// https://syzkaller.appspot.com/bug?id=7579624a9731e0731cf1ae7736c43ba25c911e9a #include #include #include #include #include #include #include #include #include int inotify_fd; volatile int current_wd = -1; volatile int stop = 0; void *adder_thread(void *arg) { while (!stop) { int wd = inotify_add_watch(inotify_fd, "testfile", IN_CLOSE_WRITE | IN_CLOSE_NOWRITE); if (wd >= 0) { current_wd = wd; } } return NULL; } void *remover_thread(void *arg) { while (!stop) { int wd = current_wd; if (wd >= 0) { inotify_rm_watch(inotify_fd, wd); } } return NULL; } void *closer_thread(void *arg) { while (!stop) { int fd = open("testfile", O_RDONLY); if (fd >= 0) { close(fd); } } return NULL; } int main() { int res; inotify_fd = inotify_init(); if (inotify_fd < 0) { printf("[-] Failed to inotify_init: %s\n", strerror(errno)); exit(1); } printf("[+] inotify_init successful.\n"); int fd = open("testfile", O_CREAT | O_RDWR, 0666); if (fd < 0) { printf("[-] Failed to open: %s\n", strerror(errno)); exit(1); } printf("[+] open successful.\n"); res = close(fd); if (res < 0) { printf("[-] Failed to close: %s\n", strerror(errno)); exit(1); } printf("[+] close successful.\n"); pthread_t t1, t2, t3; res = pthread_create(&t1, NULL, adder_thread, NULL); if (res != 0) { printf("[-] Failed to pthread_create t1: %s\n", strerror(res)); exit(1); } printf("[+] pthread_create t1 successful.\n"); res = pthread_create(&t2, NULL, remover_thread, NULL); if (res != 0) { printf("[-] Failed to pthread_create t2: %s\n", strerror(res)); exit(1); } printf("[+] pthread_create t2 successful.\n"); res = pthread_create(&t3, NULL, closer_thread, NULL); if (res != 0) { printf("[-] Failed to pthread_create t3: %s\n", strerror(res)); exit(1); } printf("[+] pthread_create t3 successful.\n"); sleep(5); stop = 1; res = pthread_join(t1, NULL); if (res != 0) { printf("[-] Failed to pthread_join t1: %s\n", strerror(res)); exit(1); } printf("[+] pthread_join t1 successful.\n"); res = pthread_join(t2, NULL); if (res != 0) { printf("[-] Failed to pthread_join t2: %s\n", strerror(res)); exit(1); } printf("[+] pthread_join t2 successful.\n"); res = pthread_join(t3, NULL); if (res != 0) { printf("[-] Failed to pthread_join t3: %s\n", strerror(res)); exit(1); } printf("[+] pthread_join t3 successful.\n"); res = close(inotify_fd); if (res < 0) { printf("[-] Failed to close inotify_fd: %s\n", strerror(errno)); exit(1); } printf("[+] close inotify_fd successful.\n"); res = unlink("testfile"); if (res < 0) { printf("[-] Failed to unlink: %s\n", strerror(errno)); exit(1); } printf("[+] unlink successful.\n"); return 0; }