1#!/bin/sh 2 3# 4# Copyright (c) 2011 Peter Holm <pho@FreeBSD.org> 5# All rights reserved. 6# 7# Redistribution and use in source and binary forms, with or without 8# modification, are permitted provided that the following conditions 9# are met: 10# 1. Redistributions of source code must retain the above copyright 11# notice, this list of conditions and the following disclaimer. 12# 2. Redistributions in binary form must reproduce the above copyright 13# notice, this list of conditions and the following disclaimer in the 14# documentation and/or other materials provided with the distribution. 15# 16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26# SUCH DAMAGE. 27# 28 29# readdir(3) fuzzing inspired by the iknowthis test suite 30# by Tavis Ormandy <taviso cmpxchg8b com> 31 32# "panic: kmem_malloc(1328054272): kmem_map too small" seen 33 34[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 35 36. ../default.cfg 37 38here=`pwd` 39cd /tmp 40sed '1,/^EOF/d' < $here/$0 > readdir.c 41mycc -o readdir -Wall -Wextra readdir.c || exit 1 42rm -f readdir.c 43 44mount | grep $mntpoint | grep -q /dev/md && umount -f $mntpoint 45mdconfig -l | grep -q md$mdstart && mdconfig -d -u $mdstart 46 47mount -t tmpfs tmpfs $mntpoint 48echo "Testing tmpfs(4)" 49cp -a /usr/include $mntpoint 50/tmp/readdir $mntpoint 51umount $mntpoint 52 53echo "Testing fdescfs(4)" 54kldstat -v | grep -q fdescfs || { kldload fdescfs.ko; loaded=1; } 55mount -t fdescfs null /dev/fd 56/tmp/readdir /dev/fd 57umount /dev/fd 58[ $unload ] && kldunload fdescfs.ko 59 60echo "Testing procfs(4)" 61mount -t procfs procfs $mntpoint 62/tmp/readdir $mntpoint 63umount $mntpoint 64 65if ping -c 2 `echo $nfs_export | sed 's/:.*//'` > /dev/null 2>&1; then 66 echo "Testing nfs" 67 mount -t nfs -o nfsv3,tcp,nolockd,retrycnt=3,soft,timeout=1 \ 68 $nfs_export $mntpoint 69 /tmp/readdir $mntpoint 70 umount $mntpoint 71fi 72 73mdconfig -a -t swap -s 1g -u $mdstart || exit 1 74newfs md$mdstart > /dev/null 75mount /dev/md$mdstart $mntpoint 76cp -a /usr/include $mntpoint 77echo "Testing UFS" 78/tmp/readdir $mntpoint 79umount $mntpoint 80mdconfig -d -u $mdstart 81 82mdconfig -a -t swap -s 1g -u $mdstart || exit 1 83newfs $newfs_flags md$mdstart > /dev/null 84mount /dev/md$mdstart $mntpoint 85cp -a /usr/include $mntpoint 86echo "Testing FFS" 87/tmp/readdir $mntpoint 88umount $mntpoint 89mdconfig -d -u $mdstart 90 91mount -t nullfs /bin $mntpoint 92echo "Testing nullfs(4)" 93/tmp/readdir $mntpoint 94umount $mntpoint 95 96rm -f /tmp/readdir 97exit 0 98EOF 99#include <sys/types.h> 100#include <sys/uio.h> 101#include <sys/wait.h> 102 103#include <dirent.h> 104#include <err.h> 105#include <fcntl.h> 106#include <signal.h> 107#include <stdio.h> 108#include <stdlib.h> 109#include <strings.h> 110#include <time.h> 111#include <unistd.h> 112 113#define RUNTIME 120 114 115/* copy from /usr/src/lib/libc/gen/gen-private.h */ 116struct _telldir; /* see telldir.h */ 117struct pthread_mutex; 118 119/* 120 * Structure describing an open directory. 121 * 122 * NOTE. Change structure layout with care, at least dd_fd field has to 123 * remain unchanged to guarantee backward compatibility. 124 */ 125struct _dirdesc { 126 int dd_fd; /* file descriptor associated with directory */ 127 long dd_loc; /* offset in current buffer */ 128 long dd_size; /* amount of data returned by getdirentries */ 129 char *dd_buf; /* data buffer */ 130 int dd_len; /* size of data buffer */ 131 long dd_seek; /* magic cookie returned by getdirentries */ 132 long dd_rewind; /* magic cookie for rewinding */ 133 int dd_flags; /* flags for readdir */ 134 struct pthread_mutex *dd_lock; /* lock */ 135 struct _telldir *dd_td; /* telldir position recording */ 136}; 137/* End copy */ 138 139static void 140hand(int i __unused) { /* handler */ 141 _exit(1); 142} 143 144static void 145test(char *path) 146{ 147 DIR *dirp, fuzz; 148 int i; 149 150 signal(SIGSEGV, hand); 151 alarm(300); 152 for (i = 0; i < 2000; i++) { 153 if ((dirp = opendir(path)) == NULL) 154 break; 155 bcopy(dirp, &fuzz, sizeof(fuzz)); 156 fuzz.dd_len = arc4random(); 157 readdir(&fuzz); 158 closedir(dirp); 159 } 160 161 _exit(0); 162} 163 164int 165main(int argc __unused, char **argv) 166{ 167 time_t start; 168 169 start = time(NULL); 170 while (time(NULL) - start < RUNTIME) { 171 if (fork() == 0) 172 test(argv[1]); 173 wait(NULL); 174 } 175 176 return (0); 177} 178