1 /* SPDX-License-Identifier: MIT */
2 // https://syzkaller.appspot.com/bug?id=99f4ea77bb9b9ef24cefb66469be319f4aa9f162
3 // autogenerated by syzkaller (https://github.com/google/syzkaller)
4
5 #include <dirent.h>
6 #include <endian.h>
7 #include <errno.h>
8 #include <fcntl.h>
9 #include <signal.h>
10 #include <stdarg.h>
11 #include <stdbool.h>
12 #include <stdint.h>
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/mman.h>
17 #include <sys/prctl.h>
18 #include <sys/stat.h>
19 #include <sys/types.h>
20 #include <sys/wait.h>
21 #include <time.h>
22 #include <unistd.h>
23
24 #include "liburing.h"
25 #include "helpers.h"
26 #include "../src/syscall.h"
27
28 #ifndef CONFIG_USE_SANITIZER
sleep_ms(uint64_t ms)29 static void sleep_ms(uint64_t ms)
30 {
31 usleep(ms * 1000);
32 }
33
current_time_ms(void)34 static uint64_t current_time_ms(void)
35 {
36 struct timespec ts;
37 if (clock_gettime(CLOCK_MONOTONIC, &ts))
38 exit(1);
39 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
40 }
41
write_file(const char * file,const char * what,...)42 static bool write_file(const char* file, const char* what, ...)
43 {
44 char buf[1024];
45 va_list args;
46 va_start(args, what);
47 vsnprintf(buf, sizeof(buf), what, args);
48 va_end(args);
49 buf[sizeof(buf) - 1] = 0;
50 int len = strlen(buf);
51 int fd = open(file, O_WRONLY | O_CLOEXEC);
52 if (fd == -1)
53 return false;
54 if (write(fd, buf, len) != len) {
55 int err = errno;
56 close(fd);
57 errno = err;
58 return false;
59 }
60 close(fd);
61 return true;
62 }
63
64 #define SIZEOF_IO_URING_SQE 64
65 #define SIZEOF_IO_URING_CQE 16
66 #define SQ_HEAD_OFFSET 0
67 #define SQ_TAIL_OFFSET 64
68 #define SQ_RING_MASK_OFFSET 256
69 #define SQ_RING_ENTRIES_OFFSET 264
70 #define SQ_FLAGS_OFFSET 276
71 #define SQ_DROPPED_OFFSET 272
72 #define CQ_HEAD_OFFSET 128
73 #define CQ_TAIL_OFFSET 192
74 #define CQ_RING_MASK_OFFSET 260
75 #define CQ_RING_ENTRIES_OFFSET 268
76 #define CQ_RING_OVERFLOW_OFFSET 284
77 #define CQ_FLAGS_OFFSET 280
78 #define CQ_CQES_OFFSET 320
79
syz_io_uring_setup(volatile long a0,volatile long a1,volatile long a2,volatile long a3,volatile long a4,volatile long a5)80 static long syz_io_uring_setup(volatile long a0, volatile long a1,
81 volatile long a2, volatile long a3,
82 volatile long a4, volatile long a5)
83 {
84 uint32_t entries = (uint32_t)a0;
85 struct io_uring_params* setup_params = (struct io_uring_params*)a1;
86 void* vma1 = (void*)a2;
87 void* vma2 = (void*)a3;
88 void** ring_ptr_out = (void**)a4;
89 void** sqes_ptr_out = (void**)a5;
90 uint32_t fd_io_uring = __sys_io_uring_setup(entries, setup_params);
91 uint32_t sq_ring_sz =
92 setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
93 uint32_t cq_ring_sz = setup_params->cq_off.cqes +
94 setup_params->cq_entries * SIZEOF_IO_URING_CQE;
95 uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
96 *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE,
97 MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
98 IORING_OFF_SQ_RING);
99 uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
100 *sqes_ptr_out =
101 mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE,
102 MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES);
103 return fd_io_uring;
104 }
105
kill_and_wait(int pid,int * status)106 static void kill_and_wait(int pid, int* status)
107 {
108 kill(-pid, SIGKILL);
109 kill(pid, SIGKILL);
110 for (int i = 0; i < 100; i++) {
111 if (waitpid(-1, status, WNOHANG | __WALL) == pid)
112 return;
113 usleep(1000);
114 }
115 DIR* dir = opendir("/sys/fs/fuse/connections");
116 if (dir) {
117 for (;;) {
118 struct dirent* ent = readdir(dir);
119 if (!ent)
120 break;
121 if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
122 continue;
123 char abort[300];
124 snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
125 ent->d_name);
126 int fd = open(abort, O_WRONLY);
127 if (fd == -1) {
128 continue;
129 }
130 if (write(fd, abort, 1) < 0) {
131 }
132 close(fd);
133 }
134 closedir(dir);
135 } else {
136 }
137 while (waitpid(-1, status, __WALL) != pid) {
138 }
139 }
140
setup_test(void)141 static void setup_test(void)
142 {
143 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
144 setpgrp();
145 write_file("/proc/self/oom_score_adj", "1000");
146 }
147
148 static void execute_one(void);
149
150 #define WAIT_FLAGS __WALL
151
loop(void)152 static void loop(void)
153 {
154 int iter = 0;
155 for (; iter < 100; iter++) {
156 int pid = fork();
157 if (pid < 0)
158 exit(1);
159 if (pid == 0) {
160 setup_test();
161 execute_one();
162 exit(0);
163 }
164 int status = 0;
165 uint64_t start = current_time_ms();
166 for (;;) {
167 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
168 break;
169 sleep_ms(1);
170 if (current_time_ms() - start < 5000) {
171 continue;
172 }
173 kill_and_wait(pid, &status);
174 break;
175 }
176 }
177 }
178
execute_one(void)179 void execute_one(void)
180 {
181 *(uint32_t*)0x20000044 = 0;
182 *(uint32_t*)0x20000048 = 0x42;
183 *(uint32_t*)0x2000004c = 0;
184 *(uint32_t*)0x20000050 = 0;
185 *(uint32_t*)0x20000058 = -1;
186 *(uint32_t*)0x2000005c = 0;
187 *(uint32_t*)0x20000060 = 0;
188 *(uint32_t*)0x20000064 = 0;
189 syz_io_uring_setup(0x74bc, 0x20000040, 0x20ffb000, 0x20ffc000, 0, 0);
190 }
main(void)191 int main(void)
192 {
193 mmap((void *)0x1ffff000ul, 0x1000ul, 0ul, MAP_ANON|MAP_PRIVATE, -1, 0ul);
194 mmap((void *)0x20000000ul, 0x1000000ul, 7ul, MAP_ANON|MAP_PRIVATE, -1, 0ul);
195 mmap((void *)0x21000000ul, 0x1000ul, 0ul, MAP_ANON|MAP_PRIVATE, -1, 0ul);
196 loop();
197 return 0;
198 }
199 #else
main(int argc,char * argv[])200 int main(int argc, char *argv[])
201 {
202 return T_EXIT_SKIP;
203 }
204 #endif
205