1#!/bin/sh 2 3# Fatal trap 12: page fault while in kernel mode 4# cpuid = 6; apic id = 06 5# fault virtual address = 0xb8 6# fault code = supervisor read data, page not present 7# instruction pointer = 0x20:0xffffffff80d3c17b 8# stack pointer = 0x28:0xfffffe00e49fab80 9# frame pointer = 0x28:0xfffffe00e49facc0 10# code segment = base 0x0, limit 0xfffff, type 0x1b 11# = DPL 0, pres 1, long 1, def32 0, gran 1 12# processor eflags = interrupt enabled, resume, IOPL = 0 13# current process = 12 (swi1: netisr 0) 14# rdi: fffff802d2d8daa0 rsi: fffffe00e49fab48 rdx: ffffffff819d5a90 15# rcx: ffffffff819d5a98 r8: 00000000ffffffff r9: 0000000000000000 16# rax: 0000000000000000 rbx: 0000000000000002 rbp: fffffe00e49facc0 17# r10: fffff802d2d8daa0 r11: 0000000000010000 r12: 0000000000000000 18# r13: fffff802d2d8da80 r14: 0000000000000060 r15: fffff802d2d8dab8 19# trap number = 12 20# panic: page fault 21# cpuid = 6 22# time = 1689053386 23# KDB: stack backtrace: 24# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00e49fa930 25# vpanic() at vpanic+0x149/frame 0xfffffe00e49fa980 26# panic() at panic+0x43/frame 0xfffffe00e49fa9e0 27# trap_fatal() at trap_fatal+0x40c/frame 0xfffffe00e49faa40 28# trap_pfault() at trap_pfault+0xae/frame 0xfffffe00e49faab0 29# calltrap() at calltrap+0x8/frame 0xfffffe00e49faab0 30# --- trap 0xc, rip = 0xffffffff80d3c17b, rsp = 0xfffffe00e49fab80, rbp = 0xfffffe00e49facc0 --- 31# tcp_input_with_port() at tcp_input_with_port+0x70b/frame 0xfffffe00e49facc0 32# tcp6_input_with_port() at tcp6_input_with_port+0x6a/frame 0xfffffe00e49facf0 33# tcp6_input() at tcp6_input+0xb/frame 0xfffffe00e49fad00 34# ip6_input() at ip6_input+0xc97/frame 0xfffffe00e49fade0 35# swi_net() at swi_net+0x19b/frame 0xfffffe00e49fae60 36# ithread_loop() at ithread_loop+0x266/frame 0xfffffe00e49faef0 37# fork_exit() at fork_exit+0x82/frame 0xfffffe00e49faf30 38# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00e49faf30 39# --- trap 0, rip = 0, rsp = 0, rbp = 0 --- 40# KDB: enter: panic 41# [ thread pid 12 tid 100089 ] 42# Stopped at kdb_enter+0x32: movq $0,0xde5053(%rip) 43# db> x/s version 44# version: FreeBSD 14.0-CURRENT #0 main-n264110-43ed91e00bbb1: Tue Jul 11 06:28:21 CEST 2023 45# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO 46# db> 47 48uname -p | grep -Eq "amd64" || exit 0 49[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 50 51. ../default.cfg 52prog=$(basename "$0" .sh) 53cat > /tmp/$prog.c <<EOF 54// https://syzkaller.appspot.com/bug?id=44d933862f436b628c77db28122dbfa4e00990aa 55// autogenerated by syzkaller (https://github.com/google/syzkaller) 56// Reported-by: syzbot+e7d2e451f89fb444319b@syzkaller.appspotmail.com 57 58#define _GNU_SOURCE 59 60#include <sys/types.h> 61 62#include <dirent.h> 63#include <errno.h> 64#include <pthread.h> 65#include <pwd.h> 66#include <setjmp.h> 67#include <signal.h> 68#include <stdarg.h> 69#include <stdbool.h> 70#include <stdint.h> 71#include <stdio.h> 72#include <stdlib.h> 73#include <string.h> 74#include <sys/endian.h> 75#include <sys/resource.h> 76#include <sys/stat.h> 77#include <sys/syscall.h> 78#include <sys/wait.h> 79#include <time.h> 80#include <unistd.h> 81 82static unsigned long long procid; 83 84static __thread int clone_ongoing; 85static __thread int skip_segv; 86static __thread jmp_buf segv_env; 87 88static void segv_handler(int sig, siginfo_t* info, void* ctx __unused) 89{ 90 if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { 91 exit(sig); 92 } 93 uintptr_t addr = (uintptr_t)info->si_addr; 94 const uintptr_t prog_start = 1 << 20; 95 const uintptr_t prog_end = 100 << 20; 96 int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; 97 int valid = addr < prog_start || addr > prog_end; 98 if (sig == SIGBUS) 99 valid = 1; 100 if (skip && valid) { 101 _longjmp(segv_env, 1); 102 } 103 exit(sig); 104} 105 106static void install_segv_handler(void) 107{ 108 struct sigaction sa; 109 memset(&sa, 0, sizeof(sa)); 110 sa.sa_sigaction = segv_handler; 111 sa.sa_flags = SA_NODEFER | SA_SIGINFO; 112 sigaction(SIGSEGV, &sa, NULL); 113 sigaction(SIGBUS, &sa, NULL); 114} 115 116#define NONFAILING(...) \ 117 ({ \ 118 int ok = 1; \ 119 __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 120 if (_setjmp(segv_env) == 0) { \ 121 __VA_ARGS__; \ 122 } else \ 123 ok = 0; \ 124 __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 125 ok; \ 126 }) 127 128static void kill_and_wait(int pid, int* status) 129{ 130 kill(pid, SIGKILL); 131 while (waitpid(-1, status, 0) != pid) { 132 } 133} 134 135static void sleep_ms(uint64_t ms) 136{ 137 usleep(ms * 1000); 138} 139 140static uint64_t current_time_ms(void) 141{ 142 struct timespec ts; 143 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 144 exit(1); 145 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 146} 147 148static void use_temporary_dir(void) 149{ 150 char tmpdir_template[] = "./syzkaller.XXXXXX"; 151 char* tmpdir = mkdtemp(tmpdir_template); 152 if (!tmpdir) 153 exit(1); 154 if (chmod(tmpdir, 0777)) 155 exit(1); 156 if (chdir(tmpdir)) 157 exit(1); 158} 159 160static void reset_flags(const char* filename) 161{ 162 struct stat st; 163 if (lstat(filename, &st)) 164 exit(1); 165 st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE | 166 SF_APPEND | UF_APPEND); 167 if (lchflags(filename, st.st_flags)) 168 exit(1); 169} 170static void __attribute__((noinline)) remove_dir(const char* dir) 171{ 172 DIR* dp = opendir(dir); 173 if (dp == NULL) { 174 if (errno == EACCES) { 175 if (rmdir(dir)) 176 exit(1); 177 return; 178 } 179 exit(1); 180 } 181 struct dirent* ep = 0; 182 while ((ep = readdir(dp))) { 183 if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) 184 continue; 185 char filename[FILENAME_MAX]; 186 snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); 187 struct stat st; 188 if (lstat(filename, &st)) 189 exit(1); 190 if (S_ISDIR(st.st_mode)) { 191 remove_dir(filename); 192 continue; 193 } 194 if (unlink(filename)) { 195 if (errno == EPERM) { 196 reset_flags(filename); 197 reset_flags(dir); 198 if (unlink(filename) == 0) 199 continue; 200 } 201 exit(1); 202 } 203 } 204 closedir(dp); 205 while (rmdir(dir)) { 206 if (errno == EPERM) { 207 reset_flags(dir); 208 if (rmdir(dir) == 0) 209 break; 210 } 211 exit(1); 212 } 213} 214 215static void thread_start(void* (*fn)(void*), void* arg) 216{ 217 pthread_t th; 218 pthread_attr_t attr; 219 pthread_attr_init(&attr); 220 pthread_attr_setstacksize(&attr, 128 << 10); 221 int i = 0; 222 for (; i < 100; i++) { 223 if (pthread_create(&th, &attr, fn, arg) == 0) { 224 pthread_attr_destroy(&attr); 225 return; 226 } 227 if (errno == EAGAIN) { 228 usleep(50); 229 continue; 230 } 231 break; 232 } 233 exit(1); 234} 235 236typedef struct { 237 pthread_mutex_t mu; 238 pthread_cond_t cv; 239 int state; 240} event_t; 241 242static void event_init(event_t* ev) 243{ 244 if (pthread_mutex_init(&ev->mu, 0)) 245 exit(1); 246 if (pthread_cond_init(&ev->cv, 0)) 247 exit(1); 248 ev->state = 0; 249} 250 251static void event_reset(event_t* ev) 252{ 253 ev->state = 0; 254} 255 256static void event_set(event_t* ev) 257{ 258 pthread_mutex_lock(&ev->mu); 259 if (ev->state) 260 exit(1); 261 ev->state = 1; 262 pthread_mutex_unlock(&ev->mu); 263 pthread_cond_broadcast(&ev->cv); 264} 265 266static void event_wait(event_t* ev) 267{ 268 pthread_mutex_lock(&ev->mu); 269 while (!ev->state) 270 pthread_cond_wait(&ev->cv, &ev->mu); 271 pthread_mutex_unlock(&ev->mu); 272} 273 274static int event_isset(event_t* ev) 275{ 276 pthread_mutex_lock(&ev->mu); 277 int res = ev->state; 278 pthread_mutex_unlock(&ev->mu); 279 return res; 280} 281 282static int event_timedwait(event_t* ev, uint64_t timeout) 283{ 284 uint64_t start = current_time_ms(); 285 uint64_t now = start; 286 pthread_mutex_lock(&ev->mu); 287 for (;;) { 288 if (ev->state) 289 break; 290 uint64_t remain = timeout - (now - start); 291 struct timespec ts; 292 ts.tv_sec = remain / 1000; 293 ts.tv_nsec = (remain % 1000) * 1000 * 1000; 294 pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); 295 now = current_time_ms(); 296 if (now - start > timeout) 297 break; 298 } 299 int res = ev->state; 300 pthread_mutex_unlock(&ev->mu); 301 return res; 302} 303 304static void sandbox_common() 305{ 306 struct rlimit rlim; 307 rlim.rlim_cur = rlim.rlim_max = 128 << 20; 308 setrlimit(RLIMIT_AS, &rlim); 309 rlim.rlim_cur = rlim.rlim_max = 8 << 20; 310 setrlimit(RLIMIT_MEMLOCK, &rlim); 311 rlim.rlim_cur = rlim.rlim_max = 1 << 20; 312 setrlimit(RLIMIT_FSIZE, &rlim); 313 rlim.rlim_cur = rlim.rlim_max = 1 << 20; 314 setrlimit(RLIMIT_STACK, &rlim); 315 rlim.rlim_cur = rlim.rlim_max = 0; 316 setrlimit(RLIMIT_CORE, &rlim); 317 rlim.rlim_cur = rlim.rlim_max = 256; 318 setrlimit(RLIMIT_NOFILE, &rlim); 319} 320 321static void loop(); 322 323static int do_sandbox_none(void) 324{ 325 sandbox_common(); 326 loop(); 327 return 0; 328} 329 330struct thread_t { 331 int created, call; 332 event_t ready, done; 333}; 334 335static struct thread_t threads[16]; 336static void execute_call(int call); 337static int running; 338 339static void* thr(void* arg) 340{ 341 struct thread_t* th = (struct thread_t*)arg; 342 for (;;) { 343 event_wait(&th->ready); 344 event_reset(&th->ready); 345 execute_call(th->call); 346 __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); 347 event_set(&th->done); 348 } 349 return 0; 350} 351 352static void execute_one(void) 353{ 354 int i, call, thread; 355 for (call = 0; call < 7; call++) { 356 for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); 357 thread++) { 358 struct thread_t* th = &threads[thread]; 359 if (!th->created) { 360 th->created = 1; 361 event_init(&th->ready); 362 event_init(&th->done); 363 event_set(&th->done); 364 thread_start(thr, th); 365 } 366 if (!event_isset(&th->done)) 367 continue; 368 event_reset(&th->done); 369 th->call = call; 370 __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); 371 event_set(&th->ready); 372 if (call == 3) 373 break; 374 event_timedwait(&th->done, 50); 375 break; 376 } 377 } 378 for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) 379 sleep_ms(1); 380} 381 382static void execute_one(void); 383 384#define WAIT_FLAGS 0 385 386static void loop(void) 387{ 388 int iter = 0; 389 for (;; iter++) { 390 char cwdbuf[32]; 391 sprintf(cwdbuf, "./%d", iter); 392 if (mkdir(cwdbuf, 0777)) 393 exit(1); 394 int pid = fork(); 395 if (pid < 0) 396 exit(1); 397 if (pid == 0) { 398 if (chdir(cwdbuf)) 399 exit(1); 400 execute_one(); 401 exit(0); 402 } 403 int status = 0; 404 uint64_t start = current_time_ms(); 405 for (;;) { 406 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 407 break; 408 sleep_ms(1); 409 if (current_time_ms() - start < 5000) 410 continue; 411 kill_and_wait(pid, &status); 412 break; 413 } 414 remove_dir(cwdbuf); 415 } 416} 417 418uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; 419 420void execute_call(int call) 421{ 422 intptr_t res = 0; 423 switch (call) { 424 case 0: 425 res = syscall(SYS_socket, 0x1cul, 1ul, 0); 426 if (res != -1) 427 r[0] = res; 428 break; 429 case 1: 430 NONFAILING(*(uint32_t*)0x20000080 = 9); 431 syscall(SYS_setsockopt, r[0], 0xffff, 0x10000, 0x20000080ul, 4ul); 432 break; 433 case 2: 434 NONFAILING(*(uint8_t*)0x200000c0 = 0x1c); 435 NONFAILING(*(uint8_t*)0x200000c1 = 0x1c); 436 NONFAILING(*(uint16_t*)0x200000c2 = htobe16(0x4e20 + procid * 4)); 437 NONFAILING(*(uint32_t*)0x200000c4 = 0); 438 NONFAILING(memset((void*)0x200000c8, 0, 16)); 439 NONFAILING(*(uint32_t*)0x200000d8 = 0); 440 syscall(SYS_bind, r[0], 0x200000c0ul, 0x1cul); 441 break; 442 case 3: 443 NONFAILING(*(uint32_t*)0x20000080 = 9); 444 syscall(SYS_setsockopt, r[0], 0xffff, 0x10000, 0x20000080ul, 4ul); 445 break; 446 case 4: 447 NONFAILING(*(uint32_t*)0x20000040 = 0x72); 448 NONFAILING(*(uint8_t*)0x20000048 = 0x10); 449 NONFAILING(*(uint8_t*)0x20000049 = 2); 450 NONFAILING(*(uint16_t*)0x2000004a = htobe16(0x4e21 + procid * 4)); 451 NONFAILING(*(uint32_t*)0x2000004c = htobe32(0x7f000001)); 452 NONFAILING(memset((void*)0x20000050, 0, 8)); 453 NONFAILING(memset((void*)0x20000058, 0, 112)); 454 syscall(SYS_setsockopt, r[0], 0, 0x51, 0x20000040ul, 0x88ul); 455 break; 456 case 5: 457 res = syscall(SYS_socket, 0x1cul, 1ul, 0); 458 if (res != -1) 459 r[1] = res; 460 break; 461 case 6: 462 NONFAILING(*(uint8_t*)0x20000140 = 0x1c); 463 NONFAILING(*(uint8_t*)0x20000141 = 0x1c); 464 NONFAILING(*(uint16_t*)0x20000142 = htobe16(0x4e20 + procid * 4)); 465 NONFAILING(*(uint32_t*)0x20000144 = 0); 466 NONFAILING(memset((void*)0x20000148, 0, 16)); 467 NONFAILING(*(uint32_t*)0x20000158 = 0); 468 syscall(SYS_connect, r[1], 0x20000140ul, 0x1cul); 469 break; 470 } 471} 472int main(void) 473{ 474 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 475 install_segv_handler(); 476 for (procid = 0; procid < 4; procid++) { 477 if (fork() == 0) { 478 use_temporary_dir(); 479 do_sandbox_none(); 480 } 481 } 482 sleep(1000000); 483 return 0; 484} 485EOF 486mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 487 488(cd ../testcases/swap; ./swap -t 2m -i 10 -l 100 > /dev/null 2>&1) & 489 490(cd /tmp; timeout 2m ./$prog) 491wait 492 493rm -rf /tmp/$prog /tmp/$prog.c /tmp/syzkaller.* 494exit 0 495