Skip to content

Commit 1d72e6e

Browse files
github-actions[bot]github-actions[bot]
committed
chore: autopublish 2025-04-17T01:11:15Z
1 parent ef0bbdb commit 1d72e6e

4 files changed

+889
-0
lines changed

‎crepros/4036165fc595a74b09b2-12170c04580000.c

+193
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
// https://syzkaller.appspot.com/bug?id=27fe4a84236153b25f0ea48b3e92d53487c6859f
2+
// autogenerated by syzkaller (https://github.com/google/syzkaller)
3+
4+
#define _GNU_SOURCE
5+
6+
#include <dirent.h>
7+
#include <endian.h>
8+
#include <errno.h>
9+
#include <fcntl.h>
10+
#include <signal.h>
11+
#include <stdarg.h>
12+
#include <stdbool.h>
13+
#include <stdint.h>
14+
#include <stdio.h>
15+
#include <stdlib.h>
16+
#include <string.h>
17+
#include <sys/prctl.h>
18+
#include <sys/stat.h>
19+
#include <sys/syscall.h>
20+
#include <sys/types.h>
21+
#include <sys/wait.h>
22+
#include <time.h>
23+
#include <unistd.h>
24+
25+
static void sleep_ms(uint64_t ms)
26+
{
27+
usleep(ms * 1000);
28+
}
29+
30+
static uint64_t current_time_ms(void)
31+
{
32+
struct timespec ts;
33+
if (clock_gettime(CLOCK_MONOTONIC, &ts))
34+
exit(1);
35+
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
36+
}
37+
38+
static bool write_file(const char* file, const char* what, ...)
39+
{
40+
char buf[1024];
41+
va_list args;
42+
va_start(args, what);
43+
vsnprintf(buf, sizeof(buf), what, args);
44+
va_end(args);
45+
buf[sizeof(buf) - 1] = 0;
46+
int len = strlen(buf);
47+
int fd = open(file, O_WRONLY | O_CLOEXEC);
48+
if (fd == -1)
49+
return false;
50+
if (write(fd, buf, len) != len) {
51+
int err = errno;
52+
close(fd);
53+
errno = err;
54+
return false;
55+
}
56+
close(fd);
57+
return true;
58+
}
59+
60+
static void kill_and_wait(int pid, int* status)
61+
{
62+
kill(-pid, SIGKILL);
63+
kill(pid, SIGKILL);
64+
for (int i = 0; i < 100; i++) {
65+
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
66+
return;
67+
usleep(1000);
68+
}
69+
DIR* dir = opendir("/sys/fs/fuse/connections");
70+
if (dir) {
71+
for (;;) {
72+
struct dirent* ent = readdir(dir);
73+
if (!ent)
74+
break;
75+
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
76+
continue;
77+
char abort[300];
78+
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
79+
ent->d_name);
80+
int fd = open(abort, O_WRONLY);
81+
if (fd == -1) {
82+
continue;
83+
}
84+
if (write(fd, abort, 1) < 0) {
85+
}
86+
close(fd);
87+
}
88+
closedir(dir);
89+
} else {
90+
}
91+
while (waitpid(-1, status, __WALL) != pid) {
92+
}
93+
}
94+
95+
static void setup_test()
96+
{
97+
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
98+
setpgrp();
99+
write_file("/proc/self/oom_score_adj", "1000");
100+
}
101+
102+
static void execute_one(void);
103+
104+
#define WAIT_FLAGS __WALL
105+
106+
static void loop(void)
107+
{
108+
int iter = 0;
109+
for (;; iter++) {
110+
int pid = fork();
111+
if (pid < 0)
112+
exit(1);
113+
if (pid == 0) {
114+
setup_test();
115+
execute_one();
116+
exit(0);
117+
}
118+
int status = 0;
119+
uint64_t start = current_time_ms();
120+
for (;;) {
121+
sleep_ms(10);
122+
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
123+
break;
124+
if (current_time_ms() - start < 5000)
125+
continue;
126+
kill_and_wait(pid, &status);
127+
break;
128+
}
129+
}
130+
}
131+
132+
uint64_t r[1] = {0xffffffffffffffff};
133+
134+
void execute_one(void)
135+
{
136+
intptr_t res = 0;
137+
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
138+
}
139+
memcpy((void*)0x200000000280, "./file0\000", 8);
140+
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000280ul,
141+
/*mode=S_IWGRP*/ 0x10ul);
142+
memcpy((void*)0x200000000140, "./file1\000", 8);
143+
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000140ul,
144+
/*mode=*/0ul);
145+
memcpy((void*)0x200000000300, "./bus\000", 6);
146+
syscall(__NR_mkdir, /*path=*/0x200000000300ul, /*mode=*/0ul);
147+
memcpy((void*)0x2000000000c0, "./bus\000", 6);
148+
memcpy((void*)0x200000000340, "overlay\000", 8);
149+
memcpy((void*)0x200000000080, "workdir", 7);
150+
*(uint8_t*)0x200000000087 = 0x3d;
151+
memcpy((void*)0x200000000088, "./bus", 5);
152+
*(uint8_t*)0x20000000008d = 0x2c;
153+
memcpy((void*)0x20000000008e, "lowerdir", 8);
154+
*(uint8_t*)0x200000000096 = 0x3d;
155+
memcpy((void*)0x200000000097, "./file0", 7);
156+
*(uint8_t*)0x20000000009e = 0x2c;
157+
memcpy((void*)0x20000000009f, "upperdir", 8);
158+
*(uint8_t*)0x2000000000a7 = 0x3d;
159+
memcpy((void*)0x2000000000a8, "./file1", 7);
160+
*(uint8_t*)0x2000000000af = 0x2c;
161+
*(uint8_t*)0x2000000000b0 = 0;
162+
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x2000000000c0ul,
163+
/*type=*/0x200000000340ul, /*flags=*/0ul, /*opts=*/0x200000000080ul);
164+
memcpy((void*)0x200000000140, "./bus\000", 6);
165+
syscall(__NR_chdir, /*dir=*/0x200000000140ul);
166+
memcpy((void*)0x200000000040, "cgroup.freeze\000", 14);
167+
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000040ul,
168+
/*flags=*/0x275a, /*mode=*/0);
169+
if (res != -1)
170+
r[0] = res;
171+
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul,
172+
/*prot=PROT_GROWSDOWN|PROT_WRITE|PROT_READ*/ 0x1000003ul,
173+
/*flags=MAP_STACK|MAP_POPULATE|MAP_FIXED|MAP_SHARED*/ 0x28011ul,
174+
/*fd=*/r[0], /*offset=*/0ul);
175+
syscall(__NR_lseek, /*fd=*/r[0], /*offset=*/5ul, /*whence=SEEK_CUR*/ 1ul);
176+
}
177+
int main(void)
178+
{
179+
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
180+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
181+
/*offset=*/0ul);
182+
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
183+
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
184+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
185+
/*offset=*/0ul);
186+
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
187+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
188+
/*offset=*/0ul);
189+
const char* reason;
190+
(void)reason;
191+
loop();
192+
return 0;
193+
}

‎crepros/4036165fc595a74b09b2-1571c7e4580000.c

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
// https://syzkaller.appspot.com/bug?id=27fe4a84236153b25f0ea48b3e92d53487c6859f
2+
// autogenerated by syzkaller (https://github.com/google/syzkaller)
3+
4+
#define _GNU_SOURCE
5+
6+
#include <endian.h>
7+
#include <stdint.h>
8+
#include <stdio.h>
9+
#include <stdlib.h>
10+
#include <string.h>
11+
#include <sys/syscall.h>
12+
#include <sys/types.h>
13+
#include <unistd.h>
14+
15+
uint64_t r[1] = {0xffffffffffffffff};
16+
17+
int main(void)
18+
{
19+
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
20+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
21+
/*offset=*/0ul);
22+
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
23+
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
24+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
25+
/*offset=*/0ul);
26+
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
27+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
28+
/*offset=*/0ul);
29+
const char* reason;
30+
(void)reason;
31+
intptr_t res = 0;
32+
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
33+
}
34+
memcpy((void*)0x200000000280, "./file0\000", 8);
35+
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000280ul,
36+
/*mode=S_IWGRP*/ 0x10ul);
37+
memcpy((void*)0x200000000140, "./file1\000", 8);
38+
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000000140ul,
39+
/*mode=*/0ul);
40+
memcpy((void*)0x200000000300, "./bus\000", 6);
41+
syscall(__NR_mkdir, /*path=*/0x200000000300ul, /*mode=*/0ul);
42+
memcpy((void*)0x2000000000c0, "./bus\000", 6);
43+
memcpy((void*)0x200000000340, "overlay\000", 8);
44+
memcpy((void*)0x200000000080, "workdir", 7);
45+
*(uint8_t*)0x200000000087 = 0x3d;
46+
memcpy((void*)0x200000000088, "./bus", 5);
47+
*(uint8_t*)0x20000000008d = 0x2c;
48+
memcpy((void*)0x20000000008e, "lowerdir", 8);
49+
*(uint8_t*)0x200000000096 = 0x3d;
50+
memcpy((void*)0x200000000097, "./file0", 7);
51+
*(uint8_t*)0x20000000009e = 0x2c;
52+
memcpy((void*)0x20000000009f, "upperdir", 8);
53+
*(uint8_t*)0x2000000000a7 = 0x3d;
54+
memcpy((void*)0x2000000000a8, "./file1", 7);
55+
*(uint8_t*)0x2000000000af = 0x2c;
56+
*(uint8_t*)0x2000000000b0 = 0;
57+
syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x2000000000c0ul,
58+
/*type=*/0x200000000340ul, /*flags=*/0ul, /*opts=*/0x200000000080ul);
59+
memcpy((void*)0x200000000140, "./bus\000", 6);
60+
syscall(__NR_chdir, /*dir=*/0x200000000140ul);
61+
memcpy((void*)0x200000000040, "cgroup.freeze\000", 14);
62+
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000040ul,
63+
/*flags=*/0x275a, /*mode=*/0);
64+
if (res != -1)
65+
r[0] = res;
66+
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0xb36000ul,
67+
/*prot=PROT_GROWSDOWN|PROT_WRITE|PROT_READ*/ 0x1000003ul,
68+
/*flags=MAP_STACK|MAP_POPULATE|MAP_FIXED|MAP_SHARED*/ 0x28011ul,
69+
/*fd=*/r[0], /*offset=*/0ul);
70+
syscall(__NR_lseek, /*fd=*/r[0], /*offset=*/5ul, /*whence=SEEK_CUR*/ 1ul);
71+
return 0;
72+
}

‎crepros/c35d73ce910d86c0026e-13ef023f980000.c

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// https://syzkaller.appspot.com/bug?id=3bcd844b287ea67f182e2a87f482f6e8222b9c50
2+
// autogenerated by syzkaller (https://github.com/google/syzkaller)
3+
4+
#define _GNU_SOURCE
5+
6+
#include <endian.h>
7+
#include <stdint.h>
8+
#include <stdio.h>
9+
#include <stdlib.h>
10+
#include <string.h>
11+
#include <sys/syscall.h>
12+
#include <sys/types.h>
13+
#include <unistd.h>
14+
15+
#ifndef __NR_fsconfig
16+
#define __NR_fsconfig 431
17+
#endif
18+
#ifndef __NR_fsopen
19+
#define __NR_fsopen 430
20+
#endif
21+
22+
uint64_t r[1] = {0xffffffffffffffff};
23+
24+
int main(void)
25+
{
26+
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
27+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
28+
/*offset=*/0ul);
29+
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
30+
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
31+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
32+
/*offset=*/0ul);
33+
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
34+
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
35+
/*offset=*/0ul);
36+
const char* reason;
37+
(void)reason;
38+
intptr_t res = 0;
39+
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
40+
}
41+
memcpy((void*)0x200000000280, "ceph\000", 5);
42+
res = syscall(__NR_fsopen, /*type=*/0x200000000280ul,
43+
/*flags=FSOPEN_CLOEXEC*/ 1ul);
44+
if (res != -1)
45+
r[0] = res;
46+
memcpy((void*)0x200000000000, "source", 6);
47+
memcpy((void*)0x200000000040, "c:::\000", 5);
48+
syscall(__NR_fsconfig, /*fd=*/r[0], /*cmd=*/1ul, /*key=*/0x200000000000ul,
49+
/*value=*/0x200000000040ul, /*aux=*/0ul);
50+
syscall(__NR_fsconfig, /*fd=*/r[0], /*cmd=*/6ul, /*key=*/0ul, /*value=*/0ul,
51+
/*aux=*/0ul);
52+
return 0;
53+
}

0 commit comments

Comments
 (0)