diff --git a/tools/test/stress2/misc/all.exclude b/tools/test/stress2/misc/all.exclude index 6cd636522c48..ac5576ed1308 100644 --- a/tools/test/stress2/misc/all.exclude +++ b/tools/test/stress2/misc/all.exclude @@ -1,105 +1,98 @@ # List of tests not to run, unless the '-a' option is used with run.sh # Exclude names must start in column 1 backingstore.sh g_vfs_done():md6a[WRITE(offset=...)]error = 28 20111220 backingstore2.sh panic: 43 vncache entries remaining 20111220 backingstore3.sh g_vfs_done():md6a[WRITE(offset=...)]error = 28 20111230 dd.sh CAM stuck in vmwait 20200116 force4.sh https://people.freebsd.org/~pho/stress/log/log0082.txt 20210328 force7.sh https://people.freebsd.org/~pho/stress/log/log0266.txt 20220207 fsync.sh panic: Journal overflow 20190208 fuse.sh Memory corruption seen in log file kostik734.txt 20141114 fuse2.sh Deadlock seen 20121129 fuse3.sh Deadlock seen 20141120 getrandom.sh Known DoS issue 20201107 getrandom2.sh Known DoS issue 20200302 gjournal.sh panic: Journal overflow 20190626 gjournal2.sh panic: Journal overflow 20180125 gjournal3.sh panic: Bio not on queue 20171225 gjournal4.sh CAM stuck in vmwait 20180517 gnop7.sh Waiting for patch commit 20190820 gnop8.sh Waiting for patch commit 20201214 gnop9.sh Waiting for patch commit 20201214 graid1_8.sh Known issue 20170909 graid1_9.sh panic: Bad effnlink 20180212 gunion.sh Waiting for fix 20220308 gunion2.sh Waiting for fix 20220308 ifconfig.sh Bug 253824 20210322 ifconfig2.sh https://people.freebsd.org/~pho/stress/log/log0051.txt 20210210 lockf5.sh Spinning threads seen 20160718 maxvnodes2.sh https://people.freebsd.org/~pho/stress/log/log0083.txt 20210329 memguard.sh https://people.freebsd.org/~pho/stress/log/log0088.txt 20210402 memguard2.sh Waiting for fix commit memguard3.sh Waiting for fix commit mlockall2.sh Unrecoverable OOM killing seen 20190203 mlockall7.sh Needs further investigation 20210123 msetdomain.sh May change policy for random threads to to domainset_fixed 20210104 newfs4.sh watchdog fired. newbuf 20190225 nfs10.sh Double fault 20151013 nfs13.sh mount_nfs hangs in mntref 20191007 nfs15lockd.sh panic: Assertion td->td_realucred == td->td_ucred failed ... 20210211 nfs16.sh panic: Failed to register NFS lock locally - error=11 20160608 nullfs28.sh Hang in "mount drain" seen 20220111 oom2.sh Hang in pfault 20180324 overcommit2.sh CAM stuck in vmwait seen 20200112 pageout.sh panic: handle_written_filepage: not started 20190218 pmc8.sh panic: [pmc,2749] (ri21, rc1) waiting too long for pmc to ... 20210621 -reaper.sh Waiting for commit -reaper2.sh Waiting for commit -reaper3.sh Waiting for commit -reaper4.sh Waiting for commit -reaper5.sh Waiting for commit rename14.sh https://people.freebsd.org/~pho/stress/log/log0279.txt 20220415 sctp2.sh panic: Queues are not empty when handling SHUTDOWN-COMPLETE 20210211 sctp3.sh panic: Queues are not empty when handling SHUTDOWN-COMPLETE 20210211 sendfile25.sh WiP 20200611 signal.sh Timing issues. Needs fixing 20171116 snap8.sh https://people.freebsd.org/~pho/stress/log/log0123.txt 20211008 swapoff2.sh swap_pager_force_pagein: read from swap failed 20171223 swapoff3.sh Excessive OOM killing 20220403 swapoff5.sh log0005.txt, known issue 20210111 systrace.sh WiP 20200227 systrace2.sh WiP 20200227 syzkaller15.sh WiP 20200712 syzkaller16.sh WiP 20210722 syzkaller25.sh WiP 20201116 syzkaller27.sh watchdogd fires 20220512 syzkaller28.sh WiP 20201120 syzkaller50.sh panic: Assertion done != job_total_nbytes failed at ... 20220405 -syzkaller52.sh Waiting for commit -syzkaller53.sh Waiting for commit syzkaller54.sh panic: td 0xfffffe014f7193a0 is not suspended 20220527 syzkaller55.sh panic: Counter goes negative 20220525 timeout.sh Waiting for commit truss3.sh WiP 20200915 unionfs14.sh WiP 20220111 unionfs9.sh https://people.freebsd.org/~pho/stress/log/log0226.txt 20220111 # Test not to run for other reasons: fuzz.sh A know issue marcus3.sh OK, but runs for a long time statfs.sh Not very interesting vunref.sh No problems ever seen vunref2.sh No problems ever seen # Snapshots has been disabled on SU+J suj15.sh suj16.sh suj19.sh suj20.sh suj21.sh suj22.sh suj24.sh suj25.sh suj26.sh suj27.sh suj28.sh # Exclude NFS loopback tests nfs2.sh panic: wrong diroffset 20140219 nfs5.sh nfs6.sh nfs11.sh vmwait deadlock 20151004 nullfs8.sh tmpfs18.sh mntref hang seen 20191019 diff --git a/tools/test/stress2/misc/syzkaller58.sh b/tools/test/stress2/misc/syzkaller58.sh new file mode 100755 index 000000000000..0083e13f1692 --- /dev/null +++ b/tools/test/stress2/misc/syzkaller58.sh @@ -0,0 +1,290 @@ +#!/bin/sh + +# panic: td 0xfffffe010e6ff000 is not suspended +# cpuid = 2 +# time = 1654661460 +# KDB: stack backtrace: +# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0143924c10 +# vpanic() at vpanic+0x17f/frame 0xfffffe0143924c60 +# panic() at panic+0x43/frame 0xfffffe0143924cc0 +# thread_single() at thread_single+0x736/frame 0xfffffe0143924d40 +# fork1() at fork1+0x1e1/frame 0xfffffe0143924da0 +# sys_rfork() at sys_rfork+0xa4/frame 0xfffffe0143924e00 +# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe0143924f30 +# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0143924f30 +# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x821be4d1a, rsp = 0x8276b8f48, rbp = 0x8276b8f70 --- +# KDB: enter: panic +# [ thread pid 2860 tid 100362 ] +# Stopped at kdb_enter+0x32: movq $0,0x1277d83(%rip) +# db> x/s version +# FreeBSD 14.0-CURRENT #0 reap-n255837-0bdda1ded8d: Thu May 26 22:38:04 CEST 2022 +# pho@mercat1.netperf.freebsd.org:/var/tmp/deviant3/sys/amd64/compile/PHO +# db> + +# Submitted by: markj + +[ `uname -p` != "amd64" ] && exit 0 + +. ../default.cfg +cat > /tmp/syzkaller58.c < + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static unsigned long long procid; + +static void kill_and_wait(int pid, int* status) +{ + kill(pid, SIGKILL); + while (waitpid(-1, status, 0) != pid) { + } +} + +static void sleep_ms(uint64_t ms) +{ + usleep(ms * 1000); +} + +static uint64_t current_time_ms(void) +{ + struct timespec ts; + if (clock_gettime(CLOCK_MONOTONIC, &ts)) + exit(1); + return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; +} + +static void thread_start(void* (*fn)(void*), void* arg) +{ + pthread_t th; + pthread_attr_t attr; + pthread_attr_init(&attr); + pthread_attr_setstacksize(&attr, 128 << 10); + int i = 0; + for (; i < 100; i++) { + if (pthread_create(&th, &attr, fn, arg) == 0) { + pthread_attr_destroy(&attr); + return; + } + if (errno == EAGAIN) { + usleep(50); + continue; + } + break; + } + exit(1); +} + +typedef struct { + pthread_mutex_t mu; + pthread_cond_t cv; + int state; +} event_t; + +static void event_init(event_t* ev) +{ + if (pthread_mutex_init(&ev->mu, 0)) + exit(1); + if (pthread_cond_init(&ev->cv, 0)) + exit(1); + ev->state = 0; +} + +static void event_reset(event_t* ev) +{ + ev->state = 0; +} + +static void event_set(event_t* ev) +{ + pthread_mutex_lock(&ev->mu); + if (ev->state) + exit(1); + ev->state = 1; + pthread_mutex_unlock(&ev->mu); + pthread_cond_broadcast(&ev->cv); +} + +static void event_wait(event_t* ev) +{ + pthread_mutex_lock(&ev->mu); + while (!ev->state) + pthread_cond_wait(&ev->cv, &ev->mu); + pthread_mutex_unlock(&ev->mu); +} + +static int event_isset(event_t* ev) +{ + pthread_mutex_lock(&ev->mu); + int res = ev->state; + pthread_mutex_unlock(&ev->mu); + return res; +} + +static int event_timedwait(event_t* ev, uint64_t timeout) +{ + uint64_t start = current_time_ms(); + uint64_t now = start; + pthread_mutex_lock(&ev->mu); + for (;;) { + if (ev->state) + break; + uint64_t remain = timeout - (now - start); + struct timespec ts; + ts.tv_sec = remain / 1000; + ts.tv_nsec = (remain % 1000) * 1000 * 1000; + pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); + now = current_time_ms(); + if (now - start > timeout) + break; + } + int res = ev->state; + pthread_mutex_unlock(&ev->mu); + return res; +} + +struct thread_t { + int created, call; + event_t ready, done; +}; + +static struct thread_t threads[16]; +static void execute_call(int call); +static int running; + +static void* thr(void* arg) +{ + struct thread_t* th = (struct thread_t*)arg; + for (;;) { + event_wait(&th->ready); + event_reset(&th->ready); + execute_call(th->call); + __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); + event_set(&th->done); + } + return 0; +} + +static void execute_one(void) +{ + int i, call, thread; + for (call = 0; call < 5; call++) { + for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); + thread++) { + struct thread_t* th = &threads[thread]; + if (!th->created) { + th->created = 1; + event_init(&th->ready); + event_init(&th->done); + event_set(&th->done); + thread_start(thr, th); + } + if (!event_isset(&th->done)) + continue; + event_reset(&th->done); + th->call = call; + __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); + event_set(&th->ready); + event_timedwait(&th->done, 50); + break; + } + } + for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) + sleep_ms(1); +} + +static void execute_one(void); + +#define WAIT_FLAGS 0 + +static void loop(void) +{ + int iter = 0; + for (;; iter++) { + int pid = fork(); + if (pid < 0) + exit(1); + if (pid == 0) { + execute_one(); + exit(0); + } + int status = 0; + uint64_t start = current_time_ms(); + for (;;) { + if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) + break; + sleep_ms(1); + if (current_time_ms() - start < 5000) + continue; + kill_and_wait(pid, &status); + break; + } + } +} + +void execute_call(int call) +{ + switch (call) { + case 0: + syscall(SYS_rfork, 0x93000ul); + break; + case 1: + syscall(SYS_kqueue); + break; + case 2: + *(uint32_t*)0x20000000 = 0x1d; + *(uint32_t*)0x20000004 = 0; + *(uint32_t*)0x20000008 = 0; + *(uint32_t*)0x2000000c = 0; + *(uint32_t*)0x20000010 = 0; + memset((void*)0x20000014, 0, 60); + syscall(SYS_procctl, 0ul, 0, 6ul, 0x20000000ul); + break; + case 3: + syscall(SYS_kevent, -1, 0ul, 0ul, 0ul, 0ul, 0ul); + break; + case 4: + syscall(SYS_truncate, 0ul, 4ul); + break; + } +} +int main(void) +{ + syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); + for (procid = 0; procid < 2; procid++) { + if (fork() == 0) { + loop(); + } + } + sleep(1000000); + return 0; +} + + +EOF +mycc -o /tmp/syzkaller58 -Wall -Wextra -O0 /tmp/syzkaller58.c -lpthread \ + || exit 1 + +(cd /tmp; timeout 3m ./syzkaller58) + +rm -rf /tmp/syzkaller58 /tmp/syzkaller58.c /tmp/syzkaller58.core \ + /tmp/syzkaller.?????? +[ $loaded ] && kldunload sctp.ko +exit 0