On 06/12, Thomas Gleixner wrote:
>On Fri, 9 Jun 2017, kernel test robot wrote:
>>
>> FYI, we noticed the following commit:
>>
>> commit: 91d57bae08689199c8acc77a8b3b41150cafab1c ("posix-timers: Make use of
>> forward/remaining callbacks")
>> https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
>>
>> in testcase: syzkaller
>> with following parameters:
>>
>> cpufreq_governor: performance
>> repro_program: repro-d1aff78d.exe
>
>Sigh. I have no clue what repro-d1aff78d.exe is. Could you please provide
>the source for this?
Oops, forgot to add the source code. Please check the attachment.
It is generated by syzkaller.
Thanks,
Xiaolong
>
>Thanks,
>
> tglx
>
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#ifndef __NR_mmap
#define __NR_mmap 9
#endif
#ifndef __NR_timer_create
#define __NR_timer_create 222
#endif
#ifndef __NR_clock_gettime
#define __NR_clock_gettime 228
#endif
#ifndef __NR_timer_settime
#define __NR_timer_settime 223
#endif
#ifndef __NR_timer_gettime
#define __NR_timer_gettime 224
#endif
#define _GNU_SOURCE
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <linux/capability.h>
#include <linux/if.h>
#include <linux/if_tun.h>
#include <linux/kvm.h>
#include <linux/sched.h>
#include <net/if_arp.h>
#include <assert.h>
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
const int kFailStatus = 67;
const int kErrorStatus = 68;
const int kRetryStatus = 69;
__attribute__((noreturn)) void doexit(int status)
{
volatile unsigned i;
syscall(__NR_exit_group, status);
for (i = 0;; i++) {
}
}
__attribute__((noreturn)) void fail(const char* msg, ...)
{
int e = errno;
fflush(stdout);
va_list args;
va_start(args, msg);
vfprintf(stderr, msg, args);
va_end(args);
fprintf(stderr, " (errno %d)\n", e);
doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}
__attribute__((noreturn)) void exitf(const char* msg, ...)
{
int e = errno;
fflush(stdout);
va_list args;
va_start(args, msg);
vfprintf(stderr, msg, args);
va_end(args);
fprintf(stderr, " (errno %d)\n", e);
doexit(kRetryStatus);
}
static int flag_debug;
void debug(const char* msg, ...)
{
if (!flag_debug)
return;
va_list args;
va_start(args, msg);
vfprintf(stdout, msg, args);
va_end(args);
fflush(stdout);
}
__thread int skip_segv;
__thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* uctx)
{
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) {
debug("SIGSEGV on %p, skipping\n", addr);
_longjmp(segv_env, 1);
}
debug("SIGSEGV on %p, exiting\n", addr);
doexit(sig);
for (;;) {
}
}
static void install_segv_handler()
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) { __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); if (_setjmp(segv_env) == 0) { __VA_ARGS__; } __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); }
#define BITMASK_LEN(type,bf_len) (type)((1ull << (bf_len)) - 1)
#define BITMASK_LEN_OFF(type,bf_off,bf_len) (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))
#define STORE_BY_BITMASK(type,addr,val,bf_off,bf_len) if ((bf_off) == 0 && (bf_len) == 0) { *(type*)(addr) = (type)(val); } else { type new_val = *(type*)(addr); new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); *(type*)(addr) = new_val; }
static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8)
{
switch (nr) {
default:
return syscall(nr, a0, a1, a2, a3, a4, a5);
}
}
static void setup_main_process()
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_handler = SIG_IGN;
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
install_segv_handler();
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
fail("failed to mkdtemp");
if (chmod(tmpdir, 0777))
fail("failed to chmod");
if (chdir(tmpdir))
fail("failed to chdir");
}
static void loop();
static void sandbox_common()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
setsid();
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
unshare(CLONE_NEWNS);
unshare(CLONE_NEWIPC);
unshare(CLONE_IO);
}
static int do_sandbox_none(int executor_pid, bool enable_tun)
{
int pid = fork();
if (pid)
return pid;
sandbox_common();
loop();
doexit(1);
}
long r[23];
void loop()
{
memset(r, -1, sizeof(r));
r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0x6000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0);
NONFAILING(*(uint64_t*)0x20001fb0 = (uint64_t)0x0);
NONFAILING(*(uint32_t*)0x20001fb8 = (uint32_t)0x1);
NONFAILING(*(uint32_t*)0x20001fbc = (uint32_t)0x0);
NONFAILING(*(uint64_t*)0x20001fc0 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20001fc8 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20001fd0 = (uint64_t)0x4);
NONFAILING(*(uint64_t*)0x20001fd8 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20001fe0 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20001fe8 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20001ff0 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20001ff8 = (uint64_t)0x0);
r[12] = execute_syscall(__NR_timer_create, 0x0ul, 0x20001fb0ul, 0x20000ffcul, 0, 0, 0, 0, 0, 0);
if (r[12] != -1)
NONFAILING(r[13] = *(uint32_t*)0x20000ffc);
r[14] = execute_syscall(__NR_clock_gettime, 0x4ul, 0x20002ff0ul, 0, 0, 0, 0, 0, 0, 0);
if (r[14] != -1)
NONFAILING(r[15] = *(uint64_t*)0x20002ff0);
if (r[14] != -1)
NONFAILING(r[16] = *(uint64_t*)0x20002ff8);
NONFAILING(*(uint64_t*)0x20003fe0 = (uint64_t)0x77359400);
NONFAILING(*(uint64_t*)0x20003fe8 = (uint64_t)0x0);
NONFAILING(*(uint64_t*)0x20003ff0 = r[15]);
NONFAILING(*(uint64_t*)0x20003ff8 = r[16]+10000000);
r[21] = execute_syscall(__NR_timer_settime, r[13], 0x0ul, 0x20003fe0ul, 0x0ul, 0, 0, 0, 0, 0);
r[22] = execute_syscall(__NR_timer_gettime, r[13], 0x20003000ul, 0, 0, 0, 0, 0, 0, 0);
}
int main()
{
setup_main_process();
int pid = do_sandbox_none(0, false);
int status = 0;
while (waitpid(pid, &status, __WALL) != pid) {}
return 0;
}
