panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet/ip_output.c:LINE

1 view
Skip to first unread message

syzbot

unread,
Jan 22, 2020, 9:08:10 AM1/22/20
to syzkaller-f...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 313adad5 Make in_pcbladdr() require network epoch entered ..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=12d51a95e00000
dashboard link: https://syzkaller.appspot.com/bug?extid=febbe3383a0e9b700c1b

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+febbe3...@syzkaller.appspotmail.com

login: panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet/ip_output.c:325
cpuid = 0
time = 1579702052
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0024541490
vpanic() at vpanic+0x1ce/frame 0xfffffe0024541500
panic() at panic+0x43/frame 0xfffffe0024541560
ip_output() at ip_output+0x2558/frame 0xfffffe0024541700
sctp_lowlevel_chunk_output() at sctp_lowlevel_chunk_output+0x101c/frame 0xfffffe0024541850
sctp_send_initiate() at sctp_send_initiate+0xa53/frame 0xfffffe0024541950
sctp_connect() at sctp_connect+0x4b1/frame 0xfffffe00245419b0
soconnectat() at soconnectat+0x183/frame 0xfffffe0024541a10
kern_connectat() at kern_connectat+0x1ec/frame 0xfffffe0024541a70
sys_connect() at sys_connect+0xd9/frame 0xfffffe0024541ab0
amd64_syscall() at amd64_syscall+0x499/frame 0xfffffe0024541bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0024541bf0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x4132ea, rsp = 0x7fffdfffdf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 1090 tid 100946 ]
Stopped at kdb_enter+0x67: movq $0,0x1466de6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0xfffffe0024a00000
rdx 0x3ffff
rbx 0
rsp 0xfffffe0024541470
rbp 0xfffffe0024541490
rsi 0x40001
rdi 0xffffffff810ba276 vprintf+0x176
r8 0
r9 0xffffffff
r10 0x6d86 ll+0x6d65
r11 0x2f94c674
r12 0xffffffff82068d90 ddb_dbbe
r13 0
r14 0xffffffff819363fb
r15 0xffffffff819363fb
rip 0xffffffff810af337 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x1466de6(%rip)
db> show proc
Process 1090 (syz-executor.0) at 0xfffff8003abac530:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 768 at 0xfffff80003ded000
ABI: FreeBSD ELF64
arguments: /root/syz-executor.0
reaper: 0xfffff800032fa530 reapsubtree: 1
sigparent: 20
vmspace: 0xfffff8003ae09000
(map 0xfffff8003ae09000)
(map.pmap 0xfffff8003ae090c0)
(pmap 0xfffff8003ae09120)
threads: 4
100115 RunQ syz-executor.0
100946 Run CPU 0 syz-executor.0
100948 S sbwait 0xfffff80003eea8e4 syz-executor.0
100950 S uwait 0xfffff80003a49c00 syz-executor.0
db> ps
pid ppid pgrp uid state wmesg wchan cmd
1091 771 771 0 R (threaded) syz-executor.2
100536 Run CPU 1 syz-executor.2
100949 S select 0xfffff8003ac50440 syz-executor.2
1090 768 768 0 R (threaded) syz-executor.0
100115 RunQ syz-executor.0
100946 Run CPU 0 syz-executor.0
100948 S sbwait 0xfffff80003eea8e4 syz-executor.0
100950 S uwait 0xfffff80003a49c00 syz-executor.0
1089 769 769 0 S (threaded) syz-executor.1
100114 S nanslp 0xffffffff824fed21 syz-executor.1
100943 S select 0xfffff8003ac50840 syz-executor.1
100944 S uwait 0xfffff80003db3100 syz-executor.1
100947 S uwait 0xfffff80003db3a80 syz-executor.1
1088 776 776 0 S (threaded) syz-executor.3
100874 S nanslp 0xffffffff824fed20 syz-executor.3
100941 S select 0xfffff80003ce6a40 syz-executor.3
100942 S uwait 0xfffff80003e09000 syz-executor.3
100945 S uwait 0xfffff80003a49800 syz-executor.3
824 811 824 0 Ss select 0xfffff8003ac50940 dhclient
814 1 814 0 Ss select 0xfffff80003ce9240 dhclient
811 798 422 65 S select 0xfffff8003ac509c0 dhclient
798 422 422 0 S wait 0xfffff8003abab000 sh
776 766 776 0 Ss nanslp 0xffffffff824fed21 syz-executor.3
771 766 771 0 Rs syz-executor.2
769 766 769 0 Ss nanslp 0xffffffff824fed21 syz-executor.1
768 766 768 0 Ss nanslp 0xffffffff824fed20 syz-executor.0
766 764 764 0 S (threaded) syz-fuzzer
100084 S uwait 0xfffff80003e08a00 syz-fuzzer
100096 S uwait 0xfffff80003a48100 syz-fuzzer
100097 S uwait 0xfffff80003a48200 syz-fuzzer
100098 S uwait 0xfffff80003a46280 syz-fuzzer
100099 S uwait 0xfffff80003a46380 syz-fuzzer
100100 S uwait 0xfffff80003e09800 syz-fuzzer
100101 S uwait 0xfffff80003a46480 syz-fuzzer
100102 S kqread 0xfffff8000333b800 syz-fuzzer
100103 S uwait 0xfffff80003a46580 syz-fuzzer
100104 S uwait 0xfffff80003e09300 syz-fuzzer
764 762 764 0 Ss pause 0xfffff80003f25b08 csh
762 680 762 0 Ss select 0xfffff80003ce8340 sshd
746 1 746 0 Ss+ ttyin 0xfffff800033f7cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff800033f8cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003aba0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003aba4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003aba8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003abacb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003abb0b0 getty
739 1 739 0 Ss+ ttyin 0xfffff80003abb4b0 getty
738 1 738 0 Ss+ ttyin 0xfffff80003abb8b0 getty
736 1 22 0 S+ piperd 0xfffff80003d862f8 logger
735 734 22 0 S+ nanslp 0xffffffff824fed20 sleep
734 1 22 0 S+ wait 0xfffff80003f31000 sh
684 1 684 0 Ss nanslp 0xffffffff824fed21 cron
680 1 680 0 Ss select 0xfffff80003ce83c0 sshd
493 1 493 0 Ss select 0xfffff80003ce8b40 syslogd
422 1 422 0 Ss wait 0xfffff80003544a60 devd
421 1 421 65 Ss select 0xfffff80003ce8440 dhclient
336 1 336 0 Ss select 0xfffff80003ce8940 dhclient
333 1 333 0 Ss select 0xfffff80003ceb8c0 dhclient
21 0 0 0 DL syncer 0xffffffff825d5198 [syncer]
20 0 0 0 DL vlruwt 0xfffff80003b01000 [vnlru]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d4698 [bufdaemon]
100070 D - 0xffffffff8200a980 [bufspacedaemon-0]
100081 D sdflush 0xfffff80003cf88e8 [/ worker]
18 0 0 0 DL psleep 0xffffffff825f0108 [vmdaemon]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261d058 [dom0]
100068 D launds 0xffffffff8261d064 [laundry: dom0]
100069 D umarcl 0xffffffff8153ce90 [uma]
16 0 0 0 DL - 0xffffffff823595b0 [rand_harvestq]
15 0 0 0 DL waiting 0xffffffff82662620 [sctp_iterator]
9 0 0 0 DL - 0xffffffff825d409c [soaiod4]
8 0 0 0 DL - 0xffffffff825d409c [soaiod3]
7 0 0 0 DL - 0xffffffff825d409c [soaiod2]
6 0 0 0 DL - 0xffffffff825d409c [soaiod1]
5 0 0 0 DL (threaded) [cam]
100031 D - 0xffffffff822349c0 [doneq0]
100062 D - 0xffffffff82234888 [scanner]
4 0 0 0 DL crypto_ 0xfffff800031f8e90 [crypto returns 1]
3 0 0 0 DL crypto_ 0xfffff800031f8e30 [crypto returns 0]
2 0 0 0 DL crypto_ 0xffffffff825ea178 [crypto]
14 0 0 0 DL seqstat 0xfffff80003362888 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100022 D - 0xffffffff8261b688 [g_event]
100023 D - 0xffffffff8261b698 [g_up]
100024 D - 0xffffffff8261b690 [g_down]
12 0 0 0 WL (threaded) [intr]
100006 I [swi5: fast taskq]
100010 I [swi6: task queue]
100011 I [swi6: Giant taskq]
100017 I [swi3: vm]
100018 I [swi4: clock (0)]
100019 I [swi4: clock (1)]
100020 I [swi1: netisr 0]
100032 I [irq24: virtio_pci0]
100033 I [irq25: virtio_pci0]
100034 I [irq26: virtio_pci0]
100035 I [irq27: virtio_pci0]
100036 I [irq28: virtio_pci1]
100037 I [irq29: virtio_pci1]
100038 I [irq30: virtio_pci1]
100039 I [irq31: virtio_pci1]
100040 I [irq32: virtio_pci1]
100045 I [irq10: virtio_pci2]
100047 I [irq1: atkbd0]
100048 I [irq12: psm0]
100049 I [swi0: uart uart++]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff800032fa530 [init]
10 0 0 0 DL audit_w 0xffffffff826632b0 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff82609c78 [swapper]
100005 D - 0xfffff8000333d000 [thread taskq]
100007 D - 0xfffff8000333cd00 [kqueue_ctx taskq]
100008 D - 0xfffff8000333cc00 [config_0]
100009 D - 0xfffff8000333cb00 [aiod_kick taskq]
100012 D - 0xfffff8000333c800 [if_config_tqg_0]
100013 D - 0xfffff8000333c700 [if_io_tqg_0]
100014 D - 0xfffff8000333c600 [if_io_tqg_1]
100015 D - 0xfffff8000333c500 [softirq_0]
100016 D - 0xfffff8000333c400 [softirq_1]
100021 D - 0xfffff8000333c300 [firmware taskq]
100026 D - 0xfffff8000333c200 [crypto_0]
100027 D - 0xfffff8000333c200 [crypto_1]
100041 D - 0xfffff8000333c000 [vtnet0 rxq 0]
100042 D - 0xfffff8000333be00 [vtnet0 txq 0]
100043 D - 0xfffff8000333bd00 [vtnet0 rxq 1]
100044 D - 0xfffff8000333bc00 [vtnet0 txq 1]
100046 D vtbslp 0xfffff800034d4400 [virtio_balloon]
100050 D - 0xfffff8000333bb00 [mca taskq]
100054 D - 0xffffffff81cd9d50 [deadlkres]
100057 D - 0xfffff80003b31100 [acpi_task_0]
100058 D - 0xfffff80003b31100 [acpi_task_1]
100059 D - 0xfffff80003b31100 [acpi_task_2]
100061 D - 0xfffff8000333c100 [CAM taskq]
db> show all locks
Process 1090 (syz-executor.0) thread 0xfffff8003abf96e0 (100946)
exclusive sleep mutex sctp-tcb (tcb) r = 0 (0xfffff8003af77928) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:4370
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffff8003adfae88) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_usrreq.c:7038
db> show malloc
Type InUse MemUse Requests
devbuf 4213 4851K 4238
vtbuf 24 1968K 46
sysctloid 26527 1553K 26591
kobj 331 1324K 487
newblk 553 1162K 1569
vfscache 4 1025K 4
inodedep 192 608K 453
pcb 25 539K 409
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 129 261K 1165
acpica 1674 185K 49750
vnet_data 1 168K 1
filedesc 21 149K 609
pagedep 19 133K 317
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 221 89K 252
bus 986 79K 3330
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 493 62K 493
umtx 300 38K 300
BPF 22 36K 22
kdtrace 181 35K 3069
gtaskqueue 22 34K 22
hostcache 1 32K 1
shm 1 32K 1
DEVFS3 124 31K 134
msg 4 30K 4
DEVFS_RULE 56 27K 56
ifaddr 71 24K 73
kbdmux 6 22K 6
freefile 159 20K 366
vmem 3 19K 4
dirrem 149 19K 372
lltable 47 18K 47
temp 34 17K 1885
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
ether_multi 172 14K 177
bus-sc 30 14K 1394
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 123 11K 123
in6_multi 89 11K 89
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 3 9K 417
devstat 4 9K 4
UART 12 9K 12
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 231 8K 289
cred 28 7K 201
routetbl 58 7K 62
sctp_timw 27 7K 27
CAM DEV 3 6K 508
kqueue 58 6K 1096
plimit 22 6K 348
vt 11 6K 11
select 43 6K 43
sglist 5 6K 5
CAM queue 5 6K 1522
ufs_dirhash 24 5K 24
DEVFSP 72 5K 76
taskqueue 42 5K 42
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
kcovinfo 64 4K 68
UMA 234 4K 234
diradd 30 4K 405
session 26 4K 35
pgrp 26 4K 35
hhook 13 4K 13
acpisem 22 3K 22
terminal 11 3K 11
proc-args 47 3K 538
mkdir 20 3K 612
indirdep 10 3K 30
uidinfo 4 3K 4
sctp_ifa 17 3K 17
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
lockf 19 2K 316
ip6ndp 12 2K 21
CAM XPT 22 2K 541
in_multi 6 2K 7
Unitno 25 2K 45
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
tun 7 2K 7
freework 5 2K 591
newdirblk 16 1K 306
freeblks 4 1K 350
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
sctp_atcl 2 1K 203
sctp_stro 1 1K 51
clone 8 1K 8
vnodemarker 2 1K 10
NFSD session 1 1K 1
CAM periph 4 1K 270
mld 6 1K 6
sctp_ifn 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
CAM SIM 2 1K 2
softdep 1 1K 1
pfil 4 1K 4
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
inpcbpolicy 15 1K 962
encap_export_host 8 1K 8
osd 3 1K 9
vnodes 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 3
CAM path 4 1K 1030
apmdev 1 1K 1
atkbddev 2 1K 2
sctp_atky 3 1K 254
soname 5 1K 5812
pmchooks 1 1K 1
prison 4 1K 4
filecaps 5 1K 72
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
nexusdev 5 1K 5
entropy 2 1K 37
tcpfunc 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
sctp_athm 2 1K 203
sctp_map 2 1K 102
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
CAM CCB 0 0K 2087
madt_table 0 0K 2
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
fpukern_ctx 0 0K 0
xen_intr 0 0K 0
CAM ccb queue 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 34
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 3
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 5
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 158
sctp_iter 0 0K 9
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 9
sctp_aadr 0 0K 0
sctp_stri 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
statfs 0 0K 475
export_host 0 0K 0
cl_savebuf 0 0K 2
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
mbuf_tag 0 0K 111
accf 0 0K 0
pts 0 0K 0
iov 0 0K 13987
ioctlops 0 0K 97
Witness 0 0K 0
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 583
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
filedesc_to_leader 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
db> show ktr
No such command; use "help" to list available commands


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Jan 22, 2020, 10:34:09 PM1/22/20
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following crash on:

HEAD commit: 313adad5 Make in_pcbladdr() require network epoch entered ..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=103e59c9e00000
dashboard link: https://syzkaller.appspot.com/bug?extid=febbe3383a0e9b700c1b
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17076185e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=115ea985e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+febbe3...@syzkaller.appspotmail.com

login: panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet/ip_output.c:325
cpuid = 1
time = 1579750220
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0024472490
vpanic() at vpanic+0x1ce/frame 0xfffffe0024472500
panic() at panic+0x43/frame 0xfffffe0024472560
ip_output() at ip_output+0x2558/frame 0xfffffe0024472700
sctp_lowlevel_chunk_output() at sctp_lowlevel_chunk_output+0x101c/frame 0xfffffe0024472850
sctp_send_initiate() at sctp_send_initiate+0xa53/frame 0xfffffe0024472950
sctp_connect() at sctp_connect+0x4b1/frame 0xfffffe00244729b0
soconnectat() at soconnectat+0x183/frame 0xfffffe0024472a10
kern_connectat() at kern_connectat+0x1ec/frame 0xfffffe0024472a70
sys_connect() at sys_connect+0xd9/frame 0xfffffe0024472ab0
amd64_syscall() at amd64_syscall+0x499/frame 0xfffffe0024472bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0024472bf0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x41c33a, rsp = 0x7fffffffeae8, rbp = 0x7fffffffeb40 ---
KDB: enter: panic
[ thread pid 773 tid 100091 ]
Stopped at kdb_enter+0x67: movq $0,0x1466de6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0x28 ll+0x7
rax 0x12
rcx 0x80 ll+0x5f
rdx 0xffffffff81898412
rbx 0
rsp 0xfffffe0024472470
rbp 0xfffffe0024472490
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0xd761 ll+0xd740
r11 0x54c9cd83
r12 0xffffffff82068d90 ddb_dbbe
r13 0
r14 0xffffffff819363fb
r15 0xffffffff819363fb
rip 0xffffffff810af337 kdb_enter+0x67
rflags 0x82 ll+0x61
kdb_enter+0x67: movq $0,0x1466de6(%rip)
db> show proc
Process 773 (syz-executor5076787) at 0xfffff80003db7a60:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 771 at 0xfffff80003db7530
ABI: FreeBSD ELF64
arguments: ./syz-executor507678767
reaper: 0xfffff800032fa530 reapsubtree: 1
sigparent: 20
vmspace: 0xfffff8003a6f0000
(map 0xfffff8003a6f0000)
(map.pmap 0xfffff8003a6f00c0)
(pmap 0xfffff8003a6f0120)
threads: 1
100091 Run CPU 1 syz-executor5076787
db> ps
pid ppid pgrp uid state wmesg wchan cmd
773 771 771 0 R CPU 1 syz-executor5076787
771 769 771 0 Ss pause 0xfffff80003db75d8 csh
769 680 769 0 Ss select 0xfffff8003a250940 sshd
746 1 746 0 Ss+ ttyin 0xfffff800033f6cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff800033f9cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003aba0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003aba4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003aba8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003abacb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003abd0b0 getty
739 1 739 0 Ss+ ttyin 0xfffff80003abd4b0 getty
738 1 738 0 Ss+ ttyin 0xfffff80003abd8b0 getty
736 1 22 0 S+ piperd 0xfffff8003a59f5f0 logger
735 734 22 0 S+ nanslp 0xffffffff824fed21 sleep
734 1 22 0 S+ wait 0xfffff80003e45a60 sh
684 1 684 0 Ss nanslp 0xffffffff824fed20 cron
680 1 680 0 Ss select 0xfffff80003d22f40 sshd
493 1 493 0 Ss select 0xfffff8003a2509c0 syslogd
422 1 422 0 Ss select 0xfffff8003a250a40 devd
421 1 421 65 Ss select 0xfffff80003d21040 dhclient
336 1 336 0 Ss select 0xfffff80003d211c0 dhclient
333 1 333 0 Ss select 0xfffff80003d21140 dhclient
21 0 0 0 DL syncer 0xffffffff825d5198 [syncer]
20 0 0 0 DL vlruwt 0xfffff80003b03000 [vnlru]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d4698 [bufdaemon]
100066 D - 0xffffffff8200a980 [bufspacedaemon-0]
100082 D sdflush 0xfffff80003d008e8 [/ worker]
18 0 0 0 DL psleep 0xffffffff825f0108 [vmdaemon]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261d058 [dom0]
100069 D launds 0xffffffff8261d064 [laundry: dom0]
100070 D umarcl 0xffffffff8153ce90 [uma]
16 0 0 0 DL - 0xffffffff823595b0 [rand_harvestq]
15 0 0 0 DL waiting 0xffffffff82662620 [sctp_iterator]
9 0 0 0 DL - 0xffffffff825d409c [soaiod4]
8 0 0 0 DL - 0xffffffff825d409c [soaiod3]
7 0 0 0 DL - 0xffffffff825d409c [soaiod2]
6 0 0 0 DL - 0xffffffff825d409c [soaiod1]
5 0 0 0 DL (threaded) [cam]
100031 D - 0xffffffff822349c0 [doneq0]
100062 D - 0xffffffff82234888 [scanner]
4 0 0 0 DL crypto_ 0xfffff800031f8e90 [crypto returns 1]
3 0 0 0 DL crypto_ 0xfffff800031f8e30 [crypto returns 0]
2 0 0 0 DL crypto_ 0xffffffff825ea178 [crypto]
14 0 0 0 DL seqstat 0xfffff80003363888 [sequencer 00]
100003 Run CPU 0 [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff800032fa530 [init]
10 0 0 0 DL audit_w 0xffffffff826632b0 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff82609c78 [swapper]
100005 D - 0xfffff8000333d000 [thread taskq]
100007 D - 0xfffff8000333cd00 [kqueue_ctx taskq]
100008 D - 0xfffff8000333cc00 [config_0]
100009 D - 0xfffff8000333cb00 [aiod_kick taskq]
100012 D - 0xfffff8000333c800 [if_config_tqg_0]
100013 D - 0xfffff8000333c700 [if_io_tqg_0]
100014 D - 0xfffff8000333c600 [if_io_tqg_1]
100015 D - 0xfffff8000333c500 [softirq_0]
100016 D - 0xfffff8000333c400 [softirq_1]
100021 D - 0xfffff8000333c300 [firmware taskq]
100026 D - 0xfffff8000333c200 [crypto_0]
100027 D - 0xfffff8000333c200 [crypto_1]
100041 D - 0xfffff8000333c000 [vtnet0 rxq 0]
100042 D - 0xfffff8000333be00 [vtnet0 txq 0]
100043 D - 0xfffff8000333bd00 [vtnet0 rxq 1]
100044 D - 0xfffff8000333bc00 [vtnet0 txq 1]
100046 D vtbslp 0xfffff800034d5400 [virtio_balloon]
100050 D - 0xfffff8000333bb00 [mca taskq]
100055 D - 0xffffffff81cd9d51 [deadlkres]
100057 D - 0xfffff80003b30100 [acpi_task_0]
100058 D - 0xfffff80003b30100 [acpi_task_1]
100059 D - 0xfffff80003b30100 [acpi_task_2]
100061 D - 0xfffff8000333c100 [CAM taskq]
db> show all locks
Process 773 (syz-executor5076787) thread 0xfffff8003a313000 (100091)
exclusive sleep mutex sctp-tcb (tcb) r = 0 (0xfffff8003aaf7928) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:4370
exclusive sleep mutex sctp-create (inp_create) r = 0 (0xfffff8003a9f5488) locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_usrreq.c:7038
db> show malloc
Type InUse MemUse Requests
devbuf 4213 4851K 4238
vtbuf 24 1968K 46
sysctloid 26527 1553K 26591
kobj 331 1324K 487
newblk 509 1151K 527
vfscache 4 1025K 4
pcb 23 539K 77
inodedep 48 536K 71
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 99 204K 829
acpica 1674 185K 49750
vnet_data 1 168K 1
pagedep 14 132K 18
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 101 101K 110
linker 221 89K 240
bus 962 78K 3298
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 493 62K 493
gtaskqueue 22 34K 22
hostcache 1 32K 1
shm 1 32K 1
msg 4 30K 4
DEVFS3 120 30K 130
umtx 220 28K 220
kdtrace 138 27K 1598
DEVFS_RULE 56 27K 56
kbdmux 6 22K 6
vmem 3 19K 4
BPF 10 18K 10
temp 17 17K 1538
ufs_mount 3 17K 4
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
bus-sc 30 14K 1394
KTRACE 100 13K 100
ifaddr 30 12K 32
kenv 95 12K 99
eventhandler 123 11K 123
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 3 9K 39
devstat 4 9K 4
UART 12 9K 12
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
audit_evclass 231 8K 289
cred 28 7K 244
CAM DEV 3 6K 508
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1522
ufs_dirhash 24 5K 24
taskqueue 42 5K 42
plimit 17 5K 337
ifnet 3 5K 3
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
filedesc 1 4K 1
routetbl 28 4K 32
UMA 234 4K 234
lltable 11 4K 11
hhook 13 4K 13
ether_multi 40 4K 45
diradd 25 4K 36
in6_multi 25 3K 25
acpisem 22 3K 22
terminal 11 3K 11
kqueue 44 3K 776
session 20 3K 32
pgrp 20 3K 32
uidinfo 4 3K 5
dirrem 17 3K 28
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
select 16 2K 16
lockf 16 2K 26
proc-args 39 2K 475
CAM XPT 22 2K 541
Unitno 25 2K 37
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
sctp_atcl 2 1K 2
sctp_stro 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 10
NFSD session 1 1K 1
CAM periph 4 1K 270
indirdep 3 1K 3
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
ip6ndp 4 1K 5
sctp_ifa 5 1K 5
CAM SIM 2 1K 2
softdep 1 1K 1
mkdir 4 1K 16
in_multi 2 1K 3
pfil 4 1K 4
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
osd 3 1K 9
newdirblk 4 1K 8
mld 2 1K 2
sctp_ifn 2 1K 2
igmp 2 1K 2
vnodes 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
inpcbpolicy 6 1K 129
loginclass 3 1K 3
CAM path 4 1K 1030
apmdev 1 1K 1
atkbddev 2 1K 2
sctp_atky 3 1K 3
soname 5 1K 5744
pmchooks 1 1K 1
prison 4 1K 4
DEVFSP 2 1K 2
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
filecaps 4 1K 66
tun 3 1K 3
nexusdev 5 1K 5
entropy 2 1K 35
tcpfunc 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
freework 1 1K 26
sctp_athm 2 1K 2
sctp_map 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
CAM CCB 0 0K 1799
savedino 0 0K 13
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 3
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefile 0 0K 9
freeblks 0 0K 25
freefrag 0 0K 7
sctp_socko 0 0K 0
sctp_iter 0 0K 3
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 3
statfs 0 0K 197
export_host 0 0K 0
cl_savebuf 0 0K 3
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
mbuf_tag 0 0K 25
accf 0 0K 0
pts 0 0K 0
iov 0 0K 12992
ioctlops 0 0K 85
Witness 0 0K 0
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 568
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
kcovinfo 0 0K 0
Reply all
Reply to author
Forward
0 new messages