-
-
Save oswalpalash/238a9956cee11f61449fc9a1f33da8c5 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#define _GNU_SOURCE | |
#include <dirent.h> | |
#include <endian.h> | |
#include <errno.h> | |
#include <fcntl.h> | |
#include <signal.h> | |
#include <stdarg.h> | |
#include <stdbool.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <sys/mman.h> | |
#include <sys/prctl.h> | |
#include <sys/stat.h> | |
#include <sys/syscall.h> | |
#include <sys/types.h> | |
#include <sys/wait.h> | |
#include <time.h> | |
#include <unistd.h> | |
static unsigned long long procid; | |
static void sleep_ms(uint64_t ms) | |
{ | |
usleep(ms * 1000); | |
} | |
static uint64_t current_time_ms(void) | |
{ | |
struct timespec ts; | |
if (clock_gettime(CLOCK_MONOTONIC, &ts)) | |
exit(1); | |
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; | |
} | |
static bool write_file(const char* file, const char* what, ...) | |
{ | |
char buf[1024]; | |
va_list args; | |
va_start(args, what); | |
vsnprintf(buf, sizeof(buf), what, args); | |
va_end(args); | |
buf[sizeof(buf) - 1] = 0; | |
int len = strlen(buf); | |
int fd = open(file, O_WRONLY | O_CLOEXEC); | |
if (fd == -1) | |
return false; | |
if (write(fd, buf, len) != len) { | |
int err = errno; | |
close(fd); | |
errno = err; | |
return false; | |
} | |
close(fd); | |
return true; | |
} | |
#define SIZEOF_IO_URING_SQE 64 | |
#define SIZEOF_IO_URING_CQE 16 | |
#define SQ_HEAD_OFFSET 0 | |
#define SQ_TAIL_OFFSET 64 | |
#define SQ_RING_MASK_OFFSET 256 | |
#define SQ_RING_ENTRIES_OFFSET 264 | |
#define SQ_FLAGS_OFFSET 276 | |
#define SQ_DROPPED_OFFSET 272 | |
#define CQ_HEAD_OFFSET 128 | |
#define CQ_TAIL_OFFSET 192 | |
#define CQ_RING_MASK_OFFSET 260 | |
#define CQ_RING_ENTRIES_OFFSET 268 | |
#define CQ_RING_OVERFLOW_OFFSET 284 | |
#define CQ_FLAGS_OFFSET 280 | |
#define CQ_CQES_OFFSET 320 | |
struct io_sqring_offsets { | |
uint32_t head; | |
uint32_t tail; | |
uint32_t ring_mask; | |
uint32_t ring_entries; | |
uint32_t flags; | |
uint32_t dropped; | |
uint32_t array; | |
uint32_t resv1; | |
uint64_t resv2; | |
}; | |
struct io_cqring_offsets { | |
uint32_t head; | |
uint32_t tail; | |
uint32_t ring_mask; | |
uint32_t ring_entries; | |
uint32_t overflow; | |
uint32_t cqes; | |
uint64_t resv[2]; | |
}; | |
struct io_uring_params { | |
uint32_t sq_entries; | |
uint32_t cq_entries; | |
uint32_t flags; | |
uint32_t sq_thread_cpu; | |
uint32_t sq_thread_idle; | |
uint32_t features; | |
uint32_t resv[4]; | |
struct io_sqring_offsets sq_off; | |
struct io_cqring_offsets cq_off; | |
}; | |
#define IORING_OFF_SQ_RING 0 | |
#define IORING_OFF_SQES 0x10000000ULL | |
#define sys_io_uring_setup 425 | |
static long syz_io_uring_setup(volatile long a0, volatile long a1, | |
volatile long a2, volatile long a3, | |
volatile long a4, volatile long a5) | |
{ | |
uint32_t entries = (uint32_t)a0; | |
struct io_uring_params* setup_params = (struct io_uring_params*)a1; | |
void* vma1 = (void*)a2; | |
void* vma2 = (void*)a3; | |
void** ring_ptr_out = (void**)a4; | |
void** sqes_ptr_out = (void**)a5; | |
uint32_t fd_io_uring = syscall(sys_io_uring_setup, entries, setup_params); | |
uint32_t sq_ring_sz = | |
setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t); | |
uint32_t cq_ring_sz = setup_params->cq_off.cqes + | |
setup_params->cq_entries * SIZEOF_IO_URING_CQE; | |
uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz; | |
*ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE, | |
MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, | |
IORING_OFF_SQ_RING); | |
uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE; | |
*sqes_ptr_out = | |
mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE, | |
MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES); | |
return fd_io_uring; | |
} | |
static long syz_io_uring_submit(volatile long a0, volatile long a1, | |
volatile long a2, volatile long a3) | |
{ | |
char* ring_ptr = (char*)a0; | |
char* sqes_ptr = (char*)a1; | |
char* sqe = (char*)a2; | |
uint32_t sqes_index = (uint32_t)a3; | |
uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET); | |
uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET); | |
uint32_t sq_array_off = | |
(CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63; | |
if (sq_ring_entries) | |
sqes_index %= sq_ring_entries; | |
char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE; | |
memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE); | |
uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET); | |
uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET); | |
uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask; | |
uint32_t sq_tail_next = *sq_tail_ptr + 1; | |
uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off); | |
*(sq_array + sq_tail) = sqes_index; | |
__atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE); | |
return 0; | |
} | |
static long syz_memcpy_off(volatile long a0, volatile long a1, volatile long a2, | |
volatile long a3, volatile long a4) | |
{ | |
char* dest = (char*)a0; | |
uint32_t dest_off = (uint32_t)a1; | |
char* src = (char*)a2; | |
uint32_t src_off = (uint32_t)a3; | |
size_t n = (size_t)a4; | |
return (long)memcpy(dest + dest_off, src + src_off, n); | |
} | |
static void kill_and_wait(int pid, int* status) | |
{ | |
kill(-pid, SIGKILL); | |
kill(pid, SIGKILL); | |
for (int i = 0; i < 100; i++) { | |
if (waitpid(-1, status, WNOHANG | __WALL) == pid) | |
return; | |
usleep(1000); | |
} | |
DIR* dir = opendir("/sys/fs/fuse/connections"); | |
if (dir) { | |
for (;;) { | |
struct dirent* ent = readdir(dir); | |
if (!ent) | |
break; | |
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) | |
continue; | |
char abort[300]; | |
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", | |
ent->d_name); | |
int fd = open(abort, O_WRONLY); | |
if (fd == -1) { | |
continue; | |
} | |
if (write(fd, abort, 1) < 0) { | |
} | |
close(fd); | |
} | |
closedir(dir); | |
} else { | |
} | |
while (waitpid(-1, status, __WALL) != pid) { | |
} | |
} | |
static void setup_test() | |
{ | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setpgrp(); | |
write_file("/proc/self/oom_score_adj", "1000"); | |
} | |
static void execute_one(void); | |
#define WAIT_FLAGS __WALL | |
static void loop(void) | |
{ | |
int iter = 0; | |
for (;; iter++) { | |
int pid = fork(); | |
if (pid < 0) | |
exit(1); | |
if (pid == 0) { | |
setup_test(); | |
execute_one(); | |
exit(0); | |
} | |
int status = 0; | |
uint64_t start = current_time_ms(); | |
for (;;) { | |
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) | |
break; | |
sleep_ms(1); | |
if (current_time_ms() - start < 5000) { | |
continue; | |
} | |
kill_and_wait(pid, &status); | |
break; | |
} | |
} | |
} | |
#ifndef __NR_io_uring_enter | |
#define __NR_io_uring_enter 426 | |
#endif | |
uint64_t r[3] = {0xffffffffffffffff, 0x0, 0x0}; | |
void execute_one(void) | |
{ | |
intptr_t res = 0; | |
*(uint32_t*)0x20000084 = 0; | |
*(uint32_t*)0x20000088 = 0; | |
*(uint32_t*)0x2000008c = 0; | |
*(uint32_t*)0x20000090 = 0; | |
*(uint32_t*)0x20000098 = 0; | |
*(uint32_t*)0x2000009c = 0; | |
*(uint32_t*)0x200000a0 = 0; | |
*(uint32_t*)0x200000a4 = 0; | |
res = -1; | |
res = syz_io_uring_setup(1, 0x20000080, 0x200a0000, 0x200b0000, 0x20000100, | |
0x20000140); | |
if (res != -1) { | |
r[0] = res; | |
r[1] = *(uint64_t*)0x20000100; | |
r[2] = *(uint64_t*)0x20000140; | |
} | |
*(uint8_t*)0x200001c0 = 0x1c; | |
*(uint8_t*)0x200001c1 = 0; | |
*(uint16_t*)0x200001c2 = 0; | |
*(uint32_t*)0x200001c4 = 0xffffff9c; | |
*(uint64_t*)0x200001c8 = 0; | |
*(uint64_t*)0x200001d0 = 0; | |
*(uint32_t*)0x200001d8 = 0; | |
*(uint32_t*)0x200001dc = 0; | |
*(uint64_t*)0x200001e0 = 0x12345; | |
*(uint16_t*)0x200001e8 = 0; | |
*(uint16_t*)0x200001ea = 0; | |
*(uint8_t*)0x200001ec = 0; | |
*(uint8_t*)0x200001ed = 0; | |
*(uint8_t*)0x200001ee = 0; | |
*(uint8_t*)0x200001ef = 0; | |
*(uint8_t*)0x200001f0 = 0; | |
*(uint8_t*)0x200001f1 = 0; | |
*(uint8_t*)0x200001f2 = 0; | |
*(uint8_t*)0x200001f3 = 0; | |
*(uint8_t*)0x200001f4 = 0; | |
*(uint8_t*)0x200001f5 = 0; | |
*(uint8_t*)0x200001f6 = 0; | |
*(uint8_t*)0x200001f7 = 0; | |
*(uint8_t*)0x200001f8 = 0; | |
*(uint8_t*)0x200001f9 = 0; | |
*(uint8_t*)0x200001fa = 0; | |
*(uint8_t*)0x200001fb = 0; | |
*(uint8_t*)0x200001fc = 0; | |
*(uint8_t*)0x200001fd = 0; | |
*(uint8_t*)0x200001fe = 0; | |
*(uint8_t*)0x200001ff = 0; | |
syz_io_uring_submit(r[1], r[2], 0x200001c0, 0); | |
*(uint32_t*)0x20000000 = 0; | |
syz_memcpy_off(r[1], 0x10c, 0x20000000, 0, 4); | |
syscall(__NR_io_uring_enter, r[0], 1, 1, 1ul, 0ul, 0ul); | |
} | |
int main(void) | |
{ | |
syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); | |
syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); | |
syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); | |
for (procid = 0; procid < 8; procid++) { | |
if (fork() == 0) { | |
loop(); | |
} | |
} | |
sleep(1000000); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment