panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:LINE
0 views
Skip to first unread message
syzbot
Jan 27, 2020, 6:49:10 AM1/27/20
to syzkaller-f...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 66f368ce Enter net epoch in msk_tick.
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=164eb611e00000
dashboard link: https://syzkaller.appspot.com/bug?extid=3473a0b2831970e18748
userspace arch: i386
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3473a0...@syzkaller.appspotmail.com
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:309
cpuid = 0
time = 28
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002450a780
vpanic() at vpanic+0x1ce/frame 0xfffffe002450a7f0
panic() at panic+0x43/frame 0xfffffe002450a850
__mtx_lock_flags() at __mtx_lock_flags+0x203/frame 0xfffffe002450a8b0
soo_stat() at soo_stat+0x9c/frame 0xfffffe002450a8f0
kern_fstat() at kern_fstat+0xed/frame 0xfffffe002450a940
freebsd11_freebsd32_fstat() at freebsd11_freebsd32_fstat+0x2d/frame 0xfffffe002450aab0
ia32_syscall() at ia32_syscall+0x48c/frame 0xfffffe002450abf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0x814269f
KDB: enter: panic
[ thread pid 10966 tid 101121 ]
Stopped at kdb_enter+0x67: movq $0,0x1466bf6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0xfffffe0025400000
rdx 0x3ffff
rbx 0
rsp 0xfffffe002450a760
rbp 0xfffffe002450a780
rsi 0x40001
rdi 0xffffffff810ba3e6 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffff800291f1bd0
r12 0xffffffff82068d90 ddb_dbbe
r13 0
r14 0xffffffff819387da
r15 0xffffffff819387da
rip 0xffffffff810af4a7 kdb_enter+0x67
rflags 0x200086 kernphys+0x86
kdb_enter+0x67: movq $0,0x1466bf6(%rip)
db> show proc
Process 10966 (syz-executor.0) at 0xfffff800291c3000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 768 at 0xfffff80003f73000
ABI: FreeBSD ELF32
arguments: /root/syz-executor.0
reaper: 0xfffff800032fa530 reapsubtree: 1
sigparent: 20
vmspace: 0xfffff80029199000
(map 0xfffff80029199000)
(map.pmap 0xfffff800291990c0)
(pmap 0xfffff80029199120)
threads: 5
100486 RunQ syz-executor.0
100165 S accept 0xfffff80003edf878 syz-executor.0
100168 S select 0xfffff80029534440 syz-executor.0
100170 Run CPU 1 syz-executor.0
101121 Run CPU 0 syz-executor.0
db> ps
pid ppid pgrp uid state wmesg wchan cmd
10969 784 784 0 S (threaded) syz-executor.3
101163 S nanslp 0xffffffff824feca0 syz-executor.3
100172 S pipdwt 0xfffff80003d97000 syz-executor.3
100185 S uwait 0xfffff8003ab27b80 syz-executor.3
10968 779 779 0 R (threaded) syz-executor.2
101137 RunQ syz-executor.2
100166 S connec 0xfffff80003ee20f0 syz-executor.2
100174 S select 0xfffff80029534640 syz-executor.2
100175 S uwait 0xfffff80003a46f00 syz-executor.2
10967 769 769 0 S (threaded) syz-executor.1
101174 S nanslp 0xffffffff824feca0 syz-executor.1
100156 S sbwait 0xfffff80003ee855c syz-executor.1
100171 S uwait 0xfffff80003a47a80 syz-executor.1
10966 768 768 0 R (threaded) syz-executor.0
100486 RunQ syz-executor.0
100165 S accept 0xfffff80003edf878 syz-executor.0
100168 S select 0xfffff80029534440 syz-executor.0
100170 Run CPU 1 syz-executor.0
101121 Run CPU 0 syz-executor.0
3116 1 3116 65 Ss select 0xfffff80003ce0ac0 dhclient
2558 1 2558 0 Ss select 0xfffff80029534540 dhclient
2555 1 2555 0 Ss select 0xfffff800295345c0 dhclient
2530 1 2530 65 Ss select 0xfffff80003ce0bc0 dhclient
2070 1 2070 0 Ss select 0xfffff80003ce0dc0 dhclient
2067 1 2067 0 Ss select 0xfffff80003cfa9c0 dhclient
2047 1 2047 65 Ss select 0xfffff800295346c0 dhclient
1668 1 1668 0 Ss select 0xfffff80003cfa6c0 dhclient
1665 1 1665 0 Ss select 0xfffff80003ce0d40 dhclient
1642 1 1642 65 Ss select 0xfffff80003ce0e40 dhclient
1041 1 1041 0 Ss select 0xfffff80003cfa840 dhclient
1037 1 1037 0 Ss select 0xfffff80003cfa740 dhclient
784 766 784 0 Ss nanslp 0xffffffff824feca0 syz-executor.3
779 766 779 0 Ss nanslp 0xffffffff824feca1 syz-executor.2
769 766 769 0 Ss nanslp 0xffffffff824feca1 syz-executor.1
768 766 768 0 Ss nanslp 0xffffffff824feca0 syz-executor.0
766 764 764 0 S (threaded) syz-fuzzer
100091 S uwait 0xfffff80003e20400 syz-fuzzer
100105 S uwait 0xfffff80003a4b080 syz-fuzzer
100106 S kqread 0xfffff8000333b900 syz-fuzzer
100107 S uwait 0xfffff80003a47c80 syz-fuzzer
100108 S uwait 0xfffff80003a47d80 syz-fuzzer
100109 S uwait 0xfffff80003a47e80 syz-fuzzer
100110 S uwait 0xfffff80003a46000 syz-fuzzer
100111 S uwait 0xfffff80003a46100 syz-fuzzer
100112 S uwait 0xfffff80003e1d080 syz-fuzzer
100113 S uwait 0xfffff80003a47780 syz-fuzzer
100114 S uwait 0xfffff80003e1d180 syz-fuzzer
764 762 764 0 Ss pause 0xfffff80003dfa5d8 csh
762 680 762 0 Ss select 0xfffff80003cf5740 sshd
746 1 746 0 Ss+ ttyin 0xfffff800033f6cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff800033f9cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003abc0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003abc4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003abc8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003abccb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003abf0b0 getty
739 1 739 0 Ss+ ttyin 0xfffff80003abf4b0 getty
738 1 738 0 Ss+ ttyin 0xfffff80003abf8b0 getty
684 1 684 0 Ss nanslp 0xffffffff824feca1 cron
680 1 680 0 Ss select 0xfffff80003cf5640 sshd
493 1 493 0 Ss select 0xfffff80003d26840 syslogd
422 1 422 0 Ss select 0xfffff80003d26ec0 devd
421 1 421 65 Ss select 0xfffff80003d26940 dhclient
336 1 336 0 Ss select 0xfffff80003cf5540 dhclient
333 1 333 0 Ss select 0xfffff80003d269c0 dhclient
21 0 0 0 DL vlruwt 0xfffff80003afea60 [vnlru]
20 0 0 0 DL syncer 0xffffffff825d5118 [syncer]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d4618 [bufdaemon]
100070 D - 0xffffffff8200a980 [bufspacedaemon-0]
100080 D sdflush 0xfffff80003d038e8 [/ worker]
18 0 0 0 DL psleep 0xffffffff825f0088 [vmdaemon]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261cfd8 [dom0]
100068 D launds 0xffffffff8261cfe4 [laundry: dom0]
100069 D umarcl 0xffffffff8153dd30 [uma]
16 0 0 0 DL - 0xffffffff82359530 [rand_harvestq]
15 0 0 0 DL waiting 0xffffffff826625a0 [sctp_iterator]
9 0 0 0 DL - 0xffffffff825d401c [soaiod4]
8 0 0 0 DL - 0xffffffff825d401c [soaiod3]
7 0 0 0 DL - 0xffffffff825d401c [soaiod2]
6 0 0 0 DL - 0xffffffff825d401c [soaiod1]
5 0 0 0 DL (threaded) [cam]
100031 D - 0xffffffff82234940 [doneq0]
100062 D - 0xffffffff82234808 [scanner]
4 0 0 0 DL crypto_ 0xfffff800031f8e90 [crypto returns 1]
3 0 0 0 DL crypto_ 0xfffff800031f8e30 [crypto returns 0]
2 0 0 0 DL crypto_ 0xffffffff825ea0f8 [crypto]
14 0 0 0 DL seqstat 0xfffff80003363888 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100022 D - 0xffffffff8261b608 [g_event]
100023 D - 0xffffffff8261b618 [g_up]
100024 D - 0xffffffff8261b610 [g_down]
12 0 0 0 WL (threaded) [intr]
100006 I [swi5: fast taskq]
100010 I [swi6: task queue]
100011 I [swi6: Giant taskq]
100017 I [swi3: vm]
100018 I [swi4: clock (0)]
100019 I [swi4: clock (1)]
100020 I [swi1: netisr 0]
100032 I [irq24: virtio_pci0]
100033 I [irq25: virtio_pci0]
100034 I [irq26: virtio_pci0]
100035 I [irq27: virtio_pci0]
100036 I [irq28: virtio_pci1]
100037 I [irq29: virtio_pci1]
100038 I [irq30: virtio_pci1]
100039 I [irq31: virtio_pci1]
100040 I [irq32: virtio_pci1]
100045 I [irq10: virtio_pci2]
100047 I [irq1: atkbd0]
100048 I [irq12: psm0]
100049 I [swi0: uart uart++]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff800032fa530 [init]
10 0 0 0 DL audit_w 0xffffffff82663230 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff82609bf8 [swapper]
100005 D - 0xfffff8000333d000 [thread taskq]
100007 D - 0xfffff8000333cd00 [kqueue_ctx taskq]
100008 D - 0xfffff8000333cc00 [config_0]
100009 D - 0xfffff8000333cb00 [aiod_kick taskq]
100012 D - 0xfffff8000333c800 [if_config_tqg_0]
100013 D - 0xfffff8000333c700 [if_io_tqg_0]
100014 D - 0xfffff8000333c600 [if_io_tqg_1]
100015 D - 0xfffff8000333c500 [softirq_0]
100016 D - 0xfffff8000333c400 [softirq_1]
100021 D - 0xfffff8000333c300 [firmware taskq]
100026 D - 0xfffff8000333c200 [crypto_0]
100027 D - 0xfffff8000333c200 [crypto_1]
100041 D - 0xfffff8000333c000 [vtnet0 rxq 0]
100042 D - 0xfffff8000333be00 [vtnet0 txq 0]
100043 D - 0xfffff8000333bd00 [vtnet0 rxq 1]
100044 D - 0xfffff8000333bc00 [vtnet0 txq 1]
100046 D vtbslp 0xfffff800034d5400 [virtio_balloon]
100050 D - 0xfffff8000333bb00 [mca taskq]
100054 D - 0xffffffff81cdc2d0 [deadlkres]
100057 D - 0xfffff80003b37100 [acpi_task_0]
100058 D - 0xfffff80003b37100 [acpi_task_1]
100059 D - 0xfffff80003b37100 [acpi_task_2]
100061 D - 0xfffff8000333c100 [CAM taskq]
db> show all locks
Process 10967 (syz-executor.1) thread 0xfffff800297fd000 (100156)
exclusive sx so_rcv_sx (so_rcv_sx) r = 0 (0xfffff80003ee8500) locked @ /syzkaller/managers/i386/kernel/sys/kern/uipc_sockbuf.c:393
Process 10966 (syz-executor.0) thread 0xfffff800291dd6e0 (100170)
exclusive sleep mutex eventhandler (eventhandler) r = 0 (0xffffffff82515260) locked @ /syzkaller/managers/i386/kernel/sys/kern/subr_eventhandler.c:271
exclusive sleep mutex socket (socket) r = 0 (0xfffff80003edca98) locked @ /syzkaller/managers/i386/kernel/sys/netinet/tcp_usrreq.c:483
exclusive rw tcpinp (tcpinp) r = 0 (0xfffff8003a49e9a8) locked @ /syzkaller/managers/i386/kernel/sys/netinet/tcp_usrreq.c:475
db> show malloc
Type InUse MemUse Requests
devbuf 4213 4851K 4241
vtbuf 24 1968K 46
sysctloid 26527 1553K 26591
kobj 332 1328K 488
newblk 8 1026K 11031
vfscache 4 1025K 4
pcb 44 553K 14020
inodedep 14 519K 10775
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 143 285K 11052
acpica 1674 185K 49750
vnet_data 1 168K 1
filedesc 21 149K 19979
pagedep 9 130K 9997
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 222 89K 253
BPF 46 88K 46
bus 964 78K 3332
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 494 62K 494
umtx 340 43K 340
kdtrace 193 37K 37516
gtaskqueue 22 34K 22
hostcache 1 32K 1
shm 1 32K 82
DEVFS3 124 31K 134
msg 4 30K 4
DEVFS_RULE 56 27K 56
ifaddr 74 25K 76
kbdmux 6 22K 6
vmem 3 19K 4
temp 34 17K 2510
ufs_mount 3 17K 4
proc 3 17K 3
lltable 44 16K 404
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
ether_multi 172 14K 177
bus-sc 30 14K 1394
KTRACE 100 13K 100
sctp_timw 49 13K 49
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 123 11K 123
in6_multi 89 11K 89
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 2 9K 10974
cred 33 9K 409
devstat 4 9K 4
UART 12 9K 12
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
routetbl 58 8K 62
select 59 8K 59
audit_evclass 231 8K 289
kqueue 63 7K 10976
CAM DEV 3 6K 510
plimit 24 6K 2319
sctp_atcl 11 6K 6126
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
DEVFSP 78 5K 82
ufs_dirhash 24 5K 24
taskqueue 42 5K 42
session 35 5K 53
pgrp 35 5K 60
memdesc 1 4K 1
MCA 32 4K 32
sctp_stro 4 4K 1861
evdev 4 4K 4
kcovinfo 64 4K 68
UMA 234 4K 234
lockf 32 4K 60
hhook 13 4K 13
proc-args 52 3K 685
acpisem 22 3K 22
terminal 11 3K 11
uidinfo 5 3K 12
sctp_ifa 17 3K 17
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 21
CAM XPT 22 2K 543
Unitno 27 2K 29009
in_multi 6 2K 7
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
tun 7 2K 7
freework 5 2K 10385
freeblks 4 1K 10336
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 84
NFSD session 1 1K 1
CAM periph 4 1K 271
mld 6 1K 6
sctp_ifn 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
mkdir 5 1K 19952
diradd 5 1K 10639
sctp_atky 15 1K 7989
inpcbpolicy 17 1K 6706
CAM SIM 2 1K 2
softdep 1 1K 1
freefile 4 1K 10594
pfil 4 1K 4
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
dirrem 3 1K 10597
osd 3 1K 9
newdirblk 4 1K 9976
vnodes 1 1K 221
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 3
sctp_athm 11 1K 6128
CAM path 4 1K 1034
apmdev 1 1K 1
atkbddev 2 1K 2
sctp_map 8 1K 3722
soname 5 1K 12757
pmchooks 1 1K 1
prison 4 1K 4
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
nexusdev 5 1K 5
filecaps 5 1K 120
entropy 2 1K 47
tcpfunc 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
CAM CCB 0 0K 4033
madt_table 0 0K 2
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
fpukern_ctx 0 0K 0
xen_intr 0 0K 0
CAM ccb queue 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 6418
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 41
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 5
allocindir 0 0K 0
indirdep 0 0K 79
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 24
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 3706
sctp_iter 0 0K 9
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 9
sctp_aadr 0 0K 0
sctp_stri 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 8
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
statfs 0 0K 10173
export_host 0 0K 0
cl_savebuf 0 0K 2
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
mbuf_tag 0 0K 478
accf 0 0K 0
pts 0 0K 0
iov 0 0K 17140
ioctlops 0 0K 1086
Witness 0 0K 0
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 729
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 7
filedesc_to_leader 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
db> show ktr
No such command; use "help" to list available commands
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 66f368ce Enter net epoch in msk_tick.
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=164eb611e00000
dashboard link: https://syzkaller.appspot.com/bug?extid=3473a0b2831970e18748
userspace arch: i386
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3473a0...@syzkaller.appspotmail.com
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:309
cpuid = 0
time = 28
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002450a780
vpanic() at vpanic+0x1ce/frame 0xfffffe002450a7f0
panic() at panic+0x43/frame 0xfffffe002450a850
__mtx_lock_flags() at __mtx_lock_flags+0x203/frame 0xfffffe002450a8b0
soo_stat() at soo_stat+0x9c/frame 0xfffffe002450a8f0
kern_fstat() at kern_fstat+0xed/frame 0xfffffe002450a940
freebsd11_freebsd32_fstat() at freebsd11_freebsd32_fstat+0x2d/frame 0xfffffe002450aab0
ia32_syscall() at ia32_syscall+0x48c/frame 0xfffffe002450abf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0x814269f
KDB: enter: panic
[ thread pid 10966 tid 101121 ]
Stopped at kdb_enter+0x67: movq $0,0x1466bf6(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0xfffffe0025400000
rdx 0x3ffff
rbx 0
rsp 0xfffffe002450a760
rbp 0xfffffe002450a780
rsi 0x40001
rdi 0xffffffff810ba3e6 vprintf+0x176
r8 0
r9 0xffffffff
r10 0
r11 0xfffff800291f1bd0
r12 0xffffffff82068d90 ddb_dbbe
r13 0
r14 0xffffffff819387da
r15 0xffffffff819387da
rip 0xffffffff810af4a7 kdb_enter+0x67
rflags 0x200086 kernphys+0x86
kdb_enter+0x67: movq $0,0x1466bf6(%rip)
db> show proc
Process 10966 (syz-executor.0) at 0xfffff800291c3000:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 768 at 0xfffff80003f73000
ABI: FreeBSD ELF32
arguments: /root/syz-executor.0
reaper: 0xfffff800032fa530 reapsubtree: 1
sigparent: 20
vmspace: 0xfffff80029199000
(map 0xfffff80029199000)
(map.pmap 0xfffff800291990c0)
(pmap 0xfffff80029199120)
threads: 5
100486 RunQ syz-executor.0
100165 S accept 0xfffff80003edf878 syz-executor.0
100168 S select 0xfffff80029534440 syz-executor.0
100170 Run CPU 1 syz-executor.0
101121 Run CPU 0 syz-executor.0
db> ps
pid ppid pgrp uid state wmesg wchan cmd
10969 784 784 0 S (threaded) syz-executor.3
101163 S nanslp 0xffffffff824feca0 syz-executor.3
100172 S pipdwt 0xfffff80003d97000 syz-executor.3
100185 S uwait 0xfffff8003ab27b80 syz-executor.3
10968 779 779 0 R (threaded) syz-executor.2
101137 RunQ syz-executor.2
100166 S connec 0xfffff80003ee20f0 syz-executor.2
100174 S select 0xfffff80029534640 syz-executor.2
100175 S uwait 0xfffff80003a46f00 syz-executor.2
10967 769 769 0 S (threaded) syz-executor.1
101174 S nanslp 0xffffffff824feca0 syz-executor.1
100156 S sbwait 0xfffff80003ee855c syz-executor.1
100171 S uwait 0xfffff80003a47a80 syz-executor.1
10966 768 768 0 R (threaded) syz-executor.0
100486 RunQ syz-executor.0
100165 S accept 0xfffff80003edf878 syz-executor.0
100168 S select 0xfffff80029534440 syz-executor.0
100170 Run CPU 1 syz-executor.0
101121 Run CPU 0 syz-executor.0
3116 1 3116 65 Ss select 0xfffff80003ce0ac0 dhclient
2558 1 2558 0 Ss select 0xfffff80029534540 dhclient
2555 1 2555 0 Ss select 0xfffff800295345c0 dhclient
2530 1 2530 65 Ss select 0xfffff80003ce0bc0 dhclient
2070 1 2070 0 Ss select 0xfffff80003ce0dc0 dhclient
2067 1 2067 0 Ss select 0xfffff80003cfa9c0 dhclient
2047 1 2047 65 Ss select 0xfffff800295346c0 dhclient
1668 1 1668 0 Ss select 0xfffff80003cfa6c0 dhclient
1665 1 1665 0 Ss select 0xfffff80003ce0d40 dhclient
1642 1 1642 65 Ss select 0xfffff80003ce0e40 dhclient
1041 1 1041 0 Ss select 0xfffff80003cfa840 dhclient
1037 1 1037 0 Ss select 0xfffff80003cfa740 dhclient
784 766 784 0 Ss nanslp 0xffffffff824feca0 syz-executor.3
779 766 779 0 Ss nanslp 0xffffffff824feca1 syz-executor.2
769 766 769 0 Ss nanslp 0xffffffff824feca1 syz-executor.1
768 766 768 0 Ss nanslp 0xffffffff824feca0 syz-executor.0
766 764 764 0 S (threaded) syz-fuzzer
100091 S uwait 0xfffff80003e20400 syz-fuzzer
100105 S uwait 0xfffff80003a4b080 syz-fuzzer
100106 S kqread 0xfffff8000333b900 syz-fuzzer
100107 S uwait 0xfffff80003a47c80 syz-fuzzer
100108 S uwait 0xfffff80003a47d80 syz-fuzzer
100109 S uwait 0xfffff80003a47e80 syz-fuzzer
100110 S uwait 0xfffff80003a46000 syz-fuzzer
100111 S uwait 0xfffff80003a46100 syz-fuzzer
100112 S uwait 0xfffff80003e1d080 syz-fuzzer
100113 S uwait 0xfffff80003a47780 syz-fuzzer
100114 S uwait 0xfffff80003e1d180 syz-fuzzer
764 762 764 0 Ss pause 0xfffff80003dfa5d8 csh
762 680 762 0 Ss select 0xfffff80003cf5740 sshd
746 1 746 0 Ss+ ttyin 0xfffff800033f6cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff800033f9cb0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003abc0b0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003abc4b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003abc8b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003abccb0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003abf0b0 getty
739 1 739 0 Ss+ ttyin 0xfffff80003abf4b0 getty
738 1 738 0 Ss+ ttyin 0xfffff80003abf8b0 getty
684 1 684 0 Ss nanslp 0xffffffff824feca1 cron
680 1 680 0 Ss select 0xfffff80003cf5640 sshd
493 1 493 0 Ss select 0xfffff80003d26840 syslogd
422 1 422 0 Ss select 0xfffff80003d26ec0 devd
421 1 421 65 Ss select 0xfffff80003d26940 dhclient
336 1 336 0 Ss select 0xfffff80003cf5540 dhclient
333 1 333 0 Ss select 0xfffff80003d269c0 dhclient
21 0 0 0 DL vlruwt 0xfffff80003afea60 [vnlru]
20 0 0 0 DL syncer 0xffffffff825d5118 [syncer]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d4618 [bufdaemon]
100070 D - 0xffffffff8200a980 [bufspacedaemon-0]
100080 D sdflush 0xfffff80003d038e8 [/ worker]
18 0 0 0 DL psleep 0xffffffff825f0088 [vmdaemon]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261cfd8 [dom0]
100068 D launds 0xffffffff8261cfe4 [laundry: dom0]
100069 D umarcl 0xffffffff8153dd30 [uma]
16 0 0 0 DL - 0xffffffff82359530 [rand_harvestq]
15 0 0 0 DL waiting 0xffffffff826625a0 [sctp_iterator]
9 0 0 0 DL - 0xffffffff825d401c [soaiod4]
8 0 0 0 DL - 0xffffffff825d401c [soaiod3]
7 0 0 0 DL - 0xffffffff825d401c [soaiod2]
6 0 0 0 DL - 0xffffffff825d401c [soaiod1]
5 0 0 0 DL (threaded) [cam]
100031 D - 0xffffffff82234940 [doneq0]
100062 D - 0xffffffff82234808 [scanner]
4 0 0 0 DL crypto_ 0xfffff800031f8e90 [crypto returns 1]
3 0 0 0 DL crypto_ 0xfffff800031f8e30 [crypto returns 0]
2 0 0 0 DL crypto_ 0xffffffff825ea0f8 [crypto]
14 0 0 0 DL seqstat 0xfffff80003363888 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100022 D - 0xffffffff8261b608 [g_event]
100023 D - 0xffffffff8261b618 [g_up]
100024 D - 0xffffffff8261b610 [g_down]
12 0 0 0 WL (threaded) [intr]
100006 I [swi5: fast taskq]
100010 I [swi6: task queue]
100011 I [swi6: Giant taskq]
100017 I [swi3: vm]
100018 I [swi4: clock (0)]
100019 I [swi4: clock (1)]
100020 I [swi1: netisr 0]
100032 I [irq24: virtio_pci0]
100033 I [irq25: virtio_pci0]
100034 I [irq26: virtio_pci0]
100035 I [irq27: virtio_pci0]
100036 I [irq28: virtio_pci1]
100037 I [irq29: virtio_pci1]
100038 I [irq30: virtio_pci1]
100039 I [irq31: virtio_pci1]
100040 I [irq32: virtio_pci1]
100045 I [irq10: virtio_pci2]
100047 I [irq1: atkbd0]
100048 I [irq12: psm0]
100049 I [swi0: uart uart++]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff800032fa530 [init]
10 0 0 0 DL audit_w 0xffffffff82663230 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff82609bf8 [swapper]
100005 D - 0xfffff8000333d000 [thread taskq]
100007 D - 0xfffff8000333cd00 [kqueue_ctx taskq]
100008 D - 0xfffff8000333cc00 [config_0]
100009 D - 0xfffff8000333cb00 [aiod_kick taskq]
100012 D - 0xfffff8000333c800 [if_config_tqg_0]
100013 D - 0xfffff8000333c700 [if_io_tqg_0]
100014 D - 0xfffff8000333c600 [if_io_tqg_1]
100015 D - 0xfffff8000333c500 [softirq_0]
100016 D - 0xfffff8000333c400 [softirq_1]
100021 D - 0xfffff8000333c300 [firmware taskq]
100026 D - 0xfffff8000333c200 [crypto_0]
100027 D - 0xfffff8000333c200 [crypto_1]
100041 D - 0xfffff8000333c000 [vtnet0 rxq 0]
100042 D - 0xfffff8000333be00 [vtnet0 txq 0]
100043 D - 0xfffff8000333bd00 [vtnet0 rxq 1]
100044 D - 0xfffff8000333bc00 [vtnet0 txq 1]
100046 D vtbslp 0xfffff800034d5400 [virtio_balloon]
100050 D - 0xfffff8000333bb00 [mca taskq]
100054 D - 0xffffffff81cdc2d0 [deadlkres]
100057 D - 0xfffff80003b37100 [acpi_task_0]
100058 D - 0xfffff80003b37100 [acpi_task_1]
100059 D - 0xfffff80003b37100 [acpi_task_2]
100061 D - 0xfffff8000333c100 [CAM taskq]
db> show all locks
Process 10967 (syz-executor.1) thread 0xfffff800297fd000 (100156)
exclusive sx so_rcv_sx (so_rcv_sx) r = 0 (0xfffff80003ee8500) locked @ /syzkaller/managers/i386/kernel/sys/kern/uipc_sockbuf.c:393
Process 10966 (syz-executor.0) thread 0xfffff800291dd6e0 (100170)
exclusive sleep mutex eventhandler (eventhandler) r = 0 (0xffffffff82515260) locked @ /syzkaller/managers/i386/kernel/sys/kern/subr_eventhandler.c:271
exclusive sleep mutex socket (socket) r = 0 (0xfffff80003edca98) locked @ /syzkaller/managers/i386/kernel/sys/netinet/tcp_usrreq.c:483
exclusive rw tcpinp (tcpinp) r = 0 (0xfffff8003a49e9a8) locked @ /syzkaller/managers/i386/kernel/sys/netinet/tcp_usrreq.c:475
db> show malloc
Type InUse MemUse Requests
devbuf 4213 4851K 4241
vtbuf 24 1968K 46
sysctloid 26527 1553K 26591
kobj 332 1328K 488
newblk 8 1026K 11031
vfscache 4 1025K 4
pcb 44 553K 14020
inodedep 14 519K 10775
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 143 285K 11052
acpica 1674 185K 49750
vnet_data 1 168K 1
filedesc 21 149K 19979
pagedep 9 130K 9997
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 222 89K 253
BPF 46 88K 46
bus 964 78K 3332
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 494 62K 494
umtx 340 43K 340
kdtrace 193 37K 37516
gtaskqueue 22 34K 22
hostcache 1 32K 1
shm 1 32K 82
DEVFS3 124 31K 134
msg 4 30K 4
DEVFS_RULE 56 27K 56
ifaddr 74 25K 76
kbdmux 6 22K 6
vmem 3 19K 4
temp 34 17K 2510
ufs_mount 3 17K 4
proc 3 17K 3
lltable 44 16K 404
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
ether_multi 172 14K 177
bus-sc 30 14K 1394
KTRACE 100 13K 100
sctp_timw 49 13K 49
ifnet 7 13K 7
kenv 95 12K 99
eventhandler 123 11K 123
in6_multi 89 11K 89
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 2 9K 10974
cred 33 9K 409
devstat 4 9K 4
UART 12 9K 12
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
routetbl 58 8K 62
select 59 8K 59
audit_evclass 231 8K 289
kqueue 63 7K 10976
CAM DEV 3 6K 510
plimit 24 6K 2319
sctp_atcl 11 6K 6126
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
DEVFSP 78 5K 82
ufs_dirhash 24 5K 24
taskqueue 42 5K 42
session 35 5K 53
pgrp 35 5K 60
memdesc 1 4K 1
MCA 32 4K 32
sctp_stro 4 4K 1861
evdev 4 4K 4
kcovinfo 64 4K 68
UMA 234 4K 234
lockf 32 4K 60
hhook 13 4K 13
proc-args 52 3K 685
acpisem 22 3K 22
terminal 11 3K 11
uidinfo 5 3K 12
sctp_ifa 17 3K 17
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
ip6ndp 12 2K 21
CAM XPT 22 2K 543
Unitno 27 2K 29009
in_multi 6 2K 7
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
tun 7 2K 7
freework 5 2K 10385
freeblks 4 1K 10336
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 84
NFSD session 1 1K 1
CAM periph 4 1K 271
mld 6 1K 6
sctp_ifn 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
mkdir 5 1K 19952
diradd 5 1K 10639
sctp_atky 15 1K 7989
inpcbpolicy 17 1K 6706
CAM SIM 2 1K 2
softdep 1 1K 1
freefile 4 1K 10594
pfil 4 1K 4
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
dirrem 3 1K 10597
osd 3 1K 9
newdirblk 4 1K 9976
vnodes 1 1K 221
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 3
sctp_athm 11 1K 6128
CAM path 4 1K 1034
apmdev 1 1K 1
atkbddev 2 1K 2
sctp_map 8 1K 3722
soname 5 1K 12757
pmchooks 1 1K 1
prison 4 1K 4
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
nexusdev 5 1K 5
filecaps 5 1K 120
entropy 2 1K 47
tcpfunc 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
CAM CCB 0 0K 4033
madt_table 0 0K 2
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
tempbuff 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
CCB List 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
fpukern_ctx 0 0K 0
xen_intr 0 0K 0
CAM ccb queue 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
mrsasbuf 0 0K 0
mpt_user 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
mps_user 0 0K 0
MPSSAS 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 6418
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 41
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 5
allocindir 0 0K 0
indirdep 0 0K 79
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 24
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 3706
sctp_iter 0 0K 9
sctp_mvrf 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_a_it 0 0K 9
sctp_aadr 0 0K 0
sctp_stri 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 8
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
statfs 0 0K 10173
export_host 0 0K 0
cl_savebuf 0 0K 2
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
mbuf_tag 0 0K 478
accf 0 0K 0
pts 0 0K 0
iov 0 0K 17140
ioctlops 0 0K 1086
Witness 0 0K 0
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 729
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 7
filedesc_to_leader 0 0K 0
tty console 0 0K 0
aaccam 0 0K 0
aacbuf 0 0K 0
zstd 0 0K 0
nvlist 0 0K 0
SCSI ENC 0 0K 0
SCSI sa 0 0K 0
isofs_node 0 0K 0
isofs_mount 0 0K 0
tr_raid5_data 0 0K 0
tr_raid1e_data 0 0K 0
tr_raid1_data 0 0K 0
tr_raid0_data 0 0K 0
tr_concat_data 0 0K 0
md_sii_data 0 0K 0
md_promise_data 0 0K 0
md_nvidia_data 0 0K 0
md_jmicron_data 0 0K 0
md_intel_data 0 0K 0
md_ddf_data 0 0K 0
raid_data 0 0K 72
geom_flashmap 0 0K 0
newnfsmnt 0 0K 0
newnfsclient_req 0 0K 0
NFSCL layrecall 0 0K 0
NFSCL session 0 0K 0
NFSCL sockreq 0 0K 0
NFSCL devinfo 0 0K 0
NFSCL flayout 0 0K 0
NFSCL layout 0 0K 0
NFSD rollback 0 0K 0
NFSCL diroffdiroff 0 0K 0
NEWdirectio 0 0K 0
NEWNFSnode 0 0K 0
NFSCL lck 0 0K 0
NFSCL lckown 0 0K 0
NFSCL client 0 0K 0
NFSCL deleg 0 0K 0
NFSCL open 0 0K 0
NFSCL owner 0 0K 0
NFS fh 0 0K 0
NFS req 0 0K 0
NFSD usrgroup 0 0K 0
NFSD string 0 0K 0
NFSD V4lock 0 0K 0
NFSD V4state 0 0K 0
NFSD srvcache 0 0K 0
msdosfs_fat 0 0K 0
msdosfs_mount 0 0K 0
msdosfs_node 0 0K 0
DEVFS4 0 0K 0
DEVFS2 0 0K 0
gntdev 0 0K 0
privcmd_dev 0 0K 0
evtchn_dev 0 0K 0
xenstore 0 0K 0
scsi_pass 0 0K 0
ciss_data 0 0K 0
xnb 0 0K 0
xbbd 0 0K 0
xbd 0 0K 0
Balloon 0 0K 0
sysmouse 0 0K 0
vtfont 0 0K 0
ath_hal 0 0K 0
athdev 0 0K 0
ata_pci 0 0K 0
ata_dma 0 0K 0
ata_generic 0 0K 0
amr 0 0K 0
scsi_da 0 0K 69
ata_da 0 0K 0
scsi_ch 0 0K 0
scsi_cd 0 0K 0
USBdev 0 0K 0
USB 0 0K 0
AHCI driver 0 0K 0
agp 0 0K 0
nvme_da 0 0K 0
acpipwr 0 0K 0
twsbuf 0 0K 0
twe_commands 0 0K 0
twa_commands 0 0K 0
tcp_log_dev 0 0K 0
midi buffers 0 0K 0
mixer 0 0K 0
ac97 0 0K 0
hdacc 0 0K 0
hdac 0 0K 0
hdaa 0 0K 0
acpi_perf 0 0K 0
acpicmbat 0 0K 0
SIIS driver 0 0K 0
db> show ktr
No such command; use "help" to list available commands
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Feb 11, 2020, 12:55:13 PM2/11/20
to syzkaller-f...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: b9b8cedc Use an int instead of a bool variable, since bool..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=124397a5e00000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12b832a1e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3473a0...@syzkaller.appspotmail.com
login: panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:309
cpuid = 0
time = 1581443332
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0024ac9720
vpanic() at vpanic+0x1ce/frame 0xfffffe0024ac9790
panic() at panic+0x43/frame 0xfffffe0024ac97f0
__mtx_lock_flags() at __mtx_lock_flags+0x203/frame 0xfffffe0024ac9850
soo_stat() at soo_stat+0x9c/frame 0xfffffe0024ac9890
kern_fstat() at kern_fstat+0xe4/frame 0xfffffe0024ac98e0
freebsd32_fstat() at freebsd32_fstat+0x2b/frame 0xfffffe0024ac9ab0
ia32_syscall() at ia32_syscall+0x494/frame 0xfffffe0024ac9bf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0x81426a9
KDB: enter: panic
[ thread pid 952 tid 100486 ]
Stopped at kdb_enter+0x67: movq $0,0x1466466(%rip)
rdx 0xffffffff818f1c61
rbx 0
rsp 0xfffffe0024ac9700
rbp 0xfffffe0024ac9720
rsi 0x1
rdi 0
r12 0xffffffff82068dc0 ddb_dbbe
r13 0
r14 0xffffffff81939d78
r15 0xffffffff81939d78
rip 0xffffffff810b0c57 kdb_enter+0x67
rflags 0x200086 kernphys+0x86
kdb_enter+0x67: movq $0,0x1466466(%rip)
db> show proc
Process 952 (syz-executor.2) at 0xfffff8003a89f530:
ABI: FreeBSD ELF32
arguments: /root/syz-executor.2
reaper: 0xfffff800032d4000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe00249a59e8
(map 0xfffffe00249a59e8)
(map.pmap 0xfffffe00249a5aa8)
(pmap 0xfffffe00249a5b08)
threads: 4
100220 Run CPU 1 syz-executor.2
100475 S select 0xfffff800039ae2c0 syz-executor.2
100476 S uwait 0xfffff80003be4580 syz-executor.2
100486 Run CPU 0 syz-executor.2
100088 S nanslp 0xffffffff824ffcc1 syz-executor.3
100484 S select 0xfffff80003bea6c0 syz-executor.3
100485 S uwait 0xfffff800039b1780 syz-executor.3
954 775 775 0 S (threaded) syz-executor.1
100202 S nanslp 0xffffffff824ffcc1 syz-executor.1
100480 S select 0xfffff800039ae1c0 syz-executor.1
100482 S uwait 0xfffff800039ae100 syz-executor.1
953 773 773 0 S (threaded) syz-executor.0
100176 S nanslp 0xffffffff824ffcc0 syz-executor.0
100478 S select 0xfffff80003beaa40 syz-executor.0
100481 S uwait 0xfffff800039b1d00 syz-executor.0
952 776 776 0 R (threaded) syz-executor.2
100220 Run CPU 1 syz-executor.2
100475 S select 0xfffff800039ae2c0 syz-executor.2
100476 S uwait 0xfffff80003be4580 syz-executor.2
100486 Run CPU 0 syz-executor.2
826 816 826 0 Ss select 0xfffff80003beac40 dhclient
823 1 823 0 Ss select 0xfffff800039aee40 dhclient
816 801 422 65 S select 0xfffff80003be4dc0 dhclient
801 422 422 0 S wait 0xfffff80003c01a60 sh
776 771 776 0 Ss nanslp 0xffffffff824ffcc1 syz-executor.2
775 771 775 0 Rs syz-executor.1
774 771 774 0 Ss nanslp 0xffffffff824ffcc1 syz-executor.3
773 771 773 0 Ss nanslp 0xffffffff824ffcc0 syz-executor.0
771 769 769 0 S (threaded) syz-execprog
100091 S uwait 0xfffff800039b0b00 syz-execprog
100100 S uwait 0xfffff800039b0380 syz-execprog
100101 S kqread 0xfffff80003b5a200 syz-execprog
100102 S uwait 0xfffff800039b0600 syz-execprog
100103 S uwait 0xfffff800039b0700 syz-execprog
100104 S uwait 0xfffff80003bcf500 syz-execprog
100105 S uwait 0xfffff80003bcf600 syz-execprog
100106 S uwait 0xfffff80003bcf700 syz-execprog
100107 S uwait 0xfffff80003bcf800 syz-execprog
100108 S uwait 0xfffff80003bcf900 syz-execprog
100109 S uwait 0xfffff80003bcfa00 syz-execprog
769 767 769 0 Ss pause 0xfffff8003a49e5d8 csh
767 680 767 0 Ss select 0xfffff80003be4940 sshd
746 1 746 0 Ss+ ttyin 0xfffff800033f5cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003a928b0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003a92cb0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003a950b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003a954b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003a958b0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003a95cb0 getty
739 1 739 0 Ss+ ttyin 0xfffff80003a940b0 getty
738 1 738 0 Ss+ ttyin 0xfffff80003a944b0 getty
736 1 22 0 S+ piperd 0xfffff80003bf92f8 logger
735 734 22 0 S+ nanslp 0xffffffff824ffcc0 sleep
734 1 22 0 S+ wait 0xfffff80003bec530 sh
684 1 684 0 Ss nanslp 0xffffffff824ffcc0 cron
680 1 680 0 Ss select 0xfffff800039b1b40 sshd
493 1 493 0 Ss select 0xfffff80003be49c0 syslogd
422 1 422 0 Ss wait 0xfffff80003be5530 devd
421 1 421 65 Ss select 0xfffff800039b0540 dhclient
336 1 336 0 Ss select 0xfffff80003be4f40 dhclient
333 1 333 0 Ss select 0xfffff80003bce2c0 dhclient
21 0 0 0 DL syncer 0xffffffff825d6158 [syncer]
20 0 0 0 DL vlruwt 0xfffff80003a70000 [vnlru]
18 0 0 0 DL psleep 0xffffffff825f10c8 [vmdaemon]
100068 D launds 0xffffffff8261dfe4 [laundry: dom0]
100069 D umarcl 0xffffffff81540820 [uma]
16 0 0 0 DL - 0xffffffff8235a530 [rand_harvestq]
15 0 0 0 DL waiting 0xffffffff826635a0 [sctp_iterator]
9 0 0 0 DL - 0xffffffff825d505c [soaiod4]
8 0 0 0 DL - 0xffffffff825d505c [soaiod3]
7 0 0 0 DL - 0xffffffff825d505c [soaiod2]
6 0 0 0 DL - 0xffffffff825d505c [soaiod1]
100062 D - 0xffffffff82235808 [scanner]
4 0 0 0 DL crypto_ 0xfffff80003303190 [crypto returns 1]
3 0 0 0 DL crypto_ 0xfffff80003303130 [crypto returns 0]
2 0 0 0 DL crypto_ 0xffffffff825eb138 [crypto]
14 0 0 0 DL seqstat 0xfffff8000333a888 [sequencer 00]
100023 D - 0xffffffff8261c618 [g_up]
100024 D - 0xffffffff8261c610 [g_down]
100009 I [swi6: task queue]
100010 I [swi6: Giant taskq]
100017 I [swi3: vm]
100018 I [swi1: netisr 0]
100019 I [swi4: clock (0)]
100020 I [swi4: clock (1)]
10 0 0 0 DL audit_w 0xffffffff82664230 [audit]
100006 D - 0xfffff800031d4000 [config_0]
100007 D - 0xfffff800031d8800 [kqueue_ctx taskq]
100008 D - 0xfffff800031d8600 [aiod_kick taskq]
100011 D - 0xfffff800031d8000 [thread taskq]
100012 D - 0xfffff800031d3e00 [softirq_0]
100013 D - 0xfffff800031d3d00 [softirq_1]
100014 D - 0xfffff800031d3c00 [if_io_tqg_0]
100015 D - 0xfffff800031d3b00 [if_io_tqg_1]
100016 D - 0xfffff800031d3a00 [if_config_tqg_0]
100021 D - 0xfffff800031d7400 [firmware taskq]
100026 D - 0xfffff800031d6d00 [crypto_0]
100027 D - 0xfffff800031d6d00 [crypto_1]
100041 D - 0xfffff800031d6000 [vtnet0 rxq 0]
100042 D - 0xfffff800031d5e00 [vtnet0 txq 0]
100043 D - 0xfffff800031d5d00 [vtnet0 rxq 1]
100044 D - 0xfffff800031d5c00 [vtnet0 txq 1]
100046 D vtbslp 0xfffff8000352f880 [virtio_balloon]
100050 D - 0xfffff80003774e00 [mca taskq]
100055 D - 0xffffffff81cddfa1 [deadlkres]
100057 D - 0xfffff800039b4700 [acpi_task_0]
100058 D - 0xfffff800039b4700 [acpi_task_1]
100059 D - 0xfffff800039b4700 [acpi_task_2]
100061 D - 0xfffff800031d6600 [CAM taskq]
db> show all locks
Process 952 (syz-executor.2) thread 0xfffffe0024960c00 (100220)
exclusive sleep mutex umtxql (umtxql) r = 0 (0xffffffff8250bb50) locked @ /syzkaller/managers/i386/kernel/sys/kern/kern_umtx.c:507
vtbuf 24 1968K 46
sysctloid 26632 1559K 26696
kobj 332 1328K 488
newblk 381 1119K 561
vfscache 4 1025K 4
inodedep 89 556K 223
pcb 27 537K 346
acpica 1674 185K 50140
vnet_data 1 168K 1
filedesc 22 153K 328
pagedep 26 135K 160
BPF 22 36K 22
kdtrace 181 35K 2335
vmem 3 22K 4
kbdmux 6 22K 6
lltable 47 18K 47
temp 34 17K 1834
KTRACE 100 13K 100
in6_multi 89 11K 89
eventhandler 122 11K 122
cred 28 7K 240
select 51 7K 51
diradd 50 7K 191
plimit 22 6K 365
UMA 235 4K 235
session 26 4K 37
pgrp 26 4K 37
hhook 13 4K 13
freefile 24 3K 138
mkdir 20 3K 298
indirdep 10 3K 10
uidinfo 4 3K 4
ipsec-saq 2 2K 2
lockf 19 2K 29
ip6ndp 12 2K 21
Unitno 29 2K 45
softdep 1 1K 1
freeblks 4 1K 154
encap_export_host 8 1K 8
inpcbpolicy 12 1K 430
osd 3 1K 9
vnodes 1 1K 1
nexusdev 5 1K 5
entropy 2 1K 41
mps_user 0 0K 0
sctp_iter 0 0K 7
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 7
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
ioctlops 0 0K 96
db>
HEAD commit: b9b8cedc Use an int instead of a bool variable, since bool..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=124397a5e00000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12b832a1e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3473a0...@syzkaller.appspotmail.com
cpuid = 0
time = 1581443332
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0024ac9720
vpanic() at vpanic+0x1ce/frame 0xfffffe0024ac9790
panic() at panic+0x43/frame 0xfffffe0024ac97f0
__mtx_lock_flags() at __mtx_lock_flags+0x203/frame 0xfffffe0024ac9850
soo_stat() at soo_stat+0x9c/frame 0xfffffe0024ac9890
kern_fstat() at kern_fstat+0xe4/frame 0xfffffe0024ac98e0
freebsd32_fstat() at freebsd32_fstat+0x2b/frame 0xfffffe0024ac9ab0
ia32_syscall() at ia32_syscall+0x494/frame 0xfffffe0024ac9bf0
int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0x81426a9
KDB: enter: panic
[ thread pid 952 tid 100486 ]
Stopped at kdb_enter+0x67: movq $0,0x1466466(%rip)
db>
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0x80 ll+0x5f
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs 0x20
ds 0x3b ll+0x1a
es 0x3b ll+0x1a
fs 0x13
gs 0x1b
ss 0
rax 0x12
rdx 0xffffffff818f1c61
rbx 0
rsp 0xfffffe0024ac9700
rbp 0xfffffe0024ac9720
rsi 0x1
rdi 0
r8 0
r9 0xffffffff
r10 0
r11 0xfffffe00249b5f00
r9 0xffffffff
r10 0
r12 0xffffffff82068dc0 ddb_dbbe
r13 0
r14 0xffffffff81939d78
r15 0xffffffff81939d78
rip 0xffffffff810b0c57 kdb_enter+0x67
rflags 0x200086 kernphys+0x86
kdb_enter+0x67: movq $0,0x1466466(%rip)
db> show proc
Process 952 (syz-executor.2) at 0xfffff8003a89f530:
state: NORMAL
uid: 0 gids: 0, 0, 5
parent: pid 776 at 0xfffff80003bd8530
uid: 0 gids: 0, 0, 5
ABI: FreeBSD ELF32
arguments: /root/syz-executor.2
reaper: 0xfffff800032d4000 reapsubtree: 1
sigparent: 20
vmspace: 0xfffffe00249a59e8
(map 0xfffffe00249a59e8)
(map.pmap 0xfffffe00249a5aa8)
(pmap 0xfffffe00249a5b08)
threads: 4
100220 Run CPU 1 syz-executor.2
100475 S select 0xfffff800039ae2c0 syz-executor.2
100476 S uwait 0xfffff80003be4580 syz-executor.2
100486 Run CPU 0 syz-executor.2
db> ps
pid ppid pgrp uid state wmesg wchan cmd
955 774 774 0 S (threaded) syz-executor.3
pid ppid pgrp uid state wmesg wchan cmd
100088 S nanslp 0xffffffff824ffcc1 syz-executor.3
100484 S select 0xfffff80003bea6c0 syz-executor.3
100485 S uwait 0xfffff800039b1780 syz-executor.3
954 775 775 0 S (threaded) syz-executor.1
100202 S nanslp 0xffffffff824ffcc1 syz-executor.1
100480 S select 0xfffff800039ae1c0 syz-executor.1
100482 S uwait 0xfffff800039ae100 syz-executor.1
953 773 773 0 S (threaded) syz-executor.0
100176 S nanslp 0xffffffff824ffcc0 syz-executor.0
100478 S select 0xfffff80003beaa40 syz-executor.0
100481 S uwait 0xfffff800039b1d00 syz-executor.0
952 776 776 0 R (threaded) syz-executor.2
100220 Run CPU 1 syz-executor.2
100475 S select 0xfffff800039ae2c0 syz-executor.2
100476 S uwait 0xfffff80003be4580 syz-executor.2
100486 Run CPU 0 syz-executor.2
826 816 826 0 Ss select 0xfffff80003beac40 dhclient
823 1 823 0 Ss select 0xfffff800039aee40 dhclient
816 801 422 65 S select 0xfffff80003be4dc0 dhclient
801 422 422 0 S wait 0xfffff80003c01a60 sh
776 771 776 0 Ss nanslp 0xffffffff824ffcc1 syz-executor.2
775 771 775 0 Rs syz-executor.1
774 771 774 0 Ss nanslp 0xffffffff824ffcc1 syz-executor.3
773 771 773 0 Ss nanslp 0xffffffff824ffcc0 syz-executor.0
771 769 769 0 S (threaded) syz-execprog
100091 S uwait 0xfffff800039b0b00 syz-execprog
100100 S uwait 0xfffff800039b0380 syz-execprog
100101 S kqread 0xfffff80003b5a200 syz-execprog
100102 S uwait 0xfffff800039b0600 syz-execprog
100103 S uwait 0xfffff800039b0700 syz-execprog
100104 S uwait 0xfffff80003bcf500 syz-execprog
100105 S uwait 0xfffff80003bcf600 syz-execprog
100106 S uwait 0xfffff80003bcf700 syz-execprog
100107 S uwait 0xfffff80003bcf800 syz-execprog
100108 S uwait 0xfffff80003bcf900 syz-execprog
100109 S uwait 0xfffff80003bcfa00 syz-execprog
769 767 769 0 Ss pause 0xfffff8003a49e5d8 csh
767 680 767 0 Ss select 0xfffff80003be4940 sshd
746 1 746 0 Ss+ ttyin 0xfffff800033f5cb0 getty
745 1 745 0 Ss+ ttyin 0xfffff80003a928b0 getty
744 1 744 0 Ss+ ttyin 0xfffff80003a92cb0 getty
743 1 743 0 Ss+ ttyin 0xfffff80003a950b0 getty
742 1 742 0 Ss+ ttyin 0xfffff80003a954b0 getty
741 1 741 0 Ss+ ttyin 0xfffff80003a958b0 getty
740 1 740 0 Ss+ ttyin 0xfffff80003a95cb0 getty
739 1 739 0 Ss+ ttyin 0xfffff80003a940b0 getty
738 1 738 0 Ss+ ttyin 0xfffff80003a944b0 getty
736 1 22 0 S+ piperd 0xfffff80003bf92f8 logger
735 734 22 0 S+ nanslp 0xffffffff824ffcc0 sleep
734 1 22 0 S+ wait 0xfffff80003bec530 sh
684 1 684 0 Ss nanslp 0xffffffff824ffcc0 cron
680 1 680 0 Ss select 0xfffff800039b1b40 sshd
493 1 493 0 Ss select 0xfffff80003be49c0 syslogd
422 1 422 0 Ss wait 0xfffff80003be5530 devd
421 1 421 65 Ss select 0xfffff800039b0540 dhclient
336 1 336 0 Ss select 0xfffff80003be4f40 dhclient
333 1 333 0 Ss select 0xfffff80003bce2c0 dhclient
21 0 0 0 DL syncer 0xffffffff825d6158 [syncer]
20 0 0 0 DL vlruwt 0xfffff80003a70000 [vnlru]
19 0 0 0 DL (threaded) [bufdaemon]
100065 D qsleep 0xffffffff825d5658 [bufdaemon]
100070 D - 0xffffffff8200a980 [bufspacedaemon-0]
100081 D sdflush 0xfffff80003b648e8 [/ worker]
18 0 0 0 DL psleep 0xffffffff825f10c8 [vmdaemon]
17 0 0 0 DL (threaded) [pagedaemon]
100063 D psleep 0xffffffff8261dfd8 [dom0]
100068 D launds 0xffffffff8261dfe4 [laundry: dom0]
100069 D umarcl 0xffffffff81540820 [uma]
16 0 0 0 DL - 0xffffffff8235a530 [rand_harvestq]
15 0 0 0 DL waiting 0xffffffff826635a0 [sctp_iterator]
9 0 0 0 DL - 0xffffffff825d505c [soaiod4]
8 0 0 0 DL - 0xffffffff825d505c [soaiod3]
7 0 0 0 DL - 0xffffffff825d505c [soaiod2]
6 0 0 0 DL - 0xffffffff825d505c [soaiod1]
5 0 0 0 DL (threaded) [cam]
100031 D - 0xffffffff82235940 [doneq0]
100062 D - 0xffffffff82235808 [scanner]
4 0 0 0 DL crypto_ 0xfffff80003303190 [crypto returns 1]
3 0 0 0 DL crypto_ 0xfffff80003303130 [crypto returns 0]
2 0 0 0 DL crypto_ 0xffffffff825eb138 [crypto]
14 0 0 0 DL seqstat 0xfffff8000333a888 [sequencer 00]
13 0 0 0 DL (threaded) [geom]
100022 D - 0xffffffff8261c608 [g_event]
100023 D - 0xffffffff8261c618 [g_up]
100024 D - 0xffffffff8261c610 [g_down]
12 0 0 0 WL (threaded) [intr]
100005 I [swi5: fast taskq]
100009 I [swi6: task queue]
100010 I [swi6: Giant taskq]
100017 I [swi3: vm]
100018 I [swi1: netisr 0]
100019 I [swi4: clock (0)]
100020 I [swi4: clock (1)]
100032 I [irq24: virtio_pci0]
100033 I [irq25: virtio_pci0]
100034 I [irq26: virtio_pci0]
100035 I [irq27: virtio_pci0]
100036 I [irq28: virtio_pci1]
100037 I [irq29: virtio_pci1]
100038 I [irq30: virtio_pci1]
100039 I [irq31: virtio_pci1]
100040 I [irq32: virtio_pci1]
100045 I [irq10: virtio_pci2]
100047 I [irq1: atkbd0]
100048 I [irq12: psm0]
100049 I [swi0: uart uart++]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
1 0 1 0 SLs wait 0xfffff800032d4000 [init]
100033 I [irq25: virtio_pci0]
100034 I [irq26: virtio_pci0]
100035 I [irq27: virtio_pci0]
100036 I [irq28: virtio_pci1]
100037 I [irq29: virtio_pci1]
100038 I [irq30: virtio_pci1]
100039 I [irq31: virtio_pci1]
100040 I [irq32: virtio_pci1]
100045 I [irq10: virtio_pci2]
100047 I [irq1: atkbd0]
100048 I [irq12: psm0]
100049 I [swi0: uart uart++]
11 0 0 0 RL (threaded) [idle]
100003 CanRun [idle: cpu0]
100004 CanRun [idle: cpu1]
10 0 0 0 DL audit_w 0xffffffff82664230 [audit]
0 0 0 0 DLs (threaded) [kernel]
100000 D swapin 0xffffffff8260ac48 [swapper]
100006 D - 0xfffff800031d4000 [config_0]
100007 D - 0xfffff800031d8800 [kqueue_ctx taskq]
100008 D - 0xfffff800031d8600 [aiod_kick taskq]
100011 D - 0xfffff800031d8000 [thread taskq]
100012 D - 0xfffff800031d3e00 [softirq_0]
100013 D - 0xfffff800031d3d00 [softirq_1]
100014 D - 0xfffff800031d3c00 [if_io_tqg_0]
100015 D - 0xfffff800031d3b00 [if_io_tqg_1]
100016 D - 0xfffff800031d3a00 [if_config_tqg_0]
100021 D - 0xfffff800031d7400 [firmware taskq]
100026 D - 0xfffff800031d6d00 [crypto_0]
100027 D - 0xfffff800031d6d00 [crypto_1]
100041 D - 0xfffff800031d6000 [vtnet0 rxq 0]
100042 D - 0xfffff800031d5e00 [vtnet0 txq 0]
100043 D - 0xfffff800031d5d00 [vtnet0 rxq 1]
100044 D - 0xfffff800031d5c00 [vtnet0 txq 1]
100046 D vtbslp 0xfffff8000352f880 [virtio_balloon]
100050 D - 0xfffff80003774e00 [mca taskq]
100055 D - 0xffffffff81cddfa1 [deadlkres]
100057 D - 0xfffff800039b4700 [acpi_task_0]
100058 D - 0xfffff800039b4700 [acpi_task_1]
100059 D - 0xfffff800039b4700 [acpi_task_2]
100061 D - 0xfffff800031d6600 [CAM taskq]
db> show all locks
Process 952 (syz-executor.2) thread 0xfffffe0024960c00 (100220)
exclusive sleep mutex umtxql (umtxql) r = 0 (0xffffffff8250bb50) locked @ /syzkaller/managers/i386/kernel/sys/kern/kern_umtx.c:507
db> show malloc
Type InUse MemUse Requests
devbuf 4213 4851K 4238
Type InUse MemUse Requests
vtbuf 24 1968K 46
sysctloid 26632 1559K 26696
kobj 332 1328K 488
newblk 381 1119K 561
vfscache 4 1025K 4
inodedep 89 556K 223
pcb 27 537K 346
ufs_quota 1 512K 1
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
subproc 123 258K 1023
vfs_hash 1 512K 1
callout 2 512K 2
intr 4 388K 4
acpica 1674 185K 50140
vnet_data 1 168K 1
filedesc 22 153K 328
pagedep 26 135K 160
tfo_ccache 1 128K 1
sem 4 106K 4
DEVFS1 105 105K 122
linker 222 89K 253
bus 988 79K 3335
sem 4 106K 4
DEVFS1 105 105K 122
linker 222 89K 253
mtx_pool 2 72K 2
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 494 62K 494
umtx 306 39K 306
syncache 1 68K 1
acpitask 1 64K 1
ddb_capture 1 64K 1
module 494 62K 494
BPF 22 36K 22
kdtrace 181 35K 2335
gtaskqueue 22 34K 22
hostcache 1 32K 1
shm 1 32K 1
hostcache 1 32K 1
DEVFS3 124 31K 134
msg 4 30K 4
DEVFS_RULE 56 27K 56
ifaddr 71 24K 73
msg 4 30K 4
DEVFS_RULE 56 27K 56
vmem 3 22K 4
kbdmux 6 22K 6
lltable 47 18K 47
temp 34 17K 1834
ufs_mount 3 17K 4
proc 3 17K 3
proc 3 17K 3
tty 16 16K 16
tidhash 1 16K 1
ithread 89 15K 89
ether_multi 172 14K 177
bus-sc 30 14K 1397
tidhash 1 16K 1
ithread 89 15K 89
ether_multi 172 14K 177
KTRACE 100 13K 100
ifnet 7 13K 7
kenv 95 12K 99
dirrem 41 11K 157
kenv 95 12K 99
in6_multi 89 11K 89
eventhandler 122 11K 122
pfs_nodes 20 10K 20
GEOM 60 10K 487
rman 82 10K 423
bmsafemap 2 9K 192
GEOM 60 10K 487
rman 82 10K 423
devstat 4 9K 4
UART 12 9K 12
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
routetbl 58 8K 62
audit_evclass 231 8K 289
UART 12 9K 12
rpc 2 8K 2
shmfd 1 8K 1
pfs_vncache 1 8K 1
routetbl 58 8K 62
cred 28 7K 240
select 51 7K 51
diradd 50 7K 191
CAM DEV 3 6K 510
kqueue 58 6K 960
plimit 22 6K 365
vt 11 6K 11
sglist 5 6K 5
CAM queue 5 6K 1528
sglist 5 6K 5
CAM queue 5 6K 1528
ufs_dirhash 24 5K 24
taskqueue 42 5K 42
taskqueue 42 5K 42
memdesc 1 4K 1
MCA 32 4K 32
evdev 4 4K 4
MCA 32 4K 32
UMA 235 4K 235
session 26 4K 37
pgrp 26 4K 37
hhook 13 4K 13
freefile 24 3K 138
acpisem 22 3K 22
terminal 11 3K 11
proc-args 47 3K 548
terminal 11 3K 11
mkdir 20 3K 298
indirdep 10 3K 10
uidinfo 4 3K 4
sctp_ifa 17 3K 17
local_apic 1 2K 1
io_apic 1 2K 1
newdirblk 16 2K 149
local_apic 1 2K 1
io_apic 1 2K 1
ipsec-saq 2 2K 2
lockf 19 2K 29
ip6ndp 12 2K 21
Unitno 29 2K 45
CAM XPT 22 2K 543
in_multi 6 2K 7
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
tun 7 2K 7
freework 5 2K 155
acpidev 20 2K 20
crypto 2 2K 2
msi 9 2K 9
tun 7 2K 7
softdep 1 1K 1
freeblks 4 1K 154
ipsecpolicy 1 1K 1
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 8
sahead 1 1K 1
secasvar 1 1K 1
clone 8 1K 8
vnodemarker 2 1K 8
NFSD session 1 1K 1
CAM periph 4 1K 271
mld 6 1K 6
sctp_ifn 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
CAM periph 4 1K 271
mld 6 1K 6
sctp_ifn 6 1K 6
igmp 6 1K 6
toponodes 6 1K 6
isadev 6 1K 6
mount 16 1K 86
pci_link 10 1K 10
CAM SIM 2 1K 2
pfil 4 1K 4
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
DEVFSP 8 1K 8
chacha20random 1 1K 1
epoch 4 1K 4
cdev 2 1K 2
encap_export_host 8 1K 8
inpcbpolicy 12 1K 430
osd 3 1K 9
vnodes 1 1K 1
NFSD lckfile 1 1K 1
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 3
NFSD V4client 1 1K 1
DEVFS 9 1K 10
feeder 7 1K 7
loginclass 3 1K 3
CAM path 4 1K 1034
apmdev 1 1K 1
atkbddev 2 1K 2
apmdev 1 1K 1
atkbddev 2 1K 2
pmchooks 1 1K 1
prison 4 1K 4
filecaps 5 1K 72
prison 4 1K 4
CAM dev queue 2 1K 2
CAM I/O Scheduler 1 1K 1
soname 4 1K 5766
CAM I/O Scheduler 1 1K 1
nexusdev 5 1K 5
entropy 2 1K 41
tcpfunc 1 1K 1
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
CAM CCB 0 0K 1833
sctp_vrf 1 1K 1
vnet 1 1K 1
acpiintr 1 1K 1
pmc 1 1K 1
cpus 2 1K 2
vnet_data_free 1 1K 1
Per-cpu 1 1K 1
p1003.1b 1 1K 1
madt_table 0 0K 2
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
PUC 0 0K 0
ppbusdev 0 0K 0
agtiapi_MemAlloc malloc 0 0K 0
osti_cacheable 0 0K 0
tempbuff 0 0K 0
pvscsi 0 0K 0
smartpqi 0 0K 0
tempbuff 0 0K 0
smartpqi 0 0K 0
ag_tgt_map_t malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
ag_slr_map_t malloc 0 0K 0
lDevFlags * malloc 0 0K 0
tiDeviceHandle_t * malloc 0 0K 0
ag_portal_data_t malloc 0 0K 0
ag_device_t malloc 0 0K 0
STLock malloc 0 0K 0
iavf 0 0K 0
ixl 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
fpukern_ctx 0 0K 0
ixl 0 0K 0
CCB List 0 0K 0
sr_iov 0 0K 0
OCS 0 0K 0
OCS 0 0K 0
nvme 0 0K 0
nvd 0 0K 0
netmap 0 0K 0
mwldev 0 0K 0
MVS driver 0 0K 0
xen_intr 0 0K 0
xen_hvm 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
CAM ccb queue 0 0K 0
mrsasbuf 0 0K 0
legacydrv 0 0K 0
qpidrv 0 0K 0
CAM ccb queue 0 0K 0
dmar_idpgtbl 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
mpt_user 0 0K 0
dmar_dom 0 0K 0
dmar_ctx 0 0K 0
dmar_dmamap 0 0K 0
mps_user 0 0K 0
isci 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
MPSSAS 0 0K 0
bxe_ilt 0 0K 0
xenbus 0 0K 0
vm_fictitious 0 0K 0
mps 0 0K 0
mpr_user 0 0K 0
MPRSAS 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
savedino 0 0K 117
mpr_user 0 0K 0
MPRSAS 0 0K 0
UMAHash 0 0K 0
vm_pgdata 0 0K 0
jblocks 0 0K 0
sentinel 0 0K 0
jfsync 0 0K 0
jtrunc 0 0K 0
sbdep 0 0K 3
jfsync 0 0K 0
jtrunc 0 0K 0
jsegdep 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 5
allocindir 0 0K 0
jseg 0 0K 0
jfreefrag 0 0K 0
jfreeblk 0 0K 0
jnewblk 0 0K 0
jmvref 0 0K 0
jremref 0 0K 0
jaddref 0 0K 0
freedep 0 0K 0
freefrag 0 0K 5
allocindir 0 0K 0
allocdirect 0 0K 0
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6opt 0 0K 3
ufs_trim 0 0K 0
mactemp 0 0K 0
audit_trigger 0 0K 0
audit_pipe_presel 0 0K 0
audit_pipeent 0 0K 0
audit_pipe 0 0K 0
audit_evname 0 0K 0
audit_bsm 0 0K 0
audit_gidset 0 0K 0
audit_text 0 0K 0
audit_path 0 0K 0
audit_data 0 0K 0
audit_cred 0 0K 0
xform 0 0K 0
NLM 0 0K 0
nfsclient_nlminfo 0 0K 0
nfsclient_lock 0 0K 0
NFS FHA 0 0K 0
ipsec-spdcache 0 0K 0
ipsec-reg 0 0K 0
ipsec-misc 0 0K 0
ipsecrequest 0 0K 0
ip6_msource 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_socko 0 0K 0
ip6_moptions 0 0K 0
in6_mfilter 0 0K 0
frag6 0 0K 0
tcplog 0 0K 0
LRO 0 0K 0
sctp_mcore 0 0K 0
sctp_iter 0 0K 7
sctp_mvrf 0 0K 0
sctp_timw 0 0K 0
sctp_cpal 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_athm 0 0K 0
sctp_cmsg 0 0K 0
sctp_stre 0 0K 0
sctp_athi 0 0K 0
sctp_atky 0 0K 0
sctp_atcl 0 0K 0
sctp_a_it 0 0K 7
sctp_aadr 0 0K 0
sctp_stro 0 0K 0
sctp_stri 0 0K 0
sctp_map 0 0K 0
newreno data 0 0K 0
ip_msource 0 0K 0
ip_moptions 0 0K 0
ip_msource 0 0K 0
in_mfilter 0 0K 0
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
statfs 0 0K 324
ipid 0 0K 0
80211scan 0 0K 0
80211ratectl 0 0K 0
80211power 0 0K 0
80211nodeie 0 0K 0
80211node 0 0K 0
80211mesh_gt 0 0K 0
80211mesh_rt 0 0K 0
80211perr 0 0K 0
80211prep 0 0K 0
80211preq 0 0K 0
80211dfs 0 0K 0
80211crypto 0 0K 0
80211vap 0 0K 0
iflib 0 0K 0
vlan 0 0K 0
gif 0 0K 0
ifdescr 0 0K 0
zlib 0 0K 0
fadvise 0 0K 0
mpr 0 0K 0
export_host 0 0K 0
cl_savebuf 0 0K 2
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
mbuf_tag 0 0K 111
cl_savebuf 0 0K 2
biobuf 0 0K 0
aios 0 0K 0
lio 0 0K 0
acl 0 0K 0
mfibuf 0 0K 0
accf 0 0K 0
pts 0 0K 0
iov 0 0K 13491
pts 0 0K 0
ioctlops 0 0K 96
Witness 0 0K 0
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctltmp 0 0K 593
stack 0 0K 0
md_sectors 0 0K 0
sbuf 0 0K 288
md_disk 0 0K 0
compressor 0 0K 0
malodev 0 0K 0
SWAP 0 0K 0
LED 0 0K 0
sysctl 0 0K 1
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
kcovinfo 0 0K 0
ekcd 0 0K 0
dumper 0 0K 0
rctl 0 0K 0
ix_sriov 0 0K 0
aacraidcam 0 0K 0
ix 0 0K 0
ipsbuf 0 0K 0
iirbuf 0 0K 0
cache 0 0K 0
aacraid_buf 0 0K 0
prison_racct 0 0K 0
Fail Points 0 0K 0
sigio 0 0K 1
Fail Points 0 0K 0
Reply all
Reply to author
Forward
0 new messages