// https://syzkaller.appspot.com/bug?id=ee786027f6824e39abc707b38fe8b1c660c5d44c #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include int fd_size; int fd_raw; int fd_marker; void *size_thread(void *arg) { while (1) { if (pwrite(fd_size, "4\n", 2, 0) < 0) { // Ignore errors as it might fail if busy } usleep(1000); if (pwrite(fd_size, "8\n", 2, 0) < 0) { // Ignore errors } usleep(1000); } return NULL; } void *read_thread(void *arg) { char buf[8192]; while (1) { if (read(fd_raw, buf, sizeof(buf)) < 0) { // Ignore errors, especially EAGAIN due to O_NONBLOCK } } return NULL; } void *write_thread(void *arg) { char buf[1024]; memset(buf, 'A', sizeof(buf) - 1); buf[sizeof(buf) - 1] = '\n'; while (1) { if (write(fd_marker, buf, sizeof(buf)) < 0) { // Ignore errors } } return NULL; } int main() { fd_size = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY); if (fd_size < 0) { fd_size = open("/sys/kernel/debug/tracing/buffer_subbuf_size_kb", O_WRONLY); } if (fd_size < 0) { printf("[-] Failed to open buffer_subbuf_size_kb: %s\n", strerror(errno)); exit(1); } printf("[+] Opened buffer_subbuf_size_kb successfully.\n"); fd_raw = open("/sys/kernel/tracing/per_cpu/cpu0/trace_pipe_raw", O_RDONLY | O_NONBLOCK); if (fd_raw < 0) { fd_raw = open("/sys/kernel/debug/tracing/per_cpu/cpu0/trace_pipe_raw", O_RDONLY | O_NONBLOCK); } if (fd_raw < 0) { printf("[-] Failed to open trace_pipe_raw: %s\n", strerror(errno)); exit(1); } printf("[+] Opened trace_pipe_raw successfully.\n"); fd_marker = open("/sys/kernel/tracing/trace_marker", O_WRONLY); if (fd_marker < 0) { fd_marker = open("/sys/kernel/debug/tracing/trace_marker", O_WRONLY); } if (fd_marker < 0) { printf("[-] Failed to open trace_marker: %s\n", strerror(errno)); exit(1); } printf("[+] Opened trace_marker successfully.\n"); pthread_t t1, t2, t3; if (pthread_create(&t1, NULL, size_thread, NULL) != 0) { printf("[-] Failed to create size_thread: %s\n", strerror(errno)); exit(1); } printf("[+] Created size_thread successfully.\n"); if (pthread_create(&t2, NULL, read_thread, NULL) != 0) { printf("[-] Failed to create read_thread: %s\n", strerror(errno)); exit(1); } printf("[+] Created read_thread successfully.\n"); if (pthread_create(&t3, NULL, write_thread, NULL) != 0) { printf("[-] Failed to create write_thread: %s\n", strerror(errno)); exit(1); } printf("[+] Created write_thread successfully.\n"); cpu_set_t set; CPU_ZERO(&set); CPU_SET(0, &set); if (pthread_setaffinity_np(t2, sizeof(set), &set) != 0) { printf("[-] Failed to set affinity for read_thread: %s\n", strerror(errno)); exit(1); } printf("[+] Set affinity for read_thread successfully.\n"); if (pthread_setaffinity_np(t3, sizeof(set), &set) != 0) { printf("[-] Failed to set affinity for write_thread: %s\n", strerror(errno)); exit(1); } printf("[+] Set affinity for write_thread successfully.\n"); sleep(10); printf("[+] Finished sleeping. Exiting.\n"); return 0; }