From: Andrey Konovalov <andreyknvl@google.com> To: Gerrit Renker <gerrit@erg.abdn.ac.uk>, "David S. Miller" <davem@davemloft.net>, dccp@vger.kernel.org, netdev <netdev@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org> Cc: Dmitry Vyukov <dvyukov@google.com>, Eric Dumazet <edumazet@google.com>, Alexander Potapenko <glider@google.com>, Kostya Serebryany <kcc@google.com>, syzkaller <syzkaller@googlegroups.com> Subject: net/dccp: warning in dccp_feat_clone_sp_val/__might_sleep Date: Sat, 29 Oct 2016 02:40:14 +0200 [thread overview] Message-ID: <CAAeHK+z-SAq-YhHarfc94dguyXCJ_tv8n=ZVdLTRsYEy0cK-pQ@mail.gmail.com> (raw) [-- Attachment #1: Type: text/plain, Size: 2613 bytes --] Hi, I've got the following error report while running the syzkaller fuzzer: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4608 at kernel/sched/core.c:7724 __might_sleep+0x14c/0x1a0 kernel/sched/core.c:7719 do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff811f5a5c>] prepare_to_wait+0xbc/0x210 kernel/sched/wait.c:178 Modules linked in: CPU: 0 PID: 4608 Comm: syz-executor Not tainted 4.9.0-rc2+ #320 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffff88006625f7a0 ffffffff81b46914 ffff88006625f818 0000000000000000 ffffffff84052960 0000000000000000 ffff88006625f7e8 ffffffff81111237 ffff88006aceac00 ffffffff00001e2c ffffed000cc4beff ffffffff84052960 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff81b46914>] dump_stack+0xb3/0x10f lib/dump_stack.c:51 [<ffffffff81111237>] __warn+0x1a7/0x1f0 kernel/panic.c:550 [<ffffffff8111132c>] warn_slowpath_fmt+0xac/0xd0 kernel/panic.c:565 [<ffffffff811922fc>] __might_sleep+0x14c/0x1a0 kernel/sched/core.c:7719 [< inline >] slab_pre_alloc_hook mm/slab.h:393 [< inline >] slab_alloc_node mm/slub.c:2634 [< inline >] slab_alloc mm/slub.c:2716 [<ffffffff81508da0>] __kmalloc_track_caller+0x150/0x2a0 mm/slub.c:4240 [<ffffffff8146be14>] kmemdup+0x24/0x50 mm/util.c:113 [<ffffffff8388b2cf>] dccp_feat_clone_sp_val.part.5+0x4f/0xe0 net/dccp/feat.c:374 [< inline >] dccp_feat_clone_sp_val net/dccp/feat.c:1141 [< inline >] dccp_feat_change_recv net/dccp/feat.c:1141 [<ffffffff8388d491>] dccp_feat_parse_options+0xaa1/0x13d0 net/dccp/feat.c:1411 [<ffffffff83894f01>] dccp_parse_options+0x721/0x1010 net/dccp/options.c:128 [<ffffffff83891280>] dccp_rcv_state_process+0x200/0x15b0 net/dccp/input.c:644 [<ffffffff838b8a94>] dccp_v4_do_rcv+0xf4/0x1a0 net/dccp/ipv4.c:681 [< inline >] sk_backlog_rcv ./include/net/sock.h:872 [<ffffffff82b7ceb6>] __release_sock+0x126/0x3a0 net/core/sock.c:2044 [<ffffffff82b7d189>] release_sock+0x59/0x1c0 net/core/sock.c:2502 [< inline >] inet_wait_for_connect net/ipv4/af_inet.c:547 [<ffffffff8316b2a2>] __inet_stream_connect+0x5d2/0xbb0 net/ipv4/af_inet.c:617 [<ffffffff8316b8d5>] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:656 [<ffffffff82b705e4>] SYSC_connect+0x244/0x2f0 net/socket.c:1533 [<ffffffff82b72dd4>] SyS_connect+0x24/0x30 net/socket.c:1514 [<ffffffff83fbf701>] entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:209 ---[ end trace 0dc4109d69f4e51e ]--- On commit 14970f204b1993af7459d5bd34aaff38dfee6670 (Oct 27). A reproducer is attached. [-- Attachment #2: dccp-feat-warn-poc.c --] [-- Type: application/octet-stream, Size: 7760 bytes --] // autogenerated by syzkaller (http://github.com/google/syzkaller) #ifndef __NR_bind #define __NR_bind 49 #endif #ifndef __NR_listen #define __NR_listen 50 #endif #ifndef __NR_syz_open_pts #define __NR_syz_open_pts 1000003 #endif #ifndef __NR_syz_test #define __NR_syz_test 1000001 #endif #ifndef __NR_mmap #define __NR_mmap 9 #endif #ifndef __NR_socket #define __NR_socket 41 #endif #ifndef __NR_connect #define __NR_connect 42 #endif #ifndef __NR_syz_fuse_mount #define __NR_syz_fuse_mount 1000004 #endif #ifndef __NR_syz_fuseblk_mount #define __NR_syz_fuseblk_mount 1000005 #endif #ifndef __NR_syz_open_dev #define __NR_syz_open_dev 1000002 #endif #include <sys/ioctl.h> #include <sys/socket.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <errno.h> #include <error.h> #include <fcntl.h> #include <pthread.h> #include <setjmp.h> #include <signal.h> #include <stddef.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> __thread int skip_segv; __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* uctx) { if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED)) _longjmp(segv_env, 1); exit(sig); } static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } static uintptr_t syz_open_pts(uintptr_t a0, uintptr_t a1) { int ptyno = 0; if (ioctl(a0, TIOCGPTN, &ptyno)) return -1; char buf[128]; sprintf(buf, "/dev/pts/%d", ptyno); return open(buf, a1, 0); } static uintptr_t syz_fuse_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5) { uint64_t target = a0; uint64_t mode = a1; uint64_t uid = a2; uint64_t gid = a3; uint64_t maxread = a4; uint64_t flags = a5; int fd = open("/dev/fuse", O_RDWR); if (fd == -1) return fd; char buf[1024]; sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid, (long)gid, (unsigned)mode & ~3u); if (maxread != 0) sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread); if (mode & 1) strcat(buf, ",default_permissions"); if (mode & 2) strcat(buf, ",allow_other"); syscall(SYS_mount, "", target, "fuse", flags, buf); return fd; } static uintptr_t syz_fuseblk_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7) { uint64_t target = a0; uint64_t blkdev = a1; uint64_t mode = a2; uint64_t uid = a3; uint64_t gid = a4; uint64_t maxread = a5; uint64_t blksize = a6; uint64_t flags = a7; int fd = open("/dev/fuse", O_RDWR); if (fd == -1) return fd; if (syscall(SYS_mknodat, AT_FDCWD, blkdev, S_IFBLK, makedev(7, 199))) return fd; char buf[256]; sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid, (long)gid, (unsigned)mode & ~3u); if (maxread != 0) sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread); if (blksize != 0) sprintf(buf + strlen(buf), ",blksize=%ld", (long)blksize); if (mode & 1) strcat(buf, ",default_permissions"); if (mode & 2) strcat(buf, ",allow_other"); syscall(SYS_mount, blkdev, target, "fuseblk", flags, buf); return fd; } static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8) { switch (nr) { default: return syscall(nr, a0, a1, a2, a3, a4, a5); case __NR_syz_test: return 0; case __NR_syz_open_dev: return syz_open_dev(a0, a1, a2); case __NR_syz_open_pts: return syz_open_pts(a0, a1); case __NR_syz_fuse_mount: return syz_fuse_mount(a0, a1, a2, a3, a4, a5); case __NR_syz_fuseblk_mount: return syz_fuseblk_mount(a0, a1, a2, a3, a4, a5, a6, a7); } } long r[28]; void* thr(void* arg) { switch ((long)arg) { case 0: r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0xe2b000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0); break; case 1: r[1] = execute_syscall(__NR_socket, 0x2ul, 0x806ul, 0x0ul, 0, 0, 0, 0, 0, 0); break; case 2: NONFAILING(*(uint16_t*)0x204e8000 = (uint16_t)0x2); NONFAILING(*(uint16_t*)0x204e8002 = (uint16_t)0x4242); NONFAILING(*(uint32_t*)0x204e8004 = (uint32_t)0x0); NONFAILING(*(uint8_t*)0x204e8008 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e8009 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800a = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800b = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800c = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800d = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800e = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800f = (uint8_t)0x0); r[13] = execute_syscall(__NR_bind, r[1], 0x204e8000ul, 0x10ul, 0, 0, 0, 0, 0, 0); break; case 3: r[14] = execute_syscall(__NR_listen, r[1], 0x1ul, 0, 0, 0, 0, 0, 0, 0); break; case 4: r[15] = execute_syscall(__NR_socket, 0x2ul, 0x6ul, 0x0ul, 0, 0, 0, 0, 0, 0); break; case 5: NONFAILING(*(uint16_t*)0x20e26000 = (uint16_t)0x2); NONFAILING(*(uint16_t*)0x20e26002 = (uint16_t)0x4242); NONFAILING(*(uint32_t*)0x20e26004 = (uint32_t)0x0); NONFAILING(*(uint8_t*)0x20e26008 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e26009 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600a = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600b = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600c = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600d = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600e = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600f = (uint8_t)0x0); r[27] = execute_syscall(__NR_connect, r[15], 0x20e26000ul, 0x10ul, 0, 0, 0, 0, 0, 0); break; } return 0; } int main() { long i; pthread_t th[12]; install_segv_handler(); memset(r, -1, sizeof(r)); srand(getpid()); for (i = 0; i < 6; i++) { pthread_create(&th[i], 0, thr, (void*)i); usleep(10000); } for (i = 0; i < 6; i++) { pthread_create(&th[6 + i], 0, thr, (void*)i); if (rand() % 2) usleep(rand() % 10000); } usleep(100000); return 0; }
WARNING: multiple messages have this Message-ID (diff)
From: Andrey Konovalov <andreyknvl@google.com> To: dccp@vger.kernel.org Subject: net/dccp: warning in dccp_feat_clone_sp_val/__might_sleep Date: Sat, 29 Oct 2016 00:40:14 +0000 [thread overview] Message-ID: <CAAeHK+z-SAq-YhHarfc94dguyXCJ_tv8n=ZVdLTRsYEy0cK-pQ@mail.gmail.com> (raw) [-- Attachment #1: Type: text/plain, Size: 2613 bytes --] Hi, I've got the following error report while running the syzkaller fuzzer: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4608 at kernel/sched/core.c:7724 __might_sleep+0x14c/0x1a0 kernel/sched/core.c:7719 do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff811f5a5c>] prepare_to_wait+0xbc/0x210 kernel/sched/wait.c:178 Modules linked in: CPU: 0 PID: 4608 Comm: syz-executor Not tainted 4.9.0-rc2+ #320 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffff88006625f7a0 ffffffff81b46914 ffff88006625f818 0000000000000000 ffffffff84052960 0000000000000000 ffff88006625f7e8 ffffffff81111237 ffff88006aceac00 ffffffff00001e2c ffffed000cc4beff ffffffff84052960 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff81b46914>] dump_stack+0xb3/0x10f lib/dump_stack.c:51 [<ffffffff81111237>] __warn+0x1a7/0x1f0 kernel/panic.c:550 [<ffffffff8111132c>] warn_slowpath_fmt+0xac/0xd0 kernel/panic.c:565 [<ffffffff811922fc>] __might_sleep+0x14c/0x1a0 kernel/sched/core.c:7719 [< inline >] slab_pre_alloc_hook mm/slab.h:393 [< inline >] slab_alloc_node mm/slub.c:2634 [< inline >] slab_alloc mm/slub.c:2716 [<ffffffff81508da0>] __kmalloc_track_caller+0x150/0x2a0 mm/slub.c:4240 [<ffffffff8146be14>] kmemdup+0x24/0x50 mm/util.c:113 [<ffffffff8388b2cf>] dccp_feat_clone_sp_val.part.5+0x4f/0xe0 net/dccp/feat.c:374 [< inline >] dccp_feat_clone_sp_val net/dccp/feat.c:1141 [< inline >] dccp_feat_change_recv net/dccp/feat.c:1141 [<ffffffff8388d491>] dccp_feat_parse_options+0xaa1/0x13d0 net/dccp/feat.c:1411 [<ffffffff83894f01>] dccp_parse_options+0x721/0x1010 net/dccp/options.c:128 [<ffffffff83891280>] dccp_rcv_state_process+0x200/0x15b0 net/dccp/input.c:644 [<ffffffff838b8a94>] dccp_v4_do_rcv+0xf4/0x1a0 net/dccp/ipv4.c:681 [< inline >] sk_backlog_rcv ./include/net/sock.h:872 [<ffffffff82b7ceb6>] __release_sock+0x126/0x3a0 net/core/sock.c:2044 [<ffffffff82b7d189>] release_sock+0x59/0x1c0 net/core/sock.c:2502 [< inline >] inet_wait_for_connect net/ipv4/af_inet.c:547 [<ffffffff8316b2a2>] __inet_stream_connect+0x5d2/0xbb0 net/ipv4/af_inet.c:617 [<ffffffff8316b8d5>] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:656 [<ffffffff82b705e4>] SYSC_connect+0x244/0x2f0 net/socket.c:1533 [<ffffffff82b72dd4>] SyS_connect+0x24/0x30 net/socket.c:1514 [<ffffffff83fbf701>] entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:209 ---[ end trace 0dc4109d69f4e51e ]--- On commit 14970f204b1993af7459d5bd34aaff38dfee6670 (Oct 27). A reproducer is attached. [-- Attachment #2: dccp-feat-warn-poc.c --] [-- Type: application/octet-stream, Size: 7760 bytes --] // autogenerated by syzkaller (http://github.com/google/syzkaller) #ifndef __NR_bind #define __NR_bind 49 #endif #ifndef __NR_listen #define __NR_listen 50 #endif #ifndef __NR_syz_open_pts #define __NR_syz_open_pts 1000003 #endif #ifndef __NR_syz_test #define __NR_syz_test 1000001 #endif #ifndef __NR_mmap #define __NR_mmap 9 #endif #ifndef __NR_socket #define __NR_socket 41 #endif #ifndef __NR_connect #define __NR_connect 42 #endif #ifndef __NR_syz_fuse_mount #define __NR_syz_fuse_mount 1000004 #endif #ifndef __NR_syz_fuseblk_mount #define __NR_syz_fuseblk_mount 1000005 #endif #ifndef __NR_syz_open_dev #define __NR_syz_open_dev 1000002 #endif #include <sys/ioctl.h> #include <sys/socket.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <errno.h> #include <error.h> #include <fcntl.h> #include <pthread.h> #include <setjmp.h> #include <signal.h> #include <stddef.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> __thread int skip_segv; __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* uctx) { if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED)) _longjmp(segv_env, 1); exit(sig); } static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } static uintptr_t syz_open_pts(uintptr_t a0, uintptr_t a1) { int ptyno = 0; if (ioctl(a0, TIOCGPTN, &ptyno)) return -1; char buf[128]; sprintf(buf, "/dev/pts/%d", ptyno); return open(buf, a1, 0); } static uintptr_t syz_fuse_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5) { uint64_t target = a0; uint64_t mode = a1; uint64_t uid = a2; uint64_t gid = a3; uint64_t maxread = a4; uint64_t flags = a5; int fd = open("/dev/fuse", O_RDWR); if (fd == -1) return fd; char buf[1024]; sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid, (long)gid, (unsigned)mode & ~3u); if (maxread != 0) sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread); if (mode & 1) strcat(buf, ",default_permissions"); if (mode & 2) strcat(buf, ",allow_other"); syscall(SYS_mount, "", target, "fuse", flags, buf); return fd; } static uintptr_t syz_fuseblk_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7) { uint64_t target = a0; uint64_t blkdev = a1; uint64_t mode = a2; uint64_t uid = a3; uint64_t gid = a4; uint64_t maxread = a5; uint64_t blksize = a6; uint64_t flags = a7; int fd = open("/dev/fuse", O_RDWR); if (fd == -1) return fd; if (syscall(SYS_mknodat, AT_FDCWD, blkdev, S_IFBLK, makedev(7, 199))) return fd; char buf[256]; sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid, (long)gid, (unsigned)mode & ~3u); if (maxread != 0) sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread); if (blksize != 0) sprintf(buf + strlen(buf), ",blksize=%ld", (long)blksize); if (mode & 1) strcat(buf, ",default_permissions"); if (mode & 2) strcat(buf, ",allow_other"); syscall(SYS_mount, blkdev, target, "fuseblk", flags, buf); return fd; } static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8) { switch (nr) { default: return syscall(nr, a0, a1, a2, a3, a4, a5); case __NR_syz_test: return 0; case __NR_syz_open_dev: return syz_open_dev(a0, a1, a2); case __NR_syz_open_pts: return syz_open_pts(a0, a1); case __NR_syz_fuse_mount: return syz_fuse_mount(a0, a1, a2, a3, a4, a5); case __NR_syz_fuseblk_mount: return syz_fuseblk_mount(a0, a1, a2, a3, a4, a5, a6, a7); } } long r[28]; void* thr(void* arg) { switch ((long)arg) { case 0: r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0xe2b000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0); break; case 1: r[1] = execute_syscall(__NR_socket, 0x2ul, 0x806ul, 0x0ul, 0, 0, 0, 0, 0, 0); break; case 2: NONFAILING(*(uint16_t*)0x204e8000 = (uint16_t)0x2); NONFAILING(*(uint16_t*)0x204e8002 = (uint16_t)0x4242); NONFAILING(*(uint32_t*)0x204e8004 = (uint32_t)0x0); NONFAILING(*(uint8_t*)0x204e8008 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e8009 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800a = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800b = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800c = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800d = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800e = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x204e800f = (uint8_t)0x0); r[13] = execute_syscall(__NR_bind, r[1], 0x204e8000ul, 0x10ul, 0, 0, 0, 0, 0, 0); break; case 3: r[14] = execute_syscall(__NR_listen, r[1], 0x1ul, 0, 0, 0, 0, 0, 0, 0); break; case 4: r[15] = execute_syscall(__NR_socket, 0x2ul, 0x6ul, 0x0ul, 0, 0, 0, 0, 0, 0); break; case 5: NONFAILING(*(uint16_t*)0x20e26000 = (uint16_t)0x2); NONFAILING(*(uint16_t*)0x20e26002 = (uint16_t)0x4242); NONFAILING(*(uint32_t*)0x20e26004 = (uint32_t)0x0); NONFAILING(*(uint8_t*)0x20e26008 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e26009 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600a = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600b = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600c = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600d = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600e = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20e2600f = (uint8_t)0x0); r[27] = execute_syscall(__NR_connect, r[15], 0x20e26000ul, 0x10ul, 0, 0, 0, 0, 0, 0); break; } return 0; } int main() { long i; pthread_t th[12]; install_segv_handler(); memset(r, -1, sizeof(r)); srand(getpid()); for (i = 0; i < 6; i++) { pthread_create(&th[i], 0, thr, (void*)i); usleep(10000); } for (i = 0; i < 6; i++) { pthread_create(&th[6 + i], 0, thr, (void*)i); if (rand() % 2) usleep(rand() % 10000); } usleep(100000); return 0; }
next reply other threads:[~2016-10-29 0:40 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-10-29 0:40 Andrey Konovalov [this message] 2016-10-29 0:40 ` net/dccp: warning in dccp_feat_clone_sp_val/__might_sleep Andrey Konovalov 2016-10-29 6:10 ` Cong Wang 2016-10-29 6:10 ` Cong Wang 2016-10-29 17:06 ` Andrey Konovalov 2016-10-29 17:06 ` Andrey Konovalov 2016-10-29 17:43 ` Eric Dumazet 2016-10-29 17:43 ` Eric Dumazet 2016-10-29 17:59 ` Andrey Konovalov 2016-10-29 17:59 ` Andrey Konovalov 2016-10-29 18:05 ` Eric Dumazet 2016-10-29 18:05 ` Eric Dumazet 2016-10-30 4:41 ` Andrey Konovalov 2016-10-30 4:41 ` Andrey Konovalov 2016-10-30 13:20 ` Eric Dumazet 2016-10-30 13:20 ` Eric Dumazet 2016-10-31 18:00 ` Cong Wang 2016-10-31 18:00 ` Cong Wang 2016-10-31 18:40 ` Eric Dumazet 2016-10-31 18:40 ` Eric Dumazet 2016-11-01 16:33 ` Andrey Konovalov 2016-11-01 16:33 ` Andrey Konovalov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CAAeHK+z-SAq-YhHarfc94dguyXCJ_tv8n=ZVdLTRsYEy0cK-pQ@mail.gmail.com' \ --to=andreyknvl@google.com \ --cc=davem@davemloft.net \ --cc=dccp@vger.kernel.org \ --cc=dvyukov@google.com \ --cc=edumazet@google.com \ --cc=gerrit@erg.abdn.ac.uk \ --cc=glider@google.com \ --cc=kcc@google.com \ --cc=linux-kernel@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=syzkaller@googlegroups.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.