blob: d12146230e09ee0e58b8167709221fcabb0f55a3 [file] [log] [blame]
// Invalid request partialResult in splice
// https://syzkaller.appspot.com/bug?id=010ab5cdbd5d0ca73a4227be6e883bd65fec09bc
// status:fixed
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#include <linux/futex.h>
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) &&
(addr < prog_start || addr > prog_end)) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_handler = SIG_IGN;
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) \
{ \
__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
if (_setjmp(segv_env) == 0) { \
__VA_ARGS__; \
} \
__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
int state;
} event_t;
static void event_init(event_t* ev)
{
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
if (ev->state)
exit(1);
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG);
}
static void event_wait(event_t* ev)
{
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}
static int event_isset(event_t* ev)
{
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
for (;;) {
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
if (__atomic_load_n(&ev->state, __ATOMIC_RELAXED))
return 1;
now = current_time_ms();
if (now - start > timeout)
return 0;
}
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void loop(void)
{
int i, call, thread;
for (call = 0; call < 6; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res;
switch (call) {
case 0:
res = syscall(__NR_socketpair, 1, 5, 0, 0x200019c0);
if (res != -1)
NONFAILING(r[0] = *(uint32_t*)0x200019c0);
break;
case 1:
syscall(__NR_sendto, -1, 0, 0, 0, 0, 0);
break;
case 2:
res = syscall(__NR_pipe, 0x200002c0);
if (res != -1) {
NONFAILING(r[1] = *(uint32_t*)0x200002c0);
NONFAILING(r[2] = *(uint32_t*)0x200002c4);
}
break;
case 3:
syscall(__NR_splice, r[1], 0, r[0], 0, 0x420000a77, 0);
break;
case 4:
NONFAILING(*(uint32_t*)0x20000000 = 0x66);
NONFAILING(*(uint8_t*)0x20000004 = 0x7d);
NONFAILING(*(uint16_t*)0x20000005 = 2);
NONFAILING(*(uint16_t*)0x20000007 = 0);
NONFAILING(*(uint16_t*)0x20000009 = 0x5f);
NONFAILING(*(uint16_t*)0x2000000b = 0);
NONFAILING(*(uint32_t*)0x2000000d = 5);
NONFAILING(*(uint8_t*)0x20000011 = 2);
NONFAILING(*(uint32_t*)0x20000012 = 4);
NONFAILING(*(uint64_t*)0x20000016 = 2);
NONFAILING(*(uint32_t*)0x2000001e = 0x4000000);
NONFAILING(*(uint32_t*)0x20000022 = 0xcc);
NONFAILING(*(uint32_t*)0x20000026 = 0x3ff);
NONFAILING(*(uint64_t*)0x2000002a = 0xf057);
NONFAILING(*(uint16_t*)0x20000032 = 0xe);
NONFAILING(memcpy((void*)0x20000034, "wlan0Mmd5sum@)", 14));
NONFAILING(*(uint16_t*)0x20000042 = 3);
NONFAILING(memcpy((void*)0x20000044, "!%/", 3));
NONFAILING(*(uint16_t*)0x20000047 = 0x1b);
NONFAILING(memcpy((void*)0x20000049, "selinux\\!*proc-GPL*vboxnet0", 27));
NONFAILING(*(uint16_t*)0x20000064 = 0);
syscall(__NR_write, r[2], 0x20000000, 0x66);
break;
case 5:
syscall(__NR_write, r[2], 0x20000000, 0xfffffd88);
break;
}
}
int main(void)
{
syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
install_segv_handler();
loop();
return 0;
}