Re: mm: GPF in find_get_pages_tag

From: Ross Zwisler
Date: Fri Jul 15 2016 - 16:21:53 EST


On Fri, Jul 15, 2016 at 09:07:48PM +0200, Dmitry Vyukov wrote:
> On Fri, Jul 15, 2016 at 9:03 PM, Ross Zwisler
> <ross.zwisler@xxxxxxxxxxxxxxx> wrote:
> >> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> >> #include <pthread.h>
> >> #include <stdint.h>
> >> #include <string.h>
> >> #include <stdio.h>
> >> #include <sys/syscall.h>
> >> #include <unistd.h>
> >>
> >> int fd;
> >> char buf[8192];
> >> char filename[256];
> >>
> >> void* thr(void* arg)
> >> {
> >> switch ((long)arg) {
> >> case 0:
> >> write(fd, buf, 0x1001ul);
> >> break;
> >> case 1:
> >> fdatasync(fd);
> >> break;
> >> case 2:
> >> ftruncate(fd, 2);
> >> break;
> >> case 3:
> >> write(fd, buf, 0x20ul);
> >> break;
> >> case 5:
> >> fd = open(filename, 0x50042ul, 0x41ul);
> >> break;
> >
> > This open() code is unreachable because the thread argument will only be 0-4,
> > right? Should this be "case 4"?
>
> I am not sure. I think it I just copy-pasted the program that
> triggered the crash for me. Andrey should have a valid reproducer, in
> the other thread he said that he can reproduce it. Andrey, did you
> change 5 to 4?

Ah, sorry if I wasn't clear. I don't think you need the open() call to have a
valid reproducer. In mine, in fact, I only use the first three - the error
happens with a combination of write(), fdatasync() and ftruncate().

I just wanted to note that the test program (which was autogenerated?) had an
unreachable case in the switch() statement. :)

Thanks for this testing, by the way!