Re: gigaset: freeing an active object

From: Dmitry Vyukov <dvyukov@google.com>
To: Sasha Levin <sasha.levin@oracle.com>
Cc: Peter Hurley <peter@hurleysoftware.com>,
	Paul Bolle <pebolle@tiscali.nl>,
	isdn@linux-pingi.de, David Miller <davem@davemloft.net>,
	tilman@imap.cc, gigaset307x-common@lists.sourceforge.net,
	LKML <linux-kernel@vger.kernel.org>,
	"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	syzkaller <syzkaller@googlegroups.com>
Subject: Re: gigaset: freeing an active object
Date: Sun, 29 Nov 2015 15:36:35 +0100	[thread overview]
Message-ID: <CACT4Y+bbHa64ietEcskKKy_BWf3M0KeTkFMWodK683KtY1yWyg@mail.gmail.com> (raw)
In-Reply-To: <5659030C.1070009@oracle.com>

On Sat, Nov 28, 2015 at 2:27 AM, Sasha Levin <sasha.levin@oracle.com> wrote:
> On 11/27/2015 08:20 PM, Peter Hurley wrote:
>> It would really help if you included the syzkaller-generated applet with
>> the bug reports; state previously established by the applet can be
>> crucial in understanding why the call stack looks the way it does.
>>
>> Also, every generated applet that triggers a report should become
>> a future regression test; I'm collecting the ones pertinent to tty/serial/
>> ldisc (so that includes this one; if you could send me the x25 one too
>> would be great).
>
> I went in to look for the 'crashers' that I thought are generated when
> syzkaller manages to crash a kernel, but none appear for me.
>
> Dmitry, is there magic required to generate those?

There is a little bit of magic, but mostly hard muscle labor.
I've outlined how I create reproducers here:
https://github.com/google/syzkaller/wiki/Crash-reproducer-programs
The description is not super detailed, but should be give you some
clue. Ideally it is all automated, but somebody needs to write some
code for that...