Repository navigation
test/sqpoll-disable-exit: pass real output pointers to the setup helper - #1650
Open
ManoharPaturi wants to merge 1 commit into
Open
ManoharPaturi wants to merge 1 commit into
ManoharPaturi wants to merge 1 commit into
Conversation
syz_io_uring_setup() stores the mapped ring and SQEs pointers through its last two arguments, but execute_one() passes NULL for both, so every forked iteration crashes on a NULL write right after the first mmap(). The reproduction therefore never reaches the exit path it is meant to exercise, and the run spams crashes (and core dumps, where enabled) for all 100 iterations. Hand it the addresses of local variables instead, so the setup runs to completion like the original syzkaller program. Fixes: axboe#1632
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
syz_io_uring_setup() stores the mapped ring and SQE pointers through its last two arguments, but execute_one() passes NULL for both, so every one of the 100 forked iterations crashes storing the ring mapping into a NULL pointer. The reproduction never reaches the exit path it is meant to exercise, and the run leaves 100 crashes behind, with core dumps wherever those are enabled.
Give the helper the addresses of two local variables so the setup runs to completion, matching the original syzkaller program, which passed proper storage for both outputs.
Fixes issue #1632. Verified on an Ubuntu 24.04 runner: the test now completes all iterations instead of crashing in every child.