ASan: Unauthorized Access in config_detach

9 views

Skip to first unread message

syzbot

unread,

Sep 28, 2022, 12:13:39 AM9/28/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: cc1aa0e44393 Extent rtl8188eu_txagc[] (in a quite cryptic ..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1708276c880000
kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=c3f781d5b15c86b594a2
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/dfbf14b1e348/disk-cc1aa0e4.raw.xz
netbsd.gdb: https://storage.googleapis.com/cd812801421b/netbsd-cc1aa0e4.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c3f781...@syzkaller.appspotmail.com

[ 140.1936109] panic: ASan: Unauthorized Access In 0xffffffff81bac166: Addr 0xffffd5801287752b [1 byte, read, PoolUseAfterFree]

[ 140.2135955] cpu1: Begin traceback...
[ 140.2235984] vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:293
[ 140.2636042] panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1043
[ 140.3035982] kasan_report() at netbsd:kasan_report+0x8f kasan_code_name sys/kern/subr_asan.c:168 [inline]
[ 140.3035982] kasan_report() at netbsd:kasan_report+0x8f sys/kern/subr_asan.c:200
[ 140.3535989] __asan_load1() at netbsd:__asan_load1+0x72 sys/kern/subr_asan.c:431
[ 140.3935993] config_detach() at netbsd:config_detach+0xaa sys/kern/subr_autoconf.c:2005
[ 140.4236006] dkwedge_delall1() at netbsd:dkwedge_delall1+0x1f7 dkwedge_del1 sys/dev/dkwedge/dk.c:574 [inline]
[ 140.4236006] dkwedge_delall1() at netbsd:dkwedge_delall1+0x1f7 sys/dev/dkwedge/dk.c:719
[ 140.4536002] disk_ioctl() at netbsd:disk_ioctl+0x2d2 sys/kern/subr_disk.c:645
[ 140.4836035] dk_ioctl() at netbsd:dk_ioctl+0x1b2 sys/dev/dksubr.c:642
[ 140.5036028] sdioctl() at netbsd:sdioctl+0xa12 sys/dev/scsipi/sd.c:1005
[ 140.5336005] cdev_ioctl() at netbsd:cdev_ioctl+0x177 sys/kern/subr_devsw.c:1250
[ 140.5636012] spec_ioctl() at netbsd:spec_ioctl+0x148 sys/miscfs/specfs/spec_vnops.c:1321
[ 140.5936008] VOP_IOCTL() at netbsd:VOP_IOCTL+0x132 sys/kern/vnode_if.c:934
[ 140.6236021] vn_ioctl() at netbsd:vn_ioctl+0x1c0 sys/kern/vfs_vnops.c:868
[ 140.6536024] sys_ioctl() at netbsd:sys_ioctl+0x8f6 sys/kern/sys_generic.c:675
[ 140.6836041] sys___syscall() at netbsd:sys___syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
[ 140.6836041] sys___syscall() at netbsd:sys___syscall+0x10e sys/kern/sys_syscall.c:90
[ 140.7135994] syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
[ 140.7135994] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 140.7135994] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
[ 140.7235990] --- syscall (number 54 via SYS_syscall) ---
[ 140.7336000] netbsd:syscall+0x25a:
[ 140.7436021] cpu1: End traceback...
[ 140.7436021] fatal breakpoint trap in supervisor mode
[ 140.7535947] trap type 1 code 0 rip 0xffffffff8023230d cs 0x8 rflags 0x286 cr2 0x7321e7c4c72d ilevel 0 rsp 0xffffd58251702200
[ 140.7635950] curlwp 0xffffd58012a10300 pid 7341.7380 lowest kstack 0xffffd582516fb2c0
Stopped in pid 7341.7380 (syz-executor.4) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:293
panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1043
kasan_report() at netbsd:kasan_report+0x8f kasan_code_name sys/kern/subr_asan.c:168 [inline]
kasan_report() at netbsd:kasan_report+0x8f sys/kern/subr_asan.c:200
__asan_load1() at netbsd:__asan_load1+0x72 sys/kern/subr_asan.c:431
config_detach() at netbsd:config_detach+0xaa sys/kern/subr_autoconf.c:2005
dkwedge_delall1() at netbsd:dkwedge_delall1+0x1f7 dkwedge_del1 sys/dev/dkwedge/dk.c:574 [inline]
dkwedge_delall1() at netbsd:dkwedge_delall1+0x1f7 sys/dev/dkwedge/dk.c:719
disk_ioctl() at netbsd:disk_ioctl+0x2d2 sys/kern/subr_disk.c:645
dk_ioctl() at netbsd:dk_ioctl+0x1b2 sys/dev/dksubr.c:642
sdioctl() at netbsd:sdioctl+0xa12 sys/dev/scsipi/sd.c:1005
cdev_ioctl() at netbsd:cdev_ioctl+0x177 sys/kern/subr_devsw.c:1250
spec_ioctl() at netbsd:spec_ioctl+0x148 sys/miscfs/specfs/spec_vnops.c:1321
VOP_IOCTL() at netbsd:VOP_IOCTL+0x132 sys/kern/vnode_if.c:934
vn_ioctl() at netbsd:vn_ioctl+0x1c0 sys/kern/vfs_vnops.c:868
sys_ioctl() at netbsd:sys_ioctl+0x8f6 sys/kern/sys_generic.c:675
sys___syscall() at netbsd:sys___syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x10e sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
--- syscall (number 54 via SYS_syscall) ---
netbsd:syscall+0x25a:
Panic string: ASan: Unauthorized Access In 0xffffffff81bac166: Addr 0xffffd5801287752b [1 byte, read, PoolUseAfterFree]

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
6742 6742 2 1 0 ffffd58013e98b00 syz-executor.0
7258 7258 2 1 0 ffffd58012c9a8c0 syz-executor.5
7341 >7380 7 1 100 ffffd58012a10300 syz-executor.4
7341 7341 2 0 10000000 ffffd58012c3b2c0 syz-executor.4
6855 6507 3 0 0 ffffd580126db780 syz-executor.3 xclocv
6855 6855 2 1 10000000 ffffd58012bf7640 syz-executor.3
6853 6827 2 0 0 ffffd58013f77340 syz-executor.1
6853 6853 2 0 10000000 ffffd58013fed4c0 syz-executor.1
6889 7113 3 0 180 ffffd58012aae080 syz-executor.2 parked
6889 6889 2 0 10040000 ffffd58012d6ebc0 syz-executor.2
1757 1757 3 1 180 ffffd58013438300 syz-executor.5 parked
458 > 458 7 0 140 ffffd58012cc6540 syz-executor.1
331 331 3 1 180 ffffd58012ad50c0 syz-executor.1 parked
1072 1383 3 1 1100000 ffffd58012b74540 syz-executor.1 vfork
1072 1072 2 1 11000040 ffffd58012b8e580 syz-executor.1
1241 1241 2 1 140 ffffd58013e986c0 syz-executor.3
1240 1240 2 1 140 ffffd58013e10680 syz-executor.5
1237 1237 2 1 140 ffffd58013deaa80 syz-executor.4
990 990 2 1 140 ffffd58013ce7a40 syz-executor.2
991 991 2 0 140 ffffd580133945c0 syz-executor.0
1228 1329 3 0 1c0 ffffd580134a25c0 syz-fuzzer wait
1228 1232 3 0 180 ffffd58012b74100 syz-fuzzer parked
1228 828 3 1 180 ffffd58013e10ac0 syz-fuzzer kqueue
1228 448 3 1 180 ffffd58013e10240 syz-fuzzer wait
1228 988 3 1 180 ffffd58013dea200 syz-fuzzer parked
1228 1229 3 1 180 ffffd58013ce7600 syz-fuzzer wait
1228 1222 3 1 1c0 ffffd5801348a9c0 syz-fuzzer wait
1228 1082 3 0 180 ffffd5801348a580 syz-fuzzer parked
1228 1078 3 0 180 ffffd5801348a140 syz-fuzzer wait
1228 1234 3 0 180 ffffd58012bf7a80 syz-fuzzer parked
1228 1111 3 0 180 ffffd580126dc480 syz-fuzzer wait
1228 1224 3 0 180 ffffd58012992b40 syz-fuzzer parked
1228 1228 3 0 180 ffffd58012aae4c0 syz-fuzzer parked
935 935 3 1 180 ffffd5801342c700 sshd select
1081 1081 3 1 180 ffffd580133bb640 getty nanoslp
1086 1086 3 0 180 ffffd580133c8680 getty nanoslp
1071 1071 3 0 180 ffffd580133c8240 getty nanoslp
1079 1079 3 1 1c0 ffffd580134a2180 getty ttyraw
1000 1000 3 1 180 ffffd580133b01c0 sshd select
895 895 3 1 180 ffffd58012ca9080 powerd kqueue
693 693 2 1 100 ffffd58012c5cb80 syslogd
742 742 3 0 180 ffffd58012c06680 dhcpcd poll
547 547 3 0 180 ffffd58012cb30c0 dhcpcd poll
465 465 3 0 180 ffffd58012c3bb40 dhcpcd poll
595 595 3 1 180 ffffd58012c1e280 dhcpcd poll
292 292 3 0 180 ffffd58012da84c0 dhcpcd poll
290 290 3 1 180 ffffd58012da8080 dhcpcd poll
289 289 3 1 180 ffffd58012d868c0 dhcpcd poll
1 1 3 1 180 ffffd58012869180 init wait
0 6378 5 0 200 ffffd58012c86bc0 (zombie)
0 928 3 0 200 ffffd5801298f280 physiod physiod
0 195 3 0 200 ffffd580129922c0 pooldrain pooldrain
0 194 3 1 200 ffffd5801298fb00 ioflush syncer
0 193 3 1 200 ffffd5801298f6c0 pgdaemon pgdaemon
0 172 3 1 200 ffffd58012967680 usb7 usbevt
0 170 3 1 200 ffffd58012967240 usb6 usbevt
0 168 3 1 200 ffffd5801291da80 usb5 usbevt
0 166 3 0 200 ffffd5801291d640 usb4 usbevt
0 165 3 1 200 ffffd5801291d200 usb3 usbevt
0 31 3 0 200 ffffd580128d1a40 usb2 usbevt
0 63 3 1 200 ffffd580128d1600 usb1 usbevt
0 126 3 0 200 ffffd580128d11c0 usb0 usbevt
0 125 3 1 200 ffffd58012869a00 usbtask-dr usbtsk
0 124 3 1 200 ffffd58010d77b00 usbtask-hc usbtsk
0 123 3 0 200 ffffd580128695c0 npfgc0 npfgcw
0 122 3 1 200 ffffd5801285a9c0 rt_free rt_free
0 121 3 1 200 ffffd5801285a580 unpgc unpgc
0 120 3 0 200 ffffd5801285a140 key_timehandler key_timehandler
0 119 3 1 200 ffffd5801270b980 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffd5801270b540 icmp6_wqinput/0 icmp6_wqinput
0 117 3 1 200 ffffd5801270b100 nd6_timer nd6_timer
0 116 3 1 200 ffffd58012703940 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffd58012703500 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffd580127030c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffd580126f5900 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffd580126f54c0 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffd580126f5080 icmp_wqinput/0 icmp_wqinput
0 110 3 1 200 ffffd580126dc8c0 rt_timer rt_timer
0 109 3 1 200 ffffd580126dc040 vmem_rehash vmem_rehash
0 100 3 1 200 ffffd580126d8300 entbutler entropy
0 99 3 0 200 ffffd580120bdb40 viomb balloon
0 98 3 1 200 ffffd580120bd700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffd580120bd2c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 ffffd58010d776c0 scsibus0 sccomp
0 29 3 0 200 ffffd58010d77280 pms0 pmsreset
0 28 2 1 200 ffffd58010cbcac0 xcall/1
0 27 1 1 200 ffffd58010cbc680 softser/1
0 26 3 1 200 ffffd58010cbc240 softclk/1 tstile
0 25 1 1 200 ffffd58010cb9a80 softbio/1
0 24 1 1 200 ffffd58010cb9640 softnet/1
0 23 1 1 201 ffffd58010cb9200 idle/1
0 22 3 1 200 ffffd5800fb57a40 lnxsyswq lnxsyswq
0 21 3 1 200 ffffd5800fb57600 lnxubdwq lnxubdwq
0 20 3 1 200 ffffd5800fb571c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffffd5800fb56a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffd5800fb565c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffffd5800fb56180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffd5800fb4f9c0 sysmon smtaskq
0 15 3 1 200 ffffd5800fb4f580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffd5800fb4f140 pmfevent pmfevent
0 13 3 0 200 ffffd5800fb4a980 sopendfree sopendfr
0 12 3 0 200 ffffd5800fb4a540 ifwdog ifwdog
0 11 3 1 200 ffffd5800fb4a100 iflnkst iflnkst
0 10 3 0 200 ffffd5800fb3d940 nfssilly nfssilly
0 9 3 0 200 ffffd5800fb3d500 vdrain vdrain
0 8 3 1 200 ffffd5800fb3d0c0 modunload mod_unld
0 7 3 0 200 ffffd5800fb34900 xcall/0 xcall
0 6 1 0 200 ffffd5800fb344c0 softser/0
0 > 5 7 0 200 ffffd5800fb34080 softclk/0
0 4 1 0 200 ffffd5800fb328c0 softbio/0
0 3 1 0 200 ffffd5800fb32480 softnet/0
0 2 1 0 201 ffffd5800fb32040 idle/0
0 0 3 0 200 ffffffff83345400 swapper uvm
[Locks tracked through LWPs]

****** LWP 7258.7258 (syz-executor.5) @ 0xffffd58012c9a8c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:pmap_ctor+0x93 sys/arch/x86/x86/pmap.c:2860)
lock address : ffffd58012d35180
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x93
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffd58012c9a8c0 last held: 0xffffd58012c9a8c0
last locked* : netbsd:pmap_enter_ma+0x386
unlocked : netbsd:pmap_extract+0x345
owner field : 0xffffd58012c9a8c0 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 7341.7380 (syz-executor.4) @ 0xffffd58012a10300, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:config_init+0x54 sys/kern/subr_autoconf.c:366)
lock address : netbsd:config_misc_lock
type : sleep/adaptive
initialized : netbsd:config_init+0x54
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffd58012a10300 last held: 000000000000000000
last locked : netbsd:localcount_xc+0x24
unlocked* : netbsd:xc_thread+0x116
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 547.547 (dhcpcd) @ 0xffffd58012cb30c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffd58012cb30c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 465.465 (dhcpcd) @ 0xffffd58012c3bb40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffd58012c3bb40 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 290.290 (dhcpcd) @ 0xffffd58012da8080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffd58012da8080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 289.289 (dhcpcd) @ 0xffffd58012d868c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffd58012d868c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffd5800fb4a100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffd5800fb4a100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffd5800fb34080, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffd5800fb34080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff83345400, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff83345400 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu1:

* Lock 0 (initialized at netbsd:main+0x12e sys/kern/init_main.c:303)
lock address : netbsd:kernel_lock
type : spin
initialized : netbsd:main+0x12e
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffd58012a10300 last held: 0xffffd58012a10300
last locked* : netbsd:config_detach+0x80
unlocked : netbsd:cv_enter+0x20e
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at netbsd:kprintf_init+0x61 sys/kern/subr_prf.c:157)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x61
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffd58012a10300 last held: 0xffffd58012a10300
last locked* : netbsd:kprintf_lock+0x33
unlocked : netbsd:kprintf_unlock+0x53
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffffd58000017180 0041 00000000 0x0 0x0
0xffffd58000017200 0041 00000000 0x0 0x0
0xffffd58000017280 0041 00000000 0x0 0x0
0xffffd58000017300 0041 00000000 0x0 0x0
0xffffd58000017380 0041 00000000 0x0 0x0
0xffffd58000017400 0041 00000000 0x0 0x0
0xffffd58000017480 0041 00000000 0x0 0x0
0xffffd58000017500 0041 00000000 0x0 0x0
0xffffd58000017580 0041 00000000 0x0 0x0
0xffffd58000017600 0041 00000000 0x0 0x0
0xffffd58000017680 0041 00000000 0x0 0x0
0xffffd58000017700 0041 00000000 0x0 0x0
0xffffd58000017780 0041 00000000 0x0 0x0
0xffffd58000017800 0041 00000000 0x0 0x0
0xffffd58000017880 0041 00000000 0x0 0x0
0xffffd58000017900 0041 00000000 0x0 0x0
0xffffd58000017980 0041 00000000 0x0 0x0
0xffffd58000017a00 0041 00000000 0x0 0x0
0xffffd58000017a80 0041 00000000 0x0 0x0
0xffffd58000017b00 0041 00000000 0x0 0x0
0xffffd58000017b80 0041 00000000 0x0 0x0
0xffffd58000017c00 0041 00000000 0x0 0x0
0xffffd58000017c80 0041 00000000 0x0 0x0
0xffffd58000017d00 0041 00000000 0x0 0x0
0xffffd58000017d80 0041 00000000 0x0 0x0
0xffffd58000017e00 0041 00000000 0x0 0x0
0xffffd58000017e80 0041 00000000 0x0 0x0
0xffffd58000017f00 0041 00000000 0x0 0x0
0xffffd58000017f80 0041 00000000 0x0 0x0
0xffffd58000018000 0041 00000000 0x0 0x0
0xffffd58000018080 0041 00000000 0x0 0x0
0xffffd58000018100 0041 00000000 0x0 0x0
0xffffd58000018180 0041 00000000 0x0 0x0
0xffffd58000018200 0041 00000000 0x0 0x0
0xffffd58000018280 0041 00000000 0x0 0x0
0xffffd58000018300 0041 00000000 0x0 0x0
0xffffd58000018380 0041 00000000 0x0 0x0
0xffffd58000018400 0041 00000000 0x0 0x0
0xffffd58000018480 0041 00000000 0x0 0x0
0xffffd58000018500 0041 00000000 0x0 0x0
0xffffd58000018580 0041 00000000 0x0 0x0
0xffffd58000018600 0041 00000000 0x0 0x0
0xffffd58000018680 0041 00000000 0x0 0x0
0xffffd58000018700 0041 00000000 0x0 0x0
0xffffd58000018780 0041 00000000 0x0 0x0
0xffffd58000018800 0041 00000000 0x0 0x0
0xffffd58000018880 0041 00000000 0x0 0x0
0xffffd58000018900 0041 00000000 0x0 0x0
0xffffd58000018980 0041 00000000 0x0 0x0
0xffffd58000018a00 0041 00000000 0x0 0x0
0xffffd58000018a80 0041 00000000 0x0 0x0
0xffffd58000018b00 0041 00000000 0x0 0x0
0xffffd58000018b80 0041 00000000 0x0 0x0
0xffffd58000018c00 0041 00000000 0x0 0x0
0xffffd58000018c80 0041 00000000 0x0 0x0
0xffffd58000018d00 0041 00000000 0x0 0x0
0xffffd58000018d80 0041 00000000 0x0 0x0
0xffffd58000018e00 0041 00000000 0x0 0x0
0xffffd58000018e80 0041 00000000 0x0 0x0
0xffffd58000018f00 0041 00000000 0x0 0x0
0xffffd58000018f80 0041 00000000 0x0 0x0
0xffffd58000019000 0041 00000000 0x0 0x0
0xffffd58000019080 0041 00000000 0x0 0x0
0xffffd58000019100 0041 00000000 0x0 0x0
0xffffd58000019180 0041 00000000 0x0 0x0
0xffffd58000019200 0041 00000000 0x0 0x0
0xffffd58000019280 0041 00000000 0x0 0x0
0xffffd58000019300 0041 00000000 0x0 0x0
0xffffd58000019380 0041 00000000 0x0 0x0
0xffffd58000019400 0041 00000000 0x0 0x0
0xffffd58000019480 0041 00000000 0x0 0x0
0xffffd58000019500 0041 00000000 0x0 0x0
0xffffd58000019580 0041 00000000 0x0 0x0
0xffffd58000019600 0041 00000000 0x0 0x0
0xffffd58000019680 0041 00000000 0x0 0x0
0xffffd58000019700 0041 00000000 0x0 0x0
0xffffd58000019780 0041 00000000 0x0 0x0
0xffffd58000019800 0041 00000000 0x0 0x0
0xffffd58000019880 0041 00000000 0x0 0x0
0xffffd58000019900 0041 00000000 0x0 0x0
0xffffd58000019980 0041 00000000 0x0 0x0
0xffffd58000019a00 0041 00000000 0x0 0x0
0xffffd58000019a80 0041 00000000 0x0 0x0
0xffffd58000019b00 0041 00000000 0x0 0x0
0xffffd58000019b80 0041 00000000 0x0 0x0
0xffffd58000019c00 0041 00000000 0x0 0x0
0xffffd58000019c80 0041 00000000 0x0 0x0
0xffffd58000019d00 0041 00000000 0x0 0x0
0xffffd58000019d80 0041 00000000 0x0 0x0
0xffffd58000019e00 0041 00000000 0x0 0x0
0xffffd58000019e80 0041 00000000 0x0 0x0
0xffffd58000019f00 0041 00000000 0x0 0x0
0xffffd58000019f80 0041 00000000 0x0 0x0
0xffffd5800001a000 0041 00000000 0x0 0x0
0xffffd5800001a080 0041 00000000 0x0 0x0
0xffffd5800001a100 0041 00000000 0x0 0x0
0xffffd5800001a180 0041 00000000 0x0 0x0
0xffffd5800001a200 0041 00000000 0x0 0x0
0xffffd5800001a280 0041 00000000 0x0 0x0
0xffffd5800001a300 0041 00000000 0x0 0x0
0xffffd5800001a380 0041 00000000 0x0 0x0
0xffffd5800001a400 0041 00000000 0x0 0x0
0xffffd5800001a480 0041 00000000 0x0 0x0
0xffffd5800001a500 0041 00000000 0x0 0x0
0xffffd5800001a580 0041 00000000 0x0 0x0
0xffffd5800001a600 0041 00000000 0x0 0x0
0xffffd5800001a680 0041 00000000 0x0 0x0
0xffffd5800001a700 0041 00000000 0x0 0x0
0xffffd5800001a780 0041 00000000 0x0 0x0
0xffffd5800001a800 0041 00000000 0x0 0x0
0xffffd5800001a880 0041 00000000 0x0 0x0
0xffffd5800001a900 0041 00000000 0x0 0x0
0xffffd5800001a980 0041 00000000 0x0 0x0
0xffffd5800001aa00 0041 00000000 0x0 0x0
0xffffd5800001aa80 0041 00000000 0x0 0x0
0xffffd5800001ab00 0041 00000000 0x0 0x0
0xffffd5800001ab80 0041 00000000 0x0 0x0
0xffffd5800001ac00 0041 00000000 0x0 0x0
0xffffd5800001ac80 0041 00000000 0x0 0x0
0xffffd5800001ad00 0041 00000000 0x0 0x0
0xffffd5800001ad80 0041 00000000 0x0 0x0
0xffffd5800001ae00 0041 00000000 0x0 0x0
0xffffd5800001ae80 0041 00000000 0x0 0x0
0xffffd5800001af00 0041 00000000 0x0 0x0
0xffffd5800001af80 0041 00000000 0x0 0x0
0xffffd5800001b000 0041 00000000 0x0 0x0
0xffffd5800001b080 0041 00000000 0x0 0x0
0xffffd5800001b100 0041 00000000 0x0 0x0
0xffffd5800001b180 0041 00000000 0x0 0x0
0xffffd5800001b200 0041 00000000 0x0 0x0
0xffffd5800001b280 0041 00000000 0x0 0x0
0xffffd5800001b300 0041 00000000 0x0 0x0
0xffffd5800001b380 0041 00000000 0x0 0x0
0xffffd5800001b400 0041 00000000 0x0 0x0
0xffffd5800001b480 0041 00000000 0x0 0x0
0xffffd5800001b500 0041 00000000 0x0 0x0
0xffffd5800001b580 0041 00000000 0x0 0x0
0xffffd5800001b600 0041 00000000 0x0 0x0
0xffffd5800001b680 0041 00000000 0x0 0x0
0xffffd5800001b700 0041 00000000 0x0 0x0
0xffffd5800001b780 0041 00000000 0x0 0x0
0xffffd5800001b800 0041 00000000 0x0 0x0
0xffffd5800001b880 0041 00000000 0x0 0x0
0xffffd5800001b900 0041 00000000 0x0 0x0
0xffffd5800001b980 0041 00000000 0x0 0x0
0xffffd5800001ba00 0041 00000000 0x0 0x0
0xffffd5800001ba80 0041 00000000 0x0 0x0
0xffffd5800001bb00 0001 00000000 0x0 0x0
0xffffd5800001bb80 0001 00000000 0x0 0x0
0xffffd5800001bc00 0001 00000000 0x0 0x0
0xffffd5800001bc80 0001 00000000 0x0 0x0
0xffffd5800001bd00 0001 00000000 0x0 0x0
0xffffd5800001bd80 0001 00000000 0x0 0x0
0xffffd5800001be00 0001 00000000 0x0 0x0
0xffffd5800001be80 0001 00000000 0x0 0x0
0xffffd5800001bf00 0001 00000000 0x0 0x0
0xffffd5800001bf80 0001 00000000 0x0 0x0
0xffffd5800001c000 0001 00000000 0x0 0x0
0xffffd5800001c080 0001 00000000 0x0 0x0
0xffffd5800001c100 0001 00000000 0x0 0x0
0xffffd5800001c180 0001 00000000 0x0 0x0
0xffffd5800001c200 0001 00000000 0x0 0x0
0xffffd5800001c280 0001 00000000 0x0 0x0
0xffffd5800001c300 0001 00000000 0x0 0x0
0xffffd5800001c380 0001 00000000 0x0 0x0
0xffffd5800001c400 0001 00000000 0x0 0x0
0xffffd5800001c480 0001 00000000 0x0 0x0
0xffffd5800001c500 0001 00000000 0x0 0x0
0xffffd5800001c580 0001 00000000 0x0 0x0
0xffffd5800001c600 0001 00000000 0x0 0x0
0xffffd5800001c680 0001 00000000 0x0 0x0
0xffffd5800001c700 0001 00000000 0x0 0x0
0xffffd5800001c780 0001 00000000 0x0 0x0
0xffffd5800001c800 0001 00000000 0x0 0x0
0xffffd5800001c880 0001 00000000 0x0 0x0
0xffffd5800001c900 0001 00000000 0x0 0x0
0xffffd5800001c980 0001 00000000 0x0 0x0
0xffffd5800001ca00 0001 00000000 0x0 0x0
0xffffd5800001ca80 0001 00000000 0x0 0x0
0xffffd5800001cb00 0001 00000000 0x0 0x0
0xffffd5800001cb80 0001 00000000 0x0 0x0
0xffffd5800001cc00 0001 00000000 0x0 0x0
0xffffd5800001cc80 0001 00000000 0x0 0x0
0xffffd5800001cd00 0001 00000000 0x0 0x0
0xffffd5800001cd80 0001 00000000 0x0 0x0
0xffffd5800001ce00 0001 00000000 0x0 0x0
0xffffd5800001ce80 0001 00000000 0x0 0x0
0xffffd5800001cf00 0001 00000000 0x0 0x0
0xffffd5800001cf80 0001 00000000 0x0 0x0
0xffffd5800001d000 0001 00000000 0x0 0x0
0xffffd5800001d080 0001 00000000 0x0 0x0
0xffffd5800001d100 0001 00000000 0x0 0x0
0xffffd5800001d180 0001 00000000 0x0 0x0
0xffffd5800001d200 0001 00000000 0x0 0x0
0xffffd5800001d280 0001 00000000 0x0 0x0
0xffffd5800001d300 0001 00000000 0x0 0x0
0xffffd5800001d380 0001 00000000 0x0 0x0
0xffffd5800001d400 0001 00000000 0x0 0x0
0xffffd5800001d480 0001 00000000 0x0 0x0
0xffffd5800001d500 0001 00000000 0x0 0x0
0xffffd5800001d580 0001 00000000 0x0 0x0
0xffffd5800001d600 0001 00000000 0x0 0x0
0xffffd5800001d680 0001 00000000 0x0 0x0
0xffffd5800001d700 0001 00000000 0x0 0x0
0xffffd5800001d780 0001 00000000 0x0 0x0
0xffffd5800001d800 0001 00000000 0x0 0x0
0xffffd5800001d880 0001 00000000 0x0 0x0
0xffffd5800001d900 0001 00000000 0x0 0x0
0xffffd5800001d980 0001 00000000 0x0 0x0
0xffffd5800001da00 0001 00000000 0x0 0x0
0xffffd5800001da80 0001 00000000 0x0 0x0
0xffffd5800001db00 0001 00000000 0x0 0x0
0xffffd5800001db80 0001 00000000 0x0 0x0
0xffffd5800001dc00 0001 00000000 0x0 0x0
0xffffd5800001dc80 0001 00000000 0x0 0x0
0xffffd5800001dd00 0001 00000000 0x0 0x0
0xffffd5800001dd80 0001 00000000 0x0 0x0
0xffffd5800001de00 0001 00000000 0x0 0x0
0xffffd5800001de80 0001 00000000 0x0 0x0
0xffffd5800001df00 0001 00000000 0x0 0x0
0xffffd5800001df80 0001 00000000 0x0 0x0
0xffffd5800001e000 0001 00000000 0x0 0x0
0xffffd5800001e080 0001 00000000 0x0 0x0
0xffffd5800001e100 0001 00000000 0x0 0x0
0xffffd5800001e180 0001 00000000 0x0 0x0
0xffffd5800001e200 0001 00000000 0x0 0x0
0xffffd5800001e280 0001 00000000 0x0 0x0
0xffffd5800001e300 0001 00000000 0x0 0x0
0xffffd5800001e380 0001 00000000 0x0 0x0
0xffffd5800001e400 0001 00000000 0x0 0x0
0xffffd5800001e480 0001 00000000 0x0 0x0
0xffffd5800001e500 0001 00000000 0x0 0x0
0xffffd5800001e580 0001 00000000 0x0 0x0
0xffffd5800001e600 0001 00000000 0x0 0x0
0xffffd5800001e680 0001 00000000 0x0 0x0
0xffffd5800001e700 0001 00000000 0x0 0x0
0xffffd5800001e780 0001 00000000 0x0 0x0
0xffffd5800001e800 0001 00000000 0x0 0x0
0xffffd5800001e880 0001 00000000 0x0 0x0
0xffffd5800001e900 0001 00000000 0x0 0x0
0xffffd5800001e980 0001 00000000 0x0 0x0
0xffffd5800001ea00 0001 00000000 0x0 0x0
0xffffd5800001ea80 0001 00000000 0x0 0x0
0xffffd5800001eb00 0001 00000000 0x0 0x0
0xffffd5800001eb80 0001 00000000 0x0 0x0
0xffffd5800001ec00 0001 00000000 0x0 0x0
0xffffd5800001ec80 0001 00000000 0x0 0x0
0xffffd5800001ed00 0001 00000000 0x0 0x0
0xffffd5800001ed80 0001 00000000 0x0 0x0
0xffffd5800001ee00 0001 00000000 0x0 0x0
0xffffd5800001ee80 0001 00000000 0x0 0x0
0xffffd5800001ef00 0001 00000000 0x0 0x0
0xffffd5800001ef80 0001 00000000 0x0 0x0
0xffffd5800001f000 0001 00000000 0x0 0x0
0xffffd5800001f080 0001 00000000 0x0 0x0
0xffffd5800001f100 0001 00000000 0x0 0x0
0xffffd5800001f180 0001 00000000 0x0 0x0
0xffffd5800001f200 0001 00000000 0x0 0x0
0xffffd5800001f280 0001 00000000 0x0 0x0
0xffffd5800001f300 0001 00000000 0x0 0x0
0xffffd5800001f380 0001 00000000 0x0 0x0
0xffffd5800001f400 0001 00000000 0x0 0x0
0xffffd5800001f480 0001 00000000 0x0 0x0
0xffffd5800001f500 0001 00000000 0x0 0x0
0xffffd5800001f580 0001 00000000 0x0 0x0
0xffffd5800001f600 0001 00000000 0x0 0x0
0xffffd5800001f680 0001 00000000 0x0 0x0
0xffffd5800001f700 0001 00000000 0x0 0x0
0xffffd5800001f780 0001 00000000 0x0 0x0
0xffffd5800001f800 0001 00000000 0x0 0x0
0xffffd5800001f880 0001 00000000 0x0 0x0
0xffffd5800001f900 0001 00000000 0x0 0x0
0xffffd5800001f980 0001 00000000 0x0 0x0
0xffffd5800001fa00 0001 00000000 0x0 0x0
0xffffd5800001fa80 0001 00000000 0x0 0x0
0xffffd5800001fb00 0001 00000000 0x0 0x0
0xffffd5800001fb80 0001 00000000 0x0 0x0
0xffffd5800001fc00 0001 00000000 0x0 0x0
0xffffd5800001fc80 0001 00000000 0x0 0x0
0xffffd5800001fd00 0001 00000000 0x0 0x0
0xffffd5800001fd80 0001 00000000 0x0 0x0
0xffffd5800001fe00 0001 00000000 0x0 0x0
0xffffd5800001fe80 0001 00000000 0x0 0x0
0xffffd5800001ff00 0001 00000000 0x0 0x0
0xffffd5800001ff80 0001 00000000 0x0 0x0
0xffffd58000020000 0001 00000000 0x0 0x0
0xffffd58000020080 0001 00000000 0x0 0x0
0xffffd58000020100 0001 00000000 0x0 0x0
0xffffd58000020180 0001 00000000 0x0 0x0
0xffffd58000020200 0001 00000000 0x0 0x0
0xffffd58000020280 0001 00000000 0x0 0x0
0xffffd58000020300 0001 00000000 0x0 0x0
0xffffd58000020380 0001 00000000 0x0 0x0
0xffffd58000020400 0001 00000000 0x0 0x0
0xffffd58000020480 0001 00000000 0x0 0x0
0xffffd58000020500 0001 00000000 0x0 0x0
0xffffd58000020580 0001 00000000 0x0 0x0
0xffffd58000020600 0001 00000000 0x0 0x0
0xffffd58000020680 0001 00000000 0x0 0x0
0xffffd58000020700 0001 00000000 0x0 0x0
0xffffd58000020780 0001 00000000 0x0 0x0
0xffffd58000020800 0001 00000000 0x0 0x0
0xffffd58000020880 0001 00000000 0x0 0x0
0xffffd58000020900 0001 00000000 0x0 0x0
0xffffd58000020980 0001 00000000 0x0 0x0
0xffffd58000020a00 0001 00000000 0x0 0x0
0xffffd58000020a80 0001 00000000 0x0 0x0
0xffffd58000020b00 0001 00000000 0x0 0x0
0xffffd58000020b80 0001 00000000 0x0 0x0
0xffffd58000020c00 0001 00000000 0x0 0x0
0xffffd58000020c80 0001 00000000 0x0 0x0
0xffffd58000020d00 0001 00000000 0x0 0x0
0xffffd58000020d80 0001 00000000 0x0 0x0
0xffffd58000020e00 0001 00000000 0x0 0x0
0xffffd58000020e80 0001 00000000 0x0 0x0
0xffffd58000020f00 0001 00000000 0x0 0x0
0xffffd58000020f80 0001 00000000 0x0 0x0
0xffffd58000021000 0001 00000000 0x0 0x0
0xffffd58000021080 0001 00000000 0x0 0x0
0xffffd58000021100 0001 00000000 0x0 0x0
0xffffd58000021180 0001 00000000 0x0 0x0
0xffffd58000021200 0001 00000000 0x0 0x0
0xffffd58000021280 0001 00000000 0x0 0x0
0xffffd58000021300 0001 00000000 0x0 0x0
0xffffd58000021380 0001 00000000 0x0 0x0
0xffffd58000021400 0001 00000000 0x0 0x0
0xffffd58000021480 0001 00000000 0x0 0x0
0xffffd58000021500 0001 00000000 0x0 0x0
0xffffd58000021580 0001 00000000 0x0 0x0
0xffffd58000021600 0001 00000000 0x0 0x0
0xffffd58000021680 0001 00000000 0x0 0x0
0xffffd58000021700 0001 00000000 0x0 0x0
0xffffd58000021780 0001 00000000 0x0 0x0
0xffffd58000021800 0001 00000000 0x0 0x0
0xffffd58000021880 0001 00000000 0x0 0x0
0xffffd58000021900 0001 00000000 0x0 0x0
0xffffd58000021980 0001 00000000 0x0 0x0
0xffffd58000021a00 0001 00000000 0x0 0x0
0xffffd58000021a80 0001 00000000 0x0 0x0
0xffffd58000021b00 0001 00000000 0x0 0x0
0xffffd58000021b80 0001 00000000 0x0 0x0
0xffffd58000021c00 0001 00000000 0x0 0x0
0xffffd58000021c80 0001 00000000 0x0 0x0
0xffffd58000021d00 0001 00000000 0x0 0x0
0xffffd58000021d80 0001 00000000 0x0 0x0
0xffffd58000021e00 0001 00000000 0x0 0x0
0xffffd58000021e80 0001 00000000 0x0 0x0
0xffffd58000021f00 0001 00000000 0x0 0x0
0xffffd58000021f80 0001 00000000 0x0 0x0
0xffffd58000022000 0001 00000000 0x0 0x0
0xffffd58000022080 0001 00000000 0x0 0x0
0xffffd58000022100 0001 00000000 0x0 0x0
0xffffd58000022180 0001 00000000 0x0 0x0
0xffffd58000022200 0001 00000000 0x0 0x0
0xffffd58000022280 0001 00000000 0x0 0x0
0xffffd58000022300 0001 00000000 0x0 0x0
0xffffd58000022380 0001 00000000 0x0 0x0
0xffffd58000022400 0001 00000000 0x0 0x0
0xffffd58000022480 0001 00000000 0x0 0x0
0xffffd58000022500 0001 00000000 0x0 0x0
0xffffd58000022580 0001 00000000 0x0 0x0
0xffffd58000022600 0001 00000000 0x0 0x0
0xffffd58000022680 0001 00000000 0x0 0x0
0xffffd58000022700 0001 00000000 0x0 0x0
0xffffd58000022780 0001 00000000 0x0 0x0
0xffffd58000022800 0001 00000000 0x0 0x0
0xffffd58000022880 0001 00000000 0x0 0x0
0xffffd58000022900 0001 00000000 0x0 0x0
0xffffd58000022980 0001 00000000 0x0 0x0
0xffffd58000022a00 0001 00000000 0x0 0x0
0xffffd58000022a80 0001 00000000 0x0 0x0
0xffffd58000022b00 0001 00000000 0x0 0x0
0xffffd58000022b80 0001 00000000 0x0 0x0
0xffffd58000022c00 0001 00000000 0x0 0x0
0xffffd58000022c80 0001 00000000 0x0 0x0
0xffffd58000022d00 0001 00000000 0x0 0x0
0xffffd58000022d80 0001 00000000 0x0 0x0
0xffffd58000022e00 0001 00000000 0x0 0x0
0xffffd58000022e80 0001 00000000 0x0 0x0
0xffffd58000022f00 0001 00000000 0x0 0x0
0xffffd58000022f80 0001 00000000 0x0 0x0
0xffffd58000023000 0001 00000000 0x0 0x0
0xffffd58000023080 0001 00000000 0x0 0x0
0xffffd58000023100 0001 00000000 0x0 0x0
0xffffd58000023180 0001 00000000 0x0 0x0
0xffffd58000023200 0001 00000000 0x0 0x0
0xffffd58000023280 0001 00000000 0x0 0x0
0xffffd58000023300 0001 00000000 0x0 0x0
0xffffd58000023380 0001 00000000 0x0 0x0
0xffffd58000023400 0001 00000000 0x0 0x0
0xffffd58000023480 0001 00000000 0x0 0x0
0xffffd58000023500 0001 00000000 0x0 0x0
0xffffd58000023580 0001 00000000 0x0 0x0
0xffffd58000023600 0001 00000000 0x0 0x0
0xffffd58000023680 0001 00000000 0x0 0x0
0xffffd58000023700 0001 00000000 0x0 0x0
0xffffd58000023780 0001 00000000 0x0 0x0
0xffffd58000023800 0001 00000000 0x0 0x0
0xffffd58000023880 0001 00000000 0x0 0x0
0xffffd58000023900 0001 00000000 0x0 0x0
0xffffd58000023980 0001 00000000 0x0 0x0
0xffffd58000023a00 0001 00000000 0x0 0x0
0xffffd58000023a80 0001 00000000 0x0 0x0
0xffffd58000023b00 0001 00000000 0x0 0x0
0xffffd58000023b80 0001 00000000 0x0 0x0
0xffffd58000023c00 0001 00000000 0x0 0x0
0xffffd58000023c80 0001 00000000 0x0 0x0
0xffffd58000023d00 0001 00000000 0x0 0x0
0xffffd58000023d80 0001 00000000 0x0 0x0
0xffffd58000023e00 0001 00000000 0x0 0x0
0xffffd58000023e80 0001 00000000 0x0 0x0
0xffffd58000023f00 0001 00000000 0x0 0x0
0xffffd58000023f80 0001 00000000 0x0 0x0
0xffffd58000024000 0001 00000000 0x0 0x0
0xffffd58000024080 0001 00000000 0x0 0x0
0xffffd58000024100 0001 00000000 0x0 0x0
0xffffd58000024180 0001 00000000 0x0 0x0
0xffffd58000024200 0001 00000000 0x0 0x0
0xffffd58000024280 0001 00000000 0x0 0x0
0xffffd58000024300 0001 00000000 0x0 0x0
0xffffd58000024380 0001 00000000 0x0 0x0
0xffffd58000024400 0001 00000000 0x0 0x0
0xffffd58000024480 0001 00000000 0x0 0x0
0xffffd58000024500 0001 00000000 0x0 0x0
0xffffd58000024580 0001 00000000 0x0 0x0
0xffffd58000024600 0001 00000000 0x0 0x0
0xffffd58000024680 0001 00000000 0x0 0x0
0xffffd58000024700 0001 00000000 0x0 0x0
0xffffd58000024780 0001 00000000 0x0 0x0
0xffffd58000024800 0001 00000000 0x0 0x0
0xffffd58000024880 0001 00000000 0x0 0x0
0xffffd58000024900 0001 00000000 0x0 0x0
0xffffd58000024980 0001 00000000 0x0 0x0
0xffffd58000024a00 0001 00000000 0x0 0x0
0xffffd58000024a80 0001 00000000 0x0 0x0
0xffffd58000024b00 0001 00000000 0x0 0x0
0xffffd58000024b80 0001 00000000 0x0 0x0
0xffffd58000024c00 0001 00000000 0x0 0x0
0xffffd58000024c80 0001 00000000 0x0 0x0
0xffffd58000024d00 0001 00000000 0x0 0x0
0xffffd58000024d80 0001 00000000 0x0 0x0
0xffffd58000024e00 0001 00000000 0x0 0x0
0xffffd58000024e80 0001 00000000 0x0 0x0
0xffffd58000024f00 0001 00000000 0x0 0x0
0xffffd58000024f80 0001 00000000 0x0 0x0
0xffffd58000025000 0001 00000000 0x0 0x0
0xffffd58000025080 0001 00000000 0x0 0x0
0xffffd58000025100 0001 00000000 0x0 0x0
0xffffd58000025180 0001 00000000 0x0 0x0
0xffffd58000025200 0001 00000000 0x0 0x0
0xffffd58000025280 0001 00000000 0x0 0x0
0xffffd58000025300 0001 00000000 0x0 0x0
0xffffd58000025380 0001 00000000 0x0 0x0
0xffffd58000025400 0001 00000000 0x0 0x0
0xffffd58000025480 0001 00000000 0x0 0x0
0xffffd58000025500 0001 00000000 0x0 0x0
0xffffd58000025580 0001 00000000 0x0 0x0
0xffffd58000025600 0001 00000000 0x0 0x0
0xffffd58000025680 0001 00000000 0x0 0x0
0xffffd58000025700 0001 00000000 0x0 0x0
0xffffd58000025780 0001 00000000 0x0 0x0
0xffffd58000025800 0001 00000000 0x0 0x0
0xffffd58000025880 0001 00000000 0x0 0x0
0xffffd58000025900 0001 00000000 0x0 0x0
0xffffd58000025980 0001 00000000 0x0 0x0
0xffffd58000025a00 0001 00000000 0x0 0x0
0xffffd58000025a80 0001 00000000 0x0 0x0
0xffffd58000025b00 0001 00000000 0x0 0x0
0xffffd58000025b80 0001 00000000 0x0 0x0
0xffffd58000025c00 0001 00000000 0x0 0x0
0xffffd58000025c80 0001 00000000 0x0 0x0
0xffffd58000025d00 0001 00000000 0x0 0x0
0xffffd58000025d80 0001 00000000 0x0 0x0
0xffffd58000025e00 0001 00000000 0x0 0x0
0xffffd58000025e80 0001 00000000 0x0 0x0
0xffffd58000025f00 0001 00000000 0x0 0x0
0xffffd58000025f80 0001 00000000 0x0 0x0
0xffffd58000026000 0001 00000000 0x0 0x0
0xffffd58000026080 0001 00000000 0x0 0x0
0xffffd58000026100 0001 00000000 0x0 0x0
0xffffd58000026180 0001 00000000 0x0 0x0
0xffffd58000026200 0001 00000000 0x0 0x0
0xffffd58000026280 0001 00000000 0x0 0x0
0xffffd58000026300 0001 00000000 0x0 0x0
0xffffd58000026380 0001 00000000 0x0 0x0
0xffffd58000026400 0001 00000000 0x0 0x0
0xffffd58000026480 0001 00000000 0x0 0x0
0xffffd58000026500 0001 00000000 0x0 0x0
0xffffd58000026580 0001 00000000 0x0 0x0
0xffffd58000026600 0001 00000000 0x0 0x0
0xffffd58000026680 0001 00000000 0x0 0x0
0xffffd58000026700 0001 00000000 0x0 0x0
0xffffd58000026780 0001 00000000 0x0 0x0
0xffffd58000026800 0001 00000000 0x0 0x0
0xffffd58000026880 0001 00000000 0x0 0x0
0xffffd58000026900 0001 00000000 0x0 0x0
0xffffd58000026980 0001 00000000 0x0 0x0
0xffffd58000026a00 0001 00000000 0x0 0x0
0xffffd58000026a80 0001 00000000 0x0 0x0
0xffffd58000026b00 0001 00000000 0x0 0x0
0xffffd58000026b80 0001 00000000 0x0 0x0
0xffffd58000026c00 0001 00000000 0x0 0x0
0xffffd58000026c80 0001 00000000 0x0 0x0
0xffffd58000026d00 0001 00000000 0x0 0x0
0xffffd58000026d80 0001 00000000 0x0 0x0
0xffffd58000026e00 0001 00000000 0x0 0x0
0xffffd58000026e80 0001 00000000 0x0 0x0
0xffffd58000026f00 0001 00000000 0x0 0x0
0xffffd58000026f80 0001 00000000 0x0 0x0
0xffffd58000027000 0001 00000000 0x0 0x0
0xffffd58000027080 0001 00000000 0x0 0x0
0xffffd58000027100 0001 00000000 0x0 0x0
0xffffd58000027180 0001 00000000 0x0 0x0
0xffffd58000027200 0001 00000000 0x0 0x0
0xffffd58000027280 0001 00000000 0x0 0x0
0xffffd58000027300 0001 00000000 0x0 0x0
0xffffd58000027380 0001 00000000 0x0 0x0
0xffffd58000027400 0001 00000000 0x0 0x0
0xffffd58000027480 0001 00000000 0x0 0x0
0xffffd58000027500 0001 00000000 0x0 0x0
0xffffd58000027580 0001 00000000 0x0 0x0
0xffffd58000027600 0001 00000000 0x0 0x0
0xffffd58000027680 0001 00000000 0x0 0x0
0xffffd58000027700 0001 00000000 0x0 0x0
0xffffd58000027780 0001 00000000 0x0 0x0
0xffffd58000027800 0001 00000000 0x0 0x0
0xffffd58000027880 0001 00000000 0x0 0x0
0xffffd58000027900 0001 00000000 0x0 0x0
0xffffd58000027980 0001 00000000 0x0 0x0
0xffffd58000027a00 0001 00000000 0x0 0x0
0xffffd58000027a80 0001 00000000 0x0 0x0
0xffffd58000027b00 0001 00000000 0x0 0x0
0xffffd58000027b80 0001 00000000 0x0 0x0
0xffffd58000027c00 0001 00000000 0x0 0x0
0xffffd58000027c80 0001 00000000 0x0 0x0
0xffffd58000027d00 0001 00000000 0x0 0x0
0xffffd58000027d80 0001 00000000 0x0 0x0
0xffffd58000027e00 0001 00000000 0x0 0x0
0xffffd58000027e80 0001 00000000 0x0 0x0
0xffffd58000027f00 0001 00000000 0x0 0x0
0xffffd58000027f80 0001 00000000 0x0 0x0
0xffffd58000028000 0001 00000000 0x0 0x0
0xffffd58000028080 0001 00000000 0x0 0x0
0xffffd58000028100 0001 00000000 0x0 0x0
0xffffd58000028180 0001 00000000 0x0 0x0
0xffffd58000028200 0001 00000000 0x0 0x0
0xffffd58000028280 0001 00000000 0x0 0x0
0xffffd58000028300 0001 00000000 0x0 0x0
0xffffd58000028380 0001 00000000 0x0 0x0
0xffffd58000028400 0001 00000000 0x0 0x0
0xffffd58000028480 0001 00000000 0x0 0x0
0xffffd58000028500 0001 00000000 0x0 0x0
0xffffd58000028580 0001 00000000 0x0 0x0
0xffffd58000028600 0001 00000000 0x0 0x0
0xffffd58000028680 0001 00000000 0x0 0x0
0xffffd58000028700 0001 00000000 0x0 0x0
0xffffd58000028780 0001 00000000 0x0 0x0
0xffffd58000028800 0001 00000000 0x0 0x0
0xffffd58000028880 0001 00000000 0x0 0x0
0xffffd58000028900 0001 00000000 0x0 0x0
0xffffd58000028980 0001 00000000 0x0 0x0
0xffffd58000028a00 0001 00000000 0x0 0x0
0xffffd58000028a80 0001 00000000 0x0 0x0
0xffffd58000028b00 0001 00000000 0x0 0x0
0xffffd58000028b80 0001 00000000 0x0 0x0
0xffffd58000028c00 0001 00000000 0x0 0x0
0xffffd58000028c80 0001 00000000 0x0 0x0
0xffffd58000028d00 0001 00000000 0x0 0x0
0xffffd58000028d80 0001 00000000 0x0 0x0
0xffffd58000028e00 0001 00000000 0x0 0x0
0xffffd58000028e80 0001 00000000 0x0 0x0
0xffffd58000028f00 0001 00000000 0x0 0x0
0xffffd58000028f80 0001 00000000 0x0 0x0
0xffffd58000029000 0001 00000000 0x0 0x0
0xffffd58000029080 0001 00000000 0x0 0x0
0xffffd58000029100 0001 00000000 0x0 0x0
0xffffd58000029180 0001 00000000 0x0 0x0
0xffffd58000029200 0001 00000000 0x0 0x0
0xffffd58000029280 0001 00000000 0x0 0x0
0xffffd58000029300 0001 00000000 0x0 0x0
0xffffd58000029380 0001 00000000 0x0 0x0
0xffffd58000029400 0001 00000000 0x0 0x0
0xffffd58000029480 0001 00000000 0x0 0x0
0xffffd58000029500 0001 00000000 0x0 0x0
0xffffd58000029580 0001 00000000 0x0 0x0
0xffffd58000029600 0001 00000000 0x0 0x0
0xffffd58000029680 0001 00000000 0x0 0x0
0xffffd58000029700 0001 00000000 0x0 0x0
0xffffd58000029780 0001 00000000 0x0 0x0
0xffffd58000029800 0001 00000000 0x0 0x0
0xffffd58000029880 0001 00000000 0x0 0x0
0xffffd58000029900 0001 00000000 0x0 0x0
0xffffd58000029980 0001 00000000 0x0 0x0
0xffffd58000029a00 0001 00000000 0x0 0x0
0xffffd58000029a80 0001 00000000 0x0 0x0
0xffffd58000029b00 0001 00000000 0x0 0x0
0xffffd58000029b80 0001 00000000 0x0 0x0
0xffffd58000029c00 0001 00000000 0x0 0x0
0xffffd58000029c80 0001 00000000 0x0 0x0
0xffffd58000029d00 0001 00000000 0x0 0x0
0xffffd58000029d80 0001 00000000 0x0 0x0
0xffffd58000029e00 0001 00000000 0x0 0x0
0xffffd58000029e80 0001 00000000 0x0 0x0
0xffffd58000029f00 0001 00000000 0x0 0x0
0xffffd58000029f80 0001 00000000 0x0 0x0
0xffffd5800002a000 0001 00000000 0x0 0x0
0xffffd5800002a080 0001 00000000 0x0 0x0
0xffffd5800002a100 0001 00000000 0x0 0x0
0xffffd5800002a180 0001 00000000 0x0 0x0
0xffffd5800002a200 0001 00000000 0x0 0x0
0xffffd5800002a280 0001 00000000 0x0 0x0
0xffffd5800002a300 0001 00000000 0x0 0x0
0xffffd5800002a380 0001 00000000 0x0 0x0
0xffffd5800002a400 0001 00000000 0x0 0x0
0xffffd5800002a480 0001 00000000 0x0 0x0
0xffffd5800002a500 0001 00000000 0x0 0x0
0xffffd5800002a580 0001 00000000 0x0 0x0
0xffffd5800002a600 0001 00000000 0x0 0x0
0xffffd5800002a680 0001 00000000 0x0 0x0
0xffffd5800002a700 0001 00000000 0x0 0x0
0xffffd5800002a780 0001 00000000 0x0 0x0
0xffffd5800002a800 0001 00000000 0x0 0x0
0xffffd5800002a880 0001 00000000 0x0 0x0
0xffffd5800002a900 0001 00000000 0x0 0x0
0xffffd5800002a980 0001 00000000 0x0 0x0
0xffffd5800002aa00 0001 00000000 0x0 0x0
0xffffd5800002aa80 0001 00000000 0x0 0x0
0xffffd5800002ab00 0001 00000000 0x0 0x0
0xffffd5800002ab80 0001 00000000 0x0 0x0
0xffffd5800002ac00 0001 00000000 0x0 0x0
0xffffd5800002ac80 0001 00000000 0x0 0x0
0xffffd5800002ad00 0001 00000000 0x0 0x0
0xffffd5800002ad80 0001 00000000 0x0 0x0
0xffffd5800002ae00 0001 00000000 0x0 0x0
0xffffd5800002ae80 0001 00000000 0x0 0x0
0xffffd5800002af00 0001 00000000 0x0 0x0
0xffffd5800002af80 0001 00000000 0x0 0x0
0xffffd5800002b000 0001 00000000 0x0 0x0
0xffffd5800002b080 0001 00000000 0x0 0x0
0xffffd5800002b100 0001 00000000 0x0 0x0
0xffffd5800002b180 0001 00000000 0x0 0x0
0xffffd5800002b200 0001 00000000 0x0 0x0
0xffffd58000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Sep 30, 2022, 8:03:42 PM9/30/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 55bdc3ec2d9b ipsecif(4) can use fixed SP reqid based on if..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=169b8598880000

kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=c3f781d5b15c86b594a2
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16cbe2f4880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=163074b8880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/77c53625daf7/disk-55bdc3ec.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/d357baaec597/netbsd-55bdc3ec.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c3f781...@syzkaller.appspotmail.com

[ 577.9588663] panic: ASan: Unauthorized Access In 0xffffffff81bac896: Addr 0xffffd2001286d82b [1 byte, read, PoolUseAfterFree]

[ 577.9588663] cpu1: Begin traceback...
[ 577.9688490] vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:293
[ 577.9988464] panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1043
[ 578.0388475] kasan_report() at netbsd:kasan_report+0x8f kasan_code_name sys/kern/subr_asan.c:168 [inline]
[ 578.0388475] kasan_report() at netbsd:kasan_report+0x8f sys/kern/subr_asan.c:200
[ 578.0688465] __asan_load1() at netbsd:__asan_load1+0x72 sys/kern/subr_asan.c:431
[ 578.0988477] config_detach() at netbsd:config_detach+0xaa sys/kern/subr_autoconf.c:2005
[ 578.1288464] dkwedge_delall1() at netbsd:dkwedge_delall1+0x1f7 dkwedge_del1 sys/dev/dkwedge/dk.c:574 [inline]
[ 578.1288464] dkwedge_delall1() at netbsd:dkwedge_delall1+0x1f7 sys/dev/dkwedge/dk.c:719
[ 578.1588453] disk_ioctl() at netbsd:disk_ioctl+0x2d2 sys/kern/subr_disk.c:645
[ 578.1888465] dk_ioctl() at netbsd:dk_ioctl+0x1b2 sys/dev/dksubr.c:642
[ 578.2188502] sdioctl() at netbsd:sdioctl+0xa12 sys/dev/scsipi/sd.c:1005
[ 578.2388502] cdev_ioctl() at netbsd:cdev_ioctl+0x177 sys/kern/subr_devsw.c:1250
[ 578.2688498] spec_ioctl() at netbsd:spec_ioctl+0x148 sys/miscfs/specfs/spec_vnops.c:1321
[ 578.2988470] VOP_IOCTL() at netbsd:VOP_IOCTL+0x132 sys/kern/vnode_if.c:934
[ 578.3288492] vn_ioctl() at netbsd:vn_ioctl+0x1c0 sys/kern/vfs_vnops.c:868
[ 578.3588484] sys_ioctl() at netbsd:sys_ioctl+0x8f6 sys/kern/sys_generic.c:675
[ 578.3788489] sys_syscall() at netbsd:sys_syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
[ 578.3788489] sys_syscall() at netbsd:sys_syscall+0x10e sys/kern/sys_syscall.c:90
[ 578.4088490] syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
[ 578.4088490] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 578.4088490] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
[ 578.4188494] --- syscall (number 54 via SYS_syscall) ---
[ 578.4288471] netbsd:syscall+0x25a:
[ 578.4388477] cpu1: End traceback...
[ 578.4388477] fatal breakpoint trap in supervisor mode
[ 578.4488466] trap type 1 code 0 rip 0xffffffff8023230d cs 0x8 rflags 0x286 cr2 0x795640e11fe8 ilevel 0 rsp 0xffffd202485cb200
[ 578.4588451] curlwp 0xffffd20013d02640 pid 1128.1128 lowest kstack 0xffffd202485c42c0
Stopped in pid 1128.1128 (syz-executor1399) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:293
panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1043
kasan_report() at netbsd:kasan_report+0x8f kasan_code_name sys/kern/subr_asan.c:168 [inline]
kasan_report() at netbsd:kasan_report+0x8f sys/kern/subr_asan.c:200
__asan_load1() at netbsd:__asan_load1+0x72 sys/kern/subr_asan.c:431
config_detach() at netbsd:config_detach+0xaa sys/kern/subr_autoconf.c:2005
dkwedge_delall1() at netbsd:dkwedge_delall1+0x1f7 dkwedge_del1 sys/dev/dkwedge/dk.c:574 [inline]
dkwedge_delall1() at netbsd:dkwedge_delall1+0x1f7 sys/dev/dkwedge/dk.c:719
disk_ioctl() at netbsd:disk_ioctl+0x2d2 sys/kern/subr_disk.c:645
dk_ioctl() at netbsd:dk_ioctl+0x1b2 sys/dev/dksubr.c:642
sdioctl() at netbsd:sdioctl+0xa12 sys/dev/scsipi/sd.c:1005
cdev_ioctl() at netbsd:cdev_ioctl+0x177 sys/kern/subr_devsw.c:1250
spec_ioctl() at netbsd:spec_ioctl+0x148 sys/miscfs/specfs/spec_vnops.c:1321
VOP_IOCTL() at netbsd:VOP_IOCTL+0x132 sys/kern/vnode_if.c:934
vn_ioctl() at netbsd:vn_ioctl+0x1c0 sys/kern/vfs_vnops.c:868
sys_ioctl() at netbsd:sys_ioctl+0x8f6 sys/kern/sys_generic.c:675

sys_syscall() at netbsd:sys_syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x10e sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
--- syscall (number 54 via SYS_syscall) ---
netbsd:syscall+0x25a:

Panic string: ASan: Unauthorized Access In 0xffffffff81bac896: Addr 0xffffd2001286d82b [1 byte, read, PoolUseAfterFree]

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

941 > 941 7 0 100 ffffd20013d1f240 syz-executor1399
1132 1132 2 1 0 ffffd20013d02a80 syz-executor1399
1128 >1128 7 1 0 ffffd20013d02640 syz-executor1399
1240 1240 3 0 0 ffffd20013d02200 syz-executor1399 xclocv
1245 1245 3 0 0 ffffd20013ceda40 syz-executor1399 tstile
1115 1115 2 1 140 ffffd20013ced600 syz-executor1399
1108 1108 2 1 140 ffffd20013ced1c0 syz-executor1399
942 942 2 0 140 ffffd200133dcb00 syz-executor1399
1241 1241 2 1 100 ffffd200133dc6c0 syz-executor1399
829 829 2 1 140 ffffd200133b9a80 syz-executor1399
1120 1120 2 0 140 ffffd20012990280 syz-executor1399
449 449 2 1 140 ffffd20012a05b80 syz-executor1399
1242 1242 3 0 180 ffffd20012b69540 syz-executor1399 nanoslp
1233 1233 3 1 180 ffffd20012a93900 sshd select
1082 1082 3 0 180 ffffd200126dc480 getty nanoslp
1255 1255 3 0 180 ffffd2001348a9c0 getty nanoslp
1222 1222 3 0 180 ffffd200134a45c0 getty nanoslp
1184 1184 3 1 1c0 ffffd200134a4180 getty ttyraw
1098 1098 3 1 180 ffffd200133a9a40 sshd select
1095 1095 3 0 180 ffffd20012d41740 powerd kqueue
702 702 3 0 0 ffffd20013423b40 syslogd tstile
747 747 3 0 180 ffffd20012c11b00 dhcpcd poll
466 466 3 0 180 ffffd20012cb80c0 dhcpcd poll
745 745 3 0 180 ffffd20012c116c0 dhcpcd poll
598 598 3 1 180 ffffd20012c22b40 dhcpcd poll
292 292 3 0 180 ffffd20012db1900 dhcpcd poll
485 485 3 0 180 ffffd20012db14c0 dhcpcd poll
291 291 3 1 180 ffffd20012db1080 dhcpcd poll
1 1 3 0 180 ffffd2001286b180 init wait
0 673 3 0 200 ffffd200129906c0 physiod physiod
0 196 3 0 200 ffffd20012993700 pooldrain pooldrain
0 195 3 0 200 ffffd200129932c0 ioflush syncer
0 194 3 1 200 ffffd20012990b00 pgdaemon pgdaemon
0 167 3 0 200 ffffd20012950ac0 usb7 usbevt
0 172 3 0 200 ffffd20012950680 usb6 usbevt
0 170 3 0 200 ffffd20012950240 usb5 usbevt
0 168 3 1 200 ffffd20012904a80 usb4 usbevt
0 166 3 0 200 ffffd20012904640 usb3 usbevt
0 165 3 1 200 ffffd20012904200 usb2 usbevt
0 31 3 0 200 ffffd200128caa40 usb1 usbevt
0 63 3 0 200 ffffd200128ca600 usb0 usbevt
0 126 3 1 200 ffffd200128ca1c0 usbtask-dr usbtsk
0 125 3 1 200 ffffd2001286ba00 usbtask-hc usbtsk
0 124 3 0 200 ffffd20010d78b00 swwreboot swwreboot
0 123 2 0 240 ffffd2001286b5c0 npfgc0
0 122 3 1 200 ffffd2001285c9c0 rt_free rt_free
0 121 3 1 200 ffffd2001285c580 unpgc unpgc
0 120 3 0 200 ffffd2001285c140 key_timehandler key_timehandler
0 119 3 1 200 ffffd20012855980 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffd20012855540 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffffd20012855100 nd6_timer nd6_timer
0 116 3 1 200 ffffd20012706940 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffd20012706500 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffd200127060c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffd200126f9900 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffd200126f94c0 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffd200126f9080 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffffd200126dc8c0 rt_timer rt_timer
0 109 3 0 200 ffffd200126dc040 vmem_rehash vmem_rehash
0 100 3 0 200 ffffd200126d8300 entbutler entropy
0 99 3 0 200 ffffd200120beb40 viomb balloon
0 98 3 1 200 ffffd200120be700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffd200120be2c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 ffffd20010d786c0 scsibus0 sccomp
0 29 3 0 200 ffffd20010d78280 pms0 pmsreset
0 28 2 1 200 ffffd20010cbcac0 xcall/1
0 27 1 1 200 ffffd20010cbc680 softser/1
0 26 1 1 200 ffffd20010cbc240 softclk/1
0 25 1 1 200 ffffd20010cb9a80 softbio/1
0 24 1 1 200 ffffd20010cb9640 softnet/1
0 23 1 1 201 ffffd20010cb9200 idle/1
0 22 3 0 200 ffffd2000fb57a40 lnxsyswq lnxsyswq
0 21 3 0 200 ffffd2000fb57600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffd2000fb571c0 lnxpwrwq lnxpwrwq
0 19 3 0 200 ffffd2000fb56a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffd2000fb565c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffffd2000fb56180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffd2000fb4f9c0 sysmon smtaskq
0 15 3 0 200 ffffd2000fb4f580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffd2000fb4f140 pmfevent pmfevent
0 13 3 0 200 ffffd2000fb4a980 sopendfree sopendfr
0 12 3 0 200 ffffd2000fb4a540 ifwdog ifwdog
0 11 3 1 200 ffffd2000fb4a100 iflnkst iflnkst
0 10 3 0 200 ffffd2000fb3d940 nfssilly nfssilly
0 9 3 0 200 ffffd2000fb3d500 vdrain vdrain
0 8 3 1 200 ffffd2000fb3d0c0 modunload mod_unld
0 7 3 0 200 ffffd2000fb34900 xcall/0 xcall
0 6 1 0 200 ffffd2000fb344c0 softser/0
0 > 5 7 0 200 ffffd2000fb34080 softclk/0
0 4 1 0 200 ffffd2000fb328c0 softbio/0
0 3 1 0 200 ffffd2000fb32480 softnet/0
0 2 1 0 201 ffffd2000fb32040 idle/0
0 0 2 1 240 ffffffff83345a40 swapper
[Locks tracked through LWPs]

****** LWP 1132.1132 (syz-executor1399) @ 0xffffd20013d02a80, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:lwp_ctl_alloc+0x7bd sys/kern/kern_lwp.c:1859)
lock address : ffffd20013d39280
type : sleep/adaptive
initialized : netbsd:lwp_ctl_alloc+0x7bd

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1

relevant lwp : 0xffffd20013d02a80 last held: 0xffffd20013d02a80
last locked* : netbsd:lwp_ctl_alloc+0x129
unlocked : 0
owner field : 0xffffd20013d02a80 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at netbsd:uvm_map_setup+0x11c sys/uvm/uvm_map.c:4772)
lock address : netbsd:kernel_map_store+0x8
type : sleep/adaptive
initialized : netbsd:uvm_map_setup+0x11c

shared holds : 0 exclusive: 1

shares wanted: 1 exclusive: 0

relevant cpu : 1 last held: 1

relevant lwp : 0xffffd20013d02a80 last held: 0xffffd20013d02a80
last locked* : netbsd:uvm_map_prepare+0x198
unlocked : netbsd:uvm_fault_lower_enter+0x5bb
owner/count : 0xffffd20013d02a80 flags : 0x0000000000000007
Turnstile:
=> 1 waiting readers: 0xffffd20013423b40
=> 1 waiting writers: 0xffffd20013ceda40

*** Locks wanted: none

****** LWP 1128.1128 (syz-executor1399) @ 0xffffd20013d02640, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:config_init+0x54 sys/kern/subr_autoconf.c:366)
lock address : netbsd:config_misc_lock
type : sleep/adaptive
initialized : netbsd:config_init+0x54
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffffd20013d02640 last held: 000000000000000000

last locked : netbsd:localcount_xc+0x24
unlocked* : netbsd:xc_thread+0x116
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 1245.1245 (syz-executor1399) @ 0xffffd20013ceda40, l_stat=3

*** Locks held:

* Lock 0 (initialized at netbsd:pmap_ctor+0x93 sys/arch/x86/x86/pmap.c:2860)

lock address : ffffd20013cf7180

type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x93
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0

relevant cpu : 0 last held: 0

relevant lwp : 0xffffd20013ceda40 last held: 0xffffd20013ceda40
last locked* : netbsd:pmap_extract+0xde
unlocked : netbsd:pmap_enter_ma+0xe14

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 702.702 (syslogd) @ 0xffffd20013423b40, l_stat=3

*** Locks held:

* Lock 0 (initialized at netbsd:vcache_alloc+0x3e sys/kern/vfs_vnode.c:1392)
lock address : ffffd20013bc1ec0
type : sleep/adaptive
initialized : netbsd:vcache_alloc+0x3e

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0

relevant cpu : 0 last held: 0

relevant lwp : 0xffffd20013423b40 last held: 0xffffd20013423b40
last locked* : netbsd:genfs_lock+0x15d
unlocked : netbsd:genfs_unlock+0x2a
owner/count : 0xffffd20013423b40 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at netbsd:uvm_map_setup+0x11c sys/uvm/uvm_map.c:4772)
lock address : netbsd:kernel_map_store+0x8
type : sleep/adaptive
initialized : netbsd:uvm_map_setup+0x11c

shared holds : 0 exclusive: 1

shares wanted: 1 exclusive: 0
relevant cpu : 0 last held: 1
relevant lwp : 0xffffd20013423b40 last held: 0xffffd20013d02a80
last locked* : netbsd:uvm_map_prepare+0x198
unlocked : netbsd:uvm_fault_lower_enter+0x5bb
owner/count : 0xffffd20013d02a80 flags : 0x0000000000000007
Turnstile:
=> 1 waiting readers: 0xffffd20013423b40
=> 1 waiting writers: 0xffffd20013ceda40

****** LWP 466.466 (dhcpcd) @ 0xffffd20012cb80c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffd20012cb80c0 last held: 000000000000000000