| // DATA RACE in shm.(*Registry).findByKey |
| // https://syzkaller.appspot.com/bug?id=ba55d69152d4549df2ba6ce6bf8da25d8881598b |
| // status:fixed |
| // autogenerated by syzkaller (http://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| #include <endian.h> |
| #include <linux/futex.h> |
| #include <pthread.h> |
| #include <stdlib.h> |
| #include <sys/syscall.h> |
| #include <unistd.h> |
| |
| __attribute__((noreturn)) static void doexit(int status) |
| { |
| volatile unsigned i; |
| syscall(__NR_exit_group, status); |
| for (i = 0;; i++) { |
| } |
| } |
| #include <setjmp.h> |
| #include <signal.h> |
| #include <stdint.h> |
| #include <string.h> |
| #include <string.h> |
| |
| static __thread int skip_segv; |
| static __thread jmp_buf segv_env; |
| |
| static void segv_handler(int sig, siginfo_t* info, void* uctx) |
| { |
| uintptr_t addr = (uintptr_t)info->si_addr; |
| const uintptr_t prog_start = 1 << 20; |
| const uintptr_t prog_end = 100 << 20; |
| if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && |
| (addr < prog_start || addr > prog_end)) { |
| _longjmp(segv_env, 1); |
| } |
| doexit(sig); |
| } |
| |
| static void install_segv_handler() |
| { |
| struct sigaction sa; |
| |
| memset(&sa, 0, sizeof(sa)); |
| sa.sa_handler = SIG_IGN; |
| syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); |
| syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); |
| |
| memset(&sa, 0, sizeof(sa)); |
| sa.sa_sigaction = segv_handler; |
| sa.sa_flags = SA_NODEFER | SA_SIGINFO; |
| sigaction(SIGSEGV, &sa, NULL); |
| sigaction(SIGBUS, &sa, NULL); |
| } |
| |
| #define NONFAILING(...) \ |
| { \ |
| __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ |
| if (_setjmp(segv_env) == 0) { \ |
| __VA_ARGS__; \ |
| } \ |
| __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ |
| } |
| |
| static void execute_one(); |
| extern unsigned long long procid; |
| |
| void loop() |
| { |
| while (1) { |
| execute_one(); |
| } |
| } |
| |
| struct thread_t { |
| int created, running, call; |
| pthread_t th; |
| }; |
| |
| static struct thread_t threads[16]; |
| static void execute_call(int call); |
| static int running; |
| static int collide; |
| |
| static void* thr(void* arg) |
| { |
| struct thread_t* th = (struct thread_t*)arg; |
| for (;;) { |
| while (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) |
| syscall(SYS_futex, &th->running, FUTEX_WAIT, 0, 0); |
| execute_call(th->call); |
| __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); |
| __atomic_store_n(&th->running, 0, __ATOMIC_RELEASE); |
| syscall(SYS_futex, &th->running, FUTEX_WAKE); |
| } |
| return 0; |
| } |
| |
| static void execute(int num_calls) |
| { |
| int call, thread; |
| running = 0; |
| for (call = 0; call < num_calls; call++) { |
| for (thread = 0; thread < sizeof(threads) / sizeof(threads[0]); thread++) { |
| struct thread_t* th = &threads[thread]; |
| if (!th->created) { |
| th->created = 1; |
| pthread_attr_t attr; |
| pthread_attr_init(&attr); |
| pthread_attr_setstacksize(&attr, 128 << 10); |
| pthread_create(&th->th, &attr, thr, th); |
| } |
| if (!__atomic_load_n(&th->running, __ATOMIC_ACQUIRE)) { |
| th->call = call; |
| __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); |
| __atomic_store_n(&th->running, 1, __ATOMIC_RELEASE); |
| syscall(SYS_futex, &th->running, FUTEX_WAKE); |
| if (collide && call % 2) |
| break; |
| struct timespec ts; |
| ts.tv_sec = 0; |
| ts.tv_nsec = 20 * 1000 * 1000; |
| syscall(SYS_futex, &th->running, FUTEX_WAIT, 1, &ts); |
| if (running) |
| usleep((call == num_calls - 1) ? 10000 : 1000); |
| break; |
| } |
| } |
| } |
| } |
| |
| uint64_t r[2] = {0xffffffffffffffff, 0x0}; |
| unsigned long long procid; |
| void execute_call(int call) |
| { |
| long res; |
| switch (call) { |
| case 0: |
| syscall(__NR_munmap, 0x20000000, 0x2000); |
| break; |
| case 1: |
| res = syscall(__NR_socketpair, 1, 2, 0, 0x200024c0); |
| if (res != -1) |
| NONFAILING(r[0] = *(uint32_t*)0x200024c0); |
| break; |
| case 2: |
| NONFAILING(*(uint64_t*)0x20005c00 = 0x20000080); |
| NONFAILING(*(uint32_t*)0x20005c08 = 0x80); |
| NONFAILING(*(uint64_t*)0x20005c10 = 0x20000300); |
| NONFAILING(*(uint64_t*)0x20000300 = 0x20000100); |
| NONFAILING(*(uint64_t*)0x20000308 = 0x15); |
| NONFAILING(*(uint64_t*)0x20000310 = 0x20000140); |
| NONFAILING(*(uint64_t*)0x20000318 = 0xae); |
| NONFAILING(*(uint64_t*)0x20000320 = 0x20000200); |
| NONFAILING(*(uint64_t*)0x20000328 = 0x64); |
| NONFAILING(*(uint64_t*)0x20000330 = 0x20000280); |
| NONFAILING(*(uint64_t*)0x20000338 = 0x67); |
| NONFAILING(*(uint64_t*)0x20005c18 = 4); |
| NONFAILING(*(uint64_t*)0x20005c20 = 0x20000340); |
| NONFAILING(*(uint64_t*)0x20005c28 = 0x80); |
| NONFAILING(*(uint32_t*)0x20005c30 = 0xd6); |
| NONFAILING(*(uint32_t*)0x20005c38 = 0x1f); |
| NONFAILING(*(uint64_t*)0x20005c40 = 0); |
| NONFAILING(*(uint32_t*)0x20005c48 = 0); |
| NONFAILING(*(uint64_t*)0x20005c50 = 0x20000700); |
| NONFAILING(*(uint64_t*)0x20000700 = 0x200003c0); |
| NONFAILING(*(uint64_t*)0x20000708 = 0xbd); |
| NONFAILING(*(uint64_t*)0x20000710 = 0x20000480); |
| NONFAILING(*(uint64_t*)0x20000718 = 0xc3); |
| NONFAILING(*(uint64_t*)0x20000720 = 0x20000580); |
| NONFAILING(*(uint64_t*)0x20000728 = 0x6c); |
| NONFAILING(*(uint64_t*)0x20000730 = 0x20000600); |
| NONFAILING(*(uint64_t*)0x20000738 = 0xdf); |
| NONFAILING(*(uint64_t*)0x20005c58 = 4); |
| NONFAILING(*(uint64_t*)0x20005c60 = 0x20000740); |
| NONFAILING(*(uint64_t*)0x20005c68 = 0xa7); |
| NONFAILING(*(uint32_t*)0x20005c70 = 0x401); |
| NONFAILING(*(uint32_t*)0x20005c78 = 6); |
| NONFAILING(*(uint64_t*)0x20005c80 = 0x20000800); |
| NONFAILING(*(uint32_t*)0x20005c88 = 0x80); |
| NONFAILING(*(uint64_t*)0x20005c90 = 0x20001a00); |
| NONFAILING(*(uint64_t*)0x20001a00 = 0x20000880); |
| NONFAILING(*(uint64_t*)0x20001a08 = 0x26); |
| NONFAILING(*(uint64_t*)0x20001a10 = 0x200008c0); |
| NONFAILING(*(uint64_t*)0x20001a18 = 0x1000); |
| NONFAILING(*(uint64_t*)0x20001a20 = 0x20002500); |
| NONFAILING(*(uint64_t*)0x20001a28 = 0x1000); |
| NONFAILING(*(uint64_t*)0x20001a30 = 0x200018c0); |
| NONFAILING(*(uint64_t*)0x20001a38 = 0xd1); |
| NONFAILING(*(uint64_t*)0x20001a40 = 0x200019c0); |
| NONFAILING(*(uint64_t*)0x20001a48 = 7); |
| NONFAILING(*(uint64_t*)0x20005c98 = 5); |
| NONFAILING(*(uint64_t*)0x20005ca0 = 0x20001a80); |
| NONFAILING(*(uint64_t*)0x20005ca8 = 0x68); |
| NONFAILING(*(uint32_t*)0x20005cb0 = 2); |
| NONFAILING(*(uint32_t*)0x20005cb8 = 7); |
| NONFAILING(*(uint64_t*)0x20005cc0 = 0x20001b00); |
| NONFAILING(*(uint32_t*)0x20005cc8 = 0x80); |
| NONFAILING(*(uint64_t*)0x20005cd0 = 0x20001f00); |
| NONFAILING(*(uint64_t*)0x20001f00 = 0x20001b80); |
| NONFAILING(*(uint64_t*)0x20001f08 = 0x8d); |
| NONFAILING(*(uint64_t*)0x20001f10 = 0x20003500); |
| NONFAILING(*(uint64_t*)0x20001f18 = 0x1000); |
| NONFAILING(*(uint64_t*)0x20001f20 = 0x20001c40); |
| NONFAILING(*(uint64_t*)0x20001f28 = 0x8e); |
| NONFAILING(*(uint64_t*)0x20001f30 = 0x20001d00); |
| NONFAILING(*(uint64_t*)0x20001f38 = 0xca); |
| NONFAILING(*(uint64_t*)0x20001f40 = 0x20001e00); |
| NONFAILING(*(uint64_t*)0x20001f48 = 0xa3); |
| NONFAILING(*(uint64_t*)0x20001f50 = 0x20001ec0); |
| NONFAILING(*(uint64_t*)0x20001f58 = 0xc); |
| NONFAILING(*(uint64_t*)0x20005cd8 = 6); |
| NONFAILING(*(uint64_t*)0x20005ce0 = 0x20001f80); |
| NONFAILING(*(uint64_t*)0x20005ce8 = 0xcf); |
| NONFAILING(*(uint32_t*)0x20005cf0 = 9); |
| NONFAILING(*(uint32_t*)0x20005cf8 = 2); |
| NONFAILING(*(uint64_t*)0x20005d00 = 0x20002080); |
| NONFAILING(*(uint32_t*)0x20005d08 = 0x80); |
| NONFAILING(*(uint64_t*)0x20005d10 = 0x200023c0); |
| NONFAILING(*(uint64_t*)0x200023c0 = 0x20002100); |
| NONFAILING(*(uint64_t*)0x200023c8 = 0xda); |
| NONFAILING(*(uint64_t*)0x200023d0 = 0x20002200); |
| NONFAILING(*(uint64_t*)0x200023d8 = 0xdc); |
| NONFAILING(*(uint64_t*)0x200023e0 = 0x20002300); |
| NONFAILING(*(uint64_t*)0x200023e8 = 0xa8); |
| NONFAILING(*(uint64_t*)0x20005d18 = 3); |
| NONFAILING(*(uint64_t*)0x20005d20 = 0x20002400); |
| NONFAILING(*(uint64_t*)0x20005d28 = 0xac); |
| NONFAILING(*(uint32_t*)0x20005d30 = 0xfffffff8); |
| NONFAILING(*(uint32_t*)0x20005d38 = 4); |
| NONFAILING(*(uint64_t*)0x20005d40 = 0x20004500); |
| NONFAILING(*(uint32_t*)0x20005d48 = 0x80); |
| NONFAILING(*(uint64_t*)0x20005d50 = 0x20005b40); |
| NONFAILING(*(uint64_t*)0x20005b40 = 0x20004580); |
| NONFAILING(*(uint64_t*)0x20005b48 = 0x4d); |
| NONFAILING(*(uint64_t*)0x20005b50 = 0x20004600); |
| NONFAILING(*(uint64_t*)0x20005b58 = 0xcf); |
| NONFAILING(*(uint64_t*)0x20005b60 = 0x20004700); |
| NONFAILING(*(uint64_t*)0x20005b68 = 0xcb); |
| NONFAILING(*(uint64_t*)0x20005b70 = 0x20004800); |
| NONFAILING(*(uint64_t*)0x20005b78 = 0x37); |
| NONFAILING(*(uint64_t*)0x20005b80 = 0x20004840); |
| NONFAILING(*(uint64_t*)0x20005b88 = 0x1000); |
| NONFAILING(*(uint64_t*)0x20005b90 = 0x20005840); |
| NONFAILING(*(uint64_t*)0x20005b98 = 0xea); |
| NONFAILING(*(uint64_t*)0x20005ba0 = 0x20005940); |
| NONFAILING(*(uint64_t*)0x20005ba8 = 0x53); |
| NONFAILING(*(uint64_t*)0x20005bb0 = 0x200059c0); |
| NONFAILING(*(uint64_t*)0x20005bb8 = 7); |
| NONFAILING(*(uint64_t*)0x20005bc0 = 0x20005a00); |
| NONFAILING(*(uint64_t*)0x20005bc8 = 0x93); |
| NONFAILING(*(uint64_t*)0x20005bd0 = 0x20005ac0); |
| NONFAILING(*(uint64_t*)0x20005bd8 = 0x7b); |
| NONFAILING(*(uint64_t*)0x20005d58 = 0xa); |
| NONFAILING(*(uint64_t*)0x20005d60 = 0); |
| NONFAILING(*(uint64_t*)0x20005d68 = 0); |
| NONFAILING(*(uint32_t*)0x20005d70 = 6); |
| NONFAILING(*(uint32_t*)0x20005d78 = 1); |
| NONFAILING(*(uint64_t*)0x20005d80 = 0); |
| NONFAILING(*(uint64_t*)0x20005d88 = 0x989680); |
| syscall(__NR_recvmmsg, r[0], 0x20005c00, 6, 0x40000000, 0x20005d80); |
| break; |
| case 3: |
| NONFAILING(memcpy( |
| (void*)0x20000040, |
| "\x73\x79\x7a\x6b\x61\x6c\x6c\x65\x72\x31\x00\x00\x00\x00\x00\x00", |
| 16)); |
| NONFAILING(*(uint16_t*)0x20000050 = 2); |
| NONFAILING(*(uint16_t*)0x20000052 = htobe16(0x4e20)); |
| NONFAILING(*(uint32_t*)0x20000054 = htobe32(0x1f)); |
| NONFAILING(*(uint8_t*)0x20000058 = 0); |
| NONFAILING(*(uint8_t*)0x20000059 = 0); |
| NONFAILING(*(uint8_t*)0x2000005a = 0); |
| NONFAILING(*(uint8_t*)0x2000005b = 0); |
| NONFAILING(*(uint8_t*)0x2000005c = 0); |
| NONFAILING(*(uint8_t*)0x2000005d = 0); |
| NONFAILING(*(uint8_t*)0x2000005e = 0); |
| NONFAILING(*(uint8_t*)0x2000005f = 0); |
| syscall(__NR_ioctl, r[0], 0x8917, 0x20000040); |
| break; |
| case 4: |
| res = syscall(__NR_shmget, 0, 0x1000, 0x230, 0x20002000); |
| if (res != -1) |
| r[1] = res; |
| break; |
| case 5: |
| syscall(__NR_shmctl, r[1], 0); |
| break; |
| case 6: |
| syscall(__NR_shmget, 0x798dd813 + procid * 4, 0x2000, 4, 0x20001000); |
| break; |
| } |
| } |
| |
| void execute_one() |
| { |
| execute(7); |
| collide = 1; |
| execute(7); |
| } |
| |
| int main() |
| { |
| syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); |
| for (procid = 0; procid < 4; procid++) { |
| if (fork() == 0) { |
| install_segv_handler(); |
| for (;;) { |
| loop(); |
| } |
| } |
| } |
| sleep(1000000); |
| return 0; |
| } |