1#!/bin/sh 2 3# panic: ASan: Invalid access, 32-byte read at 0xfffffe01f76145a0, UseAfterScope(f8) 4# cpuid = 3 5# time = 1635158022 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0xa5/frame 0xfffffe01f7614170 8# kdb_backtrace() at kdb_backtrace+0xc9/frame 0xfffffe01f76142d0 9# vpanic() at vpanic+0x248/frame 0xfffffe01f76143b0 10# panic() at panic+0xb5/frame 0xfffffe01f7614480 11# __asan_storeN() at __asan_storeN/frame 0xfffffe01f7614550 12# smp_masked_invlpg_range() at smp_masked_invlpg_range+0xb2/frame 0xfffffe01f7614630 13# pmap_invalidate_range() at pmap_invalidate_range+0x22b/frame 0xfffffe01f7614730 14# vm_thread_stack_create() at vm_thread_stack_create+0xf5/frame 0xfffffe01f7614910 15# kstack_import() at kstack_import+0xcache_alloc() at cache_alloc+0x556/frame 0xfffffe01f7614a10 16# cache_alloc_retry() at cache_alloc_retry+0x30/frame 0xfffffe01f7614a80 17# vm_thread_new() at vm_thread_new+0x61/frame 0xfffffe01f7614ab0 18# thread_alloc() at thread_alloc+0x5f/frame 0xfffffe01f7614af0 19# thread_create() at thread_create+0x1b3/frame 0xfffffe01f7614bf0 20# sys_thr_new() at sys_thr_new+0x15a/framd30 21# amd64_syscall() at amd64_syscall+0x31e/frame 0xfffffe01f7614f30 22# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01f7614f30 23# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x8003afafa, rsp = 0x7fffdfffdf58, rbp = 0x7fffdfffdf70 --- 24# KDB: enter: panic 25# [ thread pid 69407 tid 100937 ] 26# Stopped at kdb_enter+0x37: movq $0,0x2638c4e(%rip) 27# db> x/s version 28# version: FreeBSD 14.0-CURRENT #0 main-n250242-eab5358b9080-dirty: Mon Oct 25 11:32:45 CEST 2021 29# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO-KASAN 30# db> 31 32[ `uname -p` != "amd64" ] && exit 0 33[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 34[ "`sysctl -in kern.features.kasan`" != "1" ] && exit 0 35 36. ../default.cfg 37cat > /tmp/syzkaller47.c <<EOF 38// https://syzkaller.appspot.com/bug?id=5676c1c4b457596c1a8782e4a8533f4e9ff2aa0e 39// autogenerated by syzkaller (https://github.com/google/syzkaller) 40// Reported-by: syzbot+a5898c11651b423b501f@syzkaller.appspotmail.com 41 42#define _GNU_SOURCE 43 44#include <sys/types.h> 45 46#include <dirent.h> 47#include <errno.h> 48#include <pthread.h> 49#include <pwd.h> 50#include <setjmp.h> 51#include <signal.h> 52#include <stdarg.h> 53#include <stdbool.h> 54#include <stdint.h> 55#include <stdio.h> 56#include <stdlib.h> 57#include <string.h> 58#include <sys/endian.h> 59#include <sys/resource.h> 60#include <sys/stat.h> 61#include <sys/syscall.h> 62#include <sys/wait.h> 63#include <time.h> 64#include <unistd.h> 65 66static __thread int skip_segv; 67static __thread jmp_buf segv_env; 68 69static void segv_handler(int sig, siginfo_t* info, void* ctx __unused) 70{ 71 uintptr_t addr = (uintptr_t)info->si_addr; 72 const uintptr_t prog_start = 1 << 20; 73 const uintptr_t prog_end = 100 << 20; 74 int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; 75 int valid = addr < prog_start || addr > prog_end; 76 if (sig == SIGBUS) 77 valid = 1; 78 if (skip && valid) { 79 _longjmp(segv_env, 1); 80 } 81 exit(sig); 82} 83 84static void install_segv_handler(void) 85{ 86 struct sigaction sa; 87 memset(&sa, 0, sizeof(sa)); 88 sa.sa_sigaction = segv_handler; 89 sa.sa_flags = SA_NODEFER | SA_SIGINFO; 90 sigaction(SIGSEGV, &sa, NULL); 91 sigaction(SIGBUS, &sa, NULL); 92} 93 94#define NONFAILING(...) \ 95 ({ \ 96 int ok = 1; \ 97 __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 98 if (_setjmp(segv_env) == 0) { \ 99 __VA_ARGS__; \ 100 } else \ 101 ok = 0; \ 102 __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 103 ok; \ 104 }) 105 106static void kill_and_wait(int pid, int* status) 107{ 108 kill(pid, SIGKILL); 109 while (waitpid(-1, status, 0) != pid) { 110 } 111} 112 113static void sleep_ms(uint64_t ms) 114{ 115 usleep(ms * 1000); 116} 117 118static uint64_t current_time_ms(void) 119{ 120 struct timespec ts; 121 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 122 exit(1); 123 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 124} 125 126static void use_temporary_dir(void) 127{ 128 char tmpdir_template[] = "./syzkaller.XXXXXX"; 129 char* tmpdir = mkdtemp(tmpdir_template); 130 if (!tmpdir) 131 exit(1); 132 if (chmod(tmpdir, 0777)) 133 exit(1); 134 if (chdir(tmpdir)) 135 exit(1); 136} 137 138static void __attribute__((noinline)) remove_dir(const char* dir) 139{ 140 DIR* dp = opendir(dir); 141 if (dp == NULL) { 142 if (errno == EACCES) { 143 if (rmdir(dir)) 144 exit(1); 145 return; 146 } 147 exit(1); 148 } 149 struct dirent* ep = 0; 150 while ((ep = readdir(dp))) { 151 if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) 152 continue; 153 char filename[FILENAME_MAX]; 154 snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); 155 struct stat st; 156 if (lstat(filename, &st)) 157 exit(1); 158 if (S_ISDIR(st.st_mode)) { 159 remove_dir(filename); 160 continue; 161 } 162 if (unlink(filename)) 163 exit(1); 164 } 165 closedir(dp); 166 if (rmdir(dir)) 167 exit(1); 168} 169 170static void thread_start(void* (*fn)(void*), void* arg) 171{ 172 pthread_t th; 173 pthread_attr_t attr; 174 pthread_attr_init(&attr); 175 pthread_attr_setstacksize(&attr, 128 << 10); 176 int i = 0; 177 for (; i < 100; i++) { 178 if (pthread_create(&th, &attr, fn, arg) == 0) { 179 pthread_attr_destroy(&attr); 180 return; 181 } 182 if (errno == EAGAIN) { 183 usleep(50); 184 continue; 185 } 186 break; 187 } 188 exit(1); 189} 190 191typedef struct { 192 pthread_mutex_t mu; 193 pthread_cond_t cv; 194 int state; 195} event_t; 196 197static void event_init(event_t* ev) 198{ 199 if (pthread_mutex_init(&ev->mu, 0)) 200 exit(1); 201 if (pthread_cond_init(&ev->cv, 0)) 202 exit(1); 203 ev->state = 0; 204} 205 206static void event_reset(event_t* ev) 207{ 208 ev->state = 0; 209} 210 211static void event_set(event_t* ev) 212{ 213 pthread_mutex_lock(&ev->mu); 214 if (ev->state) 215 exit(1); 216 ev->state = 1; 217 pthread_mutex_unlock(&ev->mu); 218 pthread_cond_broadcast(&ev->cv); 219} 220 221static void event_wait(event_t* ev) 222{ 223 pthread_mutex_lock(&ev->mu); 224 while (!ev->state) 225 pthread_cond_wait(&ev->cv, &ev->mu); 226 pthread_mutex_unlock(&ev->mu); 227} 228 229static int event_isset(event_t* ev) 230{ 231 pthread_mutex_lock(&ev->mu); 232 int res = ev->state; 233 pthread_mutex_unlock(&ev->mu); 234 return res; 235} 236 237static int event_timedwait(event_t* ev, uint64_t timeout) 238{ 239 uint64_t start = current_time_ms(); 240 uint64_t now = start; 241 pthread_mutex_lock(&ev->mu); 242 for (;;) { 243 if (ev->state) 244 break; 245 uint64_t remain = timeout - (now - start); 246 struct timespec ts; 247 ts.tv_sec = remain / 1000; 248 ts.tv_nsec = (remain % 1000) * 1000 * 1000; 249 pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); 250 now = current_time_ms(); 251 if (now - start > timeout) 252 break; 253 } 254 int res = ev->state; 255 pthread_mutex_unlock(&ev->mu); 256 return res; 257} 258 259static void sandbox_common() 260{ 261 struct rlimit rlim; 262 rlim.rlim_cur = rlim.rlim_max = 128 << 20; 263 setrlimit(RLIMIT_AS, &rlim); 264 rlim.rlim_cur = rlim.rlim_max = 8 << 20; 265 setrlimit(RLIMIT_MEMLOCK, &rlim); 266 rlim.rlim_cur = rlim.rlim_max = 1 << 20; 267 setrlimit(RLIMIT_FSIZE, &rlim); 268 rlim.rlim_cur = rlim.rlim_max = 1 << 20; 269 setrlimit(RLIMIT_STACK, &rlim); 270 rlim.rlim_cur = rlim.rlim_max = 0; 271 setrlimit(RLIMIT_CORE, &rlim); 272 rlim.rlim_cur = rlim.rlim_max = 256; 273 setrlimit(RLIMIT_NOFILE, &rlim); 274} 275 276static void loop(); 277 278static int do_sandbox_none(void) 279{ 280 sandbox_common(); 281 loop(); 282 return 0; 283} 284 285struct thread_t { 286 int created, call; 287 event_t ready, done; 288}; 289 290static struct thread_t threads[16]; 291static void execute_call(int call); 292static int running; 293 294static void* thr(void* arg) 295{ 296 struct thread_t* th = (struct thread_t*)arg; 297 for (;;) { 298 event_wait(&th->ready); 299 event_reset(&th->ready); 300 execute_call(th->call); 301 __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); 302 event_set(&th->done); 303 } 304 return 0; 305} 306 307static void execute_one(void) 308{ 309 int i, call, thread; 310 int collide = 0; 311again: 312 for (call = 0; call < 2; call++) { 313 for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); 314 thread++) { 315 struct thread_t* th = &threads[thread]; 316 if (!th->created) { 317 th->created = 1; 318 event_init(&th->ready); 319 event_init(&th->done); 320 event_set(&th->done); 321 thread_start(thr, th); 322 } 323 if (!event_isset(&th->done)) 324 continue; 325 event_reset(&th->done); 326 th->call = call; 327 __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); 328 event_set(&th->ready); 329 if (collide && (call % 2) == 0) 330 break; 331 event_timedwait(&th->done, 50); 332 break; 333 } 334 } 335 for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) 336 sleep_ms(1); 337 if (!collide) { 338 collide = 1; 339 goto again; 340 } 341} 342 343static void execute_one(void); 344 345#define WAIT_FLAGS 0 346 347static void loop(void) 348{ 349 int iter = 0; 350 for (;; iter++) { 351 char cwdbuf[32]; 352 sprintf(cwdbuf, "./%d", iter); 353 if (mkdir(cwdbuf, 0777)) 354 exit(1); 355 int pid = fork(); 356 if (pid < 0) 357 exit(1); 358 if (pid == 0) { 359 if (chdir(cwdbuf)) 360 exit(1); 361 execute_one(); 362 exit(0); 363 } 364 int status = 0; 365 uint64_t start = current_time_ms(); 366 for (;;) { 367 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 368 break; 369 sleep_ms(1); 370 if (current_time_ms() - start < 5000) 371 continue; 372 kill_and_wait(pid, &status); 373 break; 374 } 375 remove_dir(cwdbuf); 376 } 377} 378 379void execute_call(int call) 380{ 381 switch (call) { 382 case 0: 383 syscall(SYS_rfork, 0x4030ul); 384 break; 385 case 1: 386 syscall(SYS_thr_new, 0ul, 0ul); 387 break; 388 } 389} 390int main(void) 391{ 392 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 393 install_segv_handler(); 394 use_temporary_dir(); 395 do_sandbox_none(); 396 return 0; 397} 398EOF 399mycc -o /tmp/syzkaller47 -Wall -Wextra -O0 /tmp/syzkaller47.c -lpthread || exit 1 400 401(cd /tmp; timeout 2m ./syzkaller47) 402 403rm -rf /tmp/syzkaller47 /tmp/syzkaller47.c /tmp/syzkaller.* 404exit 0 405