-
-
Save xrivendell7/93aebd97f6d43b735e45a66e8650c2ad to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN | |
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] | |
CPU: 3 PID: 19805 Comm: syz-executor.2 Not tainted 6.7.0-rc4-00141-g1ae4cd3cbdd0-dirty #5 | |
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 | |
RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] | |
RIP: 0010:dccp_write_xmit+0x74/0x240 net/dccp/output.c:356 | |
Code: 03 48 89 44 24 08 4c 89 2c 24 48 8b 44 24 08 80 3c 28 00 74 08 48 89 df e8 79 dc a7 f7 49 89 df 48 8b 1b 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 5e dc a7 f7 48 8b 1b b8 b0 00 00 00 | |
RSP: 0018:ffffc900061e7758 EFLAGS: 00010246 | |
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881045ad400 | |
RDX: ffffffff8a494702 RSI: 0000000000000000 RDI: 0000000000000001 | |
RBP: dffffc0000000000 R08: 0000000000000cf5 R09: 0000000000000cf6 | |
R10: dffffc0000000000 R11: fffffbfff2169e87 R12: ffff8881045ad400 | |
R13: ffff88810629c080 R14: ffff88810629c9d0 R15: ffff88810629c970 | |
FS: 00007f2a1785f6c0(0000) GS:ffff888135d00000(0000) knlGS:0000000000000000 | |
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | |
CR2: 00007f51c5d9ad58 CR3: 000000001f1dc000 CR4: 0000000000350ef0 | |
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | |
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 | |
Call Trace: | |
<TASK> | |
dccp_sendmsg+0x784/0xba0 net/dccp/proto.c:801 | |
sock_sendmsg_nosec net/socket.c:730 [inline] | |
__sock_sendmsg net/socket.c:745 [inline] | |
____sys_sendmsg+0x5aa/0x8b0 net/socket.c:2584 | |
___sys_sendmsg net/socket.c:2638 [inline] | |
__sys_sendmmsg+0x3c1/0x760 net/socket.c:2724 | |
__do_sys_sendmmsg net/socket.c:2753 [inline] | |
__se_sys_sendmmsg net/socket.c:2750 [inline] | |
__x64_sys_sendmmsg+0xa5/0xc0 net/socket.c:2750 | |
do_syscall_x64 arch/x86/entry/common.c:52 [inline] | |
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 | |
entry_SYSCALL_64_after_hwframe+0x63/0x6b | |
RIP: 0033:0x7f2a16a7cb29 | |
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 | |
RSP: 002b:00007f2a1785f0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 | |
RAX: ffffffffffffffda RBX: 00007f2a16b9c1f0 RCX: 00007f2a16a7cb29 | |
RDX: 0000000000000001 RSI: 0000000020000200 RDI: 0000000000000007 | |
RBP: 00007f2a16ac847a R08: 0000000000000000 R09: 0000000000000000 | |
R10: 0000000000048000 R11: 0000000000000246 R12: 0000000000000000 | |
R13: 000000000000006e R14: 00007f2a16b9c1f0 R15: 00007ffd3c4d9b98 | |
</TASK> | |
Modules linked in: | |
---[ end trace 0000000000000000 ]--- | |
RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline] | |
RIP: 0010:dccp_write_xmit+0x74/0x240 net/dccp/output.c:356 | |
Code: 03 48 89 44 24 08 4c 89 2c 24 48 8b 44 24 08 80 3c 28 00 74 08 48 89 df e8 79 dc a7 f7 49 89 df 48 8b 1b 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 5e dc a7 f7 48 8b 1b b8 b0 00 00 00 | |
RSP: 0018:ffffc900061e7758 EFLAGS: 00010246 | |
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881045ad400 | |
RDX: ffffffff8a494702 RSI: 0000000000000000 RDI: 0000000000000001 | |
RBP: dffffc0000000000 R08: 0000000000000cf5 R09: 0000000000000cf6 | |
R10: dffffc0000000000 R11: fffffbfff2169e87 R12: ffff8881045ad400 | |
R13: ffff88810629c080 R14: ffff88810629c9d0 R15: ffff88810629c970 | |
FS: 00007f2a1785f6c0(0000) GS:ffff888135d00000(0000) knlGS:0000000000000000 | |
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | |
CR2: 00007f51c5d9ad58 CR3: 000000001f1dc000 CR4: 0000000000350ef0 | |
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 | |
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 | |
---------------- | |
Code disassembly (best guess): | |
0: 03 48 89 add -0x77(%rax),%ecx | |
3: 44 24 08 rex.R and $0x8,%al | |
6: 4c 89 2c 24 mov %r13,(%rsp) | |
a: 48 8b 44 24 08 mov 0x8(%rsp),%rax | |
f: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) | |
13: 74 08 je 0x1d | |
15: 48 89 df mov %rbx,%rdi | |
18: e8 79 dc a7 f7 call 0xf7a7dc96 | |
1d: 49 89 df mov %rbx,%r15 | |
20: 48 8b 1b mov (%rbx),%rbx | |
23: 48 89 d8 mov %rbx,%rax | |
26: 48 c1 e8 03 shr $0x3,%rax | |
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction | |
2e: 74 08 je 0x38 | |
30: 48 89 df mov %rbx,%rdi | |
33: e8 5e dc a7 f7 call 0xf7a7dc96 | |
38: 48 8b 1b mov (%rbx),%rbx | |
3b: b8 b0 00 00 00 mov $0xb0,%eax |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// autogenerated by syzkaller (https://github.com/google/syzkaller) | |
#define _GNU_SOURCE | |
#include <dirent.h> | |
#include <endian.h> | |
#include <errno.h> | |
#include <fcntl.h> | |
#include <linux/futex.h> | |
#include <pthread.h> | |
#include <signal.h> | |
#include <stdarg.h> | |
#include <stdbool.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <sys/prctl.h> | |
#include <sys/stat.h> | |
#include <sys/syscall.h> | |
#include <sys/types.h> | |
#include <sys/wait.h> | |
#include <time.h> | |
#include <unistd.h> | |
static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } | |
static uint64_t current_time_ms(void) { | |
struct timespec ts; | |
if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); | |
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; | |
} | |
static void thread_start(void* (*fn)(void*), void* arg) { | |
pthread_t th; | |
pthread_attr_t attr; | |
pthread_attr_init(&attr); | |
pthread_attr_setstacksize(&attr, 128 << 10); | |
int i = 0; | |
for (; i < 100; i++) { | |
if (pthread_create(&th, &attr, fn, arg) == 0) { | |
pthread_attr_destroy(&attr); | |
return; | |
} | |
if (errno == EAGAIN) { | |
usleep(50); | |
continue; | |
} | |
break; | |
} | |
exit(1); | |
} | |
typedef struct { | |
int state; | |
} event_t; | |
static void event_init(event_t* ev) { ev->state = 0; } | |
static void event_reset(event_t* ev) { ev->state = 0; } | |
static void event_set(event_t* ev) { | |
if (ev->state) exit(1); | |
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); | |
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000); | |
} | |
static void event_wait(event_t* ev) { | |
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) | |
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); | |
} | |
static int event_isset(event_t* ev) { | |
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); | |
} | |
static int event_timedwait(event_t* ev, uint64_t timeout) { | |
uint64_t start = current_time_ms(); | |
uint64_t now = start; | |
for (;;) { | |
uint64_t remain = timeout - (now - start); | |
struct timespec ts; | |
ts.tv_sec = remain / 1000; | |
ts.tv_nsec = (remain % 1000) * 1000 * 1000; | |
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); | |
if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) return 1; | |
now = current_time_ms(); | |
if (now - start > timeout) return 0; | |
} | |
} | |
static bool write_file(const char* file, const char* what, ...) { | |
char buf[1024]; | |
va_list args; | |
va_start(args, what); | |
vsnprintf(buf, sizeof(buf), what, args); | |
va_end(args); | |
buf[sizeof(buf) - 1] = 0; | |
int len = strlen(buf); | |
int fd = open(file, O_WRONLY | O_CLOEXEC); | |
if (fd == -1) return false; | |
if (write(fd, buf, len) != len) { | |
int err = errno; | |
close(fd); | |
errno = err; | |
return false; | |
} | |
close(fd); | |
return true; | |
} | |
static void kill_and_wait(int pid, int* status) { | |
kill(-pid, SIGKILL); | |
kill(pid, SIGKILL); | |
for (int i = 0; i < 100; i++) { | |
if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; | |
usleep(1000); | |
} | |
DIR* dir = opendir("/sys/fs/fuse/connections"); | |
if (dir) { | |
for (;;) { | |
struct dirent* ent = readdir(dir); | |
if (!ent) break; | |
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) | |
continue; | |
char abort[300]; | |
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", | |
ent->d_name); | |
int fd = open(abort, O_WRONLY); | |
if (fd == -1) { | |
continue; | |
} | |
if (write(fd, abort, 1) < 0) { | |
} | |
close(fd); | |
} | |
closedir(dir); | |
} else { | |
} | |
while (waitpid(-1, status, __WALL) != pid) { | |
} | |
} | |
static void setup_test() { | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setpgrp(); | |
write_file("/proc/self/oom_score_adj", "1000"); | |
} | |
struct thread_t { | |
int created, call; | |
event_t ready, done; | |
}; | |
static struct thread_t threads[16]; | |
static void execute_call(int call); | |
static int running; | |
static void* thr(void* arg) { | |
struct thread_t* th = (struct thread_t*)arg; | |
for (;;) { | |
event_wait(&th->ready); | |
event_reset(&th->ready); | |
execute_call(th->call); | |
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); | |
event_set(&th->done); | |
} | |
return 0; | |
} | |
static void execute_one(void) { | |
int i, call, thread; | |
for (call = 0; call < 10; call++) { | |
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); | |
thread++) { | |
struct thread_t* th = &threads[thread]; | |
if (!th->created) { | |
th->created = 1; | |
event_init(&th->ready); | |
event_init(&th->done); | |
event_set(&th->done); | |
thread_start(thr, th); | |
} | |
if (!event_isset(&th->done)) continue; | |
event_reset(&th->done); | |
th->call = call; | |
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); | |
event_set(&th->ready); | |
event_timedwait(&th->done, 50); | |
break; | |
} | |
} | |
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) | |
sleep_ms(1); | |
} | |
static void execute_one(void); | |
#define WAIT_FLAGS __WALL | |
static void loop(void) { | |
int iter = 0; | |
for (;; iter++) { | |
int pid = fork(); | |
if (pid < 0) exit(1); | |
if (pid == 0) { | |
setup_test(); | |
execute_one(); | |
exit(0); | |
} | |
int status = 0; | |
uint64_t start = current_time_ms(); | |
for (;;) { | |
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; | |
sleep_ms(1); | |
if (current_time_ms() - start < 5000) continue; | |
kill_and_wait(pid, &status); | |
break; | |
} | |
} | |
} | |
uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0, | |
0xffffffffffffffff, 0xffffffffffffffff}; | |
void execute_call(int call) { | |
intptr_t res = 0; | |
switch (call) { | |
case 0: | |
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/0x803ul, | |
/*proto=*/0); | |
if (res != -1) r[0] = res; | |
break; | |
case 1: | |
res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/1ul, /*proto=*/0); | |
if (res != -1) r[1] = res; | |
break; | |
case 2: | |
memcpy((void*)0x200001c0, | |
"wg1\000\000\000\000\000\000\000\000\000\000\000\000\000", 16); | |
res = syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x8933, | |
/*arg=*/0x200001c0ul); | |
if (res != -1) r[2] = *(uint32_t*)0x200001d0; | |
break; | |
case 3: | |
*(uint64_t*)0x20000340 = 0; | |
*(uint32_t*)0x20000348 = 0; | |
*(uint64_t*)0x20000350 = 0x20002840; | |
*(uint64_t*)0x20002840 = 0x20000080; | |
*(uint32_t*)0x20000080 = 0x2c; | |
*(uint16_t*)0x20000084 = 0x14; | |
*(uint16_t*)0x20000086 = 1; | |
*(uint32_t*)0x20000088 = 0; | |
*(uint32_t*)0x2000008c = 0; | |
*(uint8_t*)0x20000090 = 0xa; | |
*(uint8_t*)0x20000091 = 0; | |
*(uint8_t*)0x20000092 = 0; | |
*(uint8_t*)0x20000093 = 0; | |
*(uint32_t*)0x20000094 = r[2]; | |
*(uint16_t*)0x20000098 = 0x14; | |
*(uint16_t*)0x2000009a = 2; | |
*(uint8_t*)0x2000009c = 0xfe; | |
*(uint8_t*)0x2000009d = 0x80; | |
memset((void*)0x2000009e, 0, 13); | |
*(uint8_t*)0x200000ab = 0xbb; | |
*(uint64_t*)0x20002848 = 0x2c; | |
*(uint64_t*)0x20000358 = 1; | |
*(uint64_t*)0x20000360 = 0; | |
*(uint64_t*)0x20000368 = 0; | |
*(uint32_t*)0x20000370 = 0; | |
syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x20000340ul, /*f=*/0ul); | |
break; | |
case 4: | |
res = syscall(__NR_socket, /*domain=*/0xaul, /*type=*/6ul, /*proto=*/0); | |
if (res != -1) r[3] = res; | |
break; | |
case 5: | |
*(uint16_t*)0x20000000 = 0xa; | |
*(uint16_t*)0x20000002 = htobe16(0); | |
*(uint32_t*)0x20000004 = htobe32(0); | |
*(uint64_t*)0x20000008 = htobe64(0); | |
*(uint64_t*)0x20000010 = htobe64(0xa0211fffe000000); | |
*(uint32_t*)0x20000018 = 0; | |
syscall(__NR_connect, /*fd=*/r[3], /*addr=*/0x20000000ul, | |
/*addrlen=*/0x1cul); | |
break; | |
case 6: | |
res = syscall(__NR_dup, /*oldfd=*/r[3]); | |
if (res != -1) r[4] = res; | |
break; | |
case 7: | |
*(uint64_t*)0x20000200 = 0; | |
*(uint32_t*)0x20000208 = 0; | |
*(uint64_t*)0x20000210 = 0; | |
*(uint64_t*)0x20000218 = 0; | |
*(uint64_t*)0x20000220 = 0; | |
*(uint64_t*)0x20000228 = 0; | |
*(uint32_t*)0x20000230 = 0; | |
*(uint32_t*)0x20000238 = 0; | |
syscall(__NR_sendmmsg, /*fd=*/r[4], /*mmsg=*/0x20000200ul, /*vlen=*/1ul, | |
/*f=*/0x48000ul); | |
break; | |
case 8: | |
syscall(__NR_shutdown, /*fd=*/r[3], /*how=*/0ul); | |
break; | |
case 9: | |
*(uint16_t*)0x20000000 = 0xa; | |
*(uint16_t*)0x20000002 = htobe16(0); | |
*(uint32_t*)0x20000004 = htobe32(0); | |
*(uint64_t*)0x20000008 = htobe64(0); | |
*(uint64_t*)0x20000010 = htobe64(0xa0211fffe000000); | |
*(uint32_t*)0x20000018 = 0; | |
syscall(__NR_connect, /*fd=*/r[3], /*addr=*/0x20000000ul, | |
/*addrlen=*/0x1cul); | |
break; | |
} | |
} | |
int main(void) { | |
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
loop(); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
r0 = socket(0x10, 0x803, 0x0) | |
r1 = socket$inet6(0xa, 0x1, 0x0) | |
ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000001c0)={'wg1\x00', <r2=>0x0}) | |
sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000002840)={&(0x7f0000000080)=@ipv6_newaddr={0x2c, 0x14, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @remote}]}, 0x2c}}, 0x0) | |
r3 = socket$inet6(0xa, 0x6, 0x0) | |
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0x0, 0xa0211fffe000000}}, 0x1c) | |
r4 = dup(r3) | |
sendmmsg$inet6(r4, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}], 0x1, 0x48000) | |
shutdown(r3, 0x0) | |
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0x0, 0xa0211fffe000000}}, 0x1c) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment