panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (2)
10 views
Skip to first unread message
syzbot
Apr 15, 2020, 6:01:15 PM4/15/20
to syzkaller-f...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 20768ae4 Do not attempt to remove backward compatibility t..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=134c7820100000
dashboard link: https://syzkaller.appspot.com/bug?extid=13f87ee993fc05259035
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+13f87e...@syzkaller.appspotmail.com
panic: Bad tailq NEXT(0xfffff80003b20b80->tqh_last) != NULL
cpuid = 1
time = 213
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025958140
vpanic() at vpanic+0x1c7/frame 0xfffffe00259581a0
panic() at panic+0x43/frame 0xfffffe0025958200
pf_tagname2tag() at pf_tagname2tag+0x2c5/frame 0xfffffe0025958260
pfioctl() at pfioctl+0x6ae3/frame 0xfffffe0025958790
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe00259587f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe0025958820
vn_ioctl() at vn_ioctl+0x27c/frame 0xfffffe0025958940
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe0025958980
kern_ioctl() at kern_ioctl+0x3d4/frame 0xfffffe00259589f0
sys_ioctl() at sys_ioctl+0x266/frame 0xfffffe0025958ac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe0025958bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0025958bf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x41332a, rsp = 0x7fffdfffdf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 4054 tid 101073 ]
Stopped at kdb_enter+0x67: movq $0,0x14aa046(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe0029e00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe0025958120
rbp 0xfffffe0025958140
rsi 0x40001
rdi 0xffffffff810b85a6 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe0025bd9810
r12 0xffffffff82068e80 ddb_dbbe
r13 0
r14 0xffffffff8194913d
r15 0xffffffff8194913d
rip 0xffffffff810ad827 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x14aa046(%rip)
db> show proc
Process 4054 (syz-executor.1) at 0xfffff8003bd54520:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 1100 at 0xfffff8003b56ba40
ABI: FreeBSD ELF64
arguments: /root/syz-executor.1
reaper: 0xfffff8000331a000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe0025bfb000
(map 0xfffffe0025bfb000)
(map.pmap 0xfffffe0025bfb0c0)
(pmap 0xfffffe0025bfb120)
threads: 3
100399 RunQ syz-executor.1
101073 Run CPU 1 syz-executor.1
101056 Run CPU 0 syz-executor.1
db> ps
pid ppid pgrp uid state wmesg wchan cmd
4054 1100 1100 0 R (threaded) syz-executor.1
100399 RunQ syz-executor.1
101073 Run CPU 1 syz-executor.1
101056 Run CPU 0 syz-executor.1
4048 794 794 0 S (threaded) syz-executor.3
100314 S nanslp 0xffffffff8252c1f0 syz-executor.3
101065 S sbwait 0xfffffe00239c7704 syz-executor.3
101067 S uwait 0xfffff8003b4f4c80 syz-executor.3
101044 S uwait 0xfffff8003b4f4a80 syz-executor.3
1736 1729 1736 0 Ss select 0xfffff80003c047c0 dhclient
1732 1 1732 0 Ss select 0xfffff80003084140 dhclient
1729 1722 424 65 S select 0xfffff80003084040 dhclient
1722 424 424 0 S wait 0xfffff8003b587a40 sh
1713 1 1713 65 Ss select 0xfffff8003b6a92c0 dhclient
1268 1 1268 0 Ss select 0xfffff80003c04a40 dhclient
1265 1 1265 0 Ss select 0xfffff8003b6a9dc0 dhclient
1244 1 1244 65 Ss select 0xfffff8003b6a96c0 dhclient
1100 768 1100 0 Ss nanslp 0xffffffff8252c1f1 syz-executor.1
815 1 815 0 Ss select 0xfffff80003c07040 dhclient
806 1 806 0 Ss select 0xfffff80003c073c0 dhclient
794 768 794 0 Ss nanslp 0xffffffff8252c1f0 syz-executor.3
778 768 778 0 Ss piperd 0xfffff80003ca8be0 syz-executor.2
770 768 770 0 Ss piperd 0xfffff8003ba415f0 syz-executor.0
768 766 766 0 S (threaded) syz-fuzzer
100106 S uwait 0xfffff80003539200 syz-fuzzer
100107 S uwait 0xfffff80003a38300 syz-fuzzer
100108 S uwait 0xfffff80003a38400 syz-fuzzer
100109 S uwait 0xfffff80003a38500 syz-fuzzer
100110 S uwait 0xfffff80003a38600 syz-fuzzer
100111 S uwait 0xfffff80003539300 syz-fuzzer
100112 S uwait 0xfffff8003b4f2300 syz-fuzzer
100113 S uwait 0xfffff80003539400 syz-fuzzer
100114 S uwait 0xfffff80003a38000 syz-fuzzer
100115 S kqread 0xfffff8000320b300 syz-fuzzer
766 764 766 0 Ss pause 0xfffff8003b5710a8 csh
764 682 764 0 Ss select 0xfffff800030840c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000356f8b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b6fcb0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b6e4b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b6ecb0 getty
744 1 744 0 Ss+ ttyin 0xfffff800033b74b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800033b7cb0 getty
742 1 742 0 Ss+ ttyin 0xfffff800033b64b0 getty
741 1 741 0 Ss+ ttyin 0xfffff800033b6cb0 getty
740 1 740 0 Ss+ ttyin 0xfffff800033b94b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252c1f1 cron
682 1 682 0 Ss select 0xfffff80003084440 sshd
495 1 495 0 Ss select 0xfffff80003c07dc0 syslogd
424 1 424 0 Ss wait 0xfffff80003cc8000 devd
423 1 423 65 Ss select 0xfffff80003c07c40 dhclient
338 1 338 0 Ss select 0xfffff80003c07e40 dhclient
335 1 335 0 Ss select 0xfffff80003c07d40 dhclient
23 0 0 0 DL syncer 0xffffffff82618118 [syncer]
22 0 0 0 DL vlruwt 0xfffff80003b7da40 [vnlru]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff82617438 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100088 D sdflush 0xfffff80003c2ace8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263e3c8 [vmdaemon]
19 0 0 0 DL (threaded) [pagedaemon]
100067 D psleep 0xffffffff82632998 [dom0]
100074 D launds 0xffffffff826329a4 [laundry: dom0]
100075 D umarcl 0xffffffff8154ae00 [uma]
18 0 0 0 DL - 0xffffffff8235fe20 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82b533a0 [pf purge]
16 0 0 0 DL waiting 0xffffffff8261a890 [sctp_iterator]
15 0 0 0 DL - 0xffffffff82616a2c [soaiod4]
9 0 0 0 DL - 0xffffffff82616a2c [soaiod3]
8 0 0 0 DL - 0xffffffff82616a2c [soaiod2]
7 0 0 0 DL - 0xffffffff82616a2c [soaiod1]
6 0 0 0 DL (threaded) [cam]
100033 D - 0xffffffff82237b40 [doneq0]
100066 D - 0xffffffff82237a10 [scanner]
5 0 0 0 DL crypto_ 0xfffff8000320cd90 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff8000320cd30 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff826300c0 [crypto]
14 0 0 0 DL seqstat 0xfffff80003363488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100024 D - 0xffffffff8250b180 [g_event]
100025 D - 0xffffffff8250b188 [g_up]
100026 D - 0xffffffff8250b190 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100017 D - 0xfffff80003084a00 [thr_0]
100018 D - 0xfffff80003084a40 [thr_1]
12 0 0 0 WL (threaded) [intr]
100010 I [swi6: Giant taskq]
100013 I [swi5: fast taskq]
100016 I [swi6: task queue]
100019 I [swi3: vm]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 I [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff8000331a000 [init]
10 0 0 0 DL audit_w 0xffffffff82630598 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8250b710 [swapper]
100005 D - 0xfffff80003338000 [if_config_tqg_0]
100006 D - 0xfffff80003339e00 [softirq_0]
100007 D - 0xfffff80003339d00 [softirq_1]
100008 D - 0xfffff80003339c00 [if_io_tqg_0]
100009 D - 0xfffff80003339b00 [if_io_tqg_1]
100011 D - 0xfffff8000333e000 [in6m_free taskq]
100012 D - 0xfffff8000333fe00 [thread taskq]
100014 D - 0xfffff8000333fc00 [kqueue_ctx taskq]
100015 D - 0xfffff8000333fb00 [aiod_kick taskq]
100023 D - 0xfffff8000333f900 [firmware taskq]
100028 D - 0xfffff8000333f800 [crypto_0]
100029 D - 0xfffff8000333f800 [crypto_1]
100043 D - 0xfffff8000333f500 [vtnet0 rxq 0]
100044 D - 0xfffff8000333f400 [vtnet0 txq 0]
100045 D - 0xfffff8000333f300 [vtnet0 rxq 1]
100046 D - 0xfffff8000333f200 [vtnet0 txq 1]
100048 D vtbslp 0xfffff800034fc580 [virtio_balloon]
100052 D - 0xfffff8000333f100 [mca taskq]
100057 D - 0xffffffff81cec741 [deadlkres]
100061 D - 0xfffff80003b5c300 [acpi_task_0]
100062 D - 0xfffff80003b5c300 [acpi_task_1]
100063 D - 0xfffff80003b5c300 [acpi_task_2]
100065 D - 0xfffff8000333f700 [CAM taskq]
db> show all locks
Process 4054 (syz-executor.1) thread 0xfffffe0025bd9300 (101073)
exclusive rm pf rulesets (pf rulesets) r = 0 (0xffffffff82ba4110) locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:1585
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 28335 1653K 28399
kobj 332 1328K 488
newblk 5 1025K 23776
vfscache 4 1025K 4
pcb 51 566K 5022
inodedep 9 516K 5326
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 141 277K 4137
acpica 1674 185K 52709
vnet_data 1 168K 1
pagedep 9 130K 3970
tfo_ccache 1 128K 1
filedesc 17 117K 6410
sem 4 106K 4
DEVFS1 105 105K 122
linker 243 92K 279
bus 976 79K 3380
mtx_pool 2 72K 2
BPF 38 71K 38
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 496 62K 496
umtx 360 45K 360
kdtrace 186 36K 17424
temp 35 33K 3401
hostcache 1 32K 1
shm 1 32K 4
DEVFS3 124 31K 134
msg 4 30K 4
DEVFS_RULE 56 27K 56
vmem 3 26K 5
gtaskqueue 18 26K 18
ifaddr 73 25K 78
kbdmux 6 22K 6
pf_rule 18 18K 111
ufs_mount 3 17K 4
proc 3 17K 3
lltable 44 16K 76
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
ether_multi 172 14K 215
bus-sc 30 14K 1431
sctp_atcl 25 13K 3198
KTRACE 100 13K 100
ifnet 7 13K 7
sctp_stro 12 12K 815
kenv 95 12K 99
eventhandler 132 12K 132
in6_multi 89 11K 102
pfs_nodes 20 10K 20
GEOM 60 10K 486
rman 82 10K 423
bmsafemap 3 9K 5407
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
sctp_timw 32 8K 32
shmfd 1 8K 32
pfs_vncache 1 8K 1
select 62 8K 62
routetbl 56 8K 71
audit_evclass 232 8K 290
cred 27 7K 340
CAM DEV 3 6K 510
kqueue 61 6K 4059
plimit 23 6K 493
vt 11 6K 11
pf_ifnet 14 6K 35
sglist 5 6K 5
CAM queue 5 6K 1528
DEVFSP 76 5K 98
taskqueue 45 5K 45
ufs_dirhash 24 5K 24
memdesc 1 4K 1
MCA 32 4K 32
UMA 249 4K 249
ioctlops 1 4K 837
evdev 4 4K 4
kcovinfo 64 4K 85
session 31 4K 45
pgrp 31 4K 45
lockf 34 4K 382
hhook 13 4K 13
acpisem 22 3K 22
terminal 11 3K 11
proc-args 50 3K 617
uidinfo 4 3K 11
sctp_ifa 17 3K 20
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 23
CAM XPT 22 2K 543
Unitno 27 2K 16491
sctp_atky 37 2K 4021
in_multi 6 2K 12
acpidev 20 2K 20
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 266
NFSD session 1 1K 1
CAM periph 4 1K 271
mld 6 1K 6
sctp_ifn 6 1K 7
igmp 6 1K 6
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
crypto 3 1K 3
newdirblk 4 1K 3849
mkdir 4 1K 7698
diradd 4 1K 4913
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
inpcbpolicy 14 1K 12482
encap_export_host 8 1K 8
sctp_athm 25 1K 3198
sctp_map 24 1K 1630
osd 3 1K 9
vnodes 1 1K 10
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 6
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
soname 4 1K 7761
nexusdev 5 1K 5
entropy 2 1K 41
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
filecaps 4 1K 103
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
freework 1 1K 11036
p1003.1b 1 1K 1
pf_table 0 0K 1
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 50159
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 4569
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 134
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
dirrem 0 0K 4871
freefile 0 0K 4538
freeblks 0 0K 4860
freefrag 0 0K 508
allocindir 0 0K 0
indirdep 0 0K 9785
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 84
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 3
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 2042
sctp_iter 0 0K 14
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 14
sctp_aadr 0 0K 0
sctp_stri 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 1
ip_moptions 0 0K 62
in_mfilter 0 0K 9
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 225
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 3710
export_host 0 0K 0
cl_savebuf 0 0K 12
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 186
accf 0 0K 0
pts 0 0K 0
iov 0 0K 19963
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 655
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 5
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
db> show ktr
No such command; use "help" to list available commands
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 20768ae4 Do not attempt to remove backward compatibility t..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=134c7820100000
dashboard link: https://syzkaller.appspot.com/bug?extid=13f87ee993fc05259035
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+13f87e...@syzkaller.appspotmail.com
panic: Bad tailq NEXT(0xfffff80003b20b80->tqh_last) != NULL
cpuid = 1
time = 213
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025958140
vpanic() at vpanic+0x1c7/frame 0xfffffe00259581a0
panic() at panic+0x43/frame 0xfffffe0025958200
pf_tagname2tag() at pf_tagname2tag+0x2c5/frame 0xfffffe0025958260
pfioctl() at pfioctl+0x6ae3/frame 0xfffffe0025958790
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe00259587f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe0025958820
vn_ioctl() at vn_ioctl+0x27c/frame 0xfffffe0025958940
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe0025958980
kern_ioctl() at kern_ioctl+0x3d4/frame 0xfffffe00259589f0
sys_ioctl() at sys_ioctl+0x266/frame 0xfffffe0025958ac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe0025958bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0025958bf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x41332a, rsp = 0x7fffdfffdf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 4054 tid 101073 ]
Stopped at kdb_enter+0x67: movq $0,0x14aa046(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe0029e00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe0025958120
rbp 0xfffffe0025958140
rsi 0x40001
rdi 0xffffffff810b85a6 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe0025bd9810
r12 0xffffffff82068e80 ddb_dbbe
r13 0
r14 0xffffffff8194913d
r15 0xffffffff8194913d
rip 0xffffffff810ad827 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x14aa046(%rip)
db> show proc
Process 4054 (syz-executor.1) at 0xfffff8003bd54520:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 1100 at 0xfffff8003b56ba40
ABI: FreeBSD ELF64
arguments: /root/syz-executor.1
reaper: 0xfffff8000331a000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe0025bfb000
(map 0xfffffe0025bfb000)
(map.pmap 0xfffffe0025bfb0c0)
(pmap 0xfffffe0025bfb120)
threads: 3
100399 RunQ syz-executor.1
101073 Run CPU 1 syz-executor.1
101056 Run CPU 0 syz-executor.1
db> ps
pid ppid pgrp uid state wmesg wchan cmd
4054 1100 1100 0 R (threaded) syz-executor.1
100399 RunQ syz-executor.1
101073 Run CPU 1 syz-executor.1
101056 Run CPU 0 syz-executor.1
4048 794 794 0 S (threaded) syz-executor.3
100314 S nanslp 0xffffffff8252c1f0 syz-executor.3
101065 S sbwait 0xfffffe00239c7704 syz-executor.3
101067 S uwait 0xfffff8003b4f4c80 syz-executor.3
101044 S uwait 0xfffff8003b4f4a80 syz-executor.3
1736 1729 1736 0 Ss select 0xfffff80003c047c0 dhclient
1732 1 1732 0 Ss select 0xfffff80003084140 dhclient
1729 1722 424 65 S select 0xfffff80003084040 dhclient
1722 424 424 0 S wait 0xfffff8003b587a40 sh
1713 1 1713 65 Ss select 0xfffff8003b6a92c0 dhclient
1268 1 1268 0 Ss select 0xfffff80003c04a40 dhclient
1265 1 1265 0 Ss select 0xfffff8003b6a9dc0 dhclient
1244 1 1244 65 Ss select 0xfffff8003b6a96c0 dhclient
1100 768 1100 0 Ss nanslp 0xffffffff8252c1f1 syz-executor.1
815 1 815 0 Ss select 0xfffff80003c07040 dhclient
806 1 806 0 Ss select 0xfffff80003c073c0 dhclient
794 768 794 0 Ss nanslp 0xffffffff8252c1f0 syz-executor.3
778 768 778 0 Ss piperd 0xfffff80003ca8be0 syz-executor.2
770 768 770 0 Ss piperd 0xfffff8003ba415f0 syz-executor.0
768 766 766 0 S (threaded) syz-fuzzer
100106 S uwait 0xfffff80003539200 syz-fuzzer
100107 S uwait 0xfffff80003a38300 syz-fuzzer
100108 S uwait 0xfffff80003a38400 syz-fuzzer
100109 S uwait 0xfffff80003a38500 syz-fuzzer
100110 S uwait 0xfffff80003a38600 syz-fuzzer
100111 S uwait 0xfffff80003539300 syz-fuzzer
100112 S uwait 0xfffff8003b4f2300 syz-fuzzer
100113 S uwait 0xfffff80003539400 syz-fuzzer
100114 S uwait 0xfffff80003a38000 syz-fuzzer
100115 S kqread 0xfffff8000320b300 syz-fuzzer
766 764 766 0 Ss pause 0xfffff8003b5710a8 csh
764 682 764 0 Ss select 0xfffff800030840c0 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000356f8b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b6fcb0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b6e4b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b6ecb0 getty
744 1 744 0 Ss+ ttyin 0xfffff800033b74b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800033b7cb0 getty
742 1 742 0 Ss+ ttyin 0xfffff800033b64b0 getty
741 1 741 0 Ss+ ttyin 0xfffff800033b6cb0 getty
740 1 740 0 Ss+ ttyin 0xfffff800033b94b0 getty
686 1 686 0 Ss nanslp 0xffffffff8252c1f1 cron
682 1 682 0 Ss select 0xfffff80003084440 sshd
495 1 495 0 Ss select 0xfffff80003c07dc0 syslogd
424 1 424 0 Ss wait 0xfffff80003cc8000 devd
423 1 423 65 Ss select 0xfffff80003c07c40 dhclient
338 1 338 0 Ss select 0xfffff80003c07e40 dhclient
335 1 335 0 Ss select 0xfffff80003c07d40 dhclient
23 0 0 0 DL syncer 0xffffffff82618118 [syncer]
22 0 0 0 DL vlruwt 0xfffff80003b7da40 [vnlru]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff82617438 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100088 D sdflush 0xfffff80003c2ace8 [/ worker]
20 0 0 0 DL psleep 0xffffffff8263e3c8 [vmdaemon]
19 0 0 0 DL (threaded) [pagedaemon]
100067 D psleep 0xffffffff82632998 [dom0]
100074 D launds 0xffffffff826329a4 [laundry: dom0]
100075 D umarcl 0xffffffff8154ae00 [uma]
18 0 0 0 DL - 0xffffffff8235fe20 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82b533a0 [pf purge]
16 0 0 0 DL waiting 0xffffffff8261a890 [sctp_iterator]
15 0 0 0 DL - 0xffffffff82616a2c [soaiod4]
9 0 0 0 DL - 0xffffffff82616a2c [soaiod3]
8 0 0 0 DL - 0xffffffff82616a2c [soaiod2]
7 0 0 0 DL - 0xffffffff82616a2c [soaiod1]
6 0 0 0 DL (threaded) [cam]
100033 D - 0xffffffff82237b40 [doneq0]
100066 D - 0xffffffff82237a10 [scanner]
5 0 0 0 DL crypto_ 0xfffff8000320cd90 [crypto returns 1]
4 0 0 0 DL crypto_ 0xfffff8000320cd30 [crypto returns 0]
3 0 0 0 DL crypto_ 0xffffffff826300c0 [crypto]
14 0 0 0 DL seqstat 0xfffff80003363488 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100024 D - 0xffffffff8250b180 [g_event]
100025 D - 0xffffffff8250b188 [g_up]
100026 D - 0xffffffff8250b190 [g_down]
2 0 0 0 DL (threaded) [KTLS]
100017 D - 0xfffff80003084a00 [thr_0]
100018 D - 0xfffff80003084a40 [thr_1]
12 0 0 0 WL (threaded) [intr]
100010 I [swi6: Giant taskq]
100013 I [swi5: fast taskq]
100016 I [swi6: task queue]
100019 I [swi3: vm]
100020 I [swi4: clock (0)]
100021 I [swi4: clock (1)]
100022 I [swi1: netisr 0]
100034 I [irq24: virtio_pci0]
100035 I [irq25: virtio_pci0]
100036 I [irq26: virtio_pci0]
100037 I [irq27: virtio_pci0]
100038 I [irq28: virtio_pci1]
100039 I [irq29: virtio_pci1]
100040 I [irq30: virtio_pci1]
100041 I [irq31: virtio_pci1]
100042 I [irq32: virtio_pci1]
100047 I [irq10: virtio_pci2]
100049 I [irq1: atkbd0]
100050 I [irq12: psm0]
100051 I [swi0: uart uart++]
100060 I [swi1: pf send]
100072 I [swi1: hpts]
100073 I [swi1: hpts]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff8000331a000 [init]
10 0 0 0 DL audit_w 0xffffffff82630598 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8250b710 [swapper]
100005 D - 0xfffff80003338000 [if_config_tqg_0]
100006 D - 0xfffff80003339e00 [softirq_0]
100007 D - 0xfffff80003339d00 [softirq_1]
100008 D - 0xfffff80003339c00 [if_io_tqg_0]
100009 D - 0xfffff80003339b00 [if_io_tqg_1]
100011 D - 0xfffff8000333e000 [in6m_free taskq]
100012 D - 0xfffff8000333fe00 [thread taskq]
100014 D - 0xfffff8000333fc00 [kqueue_ctx taskq]
100015 D - 0xfffff8000333fb00 [aiod_kick taskq]
100023 D - 0xfffff8000333f900 [firmware taskq]
100028 D - 0xfffff8000333f800 [crypto_0]
100029 D - 0xfffff8000333f800 [crypto_1]
100043 D - 0xfffff8000333f500 [vtnet0 rxq 0]
100044 D - 0xfffff8000333f400 [vtnet0 txq 0]
100045 D - 0xfffff8000333f300 [vtnet0 rxq 1]
100046 D - 0xfffff8000333f200 [vtnet0 txq 1]
100048 D vtbslp 0xfffff800034fc580 [virtio_balloon]
100052 D - 0xfffff8000333f100 [mca taskq]
100057 D - 0xffffffff81cec741 [deadlkres]
100061 D - 0xfffff80003b5c300 [acpi_task_0]
100062 D - 0xfffff80003b5c300 [acpi_task_1]
100063 D - 0xfffff80003b5c300 [acpi_task_2]
100065 D - 0xfffff8000333f700 [CAM taskq]
db> show all locks
Process 4054 (syz-executor.1) thread 0xfffffe0025bd9300 (101073)
exclusive rm pf rulesets (pf rulesets) r = 0 (0xffffffff82ba4110) locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:1585
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4241
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 28335 1653K 28399
kobj 332 1328K 488
newblk 5 1025K 23776
vfscache 4 1025K 4
pcb 51 566K 5022
inodedep 9 516K 5326
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 141 277K 4137
acpica 1674 185K 52709
vnet_data 1 168K 1
pagedep 9 130K 3970
tfo_ccache 1 128K 1
filedesc 17 117K 6410
sem 4 106K 4
DEVFS1 105 105K 122
linker 243 92K 279
bus 976 79K 3380
mtx_pool 2 72K 2
BPF 38 71K 38
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 496 62K 496
umtx 360 45K 360
kdtrace 186 36K 17424
temp 35 33K 3401
hostcache 1 32K 1
shm 1 32K 4
DEVFS3 124 31K 134
msg 4 30K 4
DEVFS_RULE 56 27K 56
vmem 3 26K 5
gtaskqueue 18 26K 18
ifaddr 73 25K 78
kbdmux 6 22K 6
pf_rule 18 18K 111
ufs_mount 3 17K 4
proc 3 17K 3
lltable 44 16K 76
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
ether_multi 172 14K 215
bus-sc 30 14K 1431
sctp_atcl 25 13K 3198
KTRACE 100 13K 100
ifnet 7 13K 7
sctp_stro 12 12K 815
kenv 95 12K 99
eventhandler 132 12K 132
in6_multi 89 11K 102
pfs_nodes 20 10K 20
GEOM 60 10K 486
rman 82 10K 423
bmsafemap 3 9K 5407
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
sctp_timw 32 8K 32
shmfd 1 8K 32
pfs_vncache 1 8K 1
select 62 8K 62
routetbl 56 8K 71
audit_evclass 232 8K 290
cred 27 7K 340
CAM DEV 3 6K 510
kqueue 61 6K 4059
plimit 23 6K 493
vt 11 6K 11
pf_ifnet 14 6K 35
sglist 5 6K 5
CAM queue 5 6K 1528
DEVFSP 76 5K 98
taskqueue 45 5K 45
ufs_dirhash 24 5K 24
memdesc 1 4K 1
MCA 32 4K 32
UMA 249 4K 249
ioctlops 1 4K 837
evdev 4 4K 4
kcovinfo 64 4K 85
session 31 4K 45
pgrp 31 4K 45
lockf 34 4K 382
hhook 13 4K 13
acpisem 22 3K 22
terminal 11 3K 11
proc-args 50 3K 617
uidinfo 4 3K 11
sctp_ifa 17 3K 20
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 23
CAM XPT 22 2K 543
Unitno 27 2K 16491
sctp_atky 37 2K 4021
in_multi 6 2K 12
acpidev 20 2K 20
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 266
NFSD session 1 1K 1
CAM periph 4 1K 271
mld 6 1K 6
sctp_ifn 6 1K 7
igmp 6 1K 6
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
crypto 3 1K 3
newdirblk 4 1K 3849
mkdir 4 1K 7698
diradd 4 1K 4913
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
inpcbpolicy 14 1K 12482
encap_export_host 8 1K 8
sctp_athm 25 1K 3198
sctp_map 24 1K 1630
osd 3 1K 9
vnodes 1 1K 10
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 6
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
soname 4 1K 7761
nexusdev 5 1K 5
entropy 2 1K 41
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
filecaps 4 1K 103
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
freework 1 1K 11036
p1003.1b 1 1K 1
pf_table 0 0K 1
pf_altq 0 0K 0
pf_osfp 0 0K 0
pf_temp 0 0K 0
ath_hal 0 0K 0
madt_table 0 0K 2
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
fpukern_ctx 0 0K 0
mixer 0 0K 0
xen_intr 0 0K 0
ac97 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
SIIS driver 0 0K 0
vm_fictitious 0 0K 0
CAM CCB 0 0K 50159
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 4569
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 134
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
dirrem 0 0K 4871
freefile 0 0K 4538
freeblks 0 0K 4860
freefrag 0 0K 508
allocindir 0 0K 0
indirdep 0 0K 9785
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 84
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 3
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 2042
sctp_iter 0 0K 14
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 14
sctp_aadr 0 0K 0
sctp_stri 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 1
ip_moptions 0 0K 62
in_mfilter 0 0K 9
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 225
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 3710
export_host 0 0K 0
cl_savebuf 0 0K 12
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 186
accf 0 0K 0
pts 0 0K 0
iov 0 0K 19963
Witness 0 0K 0
stack 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
mpr 0 0K 0
mfibuf 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 655
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
sendfile 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 5
filedesc_to_leader 0 0K 0
pwd 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
NFS FHA 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
db> show ktr
No such command; use "help" to list available commands
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Apr 15, 2020, 6:33:15 PM4/15/20
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 20768ae4 Do not attempt to remove backward compatibility t..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1606f2abe00000
dashboard link: https://syzkaller.appspot.com/bug?extid=13f87ee993fc05259035
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=120dae20100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=110e933be00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+13f87e...@syzkaller.appspotmail.com
panic: Bad tailq NEXT(0xfffff80003b20cc0->tqh_last) != NULL
cpuid = 0
time = 1586989449
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025a5e140
vpanic() at vpanic+0x1c7/frame 0xfffffe0025a5e1a0
panic() at panic+0x43/frame 0xfffffe0025a5e200
pf_tagname2tag() at pf_tagname2tag+0x2c5/frame 0xfffffe0025a5e260
pfioctl() at pfioctl+0x6ae3/frame 0xfffffe0025a5e790
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe0025a5e7f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe0025a5e820
vn_ioctl() at vn_ioctl+0x27c/frame 0xfffffe0025a5e940
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe0025a5e980
kern_ioctl() at kern_ioctl+0x3d4/frame 0xfffffe0025a5e9f0
sys_ioctl() at sys_ioctl+0x266/frame 0xfffffe0025a5eac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe0025a5ebf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0025a5ebf0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x41c5ba, rsp = 0x7fffffffeab8, rbp = 0xffffffff ---
KDB: enter: panic
[ thread pid 775 tid 100111 ]
rdx 0xffffffff818a9109
rbx 0
rsp 0xfffffe0025a5e120
rbp 0xfffffe0025a5e140
rsi 0x1
rdi 0
ABI: FreeBSD ELF64
arguments: ./syz-executor064263897
(map 0xfffffe0023bea3d0)
(map.pmap 0xfffffe0023bea490)
(pmap 0xfffffe0023bea4f0)
threads: 1
100111 Run CPU 0 syz-executor0642638
773 771 771 0 S nanslp 0xffffffff8252c1f1 syz-executor0642638
771 769 771 0 Ss pause 0xfffff8003b57aae8 csh
769 682 769 0 Rs CPU 1 sshd
737 736 24 0 S+ nanslp 0xffffffff8252c1f0 sleep
736 1 24 0 S+ wait 0xfffff80003cb8520 sh
686 1 686 0 Ss nanslp 0xffffffff8252c1f0 cron
682 1 682 0 Ss select 0xfffff80003c04ac0 sshd
495 1 495 0 Ss select 0xfffff80003c030c0 syslogd
424 1 424 0 Ss select 0xfffff80003c03040 devd
423 1 423 65 Ss select 0xfffff80003c04d40 dhclient
338 1 338 0 Ss select 0xfffff800030845c0 dhclient
335 1 335 0 Ss select 0xfffff80003084540 dhclient
Process 775 (syz-executor0642638) thread 0xfffffe0025791a00 (100111)
exclusive rm pf rulesets (pf rulesets) r = 0 (0xffffffff82c86110) locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:1585
Process 769 (sshd) thread 0xfffffe00257b0500 (100105)
exclusive sleep mutex so_snd (so_snd) r = 0 (0xfffffe001cfce5e0) locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_sockbuf.c:893
exclusive rw tcpinp (tcpinp) r = 0 (0xfffff8003b4fe3f0) locked @ /syzkaller/managers/main/kernel/sys/netinet/tcp_usrreq.c:965
exclusive sx so_snd_sx (so_snd_sx) r = 0 (0xfffffe001cfce600) locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_sockbuf.c:419
vfscache 4 1025K 4
pcb 21 537K 75
inodedep 48 536K 71
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 101 101K 110
linker 243 92K 264
bus 964 78K 3344
mtx_pool 2 72K 2
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
DEVFS3 120 30K 130
umtx 234 30K 234
kdtrace 148 29K 1606
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18
vmem 3 22K 4
kbdmux 6 22K 6
BPF 10 18K 10
KTRACE 100 13K 100
ifaddr 30 12K 32
pfs_vncache 1 8K 1
audit_evclass 232 8K 290
cred 21 6K 234
plimit 17 5K 322
ifnet 3 5K 3
evdev 4 4K 4
filedesc 1 4K 1
pf_ifnet 7 4K 8
lltable 11 4K 11
hhook 13 4K 13
ether_multi 40 4K 45
diradd 25 4K 36
in6_multi 25 3K 25
kqueue 47 3K 778
session 20 3K 31
pgrp 20 3K 31
uidinfo 3 3K 8
Unitno 25 2K 37
sctp_ifa 5 1K 5
crypto 3 1K 3
newdirblk 4 1K 8
mkdir 4 1K 16
in_multi 2 1K 3
osd 3 1K 9
mld 2 1K 2
sctp_ifn 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1
tcpfunc 3 1K 3
loginclass 3 1K 7
soname 4 1K 5788
filecaps 4 1K 66
tun 3 1K 3
nexusdev 5 1K 5
entropy 2 1K 35
CAM CCB 0 0K 1797
freeblks 0 0K 25
freefrag 0 0K 7
allocindir 0 0K 0
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 3
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 3
kcovinfo 0 0K 0
HEAD commit: 20768ae4 Do not attempt to remove backward compatibility t..
git tree: freebsd
dashboard link: https://syzkaller.appspot.com/bug?extid=13f87ee993fc05259035
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=120dae20100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=110e933be00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+13f87e...@syzkaller.appspotmail.com
cpuid = 0
time = 1586989449
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025a5e140
vpanic() at vpanic+0x1c7/frame 0xfffffe0025a5e1a0
panic() at panic+0x43/frame 0xfffffe0025a5e200
pf_tagname2tag() at pf_tagname2tag+0x2c5/frame 0xfffffe0025a5e260
pfioctl() at pfioctl+0x6ae3/frame 0xfffffe0025a5e790
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe0025a5e7f0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe0025a5e820
vn_ioctl() at vn_ioctl+0x27c/frame 0xfffffe0025a5e940
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe0025a5e980
kern_ioctl() at kern_ioctl+0x3d4/frame 0xfffffe0025a5e9f0
sys_ioctl() at sys_ioctl+0x266/frame 0xfffffe0025a5eac0
amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe0025a5ebf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0025a5ebf0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x41c5ba, rsp = 0x7fffffffeab8, rbp = 0xffffffff ---
KDB: enter: panic
[ thread pid 775 tid 100111 ]
Stopped at kdb_enter+0x67: movq $0,0x14aa046(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0x80 ll+0x5f
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rdx 0xffffffff818a9109
rbx 0
rsp 0xfffffe0025a5e120
rbp 0xfffffe0025a5e140
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe0025791f10
r9 0xffffffff
r10 0
r12 0xffffffff82068e80 ddb_dbbe
r13 0
r14 0xffffffff8194913d
r15 0xffffffff8194913d
rip 0xffffffff810ad827 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x14aa046(%rip)
db> show proc
Process 775 (syz-executor0642638) at 0xfffff8003b57a520:
r13 0
r14 0xffffffff8194913d
r15 0xffffffff8194913d
rip 0xffffffff810ad827 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x14aa046(%rip)
db> show proc
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 773 at 0xfffff8003b3f5000
uid: 0 gids: 0, 0, 5
ABI: FreeBSD ELF64
arguments: ./syz-executor064263897
reaper: 0xfffff8000331a000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe0023bea3d0
sigparent: 20
(map 0xfffffe0023bea3d0)
(map.pmap 0xfffffe0023bea490)
(pmap 0xfffffe0023bea4f0)
threads: 1
100111 Run CPU 0 syz-executor0642638
db> ps
pid ppid pgrp uid state wmesg wchan cmd
775 773 771 0 R CPU 0 syz-executor0642638
pid ppid pgrp uid state wmesg wchan cmd
773 771 771 0 S nanslp 0xffffffff8252c1f1 syz-executor0642638
771 769 771 0 Ss pause 0xfffff8003b57aae8 csh
769 682 769 0 Rs CPU 1 sshd
748 1 748 0 Ss+ ttyin 0xfffff8000356f8b0 getty
747 1 747 0 Ss+ ttyin 0xfffff80003b6fcb0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b6e4b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b6ecb0 getty
744 1 744 0 Ss+ ttyin 0xfffff800033b74b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800033b7cb0 getty
742 1 742 0 Ss+ ttyin 0xfffff800033b64b0 getty
741 1 741 0 Ss+ ttyin 0xfffff800033b6cb0 getty
740 1 740 0 Ss+ ttyin 0xfffff800033b94b0 getty
738 1 24 0 S+ piperd 0xfffff80003cb28e8 logger
747 1 747 0 Ss+ ttyin 0xfffff80003b6fcb0 getty
746 1 746 0 Ss+ ttyin 0xfffff80003b6e4b0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003b6ecb0 getty
744 1 744 0 Ss+ ttyin 0xfffff800033b74b0 getty
743 1 743 0 Ss+ ttyin 0xfffff800033b7cb0 getty
742 1 742 0 Ss+ ttyin 0xfffff800033b64b0 getty
741 1 741 0 Ss+ ttyin 0xfffff800033b6cb0 getty
740 1 740 0 Ss+ ttyin 0xfffff800033b94b0 getty
737 736 24 0 S+ nanslp 0xffffffff8252c1f0 sleep
736 1 24 0 S+ wait 0xfffff80003cb8520 sh
686 1 686 0 Ss nanslp 0xffffffff8252c1f0 cron
682 1 682 0 Ss select 0xfffff80003c04ac0 sshd
495 1 495 0 Ss select 0xfffff80003c030c0 syslogd
424 1 424 0 Ss select 0xfffff80003c03040 devd
423 1 423 65 Ss select 0xfffff80003c04d40 dhclient
338 1 338 0 Ss select 0xfffff800030845c0 dhclient
335 1 335 0 Ss select 0xfffff80003084540 dhclient
23 0 0 0 DL syncer 0xffffffff82618118 [syncer]
22 0 0 0 DL vlruwt 0xfffff800033e0a40 [vnlru]
21 0 0 0 DL (threaded) [bufdaemon]
100069 D qsleep 0xffffffff82617438 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
100087 D sdflush 0xfffff80003c27ce8 [/ worker]
100069 D qsleep 0xffffffff82617438 [bufdaemon]
100076 D - 0xffffffff8200aa00 [bufspacedaemon-0]
20 0 0 0 DL psleep 0xffffffff8263e3c8 [vmdaemon]
19 0 0 0 DL (threaded) [pagedaemon]
100067 D psleep 0xffffffff82632998 [dom0]
100074 D launds 0xffffffff826329a4 [laundry: dom0]
100075 D umarcl 0xffffffff8154ae00 [uma]
18 0 0 0 DL - 0xffffffff8235fe20 [rand_harvestq]
17 0 0 0 DL pftm 0xffffffff82c353a0 [pf purge]
19 0 0 0 DL (threaded) [pagedaemon]
100067 D psleep 0xffffffff82632998 [dom0]
100074 D launds 0xffffffff826329a4 [laundry: dom0]
100075 D umarcl 0xffffffff8154ae00 [uma]
18 0 0 0 DL - 0xffffffff8235fe20 [rand_harvestq]
exclusive rm pf rulesets (pf rulesets) r = 0 (0xffffffff82c86110) locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:1585
Process 769 (sshd) thread 0xfffffe00257b0500 (100105)
exclusive sleep mutex so_snd (so_snd) r = 0 (0xfffffe001cfce5e0) locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_sockbuf.c:893
exclusive rw tcpinp (tcpinp) r = 0 (0xfffff8003b4fe3f0) locked @ /syzkaller/managers/main/kernel/sys/netinet/tcp_usrreq.c:965
exclusive sx so_snd_sx (so_snd_sx) r = 0 (0xfffffe001cfce600) locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_sockbuf.c:419
db> show malloc
Type InUse MemUse Requests
pf_hash 5 11524K 5
devbuf 4213 4851K 4238
Type InUse MemUse Requests
pf_hash 5 11524K 5
tcp_hpts 5 3201K 5
vtbuf 24 1968K 46
sysctloid 28335 1653K 28399
kobj 332 1328K 488
newblk 511 1152K 529
vtbuf 24 1968K 46
sysctloid 28335 1653K 28399
kobj 332 1328K 488
vfscache 4 1025K 4
pcb 21 537K 75
inodedep 48 536K 71
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 114 222K 843
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
acpica 1674 185K 52709
vnet_data 1 168K 1
pagedep 14 132K 18
vnet_data 1 168K 1
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 101 101K 110
linker 243 92K 264
bus 964 78K 3344
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 496 62K 496
temp 18 33K 1540
acpitask 1 64K 1
ddb_capture 1 64K 1
module 496 62K 496
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
DEVFS3 120 30K 130
umtx 234 30K 234
kdtrace 148 29K 1606
DEVFS_RULE 56 27K 56
gtaskqueue 18 26K 18
vmem 3 22K 4
kbdmux 6 22K 6
BPF 10 18K 10
ufs_mount 3 17K 4
proc 3 17K 3
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 98 16K 98
bus-sc 30 14K 1431
tidhash 1 16K 1
ithread 98 16K 98
KTRACE 100 13K 100
ifaddr 30 12K 32
kenv 95 12K 99
eventhandler 132 12K 132
eventhandler 132 12K 132
pfs_nodes 20 10K 20
GEOM 60 10K 486
rman 82 10K 423
bmsafemap 4 9K 41
GEOM 60 10K 486
rman 82 10K 423
UART 12 9K 12
devstat 4 9K 4
rpc 2 8K 2
shmfd 1 8K 1
devstat 4 9K 4
rpc 2 8K 2
pfs_vncache 1 8K 1
audit_evclass 232 8K 290
CAM DEV 3 6K 510
vt 11 6K 11
cred 21 6K 234
sglist 5 6K 5
CAM queue 5 6K 1528
routetbl 28 5K 36
CAM queue 5 6K 1528
taskqueue 45 5K 45
ufs_dirhash 24 5K 24
dirrem 17 5K 28
ufs_dirhash 24 5K 24
plimit 17 5K 322
ifnet 3 5K 3
memdesc 1 4K 1
MCA 32 4K 32
UMA 249 4K 249
ioctlops 1 4K 92
MCA 32 4K 32
UMA 249 4K 249
evdev 4 4K 4
filedesc 1 4K 1
pf_ifnet 7 4K 8
lltable 11 4K 11
hhook 13 4K 13
ether_multi 40 4K 45
diradd 25 4K 36
in6_multi 25 3K 25
kqueue 47 3K 778
acpisem 22 3K 22
terminal 11 3K 11
select 21 3K 21
terminal 11 3K 11
session 20 3K 31
pgrp 20 3K 31
uidinfo 3 3K 8
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
proc-args 39 2K 472
io_apic 1 2K 1
ipsec-saq 2 2K 2
CAM XPT 22 2K 543
lockf 15 2K 22
Unitno 25 2K 37
acpidev 20 2K 20
msi 9 2K 9
pf_rule 1 1K 2
msi 9 2K 9
softdep 1 1K 1
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 8
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
NFSD session 1 1K 1
CAM periph 4 1K 271
indirdep 3 1K 3
CAM periph 4 1K 271
nhops 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
ip6ndp 4 1K 5
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
sctp_ifa 5 1K 5
crypto 3 1K 3
newdirblk 4 1K 8
mkdir 4 1K 16
in_multi 2 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
chacha20random 1 1K 1
CAM SIM 2 1K 2
epoch 4 1K 4
cdev 2 1K 2
osd 3 1K 9
mld 2 1K 2
sctp_ifn 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
inpcbpolicy 6 1K 131
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
tcpfunc 3 1K 3
loginclass 3 1K 7
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
DEVFSP 2 1K 2
CAM I/O Scheduler 1 1K 1
apmdev 1 1K 1
atkbddev 2 1K 2
CAM path 4 1K 1034
ktls 1 1K 1
pmchooks 1 1K 1
prison 4 1K 4
soname 4 1K 5788
filecaps 4 1K 66
tun 3 1K 3
nexusdev 5 1K 5
entropy 2 1K 35
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
freework 1 1K 26
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 11
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
UMAHash 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 3
jfsync 0 0K 0
jtrunc 0 0K 0
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefile 0 0K 9
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freeblks 0 0K 25
freefrag 0 0K 7
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
tcplog 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
lDevFlags * malloc 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 3
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
statfs 0 0K 196
export_host 0 0K 0
cl_savebuf 0 0K 3
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
mbuf_tag 0 0K 25
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
mps_user 0 0K 0
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
MPSSAS 0 0K 0
accf 0 0K 0
pts 0 0K 0
iov 0 0K 12983
pts 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
Fail Points 0 0K 0
Mark Johnston
Nov 23, 2020, 10:16:53 AM11/23/20
to syzbot, syzkaller-f...@googlegroups.com
This bug still appears to be present, but the repro doesn't work. Let's
try to get a new repro.
Reply all
Reply to author
Forward
0 new messages