[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1

echo "syscall fuzzing of write(2) using /dev entries writable by 'other'"

mntpoint=/mnt
mdstart=10

odir=`pwd`
cd /tmp
sed '1,/^EOF/d' < $odir/$0 > syscall4.c
sed -i '' -e "s#MNTPOINT#$mntpoint#" syscall4.c
rm -f /tmp/syscall4
cc -o syscall4 -Wall -Wextra -O2 -g syscall4.c -lpthread || exit 1
rm -f syscall4.c

kldstat -v | grep -q snd_dummy || kldload snd_dummy.ko

mount | grep -q "on $mntpoint " && umount -f $mntpoint
[ -c /dev/md$mdstart ] && mdconfig -d -u $mdstart

mdconfig -a -t swap -s 2g -u $mdstart || exit 1
newfs $newfs_flags -n md$mdstart > /dev/null
mount /dev/md$mdstart $mntpoint
chmod 777 $mntpoint

sleeptime=${sleeptime:-12}
st=`date '+%s'`
while [ $((`date '+%s'` - st)) -lt $((10 * sleeptime)) ]; do
	(cd $mntpoint; /tmp/syscall4 $* 1>>stdout 2>>stderr) &
	start=`date '+%s'`
	while [ $((`date '+%s'` - start)) -lt $sleeptime ]; do
		pgrep syscall4 > /dev/null || break
		sleep .5
	done
	while pkill -9 syscall4; do :; done
	wait
	ipcs | grep nobody | awk '/^(q|m|s)/ {print " -" $1, $2}' |
	    xargs -L 1 ipcrm
done
while pkill -9 syscall4; do :; done

for i in `jot 10`; do
	mount | grep -q md$mdstart  && \
		umount $mntpoint && mdconfig -d -u $mdstart && break
	sleep 10
done
if mount | grep -q md$mdstart; then
	fstat $mntpoint
	echo "umount $mntpoint failed"
	exit 1
fi
rm -f /tmp/syscall4
exit 0
EOF
#include <sys/types.h>
#include <sys/event.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/wait.h>

#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <fts.h>
#include <libutil.h>
#include <pthread.h>
#if defined(__FreeBSD__)
#include <pthread_np.h>
#define	__NP__
#endif
#include <pwd.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

static int ignore[] = {
	SYS_syscall,
	SYS_exit,
	SYS_fork,
	11,			/* 11 is obsolete execv */
	SYS_reboot,
	SYS_vfork,
	109,			/* 109 is old sigblock */
	111,			/* 111 is old sigsuspend */
	SYS_shutdown,
	SYS___syscall,
	216,			/* custom syscall */
	SYS_rfork,
	SYS_mac_syscall,
};

static int fd[900];
#ifndef nitems
#define nitems(x) (sizeof((x)) / sizeof((x)[0]))
#endif
#define N 4096
#define MAGIC 1664
#define RUNTIME 120
#define THREADS 4

static uint32_t r[N];
static int magic1, syscallno, magic2;

static int
random_int(int mi, int ma)
{
        return (arc4random()  % (ma - mi + 1) + mi);
}

static void
hand(int i __unused) {	/* handler */
	exit(1);
}

static unsigned long
makearg(void)
{
	unsigned int i;
	unsigned long val;

	val = arc4random();
	i   = arc4random() % 100;
	if (i < 20)
		val = val & 0xff;
	if (i >= 20 && i < 40)
		val = val & 0xffff;
	if (i >= 40 && i < 60)
		val = (unsigned long)(r) | (val & 0xffff);
#if defined(__LP64__)
	if (i >= 60) {
		val = (val << 32) | arc4random();
		if (i > 80)
			val = val & 0x00007fffffffffffUL;
	}
#endif

	return(val);
}

static void *
test(void *arg __unused)
{
	FTS *fts;
	FTSENT *p;
	time_t start;
	int ftsoptions, i, numfiles;
	char *args[] = {
	    "/dev",
	    NULL,
	};

#ifdef __NP__
	pthread_set_name_np(pthread_self(), __func__);
#endif
	numfiles = 0;
	ftsoptions = FTS_PHYSICAL;
	start = time(NULL);
	while (time(NULL) - start < 2) {
		for (i = 0; i < N; i++)
			r[i] = arc4random();

		if ((fts = fts_open(args, ftsoptions, NULL)) == NULL)
			err(1, "fts_open");

		i = 0;
		while ((p = fts_read(fts)) != NULL) {
			if (fd[i] > 0)
				close(fd[i]);
			if ((fd[i] = open(p->fts_path, O_RDWR)) == -1)
				if ((fd[i] = open(p->fts_path, O_WRONLY)) ==
				    -1)
					if ((fd[i] = open(p->fts_path,
					    O_RDONLY)) == -1)
						continue;
			i++;
			i = i % nitems(fd);
			if (numfiles++ < 10) {
				fprintf(stderr, "%d: pts_path = %s\n",
				    numfiles, p->fts_path);
			}
		}

		if (fts_close(fts) == -1)
			warn("fts_close()");
		sleep(1);
	}
	return(NULL);
}

static void *
calls(void *arg __unused)
{
	time_t start;
	int i __unused, j, num;
	unsigned long arg1, arg2, arg3, arg4, arg5, arg6, arg7;

#ifdef __NP__
	pthread_set_name_np(pthread_self(), __func__);
#endif
	start = time(NULL);
	for (i = 0; time(NULL) - start < 10; i++) {
		num = syscallno;
		while (num == 0) {
			num = random_int(0, SYS_MAXSYSCALL);
			for (j = 0; j < (int)nitems(ignore); j++)
				if (num == ignore[j]) {
					num = 0;
					break;
				}
		}
		arg1 = makearg();
		arg2 = makearg();
		arg3 = makearg();
		arg4 = makearg();
		arg5 = makearg();
		arg6 = makearg();
		arg7 = makearg();

#if 0		/* Debug mode */
		fprintf(stderr, "%2d : syscall(%3d, %lx, %lx, %lx, %lx, %lx,"
		   " %lx, %lx)\n",
			i, num, arg1, arg2, arg3, arg4, arg5, arg6, arg7);
		sleep(2);
#endif
		alarm(1);
		syscall(num, arg1, arg2, arg3, arg4, arg5, arg6, arg7);
		num = 0;
		if (magic1 != MAGIC || magic2 != MAGIC)
			exit(1);
	}

	return (NULL);
}

int
main(void)
{
	struct passwd *pw;
	struct rlimit limit;
	pthread_t rp, cp[THREADS];
	time_t start;
	int e, j;

	magic1 = magic2 = MAGIC;
	if ((pw = getpwnam("nobody")) == NULL)
		err(1, "failed to resolve nobody");

	if (setgroups(0, NULL) ||
	    setegid(pw->pw_gid) || setgid(pw->pw_gid) ||
	    seteuid(pw->pw_uid) || setuid(pw->pw_uid))
		err(1, "Can't drop privileges to \"nobody\"");
	endpwent();

	limit.rlim_cur = limit.rlim_max = 1000;
#if defined(RLIMIT_NPTS)
	if (setrlimit(RLIMIT_NPTS, &limit) < 0)
		err(1, "setrlimit");
#endif

	signal(SIGALRM, hand);
	signal(SIGILL,  hand);
	signal(SIGFPE,  hand);
	signal(SIGSEGV, hand);
	signal(SIGBUS,  hand);
	signal(SIGURG,  hand);
	signal(SIGSYS,  hand);
	signal(SIGTRAP, hand);

	syscallno = 4; /* write(2) */
	if (daemon(1, 1) == -1)
		err(1, "daemon()");

	system("touch aaa bbb ccc; mkdir -p ddd");
	start = time(NULL);
	while ((time(NULL) - start) < RUNTIME) {
		if (fork() == 0) {
			if ((e = pthread_create(&rp, NULL, test, NULL)) != 0)
				errc(1, e, "pthread_create");
			usleep(1000);
			for (j = 0; j < THREADS; j++)
				if ((e = pthread_create(&cp[j], NULL, calls,
				    NULL)) != 0)
					errc(1, e, "pthread_create");
			for (j = 0; j < THREADS; j++)
				pthread_join(cp[j], NULL);

			if ((e = pthread_kill(rp, SIGINT)) != 0)
				errc(1, e, "pthread_kill");
			exit(0);
		}
		wait(NULL);
		usleep(10000);
	}

	return (0);
}