Skip to content

Commit

Permalink
test: get rid of x86_64'isms in the test code
Browse files Browse the repository at this point in the history 
Most/all of these are from syzbot. Turn them into regular system calls,
and just let liburing sort out the non-x86 ones.

Fixes: #322
Signed-off-by: Jens Axboe <axboe@kernel.dk>
  • Loading branch information
@axboe
axboe committed Mar 31, 2021
1 parent efa9efe commit 808b6c7
Show file tree
Hide file tree
Showing 11 changed files with 43 additions and 130 deletions.
16 changes: 6 additions & 10 deletions test/35fa71a030ca-test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,9 @@

#include <linux/futex.h>

#include "liburing.h"
#include "../src/syscall.h"

#if !defined(SYS_futex) && defined(SYS_futex_time64)
# define SYS_futex SYS_futex_time64
#endif
Expand Down Expand Up @@ -259,13 +262,6 @@ static void loop(void)
}
}

#ifndef __NR_io_uring_register
#define __NR_io_uring_register 427
#endif
#ifndef __NR_io_uring_setup
#define __NR_io_uring_setup 425
#endif

uint64_t r[1] = {0xffffffffffffffff};

void execute_call(int call)
Expand Down Expand Up @@ -301,15 +297,15 @@ void execute_call(int call)
*(uint32_t*)0x200000a8 = 0;
*(uint32_t*)0x200000ac = 0;
*(uint64_t*)0x200000b0 = 0;
res = syscall(__NR_io_uring_setup, 0x64, 0x20000040);
res = __sys_io_uring_setup(0x64, (struct io_uring_params *) 0x20000040UL);
if (res != -1)
r[0] = res;
break;
case 1:
syscall(__NR_io_uring_register, (long)r[0], 0, 0, 0);
__sys_io_uring_register((long)r[0], 0, 0, 0);
break;
case 2:
syscall(__NR_io_uring_register, (long)r[0], 0, 0, 0);
__sys_io_uring_register((long)r[0], 0, 0, 0);
break;
}
}
Expand Down
8 changes: 3 additions & 5 deletions test/917257daa0fe-test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,12 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <unistd.h>

#ifndef __NR_io_uring_setup
#define __NR_io_uring_setup 425
#endif
#include "liburing.h"
#include "../src/syscall.h"

int main(int argc, char *argv[])
{
Expand Down Expand Up @@ -50,6 +48,6 @@ int main(int argc, char *argv[])
*(uint32_t*)0x20000068 = 0;
*(uint32_t*)0x2000006c = 0;
*(uint64_t*)0x20000070 = 0;
syscall(__NR_io_uring_setup, 0x7a6, 0x20000000);
__sys_io_uring_setup(0x7a6, (struct io_uring_params *) 0x20000000UL);
return 0;
}
13 changes: 4 additions & 9 deletions test/a0908ae19763-test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,17 +6,12 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <unistd.h>

#ifndef __NR_io_uring_register
#define __NR_io_uring_register 427
#endif
#ifndef __NR_io_uring_setup
#define __NR_io_uring_setup 425
#endif
#include "liburing.h"
#include "../src/syscall.h"

uint64_t r[1] = {0xffffffffffffffff};

Expand Down Expand Up @@ -54,10 +49,10 @@ int main(int argc, char *argv[])
*(uint32_t*)0x200000e8 = 0;
*(uint32_t*)0x200000ec = 0;
*(uint64_t*)0x200000f0 = 0;
res = syscall(__NR_io_uring_setup, 0xa4, 0x20000080);
res = __sys_io_uring_setup(0xa4, (struct io_uring_params *) 0x20000080);
if (res != -1)
r[0] = res;
*(uint32_t*)0x20000280 = -1;
syscall(__NR_io_uring_register, r[0], 2, 0x20000280, 1);
__sys_io_uring_register(r[0], 2, (const void *) 0x20000280, 1);
return 0;
}
10 changes: 4 additions & 6 deletions test/a4c0b3decb33-test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,15 @@
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/mman.h>
#include <time.h>
#include <unistd.h>

#include "liburing.h"
#include "../src/syscall.h"

static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
Expand Down Expand Up @@ -129,10 +131,6 @@ static void loop(void)
}
}

#ifndef __NR_io_uring_setup
#define __NR_io_uring_setup 425
#endif

void execute_one(void)
{
*(uint32_t*)0x20000080 = 0;
Expand Down Expand Up @@ -163,7 +161,7 @@ void execute_one(void)
*(uint32_t*)0x200000e8 = 0;
*(uint32_t*)0x200000ec = 0;
*(uint64_t*)0x200000f0 = 0;
syscall(__NR_io_uring_setup, 0x983, 0x20000080);
__sys_io_uring_setup(0x983, (struct io_uring_params *) 0x20000080);
}

static void sig_int(int sig)
Expand Down
1 change: 0 additions & 1 deletion test/accept-reuse.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <syscall.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>
Expand Down
8 changes: 3 additions & 5 deletions test/b19062a56726-test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,12 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <unistd.h>

#ifndef __NR_io_uring_setup
#define __NR_io_uring_setup 425
#endif
#include "liburing.h"
#include "../src/syscall.h"

int main(int argc, char *argv[])
{
Expand Down Expand Up @@ -50,6 +48,6 @@ int main(int argc, char *argv[])
*(uint32_t*)0x20000268 = 0;
*(uint32_t*)0x2000026c = 0;
*(uint64_t*)0x20000270 = 0;
syscall(__NR_io_uring_setup, 0xc9f, 0x20000200);
__sys_io_uring_setup(0xc9f, (struct io_uring_params *) 0x20000200);
return 0;
}
55 changes: 10 additions & 45 deletions test/double-poll-crash.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,13 @@
#include <string.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <unistd.h>

#include "liburing.h"
#include "../src/syscall.h"

#define SIZEOF_IO_URING_SQE 64
#define SIZEOF_IO_URING_CQE 16
#define SQ_HEAD_OFFSET 0
Expand All @@ -29,44 +32,6 @@
#define CQ_FLAGS_OFFSET 280
#define CQ_CQES_OFFSET 320

struct io_sqring_offsets {
uint32_t head;
uint32_t tail;
uint32_t ring_mask;
uint32_t ring_entries;
uint32_t flags;
uint32_t dropped;
uint32_t array;
uint32_t resv1;
uint64_t resv2;
};

struct io_cqring_offsets {
uint32_t head;
uint32_t tail;
uint32_t ring_mask;
uint32_t ring_entries;
uint32_t overflow;
uint32_t cqes;
uint64_t resv[2];
};

struct io_uring_params {
uint32_t sq_entries;
uint32_t cq_entries;
uint32_t flags;
uint32_t sq_thread_cpu;
uint32_t sq_thread_idle;
uint32_t features;
uint32_t resv[4];
struct io_sqring_offsets sq_off;
struct io_cqring_offsets cq_off;
};

#define IORING_OFF_SQ_RING 0
#define IORING_OFF_SQES 0x10000000ULL

#define __NR_io_uring_setup 425
static long syz_io_uring_setup(volatile long a0, volatile long a1,
volatile long a2, volatile long a3,
volatile long a4, volatile long a5)
Expand All @@ -77,7 +42,7 @@ static long syz_io_uring_setup(volatile long a0, volatile long a1,
void* vma2 = (void*)a3;
void** ring_ptr_out = (void**)a4;
void** sqes_ptr_out = (void**)a5;
uint32_t fd_io_uring = syscall(__NR_io_uring_setup, entries, setup_params);
uint32_t fd_io_uring = __sys_io_uring_setup(entries, setup_params);
uint32_t sq_ring_sz =
setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
uint32_t cq_ring_sz = setup_params->cq_off.cqes +
Expand Down Expand Up @@ -150,9 +115,9 @@ int main(int argc, char *argv[])
if (argc > 1)
return 0;

syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
mmap((void *)0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
mmap((void *)0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
mmap((void *)0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
intptr_t res = 0;
*(uint32_t*)0x20000484 = 0;
*(uint32_t*)0x20000488 = 0;
Expand Down Expand Up @@ -207,7 +172,7 @@ int main(int argc, char *argv[])
*(uint8_t*)0x2000003e = 0;
*(uint8_t*)0x2000003f = 0;
syz_io_uring_submit(r[1], r[2], 0x20000000, 0);
syscall(__NR_io_uring_enter, r[0], 0x20450c, 0, 0ul, 0ul, 0ul);
__sys_io_uring_enter(r[0], 0x20450c, 0, 0ul, 0ul);
*(uint32_t*)0x20000080 = 0x7ff;
*(uint32_t*)0x20000084 = 0x8b7;
*(uint32_t*)0x20000088 = 3;
Expand All @@ -216,6 +181,6 @@ int main(int argc, char *argv[])
memcpy((void*)0x20000091, "\xaf\x09\x01\xbc\xf9\xc6\xe4\x92\x86\x51\x7d\x7f"
"\xbd\x43\x7d\x16\x69\x3e\x05",
19);
syscall(__NR_ioctl, r[3], 0x5404, 0x20000080ul);
ioctl(r[3], 0x5404, 0x20000080ul);
return 0;
}
10 changes: 6 additions & 4 deletions test/fc2a85cb02ef-test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,13 @@
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <unistd.h>

#include "liburing.h"
#include "../src/syscall.h"

static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
Expand Down Expand Up @@ -123,14 +125,14 @@ int main(int argc, char *argv[])
*(uint32_t*)0x20000068 = 0;
*(uint32_t*)0x2000006c = 0;
*(uint64_t*)0x20000070 = 0;
res = syscall(__NR_io_uring_setup, 0x6a6, 0x20000000ul);
res = __sys_io_uring_setup(0x6a6, (struct io_uring_params *) 0x20000000ul);
if (res != -1)
r[0] = res;
res = syscall(__NR_socket, 0x11ul, 2ul, 0x300ul);
res = socket(0x11ul, 2ul, 0x300ul);
if (res != -1)
r[1] = res;
*(uint32_t*)0x20000080 = r[1];
inject_fault(1);
syscall(__NR_io_uring_register, r[0], 2ul, 0x20000080ul, 1ul);
__sys_io_uring_register(r[0], 2ul, (const void *) 0x20000080ul, 1ul);
return 0;
}
1 change: 0 additions & 1 deletion test/sendmsg_fs_cve.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@
*/

#include <unistd.h>
#include <syscall.h>
#include <stdio.h>
#include <sys/mman.h>
#include <sys/socket.h>
Expand Down
50 changes: 7 additions & 43 deletions test/sqpoll-disable-exit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,14 @@
#include <sys/mman.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include "liburing.h"
#include "../src/syscall.h"

static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
Expand Down Expand Up @@ -72,44 +74,6 @@ static bool write_file(const char* file, const char* what, ...)
#define CQ_FLAGS_OFFSET 280
#define CQ_CQES_OFFSET 320

struct io_sqring_offsets {
uint32_t head;
uint32_t tail;
uint32_t ring_mask;
uint32_t ring_entries;
uint32_t flags;
uint32_t dropped;
uint32_t array;
uint32_t resv1;
uint64_t resv2;
};

struct io_cqring_offsets {
uint32_t head;
uint32_t tail;
uint32_t ring_mask;
uint32_t ring_entries;
uint32_t overflow;
uint32_t cqes;
uint64_t resv[2];
};

struct io_uring_params {
uint32_t sq_entries;
uint32_t cq_entries;
uint32_t flags;
uint32_t sq_thread_cpu;
uint32_t sq_thread_idle;
uint32_t features;
uint32_t resv[4];
struct io_sqring_offsets sq_off;
struct io_cqring_offsets cq_off;
};

#define IORING_OFF_SQ_RING 0
#define IORING_OFF_SQES 0x10000000ULL

#define sys_io_uring_setup 425
static long syz_io_uring_setup(volatile long a0, volatile long a1,
volatile long a2, volatile long a3,
volatile long a4, volatile long a5)
Expand All @@ -120,7 +84,7 @@ static long syz_io_uring_setup(volatile long a0, volatile long a1,
void* vma2 = (void*)a3;
void** ring_ptr_out = (void**)a4;
void** sqes_ptr_out = (void**)a5;
uint32_t fd_io_uring = syscall(sys_io_uring_setup, entries, setup_params);
uint32_t fd_io_uring = __sys_io_uring_setup(entries, setup_params);
uint32_t sq_ring_sz =
setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
uint32_t cq_ring_sz = setup_params->cq_off.cqes +
Expand Down Expand Up @@ -223,9 +187,9 @@ void execute_one(void)
}
int main(void)
{
syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
mmap((void *)0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
mmap((void *)0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
mmap((void *)0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
loop();
return 0;
}

0 comments on commit 808b6c7

Please sign in to comment.