On Fri, Jul 15, 2016 at 10:21 PM, Ross Zwisler <[email protected]> wrote: > On Fri, Jul 15, 2016 at 09:07:48PM +0200, Dmitry Vyukov wrote: >> On Fri, Jul 15, 2016 at 9:03 PM, Ross Zwisler >> <[email protected]> wrote: >> >> // autogenerated by syzkaller (http://github.com/google/syzkaller) >> >> #include <pthread.h> >> >> #include <stdint.h> >> >> #include <string.h> >> >> #include <stdio.h> >> >> #include <sys/syscall.h> >> >> #include <unistd.h> >> >> >> >> int fd; >> >> char buf[8192]; >> >> char filename[256]; >> >> >> >> void* thr(void* arg) >> >> { >> >> switch ((long)arg) { >> >> case 0: >> >> write(fd, buf, 0x1001ul); >> >> break; >> >> case 1: >> >> fdatasync(fd); >> >> break; >> >> case 2: >> >> ftruncate(fd, 2); >> >> break; >> >> case 3: >> >> write(fd, buf, 0x20ul); >> >> break; >> >> case 5: >> >> fd = open(filename, 0x50042ul, 0x41ul); >> >> break; >> > >> > This open() code is unreachable because the thread argument will only be >> > 0-4, >> > right? Should this be "case 4"? >> >> I am not sure. I think it I just copy-pasted the program that >> triggered the crash for me. Andrey should have a valid reproducer, in >> the other thread he said that he can reproduce it. Andrey, did you >> change 5 to 4? > > Ah, sorry if I wasn't clear. I don't think you need the open() call to have a > valid reproducer. In mine, in fact, I only use the first three - the error > happens with a combination of write(), fdatasync() and ftruncate(). > > I just wanted to note that the test program (which was autogenerated?) had an > unreachable case in the switch() statement. :) > > Thanks for this testing, by the way!
Ah, OK. I modified the program by hand to make it trigger the bug more frequently. So I think the bug was introduced by me. Generator should not generate dead cases.
