// https://syzkaller.appspot.com/bug?id=293f48c6a63935b5872fac5eafff89a15518864e // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include __attribute__((noreturn)) static void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } } #include #include #include #include #include #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* uctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { _longjmp(segv_env, 1); } doexit(sig); } static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static void execute_one(); extern unsigned long long procid; void loop() { while (1) { execute_one(); } } struct thread_t { int created, running, call; pthread_t th; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static int collide; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { while (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &th->running, FUTEX_WAIT, 0, 0); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); __atomic_store_n(&th->running, 0, __ATOMIC_RELEASE); syscall(SYS_futex, &th->running, FUTEX_WAKE); } return 0; } static void execute(int num_calls) { int call, thread; running = 0; for (call = 0; call < num_calls; call++) { for (thread = 0; thread < sizeof(threads) / sizeof(threads[0]); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); pthread_create(&th->th, &attr, thr, th); } if (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) { th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); __atomic_store_n(&th->running, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &th->running, FUTEX_WAKE); if (collide && call % 2) break; struct timespec ts; ts.tv_sec = 0; ts.tv_nsec = 20 * 1000 * 1000; syscall(SYS_futex, &th->running, FUTEX_WAIT, 1, &ts); if (__atomic_load_n(&running, __ATOMIC_RELAXED)) usleep((call == num_calls - 1) ? 10000 : 1000); break; } } } } #ifndef __NR_bpf #define __NR_bpf 321 #endif uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { long res; switch (call) { case 0: NONFAILING(*(uint32_t*)0x20000200 = 2); NONFAILING(*(uint32_t*)0x20000204 = 0x70); NONFAILING(*(uint8_t*)0x20000208 = 0xe6); NONFAILING(*(uint8_t*)0x20000209 = 0); NONFAILING(*(uint8_t*)0x2000020a = 0); NONFAILING(*(uint8_t*)0x2000020b = 0); NONFAILING(*(uint32_t*)0x2000020c = 0); NONFAILING(*(uint64_t*)0x20000210 = 0); NONFAILING(*(uint64_t*)0x20000218 = 0); NONFAILING(*(uint64_t*)0x20000220 = 0); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 0, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 1, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 2, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 3, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 4, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 5, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 6, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 7, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 8, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 9, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 10, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 11, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 12, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 13, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 14, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 15, 2)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 17, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 18, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 19, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 20, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 21, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 22, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 23, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 24, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 25, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 26, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 27, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 28, 1)); NONFAILING(STORE_BY_BITMASK(uint64_t, 0x20000228, 0, 29, 35)); NONFAILING(*(uint32_t*)0x20000230 = 0); NONFAILING(*(uint32_t*)0x20000234 = 0); NONFAILING(*(uint64_t*)0x20000238 = 0); NONFAILING(*(uint64_t*)0x20000240 = 0); NONFAILING(*(uint64_t*)0x20000248 = 0); NONFAILING(*(uint64_t*)0x20000250 = 0); NONFAILING(*(uint32_t*)0x20000258 = 0); NONFAILING(*(uint32_t*)0x2000025c = 0); NONFAILING(*(uint64_t*)0x20000260 = 0); NONFAILING(*(uint32_t*)0x20000268 = 0); NONFAILING(*(uint16_t*)0x2000026c = 0); NONFAILING(*(uint16_t*)0x2000026e = 0); syscall(__NR_perf_event_open, 0x20000200, 0, 0, -1, 0); break; case 1: NONFAILING(*(uint32_t*)0x20000a40 = -1); syscall(__NR_setsockopt, -1, 0x29, 0x24, 0x20000a40, 0x173); break; case 2: res = syscall(__NR_socketpair, 0, 0, 0, 0x20000140); if (res != -1) NONFAILING(r[0] = *(uint32_t*)0x20000140); break; case 3: syscall(__NR_socket, 0xa, 1, 0); break; case 4: NONFAILING(*(uint32_t*)0x20000100 = r[0]); NONFAILING(*(uint64_t*)0x20000108 = 0x20000040); NONFAILING(memcpy((void*)0x20000040, "\x92\x2c\xe1\x46\x8b\x63\x33\x8b\xdb\x41\x2d\x0d\x30\xcf" "\x28\x37\xe0\xb4\xd9\x45\x76\x4c\x67\xec\x22\xc4\x71\xa8" "\x62\xbb\xfb\x0b\x1f\x0d\x8b\xe7\x91\xf3\x0f\x43\x56\x94" "\xd0\xc7\x4b\x17\xa2\x3a\x01\x95\xf1\x07\x6d\x94\xa1\xaf" "\x96\x80\x30\x18\x77\x61\x1e\xce\xbb\xc6\x0f\x53\x1a\x23" "\xe1\xd9\x3d\xcc\x53\x12\xa1\xb2\x50", 79)); NONFAILING(*(uint64_t*)0x20000110 = 0x200000c0); syscall(__NR_bpf, 4, 0x20000100, 0x18); break; case 5: NONFAILING(*(uint32_t*)0x20000280 = 0x12); NONFAILING(*(uint32_t*)0x20000284 = 9); NONFAILING(*(uint32_t*)0x20000288 = 4); NONFAILING(*(uint32_t*)0x2000028c = 1); NONFAILING(*(uint32_t*)0x20000290 = 0); NONFAILING(*(uint32_t*)0x20000294 = -1); NONFAILING(*(uint32_t*)0x20000298 = 0); NONFAILING(*(uint8_t*)0x2000029c = 0); NONFAILING(*(uint8_t*)0x2000029d = 0); NONFAILING(*(uint8_t*)0x2000029e = 0); NONFAILING(*(uint8_t*)0x2000029f = 0); NONFAILING(*(uint8_t*)0x200002a0 = 0); NONFAILING(*(uint8_t*)0x200002a1 = 0); NONFAILING(*(uint8_t*)0x200002a2 = 0); NONFAILING(*(uint8_t*)0x200002a3 = 0); NONFAILING(*(uint8_t*)0x200002a4 = 0); NONFAILING(*(uint8_t*)0x200002a5 = 0); NONFAILING(*(uint8_t*)0x200002a6 = 0); NONFAILING(*(uint8_t*)0x200002a7 = 0); NONFAILING(*(uint8_t*)0x200002a8 = 0); NONFAILING(*(uint8_t*)0x200002a9 = 0); NONFAILING(*(uint8_t*)0x200002aa = 0); NONFAILING(*(uint8_t*)0x200002ab = 0); res = syscall(__NR_bpf, 0, 0x20000280, 0x34d); if (res != -1) r[1] = res; break; case 6: NONFAILING(*(uint32_t*)0x20000000 = 0); NONFAILING(*(uint32_t*)0x20000004 = 0); NONFAILING(*(uint32_t*)0x20000008 = 4); NONFAILING(*(uint32_t*)0x2000000c = 0); NONFAILING(*(uint32_t*)0x20000010 = 0); NONFAILING(*(uint32_t*)0x20000014 = -1); NONFAILING(*(uint32_t*)0x20000018 = 0); NONFAILING(*(uint8_t*)0x2000001c = 0); NONFAILING(*(uint8_t*)0x2000001d = 0); NONFAILING(*(uint8_t*)0x2000001e = 0); NONFAILING(*(uint8_t*)0x2000001f = 0); NONFAILING(*(uint8_t*)0x20000020 = 0); NONFAILING(*(uint8_t*)0x20000021 = 0); NONFAILING(*(uint8_t*)0x20000022 = 0); NONFAILING(*(uint8_t*)0x20000023 = 0); NONFAILING(*(uint8_t*)0x20000024 = 0); NONFAILING(*(uint8_t*)0x20000025 = 0); NONFAILING(*(uint8_t*)0x20000026 = 0); NONFAILING(*(uint8_t*)0x20000027 = 0); NONFAILING(*(uint8_t*)0x20000028 = 0); NONFAILING(*(uint8_t*)0x20000029 = 0); NONFAILING(*(uint8_t*)0x2000002a = 0); NONFAILING(*(uint8_t*)0x2000002b = 0); syscall(__NR_bpf, 0, 0x20000000, 0xce); break; case 7: NONFAILING(*(uint32_t*)0x20000180 = r[1]); NONFAILING(*(uint64_t*)0x20000188 = 0x20000000); NONFAILING(*(uint64_t*)0x20000190 = 0x20000140); NONFAILING(*(uint64_t*)0x20000198 = 0); syscall(__NR_bpf, 2, 0x20000180, 0x20); break; case 8: NONFAILING(*(uint32_t*)0x20000180 = r[1]); NONFAILING(*(uint64_t*)0x20000188 = 0x20000080); NONFAILING(*(uint64_t*)0x20000190 = 0x20000140); NONFAILING(*(uint64_t*)0x20000198 = 0); syscall(__NR_bpf, 2, 0x20000180, 0x20); break; } } void execute_one() { execute(9); collide = 1; execute(9); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); install_segv_handler(); for (;;) { loop(); } }