// https://syzkaller.appspot.com/bug?id=276d5f5b76a5b4b1d63652231fd5f8d5d15e1f1f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #ifndef __NR_io_uring_register #define __NR_io_uring_register 427 #endif #ifndef __NR_io_uring_setup #define __NR_io_uring_setup 425 #endif #define SIZEOF_IO_URING_SQE 64 #define SIZEOF_IO_URING_CQE 16 #define SQ_HEAD_OFFSET 0 #define SQ_TAIL_OFFSET 64 #define SQ_RING_MASK_OFFSET 256 #define SQ_RING_ENTRIES_OFFSET 264 #define SQ_FLAGS_OFFSET 276 #define SQ_DROPPED_OFFSET 272 #define CQ_HEAD_OFFSET 128 #define CQ_TAIL_OFFSET 192 #define CQ_RING_MASK_OFFSET 260 #define CQ_RING_ENTRIES_OFFSET 268 #define CQ_RING_OVERFLOW_OFFSET 284 #define CQ_FLAGS_OFFSET 280 #define CQ_CQES_OFFSET 320 struct io_sqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t flags; uint32_t dropped; uint32_t array; uint32_t resv1; uint64_t resv2; }; struct io_cqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t overflow; uint32_t cqes; uint64_t resv[2]; }; struct io_uring_params { uint32_t sq_entries; uint32_t cq_entries; uint32_t flags; uint32_t sq_thread_cpu; uint32_t sq_thread_idle; uint32_t features; uint32_t resv[4]; struct io_sqring_offsets sq_off; struct io_cqring_offsets cq_off; }; #define IORING_OFF_SQ_RING 0 #define IORING_OFF_SQES 0x10000000ULL #define IORING_SETUP_SQE128 (1U << 10) #define IORING_SETUP_CQE32 (1U << 11) static long syz_io_uring_setup(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint32_t entries = (uint32_t)a0; struct io_uring_params* setup_params = (struct io_uring_params*)a1; void** ring_ptr_out = (void**)a2; void** sqes_ptr_out = (void**)a3; setup_params->flags &= ~(IORING_SETUP_CQE32 | IORING_SETUP_SQE128); uint32_t fd_io_uring = syscall(__NR_io_uring_setup, entries, setup_params); uint32_t sq_ring_sz = setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t); uint32_t cq_ring_sz = setup_params->cq_off.cqes + setup_params->cq_entries * SIZEOF_IO_URING_CQE; uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz; *ring_ptr_out = mmap(0, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, fd_io_uring, IORING_OFF_SQ_RING); uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE; *sqes_ptr_out = mmap(0, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, fd_io_uring, IORING_OFF_SQES); uint32_t* array = (uint32_t*)((uintptr_t)*ring_ptr_out + setup_params->sq_off.array); for (uint32_t index = 0; index < entries; index++) array[index] = index; return fd_io_uring; } uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // syz_io_uring_setup arguments: [ // entries: int32 = 0x45 (4 bytes) // params: ptr[inout, io_uring_params] { // io_uring_params { // sq_entries: int32 = 0x0 (4 bytes) // cq_entries: int32 = 0x0 (4 bytes) // flags: io_uring_setup_flags = 0x40 (4 bytes) // sq_thread_cpu: int32 = 0x2 (4 bytes) // sq_thread_idle: int32 = 0x18 (4 bytes) // features: int32 = 0x0 (4 bytes) // wq_fd: fd_io_uring (resource) // resv: buffer: {00 00 00 00 00 00 00 00 00 00 00 00} (length 0xc) // sq_off: array[int32] { // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // } // cq_off: array[int32] { // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // int32 = 0x0 (4 bytes) // } // } // } // ring_ptr: ptr[out, ring_ptr] { // ring_ptr (resource) // } // sqes_ptr: ptr[out, sqes_ptr] { // sqes_ptr (resource) // } // ] // returns fd_io_uring *(uint32_t*)0x200000000304 = 0; *(uint32_t*)0x200000000308 = 0x40; *(uint32_t*)0x20000000030c = 2; *(uint32_t*)0x200000000310 = 0x18; *(uint32_t*)0x200000000318 = -1; memset((void*)0x20000000031c, 0, 12); res = -1; res = syz_io_uring_setup(/*entries=*/0x45, /*params=*/0x200000000300, /*ring_ptr=*/0x200000000100, /*sqes_ptr=*/0x2000000000c0); if (res != -1) r[0] = res; // io_uring_register$IORING_REGISTER_PBUF_RING arguments: [ // fd: fd_io_uring (resource) // opcode: const = 0x22 (8 bytes) // arg: ptr[in, io_uring_buf_reg] { // io_uring_buf_reg { // ring_addr: ptr[in, io_uring_buf_array] { // io_uring_buf_array { // data: array[io_uring_buf] { // io_uring_buf { // addr: nil // len: len = 0x80000 (4 bytes) // bid: int16 = 0x1 (2 bytes) // resv: const = 0x0 (2 bytes) // } // } // } // } // ring_entries: len = 0x1 (4 bytes) // bgid: int16 = 0x0 (2 bytes) // flags: const = 0x0 (2 bytes) // resv: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00} (length 0x18) // } // } // nr_args: const = 0x1 (8 bytes) // ] *(uint64_t*)0x200000000200 = 0x200000001000; *(uint64_t*)0x200000001000 = 0; *(uint32_t*)0x200000001008 = 0x80000; *(uint16_t*)0x20000000100c = 1; *(uint16_t*)0x20000000100e = 0; *(uint32_t*)0x200000000208 = 1; *(uint16_t*)0x20000000020c = 0; *(uint16_t*)0x20000000020e = 0; memset((void*)0x200000000210, 0, 24); syscall(__NR_io_uring_register, /*fd=*/r[0], /*opcode=*/0x22ul, /*arg=*/0x200000000200ul, /*nr_args=*/1ul); return 0; }