syzkaller-repros/linux/369d7776ffde266ffe528cf8740346435362f37f.c

// KASAN: use-after-free Read in rxrpc_put_peer
// https://syzkaller.appspot.com/bug?id=369d7776ffde266ffe528cf8740346435362f37f
// status:open
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  int i;
  for (i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter;
  for (iter = 0;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      sleep_ms(1);
      if (current_time_ms() - start < 5 * 1000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  syscall(__NR_perf_event_open, 0, 0, -1, -1, 0);
  *(uint32_t*)0x20000200 = 0xde;
  syscall(__NR_getsockopt, -1, 1, 0, 0x20000400, 0x20000200);
  res = syscall(__NR_socket, 0x2000000000000021, 2, 2);
  if (res != -1)
    r[0] = res;
  *(uint16_t*)0x20000040 = 0x21;
  *(uint16_t*)0x20000042 = 0;
  *(uint16_t*)0x20000044 = 2;
  *(uint16_t*)0x20000046 = 0x1c;
  *(uint16_t*)0x20000048 = 0xa;
  *(uint16_t*)0x2000004a = htobe16(0);
  *(uint32_t*)0x2000004c = htobe32(0);
  *(uint8_t*)0x20000050 = 0xfe;
  *(uint8_t*)0x20000051 = 0x80;
  *(uint8_t*)0x20000052 = 0;
  *(uint8_t*)0x20000053 = 0;
  *(uint8_t*)0x20000054 = 0;
  *(uint8_t*)0x20000055 = 0;
  *(uint8_t*)0x20000056 = 0;
  *(uint8_t*)0x20000057 = 0;
  *(uint8_t*)0x20000058 = 0;
  *(uint8_t*)0x20000059 = 0;
  *(uint8_t*)0x2000005a = 0;
  *(uint8_t*)0x2000005b = 0;
  *(uint8_t*)0x2000005c = 0;
  *(uint8_t*)0x2000005d = 0;
  *(uint8_t*)0x2000005e = 0;
  *(uint8_t*)0x2000005f = 0xbb;
  *(uint32_t*)0x20000060 = 0;
  syscall(__NR_connect, r[0], 0x20000040, 0x24);
  *(uint64_t*)0x20005c00 = 0;
  *(uint32_t*)0x20005c08 = 0;
  *(uint64_t*)0x20005c10 = 0;
  *(uint64_t*)0x20005c18 = 0;
  *(uint64_t*)0x20005c20 = 0x20000240;
  memcpy((void*)0x20000240,
         "\x18\x00\x00\x00\x00\x00\x00\x00\x10\x01\x00\x00\x01\x00\x00\x00\x77"
         "\x00\x00\xf2\x00\x00\x00\x00\xa6\xe2\x17\xb9\x1c\x3b\x0d\x87\x37\x22"
         "\xb4\x1a\x11\x8f\xd5\x8f\xa1\xf0\xa3\x9a\xd9\x58\x22\x03\xda\xa3\x2c"
         "\x98\x31\x69\x9a\xcc\x52\xf1\x41\xee\xca\x2b\xd1\x1f\x00\x00\x00\x4e"
         "\x5b\xff\x40\xe0\x62\xa4\x3f\x80\xb1\xba\xbf\x50\x76\xd2\x50\x28\x92"
         "\x25\x0d\xee\xe2\x72\x83\x16\xe6\x3e\x58\x9d\xdf\x14\x2e\x89\x36\x5b"
         "\xd4\x8c\xf7\x66\x02\xc6\xf6\xaa\x76\xbc\x37\x28\x47\x32\xbd\x1e\x19"
         "\x1d\xdd\x3c\x9f\x31\x0f\x82\x7c\x19\x5f\x3c\x49\x57\xc6\x7a\x08\x46"
         "\x65\x17\xba\x13\x6c\x8c\x9e\x01\x00\x00\x00\xf8\xff\xff\xff\xff\xff"
         "\xff\xff\x3e\x26\xb5\xca\x26\xbb\x43\x4d\xbd\x0e\x50\x85\xc2\x94\xe5"
         "\x77\xbb\x08\x18\x76\xe6\x3e\x7c\x28\x34\x53\x39\x25\xdb\x8b\x54\xb3"
         "\x3d\xa7\xb9\x47\xae\xfc\xa1\xf9\xc4\x9c\x64\x8d\x58\xd4\xf9\x44\x26"
         "\x4f\xca\xce\x71\xd5\xc7\x98\xcd\x3c\x13\xd7\x08\x3a\x7e\xb4\xc5\x26"
         "\xe0\x72\xa2\x3b\xd2\x4c\xcc\xb3\x8e\x4e\xff\x54\x25\x20\x85\x8c\x94"
         "\x0f\xbb\x95\x97\x9a\x56\x4d\x73\xa7\xaf\x10\x7f\xd5\xdd\xaa\x49\x18"
         "\x38\x87\x39\x14\xa4\x67\xc3\xce\x28\x05\x68\x3b\xeb\x45\x59\x86\x43"
         "\x17\xc0\xa1\xda\xc9\x2d\x09\x0f\x4f\x90\x93\x67\x97\x91\xa2\x84\x0f"
         "\x28\x51\x32\x4a\xcd\xf4\x4a\x80\x7e\x69\xa1\xbc\x25\xd2\x65\x30\x30"
         "\x04\xe8\xea\xd1\x28\xa3\xd6\x1c\x00\x63\x23\x35\x01\xcf\xdf\x76\xd9"
         "\x9d\xbc\x46\xb9\xc0\x02\x03\xa9\x16\x1b\x8a\x44\x40\x01\xc3\x86\x47"
         "\x5c\x43\x2c\x7a\x6e\x89\x88\x85\x42\x90\x63\x95\x4e\xa0\xbd\xf9\xab"
         "\xc7\xb9\x32\x2f\x34\x85\xd9\x9a\xb3\x8a\x32\x31\xea\x08\x58\x47\x95"
         "\x64\x7d\xdb\x75\xc5\x93\x93\x3e\x82\x4a\xcd\xab\x29\x24\x82\x73\x5c"
         "\xd9\x15\x72\xd0\xbc\x3f\x95\xb6\x1e\x03\x91\x83\xf5\xed\x7c\xb7\x5f",
         408);
  *(uint64_t*)0x20005c28 = 0x18;
  *(uint32_t*)0x20005c30 = 0;
  *(uint32_t*)0x20005c38 = 0;
  syscall(__NR_sendmmsg, r[0], 0x20005c00, 1, 0x4048000);
  syscall(__NR_close, r[0]);
}
int main(void)
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  for (procid = 0; procid < 6; procid++) {
    if (fork() == 0) {
      loop();
    }
  }
  sleep(1000000);
  return 0;
}