-
-
Save xrivendell7/c971ada013151e3b5a5f3f69f8f9ce63 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
TITLE: KMSAN: uninit-value in bpf_prog_run_generic_xdp | |
CORRUPTED: false () | |
MAINTAINERS (TO): [davem@davemloft.net edumazet@google.com jasowang@redhat.com kuba@kernel.org netdev@vger.kernel.org pabeni@redhat.com willemdebruijn.kernel@gmail.com] | |
MAINTAINERS (CC): [linux-kernel@vger.kernel.org] | |
===================================================== | |
BUG: KMSAN: uninit-value in bpf_prog_run_generic_xdp+0x143d/0x1b40 net/core/dev.c:4888 | |
bpf_prog_run_generic_xdp+0x143d/0x1b40 net/core/dev.c:4888 | |
netif_receive_generic_xdp net/core/dev.c:4949 [inline] | |
do_xdp_generic+0x7a5/0xb60 net/core/dev.c:5008 | |
tun_get_user+0x48d3/0x66b0 drivers/net/tun.c:1922 | |
tun_chr_write_iter+0x3bf/0x5c0 drivers/net/tun.c:2048 | |
call_write_iter include/linux/fs.h:2020 [inline] | |
new_sync_write fs/read_write.c:491 [inline] | |
vfs_write+0x92c/0x13f0 fs/read_write.c:584 | |
ksys_write+0x1f3/0x4a0 fs/read_write.c:637 | |
__do_sys_write fs/read_write.c:649 [inline] | |
__se_sys_write fs/read_write.c:646 [inline] | |
__x64_sys_write+0x97/0xf0 fs/read_write.c:646 | |
do_syscall_x64 arch/x86/entry/common.c:52 [inline] | |
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 | |
entry_SYSCALL_64_after_hwframe+0x63/0x6b | |
Uninit was stored to memory at: | |
pskb_expand_head+0x2d1/0x19a0 net/core/skbuff.c:2142 | |
netif_receive_generic_xdp net/core/dev.c:4941 [inline] | |
do_xdp_generic+0x4e4/0xb60 net/core/dev.c:5008 | |
tun_get_user+0x48d3/0x66b0 drivers/net/tun.c:1922 | |
tun_chr_write_iter+0x3bf/0x5c0 drivers/net/tun.c:2048 | |
call_write_iter include/linux/fs.h:2020 [inline] | |
new_sync_write fs/read_write.c:491 [inline] | |
vfs_write+0x92c/0x13f0 fs/read_write.c:584 | |
ksys_write+0x1f3/0x4a0 fs/read_write.c:637 | |
__do_sys_write fs/read_write.c:649 [inline] | |
__se_sys_write fs/read_write.c:646 [inline] | |
__x64_sys_write+0x97/0xf0 fs/read_write.c:646 | |
do_syscall_x64 arch/x86/entry/common.c:52 [inline] | |
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 | |
entry_SYSCALL_64_after_hwframe+0x63/0x6b | |
Uninit was created at: | |
slab_post_alloc_hook+0x103/0x9e0 mm/slab.h:767 | |
slab_alloc_node mm/slub.c:3478 [inline] | |
__kmem_cache_alloc_node+0x5d5/0x9b0 mm/slub.c:3517 | |
__kmalloc_node_track_caller+0x120/0x410 mm/slab_common.c:1027 | |
kmalloc_reserve+0x23f/0x4a0 net/core/skbuff.c:582 | |
__alloc_skb+0x2fd/0x770 | |
alloc_skb_with_frags+0xcc/0x990 net/core/skbuff.c:6364 | |
sock_alloc_send_pskb+0xa65/0xbe0 net/core/sock.c:2776 | |
tun_build_skb drivers/net/tun.c:1693 [inline] | |
tun_get_user+0x1f8b/0x66b0 drivers/net/tun.c:1819 | |
tun_chr_write_iter+0x3bf/0x5c0 drivers/net/tun.c:2048 | |
call_write_iter include/linux/fs.h:2020 [inline] | |
new_sync_write fs/read_write.c:491 [inline] | |
vfs_write+0x92c/0x13f0 fs/read_write.c:584 | |
ksys_write+0x1f3/0x4a0 fs/read_write.c:637 | |
__do_sys_write fs/read_write.c:649 [inline] | |
__se_sys_write fs/read_write.c:646 [inline] | |
__x64_sys_write+0x97/0xf0 fs/read_write.c:646 | |
do_syscall_x64 arch/x86/entry/common.c:52 [inline] | |
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 | |
entry_SYSCALL_64_after_hwframe+0x63/0x6b | |
CPU: 0 PID: 8129 Comm: e79 Not tainted 6.7.0-rc5-01538-gfc3a5534e2a8 #3 | |
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 | |
===================================================== | |
TITLE: kernel panic: kmsan.panic set ... | |
CORRUPTED: false () | |
MAINTAINERS (TO): [davem@davemloft.net edumazet@google.com jasowang@redhat.com kuba@kernel.org netdev@vger.kernel.org pabeni@redhat.com willemdebruijn.kernel@gmail.com] | |
MAINTAINERS (CC): [linux-kernel@vger.kernel.org] | |
bpf_prog_run_generic_xdp+0x143d/0x1b40 net/core/dev.c:4888 | |
netif_receive_generic_xdp net/core/dev.c:4949 [inline] | |
do_xdp_generic+0x7a5/0xb60 net/core/dev.c:5008 | |
tun_get_user+0x48d3/0x66b0 drivers/net/tun.c:1922 | |
tun_chr_write_iter+0x3bf/0x5c0 drivers/net/tun.c:2048 | |
call_write_iter include/linux/fs.h:2020 [inline] | |
new_sync_write fs/read_write.c:491 [inline] | |
vfs_write+0x92c/0x13f0 fs/read_write.c:584 | |
ksys_write+0x1f3/0x4a0 fs/read_write.c:637 | |
__do_sys_write fs/read_write.c:649 [inline] | |
__se_sys_write fs/read_write.c:646 [inline] | |
__x64_sys_write+0x97/0xf0 fs/read_write.c:646 | |
do_syscall_x64 arch/x86/entry/common.c:52 [inline] | |
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 | |
entry_SYSCALL_64_after_hwframe+0x63/0x6b | |
Uninit was stored to memory at: | |
pskb_expand_head+0x2d1/0x19a0 net/core/skbuff.c:2142 | |
netif_receive_generic_xdp net/core/dev.c:4941 [inline] | |
do_xdp_generic+0x4e4/0xb60 net/core/dev.c:5008 | |
tun_get_user+0x48d3/0x66b0 drivers/net/tun.c:1922 | |
tun_chr_write_iter+0x3bf/0x5c0 drivers/net/tun.c:2048 | |
call_write_iter include/linux/fs.h:2020 [inline] | |
new_sync_write fs/read_write.c:491 [inline] | |
vfs_write+0x92c/0x13f0 fs/read_write.c:584 | |
ksys_write+0x1f3/0x4a0 fs/read_write.c:637 | |
__do_sys_write fs/read_write.c:649 [inline] | |
__se_sys_write fs/read_write.c:646 [inline] | |
__x64_sys_write+0x97/0xf0 fs/read_write.c:646 | |
do_syscall_x64 arch/x86/entry/common.c:52 [inline] | |
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 | |
entry_SYSCALL_64_after_hwframe+0x63/0x6b | |
Uninit was created at: | |
slab_post_alloc_hook+0x103/0x9e0 mm/slab.h:767 | |
slab_alloc_node mm/slub.c:3478 [inline] | |
__kmem_cache_alloc_node+0x5d5/0x9b0 mm/slub.c:3517 | |
__kmalloc_node_track_caller+0x120/0x410 mm/slab_common.c:1027 | |
kmalloc_reserve+0x23f/0x4a0 net/core/skbuff.c:582 | |
__alloc_skb+0x2fd/0x770 | |
alloc_skb_with_frags+0xcc/0x990 net/core/skbuff.c:6364 | |
sock_alloc_send_pskb+0xa65/0xbe0 net/core/sock.c:2776 | |
tun_build_skb drivers/net/tun.c:1693 [inline] | |
tun_get_user+0x1f8b/0x66b0 drivers/net/tun.c:1819 | |
tun_chr_write_iter+0x3bf/0x5c0 drivers/net/tun.c:2048 | |
call_write_iter include/linux/fs.h:2020 [inline] | |
new_sync_write fs/read_write.c:491 [inline] | |
vfs_write+0x92c/0x13f0 fs/read_write.c:584 | |
ksys_write+0x1f3/0x4a0 fs/read_write.c:637 | |
__do_sys_write fs/read_write.c:649 [inline] | |
__se_sys_write fs/read_write.c:646 [inline] | |
__x64_sys_write+0x97/0xf0 fs/read_write.c:646 | |
do_syscall_x64 arch/x86/entry/common.c:52 [inline] | |
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 | |
entry_SYSCALL_64_after_hwframe+0x63/0x6b | |
CPU: 0 PID: 8129 Comm: e79 Not tainted 6.7.0-rc5-01538-gfc3a5534e2a8 #3 | |
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 | |
===================================================== | |
Disabling lock debugging due to kernel taint | |
Kernel panic - not syncing: kmsan.panic set ... | |
CPU: 0 PID: 8129 Comm: e79 Tainted: G B 6.7.0-rc5-01538-gfc3a5534e2a8 #3 | |
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 | |
Call Trace: | |
<TASK> | |
__dump_stack lib/dump_stack.c:88 [inline] | |
dump_stack_lvl+0x1af/0x230 lib/dump_stack.c:106 | |
dump_stack+0x1e/0x20 lib/dump_stack.c:113 | |
panic+0x4d6/0xc60 | |
kmsan_report+0x2d7/0x2e0 mm/kmsan/report.c:216 | |
__msan_warning+0x96/0x110 mm/kmsan/instrumentation.c:317 | |
bpf_prog_run_generic_xdp+0x143d/0x1b40 net/core/dev.c:4888 | |
netif_receive_generic_xdp net/core/dev.c:4949 [inline] | |
do_xdp_generic+0x7a5/0xb60 net/core/dev.c:5008 | |
tun_get_user+0x48d3/0x66b0 drivers/net/tun.c:1922 | |
tun_chr_write_iter+0x3bf/0x5c0 drivers/net/tun.c:2048 | |
call_write_iter include/linux/fs.h:2020 [inline] | |
new_sync_write fs/read_write.c:491 [inline] | |
vfs_write+0x92c/0x13f0 fs/read_write.c:584 | |
ksys_write+0x1f3/0x4a0 fs/read_write.c:637 | |
__do_sys_write fs/read_write.c:649 [inline] | |
__se_sys_write fs/read_write.c:646 [inline] | |
__x64_sys_write+0x97/0xf0 fs/read_write.c:646 | |
do_syscall_x64 arch/x86/entry/common.c:52 [inline] | |
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 | |
entry_SYSCALL_64_after_hwframe+0x63/0x6b | |
RIP: 0033:0x436cf0 | |
Code: 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d b1 83 07 009 | |
RSP: 002b:00007fff3f6713c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 | |
RAX: ffffffffffffffda RBX: 0000000020000f0c RCX: 0000000000436cf0 | |
RDX: 000000000000fdef RSI: 0000000020000f00 RDI: 00000000000000c8 | |
RBP: 00007fff3f671400 R08: 0000000000000000 R09: 0000000000000000 | |
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 | |
R13: 00007fff3f671658 R14: 0000000000000001 R15: 0000000000000001 | |
</TASK> | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// autogenerated by syzkaller (https://github.com/google/syzkaller) | |
#define _GNU_SOURCE | |
#include <arpa/inet.h> | |
#include <dirent.h> | |
#include <endian.h> | |
#include <errno.h> | |
#include <fcntl.h> | |
#include <linux/capability.h> | |
#include <linux/genetlink.h> | |
#include <linux/if_addr.h> | |
#include <linux/if_ether.h> | |
#include <linux/if_link.h> | |
#include <linux/if_tun.h> | |
#include <linux/in6.h> | |
#include <linux/ip.h> | |
#include <linux/neighbour.h> | |
#include <linux/net.h> | |
#include <linux/netlink.h> | |
#include <linux/rtnetlink.h> | |
#include <linux/tcp.h> | |
#include <linux/veth.h> | |
#include <net/if.h> | |
#include <net/if_arp.h> | |
#include <netinet/in.h> | |
#include <sched.h> | |
#include <signal.h> | |
#include <stdarg.h> | |
#include <stdbool.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <sys/ioctl.h> | |
#include <sys/mount.h> | |
#include <sys/prctl.h> | |
#include <sys/resource.h> | |
#include <sys/socket.h> | |
#include <sys/stat.h> | |
#include <sys/syscall.h> | |
#include <sys/time.h> | |
#include <sys/types.h> | |
#include <sys/uio.h> | |
#include <sys/wait.h> | |
#include <time.h> | |
#include <unistd.h> | |
#ifndef __NR_bpf | |
#define __NR_bpf 321 | |
#endif | |
static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } | |
static uint64_t current_time_ms(void) { | |
struct timespec ts; | |
if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); | |
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; | |
} | |
static bool write_file(const char* file, const char* what, ...) { | |
char buf[1024]; | |
va_list args; | |
va_start(args, what); | |
vsnprintf(buf, sizeof(buf), what, args); | |
va_end(args); | |
buf[sizeof(buf) - 1] = 0; | |
int len = strlen(buf); | |
int fd = open(file, O_WRONLY | O_CLOEXEC); | |
if (fd == -1) return false; | |
if (write(fd, buf, len) != len) { | |
int err = errno; | |
close(fd); | |
errno = err; | |
return false; | |
} | |
close(fd); | |
return true; | |
} | |
struct nlmsg { | |
char* pos; | |
int nesting; | |
struct nlattr* nested[8]; | |
char buf[4096]; | |
}; | |
static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, | |
const void* data, int size) { | |
memset(nlmsg, 0, sizeof(*nlmsg)); | |
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; | |
hdr->nlmsg_type = typ; | |
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; | |
memcpy(hdr + 1, data, size); | |
nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); | |
} | |
static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, | |
int size) { | |
struct nlattr* attr = (struct nlattr*)nlmsg->pos; | |
attr->nla_len = sizeof(*attr) + size; | |
attr->nla_type = typ; | |
if (size > 0) memcpy(attr + 1, data, size); | |
nlmsg->pos += NLMSG_ALIGN(attr->nla_len); | |
} | |
static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, | |
int* reply_len, bool dofail) { | |
if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); | |
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; | |
hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; | |
struct sockaddr_nl addr; | |
memset(&addr, 0, sizeof(addr)); | |
addr.nl_family = AF_NETLINK; | |
ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, | |
(struct sockaddr*)&addr, sizeof(addr)); | |
if (n != (ssize_t)hdr->nlmsg_len) { | |
if (dofail) exit(1); | |
return -1; | |
} | |
n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); | |
if (reply_len) *reply_len = 0; | |
if (n < 0) { | |
if (dofail) exit(1); | |
return -1; | |
} | |
if (n < (ssize_t)sizeof(struct nlmsghdr)) { | |
errno = EINVAL; | |
if (dofail) exit(1); | |
return -1; | |
} | |
if (hdr->nlmsg_type == NLMSG_DONE) return 0; | |
if (reply_len && hdr->nlmsg_type == reply_type) { | |
*reply_len = n; | |
return 0; | |
} | |
if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { | |
errno = EINVAL; | |
if (dofail) exit(1); | |
return -1; | |
} | |
if (hdr->nlmsg_type != NLMSG_ERROR) { | |
errno = EINVAL; | |
if (dofail) exit(1); | |
return -1; | |
} | |
errno = -((struct nlmsgerr*)(hdr + 1))->error; | |
return -errno; | |
} | |
static int netlink_send(struct nlmsg* nlmsg, int sock) { | |
return netlink_send_ext(nlmsg, sock, 0, NULL, true); | |
} | |
static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, | |
const char* family_name, bool dofail) { | |
struct genlmsghdr genlhdr; | |
memset(&genlhdr, 0, sizeof(genlhdr)); | |
genlhdr.cmd = CTRL_CMD_GETFAMILY; | |
netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); | |
netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, | |
strnlen(family_name, GENL_NAMSIZ - 1) + 1); | |
int n = 0; | |
int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); | |
if (err < 0) { | |
return -1; | |
} | |
uint16_t id = 0; | |
struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + | |
NLMSG_ALIGN(sizeof(genlhdr))); | |
for (; (char*)attr < nlmsg->buf + n; | |
attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { | |
if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { | |
id = *(uint16_t*)(attr + 1); | |
break; | |
} | |
} | |
if (!id) { | |
errno = EINVAL; | |
return -1; | |
} | |
recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); | |
return id; | |
} | |
static void netlink_device_change(struct nlmsg* nlmsg, int sock, | |
const char* name, bool up, const char* master, | |
const void* mac, int macsize, | |
const char* new_name) { | |
struct ifinfomsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; | |
hdr.ifi_index = if_nametoindex(name); | |
netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); | |
if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); | |
if (master) { | |
int ifindex = if_nametoindex(master); | |
netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); | |
} | |
if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev, | |
const void* addr, int addrsize) { | |
struct ifaddrmsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; | |
hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; | |
hdr.ifa_scope = RT_SCOPE_UNIVERSE; | |
hdr.ifa_index = if_nametoindex(dev); | |
netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, | |
sizeof(hdr)); | |
netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); | |
netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); | |
return netlink_send(nlmsg, sock); | |
} | |
static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, const char* dev, | |
const char* addr) { | |
struct in_addr in_addr; | |
inet_pton(AF_INET, addr, &in_addr); | |
int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, const char* dev, | |
const char* addr) { | |
struct in6_addr in6_addr; | |
inet_pton(AF_INET6, addr, &in6_addr); | |
int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_neigh(struct nlmsg* nlmsg, int sock, const char* name, | |
const void* addr, int addrsize, const void* mac, | |
int macsize) { | |
struct ndmsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6; | |
hdr.ndm_ifindex = if_nametoindex(name); | |
hdr.ndm_state = NUD_PERMANENT; | |
netlink_init(nlmsg, RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, | |
sizeof(hdr)); | |
netlink_attr(nlmsg, NDA_DST, addr, addrsize); | |
netlink_attr(nlmsg, NDA_LLADDR, mac, macsize); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static struct nlmsg nlmsg; | |
static int tunfd = -1; | |
#define TUN_IFACE "syz_tun" | |
#define LOCAL_MAC 0xaaaaaaaaaaaa | |
#define REMOTE_MAC 0xaaaaaaaaaabb | |
#define LOCAL_IPV4 "172.20.20.170" | |
#define REMOTE_IPV4 "172.20.20.187" | |
#define LOCAL_IPV6 "fe80::aa" | |
#define REMOTE_IPV6 "fe80::bb" | |
#define IFF_NAPI 0x0010 | |
static void initialize_tun(void) { | |
tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); | |
if (tunfd == -1) { | |
printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n"); | |
printf("otherwise fuzzing or reproducing might not work as intended\n"); | |
return; | |
} | |
const int kTunFd = 200; | |
if (dup2(tunfd, kTunFd) < 0) exit(1); | |
close(tunfd); | |
tunfd = kTunFd; | |
struct ifreq ifr; | |
memset(&ifr, 0, sizeof(ifr)); | |
strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ); | |
ifr.ifr_flags = IFF_TAP | IFF_NO_PI; | |
if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) { | |
exit(1); | |
} | |
char sysctl[64]; | |
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE); | |
write_file(sysctl, "0"); | |
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE); | |
write_file(sysctl, "0"); | |
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); | |
if (sock == -1) exit(1); | |
netlink_add_addr4(&nlmsg, sock, TUN_IFACE, LOCAL_IPV4); | |
netlink_add_addr6(&nlmsg, sock, TUN_IFACE, LOCAL_IPV6); | |
uint64_t macaddr = REMOTE_MAC; | |
struct in_addr in_addr; | |
inet_pton(AF_INET, REMOTE_IPV4, &in_addr); | |
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in_addr, sizeof(in_addr), | |
&macaddr, ETH_ALEN); | |
struct in6_addr in6_addr; | |
inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr); | |
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), | |
&macaddr, ETH_ALEN); | |
macaddr = LOCAL_MAC; | |
netlink_device_change(&nlmsg, sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN, | |
NULL); | |
close(sock); | |
} | |
static int read_tun(char* data, int size) { | |
if (tunfd < 0) return -1; | |
int rv = read(tunfd, data, size); | |
if (rv < 0) { | |
if (errno == EAGAIN || errno == EBADFD) return -1; | |
exit(1); | |
} | |
return rv; | |
} | |
static long syz_emit_ethernet(volatile long a0, volatile long a1, | |
volatile long a2) { | |
if (tunfd < 0) return (uintptr_t)-1; | |
uint32_t length = a0; | |
char* data = (char*)a1; | |
return write(tunfd, data, length); | |
} | |
static void flush_tun() { | |
char data[1000]; | |
while (read_tun(&data[0], sizeof(data)) != -1) { | |
} | |
} | |
#define MAX_FDS 30 | |
static void setup_common() { | |
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { | |
} | |
} | |
static void setup_binderfs() { | |
if (mkdir("/dev/binderfs", 0777)) { | |
} | |
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { | |
} | |
if (symlink("/dev/binderfs", "./binderfs")) { | |
} | |
} | |
static void loop(); | |
static void sandbox_common() { | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setsid(); | |
struct rlimit rlim; | |
rlim.rlim_cur = rlim.rlim_max = (200 << 20); | |
setrlimit(RLIMIT_AS, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 32 << 20; | |
setrlimit(RLIMIT_MEMLOCK, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 136 << 20; | |
setrlimit(RLIMIT_FSIZE, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 1 << 20; | |
setrlimit(RLIMIT_STACK, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 128 << 20; | |
setrlimit(RLIMIT_CORE, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 256; | |
setrlimit(RLIMIT_NOFILE, &rlim); | |
if (unshare(CLONE_NEWNS)) { | |
} | |
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { | |
} | |
if (unshare(CLONE_NEWIPC)) { | |
} | |
if (unshare(0x02000000)) { | |
} | |
if (unshare(CLONE_NEWUTS)) { | |
} | |
if (unshare(CLONE_SYSVSEM)) { | |
} | |
typedef struct { | |
const char* name; | |
const char* value; | |
} sysctl_t; | |
static const sysctl_t sysctls[] = { | |
{"/proc/sys/kernel/shmmax", "16777216"}, | |
{"/proc/sys/kernel/shmall", "536870912"}, | |
{"/proc/sys/kernel/shmmni", "1024"}, | |
{"/proc/sys/kernel/msgmax", "8192"}, | |
{"/proc/sys/kernel/msgmni", "1024"}, | |
{"/proc/sys/kernel/msgmnb", "1024"}, | |
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, | |
}; | |
unsigned i; | |
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) | |
write_file(sysctls[i].name, sysctls[i].value); | |
} | |
static int wait_for_loop(int pid) { | |
if (pid < 0) exit(1); | |
int status = 0; | |
while (waitpid(-1, &status, __WALL) != pid) { | |
} | |
return WEXITSTATUS(status); | |
} | |
static void drop_caps(void) { | |
struct __user_cap_header_struct cap_hdr = {}; | |
struct __user_cap_data_struct cap_data[2] = {}; | |
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; | |
cap_hdr.pid = getpid(); | |
if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); | |
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); | |
cap_data[0].effective &= ~drop; | |
cap_data[0].permitted &= ~drop; | |
cap_data[0].inheritable &= ~drop; | |
if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); | |
} | |
static int do_sandbox_none(void) { | |
if (unshare(CLONE_NEWPID)) { | |
} | |
int pid = fork(); | |
if (pid != 0) return wait_for_loop(pid); | |
setup_common(); | |
sandbox_common(); | |
drop_caps(); | |
if (unshare(CLONE_NEWNET)) { | |
} | |
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); | |
initialize_tun(); | |
setup_binderfs(); | |
loop(); | |
exit(1); | |
} | |
static void kill_and_wait(int pid, int* status) { | |
kill(-pid, SIGKILL); | |
kill(pid, SIGKILL); | |
for (int i = 0; i < 100; i++) { | |
if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; | |
usleep(1000); | |
} | |
DIR* dir = opendir("/sys/fs/fuse/connections"); | |
if (dir) { | |
for (;;) { | |
struct dirent* ent = readdir(dir); | |
if (!ent) break; | |
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) | |
continue; | |
char abort[300]; | |
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", | |
ent->d_name); | |
int fd = open(abort, O_WRONLY); | |
if (fd == -1) { | |
continue; | |
} | |
if (write(fd, abort, 1) < 0) { | |
} | |
close(fd); | |
} | |
closedir(dir); | |
} else { | |
} | |
while (waitpid(-1, status, __WALL) != pid) { | |
} | |
} | |
static void setup_test() { | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setpgrp(); | |
write_file("/proc/self/oom_score_adj", "1000"); | |
flush_tun(); | |
} | |
static void close_fds() { | |
for (int fd = 3; fd < MAX_FDS; fd++) close(fd); | |
} | |
static void execute_one(void); | |
#define WAIT_FLAGS __WALL | |
static void loop(void) { | |
int iter = 0; | |
for (;; iter++) { | |
int pid = fork(); | |
if (pid < 0) exit(1); | |
if (pid == 0) { | |
setup_test(); | |
execute_one(); | |
close_fds(); | |
exit(0); | |
} | |
int status = 0; | |
uint64_t start = current_time_ms(); | |
for (;;) { | |
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; | |
sleep_ms(1); | |
if (current_time_ms() - start < 5000) continue; | |
kill_and_wait(pid, &status); | |
break; | |
} | |
} | |
} | |
uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0}; | |
void execute_one(void) { | |
intptr_t res = 0; | |
res = syscall(__NR_socket, /*domain=*/2ul, /*type=*/1ul, /*proto=*/0); | |
if (res != -1) r[0] = res; | |
*(uint32_t*)0x20000100 = 6; | |
*(uint32_t*)0x20000104 = 4; | |
*(uint64_t*)0x20000108 = 0x20000200; | |
memcpy((void*)0x20000200, | |
"\x18\x02\x00\x00\xfd\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x85" | |
"\x00\x00\x00\x2c\x00\x00\x00\x95", | |
25); | |
*(uint64_t*)0x20000110 = 0x20000040; | |
memcpy((void*)0x20000040, "GPL\000", 4); | |
*(uint32_t*)0x20000118 = 0; | |
*(uint32_t*)0x2000011c = 0; | |
*(uint64_t*)0x20000120 = 0; | |
*(uint32_t*)0x20000128 = 0; | |
*(uint32_t*)0x2000012c = 0; | |
memset((void*)0x20000130, 0, 16); | |
*(uint32_t*)0x20000140 = 0; | |
*(uint32_t*)0x20000144 = 0; | |
*(uint32_t*)0x20000148 = -1; | |
*(uint32_t*)0x2000014c = 8; | |
*(uint64_t*)0x20000150 = 0; | |
*(uint32_t*)0x20000158 = 0; | |
*(uint32_t*)0x2000015c = 0x10; | |
*(uint64_t*)0x20000160 = 0; | |
*(uint32_t*)0x20000168 = 0; | |
*(uint32_t*)0x2000016c = 0; | |
*(uint32_t*)0x20000170 = 0; | |
*(uint32_t*)0x20000174 = 0; | |
*(uint64_t*)0x20000178 = 0; | |
*(uint64_t*)0x20000180 = 0; | |
*(uint32_t*)0x20000188 = 0x10; | |
*(uint32_t*)0x2000018c = 0; | |
res = syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x20000100ul, /*size=*/0x90ul); | |
if (res != -1) r[1] = res; | |
memcpy((void*)0x20000180, "syz_tun\000\000\000\000\000\000\000\000\000", 16); | |
res = syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x8933, /*arg=*/0x20000180ul); | |
if (res != -1) r[2] = *(uint32_t*)0x20000190; | |
*(uint32_t*)0x20000000 = r[1]; | |
*(uint32_t*)0x20000004 = r[2]; | |
*(uint32_t*)0x20000008 = 0x25; | |
*(uint32_t*)0x2000000c = 0; | |
*(uint32_t*)0x20000010 = 0; | |
syscall(__NR_bpf, /*cmd=*/0x1cul, /*arg=*/0x20000000ul, /*size=*/0x10ul); | |
memset((void*)0x20000f00, 170, 5); | |
*(uint8_t*)0x20000f05 = 0xaa; | |
memset((void*)0x20000f06, 0, 6); | |
*(uint16_t*)0x20000f0c = htobe16(0); | |
syz_emit_ethernet(/*len=*/0xfdef, /*packet=*/0x20000f00, /*frags=*/0); | |
} | |
int main(void) { | |
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, | |
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
do_sandbox_none(); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
r0 = socket$inet_tcp(0x2, 0x1, 0x0) | |
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000fdffffff0000000000000000850000002c00000095"], &(0x7f0000000040)='GPL\x00'}, 0x90) | |
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0}) | |
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2}, 0x10) | |
syz_emit_ethernet(0xfdef, &(0x7f0000000f00)={@local, @empty, @void}, 0x0) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment