1#!/bin/sh 2 3# panic: prot 0x3 is not subset of max_prot 0x5 4# cpuid = 0 5# time = 1586745417 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0015fe8650 8# vpanic() at vpanic+0x1c7/frame 0xfffffe0015fe86b0 9# panic() at panic+0x43/frame 0xfffffe0015fe8710 10# vm_map_insert() at vm_map_insert+0xa11/frame 0xfffffe0015fe87d0 11# vm_map_fixed() at vm_map_fixed+0x19c/frame 0xfffffe0015fe8850 12# vm_mmap_object() at vm_mmap_object+0x3be/frame 0xfffffe0015fe88e0 13# shm_mmap() at shm_mmap+0x2e3/frame 0xfffffe0015fe8980 14# kern_mmap_req() at kern_mmap_req+0xa72/frame 0xfffffe0015fe8a70 15# sys_mmap() at sys_mmap+0x53/frame 0xfffffe0015fe8ac0 16# amd64_syscall() at amd64_syscall+0x236/frame 0xfffffe0015fe8bf0 17 18# Reproduced on r359818 19# Fixed by r359892 20 21[ `uname -p` = "i386" ] && exit 0 22 23. ../default.cfg 24cat > /tmp/syzkaller8.c <<EOF 25// http://syzkaller.backtrace.io:8080/report?id=ba93405590ed607e9b2d65025a44ff60dc6c4bcc 26// autogenerated by syzkaller (https://github.com/google/syzkaller) 27 28#define _GNU_SOURCE 29 30#include <pwd.h> 31#include <setjmp.h> 32#include <signal.h> 33#include <stdarg.h> 34#include <stdbool.h> 35#include <stdint.h> 36#include <stdio.h> 37#include <stdlib.h> 38#include <string.h> 39#include <sys/endian.h> 40#include <sys/syscall.h> 41#include <unistd.h> 42 43static __thread int skip_segv; 44static __thread jmp_buf segv_env; 45 46static void segv_handler(int sig, siginfo_t* info, void* ctx __unused) 47{ 48 uintptr_t addr = (uintptr_t)info->si_addr; 49 const uintptr_t prog_start = 1 << 20; 50 const uintptr_t prog_end = 100 << 20; 51 if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && 52 (addr < prog_start || addr > prog_end)) { 53 _longjmp(segv_env, 1); 54 } 55 exit(sig); 56} 57 58static void install_segv_handler(void) 59{ 60 struct sigaction sa; 61 memset(&sa, 0, sizeof(sa)); 62 sa.sa_sigaction = segv_handler; 63 sa.sa_flags = SA_NODEFER | SA_SIGINFO; 64 sigaction(SIGSEGV, &sa, NULL); 65 sigaction(SIGBUS, &sa, NULL); 66} 67 68#define NONFAILING(...) \ 69 { \ 70 __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 71 if (_setjmp(segv_env) == 0) { \ 72 __VA_ARGS__; \ 73 } \ 74 __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 75 } 76 77uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; 78 79int main(void) 80{ 81 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul); 82 install_segv_handler(); 83 intptr_t res = 0; 84 syscall(SYS___getcwd, 0x20000000ul, 0xc7ul); 85 res = syscall(SYS_socket, 0x1cul, 3ul, 0x3a); 86 if (res != -1) 87 r[0] = res; 88 res = syscall(SYS_fcntl, r[0], 1ul, -1); 89 if (res != -1) 90 r[1] = res; 91 syscall(SYS_close, r[1]); 92 syscall(SYS_mprotect, 0x20000000ul, 0x4000ul, 1ul); 93 NONFAILING(memcpy((void*)0x20000000, "./file1\000", 8)); 94 syscall(SYS_freebsd12_shm_open, 0x20000000ul, 0x200ul, 0ul); 95 res = syscall(SYS_freebsd10_pipe, 0x20000080ul); 96 if (res != -1) 97 NONFAILING(r[2] = *(uint32_t*)0x20000084); 98 syscall(SYS_mmap, 0x20d43000ul, 0x200000ul, 3ul, 0x12ul, r[2], 0ul); 99 return 0; 100} 101EOF 102mycc -o /tmp/syzkaller8 -Wall -Wextra -O2 /tmp/syzkaller8.c -lpthread || 103 exit 1 104 105(cd /tmp; ./syzkaller8) & 106sleep 60 107pkill -9 syzkaller8 108wait 109 110rm -f /tmp/syzkaller8 /tmp/syzkaller8.c /tmp/syzkaller8.core /tmp/file0 111exit 0 112