Re: fcntl(F_DUPFD) causing apparent file descriptor table corruption

[Al Viro <viro@zeniv.linux.org.uk>]

On Tue, May 19, 2020 at 03:18:13PM -0700, Thiago Macieira wrote:

> > I really wonder about the missing couple of syscalls in your strace, though;
> > could you verify that they _are_ missing and see what the fix above does to
> > your testcase?
> 
> Looking at my terminal backtrace, I might have made a copy & paste mistake of 
> the trace while flipping pages. Unfortunately, the trace file I had in /tmp 
> was lost because I needed to reboot the machine. The other traces I have in my 
> terminal show:
> 
> fcntl(2, F_DUPFD, 134217728)            = 134217728
> close(134217728)                        = 0
> fcntl(2, F_DUPFD, 268435456)            = 268435456
> close(268435456)                        = 0
> fcntl(2, F_DUPFD, 536870912)            = 536870912
> close(536870912)                        = 0
> write(1, "success\n", 8)                = ?
> ^C^Czsh: killed     sudo strace ./dupfd-bug
> 
> I had to killall -9 strace at this point. See the attached oops.

BS values in the array of struct file pointers due to the problem above.
And very likely a memory corruption as well.

> Then I insisted:
> 
> fcntl(2, F_DUPFD, 67108864)             = 67108864
> close(67108864)                         = 0
> fcntl(2, F_DUPFD, 134217728)            = 134217728
> close(134217728)                        = 0
> fcntl(2, F_DUPFD, 268435456Shared connection to <REDACTED> closed.
> 
> At this point, I need to drive to the office to reboot the machine. Building 
> the kernel and testing will take a few days.
> 
> Note to self: don't play with possible kernel bugs without a VM.

... at least not without remote console, complete with ability to
powercycle the box.