-
-
Save oswalpalash/2a4bdb639c605ec80dbeec220e09603c to your computer and use it in GitHub Desktop.
kernel BUG in fou_build_udp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// autogenerated by syzkaller (https://github.com/google/syzkaller) | |
#define _GNU_SOURCE | |
#include <dirent.h> | |
#include <endian.h> | |
#include <errno.h> | |
#include <fcntl.h> | |
#include <sched.h> | |
#include <signal.h> | |
#include <stdarg.h> | |
#include <stdbool.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <sys/mount.h> | |
#include <sys/prctl.h> | |
#include <sys/resource.h> | |
#include <sys/stat.h> | |
#include <sys/syscall.h> | |
#include <sys/time.h> | |
#include <sys/types.h> | |
#include <sys/wait.h> | |
#include <time.h> | |
#include <unistd.h> | |
#include <linux/capability.h> | |
static void sleep_ms(uint64_t ms) | |
{ | |
usleep(ms * 1000); | |
} | |
static uint64_t current_time_ms(void) | |
{ | |
struct timespec ts; | |
if (clock_gettime(CLOCK_MONOTONIC, &ts)) | |
exit(1); | |
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; | |
} | |
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) | |
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) | |
static bool write_file(const char* file, const char* what, ...) | |
{ | |
char buf[1024]; | |
va_list args; | |
va_start(args, what); | |
vsnprintf(buf, sizeof(buf), what, args); | |
va_end(args); | |
buf[sizeof(buf) - 1] = 0; | |
int len = strlen(buf); | |
int fd = open(file, O_WRONLY | O_CLOEXEC); | |
if (fd == -1) | |
return false; | |
if (write(fd, buf, len) != len) { | |
int err = errno; | |
close(fd); | |
errno = err; | |
return false; | |
} | |
close(fd); | |
return true; | |
} | |
#define MAX_FDS 30 | |
static void setup_common() | |
{ | |
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { | |
} | |
} | |
static void setup_binderfs() | |
{ | |
if (mkdir("/dev/binderfs", 0777)) { | |
} | |
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { | |
} | |
if (symlink("/dev/binderfs", "./binderfs")) { | |
} | |
} | |
static void loop(); | |
static void sandbox_common() | |
{ | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setsid(); | |
struct rlimit rlim; | |
rlim.rlim_cur = rlim.rlim_max = (200 << 20); | |
setrlimit(RLIMIT_AS, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 32 << 20; | |
setrlimit(RLIMIT_MEMLOCK, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 136 << 20; | |
setrlimit(RLIMIT_FSIZE, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 1 << 20; | |
setrlimit(RLIMIT_STACK, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 128 << 20; | |
setrlimit(RLIMIT_CORE, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 256; | |
setrlimit(RLIMIT_NOFILE, &rlim); | |
if (unshare(CLONE_NEWNS)) { | |
} | |
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { | |
} | |
if (unshare(CLONE_NEWIPC)) { | |
} | |
if (unshare(0x02000000)) { | |
} | |
if (unshare(CLONE_NEWUTS)) { | |
} | |
if (unshare(CLONE_SYSVSEM)) { | |
} | |
typedef struct { | |
const char* name; | |
const char* value; | |
} sysctl_t; | |
static const sysctl_t sysctls[] = { | |
{"/proc/sys/kernel/shmmax", "16777216"}, | |
{"/proc/sys/kernel/shmall", "536870912"}, | |
{"/proc/sys/kernel/shmmni", "1024"}, | |
{"/proc/sys/kernel/msgmax", "8192"}, | |
{"/proc/sys/kernel/msgmni", "1024"}, | |
{"/proc/sys/kernel/msgmnb", "1024"}, | |
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, | |
}; | |
unsigned i; | |
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) | |
write_file(sysctls[i].name, sysctls[i].value); | |
} | |
static int wait_for_loop(int pid) | |
{ | |
if (pid < 0) | |
exit(1); | |
int status = 0; | |
while (waitpid(-1, &status, __WALL) != pid) { | |
} | |
return WEXITSTATUS(status); | |
} | |
static void drop_caps(void) | |
{ | |
struct __user_cap_header_struct cap_hdr = {}; | |
struct __user_cap_data_struct cap_data[2] = {}; | |
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; | |
cap_hdr.pid = getpid(); | |
if (syscall(SYS_capget, &cap_hdr, &cap_data)) | |
exit(1); | |
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); | |
cap_data[0].effective &= ~drop; | |
cap_data[0].permitted &= ~drop; | |
cap_data[0].inheritable &= ~drop; | |
if (syscall(SYS_capset, &cap_hdr, &cap_data)) | |
exit(1); | |
} | |
static int do_sandbox_none(void) | |
{ | |
if (unshare(CLONE_NEWPID)) { | |
} | |
int pid = fork(); | |
if (pid != 0) | |
return wait_for_loop(pid); | |
setup_common(); | |
sandbox_common(); | |
drop_caps(); | |
if (unshare(CLONE_NEWNET)) { | |
} | |
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); | |
setup_binderfs(); | |
loop(); | |
exit(1); | |
} | |
static void kill_and_wait(int pid, int* status) | |
{ | |
kill(-pid, SIGKILL); | |
kill(pid, SIGKILL); | |
for (int i = 0; i < 100; i++) { | |
if (waitpid(-1, status, WNOHANG | __WALL) == pid) | |
return; | |
usleep(1000); | |
} | |
DIR* dir = opendir("/sys/fs/fuse/connections"); | |
if (dir) { | |
for (;;) { | |
struct dirent* ent = readdir(dir); | |
if (!ent) | |
break; | |
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) | |
continue; | |
char abort[300]; | |
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); | |
int fd = open(abort, O_WRONLY); | |
if (fd == -1) { | |
continue; | |
} | |
if (write(fd, abort, 1) < 0) { | |
} | |
close(fd); | |
} | |
closedir(dir); | |
} else { | |
} | |
while (waitpid(-1, status, __WALL) != pid) { | |
} | |
} | |
static void setup_test() | |
{ | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setpgrp(); | |
write_file("/proc/self/oom_score_adj", "1000"); | |
} | |
static void close_fds() | |
{ | |
for (int fd = 3; fd < MAX_FDS; fd++) | |
close(fd); | |
} | |
static void execute_one(void); | |
#define WAIT_FLAGS __WALL | |
static void loop(void) | |
{ | |
int iter = 0; | |
for (;; iter++) { | |
int pid = fork(); | |
if (pid < 0) | |
exit(1); | |
if (pid == 0) { | |
setup_test(); | |
execute_one(); | |
close_fds(); | |
exit(0); | |
} | |
int status = 0; | |
uint64_t start = current_time_ms(); | |
for (;;) { | |
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) | |
break; | |
sleep_ms(1); | |
if (current_time_ms() - start < 5000) | |
continue; | |
kill_and_wait(pid, &status); | |
break; | |
} | |
} | |
} | |
uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0}; | |
void execute_one(void) | |
{ | |
intptr_t res = 0; | |
res = syscall(__NR_socket, 0xaul, 2ul, 0); | |
if (res != -1) | |
r[0] = res; | |
res = syscall(__NR_socket, 0x10ul, 3ul, 0); | |
if (res != -1) | |
r[1] = res; | |
res = syscall(__NR_socket, 0x10ul, 0x803ul, 0); | |
if (res != -1) | |
r[2] = res; | |
*(uint64_t*)0x20000380 = 0; | |
*(uint32_t*)0x20000388 = 0; | |
*(uint64_t*)0x20000390 = 0x20000340; | |
*(uint64_t*)0x20000340 = 0; | |
*(uint64_t*)0x20000348 = 0x14; | |
*(uint64_t*)0x20000398 = 1; | |
*(uint64_t*)0x200003a0 = 0; | |
*(uint64_t*)0x200003a8 = 0; | |
*(uint32_t*)0x200003b0 = 0; | |
syscall(__NR_sendmsg, r[2], 0x20000380ul, 0ul); | |
*(uint32_t*)0x200000c0 = 0x14; | |
res = syscall(__NR_getsockname, r[2], 0x20000100ul, 0x200000c0ul); | |
if (res != -1) | |
r[3] = *(uint32_t*)0x20000104; | |
*(uint64_t*)0x20000080 = 0; | |
*(uint32_t*)0x20000088 = 0; | |
*(uint64_t*)0x20000090 = 0x20000500; | |
*(uint64_t*)0x20000500 = 0x20000180; | |
*(uint32_t*)0x20000180 = 0x60; | |
*(uint16_t*)0x20000184 = 0x10; | |
*(uint16_t*)0x20000186 = 0x439; | |
*(uint32_t*)0x20000188 = 0; | |
*(uint32_t*)0x2000018c = 0; | |
*(uint8_t*)0x20000190 = 0; | |
*(uint8_t*)0x20000191 = 0; | |
*(uint16_t*)0x20000192 = 0; | |
*(uint32_t*)0x20000194 = 0; | |
*(uint32_t*)0x20000198 = 0x9801; | |
*(uint32_t*)0x2000019c = 0; | |
*(uint16_t*)0x200001a0 = 0x40; | |
STORE_BY_BITMASK(uint16_t, , 0x200001a2, 0x12, 0, 14); | |
STORE_BY_BITMASK(uint16_t, , 0x200001a3, 0, 6, 1); | |
STORE_BY_BITMASK(uint16_t, , 0x200001a3, 1, 7, 1); | |
*(uint16_t*)0x200001a4 = 8; | |
*(uint16_t*)0x200001a6 = 1; | |
memcpy((void*)0x200001a8, "sit\000", 4); | |
*(uint16_t*)0x200001ac = 0x34; | |
STORE_BY_BITMASK(uint16_t, , 0x200001ae, 2, 0, 14); | |
STORE_BY_BITMASK(uint16_t, , 0x200001af, 0, 6, 1); | |
STORE_BY_BITMASK(uint16_t, , 0x200001af, 1, 7, 1); | |
*(uint16_t*)0x200001b0 = 8; | |
*(uint16_t*)0x200001b2 = 1; | |
*(uint32_t*)0x200001b4 = r[3]; | |
*(uint16_t*)0x200001b8 = 6; | |
*(uint16_t*)0x200001ba = 0xf; | |
*(uint16_t*)0x200001bc = 2; | |
*(uint16_t*)0x200001c0 = 6; | |
*(uint16_t*)0x200001c2 = 0x11; | |
*(uint16_t*)0x200001c4 = htobe16(0x4e21); | |
*(uint16_t*)0x200001c8 = 6; | |
*(uint16_t*)0x200001ca = 0x11; | |
*(uint16_t*)0x200001cc = htobe16(0x4e24); | |
*(uint16_t*)0x200001d0 = 8; | |
*(uint16_t*)0x200001d2 = 2; | |
*(uint8_t*)0x200001d4 = 0xac; | |
*(uint8_t*)0x200001d5 = 0x14; | |
*(uint8_t*)0x200001d6 = 0x14; | |
*(uint8_t*)0x200001d7 = 0x16; | |
*(uint16_t*)0x200001d8 = 6; | |
*(uint16_t*)0x200001da = 0x10; | |
*(uint16_t*)0x200001dc = 0xfff; | |
*(uint64_t*)0x20000508 = 0x60; | |
*(uint64_t*)0x20000098 = 1; | |
*(uint64_t*)0x200000a0 = 0; | |
*(uint64_t*)0x200000a8 = 0; | |
*(uint32_t*)0x200000b0 = 0; | |
syscall(__NR_sendmsg, r[1], 0x20000080ul, 0x20048894ul); | |
*(uint64_t*)0x200017c0 = 0x20000040; | |
*(uint16_t*)0x20000040 = 2; | |
*(uint16_t*)0x20000042 = htobe16(0x4e20); | |
*(uint32_t*)0x20000044 = htobe32(0xe0000001); | |
*(uint32_t*)0x200017c8 = 0x10; | |
*(uint64_t*)0x200017d0 = 0; | |
*(uint64_t*)0x200017d8 = 0; | |
*(uint64_t*)0x200017e0 = 0x20000000; | |
*(uint64_t*)0x20000000 = 0x1c; | |
*(uint32_t*)0x20000008 = 0; | |
*(uint32_t*)0x2000000c = 8; | |
*(uint32_t*)0x20000010 = r[3]; | |
*(uint32_t*)0x20000014 = htobe32(0); | |
*(uint8_t*)0x20000018 = 0xac; | |
*(uint8_t*)0x20000019 = 0x14; | |
*(uint8_t*)0x2000001a = 0x14; | |
*(uint8_t*)0x2000001b = 0xbb; | |
*(uint64_t*)0x200017e8 = 0x20; | |
*(uint32_t*)0x200017f0 = 0; | |
*(uint32_t*)0x200017f8 = 0; | |
syscall(__NR_sendmmsg, r[0], 0x200017c0ul, 1ul, 0ul); | |
} | |
int main(void) | |
{ | |
syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); | |
syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); | |
syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); | |
do_sandbox_none(); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment