executor/common_linux.h: open target dir inside syz_mount_image()

Refactor syz_mount_image() to support filesystems not requiring a
backing device and filesystem image (e.g. FUSE). To do that, we check for
the presence of the pointer to the array of struct fs_image_segment: if
missingi, there is no need to setup the loop device and we can proceed
directly with the mount() syscall.
Add syz_mount_image$fuse() (specialization for FUSE) inside
sys/linux/fs_fuse.txt.

1 files changed, 71 insertions, 67 deletions

diff --git a/pkg/csource/generated.go b/pkg/csource/generated.go
index c28b1ccaf..83781ded9 100644
--- a/pkg/csource/generated.go
+++ b/pkg/csource/generated.go
@@ -5769,13 +5769,11 @@ struct fs_image_segment {
 #define sys_memfd_create 279
 #endif
 
-static unsigned long fs_image_segment_check(unsigned long size, unsigned long nsegs, long segments)
+static unsigned long fs_image_segment_check(unsigned long size, unsigned long nsegs, struct fs_image_segment* segs)
 {
-	struct fs_image_segment* segs = (struct fs_image_segment*)segments;
-
 	if (nsegs > IMAGE_MAX_SEGMENTS)
 		nsegs = IMAGE_MAX_SEGMENTS;
-	for (unsigned long i = 0; i < nsegs; i++) {
+	for (size_t i = 0; i < nsegs; i++) {
 		if (segs[i].size > IMAGE_MAX_SIZE)
 			segs[i].size = IMAGE_MAX_SIZE;
 		segs[i].offset %= IMAGE_MAX_SIZE;
@@ -5788,14 +5786,12 @@ static unsigned long fs_image_segment_check(unsigned long size, unsigned long ns
 		size = IMAGE_MAX_SIZE;
 	return size;
 }
-#endif
-
-#if SYZ_EXECUTOR || __NR_syz_read_part_table
-static long syz_read_part_table(volatile unsigned long size, volatile unsigned long nsegs, volatile long segments)
+static int setup_loop_device(long unsigned size, long unsigned nsegs, struct fs_image_segment* segs, const char* loopname, int* memfd_p, int* loopfd_p)
 {
-	int err = 0, res = -1, loopfd = -1;
-	size = fs_image_segment_check(size, nsegs, segments);
-	int memfd = syscall(sys_memfd_create, "syz_read_part_table", 0);
+	int err = 0, loopfd = -1;
+
+	size = fs_image_segment_check(size, nsegs, segs);
+	int memfd = syscall(sys_memfd_create, "syzkaller", 0);
 	if (memfd == -1) {
 		err = errno;
 		goto error;
@@ -5804,14 +5800,12 @@ static long syz_read_part_table(volatile unsigned long size, volatile unsigned l
 		err = errno;
 		goto error_close_memfd;
 	}
-	for (unsigned long i = 0; i < nsegs; i++) {
-		struct fs_image_segment* segs = (struct fs_image_segment*)segments;
+	for (size_t i = 0; i < nsegs; i++) {
 		if (pwrite(memfd, segs[i].data, segs[i].size, segs[i].offset) < 0) {
-			debug("syz_read_part_table: pwrite[%u] failed: %d\n", (int)i, errno);
+			debug("setup_loop_device: pwrite[%zu] failed: %d\n", i, errno);
 		}
 	}
-	char loopname[64];
-	snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
+
 	loopfd = open(loopname, O_RDWR);
 	if (loopfd == -1) {
 		err = errno;
@@ -5829,6 +5823,32 @@ static long syz_read_part_table(volatile unsigned long size, volatile unsigned l
 			goto error_close_loop;
 		}
 	}
+
+	*memfd_p = memfd;
+	*loopfd_p = loopfd;
+	return 0;
+
+error_close_loop:
+	close(loopfd);
+error_close_memfd:
+	close(memfd);
+error:
+	errno = err;
+	return -1;
+}
+#endif
+
+#if SYZ_EXECUTOR || __NR_syz_read_part_table
+static long syz_read_part_table(volatile unsigned long size, volatile unsigned long nsegs, volatile long segments)
+{
+	struct fs_image_segment* segs = (struct fs_image_segment*)segments;
+	int err = 0, res = -1, loopfd = -1, memfd = -1;
+	char loopname[64];
+
+	snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
+	if (setup_loop_device(size, nsegs, segs, loopname, &memfd, &loopfd) == -1)
+		return -1;
+
 	struct loop_info64 info;
 	if (ioctl(loopfd, LOOP_GET_STATUS64, &info)) {
 		err = errno;
@@ -5856,64 +5876,42 @@ static long syz_read_part_table(volatile unsigned long size, volatile unsigned l
 	}
 error_clear_loop:
 	ioctl(loopfd, LOOP_CLR_FD, 0);
-error_close_loop:
 	close(loopfd);
-error_close_memfd:
 	close(memfd);
-error:
 	errno = err;
 	return res;
 }
 #endif
 
 #if SYZ_EXECUTOR || __NR_syz_mount_image
+#include <stddef.h>
 #include <string.h>
 #include <sys/mount.h>
 static long syz_mount_image(volatile long fsarg, volatile long dir, volatile unsigned long size, volatile unsigned long nsegs, volatile long segments, volatile long flags, volatile long optsarg)
 {
-	int err = 0, res = -1, loopfd = -1;
-	size = fs_image_segment_check(size, nsegs, segments);
-	int memfd = syscall(sys_memfd_create, "syz_mount_image", 0);
-	if (memfd == -1) {
-		err = errno;
-		goto error;
-	}
-	if (ftruncate(memfd, size)) {
-		err = errno;
-		goto error_close_memfd;
-	}
-	for (unsigned long i = 0; i < nsegs; i++) {
-		struct fs_image_segment* segs = (struct fs_image_segment*)segments;
-		if (pwrite(memfd, segs[i].data, segs[i].size, segs[i].offset) < 0) {
-			debug("syz_mount_image: pwrite[%u] failed: %d\n", (int)i, errno);
-		}
-	}
+	struct fs_image_segment* segs = (struct fs_image_segment*)segments;
+	int res = -1, err = 0, loopfd = -1, memfd = -1, need_loop_device = !!segs;
+	char* mount_opts = (char*)optsarg;
+	char* target = (char*)dir;
+	char* fs = (char*)fsarg;
+	char* source = NULL;
 	char loopname[64];
-	snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
-	loopfd = open(loopname, O_RDWR);
-	if (loopfd == -1) {
-		err = errno;
-		goto error_close_memfd;
-	}
-	if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
-		if (errno != EBUSY) {
-			err = errno;
-			goto error_close_loop;
-		}
-		ioctl(loopfd, LOOP_CLR_FD, 0);
-		usleep(1000);
-		if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
-			err = errno;
-			goto error_close_loop;
-		}
+
+	if (need_loop_device) {
+		memset(loopname, 0, sizeof(loopname));
+		snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
+		if (setup_loop_device(size, nsegs, segs, loopname, &memfd, &loopfd) == -1)
+			return -1;
+		source = loopname;
 	}
-	mkdir((char*)dir, 0777);
-	char fs[32];
-	memset(fs, 0, sizeof(fs));
-	strncpy(fs, (char*)fsarg, sizeof(fs) - 1);
+
+	mkdir(target, 0777);
 	char opts[256];
 	memset(opts, 0, sizeof(opts));
-	strncpy(opts, (char*)optsarg, sizeof(opts) - 32);
+	if (strlen(mount_opts) > (sizeof(opts) - 32)) {
+		debug("ERROR: syz_mount_image parameter optsarg bigger than internal opts\n");
+	}
+	strncpy(opts, mount_opts, sizeof(opts) - 32);
 	if (strcmp(fs, "iso9660") == 0) {
 		flags |= MS_RDONLY;
 	} else if (strncmp(fs, "ext", 3) == 0) {
@@ -5922,22 +5920,28 @@ static long syz_mount_image(volatile long fsarg, volatile long dir, volatile uns
 	} else if (strcmp(fs, "xfs") == 0) {
 		strcat(opts, ",nouuid");
 	}
-	debug("syz_mount_image: size=%llu segs=%llu loop='%s' dir='%s' fs='%s' flags=%llu opts='%s'\n", (uint64)size, (uint64)nsegs, loopname, (char*)dir, fs, (uint64)flags, opts);
+	debug("syz_mount_image: size=%llu segs=%llu loop='%s' dir='%s' fs='%s' flags=%llu opts='%s'\n", (uint64)size, (uint64)nsegs, loopname, target, fs, (uint64)flags, opts);
 #if SYZ_EXECUTOR
 	cover_reset(0);
 #endif
-	if (mount(loopname, (char*)dir, fs, flags, opts)) {
+	res = mount(source, target, fs, flags, opts);
+	if (res == -1) {
+		debug("syz_mount_image > mount error: %d\n", errno);
 		err = errno;
 		goto error_clear_loop;
 	}
-	res = 0;
+	res = open(target, O_RDONLY | O_DIRECTORY);
+	if (res == -1) {
+		debug("syz_mount_image > open error: %d\n", errno);
+		err = errno;
+	}
+
 error_clear_loop:
-	ioctl(loopfd, LOOP_CLR_FD, 0);
-error_close_loop:
-	close(loopfd);
-error_close_memfd:
-	close(memfd);
-error:
+	if (need_loop_device) {
+		ioctl(loopfd, LOOP_CLR_FD, 0);
+		close(loopfd);
+		close(memfd);
+	}
 	errno = err;
 	return res;
 }