panic: refcount ADDR wraparound
6 views
Skip to first unread message
syzbot
Feb 3, 2020, 11:24:12 PM2/3/20
to syzkaller-f...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 41f5785e Implement a deferred write advancement feature th..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16f8ec5ee00000
dashboard link: https://syzkaller.appspot.com/bug?extid=0c9b05e2b727aae21eef
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0c9b05...@syzkaller.appspotmail.com
panic: refcount 0xfffff800163bba78 wraparound
cpuid = 0
time = 1580790170
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0024546890
vpanic() at vpanic+0x1ce/frame 0xfffffe0024546900
panic() at panic+0x43/frame 0xfffffe0024546960
_refcount_update_saturated() at _refcount_update_saturated+0x15/frame 0xfffffe0024546970
refcount_release_last() at refcount_release_last+0xfb/frame 0xfffffe00245469b0
kern_accept4() at kern_accept4+0x667/frame 0xfffffe0024546a50
accept1() at accept1+0x74/frame 0xfffffe0024546ab0
amd64_syscall() at amd64_syscall+0x499/frame 0xfffffe0024546bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0024546bf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x4132ea, rsp = 0x7fffdfffdf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 3922 tid 100506 ]
Stopped at kdb_enter+0x67: movq $0,0x1466a56(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe0027e00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe0024546870
rbp 0xfffffe0024546890
rsi 0x40001
rdi 0xffffffff810ba596 vprintf+0x176
r8 0
r9 0xffffffff
r10 0x18a9c
r11 0xfffff800160104f0
r12 0xffffffff82068d90 ddb_dbbe
r13 0
r14 0xffffffff81938dcf
r15 0xffffffff81938dcf
rip 0xffffffff810af647 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x1466a56(%rip)
db> show proc
Process 3922 (syz-executor.2) at 0xfffff800160c3000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 782 at 0xfffff80003e1c530
ABI: FreeBSD ELF64
arguments: /root/syz-executor.2
reaper: 0xfffff80003300a60 reapsubtree: 1
sigparent: 20
vmspace: 0xfffff800164bd000
(map 0xfffff800164bd000)
(map.pmap 0xfffff800164bd0c0)
(pmap 0xfffff800164bd120)
threads: 2
101020 s syz-executor.2
100506 Run CPU 0 syz-executor.2
db> ps
pid ppid pgrp uid state wmesg wchan cmd
3925 769 769 0 R (threaded) syz-executor.1
100558 Run CPU 1 syz-executor.1
100494 S sbwait 0xfffff80003e871d4 syz-executor.1
3924 768 768 0 S (threaded) syz-executor.0
100765 S nanslp 0xffffffff824feca0 syz-executor.0
100500 S sbwait 0xfffff80003e7d2d4 syz-executor.0
100521 S uwait 0xfffff8003af74500 syz-executor.0
100530 S uwait 0xfffff8003af74780 syz-executor.0
3923 784 784 0 S (threaded) syz-executor.3
100362 S nanslp 0xffffffff824feca0 syz-executor.3
100517 S connec 0xfffff80003e84478 syz-executor.3
100518 S uwait 0xfffff80003e1d780 syz-executor.3
100529 S uwait 0xfffff8003af74b80 syz-executor.3
3922 782 782 0 T (threaded) syz-executor.2
101020 s syz-executor.2
100506 Run CPU 0 syz-executor.2
2531 1 2531 65 Ss select 0xfffff8003aff6840 dhclient
2155 1 2155 0 Ss select 0xfffff80003b71ec0 dhclient
2152 1 2152 0 Ss select 0xfffff80003b71c40 dhclient
2133 1 2133 65 Ss select 0xfffff80003cf16c0 dhclient
1757 1 1757 0 Ss select 0xfffff8003a2801c0 dhclient
1754 1 1754 0 Ss select 0xfffff80003b71bc0 dhclient
1735 1 1735 65 Ss select 0xfffff8003a280240 dhclient
1318 1 1318 0 Ss select 0xfffff80003d31dc0 dhclient
1314 1 1314 0 Ss select 0xfffff8003aff6940 dhclient
1293 1 1293 65 Ss select 0xfffff8003aff6640 dhclient
976 1 976 0 Ss select 0xfffff80003cf1040 dhclient
973 1 973 0 Ss select 0xfffff80003d31e40 dhclient
784 766 784 0 Rs syz-executor.3
782 766 782 0 Rs syz-executor.2
769 766 769 0 Ss nanslp 0xffffffff824feca0 syz-executor.1
768 766 768 0 Ss nanslp 0xffffffff824feca0 syz-executor.0
766 764 764 0 S (threaded) syz-fuzzer
100080 S uwait 0xfffff80003e20200 syz-fuzzer
100099 S uwait 0xfffff80003a54b00 syz-fuzzer
100100 S kqread 0xfffff80003b49100 syz-fuzzer
100101 S uwait 0xfffff80003a54d00 syz-fuzzer
100102 S uwait 0xfffff80003a54e00 syz-fuzzer
100103 S uwait 0xfffff80003a54f00 syz-fuzzer
100104 S uwait 0xfffff80003a54480 syz-fuzzer
100105 S uwait 0xfffff80003e22c00 syz-fuzzer
100106 S uwait 0xfffff80003a54580 syz-fuzzer
100107 S uwait 0xfffff80003e22d00 syz-fuzzer
100112 S uwait 0xfffff80003e21100 syz-fuzzer
764 762 764 0 Ss pause 0xfffff800032ffb08 csh
762 680 762 0 Ss select 0xfffff8003a281640 sshd
748 1 748 0 Ss+ ttyin 0xfffff800034050b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003ac94b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003ac98b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003ac9cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003ace0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003ace4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003ace8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003acecb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003acd0b0 getty
684 1 684 0 Ss nanslp 0xffffffff824feca0 cron
680 1 680 0 Ss select 0xfffff8003a281940 sshd
493 1 493 0 Ss select 0xfffff8003a281740 syslogd
422 1 422 0 Ss select 0xfffff8003a2817c0 devd
421 1 421 65 Ss select 0xfffff80003cf1f40 dhclient
336 1 336 0 Ss select 0xfffff80003cf2040 dhclient
333 1 333 0 Ss select 0xfffff8003a2818c0 dhclient
21 0 0 0 DL vlruwt 0xfffff80003b12a60 [vnlru]
20 0 0 0 DL syncer 0xffffffff825d5158 [syncer]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d4658 [bufdaemon]
100070 D - 0xffffffff8200a980 [bufspacedaemon-0]
100081 D sdflush 0xfffff80003dc8ce8 [/ worker]
18 0 0 0 DL psleep 0xffffffff825f00c8 [vmdaemon]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261cfd8 [dom0]
100068 D launds 0xffffffff8261cfe4 [laundry: dom0]
100069 D umarcl 0xffffffff8153f840 [uma]
16 0 0 0 DL - 0xffffffff82359530 [rand_harvestq]
15 0 0 0 DL waiting 0xffffffff826625a0 [sctp_iterator]
9 0 0 0 DL - 0xffffffff825d405c [soaiod4]
8 0 0 0 DL - 0xffffffff825d405c [soaiod3]
7 0 0 0 DL - 0xffffffff825d405c [soaiod2]
6 0 0 0 DL - 0xffffffff825d405c [soaiod1]
5 0 0 0 DL (threaded) [cam]
100031 D - 0xffffffff82234940 [doneq0]
100062 D - 0xffffffff82234808 [scanner]
4 0 0 0 DL crypto_ 0xfffff800031fb090 [crypto returns 1]
3 0 0 0 DL crypto_ 0xfffff800031fb030 [crypto returns 0]
2 0 0 0 DL crypto_ 0xffffffff825ea138 [crypto]
14 0 0 0 DL seqstat 0xfffff80003370c88 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100022 D - 0xffffffff8261b608 [g_event]
100023 D - 0xffffffff8261b618 [g_up]
100024 D - 0xffffffff8261b610 [g_down]
12 0 0 0 WL (threaded) [intr]
100006 I [swi5: fast taskq]
100010 I [swi6: task queue]
100011 I [swi6: Giant taskq]
100017 I [swi3: vm]
100018 I [swi4: clock (0)]
100019 I [swi4: clock (1)]
100020 I [swi1: netisr 0]
100032 I [irq24: virtio_pci0]
100033 I [irq25: virtio_pci0]
100034 I [irq26: virtio_pci0]
100035 I [irq27: virtio_pci0]
100036 I [irq28: virtio_pci1]
100037 I [irq29: virtio_pci1]
100038 I [irq30: virtio_pci1]
100039 I [irq31: virtio_pci1]
100040 I [irq32: virtio_pci1]
100045 I [irq10: virtio_pci2]
100047 I [irq1: atkbd0]
100048 I [irq12: psm0]
100049 I [swi0: uart uart++]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff80003300a60 [init]
10 0 0 0 DL audit_w 0xffffffff82663230 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff82609c48 [swapper]
100005 D - 0xfffff8000334e100 [thread taskq]
100007 D - 0xfffff8000334be00 [kqueue_ctx taskq]
100008 D - 0xfffff8000334bd00 [config_0]
100009 D - 0xfffff8000334bc00 [aiod_kick taskq]
100012 D - 0xfffff8000334b900 [if_config_tqg_0]
100013 D - 0xfffff8000334b800 [if_io_tqg_0]
100014 D - 0xfffff8000334b700 [if_io_tqg_1]
100015 D - 0xfffff8000334b600 [softirq_0]
100016 D - 0xfffff8000334b500 [softirq_1]
100021 D - 0xfffff8000334b400 [firmware taskq]
100026 D - 0xfffff8000334b300 [crypto_0]
100027 D - 0xfffff8000334b300 [crypto_1]
100041 D - 0xfffff8000334b100 [vtnet0 rxq 0]
100042 D - 0xfffff8000334b000 [vtnet0 txq 0]
100043 D - 0xfffff8000334ce00 [vtnet0 rxq 1]
100044 D - 0xfffff8000334cd00 [vtnet0 txq 1]
100046 D vtbslp 0xfffff800034de580 [virtio_balloon]
100050 D - 0xfffff8000334cc00 [mca taskq]
100054 D - 0xffffffff81cdce20 [deadlkres]
100057 D - 0xfffff80003b49300 [acpi_task_0]
100058 D - 0xfffff80003b49300 [acpi_task_1]
100059 D - 0xfffff80003b49300 [acpi_task_2]
100061 D - 0xfffff8000334b200 [CAM taskq]
db> show all locks
Process 3924 (syz-executor.0) thread 0xfffff800163db000 (100500)
exclusive sx so_snd_sx (so_snd_sx) r = 0 (0xfffff80003e7d278) locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_sockbuf.c:393
db> show malloc
Type InUse MemUse Requests
devbuf 4213 4851K 4241
vtbuf 24 1968K 46
sysctloid 26737 1565K 26801
kobj 332 1328K 488
newblk 26 1031K 13762
vfscache 4 1025K 4
pcb 28 537K 2605
inodedep 44 534K 4299
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 143 285K 4008
acpica 1674 185K 49750
vnet_data 1 168K 1
filedesc 21 149K 5923
pagedep 11 131K 3198
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 222 89K 253
BPF 46 88K 46
bus 964 78K 3332
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 494 62K 494
umtx 360 45K 360
kdtrace 191 37K 17665
gtaskqueue 22 34K 22
hostcache 1 32K 1
shm 1 32K 124
DEVFS3 124 31K 134
msg 4 30K 4
cred 106 27K 1133
DEVFS_RULE 56 27K 56
ifaddr 74 25K 76
kbdmux 6 22K 6
vmem 3 20K 5
lltable 47 18K 73
temp 34 17K 2589
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
ether_multi 172 14K 197
bus-sc 30 14K 1394
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
select 83 11K 83
in6_multi 89 11K 89
eventhandler 122 11K 122
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
dirrem 33 9K 3650
bmsafemap 2 9K 4191
devstat 4 9K 4
UART 12 9K 12
rpc 2 8K 2
sctp_timw 32 8K 32
shmfd 1 8K 1
pfs_vncache 1 8K 1
routetbl 58 8K 62
audit_evclass 231 8K 289
kqueue 63 7K 3932
CAM DEV 3 6K 510
plimit 24 6K 704
vt 11 6K 11
lockf 46 6K 4608
sglist 5 6K 5
freework 21 6K 7191
CAM queue 5 6K 1528
DEVFSP 78 5K 82
ufs_dirhash 24 5K 24
taskqueue 42 5K 42
session 35 5K 51
pgrp 35 5K 51
freefile 33 5K 3643
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
kcovinfo 64 4K 68
UMA 236 4K 236
hhook 13 4K 13
proc-args 52 3K 667
acpisem 22 3K 22
terminal 11 3K 11
uidinfo 6 3K 23
sctp_ifa 17 3K 17
local_apic 1 2K 1
io_apic 1 2K 1
freeblks 8 2K 3581
ipsec-saq 2 2K 2
ip6ndp 12 2K 21
Unitno 30 2K 17487
CAM XPT 22 2K 543
in_multi 6 2K 17
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
mkdir 8 1K 5916
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 944
NFSD session 1 1K 1
CAM periph 4 1K 271
newdirblk 6 1K 2958
mld 6 1K 6
sctp_ifn 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
diradd 5 1K 3691
inpcbpolicy 19 1K 10382
CAM SIM 2 1K 2
pfil 4 1K 4
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
iov 2 1K 21086
osd 3 1K 9
indirdep 1 1K 3589
vnodes 1 1K 5
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 3
soname 5 1K 6499
CAM path 4 1K 1034
apmdev 1 1K 1
atkbddev 2 1K 2
ip_msource 2 1K 25
pmchooks 1 1K 1
prison 4 1K 4
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
nexusdev 5 1K 5
filecaps 5 1K 116
entropy 2 1K 44
tcpfunc 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
CAM CCB 0 0K 57425
madt_table 0 0K 2
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
fpukern_ctx 0 0K 0
xen_intr 0 0K 0
CAM ccb queue 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 2488
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 472
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 123
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 6
ip6_msource 0 0K 0
ip6_moptions 0 0K 5
in6_mfilter 0 0K 14
frag6 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 308
sctp_iter 0 0K 8
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 1072
sctp_atky 0 0K 1228
sctp_atcl 0 0K 1072
sctp_a_it 0 0K 8
sctp_aadr 0 0K 5
sctp_stro 0 0K 140
sctp_stri 0 0K 0
sctp_map 0 0K 280
newreno data 0 0K 0
ip_moptions 0 0K 16
in_mfilter 0 0K 48
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
statfs 0 0K 3144
export_host 0 0K 0
cl_savebuf 0 0K 50
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
mbuf_tag 0 0K 164
accf 0 0K 0
pts 0 0K 0
ioctlops 0 0K 325
Witness 0 0K 0
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 699
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
filedesc_to_leader 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
db> show ktr
No such command; use "help" to list available commands
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 41f5785e Implement a deferred write advancement feature th..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16f8ec5ee00000
dashboard link: https://syzkaller.appspot.com/bug?extid=0c9b05e2b727aae21eef
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0c9b05...@syzkaller.appspotmail.com
panic: refcount 0xfffff800163bba78 wraparound
cpuid = 0
time = 1580790170
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0024546890
vpanic() at vpanic+0x1ce/frame 0xfffffe0024546900
panic() at panic+0x43/frame 0xfffffe0024546960
_refcount_update_saturated() at _refcount_update_saturated+0x15/frame 0xfffffe0024546970
refcount_release_last() at refcount_release_last+0xfb/frame 0xfffffe00245469b0
kern_accept4() at kern_accept4+0x667/frame 0xfffffe0024546a50
accept1() at accept1+0x74/frame 0xfffffe0024546ab0
amd64_syscall() at amd64_syscall+0x499/frame 0xfffffe0024546bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0024546bf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x4132ea, rsp = 0x7fffdfffdf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 3922 tid 100506 ]
Stopped at kdb_enter+0x67: movq $0,0x1466a56(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe0027e00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe0024546870
rbp 0xfffffe0024546890
rsi 0x40001
rdi 0xffffffff810ba596 vprintf+0x176
r8 0
r9 0xffffffff
r10 0x18a9c
r11 0xfffff800160104f0
r12 0xffffffff82068d90 ddb_dbbe
r13 0
r14 0xffffffff81938dcf
r15 0xffffffff81938dcf
rip 0xffffffff810af647 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x1466a56(%rip)
db> show proc
Process 3922 (syz-executor.2) at 0xfffff800160c3000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 782 at 0xfffff80003e1c530
ABI: FreeBSD ELF64
arguments: /root/syz-executor.2
reaper: 0xfffff80003300a60 reapsubtree: 1
sigparent: 20
vmspace: 0xfffff800164bd000
(map 0xfffff800164bd000)
(map.pmap 0xfffff800164bd0c0)
(pmap 0xfffff800164bd120)
threads: 2
101020 s syz-executor.2
100506 Run CPU 0 syz-executor.2
db> ps
pid ppid pgrp uid state wmesg wchan cmd
3925 769 769 0 R (threaded) syz-executor.1
100558 Run CPU 1 syz-executor.1
100494 S sbwait 0xfffff80003e871d4 syz-executor.1
3924 768 768 0 S (threaded) syz-executor.0
100765 S nanslp 0xffffffff824feca0 syz-executor.0
100500 S sbwait 0xfffff80003e7d2d4 syz-executor.0
100521 S uwait 0xfffff8003af74500 syz-executor.0
100530 S uwait 0xfffff8003af74780 syz-executor.0
3923 784 784 0 S (threaded) syz-executor.3
100362 S nanslp 0xffffffff824feca0 syz-executor.3
100517 S connec 0xfffff80003e84478 syz-executor.3
100518 S uwait 0xfffff80003e1d780 syz-executor.3
100529 S uwait 0xfffff8003af74b80 syz-executor.3
3922 782 782 0 T (threaded) syz-executor.2
101020 s syz-executor.2
100506 Run CPU 0 syz-executor.2
2531 1 2531 65 Ss select 0xfffff8003aff6840 dhclient
2155 1 2155 0 Ss select 0xfffff80003b71ec0 dhclient
2152 1 2152 0 Ss select 0xfffff80003b71c40 dhclient
2133 1 2133 65 Ss select 0xfffff80003cf16c0 dhclient
1757 1 1757 0 Ss select 0xfffff8003a2801c0 dhclient
1754 1 1754 0 Ss select 0xfffff80003b71bc0 dhclient
1735 1 1735 65 Ss select 0xfffff8003a280240 dhclient
1318 1 1318 0 Ss select 0xfffff80003d31dc0 dhclient
1314 1 1314 0 Ss select 0xfffff8003aff6940 dhclient
1293 1 1293 65 Ss select 0xfffff8003aff6640 dhclient
976 1 976 0 Ss select 0xfffff80003cf1040 dhclient
973 1 973 0 Ss select 0xfffff80003d31e40 dhclient
784 766 784 0 Rs syz-executor.3
782 766 782 0 Rs syz-executor.2
769 766 769 0 Ss nanslp 0xffffffff824feca0 syz-executor.1
768 766 768 0 Ss nanslp 0xffffffff824feca0 syz-executor.0
766 764 764 0 S (threaded) syz-fuzzer
100080 S uwait 0xfffff80003e20200 syz-fuzzer
100099 S uwait 0xfffff80003a54b00 syz-fuzzer
100100 S kqread 0xfffff80003b49100 syz-fuzzer
100101 S uwait 0xfffff80003a54d00 syz-fuzzer
100102 S uwait 0xfffff80003a54e00 syz-fuzzer
100103 S uwait 0xfffff80003a54f00 syz-fuzzer
100104 S uwait 0xfffff80003a54480 syz-fuzzer
100105 S uwait 0xfffff80003e22c00 syz-fuzzer
100106 S uwait 0xfffff80003a54580 syz-fuzzer
100107 S uwait 0xfffff80003e22d00 syz-fuzzer
100112 S uwait 0xfffff80003e21100 syz-fuzzer
764 762 764 0 Ss pause 0xfffff800032ffb08 csh
762 680 762 0 Ss select 0xfffff8003a281640 sshd
748 1 748 0 Ss+ ttyin 0xfffff800034050b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003ac94b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003ac98b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003ac9cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003ace0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003ace4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003ace8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003acecb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003acd0b0 getty
684 1 684 0 Ss nanslp 0xffffffff824feca0 cron
680 1 680 0 Ss select 0xfffff8003a281940 sshd
493 1 493 0 Ss select 0xfffff8003a281740 syslogd
422 1 422 0 Ss select 0xfffff8003a2817c0 devd
421 1 421 65 Ss select 0xfffff80003cf1f40 dhclient
336 1 336 0 Ss select 0xfffff80003cf2040 dhclient
333 1 333 0 Ss select 0xfffff8003a2818c0 dhclient
21 0 0 0 DL vlruwt 0xfffff80003b12a60 [vnlru]
20 0 0 0 DL syncer 0xffffffff825d5158 [syncer]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d4658 [bufdaemon]
100070 D - 0xffffffff8200a980 [bufspacedaemon-0]
100081 D sdflush 0xfffff80003dc8ce8 [/ worker]
18 0 0 0 DL psleep 0xffffffff825f00c8 [vmdaemon]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261cfd8 [dom0]
100068 D launds 0xffffffff8261cfe4 [laundry: dom0]
100069 D umarcl 0xffffffff8153f840 [uma]
16 0 0 0 DL - 0xffffffff82359530 [rand_harvestq]
15 0 0 0 DL waiting 0xffffffff826625a0 [sctp_iterator]
9 0 0 0 DL - 0xffffffff825d405c [soaiod4]
8 0 0 0 DL - 0xffffffff825d405c [soaiod3]
7 0 0 0 DL - 0xffffffff825d405c [soaiod2]
6 0 0 0 DL - 0xffffffff825d405c [soaiod1]
5 0 0 0 DL (threaded) [cam]
100031 D - 0xffffffff82234940 [doneq0]
100062 D - 0xffffffff82234808 [scanner]
4 0 0 0 DL crypto_ 0xfffff800031fb090 [crypto returns 1]
3 0 0 0 DL crypto_ 0xfffff800031fb030 [crypto returns 0]
2 0 0 0 DL crypto_ 0xffffffff825ea138 [crypto]
14 0 0 0 DL seqstat 0xfffff80003370c88 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100022 D - 0xffffffff8261b608 [g_event]
100023 D - 0xffffffff8261b618 [g_up]
100024 D - 0xffffffff8261b610 [g_down]
12 0 0 0 WL (threaded) [intr]
100006 I [swi5: fast taskq]
100010 I [swi6: task queue]
100011 I [swi6: Giant taskq]
100017 I [swi3: vm]
100018 I [swi4: clock (0)]
100019 I [swi4: clock (1)]
100020 I [swi1: netisr 0]
100032 I [irq24: virtio_pci0]
100033 I [irq25: virtio_pci0]
100034 I [irq26: virtio_pci0]
100035 I [irq27: virtio_pci0]
100036 I [irq28: virtio_pci1]
100037 I [irq29: virtio_pci1]
100038 I [irq30: virtio_pci1]
100039 I [irq31: virtio_pci1]
100040 I [irq32: virtio_pci1]
100045 I [irq10: virtio_pci2]
100047 I [irq1: atkbd0]
100048 I [irq12: psm0]
100049 I [swi0: uart uart++]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff80003300a60 [init]
10 0 0 0 DL audit_w 0xffffffff82663230 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff82609c48 [swapper]
100005 D - 0xfffff8000334e100 [thread taskq]
100007 D - 0xfffff8000334be00 [kqueue_ctx taskq]
100008 D - 0xfffff8000334bd00 [config_0]
100009 D - 0xfffff8000334bc00 [aiod_kick taskq]
100012 D - 0xfffff8000334b900 [if_config_tqg_0]
100013 D - 0xfffff8000334b800 [if_io_tqg_0]
100014 D - 0xfffff8000334b700 [if_io_tqg_1]
100015 D - 0xfffff8000334b600 [softirq_0]
100016 D - 0xfffff8000334b500 [softirq_1]
100021 D - 0xfffff8000334b400 [firmware taskq]
100026 D - 0xfffff8000334b300 [crypto_0]
100027 D - 0xfffff8000334b300 [crypto_1]
100041 D - 0xfffff8000334b100 [vtnet0 rxq 0]
100042 D - 0xfffff8000334b000 [vtnet0 txq 0]
100043 D - 0xfffff8000334ce00 [vtnet0 rxq 1]
100044 D - 0xfffff8000334cd00 [vtnet0 txq 1]
100046 D vtbslp 0xfffff800034de580 [virtio_balloon]
100050 D - 0xfffff8000334cc00 [mca taskq]
100054 D - 0xffffffff81cdce20 [deadlkres]
100057 D - 0xfffff80003b49300 [acpi_task_0]
100058 D - 0xfffff80003b49300 [acpi_task_1]
100059 D - 0xfffff80003b49300 [acpi_task_2]
100061 D - 0xfffff8000334b200 [CAM taskq]
db> show all locks
Process 3924 (syz-executor.0) thread 0xfffff800163db000 (100500)
exclusive sx so_snd_sx (so_snd_sx) r = 0 (0xfffff80003e7d278) locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_sockbuf.c:393
db> show malloc
Type InUse MemUse Requests
devbuf 4213 4851K 4241
vtbuf 24 1968K 46
sysctloid 26737 1565K 26801
kobj 332 1328K 488
newblk 26 1031K 13762
vfscache 4 1025K 4
pcb 28 537K 2605
inodedep 44 534K 4299
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 143 285K 4008
acpica 1674 185K 49750
vnet_data 1 168K 1
filedesc 21 149K 5923
pagedep 11 131K 3198
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 222 89K 253
BPF 46 88K 46
bus 964 78K 3332
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 494 62K 494
umtx 360 45K 360
kdtrace 191 37K 17665
gtaskqueue 22 34K 22
hostcache 1 32K 1
shm 1 32K 124
DEVFS3 124 31K 134
msg 4 30K 4
cred 106 27K 1133
DEVFS_RULE 56 27K 56
ifaddr 74 25K 76
kbdmux 6 22K 6
vmem 3 20K 5
lltable 47 18K 73
temp 34 17K 2589
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
ether_multi 172 14K 197
bus-sc 30 14K 1394
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
select 83 11K 83
in6_multi 89 11K 89
eventhandler 122 11K 122
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
dirrem 33 9K 3650
bmsafemap 2 9K 4191
devstat 4 9K 4
UART 12 9K 12
rpc 2 8K 2
sctp_timw 32 8K 32
shmfd 1 8K 1
pfs_vncache 1 8K 1
routetbl 58 8K 62
audit_evclass 231 8K 289
kqueue 63 7K 3932
CAM DEV 3 6K 510
plimit 24 6K 704
vt 11 6K 11
lockf 46 6K 4608
sglist 5 6K 5
freework 21 6K 7191
CAM queue 5 6K 1528
DEVFSP 78 5K 82
ufs_dirhash 24 5K 24
taskqueue 42 5K 42
session 35 5K 51
pgrp 35 5K 51
freefile 33 5K 3643
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
kcovinfo 64 4K 68
UMA 236 4K 236
hhook 13 4K 13
proc-args 52 3K 667
acpisem 22 3K 22
terminal 11 3K 11
uidinfo 6 3K 23
sctp_ifa 17 3K 17
local_apic 1 2K 1
io_apic 1 2K 1
freeblks 8 2K 3581
ipsec-saq 2 2K 2
ip6ndp 12 2K 21
Unitno 30 2K 17487
CAM XPT 22 2K 543
in_multi 6 2K 17
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
mkdir 8 1K 5916
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 944
NFSD session 1 1K 1
CAM periph 4 1K 271
newdirblk 6 1K 2958
mld 6 1K 6
sctp_ifn 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
diradd 5 1K 3691
inpcbpolicy 19 1K 10382
CAM SIM 2 1K 2
pfil 4 1K 4
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
iov 2 1K 21086
osd 3 1K 9
indirdep 1 1K 3589
vnodes 1 1K 5
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 3
soname 5 1K 6499
CAM path 4 1K 1034
apmdev 1 1K 1
atkbddev 2 1K 2
ip_msource 2 1K 25
pmchooks 1 1K 1
prison 4 1K 4
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
nexusdev 5 1K 5
filecaps 5 1K 116
entropy 2 1K 44
tcpfunc 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
CAM CCB 0 0K 57425
madt_table 0 0K 2
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
fpukern_ctx 0 0K 0
xen_intr 0 0K 0
CAM ccb queue 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 2488
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 472
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 123
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 6
ip6_msource 0 0K 0
ip6_moptions 0 0K 5
in6_mfilter 0 0K 14
frag6 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 308
sctp_iter 0 0K 8
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 1072
sctp_atky 0 0K 1228
sctp_atcl 0 0K 1072
sctp_a_it 0 0K 8
sctp_aadr 0 0K 5
sctp_stro 0 0K 140
sctp_stri 0 0K 0
sctp_map 0 0K 280
newreno data 0 0K 0
ip_moptions 0 0K 16
in_mfilter 0 0K 48
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
statfs 0 0K 3144
export_host 0 0K 0
cl_savebuf 0 0K 50
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
mbuf_tag 0 0K 164
accf 0 0K 0
pts 0 0K 0
ioctlops 0 0K 325
Witness 0 0K 0
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 699
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
filedesc_to_leader 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
db> show ktr
No such command; use "help" to list available commands
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Feb 4, 2020, 12:32:12 AM2/4/20
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 41f5785e Implement a deferred write advancement feature th..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=12466c0de00000
dashboard link: https://syzkaller.appspot.com/bug?extid=0c9b05e2b727aae21eef
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114b90f6e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1082314ee00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0c9b05...@syzkaller.appspotmail.com
panic: refcount 0xfffff80003d90078 wraparound
cpuid = 1
time = 1580794109
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002447c760
vpanic() at vpanic+0x1ce/frame 0xfffffe002447c7d0
panic() at panic+0x43/frame 0xfffffe002447c830
_refcount_update_saturated() at _refcount_update_saturated+0x15/frame 0xfffffe002447c840
refcount_release_last() at refcount_release_last+0xfb/frame 0xfffffe002447c880
closef() at closef+0x2b2/frame 0xfffffe002447c910
fdescfree_fds() at fdescfree_fds+0xa4/frame 0xfffffe002447c960
fdescfree() at fdescfree+0x60f/frame 0xfffffe002447ca30
exit1() at exit1+0x765/frame 0xfffffe002447caa0
sys_sys_exit() at sys_sys_exit+0xd/frame 0xfffffe002447cab0
amd64_syscall() at amd64_syscall+0x499/frame 0xfffffe002447cbf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe002447cbf0
--- syscall (1, FreeBSD ELF64, sys_sys_exit), rip = 0x44761a, rsp = 0x7fffffffead8, rbp = 0x7fffffffeaf0 ---
KDB: enter: panic
[ thread pid 771 tid 100093 ]
rdx 0xffffffff81899f5d
rbx 0
rsp 0xfffffe002447c740
rbp 0xfffffe002447c760
rsi 0x1
rdi 0
ABI: FreeBSD ELF64
arguments: ./syz-executor831576519
(map 0xfffff8003a667000)
(map.pmap 0xfffff8003a6670c0)
(pmap 0xfffff8003a667120)
threads: 1
100093 Run CPU 1 syz-executor8315765
769 767 769 0 Ss pause 0xfffff80003a4a5d8 csh
767 680 767 0 Ss select 0xfffff80003d3f9c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff800034060b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003acc4b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003acc8b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003acccb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003acb0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003acb4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003acb8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003acbcb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003ace0b0 getty
738 1 22 0 S+ piperd 0xfffff80003da75f0 logger
737 736 22 0 S+ nanslp 0xffffffff824feca0 sleep
736 1 22 0 S+ wait 0xfffff8003a516000 sh
493 1 493 0 Ss select 0xfffff80003d110c0 syslogd
422 1 422 0 Ss select 0xfffff80003d11240 devd
421 1 421 65 Ss select 0xfffff80003d3f740 dhclient
336 1 336 0 Ss select 0xfffff80003d3f840 dhclient
333 1 333 0 Ss select 0xfffff80003d111c0 dhclient
21 0 0 0 DL vlruwt 0xfffff80003b10a60 [vnlru]
100080 D sdflush 0xfffff80003e52ce8 [/ worker]
100070 D umarcl 0xffffffff8153f840 [uma]
16 0 0 0 RL CPU 0 [rand_harvestq]
100046 D vtbslp 0xfffff800034db580 [virtio_balloon]
100057 D - 0xfffff80003b48300 [acpi_task_0]
100058 D - 0xfffff80003b48300 [acpi_task_1]
100059 D - 0xfffff80003b48300 [acpi_task_2]
vfscache 4 1025K 4
pcb 22 537K 76
inodedep 49 536K 72
linker 222 89K 241
bus 964 78K 3300
DEVFS3 120 30K 130
kdtrace 140 27K 1596
DEVFS_RULE 56 27K 56
umtx 204 26K 204
kbdmux 6 22K 6
vmem 3 19K 4
BPF 10 18K 10
temp 17 17K 1533
kenv 95 12K 99
cred 27 7K 234
sglist 5 6K 5
plimit 17 5K 322
ifnet 3 5K 3
UMA 236 4K 236
lltable 11 4K 11
diradd 26 4K 37
hhook 13 4K 13
ether_multi 40 4K 45
in6_multi 25 3K 25
session 20 3K 31
pgrp 20 3K 31
uidinfo 4 3K 4
select 15 2K 15
proc-args 39 2K 472
Unitno 25 2K 37
sctp_ifa 5 1K 5
mkdir 4 1K 16
in_multi 2 1K 3
mld 2 1K 2
sctp_ifn 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1
filecaps 4 1K 66
tun 3 1K 3
nexusdev 5 1K 5
entropy 2 1K 35
savedino 0 0K 12
freeblks 0 0K 25
freefrag 0 0K 7
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 3
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 3
ioctlops 0 0K 86
HEAD commit: 41f5785e Implement a deferred write advancement feature th..
git tree: freebsd
dashboard link: https://syzkaller.appspot.com/bug?extid=0c9b05e2b727aae21eef
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114b90f6e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1082314ee00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0c9b05...@syzkaller.appspotmail.com
cpuid = 1
time = 1580794109
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002447c760
vpanic() at vpanic+0x1ce/frame 0xfffffe002447c7d0
panic() at panic+0x43/frame 0xfffffe002447c830
_refcount_update_saturated() at _refcount_update_saturated+0x15/frame 0xfffffe002447c840
refcount_release_last() at refcount_release_last+0xfb/frame 0xfffffe002447c880
closef() at closef+0x2b2/frame 0xfffffe002447c910
fdescfree_fds() at fdescfree_fds+0xa4/frame 0xfffffe002447c960
fdescfree() at fdescfree+0x60f/frame 0xfffffe002447ca30
exit1() at exit1+0x765/frame 0xfffffe002447caa0
sys_sys_exit() at sys_sys_exit+0xd/frame 0xfffffe002447cab0
amd64_syscall() at amd64_syscall+0x499/frame 0xfffffe002447cbf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe002447cbf0
--- syscall (1, FreeBSD ELF64, sys_sys_exit), rip = 0x44761a, rsp = 0x7fffffffead8, rbp = 0x7fffffffeaf0 ---
KDB: enter: panic
[ thread pid 771 tid 100093 ]
Stopped at kdb_enter+0x67: movq $0,0x1466a56(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0x80 ll+0x5f
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rdx 0xffffffff81899f5d
rbx 0
rsp 0xfffffe002447c740
rbp 0xfffffe002447c760
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0
r11 0xfffff8003a51a4f0
r9 0xffffffff
r10 0
r12 0xffffffff82068d90 ddb_dbbe
r13 0
r14 0xffffffff81938dcf
r15 0xffffffff81938dcf
rip 0xffffffff810af647 kdb_enter+0x67
rflags 0x86 ll+0x65
r13 0
r14 0xffffffff81938dcf
r15 0xffffffff81938dcf
rip 0xffffffff810af647 kdb_enter+0x67
kdb_enter+0x67: movq $0,0x1466a56(%rip)
db> show proc
Process 771 (syz-executor8315765) at 0xfffff8003a51d530:
db> show proc
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 769 at 0xfffff80003a4a530
uid: 0 gids: 0, 0, 5
ABI: FreeBSD ELF64
arguments: ./syz-executor831576519
reaper: 0xfffff80003300a60 reapsubtree: 1
sigparent: 20
vmspace: 0xfffff8003a667000
sigparent: 20
(map 0xfffff8003a667000)
(map.pmap 0xfffff8003a6670c0)
(pmap 0xfffff8003a667120)
threads: 1
100093 Run CPU 1 syz-executor8315765
db> ps
pid ppid pgrp uid state wmesg wchan cmd
771 769 769 0 RE CPU 1 syz-executor8315765
pid ppid pgrp uid state wmesg wchan cmd
769 767 769 0 Ss pause 0xfffff80003a4a5d8 csh
767 680 767 0 Ss select 0xfffff80003d3f9c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff800034060b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003acc4b0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003acc8b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003acccb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003acb0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003acb4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003acb8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003acbcb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003ace0b0 getty
738 1 22 0 S+ piperd 0xfffff80003da75f0 logger
737 736 22 0 S+ nanslp 0xffffffff824feca0 sleep
736 1 22 0 S+ wait 0xfffff8003a516000 sh
684 1 684 0 Ss nanslp 0xffffffff824feca0 cron
680 1 680 0 Ss select 0xfffff80003d11040 sshd
493 1 493 0 Ss select 0xfffff80003d110c0 syslogd
422 1 422 0 Ss select 0xfffff80003d11240 devd
421 1 421 65 Ss select 0xfffff80003d3f740 dhclient
336 1 336 0 Ss select 0xfffff80003d3f840 dhclient
333 1 333 0 Ss select 0xfffff80003d111c0 dhclient
21 0 0 0 DL vlruwt 0xfffff80003b10a60 [vnlru]
20 0 0 0 DL syncer 0xffffffff825d5158 [syncer]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d4658 [bufdaemon]
100066 D - 0xffffffff8200a980 [bufspacedaemon-0]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d4658 [bufdaemon]
100080 D sdflush 0xfffff80003e52ce8 [/ worker]
18 0 0 0 DL psleep 0xffffffff825f00c8 [vmdaemon]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261cfd8 [dom0]
100069 D launds 0xffffffff8261cfe4 [laundry: dom0]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261cfd8 [dom0]
100070 D umarcl 0xffffffff8153f840 [uma]
16 0 0 0 RL CPU 0 [rand_harvestq]
100050 D - 0xfffff8000334cc00 [mca taskq]
100055 D - 0xffffffff81cdce20 [deadlkres]
100057 D - 0xfffff80003b48300 [acpi_task_0]
100058 D - 0xfffff80003b48300 [acpi_task_1]
100059 D - 0xfffff80003b48300 [acpi_task_2]
100061 D - 0xfffff8000334b200 [CAM taskq]
db> show all locks
db> show all locks
db> show malloc
Type InUse MemUse Requests
devbuf 4213 4851K 4238
Type InUse MemUse Requests
vtbuf 24 1968K 46
sysctloid 26737 1565K 26801
kobj 332 1328K 488
newblk 525 1155K 543
sysctloid 26737 1565K 26801
kobj 332 1328K 488
vfscache 4 1025K 4
pcb 22 537K 76
inodedep 49 536K 72
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 96 202K 824
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
acpica 1674 185K 49750
vnet_data 1 168K 1
pagedep 14 132K 18
vnet_data 1 168K 1
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 101 101K 110
sem 4 106K 4
linker 222 89K 241
bus 964 78K 3300
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 494 62K 494
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 494 62K 494
gtaskqueue 22 34K 22
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
hostcache 1 32K 1
shm 1 32K 1
DEVFS3 120 30K 130
kdtrace 140 27K 1596
DEVFS_RULE 56 27K 56
umtx 204 26K 204
kbdmux 6 22K 6
vmem 3 19K 4
BPF 10 18K 10
temp 17 17K 1533
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
bus-sc 30 14K 1394
KTRACE 100 13K 100
ifaddr 30 12K 32
KTRACE 100 13K 100
kenv 95 12K 99
eventhandler 122 11K 122
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 2 9K 40
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
devstat 4 9K 4
UART 12 9K 12
rpc 2 8K 2
UART 12 9K 12
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 231 8K 289
pfs_vncache 1 8K 1
cred 27 7K 234
CAM DEV 3 6K 510
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
routetbl 28 5K 32
ufs_dirhash 24 5K 24
taskqueue 42 5K 42
dirrem 17 5K 28
taskqueue 42 5K 42
plimit 17 5K 322
ifnet 3 5K 3
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
filedesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
UMA 236 4K 236
lltable 11 4K 11
diradd 26 4K 37
hhook 13 4K 13
ether_multi 40 4K 45
in6_multi 25 3K 25
acpisem 22 3K 22
terminal 11 3K 11
kqueue 44 3K 774
terminal 11 3K 11
session 20 3K 31
pgrp 20 3K 31
uidinfo 4 3K 4
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
io_apic 1 2K 1
select 15 2K 15
proc-args 39 2K 472
CAM XPT 22 2K 543
lockf 15 2K 22
Unitno 25 2K 37
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
softdep 1 1K 1
crypto 2 2K 2
msi 9 2K 9
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 6
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
NFSD session 1 1K 1
CAM periph 4 1K 271
indirdep 3 1K 3
CAM periph 4 1K 271
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
ip6ndp 4 1K 5
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
sctp_ifa 5 1K 5
CAM SIM 2 1K 2
newdirblk 4 1K 8
mkdir 4 1K 16
in_multi 2 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
osd 3 1K 9
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
mld 2 1K 2
sctp_ifn 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
inpcbpolicy 7 1K 132
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 3
loginclass 3 1K 3
CAM path 4 1K 1034
apmdev 1 1K 1
atkbddev 2 1K 2
apmdev 1 1K 1
atkbddev 2 1K 2
pmchooks 1 1K 1
prison 4 1K 4
DEVFSP 2 1K 2
prison 4 1K 4
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
soname 4 1K 5740
CAM I/O Scheduler 1 1K 1
filecaps 4 1K 66
tun 3 1K 3
nexusdev 5 1K 5
entropy 2 1K 35
tcpfunc 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
freework 1 1K 26
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
CAM CCB 0 0K 1790
Per-cpu 1 1K 1
p1003.1b 1 1K 1
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 2
jfsync 0 0K 0
jtrunc 0 0K 0
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefile 0 0K 9
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freeblks 0 0K 25
freefrag 0 0K 7
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 3
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
statfs 0 0K 195
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 3
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
mbuf_tag 0 0K 25
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
accf 0 0K 0
pts 0 0K 0
iov 0 0K 12989
pts 0 0K 0
ioctlops 0 0K 86
Witness 0 0K 0
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 567
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
kcovinfo 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
Mark Johnston
Mar 19, 2020, 11:54:40 AM3/19/20
to syzbot, syzkaller-f...@googlegroups.com
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzk...@googlegroups.com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> You received this message because you are subscribed to the Google Groups "syzkaller-freebsd-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-freebsd...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-freebsd-bugs/0000000000005e3b8a059db869b4%40google.com.
Reply all
Reply to author
Forward
0 new messages