 for (;;) {
164 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
165 break;
166 sleep_ms(1);
167 if (current_time_ms() - start < 5000) {
168 continue;
169 }
170 kill_and_wait(pid, &status);
171 break;
172 }
173 }
174 }
175
execute_one(void)176 void execute_one(void)
177 {
178 *(uint32_t*)0x20000044 = 0;
179 *(uint32_t*)0x20000048 = 0x42;
180 *(uint32_t*)0x2000004c = 0;
181 *(uint32_t*)0x20000050 = 0;
182 *(uint32_t*)0x20000058 = -1;
183 *(uint32_t*)0x2000005c = 0;
184 *(uint32_t*)0x20000060 = 0;
185 *(uint32_t*)0x20000064 = 0;
186 syz_io_uring_setup(0x74bc, 0x20000040, 0x20ffb000, 0x20ffc000, 0, 0);
187 }
main(void)188 int main(void)
189 {
190 mmap((void *)0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
191 mmap((void *)0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
192 mmap((void *)0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
193 loop();
194 return 0;
195 }
196