Date: Wed, 1 Jun 2022 08:04:08 GMT From: Peter Holm <pho@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 4d0adee4e678 - main - stress2: Added procctl(2) PROC_REAP_KILL regression tests Message-ID: <202206010804.251848aX024116@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by pho: URL: https://cgit.FreeBSD.org/src/commit/?id=4d0adee4e678d1e1b973fd7cf0650950f609a44b commit 4d0adee4e678d1e1b973fd7cf0650950f609a44b Author: Peter Holm <pho@FreeBSD.org> AuthorDate: 2022-06-01 07:58:28 +0000 Commit: Peter Holm <pho@FreeBSD.org> CommitDate: 2022-06-01 07:58:28 +0000 stress2: Added procctl(2) PROC_REAP_KILL regression tests --- tools/test/stress2/misc/reaper2.sh | 131 ++++++++++ tools/test/stress2/misc/reaper3.sh | 155 +++++++++++ tools/test/stress2/misc/reaper4.sh | 154 +++++++++++ tools/test/stress2/misc/reaper5.sh | 40 +++ tools/test/stress2/misc/syzkaller52.sh | 458 +++++++++++++++++++++++++++++++++ tools/test/stress2/misc/syzkaller53.sh | 172 +++++++++++++ 6 files changed, 1110 insertions(+) diff --git a/tools/test/stress2/misc/reaper2.sh b/tools/test/stress2/misc/reaper2.sh new file mode 100755 index 000000000000..8290e38d34e4 --- /dev/null +++ b/tools/test/stress2/misc/reaper2.sh @@ -0,0 +1,131 @@ +#!/bin/sh + +# +# SPDX-License-Identifier: BSD-2-Clause-FreeBSD +# +# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org> +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +# procctl(2) threaded test + +# panic: exiting process is stopped" seen: +# https://people.freebsd.org/~pho/stress/log/log0285.txt + +prog=`basename ${0%.sh}` +cat > /tmp/$prog.c <<EOF +#include <sys/param.h> +#include <sys/mman.h> +#include <sys/procctl.h> + +#include <err.h> +#include <pthread.h> +#include <stdio.h> +#include <stdlib.h> +#include <time.h> +#include <unistd.h> + +static volatile u_int *share; + +#define PARALLEL 25 +#define RUNTIME 120 + +static void * +tr(void *arg __unused) +{ + for (;;) + pause(); + + return (NULL); +} + +static void +test(void) { + pthread_t thr; + struct procctl_reaper_kill killemall; + pid_t pid; + time_t start; + int data[20], e, n, m; + + n = m = 0; + if (procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == -1) + err(EXIT_FAILURE, "Fail to acquire the reaper"); + start = time(NULL); + while (time(NULL) - start < RUNTIME) { + m++; + share[0] = 0; + if ((pid = fork()) == 0) { + e = pthread_create(&thr, NULL, tr, NULL); + if (e != 0) + errc(1, e, "pthread_create"); + share[0] = 1; + setproctitle("child"); + usleep(arc4random() % 200); + _exit(0); + } + arc4random_buf(data, sizeof(data)); + while (share[0] == 0) + usleep(10); + killemall.rk_sig = SIGTERM; + killemall.rk_flags = 0; + if (procctl(P_PID, getpid(), PROC_REAP_KILL, + &killemall) == 0) + n++; + if (waitpid(pid, NULL, 0) != pid) + err(1, "waitpid()"); + } +#if defined(DEBUG) + fprintf(stderr, "n = %d out of %d\n", n, m); +#endif + _exit(0); +} + +int +main(void) { + pid_t pids[PARALLEL]; + size_t len; + int i; + + len = PAGE_SIZE; + if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE, + MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED) + err(1, "mmap"); + for (i = 0; i < PARALLEL; i++) { + if ((pids[i] = fork()) == 0) + test(); + } + for (i = 0; i < PARALLEL; i++) + if (waitpid(pids[i], NULL, 0) != pids[i]) + err(1, "waitpid()"); +} +EOF +cc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 +rm /tmp/$prog.c + +here=`pwd` +cd /tmp +./$prog; s=$? +cd $here + +rm /tmp/$prog +exit $s diff --git a/tools/test/stress2/misc/reaper3.sh b/tools/test/stress2/misc/reaper3.sh new file mode 100755 index 000000000000..fdf715fa7b0b --- /dev/null +++ b/tools/test/stress2/misc/reaper3.sh @@ -0,0 +1,155 @@ +#!/bin/sh + +# +# SPDX-License-Identifier: BSD-2-Clause-FreeBSD +# +# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org> +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +# procctl(2) fuzz test + +prog=`basename ${0%.sh}` +cat > /tmp/$prog.c <<EOF +#include <sys/param.h> +#include <sys/mman.h> +#include <sys/procctl.h> + +#include <err.h> +#include <pthread.h> +#include <signal.h> +#include <stdio.h> +#include <stdlib.h> +#include <time.h> +#include <unistd.h> + +static volatile u_int *share; + +#define PARALLEL 25 +#define RUNTIME 120 + +static long +random_long(long mi, long ma) +{ + return (arc4random() % (ma - mi + 1) + mi); +} + +static void +flip(void *ap, size_t len) +{ + unsigned char *cp; + int byte; + unsigned char bit, buf, mask, old __unused; + + cp = (unsigned char *)ap; + byte = random_long(0, len); + bit = random_long(0,7); + mask = ~(1 << bit); + buf = cp[byte]; + old = cp[byte]; + buf = (buf & mask) | (~buf & ~mask); + cp[byte] = buf; +} + +static void * +tr(void *arg __unused) +{ + for (;;) + pause(); + + return (NULL); +} + +static void +test(void) { + pthread_t thr; + struct procctl_reaper_kill killemall; + pid_t pid; + time_t start; + int data[20], e, n, m; + + n = m = 0; + if (procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == -1) + err(EXIT_FAILURE, "Fail to acquire the reaper"); + start = time(NULL); + while (time(NULL) - start < RUNTIME) { + m++; + share[0] = 0; + if ((pid = fork()) == 0) { + e = pthread_create(&thr, NULL, tr, NULL); + if (e != 0) + errc(1, e, "pthread_create"); + share[0] = 1; + setproctitle("child"); + usleep(arc4random() % 200); + if (arc4random() % 100 < 2) + raise(SIGSEGV); + _exit(0); + } + arc4random_buf(data, sizeof(data)); + while (share[0] == 0) + usleep(10); + killemall.rk_sig = SIGTERM; + killemall.rk_flags = 0; + flip(&killemall, sizeof(killemall)); + if (procctl(P_PID, getpid(), PROC_REAP_KILL, + &killemall) == 0) + n++; + if (waitpid(pid, NULL, 0) != pid) + err(1, "waitpid()"); + } +#if defined(DEBUG) + fprintf(stderr, "n = %d out of %d\n", n, m); +#endif + _exit(0); +} + +int +main(void) { + pid_t pids[PARALLEL]; + size_t len; + int i; + + len = PAGE_SIZE; + if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE, + MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED) + err(1, "mmap"); + for (i = 0; i < PARALLEL; i++) { + if ((pids[i] = fork()) == 0) + test(); + } + for (i = 0; i < PARALLEL; i++) + if (waitpid(pids[i], NULL, 0) != pids[i]) + err(1, "waitpid()"); +} +EOF +cc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 +rm /tmp/$prog.c + +here=`pwd` +cd /tmp +./$prog; s=$? +cd $here + +rm -f /tmp/$prog /tmp/$prog.core +exit $s diff --git a/tools/test/stress2/misc/reaper4.sh b/tools/test/stress2/misc/reaper4.sh new file mode 100755 index 000000000000..bf400e396e63 --- /dev/null +++ b/tools/test/stress2/misc/reaper4.sh @@ -0,0 +1,154 @@ +#!/bin/sh + +# +# SPDX-License-Identifier: BSD-2-Clause-FreeBSD +# +# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org> +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +# procctl(2) fuzz test + +prog=`basename ${0%.sh}` +cat > /tmp/$prog.c <<EOF +#include <sys/param.h> +#include <sys/mman.h> +#include <sys/procctl.h> + +#include <err.h> +#include <pthread.h> +#include <signal.h> +#include <stdio.h> +#include <stdlib.h> +#include <time.h> +#include <unistd.h> + +static volatile u_int *share; + +#define PARALLEL 25 +#define RUNTIME 120 + +static long +random_long(long mi, long ma) +{ + return (arc4random() % (ma - mi + 1) + mi); +} + +static void +flip(void *ap, size_t len) +{ + unsigned char *cp; + int byte; + unsigned char bit, buf, mask, old __unused; + + cp = (unsigned char *)ap; + byte = random_long(0, len); + bit = random_long(0,7); + mask = ~(1 << bit); + buf = cp[byte]; + old = cp[byte]; + buf = (buf & mask) | (~buf & ~mask); + cp[byte] = buf; +} + +static void * +tr(void *arg __unused) +{ + usleep(arc4random() % 400); + + return (NULL); +} + +static void +test(void) { + pthread_t thr; + struct procctl_reaper_kill killemall; + pid_t pid; + time_t start; + int data[20], e, n, m; + + n = m = 0; + if (procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == -1) + err(EXIT_FAILURE, "Fail to acquire the reaper"); + start = time(NULL); + while (time(NULL) - start < RUNTIME) { + m++; + share[0] = 0; + if ((pid = fork()) == 0) { + e = pthread_create(&thr, NULL, tr, NULL); + if (e != 0) + errc(1, e, "pthread_create"); + share[0] = 1; + setproctitle("child"); + usleep(arc4random() % 200); + if (arc4random() % 100 < 2) + raise(SIGSEGV); + _exit(0); + } + arc4random_buf(data, sizeof(data)); + while (share[0] == 0) + usleep(10); + killemall.rk_sig = SIGTERM; + killemall.rk_flags = 0; + flip(&killemall, sizeof(killemall)); + if (procctl(P_PID, getpid(), PROC_REAP_KILL, + &killemall) == 0) + n++; + if (waitpid(pid, NULL, 0) != pid) + err(1, "waitpid()"); + } +#if defined(DEBUG) + fprintf(stderr, "n = %d out of %d\n", n, m); +#endif + _exit(0); +} + +int +main(void) { + pid_t pids[PARALLEL]; + size_t len; + int i; + + len = PAGE_SIZE; + if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE, + MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED) + err(1, "mmap"); + for (i = 0; i < PARALLEL; i++) { + if ((pids[i] = fork()) == 0) + test(); + } + for (i = 0; i < PARALLEL; i++) + if (waitpid(pids[i], NULL, 0) != pids[i]) + err(1, "waitpid()"); +} +EOF +cc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 +rm /tmp/$prog.c + +here=`pwd` +cd /tmp +./$prog; s=$? +cd $here + +rm -f /tmp/$prog /tmp/$prog.core +exit $s diff --git a/tools/test/stress2/misc/reaper5.sh b/tools/test/stress2/misc/reaper5.sh new file mode 100755 index 000000000000..eec58c36713a --- /dev/null +++ b/tools/test/stress2/misc/reaper5.sh @@ -0,0 +1,40 @@ +#!/bin/sh + +# +# SPDX-License-Identifier: BSD-2-Clause-FreeBSD +# +# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org> +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +# "panic: Assertion (t->parent->p_treeflag & P_TREE_REAPER) != 0 failed at +# ../../../kern/kern_procctl.c:373" seen in WiP kernel code + +start=`date +%s` +while [ $((`date +%s` - start)) -lt 120 ]; do + for i in `jot 100`; do + timeout 2s sh -c "timeout 2s sleep 60" & + done + wait +done +exit 0 diff --git a/tools/test/stress2/misc/syzkaller52.sh b/tools/test/stress2/misc/syzkaller52.sh new file mode 100755 index 000000000000..ec5244bdae65 --- /dev/null +++ b/tools/test/stress2/misc/syzkaller52.sh @@ -0,0 +1,458 @@ +#!/bin/sh + +# panic: already suspended +# cpuid = 6 +# time = 1651176216 +# KDB: stack backtrace: +# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe014194ea70 +# vpanic() at vpanic+0x17f/frame 0xfffffe014194eac0 +# panic() at panic+0x43/frame 0xfffffe014194eb20 +# thread_single() at thread_single+0x774/frame 0xfffffe014194eb90 +# reap_kill_proc() at reap_kill_proc+0x296/frame 0xfffffe014194ebf0 +# reap_kill() at reap_kill+0x371/frame 0xfffffe014194ed00 +# kern_procctl() at kern_procctl+0x30b/frame 0xfffffe014194ed70 +# sys_procctl() at sys_procctl+0x11e/frame 0xfffffe014194ee00 +# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe014194ef30 +# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe014194ef30 +# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x8226f27aa, rsp = 0x82803ef48, rbp = 0x82803ef70 --- +# KDB: enter: panic +# [ thread pid 3074 tid 100404 ] +# Stopped at kdb_enter+0x32: movq $0,0x12790b3(%rip) +# db> x/s version +# FreeBSD 14.0-CURRENT #0 main-n255099-0923ff82fb383: Thu Apr 28 09:48:48 CEST 2022 +# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO +# db> + +[ `uname -p` != "amd64" ] && exit 0 + +. ../default.cfg +cat > /tmp/syzkaller52.c <<EOF +// https://syzkaller.appspot.com/bug?id=20185b6047d7371885412b56ff188be88f740eab +// autogenerated by syzkaller (https://github.com/google/syzkaller) +// Reported-by: syzbot+79cd12371d417441b175@syzkaller.appspotmail.com + +#define _GNU_SOURCE + +#include <sys/types.h> + +#include <dirent.h> +#include <errno.h> +#include <pthread.h> +#include <pwd.h> +#include <signal.h> +#include <stdarg.h> +#include <stdbool.h> +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <sys/endian.h> +#include <sys/resource.h> +#include <sys/stat.h> +#include <sys/syscall.h> +#include <sys/wait.h> +#include <time.h> +#include <unistd.h> + +static unsigned long long procid; + +static void kill_and_wait(int pid, int* status) +{ + kill(pid, SIGKILL); + while (waitpid(-1, status, 0) != pid) { + } +} + +static void sleep_ms(uint64_t ms) +{ + usleep(ms * 1000); +} + +static uint64_t current_time_ms(void) +{ + struct timespec ts; + if (clock_gettime(CLOCK_MONOTONIC, &ts)) + exit(1); + return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; +} + +static void use_temporary_dir(void) +{ + char tmpdir_template[] = "./syzkaller.XXXXXX"; + char* tmpdir = mkdtemp(tmpdir_template); + if (!tmpdir) + exit(1); + if (chmod(tmpdir, 0777)) + exit(1); + if (chdir(tmpdir)) + exit(1); +} + +static void __attribute__((noinline)) remove_dir(const char* dir) +{ + DIR* dp = opendir(dir); + if (dp == NULL) { + if (errno == EACCES) { + if (rmdir(dir)) + exit(1); + return; + } + exit(1); + } + struct dirent* ep = 0; + while ((ep = readdir(dp))) { + if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) + continue; + char filename[FILENAME_MAX]; + snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); + struct stat st; + if (lstat(filename, &st)) + exit(1); + if (S_ISDIR(st.st_mode)) { + remove_dir(filename); + continue; + } + if (unlink(filename)) + exit(1); + } + closedir(dp); + if (rmdir(dir)) + exit(1); +} + +static void thread_start(void* (*fn)(void*), void* arg) +{ + pthread_t th; + pthread_attr_t attr; + pthread_attr_init(&attr); + pthread_attr_setstacksize(&attr, 128 << 10); + int i = 0; + for (; i < 100; i++) { + if (pthread_create(&th, &attr, fn, arg) == 0) { + pthread_attr_destroy(&attr); + return; + } + if (errno == EAGAIN) { + usleep(50); + continue; + } + break; + } + exit(1); +} + +typedef struct { + pthread_mutex_t mu; + pthread_cond_t cv; + int state; +} event_t; + +static void event_init(event_t* ev) +{ + if (pthread_mutex_init(&ev->mu, 0)) + exit(1); + if (pthread_cond_init(&ev->cv, 0)) + exit(1); + ev->state = 0; +} + +static void event_reset(event_t* ev) +{ + ev->state = 0; +} + +static void event_set(event_t* ev) +{ + pthread_mutex_lock(&ev->mu); + if (ev->state) + exit(1); + ev->state = 1; + pthread_mutex_unlock(&ev->mu); + pthread_cond_broadcast(&ev->cv); +} + +static void event_wait(event_t* ev) +{ + pthread_mutex_lock(&ev->mu); + while (!ev->state) + pthread_cond_wait(&ev->cv, &ev->mu); + pthread_mutex_unlock(&ev->mu); +} + +static int event_isset(event_t* ev) +{ + pthread_mutex_lock(&ev->mu); + int res = ev->state; + pthread_mutex_unlock(&ev->mu); + return res; +} + +static int event_timedwait(event_t* ev, uint64_t timeout) +{ + uint64_t start = current_time_ms(); + uint64_t now = start; + pthread_mutex_lock(&ev->mu); + for (;;) { + if (ev->state) + break; + uint64_t remain = timeout - (now - start); + struct timespec ts; + ts.tv_sec = remain / 1000; + ts.tv_nsec = (remain % 1000) * 1000 * 1000; + pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); + now = current_time_ms(); + if (now - start > timeout) + break; + } + int res = ev->state; + pthread_mutex_unlock(&ev->mu); + return res; +} + +static void sandbox_common() +{ + struct rlimit rlim; + rlim.rlim_cur = rlim.rlim_max = 128 << 20; + setrlimit(RLIMIT_AS, &rlim); + rlim.rlim_cur = rlim.rlim_max = 8 << 20; + setrlimit(RLIMIT_MEMLOCK, &rlim); + rlim.rlim_cur = rlim.rlim_max = 1 << 20; + setrlimit(RLIMIT_FSIZE, &rlim); + rlim.rlim_cur = rlim.rlim_max = 1 << 20; + setrlimit(RLIMIT_STACK, &rlim); + rlim.rlim_cur = rlim.rlim_max = 0; + setrlimit(RLIMIT_CORE, &rlim); + rlim.rlim_cur = rlim.rlim_max = 256; + setrlimit(RLIMIT_NOFILE, &rlim); +} + +static void loop(); + +static int do_sandbox_none(void) +{ + sandbox_common(); + loop(); + return 0; +} + +struct thread_t { + int created, call; + event_t ready, done; +}; + +static struct thread_t threads[16]; +static void execute_call(int call); +static int running; + +static void* thr(void* arg) +{ + struct thread_t* th = (struct thread_t*)arg; + for (;;) { + event_wait(&th->ready); + event_reset(&th->ready); + execute_call(th->call); + __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); + event_set(&th->done); + } + return 0; +} + +static void execute_one(void) +{ + int i, call, thread; + for (call = 0; call < 14; call++) { + for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); + thread++) { + struct thread_t* th = &threads[thread]; + if (!th->created) { + th->created = 1; + event_init(&th->ready); + event_init(&th->done); + event_set(&th->done); + thread_start(thr, th); + } + if (!event_isset(&th->done)) + continue; + event_reset(&th->done); + th->call = call; + __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); + event_set(&th->ready); + event_timedwait(&th->done, 50); + break; + } + } + for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) + sleep_ms(1); +} + +static void execute_one(void); + +#define WAIT_FLAGS 0 + +static void loop(void) +{ + int iter = 0; + for (;; iter++) { + char cwdbuf[32]; + sprintf(cwdbuf, "./%d", iter); + if (mkdir(cwdbuf, 0777)) + exit(1); + int pid = fork(); + if (pid < 0) + exit(1); + if (pid == 0) { + if (chdir(cwdbuf)) + exit(1); + execute_one(); + exit(0); + } + int status = 0; + uint64_t start = current_time_ms(); + for (;;) { + if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) + break; + sleep_ms(1); + if (current_time_ms() - start < 5000) + continue; + kill_and_wait(pid, &status); + break; + } + remove_dir(cwdbuf); + } +} + +uint64_t r[4] = {0x0, 0x0, 0x0, 0x0}; + +void execute_call(int call) +{ + intptr_t res = 0; + switch (call) { + case 0: + *(uint32_t*)0x20000000 = 0x3f; + *(uint32_t*)0x20000004 = 8; + *(uint32_t*)0x20000008 = 0x1000; + *(uint32_t*)0x2000000c = 7; + syscall(SYS_sigsuspend, 0x20000000ul); + break; + case 1: + syscall(SYS_setgid, 0); + break; + case 2: + syscall(SYS_getgroups, 0ul, 0ul); + break; + case 3: + syscall(SYS_setegid, 0); + break; + case 4: + res = syscall(SYS_shmget, 0ul, 0x2000ul, 0x420ul, 0x20ffd000ul); + if (res != -1) + r[0] = res; + break; + case 5: + res = syscall(SYS_getpid); + if (res != -1) + r[1] = res; + break; + case 6: + *(uint32_t*)0x20000200 = -1; + *(uint32_t*)0x20000204 = 0; + *(uint32_t*)0x20000208 = -1; + *(uint32_t*)0x2000020c = 0; + *(uint16_t*)0x20000210 = 0xf965; + *(uint16_t*)0x20000212 = 0x2000; + *(uint32_t*)0x20000214 = 0; + *(uint64_t*)0x20000218 = 0x2d; + *(uint32_t*)0x20000220 = 0x1f; + *(uint64_t*)0x20000228 = 2; + *(uint64_t*)0x20000230 = 4; + *(uint64_t*)0x20000238 = 0; + *(uint32_t*)0x20000240 = r[1]; + *(uint32_t*)0x20000244 = -1; + *(uint16_t*)0x20000248 = 7; + *(uint16_t*)0x2000024a = 0; + *(uint64_t*)0x20000250 = 0; + *(uint64_t*)0x20000258 = 0; + syscall(SYS_shmctl, r[0], 1ul, 0x20000200ul); + break; + case 7: + syscall(SYS_getgid); + break; + case 8: + syscall(SYS___semctl, 0, 0ul, 1ul, 0ul); + break; + case 9: + *(uint32_t*)0x20000300 = 4; + *(uint32_t*)0x20000304 = 0; + *(uint16_t*)0x20000308 = 7; + *(uint16_t*)0x2000030a = 6; + memcpy((void*)0x2000030c, + "\x26\xb9\x52\x60\x70\xe1\xb8\x97\x99\x4b\x39\xd3\xea\x42\xe7\xed", + 16); + syscall(SYS_fhstat, 0x20000300ul, 0ul); + break; + case 10: + res = syscall(SYS_getgid); + if (res != -1) + r[2] = res; + break; + case 11: + *(uint32_t*)0x20000440 = 3; + *(uint32_t*)0x20000444 = 0; + *(uint32_t*)0x20000448 = r[1]; + *(uint32_t*)0x2000044c = 0x81; + *(uint32_t*)0x20000450 = r[1]; + memset((void*)0x20000454, 0, 60); + res = syscall(SYS_procctl, 0ul, r[1], 6ul, 0x20000440ul); + if (res != -1) + r[3] = *(uint32_t*)0x20000450; + break; + case 12: + *(uint32_t*)0x200004c0 = 0; + *(uint32_t*)0x200004c4 = 0; + *(uint32_t*)0x200004c8 = 0; + *(uint32_t*)0x200004cc = r[2]; + *(uint16_t*)0x200004d0 = 0x100; + *(uint16_t*)0x200004d2 = 8; + *(uint32_t*)0x200004d4 = 0; + *(uint64_t*)0x200004d8 = 0x7ff; + *(uint64_t*)0x200004e0 = 0x7f; + *(uint64_t*)0x200004e8 = 0x81; + *(uint64_t*)0x200004f0 = 0xfff; + *(uint64_t*)0x200004f8 = 0x3a; + *(uint64_t*)0x20000500 = 0x100000000; + *(uint64_t*)0x20000508 = 9; + *(uint32_t*)0x20000510 = r[1]; + *(uint32_t*)0x20000514 = r[3]; + *(uint64_t*)0x20000518 = 0; + *(uint64_t*)0x20000520 = 0; + syscall(SYS_msgctl, -1, 1ul, 0x200004c0ul); + break; + case 13: + syscall(SYS_ioctl, -1, 0xc0f24425ul, 0ul); + break; + } +} +int main(void) +{ + syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); + for (procid = 0; procid < 4; procid++) { + if (fork() == 0) { + use_temporary_dir(); + do_sandbox_none(); + } + } + sleep(1000000); + return 0; +} +EOF +mycc -o /tmp/syzkaller52 -Wall -Wextra -O0 /tmp/syzkaller52.c -l pthread || + exit 1 + +start=`date +%s` +while [ $((`date +%s` - start)) -lt 120 ]; do + (cd /tmp; timeout 3m ./syzkaller52) +done + +rm -rf /tmp/syzkaller52 /tmp/syzkaller52.c /tmp/syzkaller52.core \ + /tmp/syzkaller.?????? *** 179 LINES SKIPPED ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202206010804.251848aX024116>