linux-kernel - Re: mm: GPF in find_get_pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+ZagCds8anb6vpoTPwe-phubnw9ezaDqESr2D9yvs8-mA@mail.gmail.com>
Date:	Fri, 15 Jul 2016 22:25:58 +0200
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	syzkaller <syzkaller@...glegroups.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>, Jan Kara <jack@...e.cz>,
	ross.zwisler@...ux.intel.com,
	"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Hugh Dickins <hughd@...gle.com>,
	Greg Thelen <gthelen@...gle.com>,
	Suleiman Souhlal <suleiman@...gle.com>,
	Andrey Ryabinin <aryabinin@...tuozzo.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: Re: mm: GPF in find_get_pages_tag

On Fri, Jul 15, 2016 at 10:21 PM, Ross Zwisler
<ross.zwisler@...ux.intel.com> wrote:
> On Fri, Jul 15, 2016 at 09:07:48PM +0200, Dmitry Vyukov wrote:
>> On Fri, Jul 15, 2016 at 9:03 PM, Ross Zwisler
>> <ross.zwisler@...ux.intel.com> wrote:
>> >> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> >> #include <pthread.h>
>> >> #include <stdint.h>
>> >> #include <string.h>
>> >> #include <stdio.h>
>> >> #include <sys/syscall.h>
>> >> #include <unistd.h>
>> >>
>> >> int fd;
>> >> char buf[8192];
>> >> char filename[256];
>> >>
>> >> void* thr(void* arg)
>> >> {
>> >>   switch ((long)arg) {
>> >>   case 0:
>> >>     write(fd, buf, 0x1001ul);
>> >>     break;
>> >>   case 1:
>> >>     fdatasync(fd);
>> >>     break;
>> >>   case 2:
>> >>     ftruncate(fd, 2);
>> >>     break;
>> >>   case 3:
>> >>     write(fd, buf, 0x20ul);
>> >>     break;
>> >>   case 5:
>> >>     fd = open(filename, 0x50042ul, 0x41ul);
>> >>     break;
>> >
>> > This open() code is unreachable because the thread argument will only be 0-4,
>> > right?  Should this be "case 4"?
>>
>> I am not sure. I think it I just copy-pasted the program that
>> triggered the crash for me. Andrey should have a valid reproducer, in
>> the other thread he said that he can reproduce it. Andrey, did you
>> change 5 to 4?
>
> Ah, sorry if I wasn't clear.  I don't think you need the open() call to have a
> valid reproducer.  In mine, in fact, I only use the first three - the error
> happens with a combination of write(), fdatasync() and ftruncate().
>
> I just wanted to note that the test program (which was autogenerated?) had an
> unreachable case in the switch() statement. :)
>
> Thanks for this testing, by the way!


Ah, OK. I modified the program by hand to make it trigger the bug more
frequently. So I think the bug was introduced by me. Generator should
not generate dead cases.