| // WARNING in usb_submit_urb (3) |
| // https://syzkaller.appspot.com/bug?id=e815c44681ddb7ef43de3f0ce287a315c70d4cab |
| // status:fixed |
| // autogenerated by syzkaller (https://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| |
| #include <endian.h> |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <sched.h> |
| #include <stdarg.h> |
| #include <stdbool.h> |
| #include <stdint.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <sys/mman.h> |
| #include <sys/mount.h> |
| #include <sys/prctl.h> |
| #include <sys/resource.h> |
| #include <sys/stat.h> |
| #include <sys/syscall.h> |
| #include <sys/time.h> |
| #include <sys/types.h> |
| #include <sys/wait.h> |
| #include <unistd.h> |
| |
| #include <linux/capability.h> |
| |
| static void use_temporary_dir(void) |
| { |
| char tmpdir_template[] = "./syzkaller.XXXXXX"; |
| char* tmpdir = mkdtemp(tmpdir_template); |
| if (!tmpdir) |
| exit(1); |
| if (chmod(tmpdir, 0777)) |
| exit(1); |
| if (chdir(tmpdir)) |
| exit(1); |
| } |
| |
| static long syz_open_dev(long a0, long a1, long a2) |
| { |
| if (a0 == 0xc || a0 == 0xb) { |
| char buf[128]; |
| sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, |
| (uint8_t)a2); |
| return open(buf, O_RDWR, 0); |
| } else { |
| char buf[1024]; |
| char* hash; |
| strncpy(buf, (char*)a0, sizeof(buf) - 1); |
| buf[sizeof(buf) - 1] = 0; |
| while ((hash = strchr(buf, '#'))) { |
| *hash = '0' + (char)(a1 % 10); |
| a1 /= 10; |
| } |
| return open(buf, a2, 0); |
| } |
| } |
| |
| static bool write_file(const char* file, const char* what, ...) |
| { |
| char buf[1024]; |
| va_list args; |
| va_start(args, what); |
| vsnprintf(buf, sizeof(buf), what, args); |
| va_end(args); |
| buf[sizeof(buf) - 1] = 0; |
| int len = strlen(buf); |
| int fd = open(file, O_WRONLY | O_CLOEXEC); |
| if (fd == -1) |
| return false; |
| if (write(fd, buf, len) != len) { |
| int err = errno; |
| close(fd); |
| errno = err; |
| return false; |
| } |
| close(fd); |
| return true; |
| } |
| |
| static void setup_common() |
| { |
| if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { |
| } |
| } |
| |
| static void loop(); |
| |
| static void sandbox_common() |
| { |
| prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); |
| setpgrp(); |
| setsid(); |
| struct rlimit rlim; |
| rlim.rlim_cur = rlim.rlim_max = 200 << 20; |
| setrlimit(RLIMIT_AS, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 32 << 20; |
| setrlimit(RLIMIT_MEMLOCK, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 136 << 20; |
| setrlimit(RLIMIT_FSIZE, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 1 << 20; |
| setrlimit(RLIMIT_STACK, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 0; |
| setrlimit(RLIMIT_CORE, &rlim); |
| rlim.rlim_cur = rlim.rlim_max = 256; |
| setrlimit(RLIMIT_NOFILE, &rlim); |
| if (unshare(CLONE_NEWNS)) { |
| } |
| if (unshare(CLONE_NEWIPC)) { |
| } |
| if (unshare(0x02000000)) { |
| } |
| if (unshare(CLONE_NEWUTS)) { |
| } |
| if (unshare(CLONE_SYSVSEM)) { |
| } |
| } |
| |
| int wait_for_loop(int pid) |
| { |
| if (pid < 0) |
| exit(1); |
| int status = 0; |
| while (waitpid(-1, &status, __WALL) != pid) { |
| } |
| return WEXITSTATUS(status); |
| } |
| |
| static int real_uid; |
| static int real_gid; |
| __attribute__((aligned(64 << 10))) static char sandbox_stack[1 << 20]; |
| |
| static int namespace_sandbox_proc(void* arg) |
| { |
| sandbox_common(); |
| write_file("/proc/self/setgroups", "deny"); |
| if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)) |
| exit(1); |
| if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) |
| exit(1); |
| if (unshare(CLONE_NEWNET)) |
| exit(1); |
| if (mkdir("./syz-tmp", 0777)) |
| exit(1); |
| if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) |
| exit(1); |
| if (mkdir("./syz-tmp/newroot", 0777)) |
| exit(1); |
| if (mkdir("./syz-tmp/newroot/dev", 0700)) |
| exit(1); |
| unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE; |
| if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL)) |
| exit(1); |
| if (mkdir("./syz-tmp/newroot/proc", 0700)) |
| exit(1); |
| if (mount(NULL, "./syz-tmp/newroot/proc", "proc", 0, NULL)) |
| exit(1); |
| if (mkdir("./syz-tmp/newroot/selinux", 0700)) |
| exit(1); |
| const char* selinux_path = "./syz-tmp/newroot/selinux"; |
| if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) { |
| if (errno != ENOENT) |
| exit(1); |
| if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) && |
| errno != ENOENT) |
| exit(1); |
| } |
| if (mkdir("./syz-tmp/newroot/sys", 0700)) |
| exit(1); |
| if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL)) |
| exit(1); |
| if (mkdir("./syz-tmp/pivot", 0777)) |
| exit(1); |
| if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { |
| if (chdir("./syz-tmp")) |
| exit(1); |
| } else { |
| if (chdir("/")) |
| exit(1); |
| if (umount2("./pivot", MNT_DETACH)) |
| exit(1); |
| } |
| if (chroot("./newroot")) |
| exit(1); |
| if (chdir("/")) |
| exit(1); |
| struct __user_cap_header_struct cap_hdr = {}; |
| struct __user_cap_data_struct cap_data[2] = {}; |
| cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; |
| cap_hdr.pid = getpid(); |
| if (syscall(SYS_capget, &cap_hdr, &cap_data)) |
| exit(1); |
| cap_data[0].effective &= ~(1 << CAP_SYS_PTRACE); |
| cap_data[0].permitted &= ~(1 << CAP_SYS_PTRACE); |
| cap_data[0].inheritable &= ~(1 << CAP_SYS_PTRACE); |
| if (syscall(SYS_capset, &cap_hdr, &cap_data)) |
| exit(1); |
| loop(); |
| exit(1); |
| } |
| |
| #define SYZ_HAVE_SANDBOX_NAMESPACE 1 |
| static int do_sandbox_namespace(void) |
| { |
| int pid; |
| setup_common(); |
| real_uid = getuid(); |
| real_gid = getgid(); |
| mprotect(sandbox_stack, 4096, PROT_NONE); |
| pid = |
| clone(namespace_sandbox_proc, &sandbox_stack[sizeof(sandbox_stack) - 64], |
| CLONE_NEWUSER | CLONE_NEWPID, 0); |
| return wait_for_loop(pid); |
| } |
| |
| uint64_t r[1] = {0xffffffffffffffff}; |
| |
| void loop(void) |
| { |
| long res = 0; |
| syscall(__NR_getpid); |
| memcpy((void*)0x200000c0, "/dev/bus/usb/00#/00#", 21); |
| res = syz_open_dev(0x200000c0, 0x80000000009, 0x1000000000000001); |
| if (res != -1) |
| r[0] = res; |
| *(uint32_t*)0x20000080 = 0x8002; |
| *(uint32_t*)0x20000084 = 0; |
| *(uint32_t*)0x20000088 = 5; |
| *(uint32_t*)0x2000008c = 0x730000; |
| *(uint32_t*)0x20000090 = 0x7ff0bdbe; |
| *(uint64_t*)0x20000098 = 0; |
| syscall(__NR_ioctl, r[0], 0x802c550a, 0x20000080); |
| } |
| int main(void) |
| { |
| syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); |
| use_temporary_dir(); |
| do_sandbox_namespace(); |
| return 0; |
| } |