diff --git a/tools/test/stress2/misc/force4.sh b/tools/test/stress2/misc/force4.sh index b1b05dc54efa..72932aec1fe6 100755 --- a/tools/test/stress2/misc/force4.sh +++ b/tools/test/stress2/misc/force4.sh @@ -1,91 +1,91 @@ #!/bin/sh # # SPDX-License-Identifier: BSD-2-Clause-FreeBSD # # Copyright (c) 2020 Peter Holm # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # [ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 # "mdconfig -o force" test scenario with nullfs. # Looping in kernel with WiP kernel code seen: # https://people.freebsd.org/~pho/stress/log/kirk125.txt . ../default.cfg mount | grep $mntpoint | grep -q /dev/md && umount -f $mntpoint mdconfig -l | grep -q md$mdstart && mdconfig -d -u $mdstart mdconfig -a -t swap -s 1g -u $mdstart flags=$newfs_flags [ `jot -r 1 0 1` -eq 1 ] && flags="-j" echo "newfs $flags md$mdstart" newfs $flags md$mdstart > /dev/null 2>&1 mount /dev/md$mdstart $mntpoint chmod 777 $mntpoint mp2=${mntpoint}2 mkdir -p $mp2 mount -t nullfs $mntpoint $mp2 || exit 1 export LOAD=80 export MAXSWAPPCT=80 export RUNDIR=$mp2/stressX export runRUNTIME=3m export rwLOAD=80 export TESTPROGS=' testcases/lockf2/lockf2 testcases/symlink/symlink testcases/openat/openat testcases/socket/socket testcases/rw/rw testcases/mmap/mmap testcases/fts/fts testcases/link/link testcases/lockf/lockf testcases/creat/creat testcases/mkdir/mkdir testcases/rename/rename testcases/swap/swap testcases/mkfifo/mkfifo testcases/dirnprename/dirnprename testcases/dirrename/dirrename ' su $testuser -c 'cd ..; ./testcases/run/run $TESTPROGS' > /dev/null 2>&1 & sleep `jot -r 1 20 60` while mdconfig -l | grep -q md$mdstart; do mdconfig -d -u $mdstart -o force || sleep 1 done sleep 1 ../tools/killall.sh wait -umount $mp2 +mount | grep -q "on $mp2 " && umount $mp2 n=0 while mount | grep $mntpoint | grep -q /dev/md; do umount $mntpoint || sleep 1 [ $((n += 1)) -gt 300 ] && { echo FAIL; exit 1; } done exit 0 diff --git a/tools/test/stress2/misc/syzkaller16.sh b/tools/test/stress2/misc/syzkaller16.sh index 4ded2f61388f..8671b46474ac 100755 --- a/tools/test/stress2/misc/syzkaller16.sh +++ b/tools/test/stress2/misc/syzkaller16.sh @@ -1,417 +1,418 @@ #!/bin/sh # Fatal trap 9: general protection fault while in kernel mode # cpuid = 10; apic id = 0a # instruction pointer = 0x20:0xffffffff80db1fd9 # stack pointer = 0x0:0xfffffe00e2240660 # frame pointer = 0x0:0xfffffe00e2240830 # code segment = base 0x0, limit 0xfffff, type 0x1b # = DPL 0, pres 1, long 1, def32 0, gran 1 # processor eflags = interrupt enabled, resume, IOPL = 0 # current process = 29524 (syzkaller16) # trap number = 9 # panic: general protection fault # cpuid = 10 # time = 1592652215 # KDB: stack backtrace: # db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00e2240370 # vpanic() at vpanic+0x182/frame 0xfffffe00e22403c0 # panic() at panic+0x43/frame 0xfffffe00e2240420 # trap_fatal() at trap_fatal+0x387/frame 0xfffffe00e2240480 # trap() at trap+0x80/frame 0xfffffe00e2240590 # calltrap() at calltrap+0x8/frame 0xfffffe00e2240590 # --- trap 0x9, rip = 0xffffffff80db1fd9, rsp = 0xfffffe00e2240660, rbp = 0xfffffe00e2240830 --- # sctp_lower_sosend() at sctp_lower_sosend+0x21b9/frame 0xfffffe00e2240830 # sctp_sosend() at sctp_sosend+0x346/frame 0xfffffe00e2240950 # sosend() at sosend+0x66/frame 0xfffffe00e2240980 # kern_sendit() at kern_sendit+0x246/frame 0xfffffe00e2240a20 # sendit() at sendit+0x1d8/frame 0xfffffe00e2240a70 # sys_sendto() at sys_sendto+0x4d/frame 0xfffffe00e2240ac0 # ia32_syscall() at ia32_syscall+0x150/frame 0xfffffe00e2240bf0 # int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xfbffcf8c # db> x/s version # version: FreeBSD 13.0-CURRENT #0 r362431: Sat Jun 20 09:52:53 CEST 2020 # pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO # db> [ `uname -p` != "amd64" ] && exit 0 . ../default.cfg kldstat -v | grep -q sctp || kldload sctp.ko cat > /tmp/syzkaller16.c < #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx __unused) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; int collide = 0; again: for (call = 0; call < 6; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); if (collide && (call % 2) == 0) break; event_timedwait(&th->done, 45); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); if (!collide) { collide = 1; goto again; } } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_socket, 0x1c, 1, 0x84); if (res != -1) r[0] = res; break; case 1: NONFAILING(*(uint8_t*)0x10000000 = 0x1c); NONFAILING(*(uint8_t*)0x10000001 = 0x1c); NONFAILING(*(uint16_t*)0x10000002 = htobe16(0x4e22 + procid * 4)); NONFAILING(*(uint32_t*)0x10000004 = 0); NONFAILING(*(uint8_t*)0x10000008 = 0); NONFAILING(*(uint8_t*)0x10000009 = 0); NONFAILING(*(uint8_t*)0x1000000a = 0); NONFAILING(*(uint8_t*)0x1000000b = 0); NONFAILING(*(uint8_t*)0x1000000c = 0); NONFAILING(*(uint8_t*)0x1000000d = 0); NONFAILING(*(uint8_t*)0x1000000e = 0); NONFAILING(*(uint8_t*)0x1000000f = 0); NONFAILING(*(uint8_t*)0x10000010 = 0); NONFAILING(*(uint8_t*)0x10000011 = 0); NONFAILING(*(uint8_t*)0x10000012 = 0); NONFAILING(*(uint8_t*)0x10000013 = 0); NONFAILING(*(uint8_t*)0x10000014 = 0); NONFAILING(*(uint8_t*)0x10000015 = 0); NONFAILING(*(uint8_t*)0x10000016 = 0); NONFAILING(*(uint8_t*)0x10000017 = 0); NONFAILING(*(uint32_t*)0x10000018 = 0); syscall(SYS_bind, (intptr_t)r[0], 0x10000000, 0x1c); break; case 2: NONFAILING(*(uint8_t*)0x10000180 = 0x5f); NONFAILING(*(uint8_t*)0x10000181 = 0x1c); NONFAILING(*(uint16_t*)0x10000182 = htobe16(0x4e22 + procid * 4)); NONFAILING(*(uint32_t*)0x10000184 = 0); NONFAILING(*(uint64_t*)0x10000188 = htobe64(0)); NONFAILING(*(uint64_t*)0x10000190 = htobe64(1)); NONFAILING(*(uint32_t*)0x10000198 = 0); syscall(SYS_connect, (intptr_t)r[0], 0x10000180, 0x1c); break; case 3: NONFAILING(*(uint32_t*)0x100001c0 = 0x401); syscall(SYS_setsockopt, (intptr_t)r[0], 0x84, 0x1b, 0x100001c0, 4); break; case 4: NONFAILING(memcpy( (void*)0x10000380, "\xa3\x1b\xe1\x78\x8e\x58\x9b\x38\x59\xf3\xbb\xdd\x7e\xf7\x51\x23\x97" "\x31\xb2\x90\x4a\xd0\x4e\xb7\xdc\x37\xc6\x95\xf6\x05\x5c\xa8\x36\x54" "\x7e\x7b\x6c\xc3\x7d\xae\x2a\xe4\x77\x08\x94\x67\x3c\x89\x65\x93\x24" "\x1c\x56\x3e\x08\x69\x05\x35\xeb\x3b\x7f\x19\x7d\xda\x44\x54\xb4\x42" "\x4f\x7f\xf9\xf9\xfe\x4e\xac\xef\xa6\xd4\xb1\x61\x9d\xd9\x0b\x97\x7c" "\xd9\x82\x16\xc9\x7b\x2e\xb3\x9f\x02\xde\x0f\xae\xe7\x0b\xec\xa3\x66" "\x3c\x2e\x6c\xc5\x1d\xa2\xb4\x8b\x4b\x39\x49\xcc\x14\x5a\x50\x62\x0f" "\xd5\x65\xb9\x7c\x5c\xa0\xea\xfc\xa4\xc9\x13\x73\x14\x16\xba\xcc\xae" "\x89\xe2\x68\x01\x06\x94\x78\xa3\xee\xa8\x45\xf7\xc2\xcb\x48\x93\xe5" "\x83\x52\x45\x26\xe3\xeb\x73\xa2\xe4\xf1\x11\xcf\x40\x5f\xef\x99\xc2" "\xa1\xeb\x2c\x96\x70\x56\x88\xc8\xc7\x6b\xa1\x66\xd2\x23\x20\x07\x62" "\x69\xd2\x1c\x52\xbb\x5e\x86\x43\x7d\x6c\x65\x44\x42\xf6\xd8\x45\xe2" "\x00\x24\x00\x00\xf0\x1d\x29\xf6\xd3\x74\x83\x25\x40\x56\x50\x17\x7f" "\xc3\x60\xd7\xed\xb1\xfb\x7a\x74\x38\x2b\x47\x34\x93\x9c\xee\xc9\xb0" "\xbf\x7d\xc4\x19\xe2\x77\x4c\xa2\x71\x9c\x30", 249)); NONFAILING(*(uint8_t*)0x10000140 = 0x10); NONFAILING(*(uint8_t*)0x10000141 = 2); NONFAILING(*(uint16_t*)0x10000142 = htobe16(0x4e22 + procid * 4)); NONFAILING(*(uint32_t*)0x10000144 = htobe32(-1)); NONFAILING(*(uint8_t*)0x10000148 = 0); NONFAILING(*(uint8_t*)0x10000149 = 0); NONFAILING(*(uint8_t*)0x1000014a = 0); NONFAILING(*(uint8_t*)0x1000014b = 0); NONFAILING(*(uint8_t*)0x1000014c = 0); NONFAILING(*(uint8_t*)0x1000014d = 0); NONFAILING(*(uint8_t*)0x1000014e = 0); NONFAILING(*(uint8_t*)0x1000014f = 0); syscall(SYS_sendto, (intptr_t)r[0], 0x10000380, 0xfffffcaa, 0x20000, 0x10000140, 0x10); break; case 5: NONFAILING(*(uint32_t*)0x10000540 = 0); NONFAILING(*(uint32_t*)0x10000544 = 0); NONFAILING(*(uint32_t*)0x10000548 = 0); NONFAILING(*(uint32_t*)0x1000054c = 0); NONFAILING(*(uint32_t*)0x10000550 = 0); NONFAILING(*(uint32_t*)0x10000554 = 0); NONFAILING(*(uint32_t*)0x10000558 = 0x20008); syscall(SYS_sendmsg, (intptr_t)r[0], 0x10000540, 0x100); break; } } int main(void) { syscall(SYS_mmap, 0x10000000, 0x1000000, 7, 0x1012, -1, 0); install_segv_handler(); for (procid = 0; procid < 4; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; } EOF mycc -o /tmp/syzkaller16 -Wall -Wextra -O0 -m32 /tmp/syzkaller16.c -pthread || exit 1 (cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) & (cd /tmp; ./syzkaller16) & sleep 60 -pkill -9 syzkaller16 swap +pkill -9 syzkaller16 +while pkill swap; do sleep 1; done wait rm -f /tmp/syzkaller16 /tmp/syzkaller16.c /tmp/syzkaller16.core exit 0 diff --git a/tools/test/stress2/misc/syzkaller17.sh b/tools/test/stress2/misc/syzkaller17.sh index 94b33771c59c..1e3f3ec2eb91 100755 --- a/tools/test/stress2/misc/syzkaller17.sh +++ b/tools/test/stress2/misc/syzkaller17.sh @@ -1,131 +1,132 @@ #!/bin/sh # Fatal trap 12: page fault while in kernel mode # cpuid = 15; apic id = 23 # fault virtual address = 0x10 # fault code = supervisor read data, page not present # instruction pointer = 0x20:0xffffffff80de3833 # stack pointer = 0x28:0xfffffe01398a8860 # frame pointer = 0x28:0xfffffe01398a8880 # code segment = base 0x0, limit 0xfffff, type 0x1b # = DPL 0, pres 1, long 1, def32 0, gran 1 # processor eflags = interrupt enabled, resume, IOPL = 0 # current process = 2798 (syzkaller17) # trap number = 12 # panic: page fault # cpuid = 15 # time = 1593500664 # KDB: stack backtrace: # db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01398a8510 # vpanic() at vpanic+0x182/frame 0xfffffe01398a8560 # panic() at panic+0x43/frame 0xfffffe01398a85c0 # trap_fatal() at trap_fatal+0x387/frame 0xfffffe01398a8620 # trap_pfault() at trap_pfault+0x99/frame 0xfffffe01398a8680 # trap() at trap+0x2a5/frame 0xfffffe01398a8790 # calltrap() at calltrap+0x8/frame 0xfffffe01398a8790 # --- trap 0xc, rip = 0xffffffff80de3833, rsp = 0xfffffe01398a8860, rbp = 0xfffffe01398a8880 --- # sctp_find_ifa_in_ep() at sctp_find_ifa_in_ep+0x83/frame 0xfffffe01398a8880 # sctp_addr_mgmt_ep_sa() at sctp_addr_mgmt_ep_sa+0x56/frame 0xfffffe01398a88c0 # sctp_bindx_delete_address() at sctp_bindx_delete_address+0x9e/frame 0xfffffe01398a8910 # sctp_setopt() at sctp_setopt+0x2134/frame 0xfffffe01398a8990 # sctp_ctloutput() at sctp_ctloutput+0x173/frame 0xfffffe01398a89f0 # sosetopt() at sosetopt+0xed/frame 0xfffffe01398a8a50 # kern_setsockopt() at kern_setsockopt+0xac/frame 0xfffffe01398a8ab0 # sys_setsockopt() at sys_setsockopt+0x24/frame 0xfffffe01398a8ad0 # amd64_syscall() at amd64_syscall+0x159/frame 0xfffffe01398a8bf0 # fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe01398a8bf0 # --- syscall (0, FreeBSD ELF64, nosys), rip = 0x80042813a, rsp = 0x7fffffffe538, rbp = 0x7fffffffe570 --- # KDB: enter: panic # [ thread pid 2798 tid 100249 ] # Stopped at kdb_enter+0x37: movq $0,0x10c4cf6(%rip) # db> x/s version # version: FreeBSD 13.0-CURRENT #0 r362791: Tue Jun 30 08:57:50 CEST 2020 # pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO # db> [ `uname -p` != "amd64" ] && exit 0 . ../default.cfg kldstat -v | grep -q sctp || kldload sctp.ko cat > /tmp/syzkaller17.c < #include #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); intptr_t res = 0; res = syscall(SYS_socket, 2ul, 5ul, 0x84); if (res != -1) r[0] = res; *(uint8_t*)0x200001c0 = 0x10; *(uint8_t*)0x200001c1 = 2; *(uint16_t*)0x200001c2 = htobe16(0x4e20); *(uint8_t*)0x200001c4 = 0xac; *(uint8_t*)0x200001c5 = 0x14; *(uint8_t*)0x200001c6 = 0; *(uint8_t*)0x200001c7 = 0xaa; *(uint8_t*)0x200001c8 = 0; *(uint8_t*)0x200001c9 = 0; *(uint8_t*)0x200001ca = 0; *(uint8_t*)0x200001cb = 0; *(uint8_t*)0x200001cc = 0; *(uint8_t*)0x200001cd = 0; *(uint8_t*)0x200001ce = 0; *(uint8_t*)0x200001cf = 0; *(uint64_t*)0x200001d0 = 0; *(uint64_t*)0x200001d8 = 0; *(uint64_t*)0x200001e0 = 0; *(uint64_t*)0x200001e8 = 0; *(uint64_t*)0x200001f0 = 0; *(uint64_t*)0x200001f8 = 0; *(uint64_t*)0x20000200 = 0; *(uint64_t*)0x20000208 = 0; *(uint64_t*)0x20000210 = 0; *(uint64_t*)0x20000218 = 0; *(uint64_t*)0x20000220 = 0; *(uint64_t*)0x20000228 = 0; *(uint64_t*)0x20000230 = 0; *(uint64_t*)0x20000238 = 0; *(uint64_t*)0x20000240 = 0; *(uint32_t*)0x20000248 = 0; *(uint32_t*)0x2000024c = 4; *(uint32_t*)0x20000250 = 0; *(uint32_t*)0x20000254 = 0; *(uint32_t*)0x20000258 = 0; *(uint16_t*)0x2000025c = 0; *(uint8_t*)0x2000025e = 0; syscall(SYS_setsockopt, r[0], 0x84, 0x8002, 0x200001c0ul, 0xa0ul); return 0; } EOF mycc -o /tmp/syzkaller17 -Wall -Wextra -O0 /tmp/syzkaller17.c || exit 1 (cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) & start=`date +%s` while pgrep -q swap; do (cd /tmp; timeout 1m ./syzkaller17) [ $((`date +%s` - start)) -ge 60 ] && break done -pkill -9 syzkaller17 swap +pkill -9 syzkaller17 +while pkill swap; do sleep 1; done wait rm -f /tmp/syzkaller17 /tmp/syzkaller17.c /tmp/syzkaller17.core exit 0 diff --git a/tools/test/stress2/misc/syzkaller18.sh b/tools/test/stress2/misc/syzkaller18.sh index 12432d23bc65..6a1d41c33084 100755 --- a/tools/test/stress2/misc/syzkaller18.sh +++ b/tools/test/stress2/misc/syzkaller18.sh @@ -1,128 +1,129 @@ #!/bin/sh # panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb # cpuid = 20 # time = 1593501338 # KDB: stack backtrace: # db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe013eaf7e90 # vpanic() at vpanic+0x182/frame 0xfffffe013eaf7ee0 # panic() at panic+0x43/frame 0xfffffe013eaf7f40 # ip6_setmoptions() at ip6_setmoptions+0x23b3/frame 0xfffffe013eaf8120 # ip6_ctloutput() at ip6_ctloutput+0x1f5/frame 0xfffffe013eaf89f0 # sosetopt() at sosetopt+0xed/frame 0xfffffe013eaf8a50 # kern_setsockopt() at kern_setsockopt+0xac/frame 0xfffffe013eaf8ab0 # sys_setsockopt() at sys_setsockopt+0x24/frame 0xfffffe013eaf8ad0 # amd64_syscall() at amd64_syscall+0x159/frame 0xfffffe013eaf8bf0 # fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe013eaf8bf0 # --- syscall (0, FreeBSD ELF64, nosys), rip = 0x80042813a, rsp = 0x7fffffffe518, rbp = 0x7fffffffe570 --- # KDB: enter: panic # [ thread pid 2853 tid 100445 ] # Stopped at kdb_enter+0x37: movq $0,0x10c4cf6(%rip) # db> x/s version # version: FreeBSD 13.0-CURRENT #0 r362791: Tue Jun 30 08:57:50 CEST 2020 # pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO # db> reset [ `uname -p` != "amd64" ] && exit 0 . ../default.cfg cat > /tmp/syzkaller18.c < #include #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); intptr_t res = 0; res = syscall(SYS_socket, 0x1cul, 2ul, 0); if (res != -1) r[0] = res; *(uint32_t*)0x200001c0 = 0; syscall(SYS_setsockopt, r[0], 0x29, 0x1b, 0x200001c0ul, 4ul); *(uint8_t*)0x20000080 = 0x1c; *(uint8_t*)0x20000081 = 0x1c; *(uint16_t*)0x20000082 = htobe16(0x4e20); *(uint32_t*)0x20000084 = 0; *(uint8_t*)0x20000088 = 0; *(uint8_t*)0x20000089 = 0; *(uint8_t*)0x2000008a = 0; *(uint8_t*)0x2000008b = 0; *(uint8_t*)0x2000008c = 0; *(uint8_t*)0x2000008d = 0; *(uint8_t*)0x2000008e = 0; *(uint8_t*)0x2000008f = 0; *(uint8_t*)0x20000090 = 0; *(uint8_t*)0x20000091 = 0; *(uint8_t*)0x20000092 = -1; *(uint8_t*)0x20000093 = -1; *(uint32_t*)0x20000094 = htobe32(0x7f000001); *(uint32_t*)0x20000098 = 0; syscall(SYS_bind, r[0], 0x20000080ul, 0x18ul); *(uint32_t*)0x200002c0 = 0; *(uint8_t*)0x200002c8 = 0x1c; *(uint8_t*)0x200002c9 = 0x1c; *(uint16_t*)0x200002ca = htobe16(0x4e23); *(uint32_t*)0x200002cc = 4; *(uint8_t*)0x200002d0 = -1; *(uint8_t*)0x200002d1 = 1; *(uint8_t*)0x200002d2 = 0; *(uint8_t*)0x200002d3 = 0; *(uint8_t*)0x200002d4 = 0; *(uint8_t*)0x200002d5 = 0; *(uint8_t*)0x200002d6 = 0; *(uint8_t*)0x200002d7 = 0; *(uint8_t*)0x200002d8 = 0; *(uint8_t*)0x200002d9 = 0; *(uint8_t*)0x200002da = 0; *(uint8_t*)0x200002db = 0; *(uint8_t*)0x200002dc = 0; *(uint8_t*)0x200002dd = 0; *(uint8_t*)0x200002de = 0; *(uint8_t*)0x200002df = 1; *(uint32_t*)0x200002e0 = 0x80000000; *(uint64_t*)0x200002e8 = 0; *(uint64_t*)0x200002f0 = 0; *(uint64_t*)0x200002f8 = 0; *(uint64_t*)0x20000300 = 0; *(uint64_t*)0x20000308 = 0; *(uint64_t*)0x20000310 = 0; *(uint64_t*)0x20000318 = 0; *(uint64_t*)0x20000320 = 0; *(uint64_t*)0x20000328 = 0; *(uint64_t*)0x20000330 = 0; *(uint64_t*)0x20000338 = 0; *(uint64_t*)0x20000340 = 0; syscall(SYS_setsockopt, r[0], 0x29, 0x51, 0x200002c0ul, 0x88ul); return 0; } EOF mycc -o /tmp/syzkaller18 -Wall -Wextra -O0 /tmp/syzkaller18.c || exit 1 (cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) & start=`date +%s` while pgrep -q swap; do (cd /tmp; timeout 1m ./syzkaller18) [ $((`date +%s` - start)) -ge 60 ] && break done -pkill -9 syzkaller18 swap +pkill -9 syzkaller18 +while pkill swap; do sleep 1; done wait rm -f /tmp/syzkaller18 /tmp/syzkaller18.c /tmp/syzkaller18.core exit 0 diff --git a/tools/test/stress2/misc/syzkaller19.sh b/tools/test/stress2/misc/syzkaller19.sh index 651f444203e4..b36b12e524f2 100755 --- a/tools/test/stress2/misc/syzkaller19.sh +++ b/tools/test/stress2/misc/syzkaller19.sh @@ -1,171 +1,172 @@ #!/bin/sh # panic: sleeping without a lock # cpuid = 17 # time = 1594020733 # KDB: stack backtrace: # db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe013e99d6d0 # vpanic() at vpanic+0x182/frame 0xfffffe013e99d720 # panic() at panic+0x43/frame 0xfffffe013e99d780 # _sleep() at _sleep+0x466/frame 0xfffffe013e99d820 # soclose() at soclose+0x12a/frame 0xfffffe013e99d890 # _fdrop() at _fdrop+0x1a/frame 0xfffffe013e99d8b0 # closef() at closef+0x1db/frame 0xfffffe013e99d940 # fdescfree_fds() at fdescfree_fds+0x3c/frame 0xfffffe013e99d990 # fdescfree() at fdescfree+0x36c/frame 0xfffffe013e99da50 # exit1() at exit1+0x487/frame 0xfffffe013e99dac0 # sys_sys_exit() at sys_sys_exit+0xd/frame 0xfffffe013e99dad0 # amd64_syscall() at amd64_syscall+0x159/frame 0xfffffe013e99dbf0 # fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe013e99dbf0 # --- syscall (1, FreeBSD ELF64, sys_sys_exit), rip = 0x8004513da, rsp = 0x7fffffffe548, rbp = 0x7fffffffe560 --- # KDB: enter: panic # [ thread pid 86998 tid 100362 ] # Stopped at kdb_enter+0x37: movq $0,0x10c3a16(%rip) # db> x/s version # version:FreeBSD 13.0-CURRENT #2 r362887+d0cb7ae7cb9-c248258(mlnx3): Sat # Jul 4 10:28:49 CEST 2020 pho@t2.osted.lan:/var/tmp/deviant2/sys/amd64/compile/PHO # db> [ `uname -p` != "amd64" ] && exit 0 . ../default.cfg cat > /tmp/syzkaller19.c < #include #include #include #include #include #include #include #include #include #include #include #include #include static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); if (res != -1) r[0] = res; *(uint8_t*)0x20000000 = 0x1c; *(uint8_t*)0x20000001 = 0x1c; *(uint16_t*)0x20000002 = htobe16(0x4e22); *(uint32_t*)0x20000004 = 0; *(uint8_t*)0x20000008 = 0; *(uint8_t*)0x20000009 = 0; *(uint8_t*)0x2000000a = 0; *(uint8_t*)0x2000000b = 0; *(uint8_t*)0x2000000c = 0; *(uint8_t*)0x2000000d = 0; *(uint8_t*)0x2000000e = 0; *(uint8_t*)0x2000000f = 0; *(uint8_t*)0x20000010 = 0; *(uint8_t*)0x20000011 = 0; *(uint8_t*)0x20000012 = 0; *(uint8_t*)0x20000013 = 0; *(uint8_t*)0x20000014 = 0; *(uint8_t*)0x20000015 = 0; *(uint8_t*)0x20000016 = 0; *(uint8_t*)0x20000017 = 0; *(uint32_t*)0x20000018 = 0; syscall(SYS_bind, r[0], 0x20000000ul, 0x1cul); *(uint8_t*)0x20000180 = 0x1c; *(uint8_t*)0x20000181 = 0x1c; *(uint16_t*)0x20000182 = htobe16(0x4e22); *(uint32_t*)0x20000184 = 0; *(uint64_t*)0x20000188 = htobe64(0); *(uint64_t*)0x20000190 = htobe64(1); *(uint32_t*)0x20000198 = 0; syscall(SYS_connect, r[0], 0x20000180ul, 0x1cul); *(uint64_t*)0x20000080 = 0; *(uint32_t*)0x20000088 = 0; *(uint64_t*)0x20000090 = 0; *(uint64_t*)0x20000098 = 0; *(uint64_t*)0x200000a0 = 0; *(uint64_t*)0x200000a8 = 0x60; *(uint32_t*)0x200000b0 = 0; syscall(SYS_sendmsg, r[0], 0x20000080ul, 0x10cul); *(uint32_t*)0x200000c0 = 0xbd; *(uint32_t*)0x200000c4 = 0; syscall(SYS_setsockopt, r[0], 0xffff, 0x80, 0x200000c0ul, 8ul); } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); loop(); return 0; } EOF mycc -o /tmp/syzkaller19 -Wall -Wextra -O2 /tmp/syzkaller19.c -lpthread || exit 1 (cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) & (cd /tmp; ./syzkaller19) & sleep 60 -pkill -9 syzkaller19 swap +pkill -9 syzkaller19 +while pkill swap; do sleep 1; done wait rm -f /tmp/syzkaller19 /tmp/syzkaller19.c /tmp/syzkaller19.core exit 0