aboutsummaryrefslogtreecommitdiff
path: root/tools
diff options
context:
space:
mode:
Diffstat (limited to 'tools')
-rw-r--r--tools/test/stress2/misc/all.exclude6
-rwxr-xr-xtools/test/stress2/misc/fuzz.sh6
-rwxr-xr-xtools/test/stress2/misc/syzkaller84.sh402
-rwxr-xr-xtools/test/stress2/misc/syzkaller85.sh499
-rwxr-xr-xtools/test/stress2/misc/syzkaller86.sh555
5 files changed, 1465 insertions, 3 deletions
diff --git a/tools/test/stress2/misc/all.exclude b/tools/test/stress2/misc/all.exclude
index f9b32db95799..0658bfdc0c1b 100644
--- a/tools/test/stress2/misc/all.exclude
+++ b/tools/test/stress2/misc/all.exclude
@@ -25,6 +25,7 @@ gnop13.sh https://people.freebsd.org/~pho/stress/log/log0386.txt 20221113
gnop7.sh Waiting for patch commit 20190820
gnop8.sh Waiting for patch commit 20201214
gnop9.sh Waiting for patch commit 20201214
+graid1_3.sh Hang seen 20250915
graid1_8.sh Known issue 20170909
graid1_9.sh panic: Bad effnlink 20180212
lockf5.sh Spinning threads seen 20160718
@@ -74,10 +75,13 @@ syzkaller67.sh panic: ASan: Invalid access, 8-byte read at ... 20230621
syzkaller80.sh panic 20250711
syzkaller81.sh panic 20250711
syzkaller82.sh panic: m_apply, length > size of mbuf chain 20250724
+syzkaller84.sh panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) 20250810
+syzkaller85.sh panic: Assertion uio->uio_resid < 0 failed 20250928
+syzkaller86.sh Fatal trap 12: page fault while in kernel mode 20251001
+write2.sh panic: sndbuf_acquire: count 255 > free 0 20251003
quota3.sh https://people.freebsd.org/~pho/stress/log/log0604.txt 20250728
quota6.sh https://people.freebsd.org/~pho/stress/log/log0456.txt 20240707
truss3.sh WiP 20200915
-zfs18.sh https://people.freebsd.org/~pho/stress/log/log0560.txt 20241118
zfs9.sh panic: sacked_bytes < 0 20250711
# Test not to run for other reasons:
diff --git a/tools/test/stress2/misc/fuzz.sh b/tools/test/stress2/misc/fuzz.sh
index 189cdbfebd01..add3d0d19a21 100755
--- a/tools/test/stress2/misc/fuzz.sh
+++ b/tools/test/stress2/misc/fuzz.sh
@@ -49,6 +49,7 @@
. ../default.cfg
D=$diskimage
+backup=/tmp/fuzz.sh.diskimage.`date +%Y%m%dT%H%M%S`.gz
tst() {
rm -f $D
@@ -62,6 +63,7 @@ tst() {
for i in `jot 50`; do
./fuzz -n 50 $D
+ gzip < $D > $backup
if fsck -f -y /dev/md$mdstart 2>&1 | egrep "^[A-Z]" > /dev/null; then
if fsck -f -y /dev/md$mdstart 2>&1 | egrep "^[A-Z]" > /dev/null; then
if fsck -f -y /dev/md$mdstart 2>&1 | egrep "^[A-Z]" > /dev/null; then
@@ -73,7 +75,7 @@ tst() {
sync;sync;sync
if mount /dev/md$mdstart $mntpoint; then
ls -l $mntpoint > /dev/null
- find $mntpoint -exec dd if={} of=/dev/null bs=1m count=3 \; > /dev/null 2>&1
+ find $mntpoint -type f -exec dd if={} of=/dev/null bs=1m count=3 \; > /dev/null 2>&1
umount $mntpoint
else
echo "Giving up at loop $i"
@@ -96,7 +98,7 @@ for j in `jot 10`; do
date '+%T'
tst
done
-rm -f fuzz
+rm -f fuzz $backup
exit
diff --git a/tools/test/stress2/misc/syzkaller84.sh b/tools/test/stress2/misc/syzkaller84.sh
new file mode 100755
index 000000000000..a7976be2eeb6
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller84.sh
@@ -0,0 +1,402 @@
+#!/bin/sh
+
+# panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) failed at ../../../kern/uipc_usrreq.c:1549
+# cpuid = 6
+# time = 1754809105
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0176ef6a80
+# vpanic() at vpanic+0x136/frame 0xfffffe0176ef6bb0
+# panic() at panic+0x43/frame 0xfffffe0176ef6c10
+# uipc_soreceive_stream_or_seqpacket() at uipc_soreceive_stream_or_seqpacket+0x968/frame 0xfffffe0176ef6cd0
+# soreceive() at soreceive+0x45/frame 0xfffffe0176ef6cf0
+# kern_recvit() at kern_recvit+0x181/frame 0xfffffe0176ef6da0
+# sys_recvmsg() at sys_recvmsg+0x67/frame 0xfffffe0176ef6e00
+# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0176ef6f30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0176ef6f30
+# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x821d3da8a, rsp = 0x824440f68, rbp = 0x824440f90 ---
+# KDB: enter: panic
+# [ thread pid 17448 tid 292963 ]
+# Stopped at kdb_enter+0x33: movq $0,0x12304a2(%rip)
+# db> x/s version
+# version: FreeBSD 15.0-PRERELEASE #0 main-n279510-db7c0e32a05d-dirty: Sat Aug 9 17:21:54 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=79d6de939eb5c7de69e8e4993b6239aa0ae67335
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+ffcc3612ea266e36604e@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <errno.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static unsigned long long procid;
+
+static void kill_and_wait(int pid, int* status)
+{
+ kill(pid, SIGKILL);
+ while (waitpid(-1, status, 0) != pid) {
+ }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void thread_start(void* (*fn)(void*), void* arg)
+{
+ pthread_t th;
+ pthread_attr_t attr;
+ pthread_attr_init(&attr);
+ pthread_attr_setstacksize(&attr, 128 << 10);
+ int i = 0;
+ for (; i < 100; i++) {
+ if (pthread_create(&th, &attr, fn, arg) == 0) {
+ pthread_attr_destroy(&attr);
+ return;
+ }
+ if (errno == EAGAIN) {
+ usleep(50);
+ continue;
+ }
+ break;
+ }
+ exit(1);
+}
+
+typedef struct {
+ pthread_mutex_t mu;
+ pthread_cond_t cv;
+ int state;
+} event_t;
+
+static void event_init(event_t* ev)
+{
+ if (pthread_mutex_init(&ev->mu, 0))
+ exit(1);
+ if (pthread_cond_init(&ev->cv, 0))
+ exit(1);
+ ev->state = 0;
+}
+
+static void event_reset(event_t* ev)
+{
+ ev->state = 0;
+}
+
+static void event_set(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ if (ev->state)
+ exit(1);
+ ev->state = 1;
+ pthread_mutex_unlock(&ev->mu);
+ pthread_cond_broadcast(&ev->cv);
+}
+
+static void event_wait(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ while (!ev->state)
+ pthread_cond_wait(&ev->cv, &ev->mu);
+ pthread_mutex_unlock(&ev->mu);
+}
+
+static int event_isset(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static int event_timedwait(event_t* ev, uint64_t timeout)
+{
+ uint64_t start = current_time_ms();
+ uint64_t now = start;
+ pthread_mutex_lock(&ev->mu);
+ for (;;) {
+ if (ev->state)
+ break;
+ uint64_t remain = timeout - (now - start);
+ struct timespec ts;
+ ts.tv_sec = remain / 1000;
+ ts.tv_nsec = (remain % 1000) * 1000 * 1000;
+ pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
+ now = current_time_ms();
+ if (now - start > timeout)
+ break;
+ }
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static void sandbox_common()
+{
+ struct rlimit rlim;
+ rlim.rlim_cur = rlim.rlim_max = 128 << 20;
+ setrlimit(RLIMIT_AS, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 8 << 20;
+ setrlimit(RLIMIT_MEMLOCK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_FSIZE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_STACK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 0;
+ setrlimit(RLIMIT_CORE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 256;
+ setrlimit(RLIMIT_NOFILE, &rlim);
+}
+
+static void loop();
+
+static int do_sandbox_none(void)
+{
+ sandbox_common();
+ loop();
+ return 0;
+}
+
+struct thread_t {
+ int created, call;
+ event_t ready, done;
+};
+
+static struct thread_t threads[16];
+static void execute_call(int call);
+static int running;
+
+static void* thr(void* arg)
+{
+ struct thread_t* th = (struct thread_t*)arg;
+ for (;;) {
+ event_wait(&th->ready);
+ event_reset(&th->ready);
+ execute_call(th->call);
+ __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->done);
+ }
+ return 0;
+}
+
+static void execute_one(void)
+{
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ int i, call, thread;
+ for (call = 0; call < 4; call++) {
+ for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
+ thread++) {
+ struct thread_t* th = &threads[thread];
+ if (!th->created) {
+ th->created = 1;
+ event_init(&th->ready);
+ event_init(&th->done);
+ event_set(&th->done);
+ thread_start(thr, th);
+ }
+ if (!event_isset(&th->done))
+ continue;
+ event_reset(&th->done);
+ th->call = call;
+ __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->ready);
+ event_timedwait(&th->done, 50);
+ break;
+ }
+ }
+ for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
+ sleep_ms(1);
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+// int iter = 0;
+ for (;; /*iter++*/) {
+ int pid = fork();
+ if (pid < 0)
+ exit(1);
+ if (pid == 0) {
+ execute_one();
+ exit(0);
+ }
+ int status = 0;
+ uint64_t start = current_time_ms();
+ for (;;) {
+ sleep_ms(10);
+ if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+ break;
+ if (current_time_ms() - start < 5000)
+ continue;
+ kill_and_wait(pid, &status);
+ break;
+ }
+ }
+}
+
+uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
+
+void execute_call(int call)
+{
+ intptr_t res = 0;
+ switch (call) {
+ case 0:
+ // socketpair\$unix arguments: [
+ // domain: const = 0x1 (8 bytes)
+ // type: unix_socket_type = 0x5 (8 bytes)
+ // proto: const = 0x0 (1 bytes)
+ // fds: ptr[out, unix_pair] {
+ // unix_pair {
+ // fd0: sock_unix (resource)
+ // fd1: sock_unix (resource)
+ // }
+ // }
+ // ]
+ res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul,
+ /*proto=*/0, /*fds=*/0x200000000440ul);
+ if (res != -1) {
+ r[0] = *(uint32_t*)0x200000000440;
+ r[1] = *(uint32_t*)0x200000000444;
+ }
+ break;
+ case 1:
+ // sendmsg arguments: [
+ // fd: sock (resource)
+ // msg: ptr[in, send_msghdr] {
+ // send_msghdr {
+ // msg_name: nil
+ // msg_namelen: len = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // msg_iov: nil
+ // msg_iovlen: len = 0x0 (8 bytes)
+ // msg_control: ptr[inout, array[ANYUNION]] {
+ // array[ANYUNION] {
+ // union ANYUNION {
+ // ANYBLOB: buffer: {04 01 00 00 ff ff 00 00 01} (length 0x9)
+ // }
+ // }
+ // }
+ // msg_controllen: bytesize = 0x104 (8 bytes)
+ // msg_flags: const = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // }
+ // }
+ // f: send_flags = 0x0 (8 bytes)
+ // ]
+ *(uint64_t*)0x200000000000 = 0;
+ *(uint32_t*)0x200000000008 = 0;
+ *(uint64_t*)0x200000000010 = 0;
+ *(uint64_t*)0x200000000018 = 0;
+ *(uint64_t*)0x200000000020 = 0x2000000007c0;
+ memcpy((void*)0x2000000007c0, "\x04\x01\x00\x00\xff\xff\x00\x00\x01", 9);
+ *(uint64_t*)0x200000000028 = 0x104;
+ *(uint32_t*)0x200000000030 = 0;
+ syscall(SYS_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000000ul, /*f=*/0ul);
+ for (int i = 0; i < 32; i++) {
+ syscall(SYS_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000000ul, /*f=*/0ul);
+ }
+ break;
+ case 2:
+ // close arguments: [
+ // fd: fd (resource)
+ // ]
+ syscall(SYS_close, /*fd=*/r[1]);
+ break;
+ case 3:
+ // recvmsg arguments: [
+ // fd: sock (resource)
+ // msg: ptr[inout, recv_msghdr] {
+ // recv_msghdr {
+ // msg_name: nil
+ // msg_namelen: len = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // msg_iov: nil
+ // msg_iovlen: len = 0x0 (8 bytes)
+ // msg_control: ptr[out, buffer] {
+ // buffer: (DirOut)
+ // }
+ // msg_controllen: len = 0x19 (8 bytes)
+ // msg_flags: const = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // }
+ // }
+ // f: recv_flags = 0x80 (8 bytes)
+ // ]
+ *(uint64_t*)0x2000000005c0 = 0;
+ *(uint32_t*)0x2000000005c8 = 0;
+ *(uint64_t*)0x2000000005d0 = 0;
+ *(uint64_t*)0x2000000005d8 = 0;
+ *(uint64_t*)0x2000000005e0 = 0x200000000580;
+ *(uint64_t*)0x2000000005e8 = 0x19;
+ *(uint32_t*)0x2000000005f0 = 0;
+ syscall(SYS_recvmsg, /*fd=*/r[0], /*msg=*/0x2000000005c0ul,
+ /*f=MSG_DONTWAIT*/ 0x80ul);
+ break;
+ }
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ for (procid = 0; procid < 4; procid++) {
+ if (fork() == 0) {
+ do_sandbox_none();
+ }
+ }
+ sleep(1000000);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+kldstat | grep -q sctp || { kldload sctp.ko && loaded=1; }
+timeout 3m /tmp/$prog > /dev/null 2>&1
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core $work
+[ $loaded ] && kldunload sctp.ko
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller85.sh b/tools/test/stress2/misc/syzkaller85.sh
new file mode 100755
index 000000000000..1772c0dc58b8
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller85.sh
@@ -0,0 +1,499 @@
+#!/bin/sh
+
+# panic: Assertion uio->uio_resid < 0 failed at ../../../netlink/netlink_domain.c:808
+# cpuid = 8
+# time = 1759044376
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0184d17a70
+# vpanic() at vpanic+0x136/frame 0xfffffe0184d17ba0
+# panic() at panic+0x43/frame 0xfffffe0184d17c00
+# nl_soreceive() at nl_soreceive+0x433/frame 0xfffffe0184d17ca0
+# soreceive() at soreceive+0x45/frame 0xfffffe0184d17cc0
+# kern_recvit() at kern_recvit+0x181/frame 0xfffffe0184d17d70
+# sys_recvfrom() at sys_recvfrom+0xa2/frame 0xfffffe0184d17e00
+# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0184d17f30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0184d17f30
+# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x822882cca, rsp = 0x823572e88, rbp = 0x823572f90 ---
+# KDB: enter: panic
+# [ thread pid 11012 tid 138112 ]
+# Stopped at $0,0x121a722(%rip)
+# db> x/s version
+# version: FreeBSD 16.0-CURRENT #0 main-n280667-52eb7e394a7e-dirty: Sun Sep 28 08:56:14 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=e33cdff88b17af77553159c4b372cac4e4bcd652
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+194f95f2c5fdffef1ef5@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <dirent.h>
+#include <errno.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/resource.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static unsigned long long procid;
+
+static __thread int clone_ongoing;
+static __thread int skip_segv;
+static __thread jmp_buf segv_env;
+
+static void segv_handler(int sig, siginfo_t* info, void* ctx __unused)
+{
+ if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
+ exit(sig);
+ }
+ uintptr_t addr = (uintptr_t)info->si_addr;
+ const uintptr_t prog_start = 1 << 20;
+ const uintptr_t prog_end = 100 << 20;
+ int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
+ int valid = addr < prog_start || addr > prog_end;
+ if (sig == SIGBUS)
+ valid = 1;
+ if (skip && valid) {
+ _longjmp(segv_env, 1);
+ }
+ exit(sig);
+}
+
+static void install_segv_handler(void)
+{
+ struct sigaction sa;
+ memset(&sa, 0, sizeof(sa));
+ sa.sa_sigaction = segv_handler;
+ sa.sa_flags = SA_NODEFER | SA_SIGINFO;
+ sigaction(SIGSEGV, &sa, NULL);
+ sigaction(SIGBUS, &sa, NULL);
+}
+
+#define NONFAILING(...) \
+ ({ \
+ int ok = 1; \
+ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
+ if (_setjmp(segv_env) == 0) { \
+ __VA_ARGS__; \
+ } else \
+ ok = 0; \
+ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
+ ok; \
+ })
+
+static void kill_and_wait(int pid, int* status)
+{
+ kill(pid, SIGKILL);
+ while (waitpid(-1, status, 0) != pid) {
+ }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void use_temporary_dir(void)
+{
+ char tmpdir_template[] = "./syzkaller.XXXXXX";
+ char* tmpdir = mkdtemp(tmpdir_template);
+ if (!tmpdir)
+ exit(1);
+ if (chmod(tmpdir, 0777))
+ exit(1);
+ if (chdir(tmpdir))
+ exit(1);
+}
+
+static void reset_flags(const char* filename)
+{
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE |
+ SF_APPEND | UF_APPEND);
+ if (lchflags(filename, st.st_flags))
+ exit(1);
+}
+static void __attribute__((noinline)) remove_dir(const char* dir)
+{
+ DIR* dp = opendir(dir);
+ if (dp == NULL) {
+ if (errno == EACCES) {
+ if (rmdir(dir))
+ exit(1);
+ return;
+ }
+ exit(1);
+ }
+ struct dirent* ep = 0;
+ while ((ep = readdir(dp))) {
+ if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
+ continue;
+ char filename[FILENAME_MAX];
+ snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ if (S_ISDIR(st.st_mode)) {
+ remove_dir(filename);
+ continue;
+ }
+ if (unlink(filename)) {
+ if (errno == EPERM) {
+ reset_flags(filename);
+ reset_flags(dir);
+ if (unlink(filename) == 0)
+ continue;
+ }
+ exit(1);
+ }
+ }
+ closedir(dp);
+ while (rmdir(dir)) {
+ if (errno == EPERM) {
+ reset_flags(dir);
+ if (rmdir(dir) == 0)
+ break;
+ }
+ exit(1);
+ }
+}
+
+static void thread_start(void* (*fn)(void*), void* arg)
+{
+ pthread_t th;
+ pthread_attr_t attr;
+ pthread_attr_init(&attr);
+ pthread_attr_setstacksize(&attr, 128 << 10);
+ int i = 0;
+ for (; i < 100; i++) {
+ if (pthread_create(&th, &attr, fn, arg) == 0) {
+ pthread_attr_destroy(&attr);
+ return;
+ }
+ if (errno == EAGAIN) {
+ usleep(50);
+ continue;
+ }
+ break;
+ }
+ exit(1);
+}
+
+typedef struct {
+ pthread_mutex_t mu;
+ pthread_cond_t cv;
+ int state;
+} event_t;
+
+static void event_init(event_t* ev)
+{
+ if (pthread_mutex_init(&ev->mu, 0))
+ exit(1);
+ if (pthread_cond_init(&ev->cv, 0))
+ exit(1);
+ ev->state = 0;
+}
+
+static void event_reset(event_t* ev)
+{
+ ev->state = 0;
+}
+
+static void event_set(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ if (ev->state)
+ exit(1);
+ ev->state = 1;
+ pthread_mutex_unlock(&ev->mu);
+ pthread_cond_broadcast(&ev->cv);
+}
+
+static void event_wait(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ while (!ev->state)
+ pthread_cond_wait(&ev->cv, &ev->mu);
+ pthread_mutex_unlock(&ev->mu);
+}
+
+static int event_isset(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static int event_timedwait(event_t* ev, uint64_t timeout)
+{
+ uint64_t start = current_time_ms();
+ uint64_t now = start;
+ pthread_mutex_lock(&ev->mu);
+ for (;;) {
+ if (ev->state)
+ break;
+ uint64_t remain = timeout - (now - start);
+ struct timespec ts;
+ ts.tv_sec = remain / 1000;
+ ts.tv_nsec = (remain % 1000) * 1000 * 1000;
+ pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
+ now = current_time_ms();
+ if (now - start > timeout)
+ break;
+ }
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static void sandbox_common()
+{
+ struct rlimit rlim;
+ rlim.rlim_cur = rlim.rlim_max = 128 << 20;
+ setrlimit(RLIMIT_AS, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 8 << 20;
+ setrlimit(RLIMIT_MEMLOCK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_FSIZE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_STACK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 0;
+ setrlimit(RLIMIT_CORE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 256;
+ setrlimit(RLIMIT_NOFILE, &rlim);
+}
+
+static void loop();
+
+static int do_sandbox_none(void)
+{
+ sandbox_common();
+ loop();
+ return 0;
+}
+
+struct thread_t {
+ int created, call;
+ event_t ready, done;
+};
+
+static struct thread_t threads[16];
+static void execute_call(int call);
+static int running;
+
+static void* thr(void* arg)
+{
+ struct thread_t* th = (struct thread_t*)arg;
+ for (;;) {
+ event_wait(&th->ready);
+ event_reset(&th->ready);
+ execute_call(th->call);
+ __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->done);
+ }
+ return 0;
+}
+
+static void execute_one(void)
+{
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ int i, call, thread;
+ for (call = 0; call < 3; call++) {
+ for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
+ thread++) {
+ struct thread_t* th = &threads[thread];
+ if (!th->created) {
+ th->created = 1;
+ event_init(&th->ready);
+ event_init(&th->done);
+ event_set(&th->done);
+ thread_start(thr, th);
+ }
+ if (!event_isset(&th->done))
+ continue;
+ event_reset(&th->done);
+ th->call = call;
+ __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->ready);
+ event_timedwait(&th->done, 50);
+ break;
+ }
+ }
+ for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
+ sleep_ms(1);
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+ int iter = 0;
+ for (;; iter++) {
+ char cwdbuf[32];
+ sprintf(cwdbuf, "./%d", iter);
+ if (mkdir(cwdbuf, 0777))
+ exit(1);
+ int pid = fork();
+ if (pid < 0)
+ exit(1);
+ if (pid == 0) {
+ if (chdir(cwdbuf))
+ exit(1);
+ execute_one();
+ exit(0);
+ }
+ int status = 0;
+ uint64_t start = current_time_ms();
+ for (;;) {
+ sleep_ms(10);
+ if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+ break;
+ if (current_time_ms() - start < 5000)
+ continue;
+ kill_and_wait(pid, &status);
+ break;
+ }
+ remove_dir(cwdbuf);
+ }
+}
+
+uint64_t r[1] = {0xffffffffffffffff};
+
+void execute_call(int call)
+{
+ intptr_t res = 0;
+ switch (call) {
+ case 0:
+ // socket arguments: [
+ // domain: socket_domain = 0x26 (8 bytes)
+ // type: socket_type = 0x2 (8 bytes)
+ // proto: int8 = 0x0 (1 bytes)
+ // ]
+ // returns sock
+ res = syscall(SYS_socket, /*domain=AF_INET|0x24*/ 0x26ul,
+ /*type=SOCK_DGRAM*/ 2ul, /*proto=*/0);
+ if (res != -1)
+ r[0] = res;
+ break;
+ case 1:
+ // bind arguments: [
+ // fd: sock (resource)
+ // addr: ptr[in, sockaddr_storage] {
+ // union sockaddr_storage {
+ // in6: sockaddr_in6 {
+ // len: len = 0x22 (1 bytes)
+ // family: const = 0x1c (1 bytes)
+ // port: proc = 0x3 (2 bytes)
+ // flow: int32 = 0x0 (4 bytes)
+ // addr: union ipv6_addr {
+ // mcast1: ipv6_addr_multicast1 {
+ // a0: const = 0xff (1 bytes)
+ // a1: const = 0x1 (1 bytes)
+ // a2: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00} (length
+ // 0xd) a3: const = 0x1 (1 bytes)
+ // }
+ // }
+ // scope: int32 = 0x0 (4 bytes)
+ // }
+ // }
+ // }
+ // addrlen: len = 0xc (8 bytes)
+ // ]
+ NONFAILING(*(uint8_t*)0x200000000040 = 0x22);
+ NONFAILING(*(uint8_t*)0x200000000041 = 0x1c);
+ NONFAILING(*(uint16_t*)0x200000000042 = htobe16(0x4e23 + procid * 4));
+ NONFAILING(*(uint32_t*)0x200000000044 = 0);
+ NONFAILING(*(uint8_t*)0x200000000048 = -1);
+ NONFAILING(*(uint8_t*)0x200000000049 = 1);
+ NONFAILING(memset((void*)0x20000000004a, 0, 13));
+ NONFAILING(*(uint8_t*)0x200000000057 = 1);
+ NONFAILING(*(uint32_t*)0x200000000058 = 0);
+ syscall(SYS_bind, /*fd=*/r[0], /*addr=*/0x200000000040ul,
+ /*addrlen=*/0xcul);
+ break;
+ case 2:
+ // recvfrom\$inet arguments: [
+ // fd: sock_in (resource)
+ // buf: nil
+ // len: len = 0x51 (8 bytes)
+ // f: recv_flags = 0x401313ab1a02f21f (8 bytes)
+ // addr: nil
+ // addrlen: len = 0x0 (8 bytes)
+ // ]
+ syscall(SYS_recvfrom, /*fd=*/r[0], /*buf=*/0ul, /*len=*/0x51ul,
+ /*f=MSG_PEEK|MSG_OOB|0x401313ab1a02f21c*/ 0x401313ab1a02f21ful,
+ /*addr=*/0ul, /*addrlen=*/0ul);
+ break;
+ }
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ install_segv_handler();
+ for (procid = 0; procid < 4; procid++) {
+ if (fork() == 0) {
+ use_temporary_dir();
+ do_sandbox_none();
+ }
+ }
+ sleep(1000000);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
+
+(cd ../testcases/swap; ./swap -t 5m -i 20 -l 100 > /dev/null 2>&1) &
+sleep 5
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+
+timeout 5m /tmp/$prog > /dev/null 2>&1
+
+while pkill swap; do :; done
+wait
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/syzkaller.?????? $work
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller86.sh b/tools/test/stress2/misc/syzkaller86.sh
new file mode 100755
index 000000000000..12922a2d05fa
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller86.sh
@@ -0,0 +1,555 @@
+#!/bin/sh
+
+# Fatal trap 12: page fault while in kernel mode
+# cpuid = 1; apic id = 01
+# fault virtual address = 0x18
+# fault code = supervisor read data, page not present
+# instruction pointer = 0x20:0xffffffff80b69835
+# stack pointer = 0x28:0xfffffe00ff8e7d90
+# frame pointer = 0x28:0xfffffe00ff8e7d90
+# code segment = base 0x0, limit 0xfffff, type 0x1b
+# = DPL 0, pres 1, long 1, def32 0, gran 1
+# processor eflags = interrupt enabled, resume, IOPL = 0
+# current process = 0 (thread taskq)
+# rdi: 0000000000000018 rsi: 0000000000000004 rdx: ffffffff812b3f65
+# rcx: 00000000000008ba r8: fffff800044b8780 r9: fffff80003397000
+# rax: 0000000000000001 rbx: fffff8004221fa00 rbp: fffffe00ff8e7d90
+# r10: 0000000000000001 r11: fffffe00dc47b000 r12: fffffe0177ed0000
+# r13: fffff800044b8780 r14: fffff8004221f800 r15: fffff8004221f800
+# trap number = 12
+# panic: page fault
+# cpuid = 1
+# time = 1759322830
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00ff8e7ac0
+# vpanic() at vpanic+0x136/frame 0xfffffe00ff8e7bf0
+# panic() at panic+0x43/frame 0xfffffe00ff8e7c50
+# trap_pfault() at trap_pfault+0x47c/frame 0xfffffe00ff8e7cc0
+# calltrap() at calltrap+0x8/frame 0xfffffe00ff8e7cc0
+# --- trap 0xc, rip = 0xffffffff80b69835, rsp = 0xfffffe00ff8e7d90, rbp = 0xfffffe00ff8e7d90 ---
+# __mtx_assert() at __mtx_assert+0x35/frame 0xfffffe00ff8e7d90
+# ktls_check_rx() at ktls_check_rx+0x2f/frame 0xfffffe00ff8e7dd0
+# socantrcvmore() at socantrcvmore+0x5e/frame 0xfffffe00ff8e7df0
+# unp_gc() at unp_gc+0x5df/frame 0xfffffe00ff8e7e40
+# taskqueue_run_locked() at taskqueue_run_locked+0x1c2/frame 0xfffffe00ff8e7ec0
+# taskqueue_thread_loop() at taskqueue_thread_loop+0xd3/frame 0xfffffe00ff8e7ef0
+# fork_exit() at fork_exit+0x82/frame 0xfffffe00ff8e7f30
+# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00ff8e7f30
+# --- trap 0, rip = 0, rsp = 0, rbp = 0 ---
+# KDB: enter: panic
+# [ thread pid 0 tid 100045 ]
+# Stopped at kdb_enter+0x33: movq $0,0x121a9e2(%rip)
+# db> x/s version
+# version: FreeBSD 16.0-CURRENT #0 vmfqe-n280784-b7f165e45d6d: Wed Oct 1 13:48:43 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/var/tmp/deviant3/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=ec40fe3e3e2b41218d1d417bc10d0be2517bf751
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+a62883292a5c257703be@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <dirent.h>
+#include <errno.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/resource.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static unsigned long long procid;
+
+static void kill_and_wait(int pid, int* status)
+{
+ kill(pid, SIGKILL);
+ while (waitpid(-1, status, 0) != pid) {
+ }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void use_temporary_dir(void)
+{
+ char tmpdir_template[] = "./syzkaller.XXXXXX";
+ char* tmpdir = mkdtemp(tmpdir_template);
+ if (!tmpdir)
+ exit(1);
+ if (chmod(tmpdir, 0777))
+ exit(1);
+ if (chdir(tmpdir))
+ exit(1);
+}
+
+static void reset_flags(const char* filename)
+{
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE |
+ SF_APPEND | UF_APPEND);
+ if (lchflags(filename, st.st_flags))
+ exit(1);
+}
+static void __attribute__((noinline)) remove_dir(const char* dir)
+{
+ DIR* dp = opendir(dir);
+ if (dp == NULL) {
+ if (errno == EACCES) {
+ if (rmdir(dir))
+ exit(1);
+ return;
+ }
+ exit(1);
+ }
+ struct dirent* ep = 0;
+ while ((ep = readdir(dp))) {
+ if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
+ continue;
+ char filename[FILENAME_MAX];
+ snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ if (S_ISDIR(st.st_mode)) {
+ remove_dir(filename);
+ continue;
+ }
+ if (unlink(filename)) {
+ if (errno == EPERM) {
+ reset_flags(filename);
+ reset_flags(dir);
+ if (unlink(filename) == 0)
+ continue;
+ }
+ exit(1);
+ }
+ }
+ closedir(dp);
+ while (rmdir(dir)) {
+ if (errno == EPERM) {
+ reset_flags(dir);
+ if (rmdir(dir) == 0)
+ break;
+ }
+ exit(1);
+ }
+}
+
+static void thread_start(void* (*fn)(void*), void* arg)
+{
+ pthread_t th;
+ pthread_attr_t attr;
+ pthread_attr_init(&attr);
+ pthread_attr_setstacksize(&attr, 128 << 10);
+ int i = 0;
+ for (; i < 100; i++) {
+ if (pthread_create(&th, &attr, fn, arg) == 0) {
+ pthread_attr_destroy(&attr);
+ return;
+ }
+ if (errno == EAGAIN) {
+ usleep(50);
+ continue;
+ }
+ break;
+ }
+ exit(1);
+}
+
+typedef struct {
+ pthread_mutex_t mu;
+ pthread_cond_t cv;
+ int state;
+} event_t;
+
+static void event_init(event_t* ev)
+{
+ if (pthread_mutex_init(&ev->mu, 0))
+ exit(1);
+ if (pthread_cond_init(&ev->cv, 0))
+ exit(1);
+ ev->state = 0;
+}
+
+static void event_reset(event_t* ev)
+{
+ ev->state = 0;
+}
+
+static void event_set(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ if (ev->state)
+ exit(1);
+ ev->state = 1;
+ pthread_mutex_unlock(&ev->mu);
+ pthread_cond_broadcast(&ev->cv);
+}
+
+static void event_wait(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ while (!ev->state)
+ pthread_cond_wait(&ev->cv, &ev->mu);
+ pthread_mutex_unlock(&ev->mu);
+}
+
+static int event_isset(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static int event_timedwait(event_t* ev, uint64_t timeout)
+{
+ uint64_t start = current_time_ms();
+ uint64_t now = start;
+ pthread_mutex_lock(&ev->mu);
+ for (;;) {
+ if (ev->state)
+ break;
+ uint64_t remain = timeout - (now - start);
+ struct timespec ts;
+ ts.tv_sec = remain / 1000;
+ ts.tv_nsec = (remain % 1000) * 1000 * 1000;
+ pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
+ now = current_time_ms();
+ if (now - start > timeout)
+ break;
+ }
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static void sandbox_common()
+{
+ struct rlimit rlim;
+ rlim.rlim_cur = rlim.rlim_max = 128 << 20;
+ setrlimit(RLIMIT_AS, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 8 << 20;
+ setrlimit(RLIMIT_MEMLOCK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_FSIZE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_STACK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 0;
+ setrlimit(RLIMIT_CORE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 256;
+ setrlimit(RLIMIT_NOFILE, &rlim);
+}
+
+static void loop();
+
+static int do_sandbox_none(void)
+{
+ sandbox_common();
+ loop();
+ return 0;
+}
+
+struct thread_t {
+ int created, call;
+ event_t ready, done;
+};
+
+static struct thread_t threads[16];
+static void execute_call(int call);
+static int running;
+
+static void* thr(void* arg)
+{
+ struct thread_t* th = (struct thread_t*)arg;
+ for (;;) {
+ event_wait(&th->ready);
+ event_reset(&th->ready);
+ execute_call(th->call);
+ __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->done);
+ }
+ return 0;
+}
+
+static void execute_one(void)
+{
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ int i, call, thread;
+ for (call = 0; call < 8; call++) {
+ for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
+ thread++) {
+ struct thread_t* th = &threads[thread];
+ if (!th->created) {
+ th->created = 1;
+ event_init(&th->ready);
+ event_init(&th->done);
+ event_set(&th->done);
+ thread_start(thr, th);
+ }
+ if (!event_isset(&th->done))
+ continue;
+ event_reset(&th->done);
+ th->call = call;
+ __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->ready);
+ event_timedwait(&th->done, 50);
+ break;
+ }
+ }
+ for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
+ sleep_ms(1);
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+ int iter = 0;
+ for (;; iter++) {
+ char cwdbuf[32];
+ sprintf(cwdbuf, "./%d", iter);
+ if (mkdir(cwdbuf, 0777))
+ exit(1);
+ int pid = fork();
+ if (pid < 0)
+ exit(1);
+ if (pid == 0) {
+ if (chdir(cwdbuf))
+ exit(1);
+ execute_one();
+ exit(0);
+ }
+ int status = 0;
+ uint64_t start = current_time_ms();
+ for (;;) {
+ sleep_ms(10);
+ if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+ break;
+ if (current_time_ms() - start < 5000)
+ continue;
+ kill_and_wait(pid, &status);
+ break;
+ }
+ remove_dir(cwdbuf);
+ }
+}
+
+uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
+
+void execute_call(int call)
+{
+ intptr_t res = 0;
+ switch (call) {
+ case 0:
+ // freebsd10_pipe arguments: [
+ // pipefd: ptr[out, pipefd] {
+ // pipefd {
+ // rfd: fd (resource)
+ // wfd: fd (resource)
+ // }
+ // }
+ // ]
+ res = syscall(SYS_freebsd10_pipe, /*pipefd=*/0x2000000001c0ul);
+ if (res != -1)
+ r[0] = *(uint32_t*)0x2000000001c4;
+ break;
+ case 1:
+ // close arguments: [
+ // fd: fd (resource)
+ // ]
+ syscall(SYS_close, /*fd=*/r[0]);
+ break;
+ case 2:
+ // socket\$unix arguments: [
+ // domain: const = 0x1 (8 bytes)
+ // type: unix_socket_type = 0x5 (8 bytes)
+ // proto: const = 0x0 (1 bytes)
+ // ]
+ // returns sock_unix
+ res = syscall(SYS_socket, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul,
+ /*proto=*/0);
+ if (res != -1)
+ r[1] = res;
+ break;
+ case 3:
+ // bind\$unix arguments: [
+ // fd: sock_unix (resource)
+ // addr: ptr[in, sockaddr_un] {
+ // union sockaddr_un {
+ // file: sockaddr_un_file {
+ // len: len = 0xa (1 bytes)
+ // family: unix_socket_family = 0x1 (1 bytes)
+ // path: buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
+ // }
+ // }
+ // }
+ // addrlen: len = 0xa (8 bytes)
+ // ]
+ *(uint8_t*)0x2000000002c0 = 0xa;
+ *(uint8_t*)0x2000000002c1 = 1;
+ memcpy((void*)0x2000000002c2, "./file1\000", 8);
+ syscall(SYS_bind, /*fd=*/r[1], /*addr=*/0x2000000002c0ul,
+ /*addrlen=*/0xaul);
+ break;
+ case 4:
+ // listen arguments: [
+ // fd: sock (resource)
+ // backlog: int32 = 0xfffffffe (4 bytes)
+ // ]
+ syscall(SYS_listen, /*fd=*/r[1], /*backlog=*/0xfffffffe);
+ break;
+ case 5:
+ // sendmsg\$unix arguments: [
+ // fd: sock_unix (resource)
+ // msg: ptr[in, msghdr_un] {
+ // msghdr_un {
+ // addr: nil
+ // addrlen: len = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // vec: nil
+ // vlen: len = 0x0 (8 bytes)
+ // ctrl: ptr[inout, array[ANYUNION]] {
+ // array[ANYUNION] {
+ // union ANYUNION {
+ // ANYBLOB: buffer: {89 00 00 00 ff ff 00 00 01} (length 0x9)
+ // }
+ // }
+ // }
+ // ctrllen: bytesize = 0x9 (8 bytes)
+ // f: send_flags = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // }
+ // }
+ // f: send_flags = 0x0 (8 bytes)
+ // ]
+ *(uint64_t*)0x200000000080 = 0;
+ *(uint32_t*)0x200000000088 = 0;
+ *(uint64_t*)0x200000000090 = 0;
+ *(uint64_t*)0x200000000098 = 0;
+ *(uint64_t*)0x2000000000a0 = 0x200000000000;
+ memcpy((void*)0x200000000000, "\x89\x00\x00\x00\xff\xff\x00\x00\x01", 9);
+ *(uint64_t*)0x2000000000a8 = 9;
+ *(uint32_t*)0x2000000000b0 = 0;
+ syscall(SYS_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0x200000000080ul,
+ /*f=*/0ul);
+ break;
+ case 6:
+ // socketpair\$unix arguments: [
+ // domain: const = 0x1 (8 bytes)
+ // type: unix_socket_type = 0x2 (8 bytes)
+ // proto: const = 0x0 (1 bytes)
+ // fds: ptr[out, unix_pair] {
+ // unix_pair {
+ // fd0: sock_unix (resource)
+ // fd1: sock_unix (resource)
+ // }
+ // }
+ // ]
+ res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_DGRAM*/ 2ul,
+ /*proto=*/0, /*fds=*/0x200000000040ul);
+ if (res != -1)
+ r[2] = *(uint32_t*)0x200000000040;
+ break;
+ case 7:
+ // sendmsg arguments: [
+ // fd: sock (resource)
+ // msg: ptr[in, send_msghdr] {
+ // send_msghdr {
+ // msg_name: nil
+ // msg_namelen: len = 0x32c (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // msg_iov: nil
+ // msg_iovlen: len = 0x0 (8 bytes)
+ // msg_control: ptr[in, array[cmsghdr]] {
+ // array[cmsghdr] {
+ // }
+ // }
+ // msg_controllen: bytesize = 0x90 (8 bytes)
+ // msg_flags: const = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // }
+ // }
+ // f: send_flags = 0x0 (8 bytes)
+ // ]
+ *(uint64_t*)0x200000000380 = 0;
+ *(uint32_t*)0x200000000388 = 0x32c;
+ *(uint64_t*)0x200000000390 = 0;
+ *(uint64_t*)0x200000000398 = 0;
+ *(uint64_t*)0x2000000003a0 = 0x200000000000;
+ *(uint64_t*)0x2000000003a8 = 0x90;
+ *(uint32_t*)0x2000000003b0 = 0;
+ syscall(SYS_sendmsg, /*fd=*/r[2], /*msg=*/0x200000000380ul, /*f=*/0ul);
+ break;
+ }
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ for (procid = 0; procid < 4; procid++) {
+ if (fork() == 0) {
+ use_temporary_dir();
+ do_sandbox_none();
+ }
+ }
+ sleep(1000000);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+for i in `jot 30`; do
+ (
+ mkdir d$i
+ cd d$i
+ timeout 3m /tmp/$prog > /dev/null 2>&1 &
+ )
+done
+while pgrep -q $prog; do sleep 2; done
+wait
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core $work
+exit 0
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-05 21:37:24 +0000