int main(void) { tprintf("%s", ""); int fds[2]; if (pipe(fds)) perror_msg_and_fail("pipe"); assert(0 == fds[0]); assert(1 == fds[1]); static const char w0_c[] = "012"; const char *w0_d = hexdump_strdup(w0_c); void *w0 = tail_memdup(w0_c, LENGTH_OF(w0_c)); static const char w1_c[] = "34567"; const char *w1_d = hexdump_strdup(w1_c); void *w1 = tail_memdup(w1_c, LENGTH_OF(w1_c)); static const char w2_c[] = "89abcde"; const char *w2_d = hexdump_strdup(w2_c); void *w2 = tail_memdup(w2_c, LENGTH_OF(w2_c)); const struct iovec iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1,
int main(void) { tprintf("%s", ""); int fds[2]; if (socketpair(AF_UNIX, SOCK_STREAM, 0, fds)) perror_msg_and_skip("socketpair"); assert(0 == fds[0]); assert(1 == fds[1]); static const char w0_c[] = "012"; const char *w0_d = hexdump_strdup(w0_c); void *w0 = tail_memdup(w0_c, LENGTH_OF(w0_c)); static const char w1_c[] = "34567"; const char *w1_d = hexdump_strdup(w1_c); void *w1 = tail_memdup(w1_c, LENGTH_OF(w1_c)); static const char w2_c[] = "89abcde"; const char *w2_d = hexdump_strdup(w2_c); void *w2 = tail_memdup(w2_c, LENGTH_OF(w2_c)); static const char r0_c[] = "01234567"; const char *r0_d = hexdump_strdup(r0_c); static const char r1_c[] = "89abcde"; const char *r1_d = hexdump_strdup(r1_c); const struct iovec w_iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1,
int main(void) { tprintf("%s", ""); static char tmp[] = "preadv-pwritev-tmpfile"; if (open(tmp, O_CREAT|O_RDONLY|O_TRUNC, 0600) != 0) perror_msg_and_fail("creat: %s", tmp); if (open(tmp, O_WRONLY) != 1) perror_msg_and_fail("open: %s", tmp); if (unlink(tmp)) perror_msg_and_fail("unlink: %s", tmp); static const char w0_c[] = "012"; const char *w0_d = hexdump_strdup(w0_c); void *w0 = tail_memdup(w0_c, LENGTH_OF(w0_c)); const void *efault = w0 + LENGTH_OF(w0_c); static const char w1_c[] = "34567"; const char *w1_d = hexdump_strdup(w1_c); void *w1 = tail_memdup(w1_c, LENGTH_OF(w1_c)); static const char w2_c[] = "89abcde"; const char *w2_d = hexdump_strdup(w2_c); void *w2 = tail_memdup(w2_c, LENGTH_OF(w2_c)); long rc; rc = pwritev(1, efault, 42, 0); tprintf("pwritev(1, %p, 42, 0) = %ld %s (%m)\n", efault, rc, errno2name()); rc = preadv(0, efault, 42, 0); tprintf("preadv(0, %p, 42, 0) = %ld %s (%m)\n", efault, rc, errno2name()); static const char r0_c[] = "01234567"; const char *r0_d = hexdump_strdup(r0_c); static const char r1_c[] = "89abcde"; const char *r1_d = hexdump_strdup(r1_c); const struct iovec w_iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1,
int main(void) { const char * const fname = tail_memdup(LINKPATH, sizeof(LINKPATH)); const char * const hex_fname = hexquote_strndup(fname, sizeof(LINKPATH) - 1); const unsigned int size = sizeof(TARGET) - 1; char * const buf = tail_alloc(size); (void) unlink(fname); long rc = syscall(__NR_readlink, fname, buf, size); printf("readlink(\"%s\", %p, %u) = -1 ENOENT (%m)\n", hex_fname, buf, size); if (symlink(TARGET, fname)) perror_msg_and_fail("symlink"); rc = syscall(__NR_readlink, fname, buf, size); if (rc < 0) { perror("readlink"); (void) unlink(fname); return 77; } const char * const hex_buf = hexquote_strndup(buf, size); printf("readlink(\"%s\", \"%s\", %u) = %u\n", hex_fname, hex_buf, size, size); if (unlink(fname)) perror_msg_and_fail("unlink"); puts("+++ exited with 0 +++"); return 0; }
int main(void) { tprintf("%s", ""); int fds[2]; if (pipe(fds)) perror_msg_and_fail("pipe"); assert(0 == fds[0]); assert(1 == fds[1]); static const char w0_c[] = "012"; const char *w0_d = hexdump_strdup(w0_c); void *w0 = tail_memdup(w0_c, LENGTH_OF(w0_c)); const void *efault = w0 + LENGTH_OF(w0_c); static const char w1_c[] = "34567"; const char *w1_d = hexdump_strdup(w1_c); void *w1 = tail_memdup(w1_c, LENGTH_OF(w1_c)); static const char w2_c[] = "89abcde"; const char *w2_d = hexdump_strdup(w2_c); void *w2 = tail_memdup(w2_c, LENGTH_OF(w2_c)); assert(writev(1, efault, 42) == -1); tprintf("writev(1, [%p], 42) = -1 EFAULT (%m)\n", efault); assert(readv(0, efault, 42) == -1); tprintf("readv(0, %p, 42) = -1 EFAULT (%m)\n", efault); static const char r0_c[] = "01234567"; const char *r0_d = hexdump_strdup(r0_c); static const char r1_c[] = "89abcde"; const char *r1_d = hexdump_strdup(r1_c); const struct iovec w_iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1,
static void init_BPF_PROG_QUERY_attr5(struct bpf_attr_check *check) { struct BPF_PROG_QUERY_struct *attr = &check->data.BPF_PROG_QUERY_data; if (!prog_load_ids_ptr) prog_load_ids_ptr = tail_memdup(prog_load_ids, sizeof(prog_load_ids)); attr->prog_ids = (uintptr_t) prog_load_ids_ptr; attr->prog_cnt = ARRAY_SIZE(prog_load_ids) + 1; }
static void dumpio(void) { static char tmp[] = "preadv2-pwritev2-tmpfile"; if (open(tmp, O_CREAT|O_RDONLY|O_TRUNC, 0600) != 0) perror_msg_and_fail("creat: %s", tmp); if (open(tmp, O_WRONLY) != 1) perror_msg_and_fail("open: %s", tmp); if (unlink(tmp)) perror_msg_and_fail("unlink: %s", tmp); static const char w0_c[] = "012"; const char *w0_d = hexdump_strdup(w0_c); void *w0 = tail_memdup(w0_c, LENGTH_OF(w0_c)); static const char w1_c[] = "34567"; const char *w1_d = hexdump_strdup(w1_c); void *w1 = tail_memdup(w1_c, LENGTH_OF(w1_c)); static const char w2_c[] = "89abcde"; const char *w2_d = hexdump_strdup(w2_c); void *w2 = tail_memdup(w2_c, LENGTH_OF(w2_c)); long rc; static const char r0_c[] = "01234567"; const char *r0_d = hexdump_strdup(r0_c); static const char r1_c[] = "89abcde"; const char *r1_d = hexdump_strdup(r1_c); const struct iovec w_iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1,
int main(void) { static const char name[] = "strace.test"; static const char c_value[] = "foobar"; const char *const z_value = tail_memdup(c_value, sizeof(c_value)); long rc; rc = fsetxattr(-1, name, z_value, sizeof(c_value), XATTR_REPLACE); printf("fsetxattr(-1, \"%.*s\"..., \"%.*s\"..., %u, XATTR_REPLACE) = %s\n", 4, name, 4, c_value, (unsigned) sizeof(c_value), sprintrc(rc)); puts("+++ exited with 0 +++"); return 0; }
int main(void) { if (F8ILL_KULONG_SUPPORTED) { const void *const p = tail_memdup(".", 2); long rc = syscall(__NR_chdir, p); printf("chdir(\".\") = %s\n", sprintrc(rc)); const kernel_ulong_t ill = f8ill_ptr_to_kulong(p); rc = syscall(__NR_chdir, ill); printf("chdir(%#llx) = %s\n", (unsigned long long) ill, sprintrc(rc)); puts("+++ exited with 0 +++"); return 0; } else { return 77; } }
int main(int ac, const char **av) { assert(ac == 2); struct sockaddr_un addr = { .sun_family = AF_UNIX }; unsigned int sun_path_len = strlen(av[1]); assert(sun_path_len > 0 && sun_path_len <= sizeof(addr.sun_path)); strncpy(addr.sun_path, av[1], sizeof(addr.sun_path)); struct sockaddr * const listen_sa = tail_memdup(&addr, sizeof(addr)); socklen_t * const len = tail_alloc(sizeof(socklen_t)); *len = offsetof(struct sockaddr_un, sun_path) + strlen(av[1]) + 1; if (*len > sizeof(addr)) *len = sizeof(addr); int listen_fd = socket(PF_LOCAL, SOCK_STREAM, 0); if (listen_fd < 0) perror_msg_and_skip("socket"); unsigned long listen_inode = inode_of_sockfd(listen_fd); printf("socket(PF_LOCAL, SOCK_STREAM, 0) = %d<socket:[%lu]>\n", listen_fd, listen_inode); (void) unlink(av[1]); if (bind(listen_fd, listen_sa, *len)) perror_msg_and_skip("bind"); printf("bind(%d<socket:[%lu]>, {sa_family=AF_LOCAL, sun_path=\"%s\"}" ", %u) = 0\n", listen_fd, listen_inode, av[1], (unsigned) *len); if (listen(listen_fd, 1)) perror_msg_and_skip("listen"); printf("listen(%d<socket:[%lu]>, 1) = 0\n", listen_fd, listen_inode); unsigned int * const optval = tail_alloc(sizeof(unsigned int)); *len = sizeof(*optval); if (getsockopt(listen_fd, SOL_SOCKET, SO_PASSCRED, optval, len)) perror_msg_and_fail("getsockopt"); printf("getsockopt(%d<socket:[%lu]>, SOL_SOCKET, SO_PASSCRED" ", [%u], [%u]) = 0\n", listen_fd, listen_inode, *optval, (unsigned) *len); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getsockname(listen_fd, listen_sa, len)) perror_msg_and_fail("getsockname"); printf("getsockname(%d<socket:[%lu]>, {sa_family=AF_LOCAL" ", sun_path=\"%s\"}, [%u]) = 0\n", listen_fd, listen_inode, av[1], (unsigned) *len); int connect_fd = socket(PF_LOCAL, SOCK_STREAM, 0); if (connect_fd < 0) perror_msg_and_fail("socket"); unsigned long connect_inode = inode_of_sockfd(connect_fd); printf("socket(PF_LOCAL, SOCK_STREAM, 0) = %d<socket:[%lu]>\n", connect_fd, connect_inode); if (connect(connect_fd, listen_sa, *len)) perror_msg_and_fail("connect"); printf("connect(%d<socket:[%lu]>, {sa_family=AF_LOCAL" ", sun_path=\"%s\"}, %u) = 0\n", connect_fd, connect_inode, av[1], (unsigned) *len); struct sockaddr * const accept_sa = tail_alloc(sizeof(addr)); memset(accept_sa, 0, sizeof(addr)); *len = sizeof(addr); int accept_fd = accept(listen_fd, accept_sa, len); if (accept_fd < 0) perror_msg_and_fail("accept"); unsigned long accept_inode = inode_of_sockfd(accept_fd); printf("accept(%d<socket:[%lu]>, {sa_family=AF_LOCAL, NULL}" ", [%u]) = %d<socket:[%lu]>\n", listen_fd, listen_inode, (unsigned) *len, accept_fd, accept_inode); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getpeername(connect_fd, listen_sa, len)) perror_msg_and_fail("getpeername"); printf("getpeername(%d<socket:[%lu]>, {sa_family=AF_LOCAL" ", sun_path=\"%s\"}, [%u]) = 0\n", connect_fd, connect_inode, av[1], (unsigned) *len); char text[] = "text"; assert(sendto(connect_fd, text, sizeof(text) - 1, MSG_DONTWAIT, NULL, 0) == sizeof(text) - 1); printf("sendto(%d<socket:[%lu]>, \"%s\", %u, MSG_DONTWAIT" ", NULL, 0) = %u\n", connect_fd, connect_inode, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(connect_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", connect_fd, connect_inode); assert(recvfrom(accept_fd, text, sizeof(text) - 1, MSG_DONTWAIT, NULL, NULL) == sizeof(text) - 1); printf("recvfrom(%d<socket:[%lu]>, \"%s\", %u, MSG_DONTWAIT" ", NULL, NULL) = %u\n", accept_fd, accept_inode, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(accept_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", accept_fd, accept_inode); connect_fd = socket(PF_LOCAL, SOCK_STREAM, 0); if (connect_fd < 0) perror_msg_and_fail("socket"); connect_inode = inode_of_sockfd(connect_fd); printf("socket(PF_LOCAL, SOCK_STREAM, 0) = %d<socket:[%lu]>\n", connect_fd, connect_inode); *optval = 1; *len = sizeof(*optval); if (setsockopt(connect_fd, SOL_SOCKET, SO_PASSCRED, optval, *len)) perror_msg_and_fail("setsockopt"); printf("setsockopt(%d<socket:[%lu]>, SOL_SOCKET, SO_PASSCRED" ", [%u], %u) = 0\n", connect_fd, connect_inode, *optval, (unsigned) *len); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getsockname(listen_fd, listen_sa, len)) perror_msg_and_fail("getsockname"); printf("getsockname(%d<socket:[%lu]>, {sa_family=AF_LOCAL" ", sun_path=\"%s\"}, [%u]) = 0\n", listen_fd, listen_inode, av[1], (unsigned) *len); if (connect(connect_fd, listen_sa, *len)) perror_msg_and_fail("connect"); printf("connect(%d<socket:[%lu]>, {sa_family=AF_LOCAL" ", sun_path=\"%s\"}, %u) = 0\n", connect_fd, connect_inode, av[1], (unsigned) *len); memset(accept_sa, 0, sizeof(addr)); *len = sizeof(addr); accept_fd = accept(listen_fd, accept_sa, len); if (accept_fd < 0) perror_msg_and_fail("accept"); accept_inode = inode_of_sockfd(accept_fd); const char * const sun_path1 = ((struct sockaddr_un *) accept_sa) -> sun_path + 1; printf("accept(%d<socket:[%lu]>, {sa_family=AF_LOCAL" ", sun_path=@\"%s\"}, [%u]) = %d<socket:[%lu]>\n", listen_fd, listen_inode, sun_path1, (unsigned) *len, accept_fd, accept_inode); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getpeername(connect_fd, listen_sa, len)) perror_msg_and_fail("getpeername"); printf("getpeername(%d<socket:[%lu]>, {sa_family=AF_LOCAL" ", sun_path=\"%s\"}, [%u]) = 0\n", connect_fd, connect_inode, av[1], (unsigned) *len); memset(accept_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getsockname(connect_fd, accept_sa, len)) perror_msg_and_fail("getsockname"); printf("getsockname(%d<socket:[%lu]>, {sa_family=AF_LOCAL" ", sun_path=@\"%s\"}, [%u]) = 0\n", connect_fd, connect_inode, sun_path1, (unsigned) *len); assert(sendto(connect_fd, text, sizeof(text) - 1, MSG_DONTWAIT, NULL, 0) == sizeof(text) - 1); printf("sendto(%d<socket:[%lu]>, \"%s\", %u, MSG_DONTWAIT" ", NULL, 0) = %u\n", connect_fd, connect_inode, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(connect_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", connect_fd, connect_inode); assert(recvfrom(accept_fd, text, sizeof(text) - 1, MSG_DONTWAIT, NULL, NULL) == sizeof(text) - 1); printf("recvfrom(%d<socket:[%lu]>, \"%s\", %u, MSG_DONTWAIT" ", NULL, NULL) = %u\n", accept_fd, accept_inode, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(accept_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", accept_fd, accept_inode); assert(unlink(av[1]) == 0); assert(close(listen_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", listen_fd, listen_inode); puts("+++ exited with 0 +++"); return 0; }
int main(void) { static const kernel_ulong_t bogus_fd = (kernel_ulong_t) 0xbadc0deddeadbeef; static const kernel_ulong_t kfdcwd = (kernel_ulong_t) 0xdefaced00000000 | -100U; static const char proto_fname[] = "utimensat\nfilename"; static const char qname[] = "\"utimensat\\nfilename\""; char *const fname = tail_memdup(proto_fname, sizeof(proto_fname)); const kernel_ulong_t kfname = (uintptr_t) fname; struct timespec *const ts = tail_alloc(sizeof(*ts) * 2); (void) close(0); /* dirfd */ k_utimensat(0, kfname, 0, 0); printf("utimensat(0, %s, NULL, 0) = %s\n", qname, errstr); k_utimensat(bogus_fd, kfname, 0, 0); printf("utimensat(%d, %s, NULL, 0) = %s\n", (int) bogus_fd, qname, errstr); k_utimensat(-100U, kfname, 0, 0); printf("utimensat(" str_at_fdcwd ", %s, NULL, 0) = %s\n", qname, errstr); k_utimensat(kfdcwd, kfname, 0, 0); printf("utimensat(" str_at_fdcwd ", %s, NULL, 0) = %s\n", qname, errstr); /* pathname */ k_utimensat(kfdcwd, 0, 0, 0); printf("utimensat(" str_at_fdcwd ", NULL, NULL, 0) = %s\n", errstr); k_utimensat(kfdcwd, kfname + sizeof(proto_fname) - 1, 0, 0); printf("utimensat(" str_at_fdcwd ", \"\", NULL, 0) = %s\n", errstr); fname[sizeof(proto_fname) - 1] = '+'; k_utimensat(kfdcwd, kfname, 0, 0); fname[sizeof(proto_fname) - 1] = '\0'; printf("utimensat(" str_at_fdcwd ", %p, NULL, 0) = %s\n", fname, errstr); if (F8ILL_KULONG_SUPPORTED) { k_utimensat(kfdcwd, f8ill_ptr_to_kulong(fname), 0, 0); printf("utimensat(" str_at_fdcwd ", %#jx, NULL, 0) = %s\n", (uintmax_t) f8ill_ptr_to_kulong(fname), errstr); } /* times */ k_utimensat(kfdcwd, kfname, (uintptr_t) (ts + 1), 0); printf("utimensat(" str_at_fdcwd ", %s, %p, 0) = %s\n", qname, ts + 1, errstr); k_utimensat(kfdcwd, kfname, (uintptr_t) (ts + 2), 0); printf("utimensat(" str_at_fdcwd ", %s, %p, 0)" " = %s\n", qname, ts + 2, errstr); ts[0].tv_sec = 1492358706; ts[0].tv_nsec = 123456789; ts[1].tv_sec = 1492357068; ts[1].tv_nsec = 234567890; k_utimensat(kfdcwd, kfname, (uintptr_t) ts, 0x100); printf("utimensat(" str_at_fdcwd ", %s, [", qname); print_ts(&ts[0]); printf(", "); print_ts(&ts[1]); printf("], " str_at_symlink_nofollow ") = %s\n", errstr); ts[0].tv_sec = -1; ts[0].tv_nsec = 2000000000; ts[1].tv_sec = (time_t) -0x100000001LL; ts[1].tv_nsec = 2345678900U; k_utimensat(kfdcwd, kfname, (uintptr_t) ts, 0x100); printf("utimensat(" str_at_fdcwd ", %s, [", qname); print_ts(&ts[0]); printf(", "); print_ts(&ts[1]); printf("], " str_at_symlink_nofollow ") = %s\n", errstr); ts[0].tv_sec = 0; ts[0].tv_nsec = 0; ts[1].tv_sec = (time_t) 0xcafef00ddeadbeefLL; ts[1].tv_nsec = 0; k_utimensat(kfdcwd, kfname, (uintptr_t) ts, 0x100); printf("utimensat(" str_at_fdcwd ", %s, [", qname); print_ts(&ts[0]); printf(", "); print_ts(&ts[1]); printf("], " str_at_symlink_nofollow ") = %s\n", errstr); ts[0].tv_sec = 0xdeadbeefU; ts[0].tv_nsec = 0xfacefeedU; ts[1].tv_sec = (time_t) 0xcafef00ddeadbeefLL; ts[1].tv_nsec = (long) 0xbadc0dedfacefeedLL; k_utimensat(kfdcwd, kfname, (uintptr_t) ts, 0x100); printf("utimensat(" str_at_fdcwd ", %s, [", qname); print_ts(&ts[0]); printf(", "); print_ts(&ts[1]); printf("], " str_at_symlink_nofollow ") = %s\n", errstr); ts[0].tv_nsec = UTIME_NOW; ts[1].tv_nsec = UTIME_OMIT; k_utimensat(kfdcwd, kfname, (uintptr_t) ts, 0x100); printf("utimensat(" str_at_fdcwd ", %s, " str_utime_now_omit ", " str_at_symlink_nofollow ") = %s\n", qname, errstr); if (F8ILL_KULONG_SUPPORTED) { k_utimensat(kfdcwd, kfname, f8ill_ptr_to_kulong(ts), 0); printf("utimensat(" str_at_fdcwd ", %s, %#jx, 0) = %s\n", qname, (uintmax_t) f8ill_ptr_to_kulong(ts), errstr); } /* flags */ k_utimensat(kfdcwd, kfname, (uintptr_t) ts, (kernel_ulong_t) 0xdefaced00000200); printf("utimensat(" str_at_fdcwd ", %s, " str_utime_now_omit ", " str_at_removedir ") = %s\n", qname, errstr); k_utimensat(kfdcwd, kfname, (uintptr_t) ts, (kernel_ulong_t) 0xdefaced00000600); printf("utimensat(" str_at_fdcwd ", %s, " str_utime_now_omit ", " str_flags1 ") = %s\n", qname, errstr); k_utimensat(kfdcwd, kfname, (uintptr_t) ts, (kernel_ulong_t) -1ULL); printf("utimensat(" str_at_fdcwd ", %s, " str_utime_now_omit ", " str_flags2 ") = %s\n", qname, errstr); puts("+++ exited with 0 +++"); return 0; }
int main(void) { char ** const tail_argv = tail_memdup(argv, sizeof(argv)); char ** const tail_envp = tail_memdup(envp, sizeof(envp)); execve(FILENAME, tail_argv, tail_envp); printf("execve(\"%s\"" ", [\"%s\", \"%s\", \"%s\", %p, %p, %p, ... /* %p */]" #if VERBOSE ", [\"%s\", \"%s\", %p, %p, %p, ... /* %p */]" #else ", %p /* 5 vars, unterminated */" #endif ") = -1 ENOENT (%m)\n", Q_FILENAME, q_argv[0], q_argv[1], q_argv[2], argv[3], argv[4], argv[5], (char *) tail_argv + sizeof(argv) #if VERBOSE , q_envp[0], q_envp[1], envp[2], envp[3], envp[4], (char *) tail_envp + sizeof(envp) #else , tail_envp #endif ); tail_argv[ARRAY_SIZE(q_argv)] = NULL; tail_envp[ARRAY_SIZE(q_envp)] = NULL; execve(FILENAME, tail_argv, tail_envp); printf("execve(\"%s\", [\"%s\", \"%s\", \"%s\"]" #if VERBOSE ", [\"%s\", \"%s\"]" #else ", %p /* 2 vars */" #endif ") = -1 ENOENT (%m)\n", Q_FILENAME, q_argv[0], q_argv[1], q_argv[2] #if VERBOSE , q_envp[0], q_envp[1] #else , tail_envp #endif ); execve(FILENAME, tail_argv + 2, tail_envp + 1); printf("execve(\"%s\", [\"%s\"]" #if VERBOSE ", [\"%s\"]" #else ", %p /* 1 var */" #endif ") = -1 ENOENT (%m)\n", Q_FILENAME, q_argv[2] #if VERBOSE , q_envp[1] #else , tail_envp + 1 #endif ); TAIL_ALLOC_OBJECT_CONST_PTR(char *, empty); char **const efault = empty + 1; *empty = NULL; execve(FILENAME, empty, empty); printf("execve(\"%s\", []" #if VERBOSE ", []" #else ", %p /* 0 vars */" #endif ") = -1 ENOENT (%m)\n", Q_FILENAME #if !VERBOSE , empty #endif ); char *const str_a = tail_alloc(DEFAULT_STRLEN + 2); fill_memory_ex(str_a, DEFAULT_STRLEN + 1, '0', 10); str_a[DEFAULT_STRLEN + 1] = '\0'; char *const str_b = tail_alloc(DEFAULT_STRLEN + 2); fill_memory_ex(str_b, DEFAULT_STRLEN + 1, '_', 32); str_b[DEFAULT_STRLEN + 1] = '\0'; char **const a = tail_alloc(sizeof(*a) * (DEFAULT_STRLEN + 2)); char **const b = tail_alloc(sizeof(*b) * (DEFAULT_STRLEN + 2)); unsigned int i; for (i = 0; i <= DEFAULT_STRLEN; ++i) { a[i] = &str_a[i]; b[i] = &str_b[i]; } a[i] = b[i] = NULL; execve(FILENAME, a, b); printf("execve(\"%s\", [\"%.*s\"...", Q_FILENAME, DEFAULT_STRLEN, a[0]); for (i = 1; i < DEFAULT_STRLEN; ++i) printf(", \"%s\"", a[i]); #if VERBOSE printf(", \"%s\"", a[i]); #else printf(", ..."); #endif #if VERBOSE printf("], [\"%.*s\"...", DEFAULT_STRLEN, b[0]); for (i = 1; i <= DEFAULT_STRLEN; ++i) printf(", \"%s\"", b[i]); printf("]"); #else printf("], %p /* %u vars */", b, DEFAULT_STRLEN + 1); #endif printf(") = -1 ENOENT (%m)\n"); execve(FILENAME, a + 1, b + 1); printf("execve(\"%s\", [\"%s\"", Q_FILENAME, a[1]); for (i = 2; i <= DEFAULT_STRLEN; ++i) printf(", \"%s\"", a[i]); #if VERBOSE printf("], [\"%s\"", b[1]); for (i = 2; i <= DEFAULT_STRLEN; ++i) printf(", \"%s\"", b[i]); printf("]"); #else printf("], %p /* %d vars */", b + 1, DEFAULT_STRLEN); #endif printf(") = -1 ENOENT (%m)\n"); execve(FILENAME, (char **) tail_argv[ARRAY_SIZE(q_argv)], efault); printf("execve(\"%s\", NULL, %p) = -1 ENOENT (%m)\n", Q_FILENAME, efault); execve(FILENAME, efault, NULL); printf("execve(\"%s\", %p, NULL) = -1 ENOENT (%m)\n", Q_FILENAME, efault); return 0; }
int main(void) { char bogus_special_str[sizeof(void *) * 2 + sizeof("0x")]; char bogus_addr_str[sizeof(void *) * 2 + sizeof("0x")]; char unterminated_str[sizeof(void *) * 2 + sizeof("0x")]; long rc; struct fs_disk_quota *xdq = tail_alloc(sizeof(*xdq)); struct fs_quota_stat *xqstat = tail_alloc(sizeof(*xqstat)); struct fs_quota_statv *xqstatv = tail_alloc(sizeof(*xqstatv)); uint32_t *flags = tail_alloc(sizeof(*flags)); char *unterminated = tail_memdup(unterminated_data, sizeof(unterminated_data)); snprintf(bogus_special_str, sizeof(bogus_special_str), "%p", bogus_special); snprintf(bogus_addr_str, sizeof(bogus_addr_str), "%p", bogus_addr); snprintf(unterminated_str, sizeof(unterminated_str), "%p", unterminated); /* Q_XQUOTAON */ *flags = 0xdeadbeef; check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTAON, USRQUOTA)), ARG_STR("/dev/bogus/"), flags, "[XFS_QUOTA_UDQ_ACCT|XFS_QUOTA_UDQ_ENFD" "|XFS_QUOTA_GDQ_ACCT|XFS_QUOTA_GDQ_ENFD" "|XFS_QUOTA_PDQ_ENFD|0xdeadbec0]"); rc = syscall(__NR_quotactl, QCMD(Q_XQUOTAON, 0xfacefeed), bogus_dev, bogus_id, bogus_addr); printf("quotactl(QCMD(Q_XQUOTAON, %#x /* ???QUOTA */)" ", %s, %p) = %s\n", QCMD_TYPE(QCMD(Q_XQUOTAON, 0xfacefeed)), bogus_dev_str, bogus_addr, sprintrc(rc)); /* Q_XQUOTAOFF */ check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTAOFF, USRQUOTA)), bogus_special, bogus_special_str, bogus_addr, bogus_addr_str); check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTAOFF, GRPQUOTA)), ARG_STR("/dev/bogus/"), ARG_STR(NULL)); check_quota(CQF_ID_SKIP | CQF_ADDR_STR, QCMD(Q_XQUOTAOFF, 3), "QCMD(Q_XQUOTAOFF, 0x3 /* ???QUOTA */)", ARG_STR("/dev/bogus/"), flags, "[XFS_QUOTA_UDQ_ACCT|XFS_QUOTA_UDQ_ENFD" "|XFS_QUOTA_GDQ_ACCT|XFS_QUOTA_GDQ_ENFD" "|XFS_QUOTA_PDQ_ENFD|0xdeadbec0]"); /* Q_XGETQUOTA */ /* Trying our best to get successful result */ check_quota(CQF_ADDR_CB, ARG_STR(QCMD(Q_GETQUOTA, USRQUOTA)), ARG_STR("/dev/sda1"), getuid(), xdq, print_xdisk_quota, (intptr_t) 1); check_quota(CQF_ADDR_CB, ARG_STR(QCMD(Q_GETQUOTA, GRPQUOTA)), ARG_STR(NULL), -1, xdq, print_xdisk_quota, (intptr_t) 2); /* Q_XGETNEXTQUOTA */ check_quota(CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETNEXTQUOTA, USRQUOTA)), ARG_STR("/dev/sda1"), 0, xdq, print_xdisk_quota, (intptr_t) 1); /* Q_XSETQLIM */ check_quota(CQF_NONE, ARG_STR(QCMD(Q_XSETQLIM, PRJQUOTA)), bogus_special, bogus_special_str, 0, bogus_addr); fill_memory_ex((char *) xdq, sizeof(*xdq), 0x8e); check_quota(CQF_ADDR_CB, ARG_STR(QCMD(Q_XSETQLIM, PRJQUOTA)), bogus_dev, bogus_dev_str, 3141592653U, xdq, print_xdisk_quota, (intptr_t) 0); /* Q_XGETQSTAT */ check_quota(CQF_ID_SKIP | CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETQSTAT, USRQUOTA)), ARG_STR("/dev/sda1"), xqstat, print_xquota_stat, (intptr_t) 1); check_quota(CQF_ID_SKIP | CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETQSTATV, PRJQUOTA)), unterminated, unterminated_str, xqstat + 1, print_xquota_stat, (intptr_t) 2); /* Q_XGETQSTATV */ check_quota(CQF_ID_SKIP | CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETQSTAT, USRQUOTA)), ARG_STR("/dev/sda1"), xqstatv, print_xquota_statv, 1); check_quota(CQF_ID_SKIP | CQF_ADDR_CB, ARG_STR(QCMD(Q_XGETQSTATV, GRPQUOTA)), ARG_STR(NULL), xqstatv, print_xquota_statv, (intptr_t) 2); /* Q_XQUOTARM */ check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTARM, PRJQUOTA)), bogus_special, bogus_special_str, ARG_STR(NULL)); check_quota(CQF_ID_SKIP, ARG_STR(QCMD(Q_XQUOTARM, USRQUOTA)), unterminated, unterminated_str, flags + 1); *flags = 0xdeadbeef; check_quota(CQF_ID_SKIP | CQF_ADDR_STR, ARG_STR(QCMD(Q_XQUOTARM, GRPQUOTA)), ARG_STR(NULL), flags, "[XFS_USER_QUOTA|XFS_PROJ_QUOTA" "|XFS_GROUP_QUOTA|0xdeadbee8]"); /* Q_XQUOTASYNC */ check_quota(CQF_ID_SKIP | CQF_ADDR_SKIP, ARG_STR(QCMD(Q_XQUOTASYNC, USRQUOTA)), bogus_special, bogus_special_str); check_quota(CQF_ID_SKIP | CQF_ADDR_SKIP, QCMD(Q_XQUOTASYNC, 0xfff), "QCMD(Q_XQUOTASYNC, 0xff /* ???QUOTA */)", ARG_STR(NULL)); puts("+++ exited with 0 +++"); return 0; }
int main(void) { static const char unterminated1[] = { '\1', '\2', '\3', '\4', '\5' }; static const char unterminated2[] = { '\6', '\7', '\10', '\11', '\12' }; static const char unterminated3[] = { '\16', '\17', '\20', '\21', '\22' }; char *bogus_type = tail_memdup(unterminated1, sizeof(unterminated1)); char *bogus_desc = tail_memdup(unterminated2, sizeof(unterminated2)); char *bogus_payload = tail_memdup(unterminated3, sizeof(unterminated3)); unsigned i; unsigned j; unsigned k; unsigned l; struct { const char *type; const char *str; } types[] = { { ARG_STR(NULL) }, { bogus_type + sizeof(unterminated1), NULL }, { bogus_type, NULL }, { ARG_STR("\20\21\22\23\24") }, { ARG_STR("user") }, }; struct { const char *desc; const char *str; } descs[] = { { ARG_STR(NULL) }, { bogus_desc + sizeof(unterminated2), NULL }, { bogus_desc, NULL }, { ARG_STR("\25\26\27\30\31") }, { ARG_STR("desc") }, { "overly long description", STRINGIFY("overly long ") "..." }, }; struct { const char *pload; const char *str; size_t plen; } payloads[] = { { ARG_STR(NULL), 0 }, { bogus_payload + sizeof(unterminated3), NULL, (size_t) 0xdeadbeefbadc0dedULL }, { bogus_payload, STRINGIFY(""), 0 }, { bogus_payload, STRINGIFY("\16\17\20\21\22"), 5 }, { bogus_payload, NULL, 10 }, { "overly long payload", STRINGIFY("overly long ") "...", 15 }, }; struct { uint32_t keyring; const char *str; } keyrings[] = { { ARG_STR(0) }, { ARG_STR(1234567890) }, { ARG_STR(-1234567890) }, { -1, "KEY_SPEC_THREAD_KEYRING" }, }; for (i = 0; i < ARRAY_SIZE(types); i++) for (j = 0; j < ARRAY_SIZE(descs); j++) for (k = 0; k < ARRAY_SIZE(payloads); k++) for (l = 0; l < ARRAY_SIZE(keyrings); l++) do_add_key(types[i].type, types[i].str, descs[j].desc, descs[j].str, payloads[k].pload, payloads[k].str, payloads[k].plen, keyrings[l].keyring, keyrings[l].str); puts("+++ exited with 0 +++"); return 0; }
static const char r1_c[] = "89abcde"; const char *r1_d = hexdump_strdup(r1_c); const struct iovec w_iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1, .iov_len = LENGTH_OF(w1_c) }, { .iov_base = w2, .iov_len = LENGTH_OF(w2_c) } }; const struct iovec *w_iov = tail_memdup(w_iov_, sizeof(w_iov_)); rc = pw(1, w_iov, 0, 0); if (rc) perror_msg_and_fail("pwritev2: expected 0, returned %ld", rc); tprintf("pwritev2(1, [], 0, 0, 0) = 0\n"); rc = pw(1, w_iov + ARRAY_SIZE(w_iov_) - 1, 2, 0); tprintf("pwritev2(1, [{iov_base=\"%s\", iov_len=%u}, %p], 2, 0, 0)" " = %ld %s (%m)\n", w2_c, LENGTH_OF(w2_c), w_iov + ARRAY_SIZE(w_iov_), rc, errno2name()); const unsigned int w_len = LENGTH_OF(w0_c) + LENGTH_OF(w1_c) + LENGTH_OF(w2_c);
int main(void) { static const kernel_ulong_t bogus_zero = (kernel_ulong_t) 0x8765432100000000ULL; static const kernel_ulong_t bogus_oflags = (kernel_ulong_t) 0xdefaced100000003ULL; static const kernel_ulong_t bogus_mode = (kernel_ulong_t) 0xdec0deadfacefeedULL; static const kernel_ulong_t bogus_fd = (kernel_ulong_t) 0xfeedfacedeadba5eULL; static const kernel_ulong_t bogus_zero_size = (sizeof(kernel_ulong_t) > sizeof(int)) ? (kernel_ulong_t) 0 : (kernel_ulong_t) 0xface1e5500000000ULL; static const kernel_ulong_t bogus_size = (kernel_ulong_t) 0xbadc0dedda7a1057ULL; static const kernel_ulong_t bogus_prio = (kernel_ulong_t) 0xdec0ded1defaced3ULL; static const struct timespec bogus_tmout_data = { .tv_sec = (time_t) 0xdeadfacebeeff00dLL, .tv_nsec = (long) 0xfacefee1deadfeedLL, }; static const struct timespec future_tmout_data = { .tv_sec = (time_t) 0x7ea1fade7e57faceLL, .tv_nsec = 999999999, }; struct_sigevent bogus_sev_data = { .sigev_notify = 0xdefaced, .sigev_signo = 0xfacefeed, .sigev_value.sival_ptr = (unsigned long) 0xdeadbeefbadc0dedULL }; const char *errstr; long rc; kernel_long_t *bogus_attrs = tail_alloc(sizeof(*bogus_attrs) * NUM_ATTRS); char *msg = tail_alloc(MSG_SIZE); TAIL_ALLOC_OBJECT_CONST_PTR(unsigned, bogus_prio_ptr); struct timespec *bogus_tmout = tail_memdup(&bogus_tmout_data, sizeof(*bogus_tmout)); struct timespec *future_tmout = tail_memdup(&future_tmout_data, sizeof(*future_tmout)); struct_sigevent *bogus_sev = tail_memdup(&bogus_sev_data, sizeof(*bogus_sev)); int fd = -1; fill_memory_ex(msg, MSG_SIZE, MSG_START, MSG_SIZE); fill_memory_ex(bogus_attrs, sizeof(*bogus_attrs) * NUM_ATTRS, 0xbb, 0x70); /* mq_open */ /* Zero values, non-O_CREAT mode */ rc = syscall(__NR_mq_open, NULL, bogus_zero, bogus_mode, NULL); printf("mq_open(NULL, O_RDONLY) = %s\n", sprintrc(rc)); /* O_CREAT parsing, other flags, bogs values */ rc = syscall(__NR_mq_open, msg, O_CREAT | bogus_oflags, bogus_mode, NULL); printf("mq_open(%p, O_ACCMODE|O_CREAT, %#o, NULL) = %s\n", msg, (unsigned short) bogus_mode, sprintrc(rc)); /* Partially invalid attributes structure */ rc = syscall(__NR_mq_open, msg, O_CREAT | bogus_oflags, bogus_mode, bogus_attrs + 1); printf("mq_open(%p, O_ACCMODE|O_CREAT, %#o, %p) = %s\n", msg, (unsigned short) bogus_mode, bogus_attrs + 1, sprintrc(rc)); /* Valid attributes structure */ rc = syscall(__NR_mq_open, msg, O_CREAT | bogus_oflags, bogus_mode, bogus_attrs); printf("mq_open(%p, O_ACCMODE|O_CREAT, %#o, {mq_flags=%#llx" ", mq_maxmsg=%lld, mq_msgsize=%lld, mq_curmsgs=%lld}) = %s\n", msg, (unsigned short) bogus_mode, (unsigned long long) (kernel_ulong_t) bogus_attrs[0], (long long) bogus_attrs[1], (long long) bogus_attrs[2], (long long) bogus_attrs[3], sprintrc(rc)); /* mq_timedsend */ /* Zero values*/ rc = syscall(__NR_mq_timedsend, bogus_zero, NULL, bogus_zero_size, bogus_zero, NULL); printf("mq_timedsend(0, NULL, 0, 0, NULL) = %s\n", sprintrc(rc)); /* Invalid pointers */ rc = syscall(__NR_mq_timedsend, bogus_fd, msg + MSG_SIZE, bogus_size, bogus_prio, bogus_tmout + 1); printf("mq_timedsend(%d, %p, %llu, %u, %p) = %s\n", (int) bogus_fd, msg + MSG_SIZE, (unsigned long long) bogus_size, (unsigned) bogus_prio, bogus_tmout + 1, sprintrc(rc)); /* Partially invalid message (memory only partially available) */ rc = syscall(__NR_mq_timedsend, bogus_fd, msg + MSG_SIZE - MSG_CUT, MSG_SIZE, bogus_prio, bogus_tmout); printf("mq_timedsend(%d, %p, %llu, %u, {tv_sec=%lld, tv_nsec=%llu})" " = %s\n", (int) bogus_fd, msg + MSG_SIZE - MSG_CUT, (unsigned long long) MSG_SIZE, (unsigned) bogus_prio, (long long) bogus_tmout->tv_sec, zero_extend_signed_to_ull(bogus_tmout->tv_nsec), sprintrc(rc)); /* Fully valid message, uncut */ rc = syscall(__NR_mq_timedsend, bogus_fd, msg + MSG_SIZE - MSG_CUT, MSG_CUT, bogus_prio, bogus_tmout); errstr = sprintrc(rc); printf("mq_timedsend(%d, ", (int) bogus_fd); printstr(MSG_START + MSG_SIZE - MSG_CUT, MSG_CUT); printf(", %llu, %u, {tv_sec=%lld, tv_nsec=%llu}) = %s\n", (unsigned long long) MSG_CUT, (unsigned) bogus_prio, (long long) bogus_tmout->tv_sec, zero_extend_signed_to_ull(bogus_tmout->tv_nsec), errstr); /* Partially invalid message, cut at maxstrlen */ rc = syscall(__NR_mq_timedsend, bogus_fd, msg + MSG_CUT, MSG_SIZE, bogus_prio, bogus_tmout); errstr = sprintrc(rc); printf("mq_timedsend(%d, ", (int) bogus_fd); printstr(MSG_START + MSG_CUT, MSG_MAX_UNCUT); printf("..., %llu, %u, {tv_sec=%lld, tv_nsec=%llu}) = %s\n", (unsigned long long) MSG_SIZE, (unsigned) bogus_prio, (long long) bogus_tmout->tv_sec, zero_extend_signed_to_ull(bogus_tmout->tv_nsec), errstr); /* mq_timedreceive */ /* Zero values */ rc = syscall(__NR_mq_timedreceive, bogus_zero, NULL, bogus_zero_size, NULL, NULL); printf("mq_timedreceive(0, NULL, 0, NULL, NULL) = %s\n", sprintrc(rc)); /* Invalid addresses */ rc = syscall(__NR_mq_timedreceive, bogus_fd, msg + MSG_SIZE, bogus_size, bogus_prio_ptr + 1, bogus_tmout + 1); printf("mq_timedreceive(%d, %p, %llu, %p, %p) = %s\n", (int) bogus_fd, msg + MSG_SIZE, (unsigned long long) bogus_size, bogus_prio_ptr + 1, bogus_tmout + 1, sprintrc(rc)); /* Invalid fd, valid msg pointer */ rc = syscall(__NR_mq_timedreceive, bogus_fd, msg, bogus_size, bogus_prio_ptr, bogus_tmout); printf("mq_timedreceive(%d, %p, %llu, %p, {tv_sec=%lld, tv_nsec=%llu}) " "= %s\n", (int) bogus_fd, msg, (unsigned long long) bogus_size, bogus_prio_ptr, (long long) bogus_tmout->tv_sec, zero_extend_signed_to_ull(bogus_tmout->tv_nsec), sprintrc(rc)); /* mq_notify */ /* Zero values */ rc = syscall(__NR_mq_notify, bogus_zero, NULL); printf("mq_notify(0, NULL) = %s\n", sprintrc(rc)); /* Invalid pointer */ rc = syscall(__NR_mq_notify, bogus_fd, bogus_sev + 1); printf("mq_notify(%d, %p) = %s\n", (int) bogus_fd, bogus_sev + 1, sprintrc(rc)); /* Invalid SIGEV_* */ rc = syscall(__NR_mq_notify, bogus_fd, bogus_sev); printf("mq_notify(%d, {sigev_value={sival_int=%d, sival_ptr=%#lx}" ", sigev_signo=%u, sigev_notify=%#x /* SIGEV_??? */}) = %s\n", (int) bogus_fd, bogus_sev->sigev_value.sival_int, bogus_sev->sigev_value.sival_ptr, bogus_sev->sigev_signo, bogus_sev->sigev_notify, sprintrc(rc)); /* SIGEV_NONE */ bogus_sev->sigev_notify = SIGEV_NONE; rc = syscall(__NR_mq_notify, bogus_fd, bogus_sev); printf("mq_notify(%d, {sigev_value={sival_int=%d, sival_ptr=%#lx}" ", sigev_signo=%u, sigev_notify=SIGEV_NONE}) = %s\n", (int) bogus_fd, bogus_sev->sigev_value.sival_int, bogus_sev->sigev_value.sival_ptr, bogus_sev->sigev_signo, sprintrc(rc)); /* SIGEV_SIGNAL */ bogus_sev->sigev_notify = SIGEV_SIGNAL; bogus_sev->sigev_signo = SIGALRM; rc = syscall(__NR_mq_notify, bogus_fd, bogus_sev); printf("mq_notify(%d, {sigev_value={sival_int=%d, sival_ptr=%#lx}" ", sigev_signo=SIGALRM, sigev_notify=SIGEV_SIGNAL}) = %s\n", (int) bogus_fd, bogus_sev->sigev_value.sival_int, bogus_sev->sigev_value.sival_ptr, sprintrc(rc)); /* SIGEV_THREAD */ bogus_sev->sigev_notify = SIGEV_THREAD; bogus_sev->sigev_un.sigev_thread.function = (unsigned long) 0xdeadbeefbadc0dedULL; bogus_sev->sigev_un.sigev_thread.attribute = (unsigned long) 0xcafef00dfacefeedULL; rc = syscall(__NR_mq_notify, bogus_fd, bogus_sev); printf("mq_notify(%d, {sigev_value={sival_int=%d, sival_ptr=%#lx}" ", sigev_signo=SIGALRM, sigev_notify=SIGEV_THREAD" ", sigev_notify_function=%#lx, sigev_notify_attributes=%#lx})" " = %s\n", (int) bogus_fd, bogus_sev->sigev_value.sival_int, bogus_sev->sigev_value.sival_ptr, bogus_sev->sigev_un.sigev_thread.function, bogus_sev->sigev_un.sigev_thread.attribute, sprintrc(rc)); /* mq_unlink */ /* Zero values */ rc = syscall(__NR_mq_unlink, NULL); printf("mq_unlink(NULL) = %s\n", sprintrc(rc)); /* Invalid ptr */ rc = syscall(__NR_mq_unlink, msg + MSG_SIZE); printf("mq_unlink(%p) = %s\n", msg + MSG_SIZE, sprintrc(rc)); /* Long unterminated string */ rc = syscall(__NR_mq_unlink, msg); errstr = sprintrc(rc); printf("mq_unlink(%p) = %s\n", msg, errstr); /* Sending and receiving test */ if (asprintf(&mq_name, "strace-mq_sendrecv-%u.sample", getpid()) < 0) perror_msg_and_fail("asprintf"); # if DUMPIO_READ || DUMPIO_WRITE close(0); # endif bogus_attrs[1] = 2; bogus_attrs[2] = MSG_SIZE; fd = rc = syscall(__NR_mq_open, mq_name, O_CREAT|O_RDWR|O_NONBLOCK, S_IRWXU, bogus_attrs); errstr = sprintrc(rc); if (rc < 0) perror_msg_and_skip("mq_open"); else atexit(cleanup); # if DUMPIO_READ || DUMPIO_WRITE if (fd != 0) error_msg_and_skip("mq_open returned fd other than 0"); # endif fill_memory_ex(bogus_attrs, sizeof(*bogus_attrs) * NUM_ATTRS, 0xbb, 0x70); printf("mq_open(\"%s\", O_RDWR|O_CREAT|O_NONBLOCK, 0700" ", {mq_flags=%#llx, mq_maxmsg=2, mq_msgsize=%u" ", mq_curmsgs=%lld}) = %s\n", mq_name, (unsigned long long) (kernel_ulong_t) bogus_attrs[0], MSG_SIZE, (long long) bogus_attrs[3], errstr); rc = syscall(__NR_mq_getsetattr, fd, NULL, bogus_attrs); if (rc < 0) perror_msg_and_skip("mq_getsetattr"); if ((bogus_attrs[1] < 2) || (bogus_attrs[2] < MSG_SIZE)) error_msg_and_skip("mq too small"); do_send(fd, msg, MSG_CUT, future_tmout, false); do_send(fd, msg, MSG_SIZE, future_tmout, true); memset(msg, '\0', MSG_SIZE); do_recv(fd, msg, MSG_CUT, future_tmout, false); memset(msg, '\0', MSG_SIZE); do_recv(fd, msg, MSG_SIZE, future_tmout, true); return 0; } #else SKIP_MAIN_UNDEFINED("__NR_mq_open && __NR_mq_timedsend && " "__NR_mq_timedreceive && __NR_mq_notify && __NR_mq_unlink");
static const char r1_c[] = "89abcde"; const char *r1_d = hexdump_strdup(r1_c); const struct iovec w_iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1, .iov_len = LENGTH_OF(w1_c) }, { .iov_base = w2, .iov_len = LENGTH_OF(w2_c) } }; struct iovec *w_iov = tail_memdup(w_iov_, sizeof(w_iov_)); const unsigned int w_len = LENGTH_OF(w0_c) + LENGTH_OF(w1_c) + LENGTH_OF(w2_c); const struct msghdr w_mh_ = { .msg_iov = w_iov, .msg_iovlen = ARRAY_SIZE(w_iov_) }; const struct msghdr *w_mh = tail_memdup(&w_mh_, sizeof(w_mh_)); assert(sendmsg(1, w_mh, 0) == (int) w_len); close(1); tprintf("sendmsg(1, {msg_name=NULL, msg_namelen=0, msg_iov=" "[{\"%s\", %u}, {\"%s\", %u}, {\"%s\", %u}], msg_iovlen=%u" ", msg_controllen=0, msg_flags=0}, 0) = %u\n" " * %u bytes in buffer 0\n"
int main(void) { skip_if_unavailable("/proc/self/fd/"); static const struct sockaddr_un addr = { .sun_family = AF_UNIX, .sun_path = TEST_SOCKET }; struct sockaddr * const listen_sa = tail_memdup(&addr, sizeof(addr)); TAIL_ALLOC_OBJECT_CONST_PTR(socklen_t, len); *len = offsetof(struct sockaddr_un, sun_path) + strlen(TEST_SOCKET) + 1; if (*len > sizeof(addr)) *len = sizeof(addr); int listen_fd = socket(AF_UNIX, SOCK_STREAM, 0); if (listen_fd < 0) perror_msg_and_skip("socket"); unsigned long listen_inode = inode_of_sockfd(listen_fd); printf("socket(AF_UNIX, SOCK_STREAM, 0) = %d<socket:[%lu]>\n", listen_fd, listen_inode); (void) unlink(TEST_SOCKET); if (bind(listen_fd, listen_sa, *len)) perror_msg_and_skip("bind"); printf("bind(%d<socket:[%lu]>, {sa_family=AF_UNIX, sun_path=\"%s\"}" ", %u) = 0\n", listen_fd, listen_inode, TEST_SOCKET, (unsigned) *len); if (listen(listen_fd, 1)) perror_msg_and_skip("listen"); printf("listen(%d<socket:[%lu]>, 1) = 0\n", listen_fd, listen_inode); TAIL_ALLOC_OBJECT_CONST_PTR(unsigned int, optval); *len = sizeof(*optval); if (getsockopt(listen_fd, SOL_SOCKET, SO_PASSCRED, optval, len)) perror_msg_and_fail("getsockopt"); printf("getsockopt(%d<socket:[%lu]>, SOL_SOCKET, SO_PASSCRED" ", [%u], [%u]) = 0\n", listen_fd, listen_inode, *optval, (unsigned) *len); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getsockname(listen_fd, listen_sa, len)) perror_msg_and_fail("getsockname"); printf("getsockname(%d<socket:[%lu]>, {sa_family=AF_UNIX" ", sun_path=\"%s\"}, [%d->%d]) = 0\n", listen_fd, listen_inode, TEST_SOCKET, (int) sizeof(addr), (int) *len); int connect_fd = socket(AF_UNIX, SOCK_STREAM, 0); if (connect_fd < 0) perror_msg_and_fail("socket"); unsigned long connect_inode = inode_of_sockfd(connect_fd); printf("socket(AF_UNIX, SOCK_STREAM, 0) = %d<socket:[%lu]>\n", connect_fd, connect_inode); if (connect(connect_fd, listen_sa, *len)) perror_msg_and_fail("connect"); printf("connect(%d<socket:[%lu]>, {sa_family=AF_UNIX" ", sun_path=\"%s\"}, %u) = 0\n", connect_fd, connect_inode, TEST_SOCKET, (unsigned) *len); struct sockaddr * const accept_sa = tail_alloc(sizeof(addr)); memset(accept_sa, 0, sizeof(addr)); *len = sizeof(addr); int accept_fd = accept(listen_fd, accept_sa, len); if (accept_fd < 0) perror_msg_and_fail("accept"); unsigned long accept_inode = inode_of_sockfd(accept_fd); printf("accept(%d<socket:[%lu]>, {sa_family=AF_UNIX}" ", [%d->%d]) = %d<socket:[%lu]>\n", listen_fd, listen_inode, (int) sizeof(addr), (int) *len, accept_fd, accept_inode); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getpeername(connect_fd, listen_sa, len)) perror_msg_and_fail("getpeername"); printf("getpeername(%d<socket:[%lu]>, {sa_family=AF_UNIX" ", sun_path=\"%s\"}, [%d->%d]) = 0\n", connect_fd, connect_inode, TEST_SOCKET, (int) sizeof(addr), (int) *len); char text[] = "text"; assert(sendto(connect_fd, text, sizeof(text) - 1, MSG_DONTWAIT, NULL, 0) == sizeof(text) - 1); printf("sendto(%d<socket:[%lu]>, \"%s\", %u, MSG_DONTWAIT" ", NULL, 0) = %u\n", connect_fd, connect_inode, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(connect_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", connect_fd, connect_inode); assert(recvfrom(accept_fd, text, sizeof(text) - 1, MSG_DONTWAIT, NULL, NULL) == sizeof(text) - 1); printf("recvfrom(%d<socket:[%lu]>, \"%s\", %u, MSG_DONTWAIT" ", NULL, NULL) = %u\n", accept_fd, accept_inode, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(accept_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", accept_fd, accept_inode); connect_fd = socket(AF_UNIX, SOCK_STREAM, 0); if (connect_fd < 0) perror_msg_and_fail("socket"); connect_inode = inode_of_sockfd(connect_fd); printf("socket(AF_UNIX, SOCK_STREAM, 0) = %d<socket:[%lu]>\n", connect_fd, connect_inode); *optval = 1; *len = sizeof(*optval); if (setsockopt(connect_fd, SOL_SOCKET, SO_PASSCRED, optval, *len)) perror_msg_and_fail("setsockopt"); printf("setsockopt(%d<socket:[%lu]>, SOL_SOCKET, SO_PASSCRED" ", [%u], %u) = 0\n", connect_fd, connect_inode, *optval, (unsigned) *len); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getsockname(listen_fd, listen_sa, len)) perror_msg_and_fail("getsockname"); printf("getsockname(%d<socket:[%lu]>, {sa_family=AF_UNIX" ", sun_path=\"%s\"}, [%d->%d]) = 0\n", listen_fd, listen_inode, TEST_SOCKET, (int) sizeof(addr), (int) *len); if (connect(connect_fd, listen_sa, *len)) perror_msg_and_fail("connect"); printf("connect(%d<socket:[%lu]>, {sa_family=AF_UNIX" ", sun_path=\"%s\"}, %u) = 0\n", connect_fd, connect_inode, TEST_SOCKET, (unsigned) *len); memset(accept_sa, 0, sizeof(addr)); *len = sizeof(addr); accept_fd = accept(listen_fd, accept_sa, len); if (accept_fd < 0) perror_msg_and_fail("accept"); accept_inode = inode_of_sockfd(accept_fd); const char * const sun_path1 = ((struct sockaddr_un *) accept_sa)->sun_path + 1; printf("accept(%d<socket:[%lu]>, {sa_family=AF_UNIX" ", sun_path=@\"%s\"}, [%d->%d]) = %d<socket:[%lu]>\n", listen_fd, listen_inode, sun_path1, (int) sizeof(addr), (int) *len, accept_fd, accept_inode); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getpeername(connect_fd, listen_sa, len)) perror_msg_and_fail("getpeername"); printf("getpeername(%d<socket:[%lu]>, {sa_family=AF_UNIX" ", sun_path=\"%s\"}, [%d->%d]) = 0\n", connect_fd, connect_inode, TEST_SOCKET, (int) sizeof(addr), (int) *len); memset(accept_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getsockname(connect_fd, accept_sa, len)) perror_msg_and_fail("getsockname"); printf("getsockname(%d<socket:[%lu]>, {sa_family=AF_UNIX" ", sun_path=@\"%s\"}, [%d->%d]) = 0\n", connect_fd, connect_inode, sun_path1, (int) sizeof(addr), (int) *len); assert(sendto(connect_fd, text, sizeof(text) - 1, MSG_DONTWAIT, NULL, 0) == sizeof(text) - 1); printf("sendto(%d<socket:[%lu]>, \"%s\", %u, MSG_DONTWAIT" ", NULL, 0) = %u\n", connect_fd, connect_inode, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(connect_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", connect_fd, connect_inode); assert(recvfrom(accept_fd, text, sizeof(text) - 1, MSG_DONTWAIT, NULL, NULL) == sizeof(text) - 1); printf("recvfrom(%d<socket:[%lu]>, \"%s\", %u, MSG_DONTWAIT" ", NULL, NULL) = %u\n", accept_fd, accept_inode, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(accept_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", accept_fd, accept_inode); assert(unlink(TEST_SOCKET) == 0); assert(close(listen_fd) == 0); printf("close(%d<socket:[%lu]>) = 0\n", listen_fd, listen_inode); puts("+++ exited with 0 +++"); return 0; }
int main(void) { const char ** const tail_argv = tail_memdup(argv, sizeof(argv)); const char ** const tail_envp = tail_memdup(envp, sizeof(envp)); syscall(__NR_execveat, -100, FILENAME, tail_argv, tail_envp, 0x1100); printf("execveat(AT_FDCWD, \"%s\"" ", [\"%s\", \"%s\", \"%s\", %p, %p, %p, ???]" #ifdef VERBOSE_EXECVEAT ", [\"%s\", \"%s\", %p, %p, %p, ???]" #else ", [/* 5 vars, unterminated */]" #endif ", AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 %s (%m)\n", Q_FILENAME, q_argv[0], q_argv[1], q_argv[2], argv[3], argv[4], argv[5], #ifdef VERBOSE_EXECVEAT q_envp[0], q_envp[1], envp[2], envp[3], envp[4], #endif errno2name()); tail_argv[ARRAY_SIZE(q_argv)] = NULL; tail_envp[ARRAY_SIZE(q_envp)] = NULL; syscall(__NR_execveat, -100, FILENAME, tail_argv, tail_envp, 0x1100); printf("execveat(AT_FDCWD, \"%s\", [\"%s\", \"%s\", \"%s\"]" #ifdef VERBOSE_EXECVEAT ", [\"%s\", \"%s\"]" #else ", [/* 2 vars */]" #endif ", AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 %s (%m)\n", Q_FILENAME, q_argv[0], q_argv[1], q_argv[2], #ifdef VERBOSE_EXECVEAT q_envp[0], q_envp[1], #endif errno2name()); syscall(__NR_execveat, -100, FILENAME, tail_argv + 2, tail_envp + 1, 0x1100); printf("execveat(AT_FDCWD, \"%s\", [\"%s\"]" #ifdef VERBOSE_EXECVEAT ", [\"%s\"]" #else ", [/* 1 var */]" #endif ", AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 %s (%m)\n", Q_FILENAME, q_argv[2], #ifdef VERBOSE_EXECVEAT q_envp[1], #endif errno2name()); char **const empty = tail_alloc(sizeof(*empty)); char **const efault = empty + 1; *empty = NULL; syscall(__NR_execveat, -100, FILENAME, empty, empty, 0x1100); printf("execveat(AT_FDCWD, \"%s\", []" #ifdef VERBOSE_EXECVEAT ", []" #else ", [/* 0 vars */]" #endif ", AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 %s (%m)\n", Q_FILENAME, errno2name()); char str_a[] = "012345678901234567890123456789012"; char str_b[] = "_abcdefghijklmnopqrstuvwxyz()[]{}"; #define DEFAULT_STRLEN ((unsigned int) sizeof(str_a) - 2) char **const a = tail_alloc(sizeof(*a) * (DEFAULT_STRLEN + 2)); char **const b = tail_alloc(sizeof(*b) * (DEFAULT_STRLEN + 2)); unsigned int i; for (i = 0; i <= DEFAULT_STRLEN; ++i) { a[i] = &str_a[i]; b[i] = &str_b[i]; } a[i] = b[i] = NULL; syscall(__NR_execveat, -100, FILENAME, a, b, 0x1100); printf("execveat(AT_FDCWD, \"%s\", [\"%.*s\"...", Q_FILENAME, DEFAULT_STRLEN, a[0]); for (i = 1; i < DEFAULT_STRLEN; ++i) printf(", \"%s\"", a[i]); #ifdef VERBOSE_EXECVEAT printf(", \"%s\"", a[i]); #else printf(", ..."); #endif #ifdef VERBOSE_EXECVEAT printf("], [\"%.*s\"...", DEFAULT_STRLEN, b[0]); for (i = 1; i <= DEFAULT_STRLEN; ++i) printf(", \"%s\"", b[i]); #else printf("], [/* %u vars */", DEFAULT_STRLEN + 1); #endif printf("], AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 %s (%m)\n", errno2name()); syscall(__NR_execveat, -100, FILENAME, a + 1, b + 1, 0x1100); printf("execveat(AT_FDCWD, \"%s\", [\"%s\"", Q_FILENAME, a[1]); for (i = 2; i <= DEFAULT_STRLEN; ++i) printf(", \"%s\"", a[i]); #ifdef VERBOSE_EXECVEAT printf("], [\"%s\"", b[1]); for (i = 2; i <= DEFAULT_STRLEN; ++i) printf(", \"%s\"", b[i]); #else printf("], [/* %d vars */", DEFAULT_STRLEN); #endif printf("], AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 %s (%m)\n", errno2name()); syscall(__NR_execveat, -100, FILENAME, NULL, efault, 0x1100); printf("execveat(AT_FDCWD, \"%s\", NULL, %p" ", AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 %s (%m)\n", Q_FILENAME, efault, errno2name()); syscall(__NR_execveat, -100, FILENAME, efault, NULL, 0x1100); printf("execveat(AT_FDCWD, \"%s\", %p, NULL" ", AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH) = -1 %s (%m)\n", Q_FILENAME, efault, errno2name()); puts("+++ exited with 0 +++"); return 0; }
const char *w2_d = hexdump_strdup(w2_c); void *w2 = tail_memdup(w2_c, LENGTH_OF(w2_c)); const struct iovec iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1, .iov_len = LENGTH_OF(w1_c) }, { .iov_base = w2, .iov_len = LENGTH_OF(w2_c) } }; const struct iovec *iov = tail_memdup(iov_, sizeof(iov_)); const unsigned int len = LENGTH_OF(w0_c) + LENGTH_OF(w1_c) + LENGTH_OF(w2_c); tprintf("vmsplice(1, [{\"%s\", %u}, {\"%s\", %u}" ", {\"%s\", %u}], %u, %s) = %u\n" " * %u bytes in buffer 0\n" " | 00000 %-49s %-16s |\n" " * %u bytes in buffer 1\n" " | 00000 %-49s %-16s |\n" " * %u bytes in buffer 2\n" " | 00000 %-49s %-16s |\n", w0_c, LENGTH_OF(w0_c), w1_c, LENGTH_OF(w1_c), w2_c, LENGTH_OF(w2_c), ARRAY_SIZE(iov_), "SPLICE_F_NONBLOCK", len, LENGTH_OF(w0_c), w0_d, w0_c,
static const char r1_c[] = "89abcde"; const char *r1_d = hexdump_strdup(r1_c); const struct iovec w_iov_[] = { { .iov_base = w0, .iov_len = LENGTH_OF(w0_c) }, { .iov_base = w1, .iov_len = LENGTH_OF(w1_c) }, { .iov_base = w2, .iov_len = LENGTH_OF(w2_c) } }; const struct iovec *w_iov = tail_memdup(w_iov_, sizeof(w_iov_)); const unsigned int w_len = LENGTH_OF(w0_c) + LENGTH_OF(w1_c) + LENGTH_OF(w2_c); assert(writev(1, w_iov, ARRAY_SIZE(w_iov_)) == (int) w_len); close(1); tprintf("writev(1, [{\"%s\", %u}, {\"%s\", %u}" ", {\"%s\", %u}], %u) = %u\n" " * %u bytes in buffer 0\n" " | 00000 %-49s %-16s |\n" " * %u bytes in buffer 1\n" " | 00000 %-49s %-16s |\n" " * %u bytes in buffer 2\n" " | 00000 %-49s %-16s |\n", w0_c, LENGTH_OF(w0_c), w1_c, LENGTH_OF(w1_c), w2_c, LENGTH_OF(w2_c), ARRAY_SIZE(w_iov_), w_len,
sg_io->sbp, sg_io->host_status, sg_io->driver_status, sg_io->resid, sg_io->duration); const struct iovec iov[] = { { .iov_base = (void *) efault - 2, .iov_len = 2 }, { .iov_base = (void *) efault - 3, .iov_len = 4 } }; struct iovec *const t_iov = tail_memdup(iov, sizeof(iov)); sg_io->flags = 0x24; sg_io->info = 1; sg_io->dxfer_direction = -2; sg_io->iovec_count = ARRAY_SIZE(iov); sg_io->dxfer_len = iov[0].iov_len + iov[1].iov_len - 1; sg_io->dxferp = t_iov; ioctl(-1, SG_IO, sg_io); printf("ioctl(-1, SG_IO, {interface_id='S'" ", dxfer_direction=SG_DXFER_TO_DEV" ", cmd_len=%u" ", cmdp=%p" ", mx_sb_len=%u"
int main(void) { static const kernel_ulong_t unknown_perf_cmd = (kernel_ulong_t) 0xbadc0dedfeed24edULL; static const kernel_ulong_t magic = (kernel_ulong_t) 0xdeadbeefbadc0dedULL; static const uint64_t magic64 = 0xfacefeeddeadc0deULL; static const char str[] = STR16 STR16 STR16 STR16; static struct { unsigned int cmd; const char *str; } flag_iocs[] = { { ARG_STR(PERF_EVENT_IOC_ENABLE) }, { ARG_STR(PERF_EVENT_IOC_DISABLE) }, { ARG_STR(PERF_EVENT_IOC_RESET) }, }; TAIL_ALLOC_OBJECT_CONST_PTR(uint64_t, u64_ptr); uint64_t *const u64_efault = u64_ptr + 1; uint32_t *const u32_arr = tail_alloc(sizeof(uint32_t) * 4); uint32_t *const u32_efault = u32_arr + 4; char *const str_ptr = tail_memdup(str, sizeof(str)); char *const str_efault = str_ptr + sizeof(str); TAIL_ALLOC_OBJECT_CONST_PTR(struct perf_event_attr, pea_ptr); *u64_ptr = magic64; fill_memory_ex(pea_ptr, sizeof(*pea_ptr), 0xaa, 0x55); /* Unknown perf commands */ sys_ioctl(-1, unknown_perf_cmd, magic); printf("ioctl(-1, _IOC(_IOC_READ|_IOC_WRITE%s, 0x24, %#x, %#x), " "%#lx) = -1 EBADF (%m)\n", _IOC_DIR((unsigned int) unknown_perf_cmd) & _IOC_NONE ? "|_IOC_NONE" : "", _IOC_NR((unsigned int) unknown_perf_cmd), _IOC_SIZE((unsigned int) unknown_perf_cmd), (unsigned long) magic); sys_ioctl(-1, PERF_EVENT_IOC_MODIFY_ATTRIBUTES + 1, magic); printf("ioctl(-1, _IOC(_IOC_WRITE, 0x24, %#x, %#x), %#lx)" " = -1 EBADF (%m)\n", (unsigned int) _IOC_NR(PERF_EVENT_IOC_MODIFY_ATTRIBUTES + 1), (unsigned int) _IOC_SIZE(PERF_EVENT_IOC_MODIFY_ATTRIBUTES + 1), (unsigned long) magic); /* PERF_EVENT_IOC_{ENABLE,DISABLE,RESET} */ for (unsigned i = 0; i < ARRAY_SIZE(flag_iocs); i++) { ioctl(-1, flag_iocs[i].cmd, 0); printf("ioctl(-1, %s, 0) = -1 EBADF (%m)\n", flag_iocs[i].str); ioctl(-1, flag_iocs[i].cmd, 1); printf("ioctl(-1, %s, PERF_IOC_FLAG_GROUP) = -1 EBADF (%m)\n", flag_iocs[i].str); ioctl(-1, flag_iocs[i].cmd, 2); printf("ioctl(-1, %s, 0x2 /* PERF_IOC_FLAG_??? */) " "= -1 EBADF (%m)\n", flag_iocs[i].str); sys_ioctl(-1, flag_iocs[i].cmd, magic); printf("ioctl(-1, %s, PERF_IOC_FLAG_GROUP|%#x) " "= -1 EBADF (%m)\n", flag_iocs[i].str, (unsigned int) magic & ~1U); } /* PERF_EVENT_IOC_REFRESH */ sys_ioctl(-1, PERF_EVENT_IOC_REFRESH, magic); printf("ioctl(-1, PERF_EVENT_IOC_REFRESH, %d) = -1 EBADF (%m)\n", (int) magic); /* PERF_EVENT_IOC_PERIOD */ ioctl(-1, PERF_EVENT_IOC_PERIOD, NULL); printf("ioctl(-1, PERF_EVENT_IOC_PERIOD, NULL) = -1 EBADF (%m)\n"); ioctl(-1, PERF_EVENT_IOC_PERIOD, u64_efault); printf("ioctl(-1, PERF_EVENT_IOC_PERIOD, %p) = -1 EBADF (%m)\n", u64_efault); ioctl(-1, PERF_EVENT_IOC_PERIOD, u64_ptr); printf("ioctl(-1, PERF_EVENT_IOC_PERIOD, [%" PRIu64 "])" " = -1 EBADF (%m)\n", magic64); /* PERF_EVENT_IOC_SET_OUTPUT */ sys_ioctl(-1, PERF_EVENT_IOC_SET_OUTPUT, magic); printf("ioctl(-1, PERF_EVENT_IOC_SET_OUTPUT, %d) = -1 EBADF (%m)\n", (int) magic); /* PERF_EVENT_IOC_SET_FILTER */ ioctl(-1, PERF_EVENT_IOC_SET_FILTER, NULL); printf("ioctl(-1, PERF_EVENT_IOC_SET_FILTER, NULL) = -1 EBADF (%m)\n"); ioctl(-1, PERF_EVENT_IOC_SET_FILTER, str_efault); printf("ioctl(-1, PERF_EVENT_IOC_SET_FILTER, %p) = -1 EBADF (%m)\n", str_efault); ioctl(-1, PERF_EVENT_IOC_SET_FILTER, str_ptr); printf("ioctl(-1, PERF_EVENT_IOC_SET_FILTER, \"%.32s\"...)" " = -1 EBADF (%m)\n", str_ptr); ioctl(-1, PERF_EVENT_IOC_SET_FILTER, str_ptr + 40); printf("ioctl(-1, PERF_EVENT_IOC_SET_FILTER, \"%.32s\")" " = -1 EBADF (%m)\n", str_ptr + 40); str_ptr[sizeof(str) - 1] = '0'; ioctl(-1, PERF_EVENT_IOC_SET_FILTER, str_ptr + 40); printf("ioctl(-1, PERF_EVENT_IOC_SET_FILTER, %p)" " = -1 EBADF (%m)\n", str_ptr + 40); /* PERF_EVENT_IOC_ID */ ioctl(-1, PERF_EVENT_IOC_ID, NULL); printf("ioctl(-1, PERF_EVENT_IOC_ID, NULL) = -1 EBADF (%m)\n"); ioctl(-1, PERF_EVENT_IOC_ID, u64_efault); printf("ioctl(-1, PERF_EVENT_IOC_ID, %p) = -1 EBADF (%m)\n", u64_efault); ioctl(-1, PERF_EVENT_IOC_ID, u64_ptr); printf("ioctl(-1, PERF_EVENT_IOC_ID, %p) = -1 EBADF (%m)\n", u64_ptr); /* PERF_EVENT_IOC_SET_BPF */ sys_ioctl(-1, PERF_EVENT_IOC_SET_BPF, magic); printf("ioctl(-1, PERF_EVENT_IOC_SET_BPF, %d) = -1 EBADF (%m)\n", (int) magic); /* PERF_EVENT_IOC_PAUSE_OUTPUT */ sys_ioctl(-1, PERF_EVENT_IOC_PAUSE_OUTPUT, magic); printf("ioctl(-1, PERF_EVENT_IOC_PAUSE_OUTPUT, %lu) = -1 EBADF (%m)\n", (unsigned long) magic); /* PERF_EVENT_IOC_QUERY_BPF */ ioctl(-1, PERF_EVENT_IOC_QUERY_BPF, NULL); printf("ioctl(-1, PERF_EVENT_IOC_QUERY_BPF, NULL) = -1 EBADF (%m)\n"); ioctl(-1, PERF_EVENT_IOC_QUERY_BPF, u32_efault); printf("ioctl(-1, PERF_EVENT_IOC_QUERY_BPF, %p) = -1 EBADF (%m)\n", u32_efault); u32_arr[0] = 0xbadc0ded; ioctl(-1, PERF_EVENT_IOC_QUERY_BPF, u32_arr); printf("ioctl(-1, PERF_EVENT_IOC_QUERY_BPF, {ids_len=3134983661, ...})" " = -1 EBADF (%m)\n"); /* PERF_EVENT_IOC_MODIFY_ATTRIBUTES */ ioctl(-1, PERF_EVENT_IOC_MODIFY_ATTRIBUTES, NULL); printf("ioctl(-1, PERF_EVENT_IOC_MODIFY_ATTRIBUTES, NULL)" " = -1 EBADF (%m)\n"); ioctl(-1, PERF_EVENT_IOC_MODIFY_ATTRIBUTES, pea_ptr + 1); printf("ioctl(-1, PERF_EVENT_IOC_MODIFY_ATTRIBUTES, %p)" " = -1 EBADF (%m)\n", pea_ptr + 1); printf("ioctl(-1, PERF_EVENT_IOC_MODIFY_ATTRIBUTES" ", {type=%#x /* PERF_TYPE_??? */" ", size=%#x /* PERF_ATTR_SIZE_??? */" ", config=%#llx, ...}) = -1 EBADF (%m)\n", (unsigned int) pea_ptr->type, (unsigned int) pea_ptr->size, (unsigned long long) pea_ptr->config); ioctl(-1, PERF_EVENT_IOC_MODIFY_ATTRIBUTES, pea_ptr); puts("+++ exited with 0 +++"); return 0; }
{ .aio_data = (unsigned long) 0xfeedface11111111ULL, .aio_reqprio = 11, .aio_buf = (unsigned long) data0, .aio_offset = (unsigned long) 0xdeface1facefeedULL, .aio_nbytes = sizeof_data0 }, { .aio_data = (unsigned long) 0xfeedface22222222ULL, .aio_reqprio = 22, .aio_buf = (unsigned long) data1, .aio_offset = (unsigned long) 0xdeface2cafef00dULL, .aio_nbytes = sizeof_data1 } }; const struct iocb *cb = tail_memdup(proto_cb, sizeof(proto_cb)); const long proto_cbs[] = { (long) &cb[0], (long) &cb[1] }; const long *cbs = tail_memdup(proto_cbs, sizeof(proto_cbs)); TAIL_ALLOC_OBJECT_CONST_PTR(unsigned long, ctx); *ctx = 0; const unsigned int nr = ARRAY_SIZE(proto_cb); const struct io_event *ev = tail_alloc(nr * sizeof(struct io_event)); TAIL_ALLOC_OBJECT_CONST_PTR(struct timespec, ts); TAIL_ALLOC_OBJECT_CONST_PTR(struct __aio_sigset, ss); TAIL_ALLOC_OBJECT_CONST_PTR(sigset_t, sigs);
tprintf("poll(NULL, 42, 0) = -1 EFAULT (%m)\n"); # endif int fds[2]; if (pipe(fds) || pipe(fds)) perror_msg_and_fail("pipe"); const unsigned int abbrev = (ac > 1) ? atoi(av[1]) : -1; const struct pollfd pfds0[] = { { .fd = 0, .events = POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND }, { .fd = 1, .events = POLLOUT | POLLWRNORM | POLLWRBAND }, { .fd = fds[0], .events = POLLIN | POLLPRI }, { .fd = fds[1], .events = POLLOUT }, { .fd = 2, .events = POLLOUT | POLLWRBAND } }; struct pollfd *const tail_fds0 = tail_memdup(pfds0, sizeof(pfds0)); const int timeout = 42; int rc = syscall(__NR_poll, tail_fds0, 0, timeout); assert(rc == 0); # ifndef PATH_TRACING_FD tprintf("poll([], 0, %d) = %d (Timeout)\n", timeout, rc); # endif rc = syscall(__NR_poll, tail_fds0, ARRAY_SIZE(pfds0), timeout); assert(rc == 3); # ifndef PATH_TRACING_FD tprintf("poll("); print_pollfd_array_entering(tail_fds0, ARRAY_SIZE(pfds0), ARRAY_SIZE(pfds0), abbrev);
int main(void) { static const kernel_ulong_t bogus_kernel_fd = (kernel_ulong_t) 0xdeadca57badda7a1ULL; static const kernel_ulong_t bogus_initrd_fd = (kernel_ulong_t) 0xdec0ded1defaced2ULL; static const char cmdline_str[] = CMDLINE_STR; static const char cmdline_short_str[] = "abcdef"; static const kernel_ulong_t cmdline_lens[] = { 0, (kernel_ulong_t) 0xcaffeeeddeadbeefULL, sizeof(cmdline_str), sizeof(cmdline_str) - 1, sizeof(cmdline_short_str), sizeof(cmdline_short_str) - 1, sizeof(cmdline_short_str) + 1, }; static const struct strval flags[] = { { (kernel_ulong_t) 0xbadc0dedda7a1058ULL, "0xbadc0ded", "0x", "da7a1058 /* KEXEC_FILE_??? */" }, { 0, "", "", "0" }, { 0xdeadbeef, "", "", "KEXEC_FILE_UNLOAD|KEXEC_FILE_ON_CRASH|" "KEXEC_FILE_NO_INITRAMFS|0xdeadbee8" }, }; long rc; char *cmdline = tail_memdup(cmdline_str, sizeof(cmdline_str)); char *cmdline_short = tail_memdup(cmdline_short_str, sizeof(cmdline_short_str)); char cmdline_ptr[sizeof("0x") + sizeof(void *) * 2]; char cmdline_short_ptr[sizeof("0x") + sizeof(void *) * 2]; unsigned int i; unsigned int j; struct strval cmdlines[] = { { (uintptr_t) NULL, "", "", "NULL" }, { (uintptr_t) (cmdline + sizeof(cmdline_str)), "", "", cmdline_ptr }, { (uintptr_t) cmdline, "", "", "\"deadcodeb\"..." }, { (uintptr_t) cmdline, "", "", "\"deadcodeb\"..." }, { (uintptr_t) cmdline_short, "", "", "\"abcdef\\0\"" }, { (uintptr_t) cmdline_short, "", "", "\"abcdef\"" }, { (uintptr_t) cmdline_short, "", "", cmdline_short_ptr }, }; snprintf(cmdline_ptr, sizeof(cmdline_ptr), "%p", cmdline + sizeof(cmdline_str)); snprintf(cmdline_short_ptr, sizeof(cmdline_short_ptr), "%p", cmdline_short); for (i = 0; i < ARRAY_SIZE(flags); i++) { for (j = 0; j < ARRAY_SIZE(cmdlines); j++) { rc = syscall(__NR_kexec_file_load, bogus_kernel_fd, bogus_initrd_fd, cmdline_lens[j], cmdlines[j].val, flags[i].val); printf("kexec_file_load(%d, %d, %llu, %s, %s%s) = %s\n", (int) bogus_kernel_fd, (int) bogus_initrd_fd, (unsigned long long) cmdline_lens[j], cmdlines[j].str, sizeof(kernel_ulong_t) == 8 ? flags[i].str64 : flags[i].str32, flags[i].str, sprintrc(rc)); } } puts("+++ exited with 0 +++"); return 0; }
static const char w[] = "0123456789abcde"; if (write(fd, w, LENGTH_OF(w)) != LENGTH_OF(w)) perror_msg_and_fail("write"); static const char r0_c[] = "01234567"; static const char r1_c[] = "89abcde"; const unsigned int r_len = (LENGTH_OF(w) + 1) / 2; void *r0 = tail_alloc(r_len); const struct iovec r0_iov_[] = { { .iov_base = r0, .iov_len = r_len } }; const struct iovec *r_iov = tail_memdup(r0_iov_, sizeof(r0_iov_)); long rc; rc = preadv(fd, r_iov, ARRAY_SIZE(r0_iov_), 0); if (rc != (int) r_len) perror_msg_and_fail("preadv: expected %u, returned %ld", r_len, rc); printf("preadv(%d, [{iov_base=\"%s\", iov_len=%u}], %u, 0) = %u\n", fd, r0_c, r_len, ARRAY_SIZE(r0_iov_), r_len); void *r1 = tail_alloc(r_len); void *r2 = tail_alloc(LENGTH_OF(w)); const struct iovec r1_iov_[] = { { .iov_base = r1,
{ .aio_data = (unsigned long) 0xfeedface11111111ULL, .aio_reqprio = 11, .aio_buf = (unsigned long) data0, .aio_offset = (unsigned long) 0xdeface1facefeedULL, .aio_nbytes = sizeof_data0 }, { .aio_data = (unsigned long) 0xfeedface22222222ULL, .aio_reqprio = 22, .aio_buf = (unsigned long) data1, .aio_offset = (unsigned long) 0xdeface2cafef00dULL, .aio_nbytes = sizeof_data1 } }; const struct iocb *cb = tail_memdup(proto_cb, sizeof(proto_cb)); const struct iovec proto_iov0[] = { { .iov_base = data0, .iov_len = sizeof_data0 / 4 }, { .iov_base = data0 + sizeof_data0 / 4, .iov_len = sizeof_data0 / 4 * 3 }, }; const struct iovec *iov0 = tail_memdup(proto_iov0, sizeof(proto_iov0)); const struct iovec proto_iov1[] = { {
int main(void) { skip_if_unavailable("/proc/self/fd/"); const struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) }; struct sockaddr * const listen_sa = tail_memdup(&addr, sizeof(addr)); TAIL_ALLOC_OBJECT_CONST_PTR(socklen_t, len); *len = sizeof(addr); const int listen_fd = socket(AF_INET, SOCK_STREAM, 0); if (listen_fd < 0) perror_msg_and_skip("socket"); const unsigned long listen_inode = inode_of_sockfd(listen_fd); printf("socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = %d<TCP:[%lu]>\n", listen_fd, listen_inode); if (bind(listen_fd, listen_sa, *len)) perror_msg_and_skip("bind"); printf("bind(%d<TCP:[%lu]>, {sa_family=AF_INET, sin_port=htons(0)" ", sin_addr=inet_addr(\"127.0.0.1\")}, %u) = 0\n", listen_fd, listen_inode, (unsigned) *len); if (listen(listen_fd, 1)) perror_msg_and_skip("listen"); printf("listen(%d<TCP:[%lu]>, 1) = 0\n", listen_fd, listen_inode); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getsockname(listen_fd, listen_sa, len)) perror_msg_and_fail("getsockname"); const unsigned int listen_port = ntohs(((struct sockaddr_in *) listen_sa)->sin_port); printf("getsockname(%d<TCP:[127.0.0.1:%u]>, {sa_family=AF_INET" ", sin_port=htons(%u), sin_addr=inet_addr(\"127.0.0.1\")}" ", [%u]) = 0\n", listen_fd, listen_port, listen_port, (unsigned) *len); TAIL_ALLOC_OBJECT_CONST_PTR(unsigned int, optval); *len = sizeof(*optval); if (getsockopt(listen_fd, SOL_TCP, TCP_MAXSEG, optval, len)) perror_msg_and_fail("getsockopt"); printf("getsockopt(%d<TCP:[127.0.0.1:%u]>, SOL_TCP, TCP_MAXSEG" ", [%u], [%u]) = 0\n", listen_fd, listen_port, *optval, (unsigned) *len); const int connect_fd = socket(AF_INET, SOCK_STREAM, 0); if (connect_fd < 0) perror_msg_and_fail("socket"); const unsigned long connect_inode = inode_of_sockfd(connect_fd); printf("socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = %d<TCP:[%lu]>\n", connect_fd, connect_inode); *len = sizeof(addr); if (connect(connect_fd, listen_sa, *len)) perror_msg_and_fail("connect"); printf("connect(%d<TCP:[%lu]>, {sa_family=AF_INET, sin_port=htons(%u)" ", sin_addr=inet_addr(\"127.0.0.1\")}, %u) = 0\n", connect_fd, connect_inode, listen_port, (unsigned) *len); struct sockaddr * const accept_sa = tail_alloc(sizeof(addr)); memset(accept_sa, 0, sizeof(addr)); *len = sizeof(addr); const int accept_fd = accept(listen_fd, accept_sa, len); if (accept_fd < 0) perror_msg_and_fail("accept"); const unsigned int connect_port = ntohs(((struct sockaddr_in *) accept_sa)->sin_port); printf("accept(%d<TCP:[127.0.0.1:%u]>, {sa_family=AF_INET" ", sin_port=htons(%u), sin_addr=inet_addr(\"127.0.0.1\")}" ", [%u]) = %d<TCP:[127.0.0.1:%u->127.0.0.1:%u]>\n", listen_fd, listen_port, connect_port, (unsigned) *len, accept_fd, listen_port, connect_port); memset(accept_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getpeername(accept_fd, accept_sa, len)) perror_msg_and_fail("getpeername"); printf("getpeername(%d<TCP:[127.0.0.1:%u->127.0.0.1:%u]>" ", {sa_family=AF_INET, sin_port=htons(%u)" ", sin_addr=inet_addr(\"127.0.0.1\")}, [%u]) = 0\n", accept_fd, listen_port, connect_port, connect_port, (unsigned) *len); memset(listen_sa, 0, sizeof(addr)); *len = sizeof(addr); if (getpeername(connect_fd, listen_sa, len)) perror_msg_and_fail("getpeername"); printf("getpeername(%d<TCP:[127.0.0.1:%u->127.0.0.1:%u]>" ", {sa_family=AF_INET, sin_port=htons(%u)" ", sin_addr=inet_addr(\"127.0.0.1\")}, [%u]) = 0\n", connect_fd, connect_port, listen_port, listen_port, (unsigned) *len); *len = sizeof(*optval); if (setsockopt(connect_fd, SOL_TCP, TCP_MAXSEG, optval, *len)) perror_msg_and_fail("setsockopt"); printf("setsockopt(%d<TCP:[127.0.0.1:%u->127.0.0.1:%u]>" ", SOL_TCP, TCP_MAXSEG, [%u], %u) = 0\n", connect_fd, connect_port, listen_port, *optval, (unsigned) *len); char text[] = "text"; assert(sendto(connect_fd, text, sizeof(text) - 1, MSG_DONTROUTE | MSG_DONTWAIT, NULL, 0) == sizeof(text) - 1); printf("sendto(%d<TCP:[127.0.0.1:%u->127.0.0.1:%u]>, \"%s\", %u" ", MSG_DONTROUTE|MSG_DONTWAIT, NULL, 0) = %u\n", connect_fd, connect_port, listen_port, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(connect_fd) == 0); printf("close(%d<TCP:[127.0.0.1:%u->127.0.0.1:%u]>) = 0\n", connect_fd, connect_port, listen_port); assert(recvfrom(accept_fd, text, sizeof(text) - 1, MSG_WAITALL, NULL, NULL) == sizeof(text) - 1); printf("recvfrom(%d<TCP:[127.0.0.1:%u->127.0.0.1:%u]>, \"%s\", %u" ", MSG_WAITALL, NULL, NULL) = %u\n", accept_fd, listen_port, connect_port, text, (unsigned) sizeof(text) - 1, (unsigned) sizeof(text) - 1); assert(close(accept_fd) == 0); printf("close(%d<TCP:[127.0.0.1:%u->127.0.0.1:%u]>) = 0\n", accept_fd, listen_port, connect_port); assert(close(listen_fd) == 0); printf("close(%d<TCP:[127.0.0.1:%u]>) = 0\n", listen_fd, listen_port); puts("+++ exited with 0 +++"); return 0; }
int main(void) { static const char unterminated1[] = { '\1', '\2', '\3', '\4', '\5' }; static const char unterminated2[] = { '\6', '\7', '\10', '\11', '\12' }; static const char unterminated3[] = { '\16', '\17', '\20', '\21', '\22' }; char *bogus_type = tail_memdup(unterminated1, sizeof(unterminated1)); char *bogus_desc = tail_memdup(unterminated2, sizeof(unterminated2)); char *bogus_info = tail_memdup(unterminated3, sizeof(unterminated3)); unsigned i; unsigned j; unsigned k; unsigned l; struct { const char *type; const char *str; } types[] = { { ARG_STR(NULL) }, { bogus_type + sizeof(unterminated1), NULL }, { bogus_type, NULL }, { ARG_STR("\20\21\22\23\24") }, { ARG_STR("user") }, }; struct { const char *desc; const char *str; } descs[] = { { ARG_STR(NULL) }, { bogus_desc + sizeof(unterminated2), NULL }, { bogus_desc, NULL }, { ARG_STR("\25\26\27\30\31") }, { ARG_STR("desc") }, { "overly long description", STRINGIFY("overly long ") "..." }, }; struct { const char *info; const char *str; } infos[] = { { ARG_STR(NULL) }, { bogus_info + sizeof(unterminated3), NULL }, { bogus_info, NULL }, { ARG_STR("\32\33\34\35\36") }, { ARG_STR("info") }, { "overly long info", STRINGIFY("overly long ") "..." }, }; struct { uint32_t keyring; const char *str; } keyrings[] = { { ARG_STR(0) }, { ARG_STR(1234567890) }, { ARG_STR(-1234567890) }, { -1, "KEY_SPEC_THREAD_KEYRING" }, }; for (i = 0; i < ARRAY_SIZE(types); i++) for (j = 0; j < ARRAY_SIZE(descs); j++) for (k = 0; k < ARRAY_SIZE(infos); k++) for (l = 0; l < ARRAY_SIZE(keyrings); l++) do_request_key( types[i].type, types[i].str, descs[j].desc, descs[j].str, infos[k].info, infos[k].str, keyrings[l].keyring, keyrings[l].str); puts("+++ exited with 0 +++"); return 0; }