From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <owner-linux-mm@kvack.org>
Received: from mail-pa0-f72.google.com (mail-pa0-f72.google.com [209.85.220.72])
	by kanga.kvack.org (Postfix) with ESMTP id 8ACB66B0262
	for <linux-mm@kvack.org>; Fri, 15 Jul 2016 16:21:46 -0400 (EDT)
Received: by mail-pa0-f72.google.com with SMTP id hh10so204177208pac.3
        for <linux-mm@kvack.org>; Fri, 15 Jul 2016 13:21:46 -0700 (PDT)
Received: from mga01.intel.com (mga01.intel.com. [192.55.52.88])
        by mx.google.com with ESMTP id z21si2843627pfj.116.2016.07.15.13.21.45
        for <linux-mm@kvack.org>;
        Fri, 15 Jul 2016 13:21:45 -0700 (PDT)
Date: Fri, 15 Jul 2016 14:21:42 -0600
From: Ross Zwisler <ross.zwisler@linux.intel.com>
Subject: Re: mm: GPF in find_get_pages_tag
Message-ID: <20160715202142.GA15807@linux.intel.com>
References: <CACT4Y+a99OW7TYeLsuEic19uY2j45DGXL=LowUMq3TywWS3f2Q@mail.gmail.com>
 <20160715190316.GB7195@linux.intel.com>
 <CACT4Y+Y7YU8GTzrehV-LiuJfpV8AvTyGdd-AOwdfWJAh_+JM4A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CACT4Y+Y7YU8GTzrehV-LiuJfpV8AvTyGdd-AOwdfWJAh_+JM4A@mail.gmail.com>
Sender: owner-linux-mm@kvack.org
List-ID: <linux-mm.kvack.org>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: syzkaller <syzkaller@googlegroups.com>, Andrew Morton <akpm@linux-foundation.org>, Jan Kara <jack@suse.cz>, ross.zwisler@linux.intel.com, "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>, "linux-mm@kvack.org" <linux-mm@kvack.org>, LKML <linux-kernel@vger.kernel.org>, Hugh Dickins <hughd@google.com>, Greg Thelen <gthelen@google.com>, Suleiman Souhlal <suleiman@google.com>, Andrey Ryabinin <aryabinin@virtuozzo.com>, Kostya Serebryany <kcc@google.com>, Alexander Potapenko <glider@google.com>, Sasha Levin <sasha.levin@oracle.com>

On Fri, Jul 15, 2016 at 09:07:48PM +0200, Dmitry Vyukov wrote:
> On Fri, Jul 15, 2016 at 9:03 PM, Ross Zwisler
> <ross.zwisler@linux.intel.com> wrote:
> >> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> >> #include <pthread.h>
> >> #include <stdint.h>
> >> #include <string.h>
> >> #include <stdio.h>
> >> #include <sys/syscall.h>
> >> #include <unistd.h>
> >>
> >> int fd;
> >> char buf[8192];
> >> char filename[256];
> >>
> >> void* thr(void* arg)
> >> {
> >>   switch ((long)arg) {
> >>   case 0:
> >>     write(fd, buf, 0x1001ul);
> >>     break;
> >>   case 1:
> >>     fdatasync(fd);
> >>     break;
> >>   case 2:
> >>     ftruncate(fd, 2);
> >>     break;
> >>   case 3:
> >>     write(fd, buf, 0x20ul);
> >>     break;
> >>   case 5:
> >>     fd = open(filename, 0x50042ul, 0x41ul);
> >>     break;
> >
> > This open() code is unreachable because the thread argument will only be 0-4,
> > right?  Should this be "case 4"?
> 
> I am not sure. I think it I just copy-pasted the program that
> triggered the crash for me. Andrey should have a valid reproducer, in
> the other thread he said that he can reproduce it. Andrey, did you
> change 5 to 4?

Ah, sorry if I wasn't clear.  I don't think you need the open() call to have a
valid reproducer.  In mine, in fact, I only use the first three - the error
happens with a combination of write(), fdatasync() and ftruncate().

I just wanted to note that the test program (which was autogenerated?) had an
unreachable case in the switch() statement. :)

Thanks for this testing, by the way!

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>