1#!/bin/sh 2 3# panic: td 0xfffffe014f7193a0 is not suspended 4# cpuid = 5 5# time = 1652003036 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe019a497c20 8# vpanic() at vpanic+0x17f/frame 0xfffffe019a497c70 9# panic() at panic+0x43/frame 0xfffffe019a497cd0 10# thread_single() at thread_single+0x766/frame 0xfffffe019a497d40 11# fork1() at fork1+0x1e1/frame 0xfffffe019a497da0 12# sys_rfork() at sys_rfork+0xa4/frame 0xfffffe019a497e00 13# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe019a497f30 14# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe019a497f30 15# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x82317b7da, rsp = 0x826544f48, rbp = 0x826544f70 --- 16# KDB: enter: panic 17# [ thread pid 17068 tid 104913 ] 18# Stopped at kdb_enter+0x32: movq $0,0x12795f3(%rip) 19# db> x/s version 20# FreeBSD 14.0-CURRENT #0 main-n255381-cbbce42345c51: Sun May 8 09:55:50 CEST 2022 21# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO 22# db> 23 24[ `uname -p` != "amd64" ] && exit 0 25 26. ../default.cfg 27cat > /tmp/syzkaller54.c <<EOF 28// https://syzkaller.appspot.com/bug?id=346de481f8b814d103c440296a0adcb7ec6c46d4 29// autogenerated by syzkaller (https://github.com/google/syzkaller) 30// Reported-by: syzbot+9db4640d67478a0ced08@syzkaller.appspotmail.com 31 32#define _GNU_SOURCE 33 34#include <sys/types.h> 35 36#include <errno.h> 37#include <pthread.h> 38#include <pwd.h> 39#include <signal.h> 40#include <stdarg.h> 41#include <stdbool.h> 42#include <stdint.h> 43#include <stdio.h> 44#include <stdlib.h> 45#include <string.h> 46#include <sys/endian.h> 47#include <sys/syscall.h> 48#include <sys/wait.h> 49#include <time.h> 50#include <unistd.h> 51 52static unsigned long long procid; 53 54static void kill_and_wait(int pid, int* status) 55{ 56 kill(pid, SIGKILL); 57 while (waitpid(-1, status, 0) != pid) { 58 } 59} 60 61static void sleep_ms(uint64_t ms) 62{ 63 usleep(ms * 1000); 64} 65 66static uint64_t current_time_ms(void) 67{ 68 struct timespec ts; 69 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 70 exit(1); 71 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 72} 73 74static void thread_start(void* (*fn)(void*), void* arg) 75{ 76 pthread_t th; 77 pthread_attr_t attr; 78 pthread_attr_init(&attr); 79 pthread_attr_setstacksize(&attr, 128 << 10); 80 int i = 0; 81 for (; i < 100; i++) { 82 if (pthread_create(&th, &attr, fn, arg) == 0) { 83 pthread_attr_destroy(&attr); 84 return; 85 } 86 if (errno == EAGAIN) { 87 usleep(50); 88 continue; 89 } 90 break; 91 } 92 exit(1); 93} 94 95typedef struct { 96 pthread_mutex_t mu; 97 pthread_cond_t cv; 98 int state; 99} event_t; 100 101static void event_init(event_t* ev) 102{ 103 if (pthread_mutex_init(&ev->mu, 0)) 104 exit(1); 105 if (pthread_cond_init(&ev->cv, 0)) 106 exit(1); 107 ev->state = 0; 108} 109 110static void event_reset(event_t* ev) 111{ 112 ev->state = 0; 113} 114 115static void event_set(event_t* ev) 116{ 117 pthread_mutex_lock(&ev->mu); 118 if (ev->state) 119 exit(1); 120 ev->state = 1; 121 pthread_mutex_unlock(&ev->mu); 122 pthread_cond_broadcast(&ev->cv); 123} 124 125static void event_wait(event_t* ev) 126{ 127 pthread_mutex_lock(&ev->mu); 128 while (!ev->state) 129 pthread_cond_wait(&ev->cv, &ev->mu); 130 pthread_mutex_unlock(&ev->mu); 131} 132 133static int event_isset(event_t* ev) 134{ 135 pthread_mutex_lock(&ev->mu); 136 int res = ev->state; 137 pthread_mutex_unlock(&ev->mu); 138 return res; 139} 140 141static int event_timedwait(event_t* ev, uint64_t timeout) 142{ 143 uint64_t start = current_time_ms(); 144 uint64_t now = start; 145 pthread_mutex_lock(&ev->mu); 146 for (;;) { 147 if (ev->state) 148 break; 149 uint64_t remain = timeout - (now - start); 150 struct timespec ts; 151 ts.tv_sec = remain / 1000; 152 ts.tv_nsec = (remain % 1000) * 1000 * 1000; 153 pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); 154 now = current_time_ms(); 155 if (now - start > timeout) 156 break; 157 } 158 int res = ev->state; 159 pthread_mutex_unlock(&ev->mu); 160 return res; 161} 162 163struct thread_t { 164 int created, call; 165 event_t ready, done; 166}; 167 168static struct thread_t threads[16]; 169static void execute_call(int call); 170static int running; 171 172static void* thr(void* arg) 173{ 174 struct thread_t* th = (struct thread_t*)arg; 175 for (;;) { 176 event_wait(&th->ready); 177 event_reset(&th->ready); 178 execute_call(th->call); 179 __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); 180 event_set(&th->done); 181 } 182 return 0; 183} 184 185static void execute_one(void) 186{ 187 int i, call, thread; 188 for (call = 0; call < 12; call++) { 189 for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); 190 thread++) { 191 struct thread_t* th = &threads[thread]; 192 if (!th->created) { 193 th->created = 1; 194 event_init(&th->ready); 195 event_init(&th->done); 196 event_set(&th->done); 197 thread_start(thr, th); 198 } 199 if (!event_isset(&th->done)) 200 continue; 201 event_reset(&th->done); 202 th->call = call; 203 __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); 204 event_set(&th->ready); 205 event_timedwait(&th->done, 50); 206 break; 207 } 208 } 209 for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) 210 sleep_ms(1); 211} 212 213static void execute_one(void); 214 215#define WAIT_FLAGS 0 216 217static void loop(void) 218{ 219 int iter __unused = 0; 220 for (;; iter++) { 221 int pid = fork(); 222 if (pid < 0) 223 exit(1); 224 if (pid == 0) { 225 execute_one(); 226 exit(0); 227 } 228 int status = 0; 229 uint64_t start = current_time_ms(); 230 for (;;) { 231 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 232 break; 233 sleep_ms(1); 234 if (current_time_ms() - start < 5000) 235 continue; 236 kill_and_wait(pid, &status); 237 break; 238 } 239 } 240} 241 242uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 243 0xffffffffffffffff}; 244 245void execute_call(int call) 246{ 247 intptr_t res = 0; 248 switch (call) { 249 case 0: 250 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 251 if (res != -1) 252 r[0] = res; 253 break; 254 case 1: 255 syscall(SYS_connect, r[0], 0ul, 0ul); 256 break; 257 case 2: 258 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 259 if (res != -1) 260 r[1] = res; 261 break; 262 case 3: 263 syscall(SYS_sendto, -1, 0ul, 0ul, 0ul, 0ul, 0ul); 264 break; 265 case 4: 266 syscall(SYS_dup2, r[1], -1); 267 break; 268 case 5: 269 res = syscall(SYS_dup2, -1, -1); 270 if (res != -1) 271 r[2] = res; 272 break; 273 case 6: 274 res = syscall(SYS_dup2, -1, r[2]); 275 if (res != -1) 276 r[3] = res; 277 break; 278 case 7: 279 syscall(SYS_sendmsg, r[3], 0ul, 0ul); 280 break; 281 case 8: 282 syscall(SYS_sendto, -1, 0ul, 0ul, 0ul, 0ul, 0ul); 283 break; 284 case 9: 285 memcpy((void*)0x20000100, "/dev/filemon\000", 13); 286 syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000100ul, 0ul, 0ul); 287 break; 288 case 10: 289 syscall(SYS_rfork, 0x5000ul); 290 break; 291 case 11: 292 *(uint32_t*)0x20000080 = 0x13; 293 *(uint32_t*)0x20000084 = 0; 294 *(uint32_t*)0x20000088 = 0; 295 *(uint32_t*)0x2000008c = 0; 296 *(uint32_t*)0x20000090 = -1; 297 memset((void*)0x20000094, 0, 60); 298 syscall(SYS_procctl, 0ul, 0, 6ul, 0x20000080ul); 299 break; 300 } 301} 302int main(void) 303{ 304 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 305 for (procid = 0; procid < 4; procid++) { 306 if (fork() == 0) { 307 loop(); 308 } 309 } 310 sleep(1000000); 311 return 0; 312} 313EOF 314mycc -o /tmp/syzkaller54 -Wall -Wextra -O0 /tmp/syzkaller54.c -l pthread || 315 exit 1 316 317start=`date +%s` 318while [ $((`date +%s` - start)) -lt 120 ]; do 319 (cd /tmp; timeout 3m ./syzkaller54) 320done 321 322rm -rf /tmp/syzkaller54 /tmp/syzkaller54.c /tmp/syzkaller54.core \ 323 /tmp/syzkaller.?????? 324exit 0 325