dvyukov

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
#include <pthread.h>

long r[367];

void *thr(void *arg)

dvyukov

/*
 * Performance events core code:
 *
 *  Copyright (C) 2008 Thomas Gleixner <[email protected]>
 *  Copyright (C) 2008-2011 Red Hat, Inc., Ingo Molnar
 *  Copyright (C) 2008-2011 Red Hat, Inc., Peter Zijlstra
 *  Copyright  ©  2009 Paul Mackerras, IBM Corp. <[email protected]>
 *
 * For licensing details see kernel-base/COPYING
 */

dvyukov

Before:

ffffffff81574b60 <__sanitizer_cov_trace_pc>:
ffffffff81574b60:       65 48 8b 04 25 c0 4e    mov    %gs:0x14ec0,%rax
ffffffff81574b67:       01 00 
ffffffff81574b69:       48 85 c0                test   %rax,%rax
ffffffff81574b6c:       74 1a                   je     ffffffff81574b88 <__sanitizer_cov_trace_pc+0x28>
ffffffff81574b6e:       65 8b 15 db 02 aa 7e    mov    %gs:0x7eaa02db(%rip),%edx        # 14e50 <__preempt_count>
ffffffff81574b75:       81 e2 00 ff 1f 00       and    $0x1fff00,%edx
ffffffff81574b7b:       75 0b                   jne    ffffffff81574b88 <__sanitizer_cov_trace_pc+0x28>

dvyukov

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index b64f20d..13cfa81 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1962,7 +1962,7 @@ static int snd_seq_ioctl_remove_events(struct snd_seq_client *client,
 		 * No restrictions so for a user client we can clear
 		 * the whole fifo
 		 */
-		if (client->type == USER_CLIENT)
+		if (client->type == USER_CLIENT && client->data.user.fifo)

dvyukov

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index a8e7aa3..f5e18c2 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -76,6 +76,8 @@ int af_alg_register_type(const struct af_alg_type *type)
 		goto unlock;
 
 	type->ops->owner = THIS_MODULE;
+	if (type->ops_nokey)
+		type->ops_nokey->owner = THIS_MODULE;

dvyukov

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
#include <pthread.h>

long r[50];

int main()

dvyukov

[ 2688.712133] ======================================================
[ 2688.714127] [ INFO: possible circular locking dependency detected ]
[ 2688.714127] 4.4.0+ #273 Not tainted
[ 2688.714127] -------------------------------------------------------
[ 2688.719151] kworker/u10:4/6892 is trying to acquire lock:
[ 2688.719151]  (routelock){+.+...}, at: [<ffffffff82d1e3e0>] n_tracerouter_receivebuf+0x20/0x40
[ 2688.719151] 
[ 2688.719151] but task is already holding lock:
[ 2688.723409]  (&buf->lock){+.+...}, at: [<ffffffff82d05a11>] flush_to_ldisc+0xe1/0x7f0
[ 2688.723409] 

dvyukov

======================================================
[ INFO: possible circular locking dependency detected ]
4.4.0+ #273 Not tainted
-------------------------------------------------------
kworker/u10:4/6892 is trying to acquire lock:
 (routelock){+.+...}, at: [<ffffffff82d1e3e0>] n_tracerouter_receivebuf+0x20/0x40 drivers/tty/n_tracerouter.c:175

but task is already holding lock:
 (&buf->lock){+.+...}, at: [<ffffffff82d05a11>] flush_to_ldisc+0xe1/0x7f0 drivers/tty/tty_buffer.c:487

dvyukov

// Copyright 2015 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

#include <algorithm>
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <limits.h>
#include <linux/futex.h>
#include <linux/reboot.h>

dvyukov

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/sched.h>
#include <pthread.h>
#include <sched.h>
#include <sched.h>
#include <stdarg.h>
#include <stdint.h>