1#!/bin/sh 2 3# $ pgrep syzkaller21 | xargs ps -lHp 4# UID PID PPID CPU PRI NI VSZ RSS MWCHAN STAT TT TIME COMMAND 5# 0 3891 1 0 20 0 29828 2852 - T 0 0:00,14 ./syzkaller21 6# 0 3891 1 0 52 0 29828 2852 ufs T 0 0:00,00 ./syzkaller21 7# 0 3891 1 0 52 0 29828 2852 ufs T 0 0:00,00 ./syzkaller21 8# $ pgrep syzkaller21 | xargs procstat -k 9# PID TID COMM TDNAME KSTACK 10# 3891 100250 syzkaller21 - mi_switch thread_suspend_switch thread_single exit1 sys_sys_exit amd64_syscall fast_syscall_common 11# 3891 100777 syzkaller21 - mi_switch sleepq_switch sleeplk lockmgr_xlock_hard ffs_lock VOP_LOCK1_APV _vn_lock vget_finish vfs_hash_get ffs_vgetf softdep_sync_buf ffs_syncvnode ffs_fsync VOP_FSYNC_APV kern_fsync amd64_syscall fast_syscall_common 12# 3891 100778 syzkaller21 - mi_switch sleepq_switch sleeplk lockmgr_slock_hard ffs_lock VOP_LOCK1_APV _vn_lock vget_finish cache_lookup vfs_cache_lookup VOP_LOOKUP_APV lookup namei kern_chdir amd64_syscall fast_syscall_common 13# $ uname -a 14# FreeBSD t2.osted.lan 13.0-CURRENT FreeBSD 13.0-CURRENT #5 r363786M: Tue Aug 4 16:51:52 CEST 2020 15# pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO amd64 16# $ 17 18[ `uname -p` != "amd64" ] && exit 0 19 20. ../default.cfg 21cat > /tmp/syzkaller21.c <<EOF 22// autogenerated by syzkaller (https://github.com/google/syzkaller) 23 24#define _GNU_SOURCE 25 26#include <sys/types.h> 27 28#include <dirent.h> 29#include <errno.h> 30#include <pthread.h> 31#include <pwd.h> 32#include <setjmp.h> 33#include <signal.h> 34#include <stdarg.h> 35#include <stdbool.h> 36#include <stdint.h> 37#include <stdio.h> 38#include <stdlib.h> 39#include <string.h> 40#include <sys/endian.h> 41#include <sys/stat.h> 42#include <sys/syscall.h> 43#include <sys/wait.h> 44#include <time.h> 45#include <unistd.h> 46 47static __thread int skip_segv; 48static __thread jmp_buf segv_env; 49 50static void segv_handler(int sig, siginfo_t* info, void* ctx __unused) 51{ 52 uintptr_t addr = (uintptr_t)info->si_addr; 53 const uintptr_t prog_start = 1 << 20; 54 const uintptr_t prog_end = 100 << 20; 55 if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && 56 (addr < prog_start || addr > prog_end)) { 57 _longjmp(segv_env, 1); 58 } 59 exit(sig); 60} 61 62static void install_segv_handler(void) 63{ 64 struct sigaction sa; 65 memset(&sa, 0, sizeof(sa)); 66 sa.sa_sigaction = segv_handler; 67 sa.sa_flags = SA_NODEFER | SA_SIGINFO; 68 sigaction(SIGSEGV, &sa, NULL); 69 sigaction(SIGBUS, &sa, NULL); 70} 71 72#define NONFAILING(...) \ 73 { \ 74 __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 75 if (_setjmp(segv_env) == 0) { \ 76 __VA_ARGS__; \ 77 } \ 78 __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 79 } 80 81static void kill_and_wait(int pid, int* status) 82{ 83 kill(pid, SIGKILL); 84 while (waitpid(-1, status, 0) != pid) { 85 } 86} 87 88static void sleep_ms(uint64_t ms) 89{ 90 usleep(ms * 1000); 91} 92 93static uint64_t current_time_ms(void) 94{ 95 struct timespec ts; 96 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 97 exit(1); 98 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 99} 100 101static void use_temporary_dir(void) 102{ 103 char tmpdir_template[] = "./syzkaller.XXXXXX"; 104 char* tmpdir = mkdtemp(tmpdir_template); 105 if (!tmpdir) 106 exit(1); 107 if (chmod(tmpdir, 0777)) 108 exit(1); 109 if (chdir(tmpdir)) 110 exit(1); 111} 112 113static void remove_dir(const char* dir) 114{ 115 DIR* dp; 116 struct dirent* ep; 117 dp = opendir(dir); 118 if (dp == NULL) 119 exit(1); 120 while ((ep = readdir(dp))) { 121 if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) 122 continue; 123 char filename[FILENAME_MAX]; 124 snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); 125 struct stat st; 126 if (lstat(filename, &st)) 127 exit(1); 128 if (S_ISDIR(st.st_mode)) { 129 remove_dir(filename); 130 continue; 131 } 132 if (unlink(filename)) 133 exit(1); 134 } 135 closedir(dp); 136 if (rmdir(dir)) 137 exit(1); 138} 139 140static void thread_start(void* (*fn)(void*), void* arg) 141{ 142 pthread_t th; 143 pthread_attr_t attr; 144 pthread_attr_init(&attr); 145 pthread_attr_setstacksize(&attr, 128 << 10); 146 int i; 147 for (i = 0; i < 100; i++) { 148 if (pthread_create(&th, &attr, fn, arg) == 0) { 149 pthread_attr_destroy(&attr); 150 return; 151 } 152 if (errno == EAGAIN) { 153 usleep(50); 154 continue; 155 } 156 break; 157 } 158 exit(1); 159} 160 161typedef struct { 162 pthread_mutex_t mu; 163 pthread_cond_t cv; 164 int state; 165} event_t; 166 167static void event_init(event_t* ev) 168{ 169 if (pthread_mutex_init(&ev->mu, 0)) 170 exit(1); 171 if (pthread_cond_init(&ev->cv, 0)) 172 exit(1); 173 ev->state = 0; 174} 175 176static void event_reset(event_t* ev) 177{ 178 ev->state = 0; 179} 180 181static void event_set(event_t* ev) 182{ 183 pthread_mutex_lock(&ev->mu); 184 if (ev->state) 185 exit(1); 186 ev->state = 1; 187 pthread_mutex_unlock(&ev->mu); 188 pthread_cond_broadcast(&ev->cv); 189} 190 191static void event_wait(event_t* ev) 192{ 193 pthread_mutex_lock(&ev->mu); 194 while (!ev->state) 195 pthread_cond_wait(&ev->cv, &ev->mu); 196 pthread_mutex_unlock(&ev->mu); 197} 198 199static int event_isset(event_t* ev) 200{ 201 pthread_mutex_lock(&ev->mu); 202 int res = ev->state; 203 pthread_mutex_unlock(&ev->mu); 204 return res; 205} 206 207static int event_timedwait(event_t* ev, uint64_t timeout) 208{ 209 uint64_t start = current_time_ms(); 210 uint64_t now = start; 211 pthread_mutex_lock(&ev->mu); 212 for (;;) { 213 if (ev->state) 214 break; 215 uint64_t remain = timeout - (now - start); 216 struct timespec ts; 217 ts.tv_sec = remain / 1000; 218 ts.tv_nsec = (remain % 1000) * 1000 * 1000; 219 pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); 220 now = current_time_ms(); 221 if (now - start > timeout) 222 break; 223 } 224 int res = ev->state; 225 pthread_mutex_unlock(&ev->mu); 226 return res; 227} 228 229struct thread_t { 230 int created, call; 231 event_t ready, done; 232}; 233 234static struct thread_t threads[16]; 235static void execute_call(int call); 236static int running; 237 238static void* thr(void* arg) 239{ 240 struct thread_t* th = (struct thread_t*)arg; 241 for (;;) { 242 event_wait(&th->ready); 243 event_reset(&th->ready); 244 execute_call(th->call); 245 __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); 246 event_set(&th->done); 247 } 248 return 0; 249} 250 251static void execute_one(void) 252{ 253 int i, call, thread; 254 int collide = 0; 255again: 256 for (call = 0; call < 9; call++) { 257 for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); 258 thread++) { 259 struct thread_t* th = &threads[thread]; 260 if (!th->created) { 261 th->created = 1; 262 event_init(&th->ready); 263 event_init(&th->done); 264 event_set(&th->done); 265 thread_start(thr, th); 266 } 267 if (!event_isset(&th->done)) 268 continue; 269 event_reset(&th->done); 270 th->call = call; 271 __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); 272 event_set(&th->ready); 273 if (collide && (call % 2) == 0) 274 break; 275 event_timedwait(&th->done, 45); 276 break; 277 } 278 } 279 for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) 280 sleep_ms(1); 281 if (!collide) { 282 collide = 1; 283 goto again; 284 } 285} 286 287static void execute_one(void); 288 289#define WAIT_FLAGS 0 290 291static void loop(void) 292{ 293 int iter; 294 for (iter = 0;; iter++) { 295 char cwdbuf[32]; 296 sprintf(cwdbuf, "./%d", iter); 297 if (mkdir(cwdbuf, 0777)) 298 exit(1); 299 int pid = fork(); 300 if (pid < 0) 301 exit(1); 302 if (pid == 0) { 303 if (chdir(cwdbuf)) 304 exit(1); 305 execute_one(); 306 exit(0); 307 } 308 int status = 0; 309 uint64_t start = current_time_ms(); 310 for (;;) { 311 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 312 break; 313 sleep_ms(1); 314 if (current_time_ms() - start < 5 * 1000) 315 continue; 316 kill_and_wait(pid, &status); 317 break; 318 } 319 remove_dir(cwdbuf); 320 } 321} 322 323uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 324 0xffffffffffffffff}; 325 326void execute_call(int call) 327{ 328 intptr_t res = 0; 329 switch (call) { 330 case 0: 331 NONFAILING(memcpy((void*)0x20000000, ".\000", 2)); 332 res = syscall(SYS_open, 0x20000000ul, 0ul, 0ul); 333 if (res != -1) 334 r[0] = res; 335 break; 336 case 1: 337 NONFAILING(memcpy((void*)0x20000040, "./file0\000", 8)); 338 syscall(SYS_mkdirat, r[0], 0x20000040ul, 0ul); 339 break; 340 case 2: 341 NONFAILING(memcpy((void*)0x20000000, ".\000", 2)); 342 res = syscall(SYS_open, 0x20000000ul, 0ul, 0ul); 343 if (res != -1) 344 r[1] = res; 345 break; 346 case 3: 347 NONFAILING(memcpy((void*)0x20000040, "./file1\000", 8)); 348 syscall(SYS_mkdirat, r[1], 0x20000040ul, 0ul); 349 break; 350 case 4: 351 NONFAILING(memcpy((void*)0x20000000, ".\000", 2)); 352 res = syscall(SYS_open, 0x20000000ul, 0ul, 0ul); 353 if (res != -1) 354 r[2] = res; 355 break; 356 case 5: 357 NONFAILING(memcpy((void*)0x20000080, "./file1\000", 8)); 358 NONFAILING(memcpy((void*)0x200000c0, "./file0/file0\000", 14)); 359 syscall(SYS_renameat, r[1], 0x20000080ul, r[2], 0x200000c0ul); 360 break; 361 case 6: 362 NONFAILING(memcpy((void*)0x20000100, "./file0/file0\000", 14)); 363 res = syscall(SYS_open, 0x20000100ul, 0ul, 0ul); 364 if (res != -1) 365 r[3] = res; 366 break; 367 case 7: 368 syscall(SYS_fsync, r[3]); 369 break; 370 case 8: 371 NONFAILING(memcpy((void*)0x20000140, "./file0/file0\000", 14)); 372 syscall(SYS_chdir, 0x20000140ul); 373 break; 374 } 375} 376int main(void) 377{ 378 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 379 install_segv_handler(); 380 use_temporary_dir(); 381 loop(); 382 return 0; 383} 384EOF 385mycc -o /tmp/syzkaller21 -Wall -Wextra -O2 /tmp/syzkaller21.c -lpthread || 386 exit 1 387 388(cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) & 389(cd /tmp; ./syzkaller21) & 390sleep 60 391while pkill swap; do sleep .2; done 392pkill -9 syzkaller21 393sleep .5 394if pgrep -q syzkaller21; then 395 pgrep syzkaller21 | xargs ps -lHp 396 pgrep syzkaller21 | xargs procstat -k 397 exit 1 398fi 399wait 400 401rm -rf /tmp/syzkaller21.* 402rm -f /tmp/syzkaller21 403exit 0 404