ok github.com/google/syzkaller/dashboard/app (cached)
? github.com/google/syzkaller/dashboard/dashapi [no test files]
ok github.com/google/syzkaller/executor 1.455s
ok github.com/google/syzkaller/pkg/ast 2.396s
ok github.com/google/syzkaller/pkg/bisect 48.478s
ok github.com/google/syzkaller/pkg/build 0.207s
ok github.com/google/syzkaller/pkg/compiler 13.376s
ok github.com/google/syzkaller/pkg/config (cached)
ok github.com/google/syzkaller/pkg/cover 0.091s
? github.com/google/syzkaller/pkg/cover/backend [no test files]
--- FAIL: TestGenerate (6.89s)
--- FAIL: TestGenerate/freebsd/386 (0.98s)
csource_test.go:68: seed=1612253485548599370
--- FAIL: TestGenerate/freebsd/386/8 (0.68s)
csource_test.go:124: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Slowdown:1 Sandbox: Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
syscall(SYS_close_range, 0xffffff9c, -1, 0);
break;
case 1:
syscall(SYS_close, 0xffffff9c);
break;
case 2:
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
break;
case 3:
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
break;
case 4:
*(uint32_t*)0x10000080 = 8;
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
break;
case 5:
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23;
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
break;
case 7:
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
break;
case 8:
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
break;
case 9:
*(uint32_t*)0x10000400 = 4;
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
break;
case 10:
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
break;
case 11:
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
syz_execute_func(0x100000c0);
break;
case 12:
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
use_temporary_dir();
loop();
return 0;
}
<stdin>:277:11: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor599138726 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/12 (1.38s)
csource_test.go:124: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Slowdown:1 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:true Repro:false Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
int valid = addr < prog_start || addr > prog_end;
if (sig == SIGBUS) {
valid = 1;
}
if (skip && valid) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) ({ int ok = 1; __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); if (_setjmp(segv_env) == 0) { __VA_ARGS__; } else ok = 0; __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); ok; })
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
syscall(SYS_close_range, 0xffffff9c, -1, 0);
break;
case 1:
syscall(SYS_close, 0xffffff9c);
break;
case 2:
NONFAILING(*(uint32_t*)0x10000000 = 0);
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
break;
case 3:
NONFAILING(*(uint64_t*)0x10000040 = 6);
NONFAILING(*(uint64_t*)0x10000048 = 8);
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
break;
case 4:
NONFAILING(*(uint32_t*)0x10000080 = 8);
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
break;
case 5:
NONFAILING(*(uint8_t*)0x100000c0 = 8);
NONFAILING(*(uint8_t*)0x100000c1 = 0);
NONFAILING(*(uint8_t*)0x100000c2 = 0);
NONFAILING(*(uint32_t*)0x100000c4 = 0x4e23);
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
break;
case 7:
NONFAILING(*(uint64_t*)0x10000100 = 8);
NONFAILING(*(uint64_t*)0x10000108 = 0x100);
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
break;
case 8:
NONFAILING(*(uint32_t*)0x10000300 = 0x10000140);
NONFAILING(*(uint8_t*)0x10000140 = 0xa);
NONFAILING(*(uint8_t*)0x10000141 = 1);
NONFAILING(memcpy((void*)0x10000142, "./file0\000", 8));
NONFAILING(*(uint32_t*)0x10000304 = 0xa);
NONFAILING(*(uint32_t*)0x10000308 = 0x10000280);
NONFAILING(*(uint32_t*)0x10000280 = 0x10000180);
NONFAILING(memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216));
NONFAILING(*(uint32_t*)0x10000284 = 0xd8);
NONFAILING(*(uint32_t*)0x1000030c = 1);
NONFAILING(*(uint32_t*)0x10000310 = 0x100002c0);
NONFAILING(*(uint32_t*)0x100002c0 = 0x10);
NONFAILING(*(uint32_t*)0x100002c4 = 0xffff);
NONFAILING(*(uint32_t*)0x100002c8 = 1);
NONFAILING(*(uint32_t*)0x100002cc = r[0]);
NONFAILING(*(uint32_t*)0x100002d0 = 0x14);
NONFAILING(*(uint32_t*)0x100002d4 = 0xffff);
NONFAILING(*(uint32_t*)0x100002d8 = 1);
NONFAILING(*(uint32_t*)0x100002dc = r[1]);
NONFAILING(*(uint32_t*)0x100002e0 = r[0]);
NONFAILING(*(uint32_t*)0x100002e4 = 0x1c);
NONFAILING(*(uint32_t*)0x100002e8 = 0xffff);
NONFAILING(*(uint32_t*)0x100002ec = 1);
NONFAILING(*(uint32_t*)0x100002f0 = r[1]);
NONFAILING(*(uint32_t*)0x100002f4 = r[0]);
NONFAILING(*(uint32_t*)0x100002f8 = r[0]);
NONFAILING(*(uint32_t*)0x100002fc = r[1]);
NONFAILING(*(uint32_t*)0x10000314 = 0x40);
NONFAILING(*(uint32_t*)0x10000318 = 0x20085);
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
break;
case 9:
NONFAILING(*(uint32_t*)0x10000400 = 4);
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
break;
case 10:
NONFAILING(memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6));
NONFAILING(*(uint8_t*)0x10000006 = 0xaa);
NONFAILING(*(uint8_t*)0x10000007 = 0xaa);
NONFAILING(*(uint8_t*)0x10000008 = 0xaa);
NONFAILING(*(uint8_t*)0x10000009 = 0xaa);
NONFAILING(*(uint8_t*)0x1000000a = 0xaa);
NONFAILING(*(uint8_t*)0x1000000b = 0xaa);
NONFAILING(*(uint16_t*)0x1000000c = htobe16(0x3c00));
NONFAILING(memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176));
break;
case 11:
NONFAILING(memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51));
NONFAILING(syz_execute_func(0x100000c0));
break;
case 12:
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
install_segv_handler();
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:336:11: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor499020744 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/0 (1.57s)
csource_test.go:124: opts: {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:0 Slowdown:1 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_one(void)
{
intptr_t res = 0;
syscall(SYS_close_range, 0xffffff9c, -1, 0);
syscall(SYS_close, 0xffffff9c);
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
*(uint32_t*)0x10000080 = 8;
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23;
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
*(uint32_t*)0x10000400 = 4;
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
syz_execute_func(0x100000c0);
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:165:10: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor210371642 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/15 (1.61s)
csource_test.go:124: opts: {Threaded:true Collide:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:1 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:false Repro:true Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
}
int i, call, thread;
int collide = 0;
again:
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
if (collide && (call % 2) == 0)
break;
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
if (!collide) {
collide = 1;
goto again;
}
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
syscall(SYS_close_range, 0xffffff9c, -1, 0);
break;
case 1:
syscall(SYS_close, 0xffffff9c);
break;
case 2:
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
break;
case 3:
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
break;
case 4:
*(uint32_t*)0x10000080 = 8;
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
break;
case 5:
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23 + procid*4;
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
break;
case 7:
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
break;
case 8:
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
break;
case 9:
*(uint32_t*)0x10000400 = 4;
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
break;
case 10:
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
break;
case 11:
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
syz_execute_func(0x100000c0);
break;
case 12:
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
for (procid = 0; procid < 2; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_none();
}
}
sleep(1000000);
return 0;
}
<stdin>:316:11: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor396667527 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/14 (1.59s)
csource_test.go:124: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Slowdown:1 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:false Repro:false Trace:true}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
fprintf(stderr, "### start\n");
int i, call, thread;
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_close_range, 0xffffff9c, -1, 0);
fprintf(stderr, "### call=0 errno=%u\n", res == -1 ? errno : 0);
break;
case 1:
res = syscall(SYS_close, 0xffffff9c);
fprintf(stderr, "### call=1 errno=%u\n", res == -1 ? errno : 0);
break;
case 2:
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
fprintf(stderr, "### call=2 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[0] = res;
break;
case 3:
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
res = syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
fprintf(stderr, "### call=3 errno=%u\n", res == -1 ? errno : 0);
break;
case 4:
*(uint32_t*)0x10000080 = 8;
res = syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
fprintf(stderr, "### call=4 errno=%u\n", res == -1 ? errno : 0);
break;
case 5:
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23;
res = syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
fprintf(stderr, "### call=5 errno=%u\n", res == -1 ? errno : 0);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
fprintf(stderr, "### call=6 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[1] = res;
break;
case 7:
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
res = syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
fprintf(stderr, "### call=7 errno=%u\n", res == -1 ? errno : 0);
break;
case 8:
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
res = syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
fprintf(stderr, "### call=8 errno=%u\n", res == -1 ? errno : 0);
break;
case 9:
*(uint32_t*)0x10000400 = 4;
res = syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
fprintf(stderr, "### call=9 errno=%u\n", res == -1 ? errno : 0);
break;
case 10:
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
(void)res;
break;
case 11:
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
res = -1;
errno = EFAULT;
res = syz_execute_func(0x100000c0);
fprintf(stderr, "### call=11 errno=%u\n", res == -1 ? errno : 0);
break;
case 12:
(void)res;
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:305:17: error: use of undeclared identifier 'SYS_close_range'
res = syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor230696529 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/13 (1.60s)
csource_test.go:124: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Slowdown:1 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:false Repro:true Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
}
int i, call, thread;
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
syscall(SYS_close_range, 0xffffff9c, -1, 0);
break;
case 1:
syscall(SYS_close, 0xffffff9c);
break;
case 2:
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
break;
case 3:
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
break;
case 4:
*(uint32_t*)0x10000080 = 8;
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
break;
case 5:
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23;
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
break;
case 7:
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
break;
case 8:
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
break;
case 9:
*(uint32_t*)0x10000400 = 4;
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
break;
case 10:
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
break;
case 11:
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
syz_execute_func(0x100000c0);
break;
case 12:
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:306:11: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor055839612 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/11 (1.59s)
csource_test.go:124: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Slowdown:1 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:false HandleSegv:false Repro:false Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
syscall(SYS_close_range, 0xffffff9c, -1, 0);
break;
case 1:
syscall(SYS_close, 0xffffff9c);
break;
case 2:
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
break;
case 3:
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
break;
case 4:
*(uint32_t*)0x10000080 = 8;
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
break;
case 5:
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23;
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
break;
case 7:
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
break;
case 8:
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
break;
case 9:
*(uint32_t*)0x10000400 = 4;
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
break;
case 10:
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
break;
case 11:
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
syz_execute_func(0x100000c0);
break;
case 12:
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
do_sandbox_none();
return 0;
}
<stdin>:251:11: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor099850923 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/9 (1.45s)
csource_test.go:124: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Slowdown:1 Sandbox:setuid Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int wait_for_loop(int pid)
{
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, WUNTRACED) != pid) {
}
return WEXITSTATUS(status);
}
static int do_sandbox_setuid(void)
{
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
sandbox_common();
char pwbuf[1024];
struct passwd *pw, pwres;
if (getpwnam_r("nobody", &pwres, pwbuf, sizeof(pwbuf), &pw) != 0 || !pw)
exit(1);
if (setgroups(0, NULL))
exit(1);
if (setgid(pw->pw_gid))
exit(1);
if (setuid(pw->pw_uid))
exit(1);
loop();
exit(1);
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
syscall(SYS_close_range, 0xffffff9c, -1, 0);
break;
case 1:
syscall(SYS_close, 0xffffff9c);
break;
case 2:
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
break;
case 3:
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
break;
case 4:
*(uint32_t*)0x10000080 = 8;
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
break;
case 5:
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23;
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
break;
case 7:
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
break;
case 8:
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
break;
case 9:
*(uint32_t*)0x10000400 = 4;
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
break;
case 10:
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
break;
case 11:
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
syz_execute_func(0x100000c0);
break;
case 12:
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
use_temporary_dir();
do_sandbox_setuid();
return 0;
}
<stdin>:327:11: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor230592014 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/4 (1.43s)
csource_test.go:124: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:10 Procs:0 Slowdown:1 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (; iter < 10; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
syscall(SYS_close_range, 0xffffff9c, -1, 0);
break;
case 1:
syscall(SYS_close, 0xffffff9c);
break;
case 2:
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
break;
case 3:
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
break;
case 4:
*(uint32_t*)0x10000080 = 8;
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
break;
case 5:
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23;
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
break;
case 7:
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
break;
case 8:
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
break;
case 9:
*(uint32_t*)0x10000400 = 4;
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
break;
case 10:
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
break;
case 11:
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
syz_execute_func(0x100000c0);
break;
case 12:
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:304:11: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor886701077 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/7 (1.44s)
csource_test.go:124: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Slowdown:10 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false VhciInjection:false Wifi:false Sysctl:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
close_range(0xffffffffffffff9c, 0xffffffffffffffff, 0x0)
close(0xffffffffffffff9c)
r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x10000000)
cap_rights_limit(r0, &(0x7f0000000040)=[0x6, 0x8])
setsockopt$inet_udp(0xffffffffffffff9c, 0x11, 0x0, &(0x7f0000000080)=0x8, 0x4)
connectat$unix(0xffffffffffffff9c, r0, &(0x7f00000000c0)=@abs={0x8, 0x0, 0x0, 0x3}, 0x8)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
cap_rights_limit(r1, &(0x7f0000000100)=[0x8, 0x100])
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)=@file={0xa, 0x1, './file0\x00'}, 0xa, &(0x7f0000000280)=[{&(0x7f0000000180)="bb5a61cf7b767d8f5aac244202def2e1b265239a4e97a535dd93ebabde65567a9c9c484a3007edff7006e89f259c7cc56b15808260235c5b5397e021f34b65cd184ba50aaf31acbf3d672cb0063411126d1236aafdceeb64ec346c885c45b7f49a5b1f06ddd641dbeb9ef286e1db386ae53413ddc9c92ba4b79c05d86fd2d49eb854b33deccb774514f9c5af234780c716b44f76c18e8a3c4653037439a0d2abff207ac81fb50661ef5ebc3c3bbd4d343840d561e163d39bfbd0261bc3a7bf454fa171663ad1cd6a80e7b20c600db8e3e8641c492e3736c0", 0xd8}], 0x1, &(0x7f00000002c0)=[@rights={0x10, 0xffff, 0x1, [r0]}, @rights={0x14, 0xffff, 0x1, [r1, r0]}, @rights={0x1c, 0xffff, 0x1, [r1, r0, r0, r1]}], 0x40, 0x20085}, 0x84)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000003c0), &(0x7f0000000400)=0x4)
syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="3d17e3aa5c88", @local, [], {@generic={0x3c00, "cfc8896b5ea165f437deb1a70b4b77d9b093a352489dcbf94870f8e88bac4154a60e5b0ee1bd537072ed2275acad61c19606f4923b3a920bfd606aa7437c8e1a31ec3544dbb7e5f022d8c64bf844a38f1e8692c1bdec4cab48a22929eb113bfb02400a276a49da64391a90bf27f8abf7ba98c44f08dcc01f61b2b6ad53e7855b96bfb729f6813e14bfdb35dec6c2fd9d857cfddc1212ed5672f64e2ccd08a571c1a1a0afd2931985fa9b3baca0871af9"}}})
syz_execute_func(&(0x7f00000000c0)="640f675d918fe97001de0f1c3bc4e25501203619e78fc9f812c68fe868ed9b0d00000043c4c1e9db6f0065f30f01ea0f0ffca6")
syz_extract_tcp_res(&(0x7f0000000100), 0x400, 0x9)
csource_test.go:125: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 13; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 500);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 15000) {
continue;
}
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
syscall(SYS_close_range, 0xffffff9c, -1, 0);
break;
case 1:
syscall(SYS_close, 0xffffff9c);
break;
case 2:
*(uint32_t*)0x10000000 = 0;
res = syscall(SYS_accept4, -1, 0, 0x10000000, 0x10000000);
if (res != -1)
r[0] = res;
break;
case 3:
*(uint64_t*)0x10000040 = 6;
*(uint64_t*)0x10000048 = 8;
syscall(SYS_cap_rights_limit, (intptr_t)r[0], 0x10000040);
break;
case 4:
*(uint32_t*)0x10000080 = 8;
syscall(SYS_setsockopt, 0xffffff9c, 0x11, 0, 0x10000080, 4);
break;
case 5:
*(uint8_t*)0x100000c0 = 8;
*(uint8_t*)0x100000c1 = 0;
*(uint8_t*)0x100000c2 = 0;
*(uint32_t*)0x100000c4 = 0x4e23;
syscall(SYS_connectat, 0xffffff9c, (intptr_t)r[0], 0x100000c0, 8);
break;
case 6:
res = syscall(SYS_socket, 2, 2, 0x88);
if (res != -1)
r[1] = res;
break;
case 7:
*(uint64_t*)0x10000100 = 8;
*(uint64_t*)0x10000108 = 0x100;
syscall(SYS_cap_rights_limit, (intptr_t)r[1], 0x10000100);
break;
case 8:
*(uint32_t*)0x10000300 = 0x10000140;
*(uint8_t*)0x10000140 = 0xa;
*(uint8_t*)0x10000141 = 1;
memcpy((void*)0x10000142, "./file0\000", 8);
*(uint32_t*)0x10000304 = 0xa;
*(uint32_t*)0x10000308 = 0x10000280;
*(uint32_t*)0x10000280 = 0x10000180;
memcpy((void*)0x10000180, "\xbb\x5a\x61\xcf\x7b\x76\x7d\x8f\x5a\xac\x24\x42\x02\xde\xf2\xe1\xb2\x65\x23\x9a\x4e\x97\xa5\x35\xdd\x93\xeb\xab\xde\x65\x56\x7a\x9c\x9c\x48\x4a\x30\x07\xed\xff\x70\x06\xe8\x9f\x25\x9c\x7c\xc5\x6b\x15\x80\x82\x60\x23\x5c\x5b\x53\x97\xe0\x21\xf3\x4b\x65\xcd\x18\x4b\xa5\x0a\xaf\x31\xac\xbf\x3d\x67\x2c\xb0\x06\x34\x11\x12\x6d\x12\x36\xaa\xfd\xce\xeb\x64\xec\x34\x6c\x88\x5c\x45\xb7\xf4\x9a\x5b\x1f\x06\xdd\xd6\x41\xdb\xeb\x9e\xf2\x86\xe1\xdb\x38\x6a\xe5\x34\x13\xdd\xc9\xc9\x2b\xa4\xb7\x9c\x05\xd8\x6f\xd2\xd4\x9e\xb8\x54\xb3\x3d\xec\xcb\x77\x45\x14\xf9\xc5\xaf\x23\x47\x80\xc7\x16\xb4\x4f\x76\xc1\x8e\x8a\x3c\x46\x53\x03\x74\x39\xa0\xd2\xab\xff\x20\x7a\xc8\x1f\xb5\x06\x61\xef\x5e\xbc\x3c\x3b\xbd\x4d\x34\x38\x40\xd5\x61\xe1\x63\xd3\x9b\xfb\xd0\x26\x1b\xc3\xa7\xbf\x45\x4f\xa1\x71\x66\x3a\xd1\xcd\x6a\x80\xe7\xb2\x0c\x60\x0d\xb8\xe3\xe8\x64\x1c\x49\x2e\x37\x36\xc0", 216);
*(uint32_t*)0x10000284 = 0xd8;
*(uint32_t*)0x1000030c = 1;
*(uint32_t*)0x10000310 = 0x100002c0;
*(uint32_t*)0x100002c0 = 0x10;
*(uint32_t*)0x100002c4 = 0xffff;
*(uint32_t*)0x100002c8 = 1;
*(uint32_t*)0x100002cc = r[0];
*(uint32_t*)0x100002d0 = 0x14;
*(uint32_t*)0x100002d4 = 0xffff;
*(uint32_t*)0x100002d8 = 1;
*(uint32_t*)0x100002dc = r[1];
*(uint32_t*)0x100002e0 = r[0];
*(uint32_t*)0x100002e4 = 0x1c;
*(uint32_t*)0x100002e8 = 0xffff;
*(uint32_t*)0x100002ec = 1;
*(uint32_t*)0x100002f0 = r[1];
*(uint32_t*)0x100002f4 = r[0];
*(uint32_t*)0x100002f8 = r[0];
*(uint32_t*)0x100002fc = r[1];
*(uint32_t*)0x10000314 = 0x40;
*(uint32_t*)0x10000318 = 0x20085;
syscall(SYS_sendmsg, -1, 0x10000300, 0x84);
break;
case 9:
*(uint32_t*)0x10000400 = 4;
syscall(SYS_getsockopt, -1, 0x84, 0x20, 0x100003c0, 0x10000400);
break;
case 10:
memcpy((void*)0x10000000, "\x3d\x17\xe3\xaa\x5c\x88", 6);
*(uint8_t*)0x10000006 = 0xaa;
*(uint8_t*)0x10000007 = 0xaa;
*(uint8_t*)0x10000008 = 0xaa;
*(uint8_t*)0x10000009 = 0xaa;
*(uint8_t*)0x1000000a = 0xaa;
*(uint8_t*)0x1000000b = 0xaa;
*(uint16_t*)0x1000000c = htobe16(0x3c00);
memcpy((void*)0x1000000e, "\xcf\xc8\x89\x6b\x5e\xa1\x65\xf4\x37\xde\xb1\xa7\x0b\x4b\x77\xd9\xb0\x93\xa3\x52\x48\x9d\xcb\xf9\x48\x70\xf8\xe8\x8b\xac\x41\x54\xa6\x0e\x5b\x0e\xe1\xbd\x53\x70\x72\xed\x22\x75\xac\xad\x61\xc1\x96\x06\xf4\x92\x3b\x3a\x92\x0b\xfd\x60\x6a\xa7\x43\x7c\x8e\x1a\x31\xec\x35\x44\xdb\xb7\xe5\xf0\x22\xd8\xc6\x4b\xf8\x44\xa3\x8f\x1e\x86\x92\xc1\xbd\xec\x4c\xab\x48\xa2\x29\x29\xeb\x11\x3b\xfb\x02\x40\x0a\x27\x6a\x49\xda\x64\x39\x1a\x90\xbf\x27\xf8\xab\xf7\xba\x98\xc4\x4f\x08\xdc\xc0\x1f\x61\xb2\xb6\xad\x53\xe7\x85\x5b\x96\xbf\xb7\x29\xf6\x81\x3e\x14\xbf\xdb\x35\xde\xc6\xc2\xfd\x9d\x85\x7c\xfd\xdc\x12\x12\xed\x56\x72\xf6\x4e\x2c\xcd\x08\xa5\x71\xc1\xa1\xa0\xaf\xd2\x93\x19\x85\xfa\x9b\x3b\xac\xa0\x87\x1a\xf9", 176);
break;
case 11:
memcpy((void*)0x100000c0, "\x64\x0f\x67\x5d\x91\x8f\xe9\x70\x01\xde\x0f\x1c\x3b\xc4\xe2\x55\x01\x20\x36\x19\xe7\x8f\xc9\xf8\x12\xc6\x8f\xe8\x68\xed\x9b\x0d\x00\x00\x00\x43\xc4\xc1\xe9\xdb\x6f\x00\x65\xf3\x0f\x01\xea\x0f\x0f\xfc\xa6", 51);
syz_execute_func(0x100000c0);
break;
case 12:
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:304:11: error: use of undeclared identifier 'SYS_close_range'
syscall(SYS_close_range, 0xffffff9c, -1, 0);
^
1 error generated.
compiler invocation: clang [-o /tmp/syz-executor512098928 -DGOOS_freebsd=1 -DGOARCH_386=1 -DHOSTGOOS_freebsd=1 -x c - -m32 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -static -lc++ -Wno-overflow]
--- FAIL: TestGenerate/freebsd/386/10 (2.03s)
csource_test.go:122:
--- FAIL: TestGenerate/freebsd/386/1 (0.79s)
csource_test.go:122:
--- FAIL: TestGenerate/freebsd/386/6 (1.76s)
csource_test.go:122:
--- FAIL: TestGenerate/freebsd/386/5 (1.17s)
csource_test.go:122:
--- FAIL: TestGenerate/freebsd/386/3 (1.01s)
csource_test.go:122:
--- FAIL: TestGenerate/freebsd/386/2 (1.14s)
csource_test.go:122:
FAIL
FAIL github.com/google/syzkaller/pkg/csource 16.045s
ok github.com/google/syzkaller/pkg/db (cached)
? github.com/google/syzkaller/pkg/debugtracer [no test files]
ok github.com/google/syzkaller/pkg/email (cached)
? github.com/google/syzkaller/pkg/gce [no test files]
? github.com/google/syzkaller/pkg/gcs [no test files]
? github.com/google/syzkaller/pkg/hash [no test files]
ok github.com/google/syzkaller/pkg/host 2.823s
? github.com/google/syzkaller/pkg/html [no test files]
ok github.com/google/syzkaller/pkg/ifuzz (cached)
? github.com/google/syzkaller/pkg/ifuzz/iset [no test files]
? github.com/google/syzkaller/pkg/ifuzz/powerpc [no test files]
? github.com/google/syzkaller/pkg/ifuzz/powerpc/generated [no test files]
? github.com/google/syzkaller/pkg/ifuzz/x86 [no test files]
? github.com/google/syzkaller/pkg/ifuzz/x86/gen [no test files]
? github.com/google/syzkaller/pkg/ifuzz/x86/generated [no test files]
ok github.com/google/syzkaller/pkg/instance 2.146s
ok github.com/google/syzkaller/pkg/ipc 6.716s
? github.com/google/syzkaller/pkg/ipc/ipcconfig [no test files]
? github.com/google/syzkaller/pkg/kcidb [no test files]
ok github.com/google/syzkaller/pkg/kconfig 0.037s
ok github.com/google/syzkaller/pkg/kd (cached)
ok github.com/google/syzkaller/pkg/log (cached)
ok github.com/google/syzkaller/pkg/mgrconfig 0.138s
ok github.com/google/syzkaller/pkg/osutil (cached)
ok github.com/google/syzkaller/pkg/report 5.286s
ok github.com/google/syzkaller/pkg/repro 0.226s
? github.com/google/syzkaller/pkg/rpctype [no test files]
ok github.com/google/syzkaller/pkg/runtest 63.741s
ok github.com/google/syzkaller/pkg/serializer (cached)
? github.com/google/syzkaller/pkg/signal [no test files]
ok github.com/google/syzkaller/pkg/symbolizer 0.491s
ok github.com/google/syzkaller/pkg/tool (cached)
ok github.com/google/syzkaller/pkg/vcs 13.773s
ok github.com/google/syzkaller/prog 16.157s
ok github.com/google/syzkaller/prog/test 1.952s
? github.com/google/syzkaller/sys [no test files]
? github.com/google/syzkaller/sys/akaros [no test files]
? github.com/google/syzkaller/sys/akaros/gen [no test files]
? github.com/google/syzkaller/sys/freebsd [no test files]
? github.com/google/syzkaller/sys/freebsd/gen [no test files]
? github.com/google/syzkaller/sys/fuchsia [no test files]
? github.com/google/syzkaller/sys/fuchsia/fidlgen [no test files]
? github.com/google/syzkaller/sys/fuchsia/gen [no test files]
? github.com/google/syzkaller/sys/fuchsia/layout [no test files]
ok github.com/google/syzkaller/sys/linux 0.204s
? github.com/google/syzkaller/sys/linux/gen [no test files]
? github.com/google/syzkaller/sys/netbsd [no test files]
? github.com/google/syzkaller/sys/netbsd/gen [no test files]
ok github.com/google/syzkaller/sys/openbsd 0.168s
? github.com/google/syzkaller/sys/openbsd/gen [no test files]
? github.com/google/syzkaller/sys/syz-extract [no test files]
? github.com/google/syzkaller/sys/syz-sysgen [no test files]
? github.com/google/syzkaller/sys/targets [no test files]
? github.com/google/syzkaller/sys/test [no test files]
? github.com/google/syzkaller/sys/test/gen [no test files]
? github.com/google/syzkaller/sys/trusty [no test files]
? github.com/google/syzkaller/sys/trusty/gen [no test files]
? github.com/google/syzkaller/sys/windows [no test files]
? github.com/google/syzkaller/sys/windows/gen [no test files]
ok github.com/google/syzkaller/syz-ci 0.318s
ok github.com/google/syzkaller/syz-fuzzer 0.952s
ok github.com/google/syzkaller/syz-hub 0.128s
ok github.com/google/syzkaller/syz-hub/state 0.136s
ok github.com/google/syzkaller/syz-manager 1.913s
? github.com/google/syzkaller/tools/syz-benchcmp [no test files]
? github.com/google/syzkaller/tools/syz-bisect [no test files]
? github.com/google/syzkaller/tools/syz-build [no test files]
? github.com/google/syzkaller/tools/syz-check [no test files]
? github.com/google/syzkaller/tools/syz-cover [no test files]
? github.com/google/syzkaller/tools/syz-crush [no test files]
? github.com/google/syzkaller/tools/syz-db [no test files]
? github.com/google/syzkaller/tools/syz-execprog [no test files]
? github.com/google/syzkaller/tools/syz-expand [no test files]
? github.com/google/syzkaller/tools/syz-fmt [no test files]
? github.com/google/syzkaller/tools/syz-hubtool [no test files]
? github.com/google/syzkaller/tools/syz-kcidb [no test files]
? github.com/google/syzkaller/tools/syz-kconf [no test files]
ok github.com/google/syzkaller/tools/syz-linter 3.099s
? github.com/google/syzkaller/tools/syz-make [no test files]
? github.com/google/syzkaller/tools/syz-minconfig [no test files]
? github.com/google/syzkaller/tools/syz-mutate [no test files]
? github.com/google/syzkaller/tools/syz-prog2c [no test files]
? github.com/google/syzkaller/tools/syz-reporter [no test files]
? github.com/google/syzkaller/tools/syz-repro [no test files]
? github.com/google/syzkaller/tools/syz-reprolist [no test files]
? github.com/google/syzkaller/tools/syz-runtest [no test files]
? github.com/google/syzkaller/tools/syz-showprio [no test files]
? github.com/google/syzkaller/tools/syz-stress [no test files]
? github.com/google/syzkaller/tools/syz-symbolize [no test files]
? github.com/google/syzkaller/tools/syz-testbuild [no test files]
? github.com/google/syzkaller/tools/syz-trace2syz [no test files]
ok github.com/google/syzkaller/tools/syz-trace2syz/parser 0.049s
ok github.com/google/syzkaller/tools/syz-trace2syz/proggen 0.579s
? github.com/google/syzkaller/tools/syz-tty [no test files]
? github.com/google/syzkaller/tools/syz-upgrade [no test files]
? github.com/google/syzkaller/tools/syz-usbgen [no test files]
ok github.com/google/syzkaller/vm 8.184s
? github.com/google/syzkaller/vm/adb [no test files]
? github.com/google/syzkaller/vm/bhyve [no test files]
? github.com/google/syzkaller/vm/gce [no test files]
? github.com/google/syzkaller/vm/gvisor [no test files]
ok github.com/google/syzkaller/vm/isolated 0.118s
? github.com/google/syzkaller/vm/kvm [no test files]
? github.com/google/syzkaller/vm/odroid [no test files]
? github.com/google/syzkaller/vm/qemu [no test files]
ok github.com/google/syzkaller/vm/vmimpl 0.129s
? github.com/google/syzkaller/vm/vmm [no test files]
? github.com/google/syzkaller/vm/vmware [no test files]
FAIL