// https://syzkaller.appspot.com/bug?id=b64beb52ad2e7733f606ab098fff1c717fd6a923 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } static void execute_one(); extern unsigned long long procid; void loop() { while (1) { execute_one(); } } struct thread_t { int created, running, call; pthread_t th; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static int collide; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { while (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &th->running, FUTEX_WAIT, 0, 0); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); __atomic_store_n(&th->running, 0, __ATOMIC_RELEASE); syscall(SYS_futex, &th->running, FUTEX_WAKE); } return 0; } static void execute(int num_calls) { int call, thread; running = 0; for (call = 0; call < num_calls; call++) { for (thread = 0; thread < sizeof(threads) / sizeof(threads[0]); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); pthread_create(&th->th, &attr, thr, th); } if (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) { th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); __atomic_store_n(&th->running, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &th->running, FUTEX_WAKE); if (collide && call % 2) break; struct timespec ts; ts.tv_sec = 0; ts.tv_nsec = 20 * 1000 * 1000; syscall(SYS_futex, &th->running, FUTEX_WAIT, 1, &ts); if (running) usleep((call == num_calls - 1) ? 10000 : 1000); break; } } } } uint64_t r[10] = { 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0}; void execute_call(int call) { long res; switch (call) { case 0: memcpy((void*)0x20000000, "cpuset.effective_mems", 22); res = syscall(__NR_openat, 0xffffff9c, 0x20000000, 0, 0); if (res != -1) r[0] = res; break; case 1: *(uint32_t*)0x20000080 = 4; syscall(__NR_getsockopt, r[0], 0x29, 0x13, 0x20000040, 0x20000080); break; case 2: res = syscall(__NR_getpgid, -1); if (res != -1) r[1] = res; break; case 3: syscall(__NR_sched_getaffinity, r[1], 8, 0x200000c0); break; case 4: syscall(__NR_waitid, 2, r[1], 0x20000100, 0x1000002, 0x20000140); break; case 5: *(uint32_t*)0x20000400 = 0xe8; syscall(__NR_getsockopt, r[0], 0x29, 0x22, 0x20000300, 0x20000400); break; case 6: res = syscall(__NR_getresgid, 0x20000440, 0x20000480, 0x200004c0); if (res != -1) r[2] = *(uint32_t*)0x20000440; break; case 7: memcpy((void*)0x20000500, "./file0", 8); res = syscall(__NR_lstat, 0x20000500, 0x20000540); if (res != -1) { r[3] = *(uint32_t*)0x2000054c; r[4] = *(uint32_t*)0x20000550; } break; case 8: syscall(__NR_getresgid, 0x200005c0, 0x20000600, 0x20000640); break; case 9: memcpy((void*)0x20000680, "./file0", 8); syscall(__NR_lstat, 0x20000680, 0x200006c0); break; case 10: syscall(__NR_getresgid, 0x20000740, 0x20000780, 0x200007c0); break; case 11: memcpy((void*)0x20000800, "./file0", 8); syscall(__NR_stat, 0x20000800, 0x20000840); break; case 12: syscall(__NR_getegid); break; case 13: *(uint32_t*)0x20000900 = 0xc; res = syscall(__NR_getsockopt, r[0], 1, 0x11, 0x200008c0, 0x20000900); if (res != -1) r[5] = *(uint32_t*)0x200008c0; break; case 14: *(uint32_t*)0x20000980 = 0xc; res = syscall(__NR_getsockopt, r[0], 1, 0x11, 0x20000940, 0x20000980); if (res != -1) r[6] = *(uint32_t*)0x20000944; break; case 15: *(uint32_t*)0x20000b40 = 0; *(uint32_t*)0x20000b44 = 0x20000800; *(uint32_t*)0x20000b48 = 0x400; STORE_BY_BITMASK(uint32_t, 0x20000b4c, 0x2d, 0, 1); STORE_BY_BITMASK(uint32_t, 0x20000b4c, 1, 1, 2); STORE_BY_BITMASK(uint32_t, 0x20000b4c, 9, 3, 1); STORE_BY_BITMASK(uint32_t, 0x20000b4c, 0x8001, 4, 1); STORE_BY_BITMASK(uint32_t, 0x20000b4c, 0xe26c, 5, 1); STORE_BY_BITMASK(uint32_t, 0x20000b4c, 7, 6, 1); STORE_BY_BITMASK(uint32_t, 0x20000b4c, 0x9c7, 7, 1); syscall(__NR_modify_ldt, 0x11, 0x20000b40, 0x10); break; case 16: syscall(__NR_ioctl, r[0], 0x5441, 9); break; case 17: syscall(__NR_clock_getres, 3, 0x20000b80); break; case 18: res = syscall(__NR_socketpair, 0xa, 1, 0, 0x20000bc0); if (res != -1) { r[7] = *(uint32_t*)0x20000bc0; r[8] = *(uint32_t*)0x20000bc4; } break; case 19: syscall(__NR_fcntl, r[8], 0x10, 0x20000c00); break; case 20: *(uint32_t*)0x20000c40 = r[5]; syscall(__NR_ioctl, r[7], 0x8901, 0x20000c40); break; case 21: res = syscall(__NR_semget, 0x798e2633, 6, 0x240); if (res != -1) r[9] = res; break; case 22: *(uint32_t*)0x20000c80 = 0x101; *(uint32_t*)0x20000c84 = r[6]; *(uint32_t*)0x20000c88 = r[4]; *(uint32_t*)0x20000c8c = r[3]; *(uint32_t*)0x20000c90 = r[2]; *(uint32_t*)0x20000c94 = 0x40; *(uint16_t*)0x20000c98 = 7; *(uint16_t*)0x20000c9a = 0; *(uint64_t*)0x20000ca0 = 0; *(uint64_t*)0x20000ca8 = 0; *(uint64_t*)0x20000cb0 = 8; *(uint64_t*)0x20000cb8 = 3; *(uint64_t*)0x20000cc0 = 9; *(uint64_t*)0x20000cc8 = 0; *(uint64_t*)0x20000cd0 = 0; syscall(__NR_semctl, r[9], 0, 1, 0x20000c80); break; } } void execute_one() { execute(23); collide = 1; execute(23); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (;;) { loop(); } }