1#!/bin/sh 2 3# 4# SPDX-License-Identifier: BSD-2-Clause 5# 6# Copyright (c) 2020 Peter Holm <pho@FreeBSD.org> 7# 8# Redistribution and use in source and binary forms, with or without 9# modification, are permitted provided that the following conditions 10# are met: 11# 1. Redistributions of source code must retain the above copyright 12# notice, this list of conditions and the following disclaimer. 13# 2. Redistributions in binary form must reproduce the above copyright 14# notice, this list of conditions and the following disclaimer in the 15# documentation and/or other materials provided with the distribution. 16# 17# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27# SUCH DAMAGE. 28# 29 30# setsockopt() fuzz test scenario inspired by syzkaller. 31 32# "panic: mtx_lock() of spin mutex (null) @ 33# ../../../dev/hyperv/hvsock/hv_sock.c:519" seen. 34# https://people.freebsd.org/~pho/stress/log/setsockopt.txt 35# Introduced by r361275 36# Fixed by r361360 37 38. ../default.cfg 39 40dir=/tmp 41odir=`pwd` 42cd $dir 43sed '1,/^EOF/d' < $odir/$0 > $dir/setsockopt.c 44mycc -o setsockopt -Wall -Wextra -O0 -g setsockopt.c || exit 1 45rm -f setsockopt.c 46 47daemon sh -c "(cd $odir/../testcases/swap; ./swap -t 5m)" > /dev/null 2>&1 48/tmp/setsockopt 49s=$? 50while pgrep -q swap; do 51 pkill -9 swap 52done 53rm -rf /tmp/setsockopt /tmp/setsockopt.c 54exit $s 55EOF 56#include <sys/param.h> 57#include <sys/socket.h> 58#include <sys/stat.h> 59#include <sys/wait.h> 60 61#include <netinet/in.h> 62 63#include <err.h> 64#include <errno.h> 65#include <fcntl.h> 66#include <netdb.h> 67#include <signal.h> 68#include <stdio.h> 69#include <stdlib.h> 70#include <string.h> 71#include <time.h> 72#include <unistd.h> 73 74#define PARALLEL 128 75#define RUNTIME (3 * 60) 76 77static int port; 78 79static void 80test(int idx) { 81 struct hostent *hostent; 82 struct sockaddr_in inetaddr; 83 int i, j, r; 84 int tcpsock, on; 85 86 on = 1; 87 for (i = 1; i < 5; i++) { 88 for (j = 0; j < 10000; j++) { 89 if ((tcpsock = socket(arc4random() % 64, arc4random() % 10, arc4random() % 10)) != -1) 90 break; 91 } 92 if (tcpsock == -1) 93 _exit(0); 94 95 /* 96 if (setsockopt(tcpsock, 97 SOL_SOCKET, SO_REUSEADDR, (char *)&on, sizeof(on)) < 0) 98 err(1, "setsockopt(), %s:%d", __FILE__, __LINE__); 99 */ 100 for (j = 0; j < 10000; j++) { 101 r = setsockopt(tcpsock, arc4random(), arc4random(), (char *)&on, sizeof(on)); 102 if (r != -1) 103 break; 104 } 105 106 hostent = gethostbyname ("localhost"); 107 r = -1; 108 for (j = 0; j < 10000 && r != 0; j++) { 109 bzero((char *) &inetaddr, sizeof(inetaddr)); 110 memcpy (&inetaddr.sin_addr.s_addr, hostent->h_addr, 111 sizeof (struct in_addr)); 112 113// inetaddr.sin_family = AF_INET; 114 inetaddr.sin_family = arc4random() % 128; 115// inetaddr.sin_addr.s_addr = INADDR_ANY; 116 inetaddr.sin_addr.s_addr = arc4random(); 117 inetaddr.sin_port = htons(port + idx); 118 inetaddr.sin_len = sizeof(inetaddr); 119 120 alarm(1); 121 r = connect(tcpsock, (struct sockaddr *) &inetaddr, 122 sizeof(inetaddr)); 123 alarm(0); 124 } 125 usleep(1000); 126 close(tcpsock); 127 } 128 write(tcpsock, "a", 1); 129 _exit(0); 130} 131 132int 133main(void) 134{ 135 time_t start; 136 int i, pids[PARALLEL], status; 137 138 port = 77665; 139 start = time(NULL); 140 while ((time(NULL) - start) < RUNTIME) { 141 for (i = 0; i < PARALLEL; i++) { 142 if ((pids[i] = fork()) == 0) 143 test(i); 144 } 145 for (i = 0; i < PARALLEL; i++) { 146 if (waitpid(pids[i], &status, 0) == -1) 147 err(1, "waitpid(%d)", pids[i]); 148 } 149 } 150 151 return (0); 152} 153