From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751516AbcGOU0W (ORCPT ); Fri, 15 Jul 2016 16:26:22 -0400 Received: from mail-lf0-f52.google.com ([209.85.215.52]:33969 "EHLO mail-lf0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751241AbcGOU0T (ORCPT ); Fri, 15 Jul 2016 16:26:19 -0400 MIME-Version: 1.0 In-Reply-To: <20160715202142.GA15807@linux.intel.com> References: <20160715190316.GB7195@linux.intel.com> <20160715202142.GA15807@linux.intel.com> From: Dmitry Vyukov Date: Fri, 15 Jul 2016 22:25:58 +0200 Message-ID: Subject: Re: mm: GPF in find_get_pages_tag To: syzkaller Cc: Andrew Morton , Jan Kara , ross.zwisler@linux.intel.com, "Kirill A. Shutemov" , "linux-mm@kvack.org" , LKML , Hugh Dickins , Greg Thelen , Suleiman Souhlal , Andrey Ryabinin , Kostya Serebryany , Alexander Potapenko , Sasha Levin Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jul 15, 2016 at 10:21 PM, Ross Zwisler wrote: > On Fri, Jul 15, 2016 at 09:07:48PM +0200, Dmitry Vyukov wrote: >> On Fri, Jul 15, 2016 at 9:03 PM, Ross Zwisler >> wrote: >> >> // autogenerated by syzkaller (http://github.com/google/syzkaller) >> >> #include >> >> #include >> >> #include >> >> #include >> >> #include >> >> #include >> >> >> >> int fd; >> >> char buf[8192]; >> >> char filename[256]; >> >> >> >> void* thr(void* arg) >> >> { >> >> switch ((long)arg) { >> >> case 0: >> >> write(fd, buf, 0x1001ul); >> >> break; >> >> case 1: >> >> fdatasync(fd); >> >> break; >> >> case 2: >> >> ftruncate(fd, 2); >> >> break; >> >> case 3: >> >> write(fd, buf, 0x20ul); >> >> break; >> >> case 5: >> >> fd = open(filename, 0x50042ul, 0x41ul); >> >> break; >> > >> > This open() code is unreachable because the thread argument will only be 0-4, >> > right? Should this be "case 4"? >> >> I am not sure. I think it I just copy-pasted the program that >> triggered the crash for me. Andrey should have a valid reproducer, in >> the other thread he said that he can reproduce it. Andrey, did you >> change 5 to 4? > > Ah, sorry if I wasn't clear. I don't think you need the open() call to have a > valid reproducer. In mine, in fact, I only use the first three - the error > happens with a combination of write(), fdatasync() and ftruncate(). > > I just wanted to note that the test program (which was autogenerated?) had an > unreachable case in the switch() statement. :) > > Thanks for this testing, by the way! Ah, OK. I modified the program by hand to make it trigger the bug more frequently. So I think the bug was introduced by me. Generator should not generate dead cases. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f70.google.com (mail-wm0-f70.google.com [74.125.82.70]) by kanga.kvack.org (Postfix) with ESMTP id 8CDED6B0265 for ; Fri, 15 Jul 2016 16:26:19 -0400 (EDT) Received: by mail-wm0-f70.google.com with SMTP id o80so22611375wme.1 for ; Fri, 15 Jul 2016 13:26:19 -0700 (PDT) Received: from mail-lf0-x233.google.com (mail-lf0-x233.google.com. [2a00:1450:4010:c07::233]) by mx.google.com with ESMTPS id y197si7598711lfd.286.2016.07.15.13.26.18 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 15 Jul 2016 13:26:18 -0700 (PDT) Received: by mail-lf0-x233.google.com with SMTP id l69so38872924lfg.1 for ; Fri, 15 Jul 2016 13:26:18 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <20160715202142.GA15807@linux.intel.com> References: <20160715190316.GB7195@linux.intel.com> <20160715202142.GA15807@linux.intel.com> From: Dmitry Vyukov Date: Fri, 15 Jul 2016 22:25:58 +0200 Message-ID: Subject: Re: mm: GPF in find_get_pages_tag Content-Type: text/plain; charset=UTF-8 Sender: owner-linux-mm@kvack.org List-ID: To: syzkaller Cc: Andrew Morton , Jan Kara , ross.zwisler@linux.intel.com, "Kirill A. Shutemov" , "linux-mm@kvack.org" , LKML , Hugh Dickins , Greg Thelen , Suleiman Souhlal , Andrey Ryabinin , Kostya Serebryany , Alexander Potapenko , Sasha Levin On Fri, Jul 15, 2016 at 10:21 PM, Ross Zwisler wrote: > On Fri, Jul 15, 2016 at 09:07:48PM +0200, Dmitry Vyukov wrote: >> On Fri, Jul 15, 2016 at 9:03 PM, Ross Zwisler >> wrote: >> >> // autogenerated by syzkaller (http://github.com/google/syzkaller) >> >> #include >> >> #include >> >> #include >> >> #include >> >> #include >> >> #include >> >> >> >> int fd; >> >> char buf[8192]; >> >> char filename[256]; >> >> >> >> void* thr(void* arg) >> >> { >> >> switch ((long)arg) { >> >> case 0: >> >> write(fd, buf, 0x1001ul); >> >> break; >> >> case 1: >> >> fdatasync(fd); >> >> break; >> >> case 2: >> >> ftruncate(fd, 2); >> >> break; >> >> case 3: >> >> write(fd, buf, 0x20ul); >> >> break; >> >> case 5: >> >> fd = open(filename, 0x50042ul, 0x41ul); >> >> break; >> > >> > This open() code is unreachable because the thread argument will only be 0-4, >> > right? Should this be "case 4"? >> >> I am not sure. I think it I just copy-pasted the program that >> triggered the crash for me. Andrey should have a valid reproducer, in >> the other thread he said that he can reproduce it. Andrey, did you >> change 5 to 4? > > Ah, sorry if I wasn't clear. I don't think you need the open() call to have a > valid reproducer. In mine, in fact, I only use the first three - the error > happens with a combination of write(), fdatasync() and ftruncate(). > > I just wanted to note that the test program (which was autogenerated?) had an > unreachable case in the switch() statement. :) > > Thanks for this testing, by the way! Ah, OK. I modified the program by hand to make it trigger the bug more frequently. So I think the bug was introduced by me. Generator should not generate dead cases. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org