-
-
Save xrivendell7/bad992c2b716ed14310efa2c6f878b7c to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// autogenerated by syzkaller (https://github.com/google/syzkaller) | |
#define _GNU_SOURCE | |
#include <dirent.h> | |
#include <endian.h> | |
#include <errno.h> | |
#include <fcntl.h> | |
#include <signal.h> | |
#include <stdarg.h> | |
#include <stdbool.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <sys/prctl.h> | |
#include <sys/stat.h> | |
#include <sys/syscall.h> | |
#include <sys/types.h> | |
#include <sys/wait.h> | |
#include <time.h> | |
#include <unistd.h> | |
static unsigned long long procid; | |
static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } | |
static uint64_t current_time_ms(void) { | |
struct timespec ts; | |
if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); | |
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; | |
} | |
static bool write_file(const char* file, const char* what, ...) { | |
char buf[1024]; | |
va_list args; | |
va_start(args, what); | |
vsnprintf(buf, sizeof(buf), what, args); | |
va_end(args); | |
buf[sizeof(buf) - 1] = 0; | |
int len = strlen(buf); | |
int fd = open(file, O_WRONLY | O_CLOEXEC); | |
if (fd == -1) return false; | |
if (write(fd, buf, len) != len) { | |
int err = errno; | |
close(fd); | |
errno = err; | |
return false; | |
} | |
close(fd); | |
return true; | |
} | |
static void kill_and_wait(int pid, int* status) { | |
kill(-pid, SIGKILL); | |
kill(pid, SIGKILL); | |
for (int i = 0; i < 100; i++) { | |
if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; | |
usleep(1000); | |
} | |
DIR* dir = opendir("/sys/fs/fuse/connections"); | |
if (dir) { | |
for (;;) { | |
struct dirent* ent = readdir(dir); | |
if (!ent) break; | |
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) | |
continue; | |
char abort[300]; | |
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", | |
ent->d_name); | |
int fd = open(abort, O_WRONLY); | |
if (fd == -1) { | |
continue; | |
} | |
if (write(fd, abort, 1) < 0) { | |
} | |
close(fd); | |
} | |
closedir(dir); | |
} else { | |
} | |
while (waitpid(-1, status, __WALL) != pid) { | |
} | |
} | |
static void setup_test() { | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setpgrp(); | |
write_file("/proc/self/oom_score_adj", "1000"); | |
} | |
static void execute_one(void); | |
#define WAIT_FLAGS __WALL | |
static void loop(void) { | |
int iter = 0; | |
for (;; iter++) { | |
int pid = fork(); | |
if (pid < 0) exit(1); | |
if (pid == 0) { | |
setup_test(); | |
execute_one(); | |
exit(0); | |
} | |
int status = 0; | |
uint64_t start = current_time_ms(); | |
for (;;) { | |
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; | |
sleep_ms(1); | |
if (current_time_ms() - start < 5000) continue; | |
kill_and_wait(pid, &status); | |
break; | |
} | |
} | |
} | |
uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, | |
0xffffffffffffffff, 0xffffffffffffffff}; | |
void execute_one(void) { | |
intptr_t res = 0; | |
memcpy((void*)0x20000280, "cgroup.controllers\000", 19); | |
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000280ul, | |
/*flags=*/0x275aul, /*mode=*/0ul); | |
if (res != -1) r[0] = res; | |
memcpy((void*)0x20000180, "cgroup.controllers\000", 19); | |
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000180ul, | |
/*flags=*/0x275aul, /*mode=*/0ul); | |
if (res != -1) r[1] = res; | |
res = syscall(__NR_dup3, /*oldfd=*/r[1], /*newfd=*/r[0], /*flags=*/0ul); | |
if (res != -1) r[2] = res; | |
*(uint32_t*)0x20000140 = 0x20; | |
*(uint32_t*)0x20000144 = 0x8c8c; | |
*(uint32_t*)0x20000148 = 0; | |
*(uint32_t*)0x2000014c = 0; | |
*(uint32_t*)0x20000150 = 0; | |
memset((void*)0x20000154, 0, 8); | |
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x401c5820, /*arg=*/0x20000140ul); | |
sprintf((char*)0x20000040, "0x%016llx", (long long)0); | |
syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x20000040ul, /*len=*/0xfea0ul); | |
memcpy((void*)0x200001c0, "cpuset.effective_cpus\000", 22); | |
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200001c0ul, | |
/*flags=*/0x275aul, /*mode=*/0ul); | |
if (res != -1) r[3] = res; | |
sprintf((char*)0x20000380, "0x%016llx", (long long)0); | |
syscall(__NR_write, /*fd=*/r[3], /*buf=*/0x20000380ul, /*len=*/0x101bful); | |
syscall(__NR_ioctl, /*fd=*/r[3], /*cmd=*/0x660c, 0); | |
*(uint32_t*)0x200000c0 = 0; | |
*(uint32_t*)0x200000c4 = r[3]; | |
*(uint64_t*)0x200000c8 = 7; | |
*(uint64_t*)0x200000d0 = 0; | |
*(uint64_t*)0x200000d8 = 0; | |
*(uint64_t*)0x200000e0 = 0; | |
syscall(__NR_ioctl, /*fd=*/r[2], /*cmd=*/0xc028660f, /*arg=*/0x200000c0ul); | |
syscall(__NR_writev, /*fd=*/-1, /*vec=*/0ul, /*vlen=*/0ul); | |
syscall(__NR_ioctl, /*fd=*/-1, /*cmd=*/0x40045569, /*arg=*/9ul); | |
syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0ul, /*flags=*/0x275aul, | |
/*mode=*/0ul); | |
memcpy((void*)0x20000180, "cgroup.controllers\000", 19); | |
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x20000180ul, | |
/*flags=*/0x275aul, /*mode=*/0ul); | |
if (res != -1) r[4] = res; | |
*(uint64_t*)0x200000c0 = 4; | |
*(uint64_t*)0x200000c8 = 0x16000000000000; | |
*(uint64_t*)0x200000d0 = 0x20; | |
syscall(__NR_ioctl, /*fd=*/r[4], /*cmd=*/0xc0185879, /*arg=*/0x200000c0ul); | |
} | |
int main(void) { | |
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
for (procid = 0; procid < 4; procid++) { | |
if (fork() == 0) { | |
loop(); | |
} | |
} | |
sleep(1000000); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) | |
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) | |
r2 = dup3(r1, r0, 0x0) | |
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000140)={0x20, 0x8c8c}) | |
write$cgroup_int(r0, &(0x7f0000000040), 0xfea0) | |
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuset.effective_cpus\x00', 0x275a, 0x0) | |
write$cgroup_int(r3, &(0x7f0000000380), 0x101bf) | |
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r3, 0x660c) | |
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f00000000c0)={0x0, r3, 0x7}) | |
writev(0xffffffffffffffff, 0x0, 0x0) | |
ioctl$UI_SET_LEDBIT(0xffffffffffffffff, 0x40045569, 0x9) | |
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) | |
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) | |
ioctl$FITRIM(r4, 0xc0185879, &(0x7f00000000c0)={0x4, 0x16000000000000, 0x20}) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment