xref: /freebsd/tools/test/stress2/misc/syzkaller58.sh (revision 535af610) 
1#!/bin/sh
2
3# panic: td 0xfffffe010e6ff000 is not suspended
4# cpuid = 2
5# time = 1654661460
6# KDB: stack backtrace:
7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0143924c10
8# vpanic() at vpanic+0x17f/frame 0xfffffe0143924c60
9# panic() at panic+0x43/frame 0xfffffe0143924cc0
10# thread_single() at thread_single+0x736/frame 0xfffffe0143924d40
11# fork1() at fork1+0x1e1/frame 0xfffffe0143924da0
12# sys_rfork() at sys_rfork+0xa4/frame 0xfffffe0143924e00
13# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe0143924f30
14# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0143924f30
15# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x821be4d1a, rsp = 0x8276b8f48, rbp = 0x8276b8f70 ---
16# KDB: enter: panic
17# [ thread pid 2860 tid 100362 ]
18# Stopped at      kdb_enter+0x32: movq    $0,0x1277d83(%rip)
19# db> x/s version
20# FreeBSD 14.0-CURRENT #0 reap-n255837-0bdda1ded8d: Thu May 26 22:38:04 CEST 2022
21# pho@mercat1.netperf.freebsd.org:/var/tmp/deviant3/sys/amd64/compile/PHO
22# db>
23
24# Submitted by:	 markj
25
26[ `uname -p` != "amd64" ] && exit 0
27
28. ../default.cfg
29cat > /tmp/syzkaller58.c <<EOF
30// autogenerated by syzkaller (https://github.com/google/syzkaller)
31
32#define _GNU_SOURCE
33
34#include <sys/types.h>
35
36#include <errno.h>
37#include <pthread.h>
38#include <pwd.h>
39#include <signal.h>
40#include <stdarg.h>
41#include <stdbool.h>
42#include <stdint.h>
43#include <stdio.h>
44#include <stdlib.h>
45#include <string.h>
46#include <sys/endian.h>
47#include <sys/syscall.h>
48#include <sys/wait.h>
49#include <time.h>
50#include <unistd.h>
51
52static unsigned long long procid;
53
54static void kill_and_wait(int pid, int* status)
55{
56  kill(pid, SIGKILL);
57  while (waitpid(-1, status, 0) != pid) {
58  }
59}
60
61static void sleep_ms(uint64_t ms)
62{
63  usleep(ms * 1000);
64}
65
66static uint64_t current_time_ms(void)
67{
68  struct timespec ts;
69  if (clock_gettime(CLOCK_MONOTONIC, &ts))
70    exit(1);
71  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
72}
73
74static void thread_start(void* (*fn)(void*), void* arg)
75{
76  pthread_t th;
77  pthread_attr_t attr;
78  pthread_attr_init(&attr);
79  pthread_attr_setstacksize(&attr, 128 << 10);
80  int i = 0;
81  for (; i < 100; i++) {
82    if (pthread_create(&th, &attr, fn, arg) == 0) {
83      pthread_attr_destroy(&attr);
84      return;
85    }
86    if (errno == EAGAIN) {
87      usleep(50);
88      continue;
89    }
90    break;
91  }
92  exit(1);
93}
94
95typedef struct {
96  pthread_mutex_t mu;
97  pthread_cond_t cv;
98  int state;
99} event_t;
100
101static void event_init(event_t* ev)
102{
103  if (pthread_mutex_init(&ev->mu, 0))
104    exit(1);
105  if (pthread_cond_init(&ev->cv, 0))
106    exit(1);
107  ev->state = 0;
108}
109
110static void event_reset(event_t* ev)
111{
112  ev->state = 0;
113}
114
115static void event_set(event_t* ev)
116{
117  pthread_mutex_lock(&ev->mu);
118  if (ev->state)
119    exit(1);
120  ev->state = 1;
121  pthread_mutex_unlock(&ev->mu);
122  pthread_cond_broadcast(&ev->cv);
123}
124
125static void event_wait(event_t* ev)
126{
127  pthread_mutex_lock(&ev->mu);
128  while (!ev->state)
129    pthread_cond_wait(&ev->cv, &ev->mu);
130  pthread_mutex_unlock(&ev->mu);
131}
132
133static int event_isset(event_t* ev)
134{
135  pthread_mutex_lock(&ev->mu);
136  int res = ev->state;
137  pthread_mutex_unlock(&ev->mu);
138  return res;
139}
140
141static int event_timedwait(event_t* ev, uint64_t timeout)
142{
143  uint64_t start = current_time_ms();
144  uint64_t now = start;
145  pthread_mutex_lock(&ev->mu);
146  for (;;) {
147    if (ev->state)
148      break;
149    uint64_t remain = timeout - (now - start);
150    struct timespec ts;
151    ts.tv_sec = remain / 1000;
152    ts.tv_nsec = (remain % 1000) * 1000 * 1000;
153    pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
154    now = current_time_ms();
155    if (now - start > timeout)
156      break;
157  }
158  int res = ev->state;
159  pthread_mutex_unlock(&ev->mu);
160  return res;
161}
162
163struct thread_t {
164  int created, call;
165  event_t ready, done;
166};
167
168static struct thread_t threads[16];
169static void execute_call(int call);
170static int running;
171
172static void* thr(void* arg)
173{
174  struct thread_t* th = (struct thread_t*)arg;
175  for (;;) {
176    event_wait(&th->ready);
177    event_reset(&th->ready);
178    execute_call(th->call);
179    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
180    event_set(&th->done);
181  }
182  return 0;
183}
184
185static void execute_one(void)
186{
187  int i, call, thread;
188  for (call = 0; call < 5; call++) {
189    for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
190         thread++) {
191      struct thread_t* th = &threads[thread];
192      if (!th->created) {
193        th->created = 1;
194        event_init(&th->ready);
195        event_init(&th->done);
196        event_set(&th->done);
197        thread_start(thr, th);
198      }
199      if (!event_isset(&th->done))
200        continue;
201      event_reset(&th->done);
202      th->call = call;
203      __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
204      event_set(&th->ready);
205      event_timedwait(&th->done, 50);
206      break;
207    }
208  }
209  for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
210    sleep_ms(1);
211}
212
213static void execute_one(void);
214
215#define WAIT_FLAGS 0
216
217static void loop(void)
218{
219  int iter __unused = 0;
220  for (;; iter++) {
221    int pid = fork();
222    if (pid < 0)
223      exit(1);
224    if (pid == 0) {
225      execute_one();
226      exit(0);
227    }
228    int status = 0;
229    uint64_t start = current_time_ms();
230    for (;;) {
231      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
232        break;
233      sleep_ms(1);
234      if (current_time_ms() - start < 5000)
235        continue;
236      kill_and_wait(pid, &status);
237      break;
238    }
239  }
240}
241
242void execute_call(int call)
243{
244  switch (call) {
245  case 0:
246    syscall(SYS_rfork, 0x93000ul);
247    break;
248  case 1:
249    syscall(SYS_kqueue);
250    break;
251  case 2:
252    *(uint32_t*)0x20000000 = 0x1d;
253    *(uint32_t*)0x20000004 = 0;
254    *(uint32_t*)0x20000008 = 0;
255    *(uint32_t*)0x2000000c = 0;
256    *(uint32_t*)0x20000010 = 0;
257    memset((void*)0x20000014, 0, 60);
258    syscall(SYS_procctl, 0ul, 0, 6ul, 0x20000000ul);
259    break;
260  case 3:
261    syscall(SYS_kevent, -1, 0ul, 0ul, 0ul, 0ul, 0ul);
262    break;
263  case 4:
264    syscall(SYS_truncate, 0ul, 4ul);
265    break;
266  }
267}
268int main(void)
269{
270  syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
271  for (procid = 0; procid < 2; procid++) {
272    if (fork() == 0) {
273      loop();
274    }
275  }
276  sleep(1000000);
277  return 0;
278}
279
280
281EOF
282mycc -o /tmp/syzkaller58 -Wall -Wextra -O0 /tmp/syzkaller58.c -lpthread \
283    || exit 1
284
285(cd /tmp; timeout 3m ./syzkaller58)
286
287rm -rf /tmp/syzkaller58 /tmp/syzkaller58.c /tmp/syzkaller58.core \
288    /tmp/syzkaller.??????
289[ $loaded ] && kldunload sctp.ko
290exit 0
291