Re: [posix] 91d57bae08: WARNING:at_kernel/time/hrtimer.c:#hrtimer_forward

[Ye Xiaolong <xiaolong.ye@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 686 bytes --]

On 06/12, Thomas Gleixner wrote:
>On Fri, 9 Jun 2017, kernel test robot wrote:
>> 
>> FYI, we noticed the following commit:
>> 
>> commit: 91d57bae08689199c8acc77a8b3b41150cafab1c ("posix-timers: Make use of forward/remaining callbacks")
>> https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
>> 
>> in testcase: syzkaller
>> with following parameters:
>> 
>> 	cpufreq_governor: performance
>> 	repro_program: repro-d1aff78d.exe
>
>Sigh. I have no clue what repro-d1aff78d.exe is. Could you please provide
>the source for this?

Oops, forgot to add the source code. Please check the attachment.
It is generated by syzkaller.

Thanks,
Xiaolong

>
>Thanks,
>
>	tglx
>

[-- Attachment #2: repro-d1aff78d.c --]
[-- Type: text/x-csrc, Size: 6462 bytes --]

// autogenerated by syzkaller (http://github.com/google/syzkaller)

#ifndef __NR_mmap
#define __NR_mmap 9
#endif
#ifndef __NR_timer_create
#define __NR_timer_create 222
#endif
#ifndef __NR_clock_gettime
#define __NR_clock_gettime 228
#endif
#ifndef __NR_timer_settime
#define __NR_timer_settime 223
#endif
#ifndef __NR_timer_gettime
#define __NR_timer_gettime 224
#endif

#define _GNU_SOURCE 

#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>

#include <linux/capability.h>
#include <linux/if.h>
#include <linux/if_tun.h>
#include <linux/kvm.h>
#include <linux/sched.h>
#include <net/if_arp.h>

#include <assert.h>
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

const int kFailStatus = 67;
const int kErrorStatus = 68;
const int kRetryStatus = 69;

__attribute__((noreturn)) void doexit(int status)
{
	volatile unsigned i;
	syscall(__NR_exit_group, status);
	for (i = 0;; i++) {
	}
}

__attribute__((noreturn)) void fail(const char* msg, ...)
{
	int e = errno;
	fflush(stdout);
	va_list args;
	va_start(args, msg);
	vfprintf(stderr, msg, args);
	va_end(args);
	fprintf(stderr, " (errno %d)\n", e);
	doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus);
}

__attribute__((noreturn)) void exitf(const char* msg, ...)
{
	int e = errno;
	fflush(stdout);
	va_list args;
	va_start(args, msg);
	vfprintf(stderr, msg, args);
	va_end(args);
	fprintf(stderr, " (errno %d)\n", e);
	doexit(kRetryStatus);
}

static int flag_debug;

void debug(const char* msg, ...)
{
	if (!flag_debug)
		return;
	va_list args;
	va_start(args, msg);
	vfprintf(stdout, msg, args);
	va_end(args);
	fflush(stdout);
}

__thread int skip_segv;
__thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* uctx)
{
	uintptr_t addr = (uintptr_t)info->si_addr;
	const uintptr_t prog_start = 1 << 20;
	const uintptr_t prog_end = 100 << 20;
	if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) {
		debug("SIGSEGV on %p, skipping\n", addr);
		_longjmp(segv_env, 1);
	}
	debug("SIGSEGV on %p, exiting\n", addr);
	doexit(sig);
	for (;;) {
	}
}

static void install_segv_handler()
{
	struct sigaction sa;
	memset(&sa, 0, sizeof(sa));
	sa.sa_sigaction = segv_handler;
	sa.sa_flags = SA_NODEFER | SA_SIGINFO;
	sigaction(SIGSEGV, &sa, NULL);
	sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...) { __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); if (_setjmp(segv_env) == 0) { __VA_ARGS__; } __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); }

#define BITMASK_LEN(type,bf_len) (type)((1ull << (bf_len)) - 1)

#define BITMASK_LEN_OFF(type,bf_off,bf_len) (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))

#define STORE_BY_BITMASK(type,addr,val,bf_off,bf_len) if ((bf_off) == 0 && (bf_len) == 0) { *(type*)(addr) = (type)(val); } else { type new_val = *(type*)(addr); new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); *(type*)(addr) = new_val; }

static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8)
{
	switch (nr) {
	default:
		return syscall(nr, a0, a1, a2, a3, a4, a5);
	}
}

static void setup_main_process()
{
	struct sigaction sa;
	memset(&sa, 0, sizeof(sa));
	sa.sa_handler = SIG_IGN;
	syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
	syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
	install_segv_handler();

	char tmpdir_template[] = "./syzkaller.XXXXXX";
	char* tmpdir = mkdtemp(tmpdir_template);
	if (!tmpdir)
		fail("failed to mkdtemp");
	if (chmod(tmpdir, 0777))
		fail("failed to chmod");
	if (chdir(tmpdir))
		fail("failed to chdir");
}

static void loop();

static void sandbox_common()
{
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	setsid();

	struct rlimit rlim;
	rlim.rlim_cur = rlim.rlim_max = 128 << 20;
	setrlimit(RLIMIT_AS, &rlim);
	rlim.rlim_cur = rlim.rlim_max = 1 << 20;
	setrlimit(RLIMIT_FSIZE, &rlim);
	rlim.rlim_cur = rlim.rlim_max = 1 << 20;
	setrlimit(RLIMIT_STACK, &rlim);
	rlim.rlim_cur = rlim.rlim_max = 0;
	setrlimit(RLIMIT_CORE, &rlim);

	unshare(CLONE_NEWNS);
	unshare(CLONE_NEWIPC);
	unshare(CLONE_IO);
}

static int do_sandbox_none(int executor_pid, bool enable_tun)
{
	int pid = fork();
	if (pid)
		return pid;

	sandbox_common();

	loop();
	doexit(1);
}

long r[23];
void loop()
{
	memset(r, -1, sizeof(r));
	r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0x6000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0);
	NONFAILING(*(uint64_t*)0x20001fb0 = (uint64_t)0x0);
	NONFAILING(*(uint32_t*)0x20001fb8 = (uint32_t)0x1);
	NONFAILING(*(uint32_t*)0x20001fbc = (uint32_t)0x0);
	NONFAILING(*(uint64_t*)0x20001fc0 = (uint64_t)0x0);
	NONFAILING(*(uint64_t*)0x20001fc8 = (uint64_t)0x0);
	NONFAILING(*(uint64_t*)0x20001fd0 = (uint64_t)0x4);
	NONFAILING(*(uint64_t*)0x20001fd8 = (uint64_t)0x0);
	NONFAILING(*(uint64_t*)0x20001fe0 = (uint64_t)0x0);
	NONFAILING(*(uint64_t*)0x20001fe8 = (uint64_t)0x0);
	NONFAILING(*(uint64_t*)0x20001ff0 = (uint64_t)0x0);
	NONFAILING(*(uint64_t*)0x20001ff8 = (uint64_t)0x0);
	r[12] = execute_syscall(__NR_timer_create, 0x0ul, 0x20001fb0ul, 0x20000ffcul, 0, 0, 0, 0, 0, 0);
	if (r[12] != -1)
		NONFAILING(r[13] = *(uint32_t*)0x20000ffc);
	r[14] = execute_syscall(__NR_clock_gettime, 0x4ul, 0x20002ff0ul, 0, 0, 0, 0, 0, 0, 0);
	if (r[14] != -1)
		NONFAILING(r[15] = *(uint64_t*)0x20002ff0);
	if (r[14] != -1)
		NONFAILING(r[16] = *(uint64_t*)0x20002ff8);
	NONFAILING(*(uint64_t*)0x20003fe0 = (uint64_t)0x77359400);
	NONFAILING(*(uint64_t*)0x20003fe8 = (uint64_t)0x0);
	NONFAILING(*(uint64_t*)0x20003ff0 = r[15]);
	NONFAILING(*(uint64_t*)0x20003ff8 = r[16]+10000000);
	r[21] = execute_syscall(__NR_timer_settime, r[13], 0x0ul, 0x20003fe0ul, 0x0ul, 0, 0, 0, 0, 0);
	r[22] = execute_syscall(__NR_timer_gettime, r[13], 0x20003000ul, 0, 0, 0, 0, 0, 0, 0);
}
int main()
{
	setup_main_process();
	int pid = do_sandbox_none(0, false);
	int status = 0;
	while (waitpid(pid, &status, __WALL) != pid) {}
	return 0;
}