[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <145370.1690204627@warthog.procyon.org.uk>
Date: Mon, 24 Jul 2023 14:17:07 +0100
From: David Howells <dhowells@...hat.com>
To: syzbot <syzbot+f527b971b4bdc8e79f9e@...kaller.appspotmail.com>
Cc: dhowells@...hat.com, bpf@...r.kernel.org, brauner@...nel.org,
davem@...emloft.net, dsahern@...nel.org, edumazet@...gle.com,
kuba@...nel.org, linux-fsdevel@...r.kernel.org,
linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
pabeni@...hat.com, syzkaller-bugs@...glegroups.com,
viro@...iv.linux.org.uk
Subject: Re: [syzbot] [fs?] INFO: task hung in pipe_release (4)
Note that the test program is dodgy:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
r2 is closed here:
close(r2)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r3, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffed3, &(0x7f0000000940)=[{&(0x7f00000006c0)='O', 0x57e}], 0x1}}], 0x4000000000003bd, 0x8800)
write$binfmt_misc(r1, &(0x7f0000000440)=ANY=[], 0x8)
but then used here:
splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0)
As it happens, r3 will probably end up referring to the same fd as r2 did, but
that's not guaranteed.
David
Powered by blists - more mailing lists