On Fri, Mar 29, 2019 at 9:02 PM Anton Lindqvist <
an...@basename.se> wrote:
>
> On Fri, Mar 29, 2019 at 08:12:10PM +0100, Dmitry Vyukov wrote:
> > On Fri, Mar 29, 2019 at 7:56 PM syzbot
> > <
syzbot+45aa6b...@syzkaller.appspotmail.com> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following crash on:
> > >
> > > HEAD commit:
> > > git tree:
https://github.com/google/syzkaller.git master
> > > console output:
https://syzkaller.appspot.com/x/log.txt?x=138ab897200000
> > > dashboard link:
https://syzkaller.appspot.com/bug?extid=45aa6ba64ebbf176bcdd
> > > compiler: go version go1.12.1 freebsd/amd64
> > >
> > > Unfortunately, I don't have any reproducer for this crash yet.
> > >
> > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > Reported-by:
syzbot+45aa6b...@syzkaller.appspotmail.com
> >
> > +Anton
> > Uh, that's something we should have been caught during description compilation.
> >
> > panic: call ioctl$BIOCGETIF: pointer arg 'buffer' has output direction
> > [recovered]
> > panic: call ioctl$BIOCGETIF: pointer arg 'buffer' has output direction
>
> Ouch, my bad. Should I interpret the errors as the ptr[out, ifreq]
> argument contradicts the buffer[in] field? Could the field make use of a
> better type? In the end, it's just a pointer to a buffer.
Turns out this this because of buffer type. "ptr" has the special case
I made "buffer" a builtin alias to "ptr[array[int8]]". It should fix the crash: