d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

stress2: Added procctl(2) PROC_REAP_KILL regression tests

Browse Source
This commit is contained in:
Peter Holm 2022-06-01 09:58:28 +02:00
parent a7f20faa07
commit 4d0adee4e6
6 changed files with 1110 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

131
tools/test/stress2/misc/reaper2.sh Executable file
View File

@ -0,0 +1,131 @@
#!/bin/sh
#
# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
#
# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org>
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
# procctl(2) threaded test
# panic: exiting process is stopped" seen:
# https://people.freebsd.org/~pho/stress/log/log0285.txt
prog=`basename ${0%.sh}`
cat > /tmp/$prog.c <<EOF
#include <sys/param.h>
#include <sys/mman.h>
#include <sys/procctl.h>
#include <err.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
static volatile u_int *share;
#define PARALLEL 25
#define RUNTIME 120
static void *
tr(void *arg __unused)
{
for (;;)
pause();
return (NULL);
}
static void
test(void) {
pthread_t thr;
struct procctl_reaper_kill killemall;
pid_t pid;
time_t start;
int data[20], e, n, m;
n = m = 0;
if (procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == -1)
err(EXIT_FAILURE, "Fail to acquire the reaper");
start = time(NULL);
while (time(NULL) - start < RUNTIME) {
m++;
share[0] = 0;
if ((pid = fork()) == 0) {
e = pthread_create(&thr, NULL, tr, NULL);
if (e != 0)
errc(1, e, "pthread_create");
share[0] = 1;
setproctitle("child");
usleep(arc4random() % 200);
_exit(0);
}
arc4random_buf(data, sizeof(data));
while (share[0] == 0)
usleep(10);
killemall.rk_sig = SIGTERM;
killemall.rk_flags = 0;
if (procctl(P_PID, getpid(), PROC_REAP_KILL,
&killemall) == 0)
n++;
if (waitpid(pid, NULL, 0) != pid)
err(1, "waitpid()");
}
#if defined(DEBUG)
fprintf(stderr, "n = %d out of %d\n", n, m);
#endif
_exit(0);
}
int
main(void) {
pid_t pids[PARALLEL];
size_t len;
int i;
len = PAGE_SIZE;
if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
err(1, "mmap");
for (i = 0; i < PARALLEL; i++) {
if ((pids[i] = fork()) == 0)
test();
}
for (i = 0; i < PARALLEL; i++)
if (waitpid(pids[i], NULL, 0) != pids[i])
err(1, "waitpid()");
}
EOF
cc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
rm /tmp/$prog.c
here=`pwd`
cd /tmp
./$prog; s=$?
cd $here
rm /tmp/$prog
exit $s

155
tools/test/stress2/misc/reaper3.sh Executable file
View File

@ -0,0 +1,155 @@
#!/bin/sh
#
# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
#
# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org>
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
# procctl(2) fuzz test
prog=`basename ${0%.sh}`
cat > /tmp/$prog.c <<EOF
#include <sys/param.h>
#include <sys/mman.h>
#include <sys/procctl.h>
#include <err.h>
#include <pthread.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
static volatile u_int *share;
#define PARALLEL 25
#define RUNTIME 120
static long
random_long(long mi, long ma)
{
return (arc4random() % (ma - mi + 1) + mi);
}
static void
flip(void *ap, size_t len)
{
unsigned char *cp;
int byte;
unsigned char bit, buf, mask, old __unused;
cp = (unsigned char *)ap;
byte = random_long(0, len);
bit = random_long(0,7);
mask = ~(1 << bit);
buf = cp[byte];
old = cp[byte];
buf = (buf & mask) | (~buf & ~mask);
cp[byte] = buf;
}
static void *
tr(void *arg __unused)
{
for (;;)
pause();
return (NULL);
}
static void
test(void) {
pthread_t thr;
struct procctl_reaper_kill killemall;
pid_t pid;
time_t start;
int data[20], e, n, m;
n = m = 0;
if (procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == -1)
err(EXIT_FAILURE, "Fail to acquire the reaper");
start = time(NULL);
while (time(NULL) - start < RUNTIME) {
m++;
share[0] = 0;
if ((pid = fork()) == 0) {
e = pthread_create(&thr, NULL, tr, NULL);
if (e != 0)
errc(1, e, "pthread_create");
share[0] = 1;
setproctitle("child");
usleep(arc4random() % 200);
if (arc4random() % 100 < 2)
raise(SIGSEGV);
_exit(0);
}
arc4random_buf(data, sizeof(data));
while (share[0] == 0)
usleep(10);
killemall.rk_sig = SIGTERM;
killemall.rk_flags = 0;
flip(&killemall, sizeof(killemall));
if (procctl(P_PID, getpid(), PROC_REAP_KILL,
&killemall) == 0)
n++;
if (waitpid(pid, NULL, 0) != pid)
err(1, "waitpid()");
}
#if defined(DEBUG)
fprintf(stderr, "n = %d out of %d\n", n, m);
#endif
_exit(0);
}
int
main(void) {
pid_t pids[PARALLEL];
size_t len;
int i;
len = PAGE_SIZE;
if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
err(1, "mmap");
for (i = 0; i < PARALLEL; i++) {
if ((pids[i] = fork()) == 0)
test();
}
for (i = 0; i < PARALLEL; i++)
if (waitpid(pids[i], NULL, 0) != pids[i])
err(1, "waitpid()");
}
EOF
cc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
rm /tmp/$prog.c
here=`pwd`
cd /tmp
./$prog; s=$?
cd $here
rm -f /tmp/$prog /tmp/$prog.core
exit $s

154
tools/test/stress2/misc/reaper4.sh Executable file
View File

@ -0,0 +1,154 @@
#!/bin/sh
#
# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
#
# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org>
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
# procctl(2) fuzz test
prog=`basename ${0%.sh}`
cat > /tmp/$prog.c <<EOF
#include <sys/param.h>
#include <sys/mman.h>
#include <sys/procctl.h>
#include <err.h>
#include <pthread.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
static volatile u_int *share;
#define PARALLEL 25
#define RUNTIME 120
static long
random_long(long mi, long ma)
{
return (arc4random() % (ma - mi + 1) + mi);
}
static void
flip(void *ap, size_t len)
{
unsigned char *cp;
int byte;
unsigned char bit, buf, mask, old __unused;
cp = (unsigned char *)ap;
byte = random_long(0, len);
bit = random_long(0,7);
mask = ~(1 << bit);
buf = cp[byte];
old = cp[byte];
buf = (buf & mask) | (~buf & ~mask);
cp[byte] = buf;
}
static void *
tr(void *arg __unused)
{
usleep(arc4random() % 400);
return (NULL);
}
static void
test(void) {
pthread_t thr;
struct procctl_reaper_kill killemall;
pid_t pid;
time_t start;
int data[20], e, n, m;
n = m = 0;
if (procctl(P_PID, getpid(), PROC_REAP_ACQUIRE, NULL) == -1)
err(EXIT_FAILURE, "Fail to acquire the reaper");
start = time(NULL);
while (time(NULL) - start < RUNTIME) {
m++;
share[0] = 0;
if ((pid = fork()) == 0) {
e = pthread_create(&thr, NULL, tr, NULL);
if (e != 0)
errc(1, e, "pthread_create");
share[0] = 1;
setproctitle("child");
usleep(arc4random() % 200);
if (arc4random() % 100 < 2)
raise(SIGSEGV);
_exit(0);
}
arc4random_buf(data, sizeof(data));
while (share[0] == 0)
usleep(10);
killemall.rk_sig = SIGTERM;
killemall.rk_flags = 0;
flip(&killemall, sizeof(killemall));
if (procctl(P_PID, getpid(), PROC_REAP_KILL,
&killemall) == 0)
n++;
if (waitpid(pid, NULL, 0) != pid)
err(1, "waitpid()");
}
#if defined(DEBUG)
fprintf(stderr, "n = %d out of %d\n", n, m);
#endif
_exit(0);
}
int
main(void) {
pid_t pids[PARALLEL];
size_t len;
int i;
len = PAGE_SIZE;
if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
err(1, "mmap");
for (i = 0; i < PARALLEL; i++) {
if ((pids[i] = fork()) == 0)
test();
}
for (i = 0; i < PARALLEL; i++)
if (waitpid(pids[i], NULL, 0) != pids[i])
err(1, "waitpid()");
}
EOF
cc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
rm /tmp/$prog.c
here=`pwd`
cd /tmp
./$prog; s=$?
cd $here
rm -f /tmp/$prog /tmp/$prog.core
exit $s

40
tools/test/stress2/misc/reaper5.sh Executable file
View File

@ -0,0 +1,40 @@
#!/bin/sh
#
# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
#
# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org>
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
# "panic: Assertion (t->parent->p_treeflag & P_TREE_REAPER) != 0 failed at
# ../../../kern/kern_procctl.c:373" seen in WiP kernel code
start=`date +%s`
while [ $((`date +%s` - start)) -lt 120 ]; do
for i in `jot 100`; do
timeout 2s sh -c "timeout 2s sleep 60" &
done
wait
done
exit 0

458
tools/test/stress2/misc/syzkaller52.sh Executable file
View File

@ -0,0 +1,458 @@
#!/bin/sh
# panic: already suspended
# cpuid = 6
# time = 1651176216
# KDB: stack backtrace:
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe014194ea70
# vpanic() at vpanic+0x17f/frame 0xfffffe014194eac0
# panic() at panic+0x43/frame 0xfffffe014194eb20
# thread_single() at thread_single+0x774/frame 0xfffffe014194eb90
# reap_kill_proc() at reap_kill_proc+0x296/frame 0xfffffe014194ebf0
# reap_kill() at reap_kill+0x371/frame 0xfffffe014194ed00
# kern_procctl() at kern_procctl+0x30b/frame 0xfffffe014194ed70
# sys_procctl() at sys_procctl+0x11e/frame 0xfffffe014194ee00
# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe014194ef30
# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe014194ef30
# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x8226f27aa, rsp = 0x82803ef48, rbp = 0x82803ef70 ---
# KDB: enter: panic
# [ thread pid 3074 tid 100404 ]
# Stopped at kdb_enter+0x32: movq $0,0x12790b3(%rip)
# db> x/s version
# FreeBSD 14.0-CURRENT #0 main-n255099-0923ff82fb383: Thu Apr 28 09:48:48 CEST 2022
# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
# db>
[ `uname -p` != "amd64" ] && exit 0
. ../default.cfg
cat > /tmp/syzkaller52.c <<EOF
// https://syzkaller.appspot.com/bug?id=20185b6047d7371885412b56ff188be88f740eab
// autogenerated by syzkaller (https://github.com/google/syzkaller)
// Reported-by: syzbot+79cd12371d417441b175@syzkaller.appspotmail.com
#define _GNU_SOURCE
#include <sys/types.h>
#include <dirent.h>
#include <errno.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void __attribute__((noinline)) remove_dir(const char* dir)
{
DIR* dp = opendir(dir);
if (dp == NULL) {
if (errno == EACCES) {
if (rmdir(dir))
exit(1);
return;
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static void sandbox_common()
{
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 14; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[4] = {0x0, 0x0, 0x0, 0x0};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
*(uint32_t*)0x20000000 = 0x3f;
*(uint32_t*)0x20000004 = 8;
*(uint32_t*)0x20000008 = 0x1000;
*(uint32_t*)0x2000000c = 7;
syscall(SYS_sigsuspend, 0x20000000ul);
break;
case 1:
syscall(SYS_setgid, 0);
break;
case 2:
syscall(SYS_getgroups, 0ul, 0ul);
break;
case 3:
syscall(SYS_setegid, 0);
break;
case 4:
res = syscall(SYS_shmget, 0ul, 0x2000ul, 0x420ul, 0x20ffd000ul);
if (res != -1)
r[0] = res;
break;
case 5:
res = syscall(SYS_getpid);
if (res != -1)
r[1] = res;
break;
case 6:
*(uint32_t*)0x20000200 = -1;
*(uint32_t*)0x20000204 = 0;
*(uint32_t*)0x20000208 = -1;
*(uint32_t*)0x2000020c = 0;
*(uint16_t*)0x20000210 = 0xf965;
*(uint16_t*)0x20000212 = 0x2000;
*(uint32_t*)0x20000214 = 0;
*(uint64_t*)0x20000218 = 0x2d;
*(uint32_t*)0x20000220 = 0x1f;
*(uint64_t*)0x20000228 = 2;
*(uint64_t*)0x20000230 = 4;
*(uint64_t*)0x20000238 = 0;
*(uint32_t*)0x20000240 = r[1];
*(uint32_t*)0x20000244 = -1;
*(uint16_t*)0x20000248 = 7;
*(uint16_t*)0x2000024a = 0;
*(uint64_t*)0x20000250 = 0;
*(uint64_t*)0x20000258 = 0;
syscall(SYS_shmctl, r[0], 1ul, 0x20000200ul);
break;
case 7:
syscall(SYS_getgid);
break;
case 8:
syscall(SYS___semctl, 0, 0ul, 1ul, 0ul);
break;
case 9:
*(uint32_t*)0x20000300 = 4;
*(uint32_t*)0x20000304 = 0;
*(uint16_t*)0x20000308 = 7;
*(uint16_t*)0x2000030a = 6;
memcpy((void*)0x2000030c,
"\x26\xb9\x52\x60\x70\xe1\xb8\x97\x99\x4b\x39\xd3\xea\x42\xe7\xed",
16);
syscall(SYS_fhstat, 0x20000300ul, 0ul);
break;
case 10:
res = syscall(SYS_getgid);
if (res != -1)
r[2] = res;
break;
case 11:
*(uint32_t*)0x20000440 = 3;
*(uint32_t*)0x20000444 = 0;
*(uint32_t*)0x20000448 = r[1];
*(uint32_t*)0x2000044c = 0x81;
*(uint32_t*)0x20000450 = r[1];
memset((void*)0x20000454, 0, 60);
res = syscall(SYS_procctl, 0ul, r[1], 6ul, 0x20000440ul);
if (res != -1)
r[3] = *(uint32_t*)0x20000450;
break;
case 12:
*(uint32_t*)0x200004c0 = 0;
*(uint32_t*)0x200004c4 = 0;
*(uint32_t*)0x200004c8 = 0;
*(uint32_t*)0x200004cc = r[2];
*(uint16_t*)0x200004d0 = 0x100;
*(uint16_t*)0x200004d2 = 8;
*(uint32_t*)0x200004d4 = 0;
*(uint64_t*)0x200004d8 = 0x7ff;
*(uint64_t*)0x200004e0 = 0x7f;
*(uint64_t*)0x200004e8 = 0x81;
*(uint64_t*)0x200004f0 = 0xfff;
*(uint64_t*)0x200004f8 = 0x3a;
*(uint64_t*)0x20000500 = 0x100000000;
*(uint64_t*)0x20000508 = 9;
*(uint32_t*)0x20000510 = r[1];
*(uint32_t*)0x20000514 = r[3];
*(uint64_t*)0x20000518 = 0;
*(uint64_t*)0x20000520 = 0;
syscall(SYS_msgctl, -1, 1ul, 0x200004c0ul);
break;
case 13:
syscall(SYS_ioctl, -1, 0xc0f24425ul, 0ul);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
for (procid = 0; procid < 4; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_none();
}
}
sleep(1000000);
return 0;
}
EOF
mycc -o /tmp/syzkaller52 -Wall -Wextra -O0 /tmp/syzkaller52.c -l pthread ||
exit 1
start=`date +%s`
while [ $((`date +%s` - start)) -lt 120 ]; do
(cd /tmp; timeout 3m ./syzkaller52)
done
rm -rf /tmp/syzkaller52 /tmp/syzkaller52.c /tmp/syzkaller52.core \
/tmp/syzkaller.??????
exit 0

172
tools/test/stress2/misc/syzkaller53.sh Executable file
View File

@ -0,0 +1,172 @@
#!/bin/sh
# panic: Thread not suspended
# cpuid = 9
# time = 1651215111
# KDB: stack backtrace:
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe018701d9c0
# vpanic() at vpanic+0x17f/frame 0xfffffe018701da10
# panic() at panic+0x43/frame 0xfffffe018701da70
# thread_unsuspend_one() at thread_unsuspend_one+0xc5/frame 0xfffffe018701daa0
# thread_suspend_check() at thread_suspend_check+0x1f8/frame 0xfffffe018701dae0
# exit1() at exit1+0xb7/frame 0xfffffe018701db50
# sigexit() at sigexit+0x157/frame 0xfffffe018701de20
# postsig() at postsig+0x1aa/frame 0xfffffe018701def0
# ast() at ast+0x4fb/frame 0xfffffe018701df30
# doreti_ast() at doreti_ast+0x1f/frame 0x820bf50f0
# KDB: enter: panic
# [ thread pid 8379 tid 100392 ]
# Stopped at kdb_enter+0x32: movq $0,0x12790b3(%rip)
# db> x/s version
# FreeBSD 14.0-CURRENT #0 main-n255099-0923ff82fb383: Thu Apr 28 09:48:48 CEST 2022
# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
# db>
[ `uname -p` != "amd64" ] && exit 0
. ../default.cfg
cat > /tmp/syzkaller53.c <<EOF
// https://syzkaller.appspot.com/bug?id=3b00c85aa7a7a1bad3bf0af3abde3c16b543f2a0
// autogenerated by syzkaller (https://github.com/google/syzkaller)
// Reported-by: syzbot+7789d9923f58fa08ecba@syzkaller.appspotmail.com
#define _GNU_SOURCE
#include <sys/types.h>
#include <pwd.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static __thread int clone_ongoing;
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx __unused)
{
if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
exit(sig);
}
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
int valid = addr < prog_start || addr > prog_end;
if (sig == SIGBUS)
valid = 1;
if (skip && valid) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) \
({ \
int ok = 1; \
__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
if (_setjmp(segv_env) == 0) { \
__VA_ARGS__; \
} else \
ok = 0; \
__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
ok; \
})
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter = 0;
for (;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
}
}
void execute_one(void)
{
NONFAILING(*(uint32_t*)0x20000080 = 0x13);
NONFAILING(*(uint32_t*)0x20000084 = 0);
NONFAILING(*(uint32_t*)0x20000088 = 0);
NONFAILING(*(uint32_t*)0x2000008c = 0);
NONFAILING(*(uint32_t*)0x20000090 = -1);
NONFAILING(memset((void*)0x20000094, 0, 60));
syscall(SYS_procctl, 0ul, 0, 6ul, 0x20000080ul);
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
install_segv_handler();
loop();
return 0;
}
EOF
mycc -o /tmp/syzkaller53 -Wall -Wextra -O0 /tmp/syzkaller53.c ||
exit 1
for i in `jot 20`; do
(cd /tmp; timeout 3m ./syzkaller53) &
done
wait
rm -rf /tmp/syzkaller53 /tmp/syzkaller53.c /tmp/syzkaller53.*
exit 0