On Fri, Jul 15, 2016 at 09:07:48PM +0200, Dmitry Vyukov wrote: > On Fri, Jul 15, 2016 at 9:03 PM, Ross Zwisler > <[email protected]> wrote: > >> // autogenerated by syzkaller (http://github.com/google/syzkaller) > >> #include <pthread.h> > >> #include <stdint.h> > >> #include <string.h> > >> #include <stdio.h> > >> #include <sys/syscall.h> > >> #include <unistd.h> > >> > >> int fd; > >> char buf[8192]; > >> char filename[256]; > >> > >> void* thr(void* arg) > >> { > >> switch ((long)arg) { > >> case 0: > >> write(fd, buf, 0x1001ul); > >> break; > >> case 1: > >> fdatasync(fd); > >> break; > >> case 2: > >> ftruncate(fd, 2); > >> break; > >> case 3: > >> write(fd, buf, 0x20ul); > >> break; > >> case 5: > >> fd = open(filename, 0x50042ul, 0x41ul); > >> break; > > > > This open() code is unreachable because the thread argument will only be > > 0-4, > > right? Should this be "case 4"? > > I am not sure. I think it I just copy-pasted the program that > triggered the crash for me. Andrey should have a valid reproducer, in > the other thread he said that he can reproduce it. Andrey, did you > change 5 to 4?
Ah, sorry if I wasn't clear. I don't think you need the open() call to have a valid reproducer. In mine, in fact, I only use the first three - the error happens with a combination of write(), fdatasync() and ftruncate(). I just wanted to note that the test program (which was autogenerated?) had an unreachable case in the switch() statement. :) Thanks for this testing, by the way!
