1 /* SPDX-License-Identifier: MIT */
2 // https://syzkaller.appspot.com/bug?id=99f4ea77bb9b9ef24cefb66469be319f4aa9f162
3 // autogenerated by syzkaller (https://github.com/google/syzkaller)
4
5 #include <dirent.h>
6 #include <endian.h>
7 #include <errno.h>
8 #include <fcntl.h>
9 #include <signal.h>
10 #include <stdarg.h>
11 #include <stdbool.h>
12 #include <stdint.h>
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/mman.h>
17 #include <sys/prctl.h>
18 #include <sys/stat.h>
19 #include <sys/types.h>
20 #include <sys/wait.h>
21 #include <time.h>
22 #include <unistd.h>
23
24 #include "liburing.h"
25 #include "../src/syscall.h"
26
sleep_ms(uint64_t ms)27 static void sleep_ms(uint64_t ms)
28 {
29 usleep(ms * 1000);
30 }
31
current_time_ms(void)32 static uint64_t current_time_ms(void)
33 {
34 struct timespec ts;
35 if (clock_gettime(CLOCK_MONOTONIC, &ts))
36 exit(1);
37 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
38 }
39
write_file(const char * file,const char * what,...)40 static bool write_file(const char* file, const char* what, ...)
41 {
42 char buf[1024];
43 va_list args;
44 va_start(args, what);
45 vsnprintf(buf, sizeof(buf), what, args);
46 va_end(args);
47 buf[sizeof(buf) - 1] = 0;
48 int len = strlen(buf);
49 int fd = open(file, O_WRONLY | O_CLOEXEC);
50 if (fd == -1)
51 return false;
52 if (write(fd, buf, len) != len) {
53 int err = errno;
54 close(fd);
55 errno = err;
56 return false;
57 }
58 close(fd);
59 return true;
60 }
61
62 #define SIZEOF_IO_URING_SQE 64
63 #define SIZEOF_IO_URING_CQE 16
64 #define SQ_HEAD_OFFSET 0
65 #define SQ_TAIL_OFFSET 64
66 #define SQ_RING_MASK_OFFSET 256
67 #define SQ_RING_ENTRIES_OFFSET 264
68 #define SQ_FLAGS_OFFSET 276
69 #define SQ_DROPPED_OFFSET 272
70 #define CQ_HEAD_OFFSET 128
71 #define CQ_TAIL_OFFSET 192
72 #define CQ_RING_MASK_OFFSET 260
73 #define CQ_RING_ENTRIES_OFFSET 268
74 #define CQ_RING_OVERFLOW_OFFSET 284
75 #define CQ_FLAGS_OFFSET 280
76 #define CQ_CQES_OFFSET 320
77
syz_io_uring_setup(volatile long a0,volatile long a1,volatile long a2,volatile long a3,volatile long a4,volatile long a5)78 static long syz_io_uring_setup(volatile long a0, volatile long a1,
79 volatile long a2, volatile long a3,
80 volatile long a4, volatile long a5)
81 {
82 uint32_t entries = (uint32_t)a0;
83 struct io_uring_params* setup_params = (struct io_uring_params*)a1;
84 void* vma1 = (void*)a2;
85 void* vma2 = (void*)a3;
86 void** ring_ptr_out = (void**)a4;
87 void** sqes_ptr_out = (void**)a5;
88 uint32_t fd_io_uring = __sys_io_uring_setup(entries, setup_params);
89 uint32_t sq_ring_sz =
90 setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
91 uint32_t cq_ring_sz = setup_params->cq_off.cqes +
92 setup_params->cq_entries * SIZEOF_IO_URING_CQE;
93 uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
94 *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE,
95 MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
96 IORING_OFF_SQ_RING);
97 uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
98 *sqes_ptr_out =
99 mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE,
100 MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES);
101 return fd_io_uring;
102 }
103
kill_and_wait(int pid,int * status)104 static void kill_and_wait(int pid, int* status)
105 {
106 kill(-pid, SIGKILL);
107 kill(pid, SIGKILL);
108 for (int i = 0; i < 100; i++) {
109 if (waitpid(-1, status, WNOHANG | __WALL) == pid)
110 return;
111 usleep(1000);
112 }
113 DIR* dir = opendir("/sys/fs/fuse/connections");
114 if (dir) {
115 for (;;) {
116 struct dirent* ent = readdir(dir);
117 if (!ent)
118 break;
119 if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
120 continue;
121 char abort[300];
122 snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
123 ent->d_name);
124 int fd = open(abort, O_WRONLY);
125 if (fd == -1) {
126 continue;
127 }
128 if (write(fd, abort, 1) < 0) {
129 }
130 close(fd);
131 }
132 closedir(dir);
133 } else {
134 }
135 while (waitpid(-1, status, __WALL) != pid) {
136 }
137 }
138
setup_test()139 static void setup_test()
140 {
141 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
142 setpgrp();
143 write_file("/proc/self/oom_score_adj", "1000");
144 }
145
146 static void execute_one(void);
147
148 #define WAIT_FLAGS __WALL
149
loop(void)150 static void loop(void)
151 {
152 int iter = 0;
153 for (; iter < 100; iter++) {
154 int pid = fork();
155 if (pid < 0)
156 exit(1);
157 if (pid == 0) {
158 setup_test();
159 execute_one();
160 exit(0);
161 }
162 int status = 0;
163 uint64_t start = current_time_ms();
164 for (;;) {
165 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
166 break;
167 sleep_ms(1);
168 if (current_time_ms() - start < 5000) {
169 continue;
170 }
171 kill_and_wait(pid, &status);
172 break;
173 }
174 }
175 }
176
execute_one(void)177 void execute_one(void)
178 {
179 *(uint32_t*)0x20000044 = 0;
180 *(uint32_t*)0x20000048 = 0x42;
181 *(uint32_t*)0x2000004c = 0;
182 *(uint32_t*)0x20000050 = 0;
183 *(uint32_t*)0x20000058 = -1;
184 *(uint32_t*)0x2000005c = 0;
185 *(uint32_t*)0x20000060 = 0;
186 *(uint32_t*)0x20000064 = 0;
187 syz_io_uring_setup(0x74bc, 0x20000040, 0x20ffb000, 0x20ffc000, 0, 0);
188 }
main(void)189 int main(void)
190 {
191 mmap((void *)0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
192 mmap((void *)0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
193 mmap((void *)0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
194 loop();
195 return 0;
196 }
197