polyphony 1.4 → 1.6

data/vendor/liburing/test/io_uring_register.c

@@ -32,7 +32,7 @@ static rlim_t mlock_limit;
 static int devnull;
 
 static int expect_fail(int fd, unsigned int opcode, void *arg,
-	    unsigned int nr_args, int error)
+		       unsigned int nr_args, int error, int error2)
 {
 	int ret;
 
@@ -55,8 +55,8 @@ static int expect_fail(int fd, unsigned int opcode, void *arg,
 		return 1;
 	}
 
-	if (ret != error) {
-		fprintf(stderr, "expected %d, got %d\n", error, ret);
+	if (ret != error && (error2 && ret != error2)) {
+		fprintf(stderr, "expected %d/%d, got %d\n", error, error2, ret);
 		return 1;
 	}
 	return 0;
@@ -195,8 +195,7 @@ static int test_max_fds(int uring_fd)
 		status = 0;
 		ret = io_uring_register(uring_fd, IORING_UNREGISTER_FILES, 0, 0);
 		if (ret < 0) {
-			ret = errno;
-			errno = ret;
+			errno = -ret;
 			perror("io_uring_register UNREGISTER_FILES");
 			exit(1);
 		}
@@ -230,22 +229,20 @@ static int test_memlock_exceeded(int fd)
 
 	while (iov.iov_len) {
 		ret = io_uring_register(fd, IORING_REGISTER_BUFFERS, &iov, 1);
-		if (ret < 0) {
-			if (errno == ENOMEM) {
-				iov.iov_len /= 2;
-				continue;
-			}
-			if (errno == EFAULT) {
-				free(buf);
-				return 0;
-			}
-			fprintf(stderr, "expected success or EFAULT, got %d\n", errno);
+		if (ret == -ENOMEM) {
+			iov.iov_len /= 2;
+			continue;
+		} else if (ret == -EFAULT) {
+			free(buf);
+			return 0;
+		} else if (ret) {
+			fprintf(stderr, "expected success or EFAULT, got %d\n", ret);
 			free(buf);
 			return 1;
 		}
 		ret = io_uring_register(fd, IORING_UNREGISTER_BUFFERS, NULL, 0);
 		if (ret != 0) {
-			fprintf(stderr, "error: unregister failed with %d\n", errno);
+			fprintf(stderr, "error: unregister failed with %d\n", ret);
 			free(buf);
 			return 1;
 		}
@@ -277,15 +274,15 @@ static int test_iovec_nr(int fd)
 		iovs[i].iov_len = pagesize;
 	}
 
-	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, iovs, nr, -EINVAL);
+	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, iovs, nr, -EINVAL, 0);
 
 	/* reduce to UIO_MAXIOV */
 	nr = UIO_MAXIOV;
 	ret = io_uring_register(fd, IORING_REGISTER_BUFFERS, iovs, nr);
-	if (ret && (errno == ENOMEM || errno == EPERM) && geteuid()) {
+	if ((ret == -ENOMEM || ret == -EPERM) && geteuid()) {
 		fprintf(stderr, "can't register large iovec for regular users, skip\n");
 	} else if (ret != 0) {
-		fprintf(stderr, "expected success, got %d\n", errno);
+		fprintf(stderr, "expected success, got %d\n", ret);
 		status = 1;
 	} else {
 		io_uring_register(fd, IORING_UNREGISTER_BUFFERS, 0, 0);
@@ -308,12 +305,12 @@ static int test_iovec_size(int fd)
 	/* NULL pointer for base */
 	iov.iov_base = 0;
 	iov.iov_len = 4096;
-	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, &iov, 1, -EFAULT);
+	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, &iov, 1, -EFAULT, 0);
 
 	/* valid base, 0 length */
 	iov.iov_base = &buf;
 	iov.iov_len = 0;
-	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, &iov, 1, -EFAULT);
+	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, &iov, 1, -EFAULT, 0);
 
 	/* valid base, length exceeds size */
 	/* this requires an unampped page directly after buf */
@@ -324,7 +321,7 @@ static int test_iovec_size(int fd)
 	assert(ret == 0);
 	iov.iov_base = buf;
 	iov.iov_len = 2 * pagesize;
-	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, &iov, 1, -EFAULT);
+	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, &iov, 1, -EFAULT, 0);
 	munmap(buf, pagesize);
 
 	/* huge page */
@@ -372,7 +369,7 @@ static int test_iovec_size(int fd)
 		status = 1;
 	iov.iov_base = buf;
 	iov.iov_len = 2*1024*1024;
-	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, &iov, 1, -EOPNOTSUPP);
+	status |= expect_fail(fd, IORING_REGISTER_BUFFERS, &iov, 1, -EFAULT, -EOPNOTSUPP);
 	munmap(buf, 2*1024*1024);
 
 	/* bump up against the soft limit and make sure we get EFAULT
@@ -410,7 +407,7 @@ static int ioring_poll(struct io_uring *ring, int fd, int fixed)
 		return 1;
 	}
 	ret = 0;
-	if (cqe->res != POLLOUT) {
+	if (!(cqe->res & POLLOUT)) {
 		fprintf(stderr, "io_uring_wait_cqe: expected 0x%.8x, got 0x%.8x\n",
 		       POLLOUT, cqe->res);
 		ret = 1;
@@ -442,7 +439,7 @@ static int test_poll_ringfd(void)
 	 * fail, because the kernel does not allow registering of the
 	 * ring_fd.
 	 */
-	status |= expect_fail(fd, IORING_REGISTER_FILES, &fd, 1, -EBADF);
+	status |= expect_fail(fd, IORING_REGISTER_FILES, &fd, 1, -EBADF, 0);
 
 	/* tear down queue */
 	io_uring_queue_exit(&ring);
@@ -475,14 +472,14 @@ int main(int argc, char **argv)
 	}
 
 	/* invalid fd */
-	status |= expect_fail(-1, 0, NULL, 0, -EBADF);
+	status |= expect_fail(-1, 0, NULL, 0, -EBADF, 0);
 	/* valid fd that is not an io_uring fd */
-	status |= expect_fail(devnull, 0, NULL, 0, -EOPNOTSUPP);
+	status |= expect_fail(devnull, 0, NULL, 0, -EOPNOTSUPP, 0);
 
 	/* invalid opcode */
 	memset(&p, 0, sizeof(p));
 	fd = new_io_uring(1, &p);
-	ret = expect_fail(fd, ~0U, NULL, 0, -EINVAL);
+	ret = expect_fail(fd, ~0U, NULL, 0, -EINVAL, 0);
 	if (ret) {
 		/* if this succeeds, tear down the io_uring instance
 		 * and start clean for the next test. */

data/vendor/liburing/test/io_uring_setup.c

@@ -17,7 +17,7 @@
 #include "liburing.h"
 #include "helpers.h"
 
-#include "../syscall.h"
+#include "../src/syscall.h"
 
 /* bogus: setup returns a valid fd on success... expect can't predict the
    fd we'll get, so this really only takes 1 parameter: error */

data/vendor/liburing/test/poll-cancel-all.c

@@ -14,11 +14,22 @@
 
 static int no_cancel_flags;
 
-static int test1(struct io_uring *ring, int *fd)
+static int test1(struct io_uring *ring, int *fd, int fixed)
 {
 	struct io_uring_sqe *sqe;
 	struct io_uring_cqe *cqe;
-	int ret, i;
+	int ret, i, __fd = fd[0];
+
+	if (fixed)
+		__fd = 0;
+
+	if (fixed) {
+		ret = io_uring_register_files(ring, fd, 1);
+		if (ret) {
+			fprintf(stderr, "failed file register %d\n", ret);
+			return 1;
+		}
+	}
 
 	for (i = 0; i < 8; i++) {
 		sqe = io_uring_get_sqe(ring);
@@ -27,8 +38,10 @@ static int test1(struct io_uring *ring, int *fd)
 			return 1;
 		}
 
-		io_uring_prep_poll_add(sqe, fd[0], POLLIN);
+		io_uring_prep_poll_add(sqe, __fd, POLLIN);
 		sqe->user_data = i + 1;
+		if (fixed)
+			sqe->flags |= IOSQE_FIXED_FILE;
 	}
 
 	ret = io_uring_submit(ring);
@@ -51,7 +64,9 @@ static int test1(struct io_uring *ring, int *fd)
 	 */
 	io_uring_prep_cancel(sqe, 0, IORING_ASYNC_CANCEL_ALL);
 	sqe->cancel_flags |= IORING_ASYNC_CANCEL_FD;
-	sqe->fd = fd[0];
+	if (fixed)
+		sqe->cancel_flags |= IORING_ASYNC_CANCEL_FD_FIXED;
+	sqe->fd = __fd;
 	sqe->user_data = 100;
 
 	ret = io_uring_submit(ring);
@@ -93,6 +108,9 @@ static int test1(struct io_uring *ring, int *fd)
 		io_uring_cqe_seen(ring, cqe);
 	}
 
+	if (fixed)
+		io_uring_unregister_files(ring);
+
 	return 0;
 }
 
@@ -442,7 +460,7 @@ int main(int argc, char *argv[])
 		return 1;
 	}
 
-	ret = test1(&ring, fd);
+	ret = test1(&ring, fd, 0);
 	if (ret) {
 		fprintf(stderr, "test1 failed\n");
 		return ret;
@@ -450,6 +468,12 @@ int main(int argc, char *argv[])
 	if (no_cancel_flags)
 		return 0;
 
+	ret = test1(&ring, fd, 1);
+	if (ret) {
+		fprintf(stderr, "test1 fixed failed\n");
+		return ret;
+	}
+
 	ret = test2(&ring, fd);
 	if (ret) {
 		fprintf(stderr, "test2 failed\n");

data/vendor/liburing/test/poll-race-mshot.c

@@ -49,7 +49,6 @@ static void *thread(void *data)
 
 static int test(struct io_uring *ring, struct data *d)
 {
-	struct io_uring_buf_reg reg = { };
 	struct io_uring_buf_ring *br;
 	struct io_uring_sqe *sqe;
 	struct io_uring_cqe *cqe;
@@ -67,16 +66,9 @@ static int test(struct io_uring *ring, struct data *d)
 
 	if (posix_memalign((void **) &buf, 16384, BUF_SIZE * NREQS))
 		return T_EXIT_FAIL;
-	if (posix_memalign((void **) &br, 16384, sizeof(struct io_uring_buf) * NREQS))
-		return T_EXIT_FAIL;
-
-	io_uring_buf_ring_init(br);
-	reg.ring_addr = (unsigned long) br;
-	reg.ring_entries = NREQS;
-	reg.bgid = 1;
 
-	ret = io_uring_register_buf_ring(ring, &reg, 0);
-	if (ret) {
+	br = io_uring_setup_buf_ring(ring, NREQS, 1, 0, &ret);
+	if (!br) {
 		if (ret == -EINVAL) {
 			no_buf_ring = 1;
 			return T_EXIT_SKIP;
@@ -143,7 +135,7 @@ static int test(struct io_uring *ring, struct data *d)
 
 	pthread_join(t, &ret2);
 	free(buf);
-	free(br);
+	io_uring_free_buf_ring(ring, br, NREQS, 1);
 	close(fd[0]);
 	close(fd[1]);
 	return T_EXIT_PASS;
@@ -151,7 +143,6 @@ static int test(struct io_uring *ring, struct data *d)
 
 static int test_mshot(struct io_uring *ring, struct data *d)
 {
-	struct io_uring_buf_reg reg = { };
 	struct io_uring_buf_ring *br;
 	struct io_uring_sqe *sqe;
 	struct io_uring_cqe *cqe;
@@ -169,16 +160,9 @@ static int test_mshot(struct io_uring *ring, struct data *d)
 
 	if (posix_memalign((void *) &buf, 16384, BUF_SIZE * NREQS))
 		return T_EXIT_FAIL;
-	if (posix_memalign((void *) &br, 16384, sizeof(struct io_uring_buf) * NREQS))
-		return T_EXIT_FAIL;
-
-	io_uring_buf_ring_init(br);
-	reg.ring_addr = (unsigned long) br;
-	reg.ring_entries = NREQS;
-	reg.bgid = 1;
 
-	ret = io_uring_register_buf_ring(ring, &reg, 0);
-	if (ret) {
+	br = io_uring_setup_buf_ring(ring, NREQS, 1, 0, &ret);
+	if (!br) {
 		fprintf(stderr, "buf ring reg %d\n", ret);
 		return T_EXIT_FAIL;
 	}
@@ -245,8 +229,8 @@ static int test_mshot(struct io_uring *ring, struct data *d)
 	}
 
 	pthread_join(t, &ret2);
+	io_uring_free_buf_ring(ring, br, NREQS, 1);
 	free(buf);
-	free(br);
 	close(fd[0]);
 	close(fd[1]);
 	return T_EXIT_PASS;

data/vendor/liburing/test/read-write.c

@@ -637,6 +637,53 @@ static int test_rem_buf(int batch, int sqe_flags)
 	return ret;
 }
 
+static int test_rem_buf_single(int to_rem)
+{
+	struct io_uring_sqe *sqe;
+	struct io_uring_cqe *cqe;
+	struct io_uring ring;
+	int ret, expected;
+	int bgid = 1;
+
+	if (no_buf_select)
+		return 0;
+
+	ret = io_uring_queue_init(64, &ring, 0);
+	if (ret) {
+		fprintf(stderr, "ring create failed: %d\n", ret);
+		return 1;
+	}
+
+	ret = provide_buffers_iovec(&ring, bgid);
+	if (ret)
+		return ret;
+
+	expected = (to_rem > BUFFERS) ? BUFFERS : to_rem;
+
+	sqe = io_uring_get_sqe(&ring);
+	io_uring_prep_remove_buffers(sqe, to_rem, bgid);
+
+	ret = io_uring_submit(&ring);
+	if (ret != 1) {
+		fprintf(stderr, "submit: %d\n", ret);
+		return -1;
+	}
+
+	ret = io_uring_wait_cqe(&ring, &cqe);
+	if (ret) {
+		fprintf(stderr, "wait_cqe=%d\n", ret);
+		return 1;
+	}
+	if (cqe->res != expected) {
+		fprintf(stderr, "cqe->res=%d, expected=%d\n", cqe->res, expected);
+		return 1;
+	}
+	io_uring_cqe_seen(&ring, cqe);
+
+	io_uring_queue_exit(&ring);
+	return ret;
+}
+
 static int test_io_link(const char *file)
 {
 	const int nr_links = 100;
@@ -950,6 +997,12 @@ int main(int argc, char *argv[])
 		}
 	}
 
+	ret = test_rem_buf_single(BUFFERS + 1);
+	if (ret) {
+		fprintf(stderr, "test_rem_buf_single(BUFFERS + 1) failed\n");
+		goto err;
+	}
+
 	if (fname != argv[1])
 		unlink(fname);
 	return 0;

data/vendor/liburing/test/recv-msgall.c

@@ -18,14 +18,18 @@
 #define MAX_MSG	128
 #define HOST	"127.0.0.1"
 static __be16 bind_port;
+struct recv_data {
+	pthread_barrier_t barrier;
+	int use_recvmsg;
+	struct msghdr msg;
+};
 
 static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock,
-		     int use_recvmsg)
+		     struct recv_data *rd)
 {
 	struct sockaddr_in saddr;
 	struct io_uring_sqe *sqe;
 	int sockfd, ret, val;
-	struct msghdr msg = { };
 
 	memset(&saddr, 0, sizeof(saddr));
 	saddr.sin_family = AF_INET;
@@ -47,14 +51,17 @@ static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock,
 	bind_port = saddr.sin_port;
 
 	sqe = io_uring_get_sqe(ring);
-	if (!use_recvmsg) {
+	if (!rd->use_recvmsg) {
 		io_uring_prep_recv(sqe, sockfd, iov->iov_base, iov->iov_len,
 					MSG_WAITALL);
 	} else {
-		msg.msg_namelen = sizeof(struct sockaddr_in);
-		msg.msg_iov = iov;
-		msg.msg_iovlen = 1;
-		io_uring_prep_recvmsg(sqe, sockfd, &msg, MSG_WAITALL);
+		struct msghdr *msg = &rd->msg;
+
+		memset(msg, 0, sizeof(*msg));
+		msg->msg_namelen = sizeof(struct sockaddr_in);
+		msg->msg_iov = iov;
+		msg->msg_iovlen = 1;
+		io_uring_prep_recvmsg(sqe, sockfd, msg, MSG_WAITALL);
 	}
 
 	sqe->user_data = 2;
@@ -101,11 +108,6 @@ err:
 	return 1;
 }
 
-struct recv_data {
-	pthread_mutex_t mutex;
-	int use_recvmsg;
-};
-
 static void *recv_fn(void *data)
 {
 	struct recv_data *rd = data;
@@ -120,20 +122,20 @@ static void *recv_fn(void *data)
 
 	ret = t_create_ring_params(1, &ring, &p);
 	if (ret == T_SETUP_SKIP) {
-		pthread_mutex_unlock(&rd->mutex);
+		pthread_barrier_wait(&rd->barrier);
 		ret = 0;
 		goto err;
 	} else if (ret < 0) {
-		pthread_mutex_unlock(&rd->mutex);
+		pthread_barrier_wait(&rd->barrier);
 		goto err;
 	}
 
-	ret = recv_prep(&ring, &iov, &sock, rd->use_recvmsg);
+	ret = recv_prep(&ring, &iov, &sock, rd);
 	if (ret) {
 		fprintf(stderr, "recv_prep failed: %d\n", ret);
 		goto err;
 	}
-	pthread_mutex_unlock(&rd->mutex);
+	pthread_barrier_wait(&rd->barrier);
 	ret = do_recv(&ring);
 	close(sock);
 	io_uring_queue_exit(&ring);
@@ -217,28 +219,24 @@ err:
 
 static int test(int use_recvmsg)
 {
-	pthread_mutexattr_t attr;
 	pthread_t recv_thread;
 	struct recv_data rd;
 	int ret;
 	void *retval;
 
-	pthread_mutexattr_init(&attr);
-	pthread_mutexattr_setpshared(&attr, 1);
-	pthread_mutex_init(&rd.mutex, &attr);
-	pthread_mutex_lock(&rd.mutex);
+	pthread_barrier_init(&rd.barrier, NULL, 2);
 	rd.use_recvmsg = use_recvmsg;
 
 	ret = pthread_create(&recv_thread, NULL, recv_fn, &rd);
 	if (ret) {
 		fprintf(stderr, "Thread create failed: %d\n", ret);
-		pthread_mutex_unlock(&rd.mutex);
 		return 1;
 	}
 
-	pthread_mutex_lock(&rd.mutex);
+	pthread_barrier_wait(&rd.barrier);
 	do_send();
 	pthread_join(recv_thread, &retval);
+	pthread_barrier_destroy(&rd.barrier);
 	return (intptr_t)retval;
 }
 

data/vendor/liburing/test/reg-fd-only.c

@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * Test io_uring_setup with IORING_SETUP_REGISTERED_FD_ONLY
+ *
+ */
+#include <stdio.h>
+
+#include "helpers.h"
+
+int main(int argc, char *argv[])
+{
+	struct io_uring ring;
+	unsigned values[2];
+	int ret;
+
+	if (argc > 1)
+		return T_EXIT_SKIP;
+
+	ret = io_uring_queue_init(8, &ring, IORING_SETUP_REGISTERED_FD_ONLY | IORING_SETUP_NO_MMAP);
+	if (ret == -EINVAL)
+		return T_EXIT_SKIP;
+	else if (ret) {
+		fprintf(stderr, "ring setup failed\n");
+		return T_EXIT_FAIL;
+	}
+
+	ret = io_uring_register_ring_fd(&ring);
+	if (ret != -EEXIST) {
+		fprintf(stderr, "registering already-registered ring fd should fail\n");
+		goto err;
+	}
+
+	ret = io_uring_close_ring_fd(&ring);
+	if (ret != -EBADF) {
+		fprintf(stderr, "closing already-closed ring fd should fail\n");
+		goto err;
+	}
+
+	/* Test a simple io_uring_register operation expected to work.
+	 * io_uring_register_iowq_max_workers is arbitrary.
+	 */
+	values[0] = values[1] = 0;
+	ret = io_uring_register_iowq_max_workers(&ring, values);
+	if (ret || (values[0] == 0 && values[1] == 0)) {
+		fprintf(stderr, "io_uring_register operation failed after closing ring fd\n");
+		goto err;
+	}
+
+	io_uring_queue_exit(&ring);
+	return T_EXIT_PASS;
+
+err:
+	io_uring_queue_exit(&ring);
+	return T_EXIT_FAIL;
+}

data/vendor/liburing/test/reg-hint.c

@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * Test alloc hint sanity after unregistering the file table
+ */
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/socket.h>
+
+#include "liburing.h"
+#include "helpers.h"
+
+int main(int argc, char *argv[])
+{
+	struct io_uring_sqe *sqe;
+	struct io_uring_cqe *cqe;
+	struct io_uring ring;
+	int ret;
+
+	if (argc > 1)
+		return T_EXIT_SKIP;
+
+	io_uring_queue_init(1, &ring, 0);
+
+	ret = io_uring_register_files_sparse(&ring, 16);
+	if (ret) {
+		if (ret == -EINVAL)
+			return T_EXIT_SKIP;
+
+		fprintf(stderr, "Failed to register file table: %d\n", ret);
+		return T_EXIT_FAIL;
+	}
+	io_uring_unregister_files(&ring);
+
+	sqe = io_uring_get_sqe(&ring);
+	io_uring_prep_socket_direct_alloc(sqe, AF_UNIX, SOCK_DGRAM, 0, 0);
+
+	ret = io_uring_submit(&ring);
+	if (ret != 1) {
+		fprintf(stderr, "submit %d\n", ret);
+		return T_EXIT_FAIL;
+	}
+
+	ret = io_uring_wait_cqe(&ring, &cqe);
+	if (ret) {
+		fprintf(stderr, "wait cqe: %d\n", ret);
+		return T_EXIT_FAIL;
+	}
+
+	if (cqe->res != -ENFILE) {
+		fprintf(stderr, "Bad CQE res: %d\n", cqe->res);
+		return T_EXIT_FAIL;
+	}
+
+	io_uring_cqe_seen(&ring, cqe);
+	return T_EXIT_PASS;
+}

data/vendor/liburing/test/regbuf-merge.c

@@ -0,0 +1,91 @@
+/* SPDX-License-Identifier: MIT */
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+
+#include <endian.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include "helpers.h"
+
+#ifndef __NR_io_uring_register
+#define __NR_io_uring_register 427
+#endif
+#ifndef __NR_io_uring_setup
+#define __NR_io_uring_setup 425
+#endif
+
+#define SIZEOF_IO_URING_SQE 64
+#define SIZEOF_IO_URING_CQE 16
+#define SQ_HEAD_OFFSET 0
+#define SQ_TAIL_OFFSET 64
+#define SQ_RING_MASK_OFFSET 256
+#define SQ_RING_ENTRIES_OFFSET 264
+#define SQ_FLAGS_OFFSET 276
+#define SQ_DROPPED_OFFSET 272
+#define CQ_HEAD_OFFSET 128
+#define CQ_TAIL_OFFSET 192
+#define CQ_RING_MASK_OFFSET 260
+#define CQ_RING_ENTRIES_OFFSET 268
+#define CQ_RING_OVERFLOW_OFFSET 284
+#define CQ_FLAGS_OFFSET 280
+#define CQ_CQES_OFFSET 320
+
+static long syz_io_uring_setup(volatile long a0, volatile long a1, volatile long a2, volatile long a3, volatile long a4, volatile long a5)
+{
+	uint32_t entries = (uint32_t)a0;
+	struct io_uring_params* setup_params = (struct io_uring_params*)a1;
+	void* vma1 = (void*)a2;
+	void* vma2 = (void*)a3;
+	void** ring_ptr_out = (void**)a4;
+	void** sqes_ptr_out = (void**)a5;
+	uint32_t fd_io_uring = syscall(__NR_io_uring_setup, entries, setup_params);
+	uint32_t sq_ring_sz = setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
+	uint32_t cq_ring_sz = setup_params->cq_off.cqes + setup_params->cq_entries * SIZEOF_IO_URING_CQE;
+	uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
+	*ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQ_RING);
+	uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
+	*sqes_ptr_out = mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES);
+	return fd_io_uring;
+}
+
+static uint64_t r[1] = {0xffffffffffffffff};
+
+int main(int argc, char *argv[])
+{
+	intptr_t res = 0;
+
+	if (argc > 1)
+		return T_EXIT_SKIP;
+
+	mmap((void *) 0x1ffff000ul, 0x1000ul, PROT_NONE,
+		MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0ul);
+	mmap((void *) 0x20000000ul, 0x1000000ul, PROT_READ|PROT_WRITE|PROT_EXEC,
+		MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0ul);
+	mmap((void *) 0x21000000ul, 0x1000ul, PROT_NONE,
+		MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0ul);
+
+	*(uint32_t*)0x20000684 = 0;
+	*(uint32_t*)0x20000688 = 0;
+	*(uint32_t*)0x2000068c = 0;
+	*(uint32_t*)0x20000690 = 0;
+	*(uint32_t*)0x20000698 = -1;
+	memset((void*)0x2000069c, 0, 12);
+
+	res = syz_io_uring_setup(0x2fd6, 0x20000680, 0x20ffd000, 0x20ffc000,
+					0x20000700, 0x20000740);
+	if (res != -1)
+		r[0] = res;
+
+	*(uint64_t*)0x20002840 = 0;
+	*(uint64_t*)0x20002848 = 0;
+	*(uint64_t*)0x20002850 = 0x20000840;
+	*(uint64_t*)0x20002858 = 0x1000;
+	syscall(__NR_io_uring_register, r[0], 0ul, 0x20002840ul, 2ul);
+	return T_EXIT_PASS;
+}