diff options
Diffstat (limited to 'test/double-poll-crash.c')
| -rw-r--r-- | test/double-poll-crash.c | 22 |
1 files changed, 15 insertions, 7 deletions
diff --git a/test/double-poll-crash.c b/test/double-poll-crash.c index 2a012e5..231c7da 100644 --- a/test/double-poll-crash.c +++ b/test/double-poll-crash.c @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: MIT */ // https://syzkaller.appspot.com/bug?id=5c9918d20f771265ad0ffae3c8f3859d24850692 // autogenerated by syzkaller (https://github.com/google/syzkaller) @@ -51,10 +52,14 @@ static long syz_io_uring_setup(volatile long a0, volatile long a1, *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQ_RING); + if (*ring_ptr_out == MAP_FAILED) + exit(0); uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE; *sqes_ptr_out = mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES); + if (*sqes_ptr_out == MAP_FAILED) + exit(0); return fd_io_uring; } @@ -103,21 +108,24 @@ static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2) } } -#ifndef __NR_io_uring_enter -#define __NR_io_uring_enter 426 -#endif - uint64_t r[4] = {0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff}; int main(int argc, char *argv[]) { + void *mmap_ret; +#if !defined(__i386) && !defined(__x86_64__) + return 0; +#endif if (argc > 1) return 0; - mmap((void *)0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); - mmap((void *)0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); - mmap((void *)0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); + mmap_ret = mmap((void *)0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); + if (mmap_ret == MAP_FAILED) + return 0; + mmap_ret = mmap((void *)0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); + if (mmap_ret == MAP_FAILED) + return 0; intptr_t res = 0; *(uint32_t*)0x20000484 = 0; *(uint32_t*)0x20000488 = 0; |