Re: generic-sanitise.c:fill_arg:294 unreachable!

[Dave Jones <davej@redhat.com>]

On Tue, May 28, 2013 at 05:11:45PM +0200, Toralf Förster wrote:
 > run into this today while fuzzying a stable Gentoo Linux image (chrooted) and kernel 3.10-rc3:
 > 
 > 
 > [29118] [36] statfs64(pathname="/mnt/hostfs/v1/v2/f19735", sz=0x3fba7c8f) = -1 (Invalid argument)
 > generic-sanitise.c:fill_arg:294 unreachable!
 > [watchdog] pid 29096 hasn't made progress in 30 seconds! (last:1369753604 now:1369753634 diff:30). Stuck in syscall 279:mq_timedsend. Sending SIGKILL.
 > [28242] Random reseed: 504311294
 > 
 > 
 > and later :
 > 
 > 
 > [29123] [128] setdomainname(name=0, len=0) = -1 (Operation not permitted)
 > [29123] [129] pread64(fd=12, buf=0x895a000[page_rand], count=4096, pos=16) = -1 (Is a directory)
 > generic-sanitise.c:fill_arg:294 unreachable!
 > [watchdog] pid 29118 hasn't made progress in 30 seconds! (last:1369753633 now:1369753663 diff:30). Stuck in syscall 279:mq_timedsend. Sending SIGKILL.
 > [28242] Random reseed: 1774374230
 > [29133] [0] setresuid(ruid=0x8fffffff, euid=0x45009081, suid=0x67a8cbc6) = -1 (Operation not permitted)
 > 
 > 
 > 
 > [29133] [31] acct(name=0) = -1 (Operation not permitted)
 > [29133] [32] pipe2(fildes=4, flags=0x4000) = -1 (Bad address)
 > generic-sanitise.c:fill_arg:294 unreachable!
 > [watchdog] pid 29121 hasn't made progress in 30 seconds! (last:1369753635 now:1369753665 diff:30). Stuck in syscall 279:mq_timedsend. Sending SIGKILL.
 > [28242] Random reseed: 641723094
 > [29143] [0] unlinkat(dfd=12, pathname="/mnt/hostfs/v1/v2/f19735", flag=0x74fe39d0) = -1 (Invalid argument)
 > 
 > 
 > expected or rather a ToDo ?

unexpected. Very strange. Can you apply this, and see what it prints out ?

diff --git a/generic-sanitise.c b/generic-sanitise.c
index 0fb2f52..2232437 100644
--- a/generic-sanitise.c
+++ b/generic-sanitise.c
@@ -291,6 +291,9 @@ static unsigned long fill_arg(int childno, int call, int argnum)
 		return mode;
 
 	default:
+		printf("name: %s\n", syscalls[call].entry->name);
+		printf("argnum: %d\n", argnum);
+		printf("argtype: %d\n", argtype);
 		BUG("unreachable!\n");
 		return 0;
 	}