API tools faq
paste
Advertisement
cruisek

Untitled

cruisek
Jan 9th, 2022
57
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.57 KB | None | 0 0
raw download clone embed print report
  1. // autogenerated by syzkaller (https://github.com/google/syzkaller)
  2.  
  3. #define _GNU_SOURCE
  4.  
  5. #include <dirent.h>
  6. #include <endian.h>
  7. #include <errno.h>
  8. #include <fcntl.h>
  9. #include <pthread.h>
  10. #include <signal.h>
  11. #include <stdarg.h>
  12. #include <stdbool.h>
  13. #include <stddef.h>
  14. #include <stdint.h>
  15. #include <stdio.h>
  16. #include <stdlib.h>
  17. #include <string.h>
  18. #include <sys/ioctl.h>
  19. #include <sys/mount.h>
  20. #include <sys/prctl.h>
  21. #include <sys/stat.h>
  22. #include <sys/syscall.h>
  23. #include <sys/types.h>
  24. #include <sys/wait.h>
  25. #include <time.h>
  26. #include <unistd.h>
  27.  
  28. #include <linux/futex.h>
  29. #include <linux/loop.h>
  30.  
  31. static unsigned long long procid;
  32.  
  33. static void sleep_ms(uint64_t ms)
  34. {
  35. usleep(ms * 1000);
  36. }
  37.  
  38. static uint64_t current_time_ms(void)
  39. {
  40. struct timespec ts;
  41. if (clock_gettime(CLOCK_MONOTONIC, &ts))
  42. exit(1);
  43. return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
  44. }
  45.  
  46. static void thread_start(void* (*fn)(void*), void* arg)
  47. {
  48. pthread_t th;
  49. pthread_attr_t attr;
  50. pthread_attr_init(&attr);
  51. pthread_attr_setstacksize(&attr, 128 << 10);
  52. int i = 0;
  53. for (; i < 100; i++) {
  54. if (pthread_create(&th, &attr, fn, arg) == 0) {
  55. pthread_attr_destroy(&attr);
  56. return;
  57. }
  58. if (errno == EAGAIN) {
  59. usleep(50);
  60. continue;
  61. }
  62. break;
  63. }
  64. exit(1);
  65. }
  66.  
  67. typedef struct {
  68. int state;
  69. } event_t;
  70.  
  71. static void event_init(event_t* ev)
  72. {
  73. ev->state = 0;
  74. }
  75.  
  76. static void event_reset(event_t* ev)
  77. {
  78. ev->state = 0;
  79. }
  80.  
  81. static void event_set(event_t* ev)
  82. {
  83. if (ev->state)
  84. exit(1);
  85. __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
  86. syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
  87. }
  88.  
  89. static void event_wait(event_t* ev)
  90. {
  91. while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
  92. syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
  93. }
  94.  
  95. static int event_isset(event_t* ev)
  96. {
  97. return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
  98. }
  99.  
  100. static int event_timedwait(event_t* ev, uint64_t timeout)
  101. {
  102. uint64_t start = current_time_ms();
  103. uint64_t now = start;
  104. for (;;) {
  105. uint64_t remain = timeout - (now - start);
  106. struct timespec ts;
  107. ts.tv_sec = remain / 1000;
  108. ts.tv_nsec = (remain % 1000) * 1000 * 1000;
  109. syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
  110. if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
  111. return 1;
  112. now = current_time_ms();
  113. if (now - start > timeout)
  114. return 0;
  115. }
  116. }
  117.  
  118. static bool write_file(const char* file, const char* what, ...)
  119. {
  120. char buf[1024];
  121. va_list args;
  122. va_start(args, what);
  123. vsnprintf(buf, sizeof(buf), what, args);
  124. va_end(args);
  125. buf[sizeof(buf) - 1] = 0;
  126. int len = strlen(buf);
  127. int fd = open(file, O_WRONLY | O_CLOEXEC);
  128. if (fd == -1)
  129. return false;
  130. if (write(fd, buf, len) != len) {
  131. int err = errno;
  132. close(fd);
  133. errno = err;
  134. return false;
  135. }
  136. close(fd);
  137. return true;
  138. }
  139.  
  140. static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
  141. {
  142. if (a0 == 0xc || a0 == 0xb) {
  143. char buf[128];
  144. sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2);
  145. return open(buf, O_RDWR, 0);
  146. } else {
  147. char buf[1024];
  148. char* hash;
  149. strncpy(buf, (char*)a0, sizeof(buf) - 1);
  150. buf[sizeof(buf) - 1] = 0;
  151. while ((hash = strchr(buf, '#'))) {
  152. *hash = '0' + (char)(a1 % 10);
  153. a1 /= 10;
  154. }
  155. return open(buf, a2, 0);
  156. }
  157. }
  158.  
  159. struct fs_image_segment {
  160. void* data;
  161. uintptr_t size;
  162. uintptr_t offset;
  163. };
  164.  
  165. #define IMAGE_MAX_SEGMENTS 4096
  166. #define IMAGE_MAX_SIZE (129 << 20)
  167.  
  168. #define sys_memfd_create 319
  169.  
  170. static unsigned long fs_image_segment_check(unsigned long size, unsigned long nsegs, struct fs_image_segment* segs)
  171. {
  172. if (nsegs > IMAGE_MAX_SEGMENTS)
  173. nsegs = IMAGE_MAX_SEGMENTS;
  174. for (size_t i = 0; i < nsegs; i++) {
  175. if (segs[i].size > IMAGE_MAX_SIZE)
  176. segs[i].size = IMAGE_MAX_SIZE;
  177. segs[i].offset %= IMAGE_MAX_SIZE;
  178. if (segs[i].offset > IMAGE_MAX_SIZE - segs[i].size)
  179. segs[i].offset = IMAGE_MAX_SIZE - segs[i].size;
  180. if (size < segs[i].offset + segs[i].offset)
  181. size = segs[i].offset + segs[i].offset;
  182. }
  183. if (size > IMAGE_MAX_SIZE)
  184. size = IMAGE_MAX_SIZE;
  185. return size;
  186. }
  187. static int setup_loop_device(long unsigned size, long unsigned nsegs, struct fs_image_segment* segs, const char* loopname, int* memfd_p, int* loopfd_p)
  188. {
  189. int err = 0, loopfd = -1;
  190. size = fs_image_segment_check(size, nsegs, segs);
  191. int memfd = syscall(sys_memfd_create, "syzkaller", 0);
  192. if (memfd == -1) {
  193. err = errno;
  194. goto error;
  195. }
  196. if (ftruncate(memfd, size)) {
  197. err = errno;
  198. goto error_close_memfd;
  199. }
  200. for (size_t i = 0; i < nsegs; i++) {
  201. if (pwrite(memfd, segs[i].data, segs[i].size, segs[i].offset) < 0) {
  202. }
  203. }
  204. loopfd = open(loopname, O_RDWR);
  205. if (loopfd == -1) {
  206. err = errno;
  207. goto error_close_memfd;
  208. }
  209. if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
  210. if (errno != EBUSY) {
  211. err = errno;
  212. goto error_close_loop;
  213. }
  214. ioctl(loopfd, LOOP_CLR_FD, 0);
  215. usleep(1000);
  216. if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
  217. err = errno;
  218. goto error_close_loop;
  219. }
  220. }
  221. *memfd_p = memfd;
  222. *loopfd_p = loopfd;
  223. return 0;
  224.  
  225. error_close_loop:
  226. close(loopfd);
  227. error_close_memfd:
  228. close(memfd);
  229. error:
  230. errno = err;
  231. return -1;
  232. }
  233.  
  234. static long syz_mount_image(volatile long fsarg, volatile long dir, volatile unsigned long size, volatile unsigned long nsegs, volatile long segments, volatile long flags, volatile long optsarg)
  235. {
  236. struct fs_image_segment* segs = (struct fs_image_segment*)segments;
  237. int res = -1, err = 0, loopfd = -1, memfd = -1, need_loop_device = !!segs;
  238. char* mount_opts = (char*)optsarg;
  239. char* target = (char*)dir;
  240. char* fs = (char*)fsarg;
  241. char* source = NULL;
  242. char loopname[64];
  243. if (need_loop_device) {
  244. memset(loopname, 0, sizeof(loopname));
  245. snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
  246. if (setup_loop_device(size, nsegs, segs, loopname, &memfd, &loopfd) == -1)
  247. return -1;
  248. source = loopname;
  249. }
  250. mkdir(target, 0777);
  251. char opts[256];
  252. memset(opts, 0, sizeof(opts));
  253. if (strlen(mount_opts) > (sizeof(opts) - 32)) {
  254. }
  255. strncpy(opts, mount_opts, sizeof(opts) - 32);
  256. if (strcmp(fs, "iso9660") == 0) {
  257. flags |= MS_RDONLY;
  258. } else if (strncmp(fs, "ext", 3) == 0) {
  259. if (strstr(opts, "errors=panic") || strstr(opts, "errors=remount-ro") == 0)
  260. strcat(opts, ",errors=continue");
  261. } else if (strcmp(fs, "xfs") == 0) {
  262. strcat(opts, ",nouuid");
  263. }
  264. res = mount(source, target, fs, flags, opts);
  265. if (res == -1) {
  266. err = errno;
  267. goto error_clear_loop;
  268. }
  269. res = open(target, O_RDONLY | O_DIRECTORY);
  270. if (res == -1) {
  271. err = errno;
  272. }
  273.  
  274. error_clear_loop:
  275. if (need_loop_device) {
  276. ioctl(loopfd, LOOP_CLR_FD, 0);
  277. close(loopfd);
  278. close(memfd);
  279. }
  280. errno = err;
  281. return res;
  282. }
  283.  
  284. static void kill_and_wait(int pid, int* status)
  285. {
  286. kill(-pid, SIGKILL);
  287. kill(pid, SIGKILL);
  288. for (int i = 0; i < 100; i++) {
  289. if (waitpid(-1, status, WNOHANG | __WALL) == pid)
  290. return;
  291. usleep(1000);
  292. }
  293. DIR* dir = opendir("/sys/fs/fuse/connections");
  294. if (dir) {
  295. for (;;) {
  296. struct dirent* ent = readdir(dir);
  297. if (!ent)
  298. break;
  299. if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
  300. continue;
  301. char abort[300];
  302. snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
  303. int fd = open(abort, O_WRONLY);
  304. if (fd == -1) {
  305. continue;
  306. }
  307. if (write(fd, abort, 1) < 0) {
  308. }
  309. close(fd);
  310. }
  311. closedir(dir);
  312. } else {
  313. }
  314. while (waitpid(-1, status, __WALL) != pid) {
  315. }
  316. }
  317.  
  318. static void reset_loop()
  319. {
  320. char buf[64];
  321. snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
  322. int loopfd = open(buf, O_RDWR);
  323. if (loopfd != -1) {
  324. ioctl(loopfd, LOOP_CLR_FD, 0);
  325. close(loopfd);
  326. }
  327. }
  328.  
  329. static void setup_test()
  330. {
  331. prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  332. setpgrp();
  333. write_file("/proc/self/oom_score_adj", "1000");
  334. }
  335.  
  336. struct thread_t {
  337. int created, call;
  338. event_t ready, done;
  339. };
  340.  
  341. static struct thread_t threads[16];
  342. static void execute_call(int call);
  343. static int running;
  344.  
  345. static void* thr(void* arg)
  346. {
  347. struct thread_t* th = (struct thread_t*)arg;
  348. for (;;) {
  349. event_wait(&th->ready);
  350. event_reset(&th->ready);
  351. execute_call(th->call);
  352. __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
  353. event_set(&th->done);
  354. }
  355. return 0;
  356. }
  357.  
  358. static void execute_one(void)
  359. {
  360. int i, call, thread;
  361. for (call = 0; call < 3; call++) {
  362. for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
  363. struct thread_t* th = &threads[thread];
  364. if (!th->created) {
  365. th->created = 1;
  366. event_init(&th->ready);
  367. event_init(&th->done);
  368. event_set(&th->done);
  369. thread_start(thr, th);
  370. }
  371. if (!event_isset(&th->done))
  372. continue;
  373. event_reset(&th->done);
  374. th->call = call;
  375. __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
  376. event_set(&th->ready);
  377. event_timedwait(&th->done, 50 + (call == 2 ? 50 : 0));
  378. break;
  379. }
  380. }
  381. for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
  382. sleep_ms(1);
  383. }
  384.  
  385. static void execute_one(void);
  386.  
  387. #define WAIT_FLAGS __WALL
  388.  
  389. static void loop(void)
  390. {
  391. int iter = 0;
  392. for (;; iter++) {
  393. reset_loop();
  394. int pid = fork();
  395. if (pid < 0)
  396. exit(1);
  397. if (pid == 0) {
  398. setup_test();
  399. execute_one();
  400. exit(0);
  401. }
  402. int status = 0;
  403. uint64_t start = current_time_ms();
  404. for (;;) {
  405. if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
  406. break;
  407. sleep_ms(1);
  408. if (current_time_ms() - start < 5000)
  409. continue;
  410. kill_and_wait(pid, &status);
  411. break;
  412. }
  413. }
  414. }
  415.  
  416. uint64_t r[1] = {0xffffffffffffffff};
  417.  
  418. void execute_call(int call)
  419. {
  420. intptr_t res = 0;
  421. switch (call) {
  422. case 0:
  423. memcpy((void*)0x20000080, "/dev/fd#\000", 9);
  424. res = -1;
  425. res = syz_open_dev(0x20000080, 0, 0x4a03);
  426. if (res != -1)
  427. r[0] = res;
  428. break;
  429. case 1:
  430. *(uint32_t*)0x20000100 = 0;
  431. *(uint64_t*)0x20000108 = 0;
  432. *(uint64_t*)0x20000110 = 0;
  433. *(uint64_t*)0x20000118 = 0;
  434. *(uint64_t*)0x20000120 = 6;
  435. *(uint64_t*)0x20000128 = 0;
  436. *(uint32_t*)0x20000130 = 0;
  437. *(uint8_t*)0x20000134 = 0;
  438. *(uint8_t*)0x20000135 = 0;
  439. memcpy((void*)0x20000136, "\x1d\xcd\xbe\x0e\x92\x3e\xbc\x32\x65\xf5\xbb\x4e\x6e\xcd\xda\xf9", 16);
  440. *(uint8_t*)0x20000146 = 0;
  441. memset((void*)0x20000147, 0, 16);
  442. *(uint32_t*)0x20000158 = 0;
  443. *(uint32_t*)0x2000015c = 0;
  444. *(uint32_t*)0x20000160 = 0;
  445. *(uint32_t*)0x20000164 = 0;
  446. syscall(__NR_ioctl, r[0], 0x258, 0x20000100ul);
  447. break;
  448. case 2:
  449. *(uint64_t*)0x20000080 = 0;
  450. *(uint64_t*)0x20000088 = 0;
  451. *(uint64_t*)0x20000090 = 0x8000;
  452. *(uint64_t*)0x20000098 = 0;
  453. *(uint64_t*)0x200000a0 = 0;
  454. *(uint64_t*)0x200000a8 = 0x8800;
  455. *(uint64_t*)0x200000b0 = 0;
  456. *(uint64_t*)0x200000b8 = 0;
  457. *(uint64_t*)0x200000c0 = 0x18000;
  458. *(uint64_t*)0x200000c8 = 0;
  459. *(uint64_t*)0x200000d0 = 0;
  460. *(uint64_t*)0x200000d8 = 0x180c0;
  461. *(uint64_t*)0x200000e0 = 0;
  462. *(uint64_t*)0x200000e8 = 0;
  463. *(uint64_t*)0x200000f0 = 0x181e0;
  464. *(uint64_t*)0x200000f8 = 0x20000780;
  465. memcpy((void*)0x20000780, "\x06\x00\x03\x00\x25\x00\x01\x00\x22\xaf\xe8\x01\x61\x00\x00\x00\x02\x00\x00\x00\x00\x4f\x53\x54\x41\x20\x43\x6f\x6d\x70\x72\x65\x73\x73\x65\x64\x20\x55\x6e\x69\x63\x6f\x64\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x4c\x69\x6e\x75\x78\x55\x44\x46", 93);
  466. *(uint64_t*)0x20000100 = 0x5d;
  467. *(uint64_t*)0x20000108 = 0x18400;
  468. *(uint64_t*)0x20000110 = 0;
  469. *(uint64_t*)0x20000118 = 0;
  470. *(uint64_t*)0x20000120 = 0x184c0;
  471. *(uint64_t*)0x20000128 = 0;
  472. *(uint64_t*)0x20000130 = 0;
  473. *(uint64_t*)0x20000138 = 0x185a0;
  474. *(uint64_t*)0x20000140 = 0;
  475. *(uint64_t*)0x20000148 = 0;
  476. *(uint64_t*)0x20000150 = 0x18800;
  477. *(uint64_t*)0x20000158 = 0x20000980;
  478. *(uint64_t*)0x20000160 = 0;
  479. *(uint64_t*)0x20000168 = 0x188a0;
  480. *(uint64_t*)0x20000170 = 0;
  481. *(uint64_t*)0x20000178 = 0;
  482. *(uint64_t*)0x20000180 = 0x20000;
  483. *(uint64_t*)0x20000188 = 0;
  484. *(uint64_t*)0x20000190 = 0;
  485. *(uint64_t*)0x20000198 = 0x40000;
  486. *(uint64_t*)0x200001a0 = 0;
  487. *(uint64_t*)0x200001a8 = 0;
  488. *(uint64_t*)0x200001b0 = 0x150000;
  489. *(uint64_t*)0x200001b8 = 0;
  490. *(uint64_t*)0x200001c0 = 0;
  491. *(uint64_t*)0x200001c8 = 0x1500e0;
  492. *(uint64_t*)0x200001d0 = 0;
  493. *(uint64_t*)0x200001d8 = 0;
  494. *(uint64_t*)0x200001e0 = 0x160000;
  495. syz_mount_image(0, 0, 0, 0xf, 0x20000080, 0, 0);
  496. break;
  497. }
  498.  
  499. }
  500. int main(void)
  501. {
  502. syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  503. syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
  504. syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
  505. for (procid = 0; procid < 8; procid++) {
  506. if (fork() == 0) {
  507. loop();
  508. }
  509. }
  510. sleep(1000000);
  511. return 0;
  512. }
  513.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!