UBSan: Undefined Behavior in config_devalloc

0 views

Skip to first unread message

syzbot

unread,

Jul 29, 2020, 3:51:16 AM7/29/20

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 47132c89 cninit - don't reset cn_tab on entry.
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1754389b100000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=a63ae6c58df86f40b6f3
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a63ae6...@syzkaller.appspotmail.com

[ 72.0975056] panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/subr_autoconf.c:1343:19, pointer expression with base 0 overflowed to 0xfffffffffffc0010

[ 72.0975056] cpu0: Begin traceback...
[ 72.0975056] vpanic() at netbsd:vpanic+0x2d3 sys/kern/subr_prf.c:290
[ 72.0975056] isAlreadyReported() at netbsd:isAlreadyReported
[ 72.0975056] HandlePointerOverflow() at netbsd:HandlePointerOverflow+0xd7 sys/../common/lib/libc/misc/ubsan.c:706
[ 72.0975056] config_devalloc() at netbsd:config_devalloc+0x93c config_unit_nextfree sys/kern/subr_autoconf.c:1343 [inline]
[ 72.0975056] config_devalloc() at netbsd:config_devalloc+0x93c config_unit_alloc sys/kern/subr_autoconf.c:1365 [inline]
[ 72.0975056] config_devalloc() at netbsd:config_devalloc+0x93c sys/kern/subr_autoconf.c:1420
[ 72.0975056] config_attach_pseudo() at netbsd:config_attach_pseudo+0x21 sys/kern/subr_autoconf.c:1648
[ 72.0975056] vndopen() at netbsd:vndopen+0x4cb vnd_spawn sys/dev/vnd.c:308 [inline]
[ 72.0975056] vndopen() at netbsd:vndopen+0x4cb sys/dev/vnd.c:339
[ 72.0975056] cdev_open() at netbsd:cdev_open+0x166 sys/kern/subr_devsw.c:871
[ 72.0975056] spec_open() at netbsd:spec_open+0x42f sys/miscfs/specfs/spec_vnops.c:563
[ 72.0975056] VOP_OPEN() at netbsd:VOP_OPEN+0x12f sys/kern/vnode_if.c:298
[ 72.0975056] vn_open() at netbsd:vn_open+0x570 sys/kern/vfs_vnops.c:261
[ 72.0975056] do_open() at netbsd:do_open+0x22f sys/kern/vfs_syscalls.c:1668
[ 72.0975056] do_sys_openat() at netbsd:do_sys_openat+0xc6 sys/kern/vfs_syscalls.c:1752
[ 72.0975056] sys_open() at netbsd:sys_open+0x5c sys/kern/vfs_syscalls.c:1773
[ 72.0975056] sys___syscall() at netbsd:sys___syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
[ 72.0975056] sys___syscall() at netbsd:sys___syscall+0x1cf sys/kern/sys_syscall.c:77
[ 72.0975056] syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
[ 72.0975056] syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 72.0975056] syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138
[ 72.0975056] --- syscall (number 198) ---
[ 72.0975056] netbsd:syscall+0x2d5:
[ 72.0975056] cpu0: End traceback...
[ 72.0975056] fatal breakpoint trap in supervisor mode
[ 72.0975056] trap type 1 code 0 rip 0xffffffff80221a85 cs 0x8 rflags 0x246 cr2 0x75ce114264c0 ilevel 0x8 rsp 0xffffd500cb40b490
[ 72.0975056] curlwp 0xffffc6d66ea60200 pid 3527.3646 lowest kstack 0xffffd500cb4072c0
Stopped in pid 3527.3646 (syz-executor.1) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x2d3 sys/kern/subr_prf.c:290
isAlreadyReported() at netbsd:isAlreadyReported
HandlePointerOverflow() at netbsd:HandlePointerOverflow+0xd7 sys/../common/lib/libc/misc/ubsan.c:706
config_devalloc() at netbsd:config_devalloc+0x93c config_unit_nextfree sys/kern/subr_autoconf.c:1343 [inline]
config_devalloc() at netbsd:config_devalloc+0x93c config_unit_alloc sys/kern/subr_autoconf.c:1365 [inline]
config_devalloc() at netbsd:config_devalloc+0x93c sys/kern/subr_autoconf.c:1420
config_attach_pseudo() at netbsd:config_attach_pseudo+0x21 sys/kern/subr_autoconf.c:1648
vndopen() at netbsd:vndopen+0x4cb vnd_spawn sys/dev/vnd.c:308 [inline]
vndopen() at netbsd:vndopen+0x4cb sys/dev/vnd.c:339
cdev_open() at netbsd:cdev_open+0x166 sys/kern/subr_devsw.c:871
spec_open() at netbsd:spec_open+0x42f sys/miscfs/specfs/spec_vnops.c:563
VOP_OPEN() at netbsd:VOP_OPEN+0x12f sys/kern/vnode_if.c:298
vn_open() at netbsd:vn_open+0x570 sys/kern/vfs_vnops.c:261
do_open() at netbsd:do_open+0x22f sys/kern/vfs_syscalls.c:1668
do_sys_openat() at netbsd:do_sys_openat+0xc6 sys/kern/vfs_syscalls.c:1752
sys_open() at netbsd:sys_open+0x5c sys/kern/vfs_syscalls.c:1773
sys___syscall() at netbsd:sys___syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
sys___syscall() at netbsd:sys___syscall+0x1cf sys/kern/sys_syscall.c:77
syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138
--- syscall (number 198) ---
netbsd:syscall+0x2d5:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/subr_autoconf.c:1343:19, pointer expression with base 0 overflowed to 0xfffffffffffc0010

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
3633 3633 2 0 40000 ffffc6d67a68b680 syz-executor.2
3527 >3646 7 0 0 ffffc6d66ea60200 syz-executor.1
3527 3527 2 0 10040000 ffffc6d67937a140 syz-executor.1
3652 3790 3 0 80 ffffc6d67a466780 syz-executor.5 parked
3652 3685 3 0 80 ffffc6d67a4ca700 syz-executor.5 msgwait
3652 3652 3 0 10040080 ffffc6d67b290b80 syz-executor.5 nanoslp
3543 3711 2 0 0 ffffc6d66ea60640 syz-executor.4
3543 3543 2 0 10040000 ffffc6d67a3edb00 syz-executor.4
3760 2848 2 0 100000 ffffc6d67a466340 syz-executor.0
3760 3760 3 1 10040000 ffffc6d67a4cab40 syz-executor.0 lwpwait
3168 3934 2 0 100000 ffffc6d67a515040 syz-executor.3
3168 3129 2 0 140000 ffffc6d66ea60a80 syz-executor.3
3168 3168 3 1 10040000 ffffc6d67983c180 syz-executor.3 lwpwait
419 419 3 0 80 ffffc6d66c60e980 syz-executor.5 nanoslp
1082 >1082 7 1 40 ffffc6d66c60e540 syz-executor.2
1121 1121 3 0 80 ffffc6d66a0465c0 syz-executor.4 nanoslp
1076 1076 3 0 80 ffffc6d66abd3bc0 syz-executor.3 nanoslp
979 979 3 0 80 ffffc6d66a774b00 syz-executor.1 nanoslp
1067 1067 3 0 80 ffffc6d66b959900 syz-executor.0 nanoslp
1065 1096 3 1 c0 ffffc6d66c60e100 syz-fuzzer parked
1065 1075 3 1 80 ffffc6d66a7746c0 syz-fuzzer parked
1065 867 3 0 80 ffffc6d66a293a80 syz-fuzzer parked
1065 1068 3 1 80 ffffc6d66b9594c0 syz-fuzzer kqueue
1065 1064 3 1 80 ffffc6d66b881040 syz-fuzzer parked
1065 1117 3 1 80 ffffc6d66a293640 syz-fuzzer parked
1065 1254 3 1 80 ffffc6d66a293200 syz-fuzzer parked
1065 1065 3 0 80 ffffc6d66a469240 syz-fuzzer parked
1252 1252 3 1 80 ffffc6d66a469680 sshd select
850 850 3 1 80 ffffc6d66a469ac0 getty nanoslp
1089 1089 3 0 80 ffffc6d66abd3340 getty nanoslp
695 695 3 1 80 ffffc6d66c0f6940 getty nanoslp
1058 1058 3 1 c0 ffffc6d66c0f6500 getty ttyraw
941 941 3 1 80 ffffc6d66c0f60c0 sshd select
982 982 3 0 80 ffffc6d66ac40b40 powerd kqueue
568 568 3 0 80 ffffc6d66ac402c0 syslogd kqueue
591 591 3 0 80 ffffc6d66ac40700 dhcpcd poll
589 589 3 0 80 ffffc6d66a774280 dhcpcd poll
587 587 3 0 80 ffffc6d66b959080 dhcpcd poll
412 412 3 1 80 ffffc6d66abd3780 dhcpcd poll
347 347 3 0 80 ffffc6d66a9a5b80 dhcpcd poll
346 346 3 0 80 ffffc6d66a9a5300 dhcpcd poll
345 345 3 1 80 ffffc6d66a9a5740 dhcpcd poll
1 1 3 0 80 ffffc6d661e8d900 init wait
0 853 3 0 200 ffffc6d66a046a00 physiod physiod
0 166 3 0 200 ffffc6d66a0b7a40 pooldrain pooldrain
0 165 3 0 200 ffffc6d66a0b7600 ioflush syncer
0 164 3 1 200 ffffc6d66a0b71c0 pgdaemon pgdaemon
0 161 3 1 200 ffffc6d66a046180 usb7 usbevt
0 31 3 1 200 ffffc6d666fd99c0 usb6 usbevt
0 63 3 1 200 ffffc6d666fd9580 usb5 usbevt
0 126 3 1 200 ffffc6d666fd9140 usb4 usbevt
0 125 3 1 200 ffffc6d663f7c980 usb3 usbevt
0 124 3 1 200 ffffc6d663f7c540 usb2 usbevt
0 123 3 1 200 ffffc6d663f7c100 usb1 usbevt
0 122 3 1 200 ffffc6d661ebf940 usb0 usbevt
0 121 3 1 200 ffffc6d661ebf500 usbtask-dr usbtsk
0 120 3 0 200 ffffc6d65f34aac0 usbtask-hc usbtsk
0 119 3 0 200 ffffc6d661ebf0c0 npfgc0 npfgcw
0 118 3 1 200 ffffc6d661e8d4c0 rt_free rt_free
0 117 3 1 200 ffffc6d661e8d080 unpgc unpgc
0 116 3 0 200 ffffc6d661ea08c0 key_timehandler key_timehandler
0 115 3 1 200 ffffc6d661ea0480 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffffc6d661ea0040 icmp6_wqinput/0 icmp6_wqinput
0 113 3 0 200 ffffc6d661e7bbc0 nd6_timer nd6_timer
0 112 3 1 200 ffffc6d661e7b780 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffffc6d661e01700 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffffc6d661e01b40 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffffc6d661798b00 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffffc6d661e7b340 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffffc6d661e06b80 icmp_wqinput/0 icmp_wqinput
0 106 3 0 200 ffffc6d661e06740 rt_timer rt_timer
0 105 3 0 200 ffffc6d661e06300 vmem_rehash vmem_rehash
0 104 3 0 200 ffffc6d661e012c0 entbutler entropy
0 30 3 1 200 ffffc6d6617986c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffffc6d661798280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffffc6d65f34a680 scsibus0 sccomp
0 26 3 0 200 ffffc6d65f34a240 pms0 pmsreset
0 25 3 1 200 ffffc6d65f27ca80 xcall/1 xcall
0 24 1 1 200 ffffc6d65f27c640 softser/1
0 23 1 1 200 ffffc6d65f27c200 softclk/1
0 22 1 1 200 ffffc6d65f24fa40 softbio/1
0 21 1 1 200 ffffc6d65f24f600 softnet/1
0 20 1 1 201 ffffc6d65f24f1c0 idle/1
0 19 3 0 200 ffffc6d76f18fa00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffffc6d76f18f5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffffc6d76f18f180 lnxsyswq lnxsyswq
0 16 3 0 200 ffffc6d76f19c9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffc6d76f19c580 sysmon smtaskq
0 14 3 0 200 ffffc6d76f19c140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffc6d76f1b9980 pmfevent pmfevent
0 12 3 0 200 ffffc6d76f1b9540 sopendfree sopendfr
0 11 3 0 200 ffffc6d76f1b9100 iflnkst iflnkst
0 10 3 0 200 ffffc6d7701d8940 nfssilly nfssilly
0 9 3 0 200 ffffc6d7701d8500 vdrain vdrain
0 8 3 0 200 ffffc6d7701d80c0 modunload mod_unld
0 7 3 0 200 ffffc6d770213900 xcall/0 xcall
0 6 1 0 200 ffffc6d7702134c0 softser/0
0 5 1 0 200 ffffc6d770213080 softclk/0
0 4 1 0 200 ffffc6d77023d8c0 softbio/0
0 3 1 0 200 ffffc6d77023d480 softnet/0
0 2 1 0 201 ffffc6d77023d040 idle/0
0 0 3 0 200 ffffffff85efbb00 swapper uvm
[Locks tracked through LWPs]

****** LWP 589.589 (dhcpcd) @ 0xffffc6d66a774280, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa540 type : sleep/adaptive
initialized : 0xffffffff8323a320
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc6d66a774280 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 587.587 (dhcpcd) @ 0xffffc6d66b959080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa540 type : sleep/adaptive
initialized : 0xffffffff8323a320
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc6d66b959080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 346.346 (dhcpcd) @ 0xffffc6d66a9a5300, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa540 type : sleep/adaptive
initialized : 0xffffffff8323a320
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc6d66a9a5300 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 345.345 (dhcpcd) @ 0xffffc6d66a9a5740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa540 type : sleep/adaptive
initialized : 0xffffffff8323a320
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffc6d66a9a5740 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffc6d76f1b9100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa540 type : sleep/adaptive
initialized : 0xffffffff8323a320
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc6d76f1b9100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffc6d770213080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa540 type : sleep/adaptive
initialized : 0xffffffff8323a320
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc6d770213080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at main)
lock address : 0xffffffff862fa440 type : spin
initialized : 0xffffffff83a167cd
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc6d66ea60200 last held: 0xffffc6d66ea60200
last locked* : 0xffffffff8331bd3c unlocked : 0xffffffff82689573
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at config_init)
lock address : 0xffffffff86303380 type : spin
initialized : 0xffffffff832f818d
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc6d66ea60200 last held: 0xffffc6d66ea60200
last locked* : 0xffffffff832f9968 unlocked : 0xffffffff83300c16
owner field : 0x0000000000010600 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffffd50000007180 0045 00000000 0x0 0x0
0xffffd50000007200 0045 00000000 0x0 0x0
0xffffd50000007280 0045 00000000 0x0 0x0
0xffffd50000007300 0045 00000000 0x0 0x0
0xffffd50000007380 0045 00000000 0x0 0x0
0xffffd50000007400 0045 00000000 0x0 0x0
0xffffd50000007480 0045 00000000 0x0 0x0
0xffffd50000007500 0045 00000000 0x0 0x0
0xffffd50000007580 0041 00000000 0x0 0x0
0xffffd50000007600 0041 00000000 0x0 0x0
0xffffd50000007680 0041 00000000 0x0 0x0
0xffffd50000007700 0045 00000000 0x0 0x0
0xffffd50000007780 0045 00000000 0x0 0x0
0xffffd50000007800 0045 00000000 0x0 0x0
0xffffd50000007880 0041 00000000 0x0 0x0
0xffffd50000007900 0041 00000000 0x0 0x0
0xffffd50000007980 0041 00000000 0x0 0x0
0xffffd50000007a00 0041 00000000 0x0 0x0
0xffffd50000007a80 0041 00000000 0x0 0x0
0xffffd50000007b00 0041 00000000 0x0 0x0
0xffffd50000007b80 0041 00000000 0x0 0x0
0xffffd50000007c00 0041 00000000 0x0 0x0
0xffffd50000007c80 0041 00000000 0x0 0x0
0xffffd50000007d00 0041 00000000 0x0 0x0
0xffffd50000007d80 0041 00000000 0x0 0x0
0xffffd50000007e00 0041 00000000 0x0 0x0
0xffffd50000007e80 0041 00000000 0x0 0x0
0xffffd50000007f00 0041 00000000 0x0 0x0
0xffffd50000007f80 0041 00000000 0x0 0x0
0xffffd50000008000 0041 00000000 0x0 0x0
0xffffd50000008080 0041 00000000 0x0 0x0
0xffffd50000008100 0041 00000000 0x0 0x0
0xffffd50000008180 0041 00000000 0x0 0x0
0xffffd50000008200 0041 00000000 0x0 0x0
0xffffd50000008280 0045 00000000 0x0 0x0
0xffffd50000008300 0041 00000000 0x0 0x0
0xffffd50000008380 0041 00000000 0x0 0x0
0xffffd50000008400 0041 00000000 0x0 0x0
0xffffd50000008480 0041 00000000 0x0 0x0
0xffffd50000008500 0041 00000000 0x0 0x0
0xffffd50000008580 0041 00000000 0x0 0x0
0xffffd50000008600 0041 00000000 0x0 0x0
0xffffd50000008680 0041 00000000 0x0 0x0
0xffffd50000008700 0041 00000000 0x0 0x0
0xffffd50000008780 0041 00000000 0x0 0x0
0xffffd50000008800 0041 00000000 0x0 0x0
0xffffd50000008880 0041 00000000 0x0 0x0
0xffffd50000008900 0041 00000000 0x0 0x0
0xffffd50000008980 0041 00000000 0x0 0x0
0xffffd50000008a00 0041 00000000 0x0 0x0
0xffffd50000008a80 0045 00000000 0x0 0x0
0xffffd50000008b00 0041 00000000 0x0 0x0
0xffffd50000008b80 0041 00000000 0x0 0x0
0xffffd50000008c00 0041 00000000 0x0 0x0
0xffffd50000008c80 0041 00000000 0x0 0x0
0xffffd50000008d00 0041 00000000 0x0 0x0
0xffffd50000008d80 0041 00000000 0x0 0x0
0xffffd50000008e00 0041 00000000 0x0 0x0
0xffffd50000008e80 0041 00000000 0x0 0x0
0xffffd50000008f00 0045 00000000 0x0 0x0
0xffffd50000008f80 0041 00000000 0x0 0x0
0xffffd50000009000 0041 00000000 0x0 0x0
0xffffd50000009080 0041 00000000 0x0 0x0
0xffffd50000009100 0041 00000000 0x0 0x0
0xffffd50000009180 0041 00000000 0x0 0x0
0xffffd50000009200 0041 00000000 0x0 0x0
0xffffd50000009280 0041 00000000 0x0 0x0
0xffffd50000009300 0041 00000000 0x0 0x0
0xffffd50000009380 0041 00000000 0x0 0x0
0xffffd50000009400 0041 00000000 0x0 0x0
0xffffd50000009480 0041 00000000 0x0 0x0
0xffffd50000009500 0041 00000000 0x0 0x0
0xffffd50000009580 0045 00000000 0x0 0x0
0xffffd50000009600 0041 00000000 0x0 0x0
0xffffd50000009680 0041 00000000 0x0 0x0
0xffffd50000009700 0041 00000000 0x0 0x0
0xffffd50000009780 0041 00000000 0x0 0x0
0xffffd50000009800 0041 00000000 0x0 0x0
0xffffd50000009880 0041 00000000 0x0 0x0
0xffffd50000009900 0041 00000000 0x0 0x0
0xffffd50000009980 0041 00000000 0x0 0x0
0xffffd50000009a00 0041 00000000 0x0 0x0
0xffffd50000009a80 0041 00000000 0x0 0x0
0xffffd50000009b00 0041 00000000 0x0 0x0
0xffffd50000009b80 0041 00000000 0x0 0x0
0xffffd50000009c00 0041 00000000 0x0 0x0
0xffffd50000009c80 0041 00000000 0x0 0x0
0xffffd50000009d00 0041 00000000 0x0 0x0
0xffffd50000009d80 0041 00000000 0x0 0x0
0xffffd50000009e00 0041 00000000 0x0 0x0
0xffffd50000009e80 0041 00000000 0x0 0x0
0xffffd50000009f00 0041 00000000 0x0 0x0
0xffffd50000009f80 0041 00000000 0x0 0x0
0xffffd5000000a000 0041 00000000 0x0 0x0
0xffffd5000000a080 0041 00000000 0x0 0x0
0xffffd5000000a100 0045 00000000 0x0 0x0
0xffffd5000000a180 0041 00000000 0x0 0x0
0xffffd5000000a200 0041 00000000 0x0 0x0
0xffffd5000000a280 0041 00000000 0x0 0x0
0xffffd5000000a300 0041 00000000 0x0 0x0
0xffffd5000000a380 0041 00000000 0x0 0x0
0xffffd5000000a400 0041 00000000 0x0 0x0
0xffffd5000000a480 0041 00000000 0x0 0x0
0xffffd5000000a500 0041 00000000 0x0 0x0
0xffffd5000000a580 0041 00000000 0x0 0x0
0xffffd5000000a600 0041 00000000 0x0 0x0
0xffffd5000000a680 0041 00000000 0x0 0x0
0xffffd5000000a700 0041 00000000 0x0 0x0
0xffffd5000000a780 0041 00000000 0x0 0x0
0xffffd5000000a800 0041 00000000 0x0 0x0
0xffffd5000000a880 0041 00000000 0x0 0x0
0xffffd5000000a900 0041 00000000 0x0 0x0
0xffffd5000000a980 0041 00000000 0x0 0x0
0xffffd5000000aa00 0045 00000000 0x0 0x0
0xffffd5000000aa80 0041 00000000 0x0 0x0
0xffffd5000000ab00 0041 00000000 0x0 0x0
0xffffd5000000ab80 0041 00000000 0x0 0x0
0xffffd5000000ac00 0041 00000000 0x0 0x0
0xffffd5000000ac80 0041 00000000 0x0 0x0
0xffffd5000000ad00 0041 00000000 0x0 0x0
0xffffd5000000ad80 0041 00000000 0x0 0x0
0xffffd5000000ae00 0045 00000000 0x0 0x0
0xffffd5000000ae80 0041 00000000 0x0 0x0
0xffffd5000000af00 0041 00000000 0x0 0x0
0xffffd5000000af80 0041 00000000 0x0 0x0
0xffffd5000000b000 0041 00000000 0x0 0x0
0xffffd5000000b080 0041 00000000 0x0 0x0
0xffffd5000000b100 0041 00000000 0x0 0x0
0xffffd5000000b180 0045 00000000 0x0 0x0
0xffffd5000000b200 0045 00000000 0x0 0x0
0xffffd5000000b280 0045 00000000 0x0 0x0
0xffffd5000000b300 0041 00000000 0x0 0x0
0xffffd5000000b380 0041 00000000 0x0 0x0
0xffffd5000000b400 0041 00000000 0x0 0x0
0xffffd5000000b480 0041 00000000 0x0 0x0
0xffffd5000000b500 0041 00000000 0x0 0x0
0xffffd5000000b580 0045 00000000 0x0 0x0
0xffffd5000000b600 0045 00000000 0x0 0x0
0xffffd5000000b680 0045 00000000 0x0 0x0
0xffffd5000000b700 0041 00000000 0x0 0x0
0xffffd5000000b780 0045 00000000 0x0 0x0
0xffffd5000000b800 0045 00000000 0x0 0x0
0xffffd5000000b880 0045 00000000 0x0 0x0
0xffffd5000000b900 0045 00000000 0x0 0x0
0xffffd5000000b980 0045 00000000 0x0 0x0
0xffffd5000000ba00 0041 00000000 0x0 0x0
0xffffd5000000ba80 0045 00000000 0x0 0x0
0xffffd5000000bb00 0045 00000000 0x0 0x0
0xffffd5000000bb80 0045 00000000 0x0 0x0
0xffffd5000000bc00 0045 00000000 0x0 0x0
0xffffd5000000bc80 0045 00000000 0x0 0x0
0xffffd5000000bd00 0045 00000000 0x0 0x0
0xffffd5000000bd80 0045 00000000 0x0 0x0
0xffffd5000000be00 0041 00000000 0x0 0x0
0xffffd5000000be80 0045 00000000 0x0 0x0
0xffffd5000000bf00 0045 00000000 0x0 0x0
0xffffd5000000bf80 0045 00000000 0x0 0x0
0xffffd5000000c000 0045 00000000 0x0 0x0
0xffffd5000000c080 0045 00000000 0x0 0x0
0xffffd5000000c100 0045 00000000 0x0 0x0
0xffffd5000000c180 0045 00000000 0x0 0x0
0xffffd5000000c200 0041 00000000 0x0 0x0
0xffffd5000000c280 0041 00000000 0x0 0x0
0xffffd5000000c300 0045 00000000 0x0 0x0
0xffffd5000000c380 0045 00000000 0x0 0x0
0xffffd5000000c400 0045 00000000 0x0 0x0
0xffffd5000000c480 0045 00000000 0x0 0x0
0xffffd5000000c500 0045 00000000 0x0 0x0
0xffffd5000000c580 0041 00000000 0x0 0x0
0xffffd5000000c600 0041 00000000 0x0 0x0
0xffffd5000000c680 0041 00000000 0x0 0x0
0xffffd5000000c700 0045 00000000 0x0 0x0
0xffffd5000000c780 0041 00000000 0x0 0x0
0xffffd5000000c800 0045 00000000 0x0 0x0
0xffffd5000000c880 0045 00000000 0x0 0x0
0xffffd5000000c900 0045 00000000 0x0 0x0
0xffffd5000000c980 0041 00000000 0x0 0x0
0xffffd5000000ca00 0041 00000000 0x0 0x0
0xffffd5000000ca80 0041 00000000 0x0 0x0
0xffffd5000000cb00 0041 00000000 0x0 0x0
0xffffd5000000cb80 0041 00000000 0x0 0x0
0xffffd5000000cc00 0041 00000000 0x0 0x0
0xffffd5000000cc80 0041 00000000 0x0 0x0
0xffffd5000000cd00 0041 00000000 0x0 0x0
0xffffd5000000cd80 0041 00000000 0x0 0x0
0xffffd5000000ce00 0045 00000000 0x0 0x0
0xffffd5000000ce80 0041 00000000 0x0 0x0
0xffffd5000000cf00 0041 00000000 0x0 0x0
0xffffd5000000cf80 0041 00000000 0x0 0x0
0xffffd5000000d000 0041 00000000 0x0 0x0
0xffffd5000000d080 0041 00000000 0x0 0x0
0xffffd5000000d100 0041 00000000 0x0 0x0
0xffffd5000000d180 0041 00000000 0x0 0x0
0xffffd5000000d200 0041 00000000 0x0 0x0
0xffffd5000000d280 0041 00000000 0x0 0x0
0xffffd5000000d300 0041 00000000 0x0 0x0
0xffffd5000000d380 0045 00000000 0x0 0x0
0xffffd5000000d400 0041 00000000 0x0 0x0
0xffffd5000000d480 0041 00000000 0x0 0x0
0xffffd5000000d500 0041 00000000 0x0 0x0
0xffffd5000000d580 0041 00000000 0x0 0x0
0xffffd5000000d600 0041 00000000 0x0 0x0
0xffffd5000000d680 0045 00000000 0x0 0x0
0xffffd5000000d700 0045 00000000 0x0 0x0
0xffffd5000000d780 0041 00000000 0x0 0x0
0xffffd5000000d800 0045 00000000 0x0 0x0
0xffffd5000000d880 0041 00000000 0x0 0x0
0xffffd5000000d900 0041 00000000 0x0 0x0
0xffffd5000000d980 0045 00000000 0x0 0x0
0xffffd5000000da00 0041 00000000 0x0 0x0
0xffffd5000000da80 0041 00000000 0x0 0x0
0xffffd5000000db00 0041 00000000 0x0 0x0
0xffffd5000000db80 0045 00000000 0x0 0x0
0xffffd5000000dc00 0041 00000000 0x0 0x0
0xffffd5000000dc80 0045 00000000 0x0 0x0
0xffffd5000000dd00 0045 00000000 0x0 0x0
0xffffd5000000dd80 0045 00000000 0x0 0x0
0xffffd5000000de00 0041 00000000 0x0 0x0
0xffffd5000000de80 0041 00000000 0x0 0x0
0xffffd5000000df00 0041 00000000 0x0 0x0
0xffffd5000000df80 0045 00000000 0x0 0x0
0xffffd5000000e000 0045 00000000 0x0 0x0
0xffffd5000000e080 0045 00000000 0x0 0x0
0xffffd5000000e100 0045 00000000 0x0 0x0
0xffffd5000000e180 0041 00000000 0x0 0x0
0xffffd5000000e200 0041 00000000 0x0 0x0
0xffffd5000000e280 0041 00000000 0x0 0x0
0xffffd5000000e300 0045 00000000 0x0 0x0
0xffffd5000000e380 0045 00000000 0x0 0x0
0xffffd5000000e400 0045 00000000 0x0 0x0
0xffffd5000000e480 0045 00000000 0x0 0x0
0xffffd5000000e500 0041 00000000 0x0 0x0
0xffffd5000000e580 0041 00000000 0x0 0x0
0xffffd5000000e600 0041 00000000 0x0 0x0
0xffffd5000000e680 0041 00000000 0x0 0x0
0xffffd5000000e700 0041 00000000 0x0 0x0
0xffffd5000000e780 0041 00000000 0x0 0x0
0xffffd5000000e800 0045 00000000 0x0 0x0
0xffffd5000000e880 0041 00000000 0x0 0x0
0xffffd5000000e900 0045 00000000 0x0 0x0
0xffffd5000000e980 0041 00000000 0x0 0x0
0xffffd5000000ea00 0041 00000000 0x0 0x0
0xffffd5000000ea80 0041 00000000 0x0 0x0
0xffffd5000000eb00 0045 00000000 0x0 0x0
0xffffd5000000eb80 0041 00000000 0x0 0x0
0xffffd5000000ec00 0041 00000000 0x0 0x0
0xffffd5000000ec80 0045 00000000 0x0 0x0
0xffffd5000000ed00 0041 00000000 0x0 0x0
0xffffd5000000ed80 0041 00000000 0x0 0x0
0xffffd5000000ee00 0041 00000000 0x0 0x0
0xffffd5000000ee80 0041 00000000 0x0 0x0
0xffffd5000000ef00 0041 00000000 0x0 0x0
0xffffd5000000ef80 0041 00000000 0x0 0x0
0xffffd5000000f000 0045 00000000 0x0 0x0
0xffffd5000000f080 0041 00000000 0x0 0x0
0xffffd5000000f100 0041 00000000 0x0 0x0
0xffffd5000000f180 0041 00000000 0x0 0x0
0xffffd5000000f200 0045 00000000 0x0 0x0
0xffffd5000000f280 0041 00000000 0x0 0x0
0xffffd5000000f300 0041 00000000 0x0 0x0
0xffffd5000000f380 0041 00000000 0x0 0x0
0xffffd5000000f400 0041 00000000 0x0 0x0
0xffffd5000000f480 0041 00000000 0x0 0x0
0xffffd5000000f500 0041 00000000 0x0 0x0
0xffffd5000000f580 0041 00000000 0x0 0x0
0xffffd5000000f600 0041 00000000 0x0 0x0
0xffffd5000000f680 0045 00000000 0x0 0x0
0xffffd5000000f700 0041 00000000 0x0 0x0
0xffffd5000000f780 0041 00000000 0x0 0x0
0xffffd5000000f800 0041 00000000 0x0 0x0
0xffffd5000000f880 0041 00000000 0x0 0x0
0xffffd5000000f900 0041 00000000 0x0 0x0
0xffffd5000000f980 0041 00000000 0x0 0x0
0xffffd5000000fa00 0041 00000000 0x0 0x0
0xffffd5000000fa80 0041 00000000 0x0 0x0
0xffffd5000000fb00 0041 00000000 0x0 0x0
0xffffd5000000fb80 0045 00000000 0x0 0x0
0xffffd5000000fc00 0041 00000000 0x0 0x0
0xffffd5000000fc80 0041 00000000 0x0 0x0
0xffffd5000000fd00 0041 00000000 0x0 0x0
0xffffd5000000fd80 0041 00000000 0x0 0x0
0xffffd5000000fe00 0041 00000000 0x0 0x0
0xffffd5000000fe80 0041 00000000 0x0 0x0
0xffffd5000000ff00 0041 00000000 0x0 0x0
0xffffd5000000ff80 0041 00000000 0x0 0x0
0xffffd50000010000 0041 00000000 0x0 0x0
0xffffd50000010080 0041 00000000 0x0 0x0
0xffffd50000010100 0041 00000000 0x0 0x0
0xffffd50000010180 0045 00000000 0x0 0x0
0xffffd50000010200 0041 00000000 0x0 0x0
0xffffd50000010280 0041 00000000 0x0 0x0
0xffffd50000010300 0041 00000000 0x0 0x0
0xffffd50000010380 0041 00000000 0x0 0x0
0xffffd50000010400 0041 00000000 0x0 0x0
0xffffd50000010480 0041 00000000 0x0 0x0
0xffffd50000010500 0041 00000000 0x0 0x0
0xffffd50000010580 0041 00000000 0x0 0x0
0xffffd50000010600 0041 00000000 0x0 0x0
0xffffd50000010680 0041 00000000 0x0 0x0
0xffffd50000010700 0045 00000000 0x0 0x0
0xffffd50000010780 0041 00000000 0x0 0x0
0xffffd50000010800 0045 00000000 0x0 0x0
0xffffd50000010880 0045 00000000 0x0 0x0
0xffffd50000010900 0045 00000000 0x0 0x0
0xffffd50000010980 0041 00000000 0x0 0x0
0xffffd50000010a00 0041 00000000 0x0 0x0
0xffffd50000010a80 0041 00000000 0x0 0x0
0xffffd50000010b00 0041 00000000 0x0 0x0
0xffffd50000010b80 0045 00000000 0x0 0x0
0xffffd50000010c00 0041 00000000 0x0 0x0
0xffffd50000010c80 0041 00000000 0x0 0x0
0xffffd50000010d00 0041 00000000 0x0 0x0
0xffffd50000010d80 0041 00000000 0x0 0x0
0xffffd50000010e00 0041 00000000 0x0 0x0
0xffffd50000010e80 0041 00000000 0x0 0x0
0xffffd50000010f00 0041 00000000 0x0 0x0
0xffffd50000010f80 0041 00000000 0x0 0x0
0xffffd50000011000 0041 00000000 0x0 0x0
0xffffd50000011080 0041 00000000 0x0 0x0
0xffffd50000011100 0041 00000000 0x0 0x0
0xffffd50000011180 0041 00000000 0x0 0x0
0xffffd50000011200 0041 00000000 0x0 0x0
0xffffd50000011280 0041 00000000 0x0 0x0
0xffffd50000011300 0041 00000000 0x0 0x0
0xffffd50000011380 0041 00000000 0x0 0x0
0xffffd50000011400 0041 00000000 0x0 0x0
0xffffd50000011480 0041 00000000 0x0 0x0
0xffffd50000011500 0041 00000000 0x0 0x0
0xffffd50000011580 0041 00000000 0x0 0x0
0xffffd50000011600 0041 00000000 0x0 0x0
0xffffd50000011680 0041 00000000 0x0 0x0
0xffffd50000011700 0041 00000000 0x0 0x0
0xffffd50000011780 0041 00000000 0x0 0x0
0xffffd50000011800 0045 00000000 0x0 0x0
0xffffd50000011880 0001 00000000 0x0 0x0
0xffffd50000011900 0001 00000000 0x0 0x0
0xffffd50000011980 0001 00000000 0x0 0x0
0xffffd50000011a00 0001 00000000 0x0 0x0
0xffffd50000011a80 0001 00000000 0x0 0x0
0xffffd50000011b00 0001 00000000 0x0 0x0
0xffffd50000011b80 0001 00000000 0x0 0x0
0xffffd50000011c00 0001 00000000 0x0 0x0
0xffffd50000011c80 0001 00000000 0x0 0x0
0xffffd50000011d00 0001 00000000 0x0 0x0
0xffffd50000011d80 0001 00000000 0x0 0x0
0xffffd50000011e00 0001 00000000 0x0 0x0
0xffffd50000011e80 0001 00000000 0x0 0x0
0xffffd50000011f00 0001 00000000 0x0 0x0
0xffffd50000011f80 0001 00000000 0x0 0x0
0xffffd50000012000 0001 00000000 0x0 0x0
0xffffd50000012080 0001 00000000 0x0 0x0
0xffffd50000012100 0001 00000000 0x0 0x0
0xffffd50000012180 0001 00000000 0x0 0x0
0xffffd50000012200 0001 00000000 0x0 0x0
0xffffd50000012280 0001 00000000 0x0 0x0
0xffffd50000012300 0001 00000000 0x0 0x0
0xffffd50000012380 0001 00000000 0x0 0x0
0xffffd50000012400 0001 00000000 0x0 0x0
0xffffd50000012480 0001 00000000 0x0 0x0
0xffffd50000012500 0001 00000000 0x0 0x0
0xffffd50000012580 0001 00000000 0x0 0x0
0xffffd50000012600 0001 00000000 0x0 0x0
0xffffd50000012680 0001 00000000 0x0 0x0
0xffffd50000012700 0001 00000000 0x0 0x0
0xffffd50000012780 0001 00000000 0x0 0x0
0xffffd50000012800 0001 00000000 0x0 0x0
0xffffd50000012880 0001 00000000 0x0 0x0
0xffffd50000012900 0001 00000000 0x0 0x0
0xffffd50000012980 0001 00000000 0x0 0x0
0xffffd50000012a00 0001 00000000 0x0 0x0
0xffffd50000012a80 0001 00000000 0x0 0x0
0xffffd50000012b00 0001 00000000 0x0 0x0
0xffffd50000012b80 0001 00000000 0x0 0x0
0xffffd50000012c00 0001 00000000 0x0 0x0
0xffffd50000012c80 0001 00000000 0x0 0x0
0xffffd50000012d00 0001 00000000 0x0 0x0
0xffffd50000012d80 0001 00000000 0x0 0x0
0xffffd50000012e00 0001 00000000 0x0 0x0
0xffffd50000012e80 0001 00000000 0x0 0x0
0xffffd50000012f00 0001 00000000 0x0 0x0
0xffffd50000012f80 0001 00000000 0x0 0x0
0xffffd50000013000 0001 00000000 0x0 0x0
0xffffd50000013080 0001 00000000 0x0 0x0
0xffffd50000013100 0001 00000000 0x0 0x0
0xffffd50000013180 0001 00000000 0x0 0x0
0xffffd50000013200 0001 00000000 0x0 0x0
0xffffd50000013280 0001 00000000 0x0 0x0
0xffffd50000013300 0001 00000000 0x0 0x0
0xffffd50000013380 0041 00000000 0x0 0x0
0xffffd50000013400 0041 00000000 0x0 0x0
0xffffd50000013480 0041 00000000 0x0 0x0
0xffffd50000013500 0041 00000000 0x0 0x0
0xffffd50000013580 0041 00000000 0x0 0x0
0xffffd50000013600 0041 00000000 0x0 0x0
0xffffd50000013680 0041 00000000 0x0 0x0
0xffffd50000013700 0041 00000000 0x0 0x0
0xffffd50000013780 0041 00000000 0x0 0x0
0xffffd50000013800 0041 00000000 0x0 0x0
0xffffd50000013880 0041 00000000 0x0 0x0
0xffffd50000013900 0041 00000000 0x0 0x0
0xffffd50000013980 0041 00000000 0x0 0x0
0xffffd50000013a00 0041 00000000 0x0 0x0
0xffffd50000013a80 0041 00000000 0x0 0x0
0xffffd50000013b00 0041 00000000 0x0 0x0
0xffffd50000013b80 0041 00000000 0x0 0x0
0xffffd50000013c00 0041 00000000 0x0 0x0
0xffffd50000013c80 0041 00000000 0x0 0x0
0xffffd50000013d00 0041 00000000 0x0 0x0
0xffffd50000013d80 0041 00000000 0x0 0x0
0xffffd50000013e00 0041 00000000 0x0 0x0
0xffffd50000013e80 0041 00000000 0x0 0x0
0xffffd50000013f00 0041 00000000 0x0 0x0
0xffffd50000013f80 0041 00000000 0x0 0x0
0xffffd50000014000 0041 00000000 0x0 0x0
0xffffd50000014080 0041 00000000 0x0 0x0
0xffffd50000014100 0041 00000000 0x0 0x0
0xffffd50000014180 0041 00000000 0x0 0x0
0xffffd50000014200 0041 00000000 0x0 0x0
0xffffd50000014280 0041 00000000 0x0 0x0
0xffffd50000014300 0041 00000000 0x0 0x0
0xffffd50000014380 0041 00000000 0x0 0x0
0xffffd50000014400 0041 00000000 0x0 0x0
0xffffd50000014480 0041 00000000 0x0 0x0
0xffffd50000014500 0041 00000000 0x0 0x0
0xffffd50000014580 0041 00000000 0x0 0x0
0xffffd50000014600 0041 00000000 0x0 0x0
0xffffd50000014680 0041 00000000 0x0 0x0
0xffffd50000014700 0041 00000000 0x0 0x0
0xffffd50000014780 0041 00000000 0x0 0x0
0xffffd50000014800 0041 00000000 0x0 0x0
0xffffd50000014880 0001 00000000 0x0 0x0
0xffffd50000014900 0001 00000000 0x0 0x0
0xffffd50000014980 0001 00000000 0x0 0x0
0xffffd50000014a00 0001 00000000 0x0 0x0
0xffffd50000014a80 0001 00000000 0x0 0x0
0xffffd50000014b00 0001 00000000 0x0 0x0
0xffffd50000014b80 0001 00000000 0x0 0x0
0xffffd50000014c00 0001 00000000 0x0 0x0
0xffffd50000014c80 0001 00000000 0x0 0x0
0xffffd50000014d00 0001 00000000 0x0 0x0
0xffffd50000014d80 0001 00000000 0x0 0x0
0xffffd50000014e00 0001 00000000 0x0 0x0
0xffffd50000014e80 0001 00000000 0x0 0x0
0xffffd50000014f00 0001 00000000 0x0 0x0
0xffffd50000014f80 0001 00000000 0x0 0x0
0xffffd50000015000 0001 00000000 0x0 0x0
0xffffd50000015080 0001 00000000 0x0 0x0
0xffffd50000015100 0001 00000000 0x0 0x0
0xffffd50000015180 0001 00000000 0x0 0x0
0xffffd50000015200 0001 00000000 0x0 0x0
0xffffd50000015280 0001 00000000 0x0 0x0
0xffffd50000015300 0001 00000000 0x0 0x0
0xffffd50000015380 0001 00000000 0x0 0x0
0xffffd50000015400 0001 00000000 0x0 0x0
0xffffd50000015480 0001 00000000 0x0 0x0
0xffffd50000015500 0001 00000000 0x0 0x0
0xffffd50000015580 0001 00000000 0x0 0x0
0xffffd50000015600 0001 00000000 0x0 0x0
0xffffd50000015680 0001 00000000 0x0 0x0
0xffffd50000015700 0001 00000000 0x0 0x0
0xffffd50000015780 0001 00000000 0x0 0x0
0xffffd50000015800 0001 00000000 0x0 0x0
0xffffd50000015880 0001 00000000 0x0 0x0
0xffffd50000015900 0001 00000000 0x0 0x0
0xffffd50000015980 0001 00000000 0x0 0x0
0xffffd50000015a00 0001 00000000 0x0 0x0
0xffffd50000015a80 0001 00000000 0x0 0x0
0xffffd50000015b00 0001 00000000 0x0 0x0
0xffffd50000015b80 0001 00000000 0x0 0x0
0xffffd50000015c00 0001 00000000 0x0 0x0
0xffffd50000015c80 0001 00000000 0x0 0x0
0xffffd50000015d00 0001 00000000 0x0 0x0
0xffffd50000015d80 0001 00000000 0x0 0x0
0xffffd50000015e00 0001 00000000 0x0 0x0
0xffffd50000015e80 0001 00000000 0x0 0x0
0xffffd50000015f00 0001 00000000 0x0 0x0
0xffffd50000015f80 0001 00000000 0x0 0x0
0xffffd50000016000 0001 00000000 0x0 0x0
0xffffd50000016080 0001 00000000 0x0 0x0
0xffffd50000016100 0001 00000000 0x0 0x0
0xffffd50000016180 0001 00000000 0x0 0x0
0xffffd50000016200 0001 00000000 0x0 0x0
0xffffd50000016280 0001 00000000 0x0 0x0
0xffffd50000016300 0001 00000000 0x0 0x0
0xffffd50000016380 0041 00000000 0x0 0x0
0xffffd50000016400 0041 00000000 0x0 0x0
0xffffd50000016480 0041 00000000 0x0 0x0
0xffffd50000016500 0041 00000000 0x0 0x0
0xffffd50000016580 0041 00000000 0x0 0x0
0xffffd50000016600 0041 00000000 0x0 0x0
0xffffd50000016680 0041 00000000 0x0 0x0
0xffffd50000016700 0041 00000000 0x0 0x0
0xffffd50000016780 0041 00000000 0x0 0x0
0xffffd50000016800 0041 00000000 0x0 0x0
0xffffd50000016880 0041 00000000 0x0 0x0
0xffffd50000016900 0041 00000000 0x0 0x0
0xffffd50000016980 0041 00000000 0x0 0x0
0xffffd50000016a00 0041 00000000 0x0 0x0
0xffffd50000016a80 0041 00000000 0x0 0x0
0xffffd50000016b00 0041 00000000 0x0 0x0
0xffffd50000016b80 0041 00000000 0x0 0x0
0xffffd50000016c00 0041 00000000 0x0 0x0
0xffffd50000016c80 0041 00000000 0x0 0x0
0xffffd50000016d00 0041 00000000 0x0 0x0
0xffffd50000016d80 0041 00000000 0x0 0x0
0xffffd50000016e00 0041 00000000 0x0 0x0
0xffffd50000016e80 0041 00000000 0x0 0x0
0xffffd50000016f00 0041 00000000 0x0 0x0
0xffffd50000016f80 0041 00000000 0x0 0x0
0xffffd50000017000 0041 00000000 0x0 0x0
0xffffd50000017080 0041 00000000 0x0 0x0
0xffffd50000017100 0041 00000000 0x0 0x0
0xffffd50000017180 0041 00000000 0x0 0x0
0xffffd50000017200 0041 00000000 0x0 0x0
0xffffd50000017280 0041 00000000 0x0 0x0
0xffffd50000017300 0041 00000000 0x0 0x0
0xffffd50000017380 0041 00000000 0x0 0x0
0xffffd50000017400 0041 00000000 0x0 0x0
0xffffd50000017480 0041 00000000 0x0 0x0
0xffffd50000017500 0041 00000000 0x0 0x0
0xffffd50000017580 0041 00000000 0x0 0x0
0xffffd50000017600 0045 00000000 0x0 0x0
0xffffd50000017680 0041 00000000 0x0 0x0
0xffffd50000017700 0041 00000000 0x0 0x0
0xffffd50000017780 0041 00000000 0x0 0x0
0xffffd50000017800 0041 00000000 0x0 0x0
0xffffd50000017880 0001 00000000 0x0 0x0
0xffffd50000017900 0001 00000000 0x0 0x0
0xffffd50000017980 0001 00000000 0x0 0x0
0xffffd50000017a00 0001 00000000 0x0 0x0
0xffffd50000017a80 0001 00000000 0x0 0x0
0xffffd50000017b00 0001 00000000 0x0 0x0
0xffffd50000017b80 0001 00000000 0x0 0x0
0xffffd50000017c00 0001 00000000 0x0 0x0
0xffffd50000017c80 0001 00000000 0x0 0x0
0xffffd50000017d00 0001 00000000 0x0 0x0
0xffffd50000017d80 0001 00000000 0x0 0x0
0xffffd50000017e00 0001 00000000 0x0 0x0
0xffffd50000017e80 0001 00000000 0x0 0x0
0xffffd50000017f00 0001 00000000 0x0 0x0
0xffffd50000017f80 0001 00000000 0x0 0x0
0xffffd50000018000 0001 00000000 0x0 0x0
0xffffd50000018080 0001 00000000 0x0 0x0
0xffffd50000018100 0001 00000000 0x0 0x0
0xffffd50000018180 0001 00000000 0x0 0x0
0xffffd50000018200 0001 00000000 0x0 0x0
0xffffd50000018280 0001 00000000 0x0 0x0
0xffffd50000018300 0001 00000000 0x0 0x0
0xffffd50000018380 0001 00000000 0x0 0x0
0xffffd50000018400 0001 00000000 0x0 0x0
0xffffd50000018480 0001 00000000 0x0 0x0
0xffffd50000018500 0001 00000000 0x0 0x0
0xffffd50000018580 0001 00000000 0x0 0x0
0xffffd50000018600 0001 00000000 0x0 0x0
0xffffd50000018680 0001 00000000 0x0 0x0
0xffffd50000018700 0001 00000000 0x0 0x0
0xffffd50000018780 0001 00000000 0x0 0x0
0xffffd50000018800 0001 00000000 0x0 0x0
0xffffd50000018880 0001 00000000 0x0 0x0
0xffffd50000018900 0001 00000000 0x0 0x0
0xffffd50000018980 0001 00000000 0x0 0x0
0xffffd50000018a00 0001 00000000 0x0 0x0
0xffffd50000018a80 0001 00000000 0x0 0x0
0xffffd50000018b00 0001 00000000 0x0 0x0
0xffffd50000018b80 0001 00000000 0x0 0x0
0xffffd50000018c00 0001 00000000 0x0 0x0
0xffffd50000018c80 0001 00000000 0x0 0x0
0xffffd50000018d00 0001 00000000 0x0 0x0
0xffffd50000018d80 0001 00000000 0x0 0x0
0xffffd50000018e00 0001 00000000 0x0 0x0
0xffffd50000018e80 0001 00000000 0x0 0x0
0xffffd50000018f00 0001 00000000 0x0 0x0
0xffffd50000018f80 0001 00000000 0x0 0x0
0xffffd50000019000 0001 00000000 0x0 0x0
0xffffd50000019080 0001 00000000 0x0 0x0
0xffffd50000019100 0001 00000000 0x0 0x0
0xffffd50000019180 0001 00000000 0x0 0x0
0xffffd50000019200 0001 00000000 0x0 0x0
0xffffd50000019280 0001 00000000 0x0 0x0
0xffffd50000019300 0001 00000000 0x0 0x0
0xffffd50000019380 0041 00000000 0x0 0x0
0xffffd50000019400 0041 00000000 0x0 0x0
0xffffd50000019480 0041 00000000 0x0 0x0
0xffffd50000019500 0041 00000000 0x0 0x0
0xffffd50000019580 0041 00000000 0x0 0x0
0xffffd50000019600 0045 00000000 0x0 0x0
0xffffd50000019680 0045 00000000 0x0 0x0
0xffffd50000019700 0041 00000000 0x0 0x0
0xffffd50000019780 0041 00000000 0x0 0x0
0xffffd50000019800 0041 00000000 0x0 0x0
0xffffd50000019880 0041 00000000 0x0 0x0
0xffffd50000019900 0041 00000000 0x0 0x0
0xffffd50000019980 0041 00000000 0x0 0x0
0xffffd50000019a00 0045 00000000 0x0 0x0
0xffffd50000019a80 0045 00000000 0x0 0x0
0xffffd50000019b00 0041 00000000 0x0 0x0
0xffffd50000019b80 0041 00000000 0x0 0x0
0xffffd50000019c00 0041 00000000 0x0 0x0
0xffffd50000019c80 0041 00000000 0x0 0x0
0xffffd50000019d00 0041 00000000 0x0 0x0
0xffffd50000019d80 0041 00000000 0x0 0x0
0xffffd50000019e00 0045 00000000 0x0 0x0
0xffffd50000019e80 0045 00000000 0x0 0x0
0xffffd50000019f00 0041 00000000 0x0 0x0
0xffffd50000019f80 0045 00000000 0x0 0x0
0xffffd5000001a000 0041 00000000 0x0 0x0
0xffffd5000001a080 0041 00000000 0x0 0x0
0xffffd5000001a100 0041 00000000 0x0 0x0
0xffffd5000001a180 0045 00000000 0x0 0x0
0xffffd5000001a200 0045 00000000 0x0 0x0
0xffffd5000001a280 0045 00000000 0x0 0x0
0xffffd5000001a300 0041 00000000 0x0 0x0
0xffffd5000001a380 0045 00000000 0x0 0x0
0xffffd5000001a400 0041 00000000 0x0 0x0
0xffffd5000001a480 0041 00000000 0x0 0x0
0xffffd5000001a500 0041 00000000 0x0 0x0
0xffffd5000001a580 0045 00000000 0x0 0x0
0xffffd5000001a600 0045 00000000 0x0 0x0
0xffffd5000001a680 0045 00000000 0x0 0x0
0xffffd5000001a700 0045 00000000 0x0 0x0
0xffffd5000001a780 0045 00000000 0x0 0x0
0xffffd5000001a800 0041 00000000 0x0 0x0
0xffffd5000001a880 0001 00000000 0x0 0x0
0xffffd5000001a900 0001 00000000 0x0 0x0
0xffffd5000001a980 0001 00000000 0x0 0x0
0xffffd5000001aa00 0001 00000000 0x0 0x0
0xffffd5000001aa80 0001 00000000 0x0 0x0
0xffffd5000001ab00 0001 00000000 0x0 0x0
0xffffd5000001ab80 0001 00000000 0x0 0x0
0xffffd5000001ac00 0001 00000000 0x0 0x0
0xffffd5000001ac80 0001 00000000 0x0 0x0
0xffffd5000001ad00 0001 00000000 0x0 0x0
0xffffd5000001ad80 0001 00000000 0x0 0x0
0xffffd5000001ae00 0001 00000000 0x0 0x0
0xffffd5000001ae80 0001 00000000 0x0 0x0
0xffffd5000001af00 0001 00000000 0x0 0x0
0xffffd5000001af80 0001 00000000 0x0 0x0
0xffffd5000001b000 0001 00000000 0x0 0x0
0xffffd5000001b080 0001 00000000 0x0 0x0
0xffffd5000001b100 0001 00000000 0x0 0x0
0xffffd5000001b180 0001 00000000 0x0 0x0
0xffffd5000001b200 0001 00000000 0x0 0x0
0xffffd5000001b280 0001 00000000 0x0 0x0
0xffffd5000001b300 0001 00000000 0x0 0x0
0xffffd5000001b380 0001 00000000 0x0 0x0
0xffffd5000001b400 0001 00000000 0x0 0x0
0xffffd5000001b480 0001 00000000 0x0 0x0
0xffffd5000001b500 0001 00000000 0x0 0x0
0xffffd5000001b580 0001 00000000 0x0 0x0
0xffffd5000001b600 0001 00000000 0x0 0x0
0xffffd5000001b680 0001 00000000 0x0 0x0
0xffffd5000001b700 0001 00000000 0x0 0x0
0xffffd5000001b780 0001 00000000 0x0 0x0
0xffffd5000001b800 0001 00000000 0x0 0x0
0xffffd5000001b880 0001 00000000 0x0 0x0
0xffffd5000001b900 0001 00000000 0x0 0x0
0xffffd5000001b980 0001 00000000 0x0 0x0
0xffffd5000001ba00 0001 00000000 0x0 0x0
0xffffd5000001ba80 0001 00000000 0x0 0x0
0xffffd5000001bb00 0001 00000000 0x0 0x0
0xffffd5000001bb80 0001 00000000 0x0 0x0
0xffffd5000001bc00 0001 00000000 0x0 0x0
0xffffd5000001bc80 0001 00000000 0x0 0x0
0xffffd5000001bd00 0001 00000000 0x0 0x0
0xffffd5000001bd80 0001 00000000 0x0 0x0
0xffffd5000001be00 0001 00000000 0x0 0x0
0xffffd5000001be80 0001 00000000 0x0 0x0
0xffffd5000001bf00 0001 00000000 0x0 0x0
0xffffd5000001bf80 0001 00000000 0x0 0x0
0xffffd5000001c000 0001 00000000 0x0 0x0
0xffffd5000001c080 0001 00000000 0x0 0x0
0xffffd5000001c100 0001 00000000 0x0 0x0
0xffffd5000001c180 0001 00000000 0x0 0x0
0xffffd5000001c200 0001 00000000 0x0 0x0
0xffffd5000001c280 0001 00000000 0x0 0x0
0xffffd5000001c300 0001 00000000 0x0 0x0
0xffffd5000001c380 0001 00000000 0x0 0x0
0xffffd5000001c400 0001 00000000 0x0 0x0
0xffffd5000001c480 0001 00000000 0x0 0x0
0xffffd5000001c500 0001 00000000 0x0 0x0
0xffffd5000001c580 0001 00000000 0x0 0x0
0xffffd5000001c600 0001 00000000 0x0 0x0
0xffffd5000001c680 0001 00000000 0x0

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Jul 29, 2020, 4:02:22 AM7/29/20

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 47132c89 cninit - don't reset cn_tab on entry.
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=155613c4900000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=a63ae6c58df86f40b6f3
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13265522900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa0cbc900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a63ae6...@syzkaller.appspotmail.com

[ 49.6089802] panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/subr_autoconf.c:1343:19, pointer expression with base 0 overflowed to 0xfffffffffffc0010

[ 49.6189562] cpu1: Begin traceback...
[ 49.6389576] vpanic() at netbsd:vpanic+0x2d3 sys/kern/subr_prf.c:290
[ 49.6889609] isAlreadyReported() at netbsd:isAlreadyReported
[ 49.7389593] HandlePointerOverflow() at netbsd:HandlePointerOverflow+0xd7 sys/../common/lib/libc/misc/ubsan.c:706
[ 49.7889644] config_devalloc() at netbsd:config_devalloc+0x93c config_unit_nextfree sys/kern/subr_autoconf.c:1343 [inline]
[ 49.7889644] config_devalloc() at netbsd:config_devalloc+0x93c config_unit_alloc sys/kern/subr_autoconf.c:1365 [inline]
[ 49.7889644] config_devalloc() at netbsd:config_devalloc+0x93c sys/kern/subr_autoconf.c:1420
[ 49.8389595] config_attach_pseudo() at netbsd:config_attach_pseudo+0x21 sys/kern/subr_autoconf.c:1648
[ 49.8889618] vndopen() at netbsd:vndopen+0x4cb vnd_spawn sys/dev/vnd.c:308 [inline]
[ 49.8889618] vndopen() at netbsd:vndopen+0x4cb sys/dev/vnd.c:339
[ 49.9389594] cdev_open() at netbsd:cdev_open+0x166 sys/kern/subr_devsw.c:871
[ 49.9789600] spec_open() at netbsd:spec_open+0x42f sys/miscfs/specfs/spec_vnops.c:563
[ 50.0289617] VOP_OPEN() at netbsd:VOP_OPEN+0x12f sys/kern/vnode_if.c:298
[ 50.0789618] vn_open() at netbsd:vn_open+0x570 sys/kern/vfs_vnops.c:261
[ 50.1189583] do_open() at netbsd:do_open+0x22f sys/kern/vfs_syscalls.c:1668
[ 50.1689601] do_sys_openat() at netbsd:do_sys_openat+0xc6 sys/kern/vfs_syscalls.c:1752
[ 50.2189599] sys_open() at netbsd:sys_open+0x5c sys/kern/vfs_syscalls.c:1773
[ 50.2689606] sys_syscall() at netbsd:sys_syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
[ 50.2689606] sys_syscall() at netbsd:sys_syscall+0x1cf sys/kern/sys_syscall.c:77
[ 50.3089616] syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
[ 50.3089616] syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 50.3089616] syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138
[ 50.3289633] --- syscall (number 0) ---
[ 50.3389587] netbsd:syscall+0x2d5:
[ 50.3489581] cpu1: End traceback...
[ 50.3489581] fatal breakpoint trap in supervisor mode
[ 50.3489581] trap type 1 code 0 rip 0xffffffff80221a85 cs 0x8 rflags 0x246 cr2 0x20000000 ilevel 0x8 rsp 0xffffa500bf358490
[ 50.3589542] curlwp 0xffff8d5b294629c0 pid 736.736 lowest kstack 0xffffa500bf3542c0
Stopped in pid 736.736 (syz-executor9706) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x2d3 sys/kern/subr_prf.c:290
isAlreadyReported() at netbsd:isAlreadyReported
HandlePointerOverflow() at netbsd:HandlePointerOverflow+0xd7 sys/../common/lib/libc/misc/ubsan.c:706
config_devalloc() at netbsd:config_devalloc+0x93c config_unit_nextfree sys/kern/subr_autoconf.c:1343 [inline]
config_devalloc() at netbsd:config_devalloc+0x93c config_unit_alloc sys/kern/subr_autoconf.c:1365 [inline]
config_devalloc() at netbsd:config_devalloc+0x93c sys/kern/subr_autoconf.c:1420
config_attach_pseudo() at netbsd:config_attach_pseudo+0x21 sys/kern/subr_autoconf.c:1648
vndopen() at netbsd:vndopen+0x4cb vnd_spawn sys/dev/vnd.c:308 [inline]
vndopen() at netbsd:vndopen+0x4cb sys/dev/vnd.c:339
cdev_open() at netbsd:cdev_open+0x166 sys/kern/subr_devsw.c:871
spec_open() at netbsd:spec_open+0x42f sys/miscfs/specfs/spec_vnops.c:563
VOP_OPEN() at netbsd:VOP_OPEN+0x12f sys/kern/vnode_if.c:298
vn_open() at netbsd:vn_open+0x570 sys/kern/vfs_vnops.c:261
do_open() at netbsd:do_open+0x22f sys/kern/vfs_syscalls.c:1668
do_sys_openat() at netbsd:do_sys_openat+0xc6 sys/kern/vfs_syscalls.c:1752
sys_open() at netbsd:sys_open+0x5c sys/kern/vfs_syscalls.c:1773

sys_syscall() at netbsd:sys_syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
sys_syscall() at netbsd:sys_syscall+0x1cf sys/kern/sys_syscall.c:77

syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138

--- syscall (number 0) ---

netbsd:syscall+0x2d5:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/kern/subr_autoconf.c:1343:19, pointer expression with base 0 overflowed to 0xfffffffffffc0010

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1078 1078 2 0 0 ffff8d5b280244c0 syz-executor9706
1073 1073 2 0 0 ffff8d5b28e92940 syz-executor9706
1080 1080 2 0 0 ffff8d5b28f12100 syz-executor9706
1081 1081 2 0 0 ffff8d5b290f7180 syz-executor9706
1067 1067 2 0 0 ffff8d5b28e920c0 syz-executor9706
736 > 736 7 1 0 ffff8d5b294629c0 syz-executor9706
1075 1075 2 0 40 ffff8d5b29462140 syz-executor9706
1121 1121 3 1 80 ffff8d5b26c83a80 syz-executor9706 nanoslp
1253 >1253 7 0 40 ffff8d5b26e23240 syz-executor9706
1069 1069 3 1 80 ffff8d5b28f12980 syz-executor9706 nanoslp
1068 1068 2 0 0 ffff8d5b29462580 syz-executor9706
1065 1065 3 1 80 ffff8d5b26c83200 sshd select
1102 1102 3 1 80 ffff8d5b28024900 getty nanoslp
1088 1088 3 0 80 ffff8d5b28024080 getty nanoslp
1089 1089 3 1 80 ffff8d5b26c83640 getty nanoslp
948 948 3 1 c0 ffff8d5b26a2e5c0 getty ttyraw
938 938 3 1 80 ffff8d5b28f12540 sshd select
962 962 3 0 80 ffff8d5b28e92500 powerd kqueue
734 734 3 0 80 ffff8d5b272962c0 syslogd kqueue
591 591 3 0 80 ffff8d5b27ff7340 dhcpcd poll
589 589 3 1 80 ffff8d5b2714c280 dhcpcd poll
587 587 3 0 80 ffff8d5b26e23ac0 dhcpcd poll
412 412 3 0 80 ffff8d5b26e23680 dhcpcd poll
347 347 3 0 80 ffff8d5b27296b40 dhcpcd poll
346 346 3 1 80 ffff8d5b27296700 dhcpcd poll
345 345 3 0 80 ffff8d5b2714c6c0 dhcpcd poll
1 1 3 0 80 ffff8d5b1e88d900 init wait
0 821 3 0 200 ffff8d5b26a2ea00 physiod physiod
0 166 3 0 200 ffff8d5b26ac7a40 pooldrain pooldrain
0 165 3 0 200 ffff8d5b26ac7600 ioflush syncer
0 164 3 1 200 ffff8d5b26ac71c0 pgdaemon pgdaemon
0 161 3 1 200 ffff8d5b26a2e180 usb7 usbevt
0 31 3 1 200 ffff8d5b239e19c0 usb6 usbevt
0 63 3 1 200 ffff8d5b239e1580 usb5 usbevt
0 126 3 1 200 ffff8d5b239e1140 usb4 usbevt
0 125 3 1 200 ffff8d5b20984980 usb3 usbevt
0 124 3 1 200 ffff8d5b20984540 usb2 usbevt
0 123 3 1 200 ffff8d5b20984100 usb1 usbevt
0 122 3 1 200 ffff8d5b1f952940 usb0 usbevt
0 121 3 1 200 ffff8d5b1f952500 usbtask-dr usbtsk
0 120 3 1 200 ffff8d5b1f9520c0 usbtask-hc usbtsk
0 119 3 0 200 ffff8d5b1bd4aac0 npfgc0 npfgcw
0 118 3 1 200 ffff8d5b1e88d4c0 rt_free rt_free
0 117 3 1 200 ffff8d5b1e88d080 unpgc unpgc
0 116 3 0 200 ffff8d5b1e8a88c0 key_timehandler key_timehandler
0 115 3 1 200 ffff8d5b1e8a8480 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffff8d5b1e8a8040 icmp6_wqinput/0 icmp6_wqinput
0 113 3 0 200 ffff8d5b1e843bc0 nd6_timer nd6_timer
0 112 3 1 200 ffff8d5b1e843780 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffff8d5b1e843340 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffff8d5b1e801700 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffff8d5b1e801b40 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffff8d5b1e806b80 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffff8d5b1e806740 icmp_wqinput/0 icmp_wqinput
0 106 3 0 200 ffff8d5b1e806300 rt_timer rt_timer
0 105 3 1 200 ffff8d5b1e8012c0 vmem_rehash vmem_rehash
0 104 3 0 200 ffff8d5b1e198b00 entbutler entropy
0 30 3 1 200 ffff8d5b1e1986c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffff8d5b1e198280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffff8d5b1bd4a680 scsibus0 sccomp
0 26 3 0 200 ffff8d5b1bd4a240 pms0 pmsreset
0 25 3 1 200 ffff8d5b1bc7ca80 xcall/1 xcall
0 24 1 1 200 ffff8d5b1bc7c640 softser/1
0 23 1 1 200 ffff8d5b1bc7c200 softclk/1
0 22 1 1 200 ffff8d5b1bc4fa40 softbio/1
0 21 1 1 200 ffff8d5b1bc4f600 softnet/1
0 20 1 1 201 ffff8d5b1bc4f1c0 idle/1
0 19 3 0 200 ffff8d5c2bb8fa00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffff8d5c2bb8f5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffff8d5c2bb8f180 lnxsyswq lnxsyswq
0 16 3 0 200 ffff8d5c2bb9c9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffff8d5c2bb9c580 sysmon smtaskq
0 14 3 0 200 ffff8d5c2bb9c140 pmfsuspend pmfsuspend
0 13 3 0 200 ffff8d5c2bbb9980 pmfevent pmfevent
0 12 3 0 200 ffff8d5c2bbb9540 sopendfree sopendfr
0 11 3 0 200 ffff8d5c2bbb9100 iflnkst iflnkst
0 10 3 0 200 ffff8d5c2cbd8940 nfssilly nfssilly
0 9 3 0 200 ffff8d5c2cbd8500 vdrain vdrain
0 8 3 0 200 ffff8d5c2cbd80c0 modunload mod_unld
0 7 3 0 200 ffff8d5c2cc13900 xcall/0 xcall
0 6 1 0 200 ffff8d5c2cc134c0 softser/0
0 5 1 0 200 ffff8d5c2cc13080 softclk/0
0 4 1 0 200 ffff8d5c2cc3d8c0 softbio/0
0 3 1 0 200 ffff8d5c2cc3d480 softnet/0
0 2 1 0 201 ffff8d5c2cc3d040 idle/0

0 0 3 0 200 ffffffff85efbb00 swapper uvm
[Locks tracked through LWPs]

****** LWP 1068.1068 (syz-executor9706) @ 0xffff8d5b29462580, l_stat=2

*** Locks held:

* Lock 0 (initialized at amap_alloc1)
lock address : 0xffff8d5b29bf8c00 type : sleep/adaptive
initialized : 0xffffffff830eee8c

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffff8d5b29462580 last held: 0xffff8d5b29462580
last locked* : 0xffffffff8311259c unlocked : 0xffffffff830f77aa
owner/count : 000000000000000000 flags : 000000000000000000

Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffff8d5b2801c580 type : sleep/adaptive
initialized : 0xffffffff80f83ea3

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 1

relevant cpu : 0 last held: 0

relevant lwp : 0xffff8d5b29462580 last held: 000000000000000000
last locked : 0xffffffff80f83aa7 unlocked*: 0xffffffff80f83be6

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 589.589 (dhcpcd) @ 0xffff8d5b2714c280, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa540 type : sleep/adaptive
initialized : 0xffffffff8323a320
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffff8d5b2714c280 last held: 000000000000000000