1#!/bin/sh 2 3# 4# SPDX-License-Identifier: BSD-2-Clause 5# 6# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org> 7# 8# Redistribution and use in source and binary forms, with or without 9# modification, are permitted provided that the following conditions 10# are met: 11# 1. Redistributions of source code must retain the above copyright 12# notice, this list of conditions and the following disclaimer. 13# 2. Redistributions in binary form must reproduce the above copyright 14# notice, this list of conditions and the following disclaimer in the 15# documentation and/or other materials provided with the distribution. 16# 17# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27# SUCH DAMAGE. 28# 29 30# procctl(2) fuzz test 31 32prog=`basename ${0%.sh}` 33cat > /tmp/$prog.c <<EOF 34#include <sys/param.h> 35#include <sys/mman.h> 36#include <sys/procctl.h> 37 38#include <err.h> 39#include <pthread.h> 40#include <signal.h> 41#include <stdio.h> 42#include <stdlib.h> 43#include <time.h> 44#include <unistd.h> 45 46static volatile u_int *share; 47 48#define PARALLEL 25 49#define RUNTIME 120 50 51static long 52random_long(long mi, long ma) 53{ 54 return (arc4random() % (ma - mi + 1) + mi); 55} 56 57static void 58flip(void *ap, size_t len) 59{ 60 unsigned char *cp; 61 int byte; 62 unsigned char bit, buf, mask; 63 64 cp = (unsigned char *)ap; 65 byte = random_long(0, len); 66 bit = random_long(0,7); 67 mask = ~(1 << bit); 68 buf = cp[byte]; 69 buf = (buf & mask) | (~buf & ~mask); 70 cp[byte] = buf; 71} 72 73static void * 74tr(void *arg __unused) 75{ 76 usleep(arc4random() % 400); 77 78 return (NULL); 79} 80 81static void 82test(void) { 83 pthread_t thr; 84 struct procctl_reaper_kill killemall; 85 pid_t pid; 86 time_t start; 87 int data[20], debug, e, n, m; 88 89 debug = 0; /* set to 1 for debug output */ 90 n = m = 0; 91 if (procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == -1) 92 err(EXIT_FAILURE, "Fail to acquire the reaper"); 93 start = time(NULL); 94 while (time(NULL) - start < RUNTIME) { 95 m++; 96 share[0] = 0; 97 if ((pid = fork()) == 0) { 98 e = pthread_create(&thr, NULL, tr, NULL); 99 if (e != 0) 100 errc(1, e, "pthread_create"); 101 share[0] = 1; 102 setproctitle("child"); 103 usleep(arc4random() % 200); 104 if (arc4random() % 100 < 2) 105 raise(SIGSEGV); 106 _exit(0); 107 } 108 arc4random_buf(data, sizeof(data)); 109 while (share[0] == 0) 110 usleep(10); 111 killemall.rk_sig = SIGTERM; 112 killemall.rk_flags = 0; 113 flip(&killemall, sizeof(killemall)); 114 if (procctl(P_PID, getpid(), PROC_REAP_KILL, 115 &killemall) == 0) 116 n++; 117 if (waitpid(pid, NULL, 0) != pid) 118 err(1, "waitpid()"); 119 } 120 if (debug == 1) 121 fprintf(stderr, "n = %d out of %d\n", n, m); 122 _exit(0); 123} 124 125int 126main(void) { 127 pid_t pids[PARALLEL]; 128 size_t len; 129 int i; 130 131 len = PAGE_SIZE; 132 if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE, 133 MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED) 134 err(1, "mmap"); 135 for (i = 0; i < PARALLEL; i++) { 136 if ((pids[i] = fork()) == 0) 137 test(); 138 } 139 for (i = 0; i < PARALLEL; i++) 140 if (waitpid(pids[i], NULL, 0) != pids[i]) 141 err(1, "waitpid()"); 142} 143EOF 144cc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 145rm /tmp/$prog.c 146 147here=`pwd` 148cd /tmp 149./$prog; s=$? 150cd $here 151 152rm -f /tmp/$prog /tmp/$prog.core 153exit $s 154