The branch main has been updated by pho: URL: https://cgit.FreeBSD.org/src/commit/?id=833f9294b46856dce3028a8ecb65663ed422b629
commit 833f9294b46856dce3028a8ecb65663ed422b629 Author: Peter Holm <[email protected]> AuthorDate: 2026-01-24 12:28:54 +0000 Commit: Peter Holm <[email protected]> CommitDate: 2026-01-24 12:28:54 +0000 stress2: Added two syzkaller reproducers. Updated the exclude file --- tools/test/stress2/misc/all.exclude | 4 + tools/test/stress2/misc/syzkaller88.sh | 317 +++++++++++++++++++++++++++++++++ tools/test/stress2/misc/syzkaller89.sh | 210 ++++++++++++++++++++++ 3 files changed, 531 insertions(+) diff --git a/tools/test/stress2/misc/all.exclude b/tools/test/stress2/misc/all.exclude index 9851496f8839..a802f7c21cb1 100644 --- a/tools/test/stress2/misc/all.exclude +++ b/tools/test/stress2/misc/all.exclude @@ -28,6 +28,9 @@ gnop9.sh Waiting for patch commit 20201214 graid1_3.sh Hang seen 20250915 graid1_8.sh Known issue 20170909 graid1_9.sh panic: Bad effnlink 20180212 +gunion.sh CAM stuk in vmwait 20251226 +ifconfig.sh https://people.freebsd.org/~pho/stress/log/log0626.txt 20251217 +ifconfig2.sh Hang in ifnet_de, vlan_sx and sbwait 20250114 lockf5.sh Spinning threads seen 20160718 maxvnodes2.sh https://people.freebsd.org/~pho/stress/log/log0083.txt 20210329 memguard.sh https://people.freebsd.org/~pho/stress/log/log0088.txt 20210402 @@ -71,6 +74,7 @@ syzkaller59.sh Page fault 20220625 syzkaller80.sh panic 20250711 syzkaller82.sh panic: m_apply, length > size of mbuf chain 20250724 syzkaller85.sh panic: Assertion uio->uio_resid < 0 failed 20250928 +syzkaller89.sh panic: MNT_DEFERRED requires MNT_RECURSE | MNT_FORCE 20241224 quota3.sh https://people.freebsd.org/~pho/stress/log/log0604.txt 20250728 quota6.sh https://people.freebsd.org/~pho/stress/log/log0456.txt 20240707 truss3.sh WiP 20200915 diff --git a/tools/test/stress2/misc/syzkaller88.sh b/tools/test/stress2/misc/syzkaller88.sh new file mode 100755 index 000000000000..b2225a37a27f --- /dev/null +++ b/tools/test/stress2/misc/syzkaller88.sh @@ -0,0 +1,317 @@ +#!/bin/sh + +# panic: proc_dtor: non-empty p_ktr +# cpuid = 1 +# time = 1768834000 +# KDB: stack backtrace: +# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0167884910 +# vpanic() at vpanic+0x136/frame 0xfffffe0167884a40 +# panic() at panic+0x43/frame 0xfffffe0167884aa0 +# proc_dtor() at proc_dtor+0x2cb/frame 0xfffffe0167884ae0 +# uma_zfree_arg() at uma_zfree_arg+0xaa/frame 0xfffffe0167884b30 +# proc_reap() at proc_reap+0x5b0/frame 0xfffffe0167884b70 +# proc_to_reap() at proc_to_reap+0x3be/frame 0xfffffe0167884bc0 +# kern_wait6() at kern_wait6+0x1ab/frame 0xfffffe0167884c60 +# sys_wait6() at sys_wait6+0x9f/frame 0xfffffe0167884e00 +# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0167884f30 +# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0167884f30 +# --- syscall (532, FreeBSD ELF64, wait6), rip = 0x3228e1de521a, rsp = 0x3228e0f6e308, rbp = 0x3228e0f6e350 --- +# KDB: enter: panic +# [ thread pid 67906 tid 768579 ] +# Stopped at kdb_enter+0x33: movq $0,0x11e6bc2(%rip) +# db> x/s version +# version: FreeBSD 16.0-CURRENT #0 main-n283239-11f954b021a1-dirty: Sun Jan 18 21:26:45 CET 2026 +# [email protected]:/usr/src/sys/amd64/compile/PHO +# db> + +# Fixed by: 6bb3f208617b - main - ktrace: do not enqueue request if the process' ktrioparams are freed + +[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 + +. ../default.cfg +set -u +prog=$(basename "$0" .sh) +cat > /tmp/$prog.c <<EOF +// https://syzkaller.appspot.com/bug?id=2212d848f78d472dfeaec7a3cc9f5a31e2a44f42 +// autogenerated by syzkaller (https://github.com/google/syzkaller) +// Reported-by: [email protected] + +#define _GNU_SOURCE + +#include <sys/types.h> + +#include <pwd.h> +#include <signal.h> +#include <stdarg.h> +#include <stdbool.h> +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <sys/endian.h> +#include <sys/syscall.h> +#include <sys/wait.h> +#include <time.h> +#include <unistd.h> + +static unsigned long long procid; + +static void kill_and_wait(int pid, int* status) +{ + kill(pid, SIGKILL); + while (waitpid(-1, status, 0) != pid) { + } +} + +static void sleep_ms(uint64_t ms) +{ + usleep(ms * 1000); +} + +static uint64_t current_time_ms(void) +{ + struct timespec ts; + if (clock_gettime(CLOCK_MONOTONIC, &ts)) + exit(1); + return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; +} + +static void execute_one(void); + +#define WAIT_FLAGS 0 + +static void loop(void) +{ + alarm(240); /* Added by pho */ + for (;;) { + int pid = fork(); + if (pid < 0) + exit(1); + if (pid == 0) { + execute_one(); + exit(0); + } + int status = 0; + uint64_t start = current_time_ms(); + for (;;) { + sleep_ms(10); + if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) + break; + if (current_time_ms() - start < 5000) + continue; + kill_and_wait(pid, &status); + break; + } + } +} + +uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff}; + +void execute_one(void) +{ + intptr_t res = 0; + if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { + } + // open\$dir arguments: [ + // file: ptr[in, buffer] { + // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) + // } + // flags: open_flags = 0x200 (8 bytes) + // mode: open_mode = 0x19c (8 bytes) + // ] + // returns fd_dir + memcpy((void*)0x200000000040, "./file0\000", 8); + syscall(SYS_open, /*file=*/0x200000000040ul, /*flags=O_CREAT*/ 0x200ul, + /*mode=S_IROTH|S_IXGRP|S_IWGRP|S_IWUSR|S_IRUSR*/ 0x19cul); + // setreuid arguments: [ + // ruid: uid (resource) + // euid: uid (resource) + // ] + syscall(SYS_setreuid, /*ruid=*/0xee00, /*euid=*/0); + // chown arguments: [ + // file: nil + // uid: uid (resource) + // gid: gid (resource) + // ] + syscall(SYS_chown, /*file=*/0ul, /*uid=*/0, /*gid=*/0); + // kqueue arguments: [ + // ] + // returns kqueue + res = syscall(SYS_kqueue); + if (res != -1) + r[0] = res; + // kevent arguments: [ + // kqueue: kqueue (resource) + // changelist: ptr[in, array[kevent]] { + // array[kevent] { + // kevent { + // ident: intptr = 0x0 (8 bytes) + // filter: filters = 0xfffffffffffffff9 (2 bytes) + // flags: evflags = 0x8009 (2 bytes) + // fflags: fflags = 0x8 (4 bytes) + // data: int64 = 0xe8c5 (8 bytes) + // udata: intptr = 0x0 (8 bytes) + // ext: array[int64] { + // int64 = 0x7ffffffffc (8 bytes) + // int64 = 0xfffffffffffffffc (8 bytes) + // int64 = 0x7 (8 bytes) + // int64 = 0x40000000000000 (8 bytes) + // } + // } + // } + // } + // nchanges: len = 0x1 (8 bytes) + // eventlist: nil + // nevents: len = 0x0 (8 bytes) + // timeout: nil + // ] + *(uint64_t*)0x200000000040 = 0; + *(uint16_t*)0x200000000048 = 0xfff9; + *(uint16_t*)0x20000000004a = 0x8009; + *(uint32_t*)0x20000000004c = 8; + *(uint64_t*)0x200000000050 = 0xe8c5; + *(uint64_t*)0x200000000058 = 0; + *(uint64_t*)0x200000000060 = 0x7ffffffffc; + *(uint64_t*)0x200000000068 = 0xfffffffffffffffc; + *(uint64_t*)0x200000000070 = 7; + *(uint64_t*)0x200000000078 = 0x40000000000000; + syscall(SYS_kevent, /*kqueue=*/r[0], /*changelist=*/0x200000000040ul, + /*nchanges=*/1ul, /*eventlist=*/0ul, /*nevents=*/0ul, + /*timeout=*/0ul); + // extattr_delete_fd arguments: [ + // fd: fd (resource) + // attrnamespace: attrnamespace_flags = 0x0 (8 bytes) + // attrname: ptr[in, buffer] { + // buffer: {27 17 2e 29 23 00} (length 0x6) + // } + // ] + memcpy((void*)0x2000000001c0, "\'\027.)#\000", 6); + syscall(SYS_extattr_delete_fd, /*fd=*/r[0], /*attrnamespace=*/0ul, + /*attrname=*/0x2000000001c0ul); + // freebsd11_mknod arguments: [ + // file: ptr[in, buffer] { + // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) + // } + // mod: mknod_mode = 0x1000 (8 bytes) + // dev: int32 = 0x0 (4 bytes) + // ] + memcpy((void*)0x2000000000c0, "./file0\000", 8); + syscall(SYS_freebsd11_mknod, /*file=*/0x2000000000c0ul, + /*mod=S_IFIFO*/ 0x1000ul, /*dev=*/0); + // freebsd10_pipe arguments: [ + // pipefd: nil + // ] + syscall(SYS_freebsd10_pipe, /*pipefd=*/0ul); + // ksem_init arguments: [ + // idp: ptr[out, semid] { + // semid (resource) + // } + // value: int32 = 0x0 (4 bytes) + // ] + res = syscall(SYS_ksem_init, /*idp=*/0x200000000100ul, /*value=*/0); + if (res != -1) + r[1] = *(uint64_t*)0x200000000100; + // ksem_post arguments: [ + // id: semid (resource) + // ] + syscall(SYS_ksem_post, /*id=*/r[1]); + // openat\$bpf arguments: [ + // fd: const = 0xffffffffffffff9c (8 bytes) + // file: ptr[in, buffer] { + // buffer: {2f 64 65 76 2f 62 70 66 00} (length 0x9) + // } + // flags: open_flags = 0x40 (8 bytes) + // mode: const = 0x0 (8 bytes) + // ] + // returns fd_bpf + memcpy((void*)0x200000000040, "/dev/bpf\000", 9); + syscall(SYS_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000040ul, + /*flags=FASYNC*/ 0x40ul, /*mode=*/0ul); + // kqueue arguments: [ + // ] + // returns kqueue + res = syscall(SYS_kqueue); + if (res != -1) + r[2] = res; + // kevent arguments: [ + // kqueue: kqueue (resource) + // changelist: nil + // nchanges: len = 0x0 (8 bytes) + // eventlist: nil + // nevents: len = 0x0 (8 bytes) + // timeout: nil + // ] + syscall(SYS_kevent, /*kqueue=*/r[2], /*changelist=*/0ul, /*nchanges=*/0ul, + /*eventlist=*/0ul, /*nevents=*/0ul, /*timeout=*/0ul); + // ktrace arguments: [ + // path: ptr[in, buffer] { + // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) + // } + // ops: ktrace_ops = 0x4 (8 bytes) + // trpoints: ktrace_trpoints = 0x94659db2cce5c9d8 (8 bytes) + // pid: pid (resource) + // ] + memcpy((void*)0x2000000000c0, "./file0\000", 8); + syscall( + SYS_ktrace, /*path=*/0x2000000000c0ul, /*ops=KTRFLAG_DESCEND*/ 4ul, + /*trpoints=KTRFAC_INHERIT|KTRFAC_FAULTEND|KTRFAC_PROCDTOR|KTRFAC_STRUCT|KTRFAC_USER|KTRFAC_CSW|KTRFAC_GENIO|0x94659db28ce58008*/ + 0x94659db2cce5c9d8ul, /*pid=*/0); + // rfork arguments: [ + // flags: rfork_flags = 0x96014 (8 bytes) + // ] + syscall(SYS_rfork, + /*flags=RFLINUXTHPN|RFTSIGZMB|RFSIGSHARE|RFTHREAD|RFFDG|RFPROC*/ + 0x96014ul); + // ktrace arguments: [ + // path: ptr[in, buffer] { + // buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8) + // } + // ops: ktrace_ops = 0x2 (8 bytes) + // trpoints: ktrace_trpoints = 0x180 (8 bytes) + // pid: pid (resource) + // ] + memcpy((void*)0x200000000000, "./file0\000", 8); + syscall(SYS_ktrace, /*path=*/0x200000000000ul, /*ops=KTROP_CLEARFILE*/ 2ul, + /*trpoints=KTRFAC_STRUCT|KTRFAC_USER*/ 0x180ul, /*pid=*/0); +} +int main(void) +{ + syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, + /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, + /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, + /*fd=*/(intptr_t)-1, /*offset=*/0ul); + const char* reason; + (void)reason; + for (procid = 0; procid < 4; procid++) { + if (fork() == 0) { + loop(); + } + } + sleep(1000000); + return 0; +} +EOF +mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 + +(cd ../testcases/swap; ./swap -t 3m -i 30 -l 100 > /dev/null 2>&1) & +sleep 5 + +kldstat | grep -q sem && loaded=0 || { kldload sem.ko && loaded=1; } +work=/tmp/$prog.dir +rm -rf $work +mkdir $work +cd /tmp/$prog.dir +for i in `jot 30`; do + ( + mkdir d$i + cd d$i + timeout 3m /tmp/$prog > /dev/null 2>&1 & + ) +done +while pgrep -q $prog; do sleep 2; done +while pkill swap; do :; done +wait + +rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core $work +[ $loaded -eq 1 ] && kldunload sem.ko +exit 0 diff --git a/tools/test/stress2/misc/syzkaller89.sh b/tools/test/stress2/misc/syzkaller89.sh new file mode 100755 index 000000000000..ea7325560d01 --- /dev/null +++ b/tools/test/stress2/misc/syzkaller89.sh @@ -0,0 +1,210 @@ +#!/bin/sh + +# panic: MNT_DEFERRED requires MNT_RECURSE | MNT_FORCE +# cpuid = 6 +# time = 1766415391 +# KDB: stack backtrace: +# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01003ffaf0 +# vpanic() at vpanic+0x136/frame 0xfffffe01003ffc20 +# panic() at panic+0x43/frame 0xfffffe01003ffc80 +# dounmount() at dounmount+0xa49/frame 0xfffffe01003ffcf0 +# kern_unmount() at kern_unmount+0x30c/frame 0xfffffe01003ffe00 +# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe01003fff30 +# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01003fff30 +# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x8227c1c1a, rsp = 0x8204589e8, rbp = 0x820458a50 --- +# KDB: enter: panic +# [ thread pid 67901 tid 1052310 ] +# Stopped at kdb_enter+0x33: movq $0,0x12132c2(%rip) +# db> x/s version +# version:FreeBSD 16.0-CURRENT #1 vmfqe-n282663-949b0dac6c83: Sun Dec 21 12:59:23 CET 2025 +# [email protected]:/var/tmp/deviant3/sys/amd64/compile/PHO\ + +[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 + +. ../default.cfg +set -u +prog=$(basename "$0" .sh) +cat > /tmp/$prog.c <<EOF +// https://syzkaller.appspot.com/bug?id=e5807bfa71ca13538ae5c94e160b0c959a40750d +// autogenerated by syzkaller (https://github.com/google/syzkaller) +// [email protected] + +#define _GNU_SOURCE + +#include <pwd.h> +#include <setjmp.h> +#include <signal.h> +#include <stdarg.h> +#include <stdbool.h> +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <sys/endian.h> +#include <sys/syscall.h> +#include <unistd.h> + +static __thread int clone_ongoing; +static __thread int skip_segv; +static __thread jmp_buf segv_env; + +static void segv_handler(int sig, siginfo_t* info, void* ctx __unused) +{ + if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { + exit(sig); + } + uintptr_t addr = (uintptr_t)info->si_addr; + const uintptr_t prog_start = 1 << 20; + const uintptr_t prog_end = 100 << 20; + int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; + int valid = addr < prog_start || addr > prog_end; + if (sig == SIGBUS) + valid = 1; + if (skip && valid) { + _longjmp(segv_env, 1); + } + exit(sig); +} + +static void install_segv_handler(void) +{ + struct sigaction sa; + memset(&sa, 0, sizeof(sa)); + sa.sa_sigaction = segv_handler; + sa.sa_flags = SA_NODEFER | SA_SIGINFO; + sigaction(SIGSEGV, &sa, NULL); + sigaction(SIGBUS, &sa, NULL); +} + +#define NONFAILING(...) \ + ({ \ + int ok = 1; \ + __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ + if (_setjmp(segv_env) == 0) { \ + __VA_ARGS__; \ + } else \ + ok = 0; \ + __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ + ok; \ + }) + +uint64_t r[1] = {0xffffffffffffffff}; + +int main(void) +{ + syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, + /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, + /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, + /*fd=*/(intptr_t)-1, /*offset=*/0ul); + const char* reason; + (void)reason; + install_segv_handler(); + intptr_t res = 0; + if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { + } + // openat\$crypto arguments: [ + // fd: const = 0xffffffffffffff9c (8 bytes) + // file: ptr[in, buffer] { + // buffer: {2f 64 65 76 2f 63 72 79 70 74 6f 00} (length 0xc) + // } + // flags: open_flags = 0x200 (8 bytes) + // mode: const = 0x0 (8 bytes) + // ] + // returns fd_crypto + NONFAILING(memcpy((void*)0x200000000040, "/dev/crypto\000", 12)); + res = syscall(SYS_openat, /*fd=*/0xffffffffffffff9cul, + /*file=*/0x200000000040ul, /*flags=O_CREAT*/ 0x200ul, + /*mode=*/0ul); + if (res != -1) + r[0] = res; + // freebsd11_fstatfs arguments: [ + // fd: fd (resource) + // buf: ptr[out, freebsd11_statfs] { + // freebsd11_statfs { + // version: int32 = 0x0 (4 bytes) + // type: int32 = 0x0 (4 bytes) + // flags: mount_flags = 0x0 (8 bytes) + // bsize: int64 = 0x0 (8 bytes) + // iosize: int64 = 0x0 (8 bytes) + // blocks: int64 = 0x0 (8 bytes) + // bfree: int64 = 0x0 (8 bytes) + // bavail: int64 = 0x0 (8 bytes) + // files: int64 = 0x0 (8 bytes) + // ffree: int64 = 0x0 (8 bytes) + // syncwrites: int64 = 0x0 (8 bytes) + // asyncwrites: int64 = 0x0 (8 bytes) + // syncreads: int64 = 0x0 (8 bytes) + // asyncreads: int64 = 0x0 (8 bytes) + // spare: array[int64] { + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // int64 = 0x0 (8 bytes) + // } + // namemax: int32 = 0x0 (4 bytes) + // owner: uid (resource) + // fsid: fsid { + // val: array[int32] { + // int32 = 0x0 (4 bytes) + // int32 = 0x0 (4 bytes) + // } + // } + // cspare: buffer: (DirOut) + // fstype: buffer: (DirOut) + // mnton: buffer: (DirOut) + // mntfrom: buffer: (DirOut) + // } + // } + // ] + syscall(SYS_freebsd11_fstatfs, /*fd=*/r[0], /*buf=*/0x200000000080ul); + // mprotect arguments: [ + // addr: VMA[0x4000] + // len: len = 0x4000 (8 bytes) + // prot: mmap_prot = 0x1 (8 bytes) + // ] + syscall(SYS_mprotect, /*addr=*/0x200000000000ul, /*len=*/0x4000ul, + /*prot=PROT_READ*/ 1ul); + // unmount arguments: [ + // path: ptr[in, buffer] { + // buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8) + // } + // flags: mount_flags = 0xc40006c8 (8 bytes) + // ] + NONFAILING(memcpy((void*)0x200000000200, "./file1\000", 8)); + syscall( + SYS_unmount, /*path=*/0x200000000200ul, + /*flags=MNT_EXPORTANON|MNT_DEFEXPORTED|MNT_EXRDONLY|MNT_MULTILABEL|MNT_NOCLUSTERW|MNT_NOCLUSTERR|MNT_ASYNC|0x8*/ + 0xc40006c8ul); + return 0; +} +EOF +mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 + +(cd ../testcases/swap; ./swap -t 3m -i 30 -l 100 > /dev/null 2>&1) & +sleep 5 + +kldstat | grep -q cryptodev && loaded=0 || { kldload cryptodev.ko && loaded=1; } +work=/tmp/$prog.dir +rm -rf $work +mkdir $work +cd /tmp/$prog.dir +for i in `jot 30`; do + ( + mkdir d$i + cd d$i + timeout 3m /tmp/$prog > /dev/null 2>&1 & + ) +done +while pgrep -q $prog; do sleep 2; done +while pkill swap; do :; done +wait + +rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core $work +[ $loaded -eq 1 ] && kldunload cryptodev.ko +exit 0
