| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <31142ccf9bd1893b773f53ff51025a27a8179367.camel@elektrobit.com>
Date: Wed, 13 Mar 2024 12:15:24 +0000
From: Weiß, Simone <Simone.Weiss@...ktrobit.com>
To: "tj@...nel.org" <tj@...nel.org>
CC: "jiangshanlai@...il.com" <jiangshanlai@...il.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: BUG: MAX_LOCKDEP_ENTRIES too low! triggered by ext4&workqueue
Dear all,
For some experimentation, I have been running fuzzing campaigns and I
noticed BUG: MAX_LOCKDEP_ENTRIES too low! most likely triggered by ext4
operations.
As I found a C reproducer in my setup, it could be bisected being introduced
with the following:
commit 967b494e2fd143a9c1a3201422aceadb5fa9fbfc
Author: Tejun Heo <tj@...nel.org>
Date: Mon Aug 7 15:57:23 2023 -1000
workqueue: Use a kthread_worker to release pool_workqueues
pool_workqueue release path is currently bounced to system_wq; however, this
is a bit tricky because this bouncing occurs while holding a pool lock and
thus has risk of causing a A-A deadlock. This is currently addressed by the
fact that only unbound workqueues use this bouncing path and system_wq is a
per-cpu workqueue.
...
It was reproducible on v6.6.16 and v6.16.21.
The C reproducer is automatically generated by syzkaller and included below.
If you need any further information, just let me know.
Best,
Simone
Sample Crash
------------
BUG: MAX_LOCKDEP_ENTRIES too low!
turning off the locking correctness validator.
CPU: 0 PID: 1011 Comm: syz-executor232 Not tainted 6.6.16-eb-corbos-standard-
syzkaller-geb3e299184cc #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x128/0x214 arch/arm64/kernel/stacktrace.c:233
show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xac/0x128 lib/dump_stack.c:106
dump_stack+0x20/0x2c lib/dump_stack.c:113
alloc_list_entry kernel/locking/lockdep.c:1397 [inline]
add_lock_to_list+0x24c/0x2d8 kernel/locking/lockdep.c:1418
check_prev_add kernel/locking/lockdep.c:3204 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x35dc/0x6344 kernel/locking/lockdep.c:5137
lock_acquire kernel/locking/lockdep.c:5754 [inline]
lock_acquire+0x47c/0x770 kernel/locking/lockdep.c:5719
_raw_spin_lock_nested+0x50/0x6c kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested kernel/sched/core.c:558 [inline]
raw_spin_rq_lock kernel/sched/sched.h:1372 [inline]
rq_lock kernel/sched/sched.h:1681 [inline]
__schedule+0x218/0x2448 kernel/sched/core.c:6614
preempt_schedule_irq+0x80/0x1ac kernel/sched/core.c:7008
arm64_preempt_schedule_irq+0x3c/0x54 arch/arm64/kernel/entry-common.c:267
__el1_irq arch/arm64/kernel/entry-common.c:505 [inline]
el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:517
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:522
el1h_64_irq+0x68/0x6c arch/arm64/kernel/entry.S:595
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:182 [inline]
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:202 [inline]
lock_acquire kernel/locking/lockdep.c:5757 [inline]
lock_acquire+0x4c4/0x770 kernel/locking/lockdep.c:5719
__flush_workqueue+0x124/0xf28 kernel/workqueue.c:3140
drain_workqueue+0x184/0x36c kernel/workqueue.c:3305
destroy_workqueue+0xb4/0x9a0 kernel/workqueue.c:4800
ext4_put_super+0xe0/0x924 fs/ext4/super.c:1311
generic_shutdown_super+0x120/0x324 fs/super.c:693
kill_block_super+0x3c/0x74 fs/super.c:1646
ext4_kill_sb+0x60/0xb8 fs/ext4/super.c:7320
deactivate_locked_super+0xa0/0x1a8 fs/super.c:481
deactivate_super fs/super.c:514 [inline]
deactivate_super+0x118/0x148 fs/super.c:510
cleanup_mnt+0x1b8/0x338 fs/namespace.c:1254
__cleanup_mnt+0x20/0x30 fs/namespace.c:1261
task_work_run+0x148/0x254 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
do_notify_resume+0xe04/0x18f4 arch/arm64/kernel/signal.c:1305
exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:144 [inline]
el0_svc+0x11c/0x140 arch/arm64/kernel/entry-common.c:679
el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x194/0x198 arch/arm64/kernel/entry.S:599
Reproducer
----------
// https://None.appspot.com/bug?id=422a59d59663a31fd6b1d700eab33c89c33a029b
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/capability.h>
#include <linux/loop.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 279
#endif
#ifndef __NR_mmap
#define __NR_mmap 222
#endif
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
#define MAX_FDS 30
//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty. In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//% claim that you wrote the original software. If you use this software
//% in a product, an acknowledgment in the product documentation would be
//% appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//% misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler madler@...mni.caltech.edu
//% BEGIN CODE DERIVED FROM puff.{c,h}
#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288
struct puff_state {
unsigned char* out;
unsigned long outlen;
unsigned long outcnt;
const unsigned char* in;
unsigned long inlen;
unsigned long incnt;
int bitbuf;
int bitcnt;
jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
long val = s->bitbuf;
while (s->bitcnt < need) {
if (s->incnt == s->inlen)
longjmp(s->env, 1);
val |= (long)(s->in[s->incnt++]) << s->bitcnt;
s->bitcnt += 8;
}
s->bitbuf = (int)(val >> need);
s->bitcnt -= need;
return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
s->bitbuf = 0;
s->bitcnt = 0;
if (s->incnt + 4 > s->inlen)
return 2;
unsigned len = s->in[s->incnt++];
len |= s->in[s->incnt++] << 8;
if (s->in[s->incnt++] != (~len & 0xff) ||
s->in[s->incnt++] != ((~len >> 8) & 0xff))
return -2;
if (s->incnt + len > s->inlen)
return 2;
if (s->outcnt + len > s->outlen)
return 1;
for (; len--; s->outcnt++, s->incnt++) {
if (s->in[s->incnt])
s->out[s->outcnt] = s->in[s->incnt];
}
return 0;
}
struct puff_huffman {
short* count;
short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
int first = 0;
int index = 0;
int bitbuf = s->bitbuf;
int left = s->bitcnt;
int code = first = index = 0;
int len = 1;
short* next = h->count + 1;
while (1) {
while (left--) {
code |= bitbuf & 1;
bitbuf >>= 1;
int count = *next++;
if (code - count < first) {
s->bitbuf = bitbuf;
s->bitcnt = (s->bitcnt - len) & 7;
return h->symbol[index + (code - first)];
}
index += count;
first += count;
first <<= 1;
code <<= 1;
len++;
}
left = (MAXBITS + 1) - len;
if (left == 0)
break;
if (s->incnt == s->inlen)
longjmp(s->env, 1);
bitbuf = s->in[s->incnt++];
if (left > 8)
left = 8;
}
return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
int len;
for (len = 0; len <= MAXBITS; len++)
h->count[len] = 0;
int symbol;
for (symbol = 0; symbol < n; symbol++)
(h->count[length[symbol]])++;
if (h->count[0] == n)
return 0;
int left = 1;
for (len = 1; len <= MAXBITS; len++) {
left <<= 1;
left -= h->count[len];
if (left < 0)
return left;
}
short offs[MAXBITS + 1];
offs[1] = 0;
for (len = 1; len < MAXBITS; len++)
offs[len + 1] = offs[len] + h->count[len];
for (symbol = 0; symbol < n; symbol++)
if (length[symbol] != 0)
h->symbol[offs[length[symbol]]++] = symbol;
return left;
}
static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode,
const struct puff_huffman* distcode)
{
static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
15, 17, 19, 23, 27, 31, 35, 43, 51, 59,
67, 83, 99, 115, 131, 163, 195, 227, 258};
static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2,
2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
static const short dists[30] = {
1, 2, 3, 4, 5, 7, 9, 13, 17, 25,
33, 49, 65, 97, 129, 193, 257, 385, 513, 769,
1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3,
4, 4, 5, 5, 6, 6, 7, 7, 8, 8,
9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
int symbol;
do {
symbol = puff_decode(s, lencode);
if (symbol < 0)
return symbol;
if (symbol < 256) {
if (s->outcnt == s->outlen)
return 1;
if (symbol)
s->out[s->outcnt] = symbol;
s->outcnt++;
} else if (symbol > 256) {
symbol -= 257;
if (symbol >= 29)
return -10;
int len = lens[symbol] + puff_bits(s, lext[symbol]);
symbol = puff_decode(s, distcode);
if (symbol < 0)
return symbol;
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
if (dist > s->outcnt)
return -11;
if (s->outcnt + len > s->outlen)
return 1;
while (len--) {
if (dist <= s->outcnt && s->out[s->outcnt - dist])
s->out[s->outcnt] = s->out[s->outcnt - dist];
s->outcnt++;
}
}
} while (symbol != 256);
return 0;
}
static int puff_fixed(struct puff_state* s)
{
static int virgin = 1;
static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
static struct puff_huffman lencode, distcode;
if (virgin) {
lencode.count = lencnt;
lencode.symbol = lensym;
distcode.count = distcnt;
distcode.symbol = distsym;
short lengths[FIXLCODES];
int symbol;
for (symbol = 0; symbol < 144; symbol++)
lengths[symbol] = 8;
for (; symbol < 256; symbol++)
lengths[symbol] = 9;
for (; symbol < 280; symbol++)
lengths[symbol] = 7;
for (; symbol < FIXLCODES; symbol++)
lengths[symbol] = 8;
puff_construct(&lencode, lengths, FIXLCODES);
for (symbol = 0; symbol < MAXDCODES; symbol++)
lengths[symbol] = 5;
puff_construct(&distcode, lengths, MAXDCODES);
virgin = 0;
}
return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5,
11, 4, 12, 3, 13, 2, 14, 1, 15};
int nlen = puff_bits(s, 5) + 257;
int ndist = puff_bits(s, 5) + 1;
int ncode = puff_bits(s, 4) + 4;
if (nlen > MAXLCODES || ndist > MAXDCODES)
return -3;
short lengths[MAXCODES];
int index;
for (index = 0; index < ncode; index++)
lengths[order[index]] = puff_bits(s, 3);
for (; index < 19; index++)
lengths[order[index]] = 0;
short lencnt[MAXBITS + 1], lensym[MAXLCODES];
struct puff_huffman lencode = {lencnt, lensym};
int err = puff_construct(&lencode, lengths, 19);
if (err != 0)
return -4;
index = 0;
while (index < nlen + ndist) {
int symbol;
int len;
symbol = puff_decode(s, &lencode);
if (symbol < 0)
return symbol;
if (symbol < 16)
lengths[index++] = symbol;
else {
len = 0;
if (symbol == 16) {
if (index == 0)
return -5;
len = lengths[index - 1];
symbol = 3 + puff_bits(s, 2);
} else if (symbol == 17)
symbol = 3 + puff_bits(s, 3);
else
symbol = 11 + puff_bits(s, 7);
if (index + symbol > nlen + ndist)
return -6;
while (symbol--)
lengths[index++] = len;
}
}
if (lengths[256] == 0)
return -9;
err = puff_construct(&lencode, lengths, nlen);
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
return -7;
short distcnt[MAXBITS + 1], distsym[MAXDCODES];
struct puff_huffman distcode = {distcnt, distsym};
err = puff_construct(&distcode, lengths + nlen, ndist);
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
return -8;
return puff_codes(s, &lencode, &distcode);
}
static int puff(unsigned char* dest, unsigned long* destlen,
const unsigned char* source, unsigned long sourcelen)
{
struct puff_state s = {
.out = dest,
.outlen = *destlen,
.outcnt = 0,
.in = source,
.inlen = sourcelen,
.incnt = 0,
.bitbuf = 0,
.bitcnt = 0,
};
int err;
if (setjmp(s.env) != 0)
err = 2;
else {
int last;
do {
last = puff_bits(&s, 1);
int type = puff_bits(&s, 2);
err = type == 0 ? puff_stored(&s)
: (type == 1 ? puff_fixed(&s)
: (type == 2 ? puff_dynamic(&s) : -1));
if (err != 0)
break;
} while (!last);
}
*destlen = s.outcnt;
return err;
}
//% END CODE DERIVED FROM puff.{c,h}
#define ZLIB_HEADER_WIDTH 2
static int puff_zlib_to_file(const unsigned char* source,
unsigned long sourcelen, int dest_fd)
{
if (sourcelen < ZLIB_HEADER_WIDTH)
return 0;
source += ZLIB_HEADER_WIDTH;
sourcelen -= ZLIB_HEADER_WIDTH;
const unsigned long max_destlen = 132 << 20;
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ,
MAP_PRIVATE | MAP_ANON, -1, 0);
if (ret == MAP_FAILED)
return -1;
unsigned char* dest = (unsigned char*)ret;
unsigned long destlen = max_destlen;
int err = puff(dest, &destlen, source, sourcelen);
if (err) {
munmap(dest, max_destlen);
errno = -err;
return -1;
}
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
munmap(dest, max_destlen);
return -1;
}
return munmap(dest, max_destlen);
}
static int setup_loop_device(unsigned char* data, unsigned long size,
const char* loopname, int* loopfd_p)
{
int err = 0, loopfd = -1;
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (puff_zlib_to_file(data, size, memfd)) {
err = errno;
goto error_close_memfd;
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
close(memfd);
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static long syz_mount_image(volatile long fsarg, volatile long dir,
volatile long flags, volatile long optsarg,
volatile long change_dir,
volatile unsigned long size, volatile long image)
{
unsigned char* data = (unsigned char*)image;
int res = -1, err = 0, loopfd = -1, need_loop_device = !!size;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(data, size, loopname, &loopfd) == -1)
return -1;
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
bool has_remount_ro = false;
char* remount_ro_start = strstr(opts, "errors=remount-ro");
if (remount_ro_start != NULL) {
char after = *(remount_ro_start + strlen("errors=remount-ro"));
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
has_remount_ro = ((before == '\0' || before == ',') &&
(after == '\0' || after == ','));
}
if (strstr(opts, "errors=panic") || !has_remount_ro)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
}
errno = err;
return res;
}
static void setup_common()
{
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
}
}
static void setup_binderfs()
{
if (mkdir("/dev/binderfs", 0777)) {
}
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
}
}
static void loop();
static void sandbox_common()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setsid();
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = (200 << 20);
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 32 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 136 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
if (unshare(CLONE_NEWNS)) {
}
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
}
if (unshare(CLONE_NEWIPC)) {
}
if (unshare(0x02000000)) {
}
if (unshare(CLONE_NEWUTS)) {
}
if (unshare(CLONE_SYSVSEM)) {
}
typedef struct {
const char* name;
const char* value;
} sysctl_t;
static const sysctl_t sysctls[] = {
{"/proc/sys/kernel/shmmax", "16777216"},
{"/proc/sys/kernel/shmall", "536870912"},
{"/proc/sys/kernel/shmmni", "1024"},
{"/proc/sys/kernel/msgmax", "8192"},
{"/proc/sys/kernel/msgmni", "1024"},
{"/proc/sys/kernel/msgmnb", "1024"},
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
};
unsigned i;
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
write_file(sysctls[i].name, sysctls[i].value);
}
static int wait_for_loop(int pid)
{
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, __WALL) != pid) {
}
return WEXITSTATUS(status);
}
static void drop_caps(void)
{
struct __user_cap_header_struct cap_hdr = {};
struct __user_cap_data_struct cap_data[2] = {};
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
cap_hdr.pid = getpid();
if (syscall(SYS_capget, &cap_hdr, &cap_data))
exit(1);
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
cap_data[0].effective &= ~drop;
cap_data[0].permitted &= ~drop;
cap_data[0].inheritable &= ~drop;
if (syscall(SYS_capset, &cap_hdr, &cap_data))
exit(1);
}
static int do_sandbox_none(void)
{
if (unshare(CLONE_NEWPID)) {
}
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
setup_common();
sandbox_common();
drop_caps();
if (unshare(CLONE_NEWNET)) {
}
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
setup_binderfs();
loop();
exit(1);
}
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
int iter = 0;
DIR* dp = 0;
retry:
while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
}
dp = opendir(dir);
if (dp == NULL) {
if (errno == EMFILE) {
exit(1);
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
}
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
int i;
for (i = 0;; i++) {
if (unlink(filename) == 0)
break;
if (errno == EPERM) {
int fd = open(filename, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno != EBUSY || i > 100)
exit(1);
if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW))
exit(1);
}
}
closedir(dp);
for (int i = 0;; i++) {
if (rmdir(dir) == 0)
break;
if (i < 100) {
if (errno == EPERM) {
int fd = open(dir, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno == EBUSY) {
if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW))
exit(1);
continue;
}
if (errno == ENOTEMPTY) {
if (iter < 100) {
iter++;
goto retry;
}
}
}
exit(1);
}
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void reset_loop()
{
char buf[64];
snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
int loopfd = open(buf, O_RDWR);
if (loopfd != -1) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
if (symlink("/dev/binderfs", "./binderfs")) {
}
}
static void close_fds()
{
for (int fd = 3; fd < MAX_FDS; fd++)
close(fd);
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
reset_loop();
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
setup_test();
execute_one();
close_fds();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
void execute_one(void)
{
memcpy((void*)0x20000540, "ext4\000", 5);
memcpy((void*)0x20000580, "./file0\000", 8);
memcpy((void*)0x20000000,
"\x00\xf7\xf3\x9e\xf9\xcd\x1c\x6a\x04\x3f\xd7\x8a\xa7\xf9\xce\xb4\xe5"
"\xc2\xc4\x3d\xa9\xd7\x96\x18\xdd\x18\xc1\x68\x98\x9c\x2d\xc4\xb4\x12"
"\xca\x72\x6b\x49\x63\x9a\x98\x2c\xdf\x09\x41\x2c\x67\xd4\x7a\xc4\x0b"
"\xa2\x43\x93\x7f\x7d\xe1\xf5\x33\xf3\xfa\xf1\xb1\xc0\x6d\x75\xa8\x9a"
"\x1a\xfa\x46\x79\x71\xac\x77\x27\x84\x46\x28\x3e\xf9\x0c\xba\xcd\x7d"
"\x21\x9b\x47\x63\x46\xfd\x12\x2c\xed\xa1\x50\x65\xe1\xa1\xb1\xdf\xee"
"\x4f\x0a\x1c\x59\xac\x58\xc8\x1e\xe7\x58\x34\x10\x8b\x6b\xb2\x06",
118);
memcpy(
(void*)0x200005c0,
"\x78\x9c\xec\xdd\xcf\x6b\x1c\x55\x1c\x00\xf0\xef\x6c\x92\x36\xb6\x6a\x5b"
"\x28\x45\x3d\x68\xa0\xa0\x85\xda\x4d\x93\xf8\xa3\x82\x87\xf6\x28\x5a\x2c"
"\xe8\xcd\x43\xbb\x24\xdb\x50\xb2\xe9\x96\xec\xa6\x34\x69\xc1\xf6\x60\x2f"
"\x5e\xa4\x08\x22\x16\x44\xf0\xea\xdd\x63\xf1\x1f\xf0\xe0\x1f\xe0\xa9\xa0"
"\x85\x22\x25\x78\xf1\xe0\xca\x6c\x66\xd3\x6d\xb2\x9b\xac\x49\xb6\xbb\x74"
"\x3f\x1f\x98\xe6\xbd\x99\xd9\x7d\xef\x3b\xf3\xde\xdb\x37\x3b\x53\x36\x80"
"\x81\x35\x96\xfe\x93\x8b\x78\x39\x22\xbe\x4a\x22\x0e\x34\x6d\x1b\x8e\x6c"
"\xe3\xd8\xea\x7e\x2b\x8f\x6e\x4c\xa7\x4b\x12\xb5\xda\x27\x7f\x25\x91\x64"
"\xeb\x1a\xfb\x27\xd9\xdf\xfd\x59\xe6\xa5\x88\xf8\xe5\x8b\x88\xe3\xb9\x8d"
"\xe5\x56\x96\x96\xe7\x0a\xa5\x52\x71\x21\xcb\x8f\x57\xe7\xaf\x8c\x57\x96"
"\x96\x4f\x5c\x9a\x2f\xcc\x16\x67\x8b\x97\x27\xa7\xa6\x4e\xbd\x3d\x35\xf9"
"\xde\xbb\xef\xec\x46\x98\xd7\x0f\xad\xfe\xfd\xf6\xe3\x7b\x1f\x9c\xfa\xf2"
"\xe8\xca\x37\x3f\x3d\x38\x74\x27\x89\xd3\xf1\x6f\xad\x56\x8b\x75\x71\xec"
"\x96\xb1\x18\xcb\x8e\xc9\x48\x9c\x5e\xb7\x6d\x62\xb7\x0b\xeb\xb1\xa4\xd7"
"\x15\x60\x5b\x86\xb2\x7e\x3e\x12\xe9\x18\x70\x20\x86\xb2\x5e\x0f\x3c\xfb"
"\x3e\x8f\x88\x1a\x30\xa0\x12\xfd\x1f\x06\x54\x63\x1e\xd0\xb8\xb6\xef\xc6"
"\x75\x70\x3f\x7b\x78\x26\xe2\xb3\x5c\xab\xf8\x87\x57\xbf\x1b\x89\xd1\xfa"
"\xb5\xd1\xbe\x95\xe4\x89\x2b\xa3\xf4\x7a\xf7\xe0\x2e\x94\x3f\x1a\x11\x3f"
"\xff\x79\xf7\x4e\xba\x44\x97\xbe\x87\x00\x68\xe5\xe6\xad\x88\x38\x39\x3c"
"\xbc\x71\xfc\x4b\xb2\xf1\x6f\xfb\x4e\x76\xb0\xcf\xfa\x32\x8c\x7f\xf0\xf4"
"\xdc\x3b\x13\x11\x6f\xb6\x9a\xff\xe4\xd6\xe6\x3f\x91\xcd\x7f\x9a\xe7\x8b"
"\xfb\x5b\xf4\xdd\xed\xd8\xba\xff\xe7\x1e\xec\x42\x31\x6d\xa5\xf3\xbf\xf7"
"\x5b\xce\x7f\xd7\x6e\x5a\x1d\x1c\xca\x72\x2f\xd4\xe7\x7c\x23\xc9\xc5\x4b"
"\xa5\x62\x3a\xb6\xbd\x18\x11\xc7\x62\x64\x6f\x9a\xdf\xec\x7e\xce\xa9\x95"
"\xfb\xb5\x76\xdb\xc6\x9a\xe6\x7f\xe9\x92\x96\xdf\x98\x0b\x66\xf5\x78\x30"
"\xbc\xf7\xc9\xd7\xcc\x14\xaa\x85\x9d\xc4\xdc\xec\xe1\xad\x88\x57\x86\x5b"
"\xc5\x9f\xac\x9d\xff\xa4\xc5\xfc\x37\x3d\x1e\xe7\x3a\x2c\xe3\x48\xf1\xee"
"\xab\xed\xb6\x6d\x1d\xff\x66\x7e\xef\xb0\x06\xed\xd5\x7e\x88\x78\xa3\xf9"
"\xfc\xff\xd6\xd8\xf2\xf8\x8e\x56\xb2\xf9\xfd\xc9\xf1\x7a\x7b\x18\x6f\xb4"
"\x8a\x8d\xfe\xbe\x7d\xe4\xd7\x76\xe5\xef\x2c\xfe\x9d\x4b\xcf\xff\xbe\x96"
"\xed\x7f\x2d\xfe\x83\x49\xf3\xfd\xda\xca\xd6\xef\xf9\xe3\xba\xfc\xf7\xa3"
"\xff\x14\xdb\xed\xbb\xdd\xf6\xbf\x27\xf9\xb4\x9e\xde\x93\xad\xbb\x56\xa8"
"\x56\x17\x26\xd2\xdc\x47\x1b\xd7\x4f\x3e\x7e\x6d\x23\xbf\xba\xff\x6a\xfc"
"\xc7\x8e\xa6\xf1\xbf\xd6\x76\xfc\x6b\xd5\xfe\x4f\x47\xc4\x85\x27\x8f\x53"
"\x5b\xb7\x0f\xdf\xbe\xb0\xfd\xf8\xbb\x2b\x8d\x7f\xe6\x7f\x9d\xff\x8e\x13"
"\x31\x9a\x25\xee\x7f\x78\xfd\xbb\x76\xe5\x77\x76\xfe\xdf\xaa\xa7\x8e\x65"
"\x6b\x3a\x19\xff\x3a\xad\xe9\x4e\x8e\x1d\x00\x00\x00\x00\x00\x00\xf4\x9b"
"\x5c\x44\x3c\x1f\x49\x2e\xbf\x96\xce\xe5\xf2\xf9\xd5\xe7\x3b\x0e\xc7\xbe"
"\x5c\xa9\x5c\xa9\x1e\xbf\x58\x5e\xbc\x3c\x93\x6e\xab\x3f\xff\x90\x6b\xdc"
"\xe9\x3e\xd0\xf4\x3c\xc4\x44\xf6\x3c\x6c\x23\x3f\xb9\x2e\x3f\x15\x11\x87"
"\x22\xe2\xeb\xa1\xe7\xea\xf9\xfc\x74\xb9\x34\xd3\xeb\xe0\x01\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\x4f\xec\x6f\xf3\xff\xff"
"\x53\x7f\x0c\xf5\xba\x76\x40\xd7\xf9\xc9\x6f\x18\x5c\x8f\xfb\xff\x48\x4f"
"\xeb\x01\x3c\x7d\x3e\xff\x61\x70\xe9\xff\x30\xb8\xf4\x7f\x18\x5c\xfa\x3f"
"\x0c\x2e\xfd\x1f\x06\xd7\x36\xfa\xff\xeb\xdd\xa8\x07\xf0\xf4\xf9\xfc\x87"
"\xc1\xb5\xae\xff\x8f\x6e\xba\x73\xd2\xdd\xba\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x33\xe0\xdc"
"\xd9\xb3\xe9\x52\x5b\x79\x74\x63\x3a\xcd\xcf\x5c\x5d\x5a\x9c\x2b\x5f\x3d"
"\x31\x53\xac\xcc\xe5\xe7\x17\xa7\xf3\xd3\xe5\x85\x2b\xf9\xd9\x72\x79\xb6"
"\x54\xcc\x4f\x97\xe7\xb7\x7a\xbf\x52\xb9\x7c\x65\x62\x32\x16\xaf\x8d\x57"
"\x8b\x95\xea\x78\x65\x69\xf9\xfc\x7c\x79\xf1\x72\xf5\xfc\xa5\xf9\xc2\x6c"
"\xf1\x7c\xd1\x0f\x0c\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\xc0\x46\x95\xa5\xe5\xb9\x42\xa9\x54\x5c\x18\xc4\x44\x12\x71\x73"
"\x93\x7d\xf6\x66\xc7\xa8\x1f\xaa\xda\x85\x44\x12\x49\x3d\xbc\x7e\xa9\x4f"
"\xa3\x49\xf6\x4b\x7d\x3a\x49\xa4\x4d\xa4\x0f\xaa\xd1\x8d\x44\xaf\x46\x24"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\xe8\xbf\x00\x00"
"\x00\xff\xff\xec\xd9\x32\x7d",
1429);
syz_mount_image(/*fs=*/0x20000540, /*dir=*/0x20000580, /*flags=*/0xd,
/*opts=*/0x20000000, /*chdir=*/1, /*size=*/0x594,
/*img=*/0x200005c0);
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
for (procid = 0; procid < 6; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_none();
}
}
sleep(1000000);
return 0;
}
Powered by blists - more mailing lists