From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1751661AbcGOUVu (ORCPT <rfc822;w@1wt.eu>);
	Fri, 15 Jul 2016 16:21:50 -0400
Received: from mga09.intel.com ([134.134.136.24]:34655 "EHLO mga09.intel.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751596AbcGOUVr (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 15 Jul 2016 16:21:47 -0400
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.28,369,1464678000"; 
   d="scan'208";a="1022604127"
Date: Fri, 15 Jul 2016 14:21:42 -0600
From: Ross Zwisler <ross.zwisler@linux.intel.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: syzkaller <syzkaller@googlegroups.com>,
        Andrew Morton <akpm@linux-foundation.org>, Jan Kara <jack@suse.cz>,
        ross.zwisler@linux.intel.com,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        LKML <linux-kernel@vger.kernel.org>, Hugh Dickins <hughd@google.com>,
        Greg Thelen <gthelen@google.com>,
        Suleiman Souhlal <suleiman@google.com>,
        Andrey Ryabinin <aryabinin@virtuozzo.com>,
        Kostya Serebryany <kcc@google.com>,
        Alexander Potapenko <glider@google.com>,
        Sasha Levin <sasha.levin@oracle.com>
Subject: Re: mm: GPF in find_get_pages_tag
Message-ID: <20160715202142.GA15807@linux.intel.com>
References: <CACT4Y+a99OW7TYeLsuEic19uY2j45DGXL=LowUMq3TywWS3f2Q@mail.gmail.com>
 <20160715190316.GB7195@linux.intel.com>
 <CACT4Y+Y7YU8GTzrehV-LiuJfpV8AvTyGdd-AOwdfWJAh_+JM4A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CACT4Y+Y7YU8GTzrehV-LiuJfpV8AvTyGdd-AOwdfWJAh_+JM4A@mail.gmail.com>
User-Agent: Mutt/1.6.1 (2016-04-27)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Jul 15, 2016 at 09:07:48PM +0200, Dmitry Vyukov wrote:
> On Fri, Jul 15, 2016 at 9:03 PM, Ross Zwisler
> <ross.zwisler@linux.intel.com> wrote:
> >> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> >> #include <pthread.h>
> >> #include <stdint.h>
> >> #include <string.h>
> >> #include <stdio.h>
> >> #include <sys/syscall.h>
> >> #include <unistd.h>
> >>
> >> int fd;
> >> char buf[8192];
> >> char filename[256];
> >>
> >> void* thr(void* arg)
> >> {
> >>   switch ((long)arg) {
> >>   case 0:
> >>     write(fd, buf, 0x1001ul);
> >>     break;
> >>   case 1:
> >>     fdatasync(fd);
> >>     break;
> >>   case 2:
> >>     ftruncate(fd, 2);
> >>     break;
> >>   case 3:
> >>     write(fd, buf, 0x20ul);
> >>     break;
> >>   case 5:
> >>     fd = open(filename, 0x50042ul, 0x41ul);
> >>     break;
> >
> > This open() code is unreachable because the thread argument will only be 0-4,
> > right?  Should this be "case 4"?
> 
> I am not sure. I think it I just copy-pasted the program that
> triggered the crash for me. Andrey should have a valid reproducer, in
> the other thread he said that he can reproduce it. Andrey, did you
> change 5 to 4?

Ah, sorry if I wasn't clear.  I don't think you need the open() call to have a
valid reproducer.  In mine, in fact, I only use the first three - the error
happens with a combination of write(), fdatasync() and ftruncate().

I just wanted to note that the test program (which was autogenerated?) had an
unreachable case in the switch() statement. :)

Thanks for this testing, by the way!