xref: /freebsd/tools/test/stress2/misc/syzkaller59.sh (revision 2e3507c25e42292b45a5482e116d278f5515d04d) 
1#!/bin/sh
2
3# Fatal trap 12: page fault while in kernel mode
4# cpuid = 8; apic id = 08
5# fault virtual address   = 0x8
6# fault code              = supervisor read data, page not present
7# instruction pointer     = 0x20:0xffffffff80b98b73
8# stack pointer           = 0x0:0xfffffe06996fc700
9# frame pointer           = 0x0:0xfffffe06996fc730
10# code segment            = base 0x0, limit 0xfffff, type 0x1b
11#                         = DPL 0, pres 1, long 1, def32 0, gran 1
12# processor eflags        = interrupt enabled, resume, IOPL = 0
13# current process         = 46538 (repro11)
14# trap number             = 12
15# panic: page fault
16# cpuid = 8
17# time = 1655883715
18# KDB: stack backtrace:
19# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe06996fc4c0
20# vpanic() at vpanic+0x151/frame 0xfffffe06996fc510
21# panic() at panic+0x43/frame 0xfffffe06996fc570
22# trap_fatal() at trap_fatal+0x387/frame 0xfffffe06996fc5d0
23# trap_pfault() at trap_pfault+0xab/frame 0xfffffe06996fc630
24# calltrap() at calltrap+0x8/frame 0xfffffe06996fc630
25# --- trap 0xc, rip = 0xffffffff80b98b73, rsp = 0xfffffe06996fc700, rbp = 0xfffffe06996fc730 ---
26# knlist_remove_kq() at knlist_remove_kq+0xa3/frame 0xfffffe06996fc730
27# kqueue_drain() at kqueue_drain+0x2c8/frame 0xfffffe06996fc770
28# kqueue_close() at kqueue_close+0x7e/frame 0xfffffe06996fc7b0
29# _fdrop() at _fdrop+0x1b/frame 0xfffffe06996fc7d0
30# closef() at closef+0x1db/frame 0xfffffe06996fc860
31# fdescfree() at fdescfree+0x433/frame 0xfffffe06996fc930
32# exit1() at exit1+0x4ef/frame 0xfffffe06996fc9a0
33# sigexit() at sigfce20
34# postsig() at postsig+0x1aa/frame 0xfffffe06996fcef0
35# ast() at ast+0x4fb/frame 0xfffffe06996fcf30
36# doreti_ast() at doreti_ast+0x1f/frame 0x821076840
37# KDB: enter: panic
38# [ thread pid 46538 tid 356284 ]
39# Stopped at      kdb_enter+0x32: movq    $0,0x129f1a3(%rip)
40# db> x/s version
41# version: FreeBSD 14.0-CURRENT #0 main-n256236-4f1d91e413d7e: Wed Jun 22 07:47:51 CEST 2022
42# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
43# db>
44
45[ `uname -p` != "amd64" ] && exit 0
46
47. ../default.cfg
48cat > /tmp/syzkaller59.c <<EOF
49// https://syzkaller.appspot.com/bug?id=17dea08cb46e51310db9047c400d1ff4646d2f9a
50// autogenerated by syzkaller (https://github.com/google/syzkaller)
51// Reported-by: syzbot+c94f6c97744bd9f9d14d@syzkaller.appspotmail.com
52
53#define _GNU_SOURCE
54
55#include <sys/types.h>
56
57#include <pwd.h>
58#include <signal.h>
59#include <stdarg.h>
60#include <stdbool.h>
61#include <stdint.h>
62#include <stdio.h>
63#include <stdlib.h>
64#include <string.h>
65#include <sys/endian.h>
66#include <sys/syscall.h>
67#include <sys/wait.h>
68#include <time.h>
69#include <unistd.h>
70
71static void kill_and_wait(int pid, int* status)
72{
73  kill(pid, SIGKILL);
74  while (waitpid(-1, status, 0) != pid) {
75  }
76}
77
78static void sleep_ms(uint64_t ms)
79{
80  usleep(ms * 1000);
81}
82
83static uint64_t current_time_ms(void)
84{
85  struct timespec ts;
86  if (clock_gettime(CLOCK_MONOTONIC, &ts))
87    exit(1);
88  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
89}
90
91static void execute_one(void);
92
93#define WAIT_FLAGS 0
94
95static void loop(void)
96{
97  int iter __unused = 0;
98  for (;; iter++) {
99    int pid = fork();
100    if (pid < 0)
101      exit(1);
102    if (pid == 0) {
103      execute_one();
104      exit(0);
105    }
106    int status = 0;
107    uint64_t start = current_time_ms();
108    for (;;) {
109      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
110        break;
111      sleep_ms(1);
112      if (current_time_ms() - start < 5000)
113        continue;
114      kill_and_wait(pid, &status);
115      break;
116    }
117  }
118}
119
120uint64_t r[1] = {0xffffffffffffffff};
121
122void execute_one(void)
123{
124  intptr_t res = 0;
125  res = syscall(SYS_kqueue);
126  if (res != -1)
127    r[0] = res;
128  *(uint64_t*)0x20000140 = 0;
129  *(uint16_t*)0x20000148 = 0xfffa;
130  *(uint16_t*)0x2000014a = 0x4021;
131  *(uint32_t*)0x2000014c = 0;
132  *(uint64_t*)0x20000150 = 0;
133  *(uint64_t*)0x20000158 = 0;
134  *(uint64_t*)0x20000160 = 0;
135  *(uint64_t*)0x20000168 = 0;
136  *(uint64_t*)0x20000170 = 0;
137  *(uint64_t*)0x20000178 = 0;
138  syscall(SYS_kevent, r[0], 0x20000140ul, 1ul, 0ul, 0ul, 0ul);
139  syscall(SYS_rfork, 0x90030ul);
140}
141int main(void)
142{
143  syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
144  loop();
145  return 0;
146}
147EOF
148mycc -o /tmp/syzkaller59 -Wall -Wextra -O0 /tmp/syzkaller59.c || exit 1
149
150(cd /tmp; timeout 3m ./syzkaller59)
151
152rm -rf /tmp/syzkaller59 /tmp/syzkaller59.c /tmp/syzkaller59.core \
153    /tmp/syzkaller.??????
154exit 0
155