xref: /aosp_15_r20/external/liburing/test/sqpoll-disable-exit.c (revision 25da2bea747f3a93b4c30fd9708b0618ef55a0e6)
1 /* SPDX-License-Identifier: MIT */
2 // https://syzkaller.appspot.com/bug?id=99f4ea77bb9b9ef24cefb66469be319f4aa9f162
3 // autogenerated by syzkaller (https://github.com/google/syzkaller)
4 
5 #include <dirent.h>
6 #include <endian.h>
7 #include <errno.h>
8 #include <fcntl.h>
9 #include <signal.h>
10 #include <stdarg.h>
11 #include <stdbool.h>
12 #include <stdint.h>
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <sys/mman.h>
17 #include <sys/prctl.h>
18 #include <sys/stat.h>
19 #include <sys/types.h>
20 #include <sys/wait.h>
21 #include <time.h>
22 #include <unistd.h>
23 
24 #include "liburing.h"
25 #include "../src/syscall.h"
26 
sleep_ms(uint64_t ms)27 static void sleep_ms(uint64_t ms)
28 {
29   usleep(ms * 1000);
30 }
31 
current_time_ms(void)32 static uint64_t current_time_ms(void)
33 {
34   struct timespec ts;
35   if (clock_gettime(CLOCK_MONOTONIC, &ts))
36     exit(1);
37   return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
38 }
39 
write_file(const char * file,const char * what,...)40 static bool write_file(const char* file, const char* what, ...)
41 {
42   char buf[1024];
43   va_list args;
44   va_start(args, what);
45   vsnprintf(buf, sizeof(buf), what, args);
46   va_end(args);
47   buf[sizeof(buf) - 1] = 0;
48   int len = strlen(buf);
49   int fd = open(file, O_WRONLY | O_CLOEXEC);
50   if (fd == -1)
51     return false;
52   if (write(fd, buf, len) != len) {
53     int err = errno;
54     close(fd);
55     errno = err;
56     return false;
57   }
58   close(fd);
59   return true;
60 }
61 
62 #define SIZEOF_IO_URING_SQE 64
63 #define SIZEOF_IO_URING_CQE 16
64 #define SQ_HEAD_OFFSET 0
65 #define SQ_TAIL_OFFSET 64
66 #define SQ_RING_MASK_OFFSET 256
67 #define SQ_RING_ENTRIES_OFFSET 264
68 #define SQ_FLAGS_OFFSET 276
69 #define SQ_DROPPED_OFFSET 272
70 #define CQ_HEAD_OFFSET 128
71 #define CQ_TAIL_OFFSET 192
72 #define CQ_RING_MASK_OFFSET 260
73 #define CQ_RING_ENTRIES_OFFSET 268
74 #define CQ_RING_OVERFLOW_OFFSET 284
75 #define CQ_FLAGS_OFFSET 280
76 #define CQ_CQES_OFFSET 320
77 
syz_io_uring_setup(volatile long a0,volatile long a1,volatile long a2,volatile long a3,volatile long a4,volatile long a5)78 static long syz_io_uring_setup(volatile long a0, volatile long a1,
79                                volatile long a2, volatile long a3,
80                                volatile long a4, volatile long a5)
81 {
82   uint32_t entries = (uint32_t)a0;
83   struct io_uring_params* setup_params = (struct io_uring_params*)a1;
84   void* vma1 = (void*)a2;
85   void* vma2 = (void*)a3;
86   void** ring_ptr_out = (void**)a4;
87   void** sqes_ptr_out = (void**)a5;
88   uint32_t fd_io_uring = __sys_io_uring_setup(entries, setup_params);
89   uint32_t sq_ring_sz =
90       setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
91   uint32_t cq_ring_sz = setup_params->cq_off.cqes +
92                         setup_params->cq_entries * SIZEOF_IO_URING_CQE;
93   uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
94   *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE,
95                        MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
96                        IORING_OFF_SQ_RING);
97   uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
98   *sqes_ptr_out =
99       mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE,
100            MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES);
101   return fd_io_uring;
102 }
103 
kill_and_wait(int pid,int * status)104 static void kill_and_wait(int pid, int* status)
105 {
106   kill(-pid, SIGKILL);
107   kill(pid, SIGKILL);
108   for (int i = 0; i < 100; i++) {
109     if (waitpid(-1, status, WNOHANG | __WALL) == pid)
110       return;
111     usleep(1000);
112   }
113   DIR* dir = opendir("/sys/fs/fuse/connections");
114   if (dir) {
115     for (;;) {
116       struct dirent* ent = readdir(dir);
117       if (!ent)
118         break;
119       if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
120         continue;
121       char abort[300];
122       snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
123                ent->d_name);
124       int fd = open(abort, O_WRONLY);
125       if (fd == -1) {
126         continue;
127       }
128       if (write(fd, abort, 1) < 0) {
129       }
130       close(fd);
131     }
132     closedir(dir);
133   } else {
134   }
135   while (waitpid(-1, status, __WALL) != pid) {
136   }
137 }
138 
setup_test()139 static void setup_test()
140 {
141   prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
142   setpgrp();
143   write_file("/proc/self/oom_score_adj", "1000");
144 }
145 
146 static void execute_one(void);
147 
148 #define WAIT_FLAGS __WALL
149 
loop(void)150 static void loop(void)
151 {
152   int iter = 0;
153   for (; iter < 100; iter++) {
154     int pid = fork();
155     if (pid < 0)
156       exit(1);
157     if (pid == 0) {
158       setup_test();
159       execute_one();
160       exit(0);
161     }
162     int status = 0;
163     uint64_t start = current_time_ms();
164     for (;;) {
165       if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
166         break;
167       sleep_ms(1);
168       if (current_time_ms() - start < 5000) {
169         continue;
170       }
171       kill_and_wait(pid, &status);
172       break;
173     }
174   }
175 }
176 
execute_one(void)177 void execute_one(void)
178 {
179   *(uint32_t*)0x20000044 = 0;
180   *(uint32_t*)0x20000048 = 0x42;
181   *(uint32_t*)0x2000004c = 0;
182   *(uint32_t*)0x20000050 = 0;
183   *(uint32_t*)0x20000058 = -1;
184   *(uint32_t*)0x2000005c = 0;
185   *(uint32_t*)0x20000060 = 0;
186   *(uint32_t*)0x20000064 = 0;
187   syz_io_uring_setup(0x74bc, 0x20000040, 0x20ffb000, 0x20ffc000, 0, 0);
188 }
main(void)189 int main(void)
190 {
191   mmap((void *)0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
192   mmap((void *)0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
193   mmap((void *)0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
194   loop();
195   return 0;
196 }
197