UBSan: Undefined Behavior in usb_free_device (2)

5 views

Skip to first unread message

syzbot

unread,

Dec 7, 2021, 4:55:26 PM12/7/21

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 0f5320a36768 Match variable names to register names. Same ..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15051df9b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=017911f90e0f9766bc71
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+017911...@syzkaller.appspotmail.com

[ 63.3760043] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/usb/usb_subr.c:1810:23, member access within null pointer of type 'struct usb_config_descriptor_t'

[ 63.3936656] cpu0: Begin traceback...
[ 63.4057212] vpanic() at netbsd:vpanic+0x2d0 sys/kern/subr_prf.c:290
[ 63.4557182] isAlreadyReported() at netbsd:isAlreadyReported
[ 63.5057255] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 63.5557189] usb_free_device() at netbsd:usb_free_device+0x597 sys/dev/usb/usb_subr.c:1810
[ 63.5957184] usb_disconnect_port() at netbsd:usb_disconnect_port+0x410 sys/dev/usb/usb_subr.c:1904
[ 63.6457185] uhub_explore() at netbsd:uhub_explore+0x747 sys/dev/usb/uhub.c:663
[ 63.6957176] usb_discover() at netbsd:usb_discover+0x234 sys/dev/usb/usb.c:1197
[ 63.7457185] usb_event_thread() at netbsd:usb_event_thread+0x1c1 sys/dev/usb/usb.c:750
[ 63.7557182] cpu0: End traceback...
[ 63.7675042] fatal breakpoint trap in supervisor mode
[ 63.7675042] trap type 1 code 0 rip 0xffffffff80221a95 cs 0x8 rflags 0x246 cr2 0x20000100 ilevel 0 rsp 0xffffd080c2fc3870
[ 63.7835355] curlwp 0xffff81c5bd75f580 pid 0.125 lowest kstack 0xffffd080c2fbf2c0
Stopped in pid 0.125 (system) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2d0 sys/kern/subr_prf.c:290
isAlreadyReported() at netbsd:isAlreadyReported
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
usb_free_device() at netbsd:usb_free_device+0x597 sys/dev/usb/usb_subr.c:1810
usb_disconnect_port() at netbsd:usb_disconnect_port+0x410 sys/dev/usb/usb_subr.c:1904
uhub_explore() at netbsd:uhub_explore+0x747 sys/dev/usb/uhub.c:663
usb_discover() at netbsd:usb_discover+0x234 sys/dev/usb/usb.c:1197
usb_event_thread() at netbsd:usb_event_thread+0x1c1 sys/dev/usb/usb.c:750
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/usb/usb_subr.c:1810:23, member access within null pointer of type 'struct usb_config_descriptor_t'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
1595 1595 3 0 180 ffff81c5e018bb00 syz-executor.1 parked
1753 1849 2 0 1100100 ffff81c5e0bd4080 syz-executor.2
1753 2152 3 1 1000000 ffff81c5e0bd4900 syz-executor.2 lwpwait
1505 1505 3 1 180 ffff81c5e1740700 syz-executor.0 parked
1350 1350 2 0 40000 ffff81c5c3ce7280 syz-executor.0
1191 1191 3 0 1c0 ffff81c5c6c4f200 syz-executor.5 pipe_rd
1106 1106 3 0 1c0 ffff81c5c434b300 syz-executor.4 pipe_rd
420 420 3 0 1c0 ffff81c5c5832140 syz-executor.3 pipe_rd
1082 1082 3 1 1c0 ffff81c5c4b1f980 syz-executor.1 pipe_rd
1084 1084 3 1 1c0 ffff81c5c3bc3680 syz-executor.2 wait
1077 1077 3 1 1c0 ffff81c5c38bfa80 syz-executor.0 pipe_rd
1078 1085 2 0 100 ffff81c5c6c4f640 syz-fuzzer
1078 1079 2 0 140 ffff81c5c5cb6a40 syz-fuzzer
1078 1101 3 0 180 ffff81c5c4b1f100 syz-fuzzer parked
1078 1252 3 0 180 ffff81c5c5cb6600 syz-fuzzer parked
1078 1075 2 0 100 ffff81c5c3bc3ac0 syz-fuzzer
1078 1076 3 0 180 ffff81c5c3851600 syz-fuzzer parked
1078 >1074 7 1 140 ffff81c5c3bc3240 syz-fuzzer
1078 1078 3 0 180 ffff81c5c5cb61c0 syz-fuzzer parked
1069 1069 3 0 180 ffff81c5c5832580 sshd select
1090 1090 3 0 180 ffff81c5c3dbda00 getty nanoslp
1099 1099 3 0 180 ffff81c5c3dbd5c0 getty nanoslp
1091 1091 3 1 180 ffff81c5c58329c0 getty nanoslp
974 974 3 0 1c0 ffff81c5bb6282c0 getty ttyraw
944 944 3 1 180 ffff81c5c3dbd180 sshd select
1127 1127 3 0 180 ffff81c5c493b500 powerd kqueue
672 672 3 1 180 ffff81c5c493b940 syslogd kqueue
595 595 3 0 180 ffff81c5c3fe7b40 dhcpcd poll
593 593 3 1 180 ffff81c5c4825780 dhcpcd poll
592 592 3 1 180 ffff81c5c5320900 dhcpcd poll
428 428 3 1 180 ffff81c5c3ce76c0 dhcpcd poll
349 349 3 1 180 ffff81c5c3fe72c0 dhcpcd poll
348 348 3 1 180 ffff81c5c3ce7b00 dhcpcd poll
347 347 3 1 180 ffff81c5c3fe7700 dhcpcd poll
1 1 3 1 180 ffff81c5bb698940 init wait
0 817 3 1 200 ffff81c5c3851a40 physiod physiod
0 192 3 0 200 ffff81c5c38bf640 ioflush syncer
0 166 3 0 200 ffff81c5bb628700 pooldrain pooldrain
0 165 3 1 200 ffff81c5c38bf200 pgdaemon pgdaemon
0 162 3 1 200 ffff81c5c38511c0 usb7 usbevt
0 161 3 1 200 ffff81c5c07dca00 usb6 usbevt
0 31 3 1 200 ffff81c5c07dc5c0 usb5 usbevt
0 63 3 1 200 ffff81c5c07dc180 usb4 usbevt
0 126 3 0 200 ffff81c5bd75f9c0 usb3 usbevt
0 > 125 7 0 240 ffff81c5bd75f580 usb2
0 124 3 1 200 ffff81c5bd75f140 usb1 usbevt
0 123 3 1 200 ffff81c5bc731980 usb0 usbevt
0 122 3 1 200 ffff81c5bc731540 usbtask-dr usbtsk
0 121 3 1 200 ffff81c5bc731100 usbtask-hc usbtsk
0 120 2 0 240 ffff81c5b9ae4ac0 npfgc0
0 119 3 1 200 ffff81c5bb698500 rt_free rt_free
0 118 3 1 200 ffff81c5bb6980c0 unpgc unpgc
0 117 2 0 200 ffff81c5bb643900 key_timehandler
0 116 3 1 200 ffff81c5bb6434c0 icmp6_wqinput/1 icmp6_wqinput
0 115 3 0 200 ffff81c5bb643080 icmp6_wqinput/0 icmp6_wqinput
0 114 2 0 200 ffff81c5bb6768c0 nd6_timer
0 113 3 1 200 ffff81c5bb676480 carp6_wqinput/1 carp6_wqinput
0 112 3 0 200 ffff81c5bb676040 carp6_wqinput/0 carp6_wqinput
0 111 3 1 200 ffff81c5bb641bc0 carp_wqinput/1 carp_wqinput
0 110 3 0 200 ffff81c5bb641780 carp_wqinput/0 carp_wqinput
0 109 3 1 200 ffff81c5bb641340 icmp_wqinput/1 icmp_wqinput
0 108 3 0 200 ffff81c5bb625b80 icmp_wqinput/0 icmp_wqinput
0 107 2 0 200 ffff81c5bb625740 rt_timer
0 106 3 0 200 ffff81c5bb628b40 vmem_rehash vmem_rehash
0 105 3 0 200 ffff81c5bb625300 entbutler entropy
0 96 3 1 200 ffff81c5baf7db00 viomb balloon
0 30 3 1 200 ffff81c5baf7d6c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffff81c5baf7d280 vioif0_txrx/0 vioif0_txrx
0 27 3 1 200 ffff81c5b9ae4680 scsibus0 sccomp
0 26 3 0 200 ffff81c5b9ae4240 pms0 pmsreset
0 25 3 1 200 ffff81c5b99eca80 xcall/1 xcall
0 24 1 1 200 ffff81c5b99ec640 softser/1
0 23 1 1 200 ffff81c5b99ec200 softclk/1
0 22 1 1 200 ffff81c5b99cfa40 softbio/1
0 21 1 1 200 ffff81c5b99cf600 softnet/1
0 20 1 1 201 ffff81c5b99cf1c0 idle/1
0 19 3 0 200 ffff81c6e893ea00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffff81c6e893e5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffff81c6e893e180 lnxsyswq lnxsyswq
0 16 3 0 200 ffff81c6e89639c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffff81c6e8963580 sysmon smtaskq
0 14 3 1 200 ffff81c6e8963140 pmfsuspend pmfsuspend
0 13 3 0 200 ffff81c6e8968980 pmfevent pmfevent
0 12 3 1 200 ffff81c6e8968540 sopendfree sopendfr
0 11 3 1 200 ffff81c6e8968100 iflnkst iflnkst
0 10 3 1 200 ffff81c6e999b940 nfssilly nfssilly
0 9 3 0 200 ffff81c6e999b500 vdrain vdrain
0 8 3 1 200 ffff81c6e999b0c0 modunload mod_unld
0 7 3 0 200 ffff81c6e99c6900 xcall/0 xcall
0 6 1 0 200 ffff81c6e99c64c0 softser/0
0 5 1 0 200 ffff81c6e99c6080 softclk/0
0 4 1 0 200 ffff81c6e99f38c0 softbio/0
0 3 1 0 200 ffff81c6e99f3480 softnet/0
0 2 1 0 201 ffff81c6e99f3040 idle/0
0 0 3 0 200 ffffffff85f57280 swapper uvm
[Locks tracked through LWPs]

****** LWP 593.593 (dhcpcd) @ 0xffff81c5c4825780, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8637ec80 type : sleep/adaptive
initialized : 0xffffffff8338cea7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff81c5c4825780 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 592.592 (dhcpcd) @ 0xffff81c5c5320900, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8637ec80 type : sleep/adaptive
initialized : 0xffffffff8338cea7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff81c5c5320900 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 348.348 (dhcpcd) @ 0xffff81c5c3ce7b00, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8637ec80 type : sleep/adaptive
initialized : 0xffffffff8338cea7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff81c5c3ce7b00 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 347.347 (dhcpcd) @ 0xffff81c5c3fe7700, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8637ec80 type : sleep/adaptive
initialized : 0xffffffff8338cea7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff81c5c3fe7700 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffff81c6e8968100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8637ec80 type : sleep/adaptive
initialized : 0xffffffff8338cea7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff81c6e8968100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffff81c6e99c6080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8637ec80 type : sleep/adaptive
initialized : 0xffffffff8338cea7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff81c6e99c6080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff85f57280, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8637ec80 type : sleep/adaptive
initialized : 0xffffffff8338cea7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff85f57280 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at main)
lock address : 0xffffffff8637eb80 type : spin
initialized : 0xffffffff83ba5dd6
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff81c5bd75f580 last held: 0xffff81c5bd75f580
last locked* : 0xffffffff833f4b5b unlocked : 0xffffffff832ff5cc
curcpu holds : 1 wanted by: 000000000000000000

PAGE FLAG PQ UOBJECT UANON
0xffffd08000007180 0045 00000000 0x0 0x0
0xffffd08000007200 0045 00000000 0x0 0x0
0xffffd08000007280 0045 00000000 0x0 0x0
0xffffd08000007300 0045 00000000 0x0 0x0
0xffffd08000007380 0045 00000000 0x0 0x0
0xffffd08000007400 0045 00000000 0x0 0x0
0xffffd08000007480 0045 00000000 0x0 0x0
0xffffd08000007500 0045 00000000 0x0 0x0
0xffffd08000007580 0045 00000000 0x0 0x0
0xffffd08000007600 0045 00000000 0x0 0x0
0xffffd08000007680 0041 00000000 0x0 0x0
0xffffd08000007700 0041 00000000 0x0 0x0
0xffffd08000007780 0041 00000000 0x0 0x0
0xffffd08000007800 0041 00000000 0x0 0x0
0xffffd08000007880 0045 00000000 0x0 0x0
0xffffd08000007900 0045 00000000 0x0 0x0
0xffffd08000007980 0041 00000000 0x0 0x0
0xffffd08000007a00 0041 00000000 0x0 0x0
0xffffd08000007a80 0041 00000000 0x0 0x0
0xffffd08000007b00 0041 00000000 0x0 0x0
0xffffd08000007b80 0041 00000000 0x0 0x0
0xffffd08000007c00 0041 00000000 0x0 0x0
0xffffd08000007c80 0041 00000000 0x0 0x0
0xffffd08000007d00 0041 00000000 0x0 0x0
0xffffd08000007d80 0041 00000000 0x0 0x0
0xffffd08000007e00 0041 00000000 0x0 0x0
0xffffd08000007e80 0041 00000000 0x0 0x0
0xffffd08000007f00 0041 00000000 0x0 0x0
0xffffd08000007f80 0041 00000000 0x0 0x0
0xffffd08000008000 0041 00000000 0x0 0x0
0xffffd08000008080 0041 00000000 0x0 0x0
0xffffd08000008100 0041 00000000 0x0 0x0
0xffffd08000008180 0041 00000000 0x0 0x0
0xffffd08000008200 0041 00000000 0x0 0x0
0xffffd08000008280 0041 00000000 0x0 0x0
0xffffd08000008300 0041 00000000 0x0 0x0
0xffffd08000008380 0041 00000000 0x0 0x0
0xffffd08000008400 0041 00000000 0x0 0x0
0xffffd08000008480 0041 00000000 0x0 0x0
0xffffd08000008500 0041 00000000 0x0 0x0
0xffffd08000008580 0041 00000000 0x0 0x0
0xffffd08000008600 0045 00000000 0x0 0x0
0xffffd08000008680 0041 00000000 0x0 0x0
0xffffd08000008700 0041 00000000 0x0 0x0
0xffffd08000008780 0041 00000000 0x0 0x0
0xffffd08000008800 0041 00000000 0x0 0x0
0xffffd08000008880 0041 00000000 0x0 0x0
0xffffd08000008900 0041 00000000 0x0 0x0
0xffffd08000008980 0041 00000000 0x0 0x0
0xffffd08000008a00 0041 00000000 0x0 0x0
0xffffd08000008a80 0041 00000000 0x0 0x0
0xffffd08000008b00 0041 00000000 0x0 0x0
0xffffd08000008b80 0045 00000000 0x0 0x0
0xffffd08000008c00 0045 00000000 0x0 0x0
0xffffd08000008c80 0041 00000000 0x0 0x0
0xffffd08000008d00 0041 00000000 0x0 0x0
0xffffd08000008d80 0041 00000000 0x0 0x0
0xffffd08000008e00 0041 00000000 0x0 0x0
0xffffd08000008e80 0041 00000000 0x0 0x0
0xffffd08000008f00 0041 00000000 0x0 0x0
0xffffd08000008f80 0041 00000000 0x0 0x0
0xffffd08000009000 0041 00000000 0x0 0x0
0xffffd08000009080 0041 00000000 0x0 0x0
0xffffd08000009100 0045 00000000 0x0 0x0
0xffffd08000009180 0041 00000000 0x0 0x0
0xffffd08000009200 0041 00000000 0x0 0x0
0xffffd08000009280 0041 00000000 0x0 0x0
0xffffd08000009300 0041 00000000 0x0 0x0
0xffffd08000009380 0041 00000000 0x0 0x0
0xffffd08000009400 0041 00000000 0x0 0x0
0xffffd08000009480 0045 00000000 0x0 0x0
0xffffd08000009500 0041 00000000 0x0 0x0
0xffffd08000009580 0041 00000000 0x0 0x0
0xffffd08000009600 0041 00000000 0x0 0x0
0xffffd08000009680 0041 00000000 0x0 0x0
0xffffd08000009700 0041 00000000 0x0 0x0
0xffffd08000009780 0041 00000000 0x0 0x0
0xffffd08000009800 0041 00000000 0x0 0x0
0xffffd08000009880 0041 00000000 0x0 0x0
0xffffd08000009900 0041 00000000 0x0 0x0
0xffffd08000009980 0041 00000000 0x0 0x0
0xffffd08000009a00 0041 00000000 0x0 0x0
0xffffd08000009a80 0045 00000000 0x0 0x0
0xffffd08000009b00 0041 00000000 0x0 0x0
0xffffd08000009b80 0041 00000000 0x0 0x0
0xffffd08000009c00 0041 00000000 0x0 0x0
0xffffd08000009c80 0041 00000000 0x0 0x0
0xffffd08000009d00 0041 00000000 0x0 0x0
0xffffd08000009d80 0041 00000000 0x0 0x0
0xffffd08000009e00 0041 00000000 0x0 0x0
0xffffd08000009e80 0041 00000000 0x0 0x0
0xffffd08000009f00 0041 00000000 0x0 0x0
0xffffd08000009f80 0041 00000000 0x0 0x0
0xffffd0800000a000 0041 00000000 0x0 0x0
0xffffd0800000a080 0041 00000000 0x0 0x0
0xffffd0800000a100 0041 00000000 0x0 0x0
0xffffd0800000a180 0041 00000000 0x0 0x0
0xffffd0800000a200 0041 00000000 0x0 0x0
0xffffd0800000a280 0041 00000000 0x0 0x0
0xffffd0800000a300 0041 00000000 0x0 0x0
0xffffd0800000a380 0041 00000000 0x0 0x0
0xffffd0800000a400 0041 00000000 0x0 0x0
0xffffd0800000a480 0041 00000000 0x0 0x0
0xffffd0800000a500 0041 00000000 0x0 0x0
0xffffd0800000a580 0041 00000000 0x0 0x0
0xffffd0800000a600 0041 00000000 0x0 0x0
0xffffd0800000a680 0041 00000000 0x0 0x0
0xffffd0800000a700 0041 00000000 0x0 0x0
0xffffd0800000a780 0041 00000000 0x0 0x0
0xffffd0800000a800 0041 00000000 0x0 0x0
0xffffd0800000a880 0041 00000000 0x0 0x0
0xffffd0800000a900 0041 00000000 0x0 0x0
0xffffd0800000a980 0041 00000000 0x0 0x0
0xffffd0800000aa00 0041 00000000 0x0 0x0
0xffffd0800000aa80 0041 00000000 0x0 0x0
0xffffd0800000ab00 0041 00000000 0x0 0x0
0xffffd0800000ab80 0041 00000000 0x0 0x0
0xffffd0800000ac00 0041 00000000 0x0 0x0
0xffffd0800000ac80 0041 00000000 0x0 0x0
0xffffd0800000ad00 0041 00000000 0x0 0x0
0xffffd0800000ad80 0041 00000000 0x0 0x0
0xffffd0800000ae00 0041 00000000 0x0 0x0
0xffffd0800000ae80 0045 00000000 0x0 0x0
0xffffd0800000af00 0045 00000000 0x0 0x0
0xffffd0800000af80 0041 00000000 0x0 0x0
0xffffd0800000b000 0041 00000000 0x0 0x0
0xffffd0800000b080 0041 00000000 0x0 0x0
0xffffd0800000b100 0041 00000000 0x0 0x0
0xffffd0800000b180 0045 00000000 0x0 0x0
0xffffd0800000b200 0045 00000000 0x0 0x0
0xffffd0800000b280 0045 00000000 0x0 0x0
0xffffd0800000b300 0045 00000000 0x0 0x0
0xffffd0800000b380 0045 00000000 0x0 0x0
0xffffd0800000b400 0041 00000000 0x0 0x0
0xffffd0800000b480 0041 00000000 0x0 0x0
0xffffd0800000b500 0041 00000000 0x0 0x0
0xffffd0800000b580 0045 00000000 0x0 0x0
0xffffd0800000b600 0045 00000000 0x0 0x0
0xffffd0800000b680 0045 00000000 0x0 0x0
0xffffd0800000b700 0045 00000000 0x0 0x0
0xffffd0800000b780 0045 00000000 0x0 0x0
0xffffd0800000b800 0041 00000000 0x0 0x0
0xffffd0800000b880 0041 00000000 0x0 0x0
0xffffd0800000b900 0045 00000000 0x0 0x0
0xffffd0800000b980 0045 00000000 0x0 0x0
0xffffd0800000ba00 0045 00000000 0x0 0x0
0xffffd0800000ba80 0045 00000000 0x0 0x0
0xffffd0800000bb00 0045 00000000 0x0 0x0
0xffffd0800000bb80 0045 00000000 0x0 0x0
0xffffd0800000bc00 0045 00000000 0x0 0x0
0xffffd0800000bc80 0041 00000000 0x0 0x0
0xffffd0800000bd00 0045 00000000 0x0 0x0
0xffffd0800000bd80 0045 00000000 0x0 0x0
0xffffd0800000be00 0045 00000000 0x0 0x0
0xffffd0800000be80 0045 00000000 0x0 0x0
0xffffd0800000bf00 0045 00000000 0x0 0x0
0xffffd0800000bf80 0045 00000000 0x0 0x0
0xffffd0800000c000 0045 00000000 0x0 0x0
0xffffd0800000c080 0041 00000000 0x0 0x0
0xffffd0800000c100 0045 00000000 0x0 0x0
0xffffd0800000c180 0045 00000000 0x0 0x0
0xffffd0800000c200 0045 00000000 0x0 0x0
0xffffd0800000c280 0045 00000000 0x0 0x0
0xffffd0800000c300 0045 00000000 0x0 0x0
0xffffd0800000c380 0045 00000000 0x0 0x0
0xffffd0800000c400 0045 00000000 0x0 0x0
0xffffd0800000c480 0045 00000000 0x0 0x0
0xffffd0800000c500 0045 00000000 0x0 0x0
0xffffd0800000c580 0045 00000000 0x0 0x0
0xffffd0800000c600 0045 00000000 0x0 0x0
0xffffd0800000c680 0045 00000000 0x0 0x0
0xffffd0800000c700 0041 00000000 0x0 0x0
0xffffd0800000c780 0045 00000000 0x0 0x0
0xffffd0800000c800 0045 00000000 0x0 0x0
0xffffd0800000c880 0045 00000000 0x0 0x0
0xffffd0800000c900 0045 00000000 0x0 0x0
0xffffd0800000c980 0045 00000000 0x0 0x0
0xffffd0800000ca00 0045 00000000 0x0 0x0
0xffffd0800000ca80 0041 00000000 0x0 0x0
0xffffd0800000cb00 0041 00000000 0x0 0x0
0xffffd0800000cb80 0041 00000000 0x0 0x0
0xffffd0800000cc00 0045 00000000 0x0 0x0
0xffffd0800000cc80 0045 00000000 0x0 0x0
0xffffd0800000cd00 0045 00000000 0x0 0x0
0xffffd0800000cd80 0041 00000000 0x0 0x0
0xffffd0800000ce00 0041 00000000 0x0 0x0
0xffffd0800000ce80 0041 00000000 0x0 0x0
0xffffd0800000cf00 0041 00000000 0x0 0x0
0xffffd0800000cf80 0041 00000000 0x0 0x0
0xffffd0800000d000 0045 00000000 0x0 0x0
0xffffd0800000d080 0045 00000000 0x0 0x0
0xffffd0800000d100 0041 00000000 0x0 0x0
0xffffd0800000d180 0041 00000000 0x0 0x0
0xffffd0800000d200 0041 00000000 0x0 0x0
0xffffd0800000d280 0041 00000000 0x0 0x0
0xffffd0800000d300 0041 00000000 0x0 0x0
0xffffd0800000d380 0041 00000000 0x0 0x0
0xffffd0800000d400 0041 00000000 0x0 0x0
0xffffd0800000d480 0045 00000000 0x0 0x0
0xffffd0800000d500 0041 00000000 0x0 0x0
0xffffd0800000d580 0041 00000000 0x0 0x0
0xffffd0800000d600 0041 00000000 0x0 0x0
0xffffd0800000d680 0045 00000000 0x0 0x0
0xffffd0800000d700 0045 00000000 0x0 0x0
0xffffd0800000d780 0041 00000000 0x0 0x0
0xffffd0800000d800 0041 00000000 0x0 0x0
0xffffd0800000d880 0045 00000000 0x0 0x0
0xffffd0800000d900 0041 00000000 0x0 0x0
0xffffd0800000d980 0041 00000000 0x0 0x0
0xffffd0800000da00 0041 00000000 0x0 0x0
0xffffd0800000da80 0041 00000000 0x0 0x0
0xffffd0800000db00 0045 00000000 0x0 0x0
0xffffd0800000db80 0045 00000000 0x0 0x0
0xffffd0800000dc00 0041 00000000 0x0 0x0
0xffffd0800000dc80 0041 00000000 0x0 0x0
0xffffd0800000dd00 0041 00000000 0x0 0x0
0xffffd0800000dd80 0041 00000000 0x0 0x0
0xffffd0800000de00 0041 00000000 0x0 0x0
0xffffd0800000de80 0041 00000000 0x0 0x0
0xffffd0800000df00 0045 00000000 0x0 0x0
0xffffd0800000df80 0045 00000000 0x0 0x0
0xffffd0800000e000 0041 00000000 0x0 0x0
0xffffd0800000e080 0041 00000000 0x0 0x0
0xffffd0800000e100 0041 00000000 0x0 0x0
0xffffd0800000e180 0045 00000000 0x0 0x0
0xffffd0800000e200 0045 00000000 0x0 0x0
0xffffd0800000e280 0045 00000000 0x0 0x0
0xffffd0800000e300 0041 00000000 0x0 0x0
0xffffd0800000e380 0045 00000000 0x0 0x0
0xffffd0800000e400 0045 00000000 0x0 0x0
0xffffd0800000e480 0041 00000000 0x0 0x0
0xffffd0800000e500 0045 00000000 0x0 0x0
0xffffd0800000e580 0041 00000000 0x0 0x0
0xffffd0800000e600 0041 00000000 0x0 0x0
0xffffd0800000e680 0041 00000000 0x0 0x0
0xffffd0800000e700 0041 00000000 0x0 0x0
0xffffd0800000e780 0041 00000000 0x0 0x0
0xffffd0800000e800 0045 00000000 0x0 0x0
0xffffd0800000e880 0041 00000000 0x0 0x0
0xffffd0800000e900 0041 00000000 0x0 0x0
0xffffd0800000e980 0041 00000000 0x0 0x0
0xffffd0800000ea00 0041 00000000 0x0 0x0
0xffffd0800000ea80 0045 00000000 0x0 0x0
0xffffd0800000eb00 0041 00000000 0x0 0x0
0xffffd0800000eb80 0041 00000000 0x0 0x0
0xffffd0800000ec00 0045 00000000 0x0 0x0
0xffffd0800000ec80 0045 00000000 0x0 0x0
0xffffd0800000ed00 0041 00000000 0x0 0x0
0xffffd0800000ed80 0041 00000000 0x0 0x0
0xffffd0800000ee00 0041 00000000 0x0 0x0
0xffffd0800000ee80 0041 00000000 0x0 0x0
0xffffd0800000ef00 0041 00000000 0x0 0x0
0xffffd0800000ef80 0045 00000000 0x0 0x0
0xffffd0800000f000 0041 00000000 0x0 0x0
0xffffd0800000f080 0041 00000000 0x0 0x0
0xffffd0800000f100 0041 00000000 0x0 0x0
0xffffd0800000f180 0041 00000000 0x0 0x0
0xffffd0800000f200 0045 00000000 0x0 0x0
0xffffd0800000f280 0041 00000000 0x0 0x0
0xffffd0800000f300 0041 00000000 0x0 0x0
0xffffd0800000f380 0041 00000000 0x0 0x0
0xffffd0800000f400 0041 00000000 0x0 0x0
0xffffd0800000f480 0041 00000000 0x0 0x0
0xffffd0800000f500 0041 00000000 0x0 0x0
0xffffd0800000f580 0041 00000000 0x0 0x0
0xffffd0800000f600 0041 00000000 0x0 0x0
0xffffd0800000f680 0041 00000000 0x0 0x0
0xffffd0800000f700 0041 00000000 0x0 0x0
0xffffd0800000f780 0041 00000000 0x0 0x0
0xffffd0800000f800 0045 00000000 0x0 0x0
0xffffd0800000f880 0041 00000000 0x0 0x0
0xffffd0800000f900 0041 00000000 0x0 0x0
0xffffd0800000f980 0041 00000000 0x0 0x0
0xffffd0800000fa00 0041 00000000 0x0 0x0
0xffffd0800000fa80 0041 00000000 0x0 0x0
0xffffd0800000fb00 0041 00000000 0x0 0x0
0xffffd0800000fb80 0041 00000000 0x0 0x0
0xffffd0800000fc00 0041 00000000 0x0 0x0
0xffffd0800000fc80 0041 00000000 0x0 0x0
0xffffd0800000fd00 0041 00000000 0x0 0x0
0xffffd0800000fd80 0041 00000000 0x0 0x0
0xffffd0800000fe00 0041 00000000 0x0 0x0
0xffffd0800000fe80 0041 00000000 0x0 0x0
0xffffd0800000ff00 0041 00000000 0x0 0x0
0xffffd0800000ff80 0041 00000000 0x0 0x0
0xffffd08000010000 0041 00000000 0x0 0x0
0xffffd08000010080 0041 00000000 0x0 0x0
0xffffd08000010100 0045 00000000 0x0 0x0
0xffffd08000010180 0045 00000000 0x0 0x0
0xffffd08000010200 0041 00000000 0x0 0x0
0xffffd08000010280 0041 00000000 0x0 0x0
0xffffd08000010300 0041 00000000 0x0 0x0
0xffffd08000010380 0041 00000000 0x0 0x0
0xffffd08000010400 0041 00000000 0x0 0x0
0xffffd08000010480 0041 00000000 0x0 0x0
0xffffd08000010500 0041 00000000 0x0 0x0
0xffffd08000010580 0041 00000000 0x0 0x0
0xffffd08000010600 0045 00000000 0x0 0x0
0xffffd08000010680 0045 00000000 0x0 0x0
0xffffd08000010700 0041 00000000 0x0 0x0
0xffffd08000010780 0041 00000000 0x0 0x0
0xffffd08000010800 0045 00000000 0x0 0x0
0xffffd08000010880 0045 00000000 0x0 0x0
0xffffd08000010900 0045 00000000 0x0 0x0
0xffffd08000010980 0045 00000000 0x0 0x0
0xffffd08000010a00 0041 00000000 0x0 0x0
0xffffd08000010a80 0041 00000000 0x0 0x0
0xffffd08000010b00 0041 00000000 0x0 0x0
0xffffd08000010b80 0041 00000000 0x0 0x0
0xffffd08000010c00 0041 00000000 0x0 0x0
0xffffd08000010c80 0041 00000000 0x0 0x0
0xffffd08000010d00 0041 00000000 0x0 0x0
0xffffd08000010d80 0041 00000000 0x0 0x0
0xffffd08000010e00 0045 00000000 0x0 0x0
0xffffd08000010e80 0045 00000000 0x0 0x0
0xffffd08000010f00 0041 00000000 0x0 0x0
0xffffd08000010f80 0041 00000000 0x0 0x0
0xffffd08000011000 0041 00000000 0x0 0x0
0xffffd08000011080 0045 00000000 0x0 0x0
0xffffd08000011100 0045 00000000 0x0 0x0
0xffffd08000011180 0045 00000000 0x0 0x0
0xffffd08000011200 0041 00000000 0x0 0x0
0xffffd08000011280 0041 00000000 0x0 0x0
0xffffd08000011300 0041 00000000 0x0 0x0
0xffffd08000011380 0041 00000000 0x0 0x0
0xffffd08000011400 0041 00000000 0x0 0x0
0xffffd08000011480 0041 00000000 0x0 0x0
0xffffd08000011500 0041 00000000 0x0 0x0
0xffffd08000011580 0041 00000000 0x0 0x0
0xffffd08000011600 0041 00000000 0x0 0x0
0xffffd08000011680 0045 00000000 0x0 0x0
0xffffd08000011700 0041 00000000 0x0 0x0
0xffffd08000011780 0041 00000000 0x0 0x0
0xffffd08000011800 0041 00000000 0x0 0x0
0xffffd08000011880 0041 00000000 0x0 0x0
0xffffd08000011900 0041 00000000 0x0 0x0
0xffffd08000011980 0041 00000000 0x0 0x0
0xffffd08000011a00 0041 00000000 0x0 0x0
0xffffd08000011a80 0041 00000000 0x0 0x0
0xffffd08000011b00 0045 00000000 0x0 0x0
0xffffd08000011b80 0041 00000000 0x0 0x0
0xffffd08000011c00 0041 00000000 0x0 0x0
0xffffd08000011c80 0041 00000000 0x0 0x0
0xffffd08000011d00 0041 00000000 0x0 0x0
0xffffd08000011d80 0041 00000000 0x0 0x0
0xffffd08000011e00 0045 00000000 0x0 0x0
0xffffd08000011e80 0041 00000000 0x0 0x0
0xffffd08000011f00 0041 00000000 0x0 0x0
0xffffd08000011f80 0045 00000000 0x0 0x0
0xffffd08000012000 0041 00000000 0x0 0x0
0xffffd08000012080 0041 00000000 0x0 0x0
0xffffd08000012100 0041 00000000 0x0 0x0
0xffffd08000012180 0041 00000000 0x0 0x0
0xffffd08000012200 0041 00000000 0x0 0x0
0xffffd08000012280 0041 00000000 0x0 0x0
0xffffd08000012300 0041 00000000 0x0 0x0
0xffffd08000012380 0041 00000000 0x0 0x0
0xffffd08000012400 0041 00000000 0x0 0x0
0xffffd08000012480 0041 00000000 0x0 0x0
0xffffd08000012500 0041 00000000 0x0 0x0
0xffffd08000012580 0041 00000000 0x0 0x0
0xffffd08000012600 0041 00000000 0x0 0x0
0xffffd08000012680 0045 00000000 0x0 0x0
0xffffd08000012700 0041 00000000 0x0 0x0
0xffffd08000012780 0041 00000000 0x0 0x0
0xffffd08000012800 0041 00000000 0x0 0x0
0xffffd08000012880 0041 00000000 0x0 0x0
0xffffd08000012900 0041 00000000 0x0 0x0
0xffffd08000012980 0045 00000000 0x0 0x0
0xffffd08000012a00 0041 00000000 0x0 0x0
0xffffd08000012a80 0041 00000000 0x0 0x0
0xffffd08000012b00 0041 00000000 0x0 0x0
0xffffd08000012b80 0041 00000000 0x0 0x0
0xffffd08000012c00 0041 00000000 0x0 0x0
0xffffd08000012c80 0041 00000000 0x0 0x0
0xffffd08000012d00 0045 00000000 0x0 0x0
0xffffd08000012d80 0041 00000000 0x0 0x0
0xffffd08000012e00 0041 00000000 0x0 0x0
0xffffd08000012e80 0041 00000000 0x0 0x0
0xffffd08000012f00 0041 00000000 0x0 0x0
0xffffd08000012f80 0041 00000000 0x0 0x0
0xffffd08000013000 0045 00000000 0x0 0x0
0xffffd08000013080 0045 00000000 0x0 0x0
0xffffd08000013100 0001 00000000 0x0 0x0
0xffffd08000013180 0001 00000000 0x0 0x0
0xffffd08000013200 0001 00000000 0x0 0x0
0xffffd08000013280 0001 00000000 0x0 0x0
0xffffd08000013300 0001 00000000 0x0 0x0
0xffffd08000013380 0001 00000000 0x0 0x0
0xffffd08000013400 0001 00000000 0x0 0x0
0xffffd08000013480 0001 00000000 0x0 0x0
0xffffd08000013500 0001 00000000 0x0 0x0
0xffffd08000013580 0001 00000000 0x0 0x0
0xffffd08000013600 0001 00000000 0x0 0x0
0xffffd08000013680 0001 00000000 0x0 0x0
0xffffd08000013700 0001 00000000 0x0 0x0
0xffffd08000013780 0001 00000000 0x0 0x0
0xffffd08000013800 0001 00000000 0x0 0x0
0xffffd08000013880 0001 00000000 0x0 0x0
0xffffd08000013900 0001 00000000 0x0 0x0
0xffffd08000013980 0001 00000000 0x0 0x0
0xffffd08000013a00 0001 00000000 0x0 0x0
0xffffd08000013a80 0001 00000000 0x0 0x0
0xffffd08000013b00 0001 00000000 0x0 0x0
0xffffd08000013b80 0001 00000000 0x0 0x0
0xffffd08000013c00 0001 00000000 0x0 0x0
0xffffd08000013c80 0001 00000000 0x0 0x0
0xffffd08000013d00 0001 00000000 0x0 0x0
0xffffd08000013d80 0001 00000000 0x0 0x0
0xffffd08000013e00 0001 00000000 0x0 0x0
0xffffd08000013e80 0001 00000000 0x0 0x0
0xffffd08000013f00 0001 00000000 0x0 0x0
0xffffd08000013f80 0001 00000000 0x0 0x0
0xffffd08000014000 0001 00000000 0x0 0x0
0xffffd08000014080 0001 00000000 0x0 0x0
0xffffd08000014100 0001 00000000 0x0 0x0
0xffffd08000014180 0001 00000000 0x0 0x0
0xffffd08000014200 0001 00000000 0x0 0x0
0xffffd08000014280 0001 00000000 0x0 0x0
0xffffd08000014300 0001 00000000 0x0 0x0
0xffffd08000014380 0001 00000000 0x0 0x0
0xffffd08000014400 0001 00000000 0x0 0x0
0xffffd08000014480 0001 00000000 0x0 0x0
0xffffd08000014500 0001 00000000 0x0 0x0
0xffffd08000014580 0001 00000000 0x0 0x0
0xffffd08000014600 0001 00000000 0x0 0x0
0xffffd08000014680 0001 00000000 0x0 0x0
0xffffd08000014700 0001 00000000 0x0 0x0
0xffffd08000014780 0001 00000000 0x0 0x0
0xffffd08000014800 0001 00000000 0x0 0x0
0xffffd08000014880 0001 00000000 0x0 0x0
0xffffd08000014900 0001 00000000 0x0 0x0
0xffffd08000014980 0001 00000000 0x0 0x0
0xffffd08000014a00 0001 00000000 0x0 0x0
0xffffd08000014a80 0001 00000000 0x0 0x0
0xffffd08000014b00 0001 00000000 0x0 0x0
0xffffd08000014b80 0001 00000000 0x0 0x0
0xffffd08000014c00 0041 00000000 0x0 0x0
0xffffd08000014c80 0041 00000000 0x0 0x0
0xffffd08000014d00 0041 00000000 0x0 0x0
0xffffd08000014d80 0041 00000000 0x0 0x0
0xffffd08000014e00 0041 00000000 0x0 0x0
0xffffd08000014e80 0041 00000000 0x0 0x0
0xffffd08000014f00 0041 00000000 0x0 0x0
0xffffd08000014f80 0041 00000000 0x0 0x0
0xffffd08000015000 0041 00000000 0x0 0x0
0xffffd08000015080 0041 00000000 0x0 0x0
0xffffd08000015100 0041 00000000 0x0 0x0
0xffffd08000015180 0041 00000000 0x0 0x0
0xffffd08000015200 0041 00000000 0x0 0x0
0xffffd08000015280 0041 00000000 0x0 0x0
0xffffd08000015300 0041 00000000 0x0 0x0
0xffffd08000015380 0041 00000000 0x0 0x0
0xffffd08000015400 0041 00000000 0x0 0x0
0xffffd08000015480 0041 00000000 0x0 0x0
0xffffd08000015500 0041 00000000 0x0 0x0
0xffffd08000015580 0041 00000000 0x0 0x0
0xffffd08000015600 0041 00000000 0x0 0x0
0xffffd08000015680 0041 00000000 0x0 0x0
0xffffd08000015700 0041 00000000 0x0 0x0
0xffffd08000015780 0041 00000000 0x0 0x0
0xffffd08000015800 0041 00000000 0x0 0x0
0xffffd08000015880 0041 00000000 0x0 0x0
0xffffd08000015900 0041 00000000 0x0 0x0
0xffffd08000015980 0041 00000000 0x0 0x0
0xffffd08000015a00 0041 00000000 0x0 0x0
0xffffd08000015a80 0041 00000000 0x0 0x0
0xffffd08000015b00 0041 00000000 0x0 0x0
0xffffd08000015b80 0041 00000000 0x0 0x0
0xffffd08000015c00 0041 00000000 0x0 0x0
0xffffd08000015c80 0041 00000000 0x0 0x0
0xffffd08000015d00 0041 00000000 0x0 0x0
0xffffd08000015d80 0041 00000000 0x0 0x0
0xffffd08000015e00 0041 00000000 0x0 0x0
0xffffd08000015e80 0041 00000000 0x0 0x0
0xffffd08000015f00 0041 00000000 0x0 0x0
0xffffd08000015f80 0041 00000000 0x0 0x0
0xffffd08000016000 0041 00000000 0x0 0x0
0xffffd08000016080 0041 00000000 0x0 0x0
0xffffd08000016100 0041 00000000 0x0 0x0
0xffffd08000016180 0001 00000000 0x0 0x0
0xffffd08000016200 0001 00000000 0x0 0x0
0xffffd08000016280 0001 00000000 0x0 0x0
0xffffd08000016300 0001 00000000 0x0 0x0
0xffffd08000016380 0001 00000000 0x0 0x0
0xffffd08000016400 0001 00000000 0x0 0x0
0xffffd08000016480 0001 00000000 0x0 0x0
0xffffd08000016500 0001 00000000 0x0 0x0
0xffffd08000016580 0001 00000000 0x0 0x0
0xffffd08000016600 0001 00000000 0x0 0x0
0xffffd08000016680 0001 00000000 0x0 0x0
0xffffd08000016700 0001 00000000 0x0 0x0
0xffffd08000016780 0001 00000000 0x0 0x0
0xffffd08000016800 0001 00000000 0x0 0x0
0xffffd08000016880 0001 00000000 0x0 0x0
0xffffd08000016900 0001 00000000 0x0 0x0
0xffffd08000016980 0001 00000000 0x0 0x0
0xffffd08000016a00 0001 00000000 0x0 0x0
0xffffd08000016a80 0001 00000000 0x0 0x0
0xffffd08000016b00 0001 00000000 0x0 0x0
0xffffd08000016b80 0001 00000000 0x0 0x0
0xffffd08000016c00 0001 00000000 0x0 0x0
0xffffd08000016c80 0001 00000000 0x0 0x0
0xffffd08000016d00 0001 00000000 0x0 0x0
0xffffd08000016d80 0001 00000000 0x0 0x0
0xffffd08000016e00 0001 00000000 0x0 0x0
0xffffd08000016e80 0001 00000000 0x0 0x0
0xffffd08000016f00 0001 00000000 0x0 0x0
0xffffd08000016f80 0001 00000000 0x0 0x0
0xffffd08000017000 0001 00000000 0x0 0x0
0xffffd08000017080 0001 00000000 0x0 0x0
0xffffd08000017100 0001 00000000 0x0 0x0
0xffffd08000017180 0001 00000000 0x0 0x0
0xffffd08000017200 0001 00000000 0x0 0x0
0xffffd08000017280 0001 00000000 0x0 0x0
0xffffd08000017300 0001 00000000 0x0 0x0
0xffffd08000017380 0001 00000000 0x0 0x0
0xffffd08000017400 0001 00000000 0x0 0x0
0xffffd08000017480 0001 00000000 0x0 0x0
0xffffd08000017500 0001 00000000 0x0 0x0
0xffffd08000017580 0001 00000000 0x0 0x0
0xffffd08000017600 0001 00000000 0x0 0x0
0xffffd08000017680 0001 00000000 0x0 0x0
0xffffd08000017700 0001 00000000 0x0 0x0
0xffffd08000017780 0001 00000000 0x0 0x0
0xffffd08000017800 0001 00000000 0x0 0x0
0xffffd08000017880 0001 00000000 0x0 0x0
0xffffd08000017900 0001 00000000 0x0 0x0
0xffffd08000017980 0001 00000000 0x0 0x0
0xffffd08000017a00 0001 00000000 0x0 0x0
0xffffd08000017a80 0001 00000000 0x0 0x0
0xffffd08000017b00 0001 00000000 0x0 0x0
0xffffd08000017b80 0001 00000000 0x0 0x0
0xffffd08000017c00 0001 00000000 0x0 0x0
0xffffd08000017c80 0041 00000000 0x0 0x0
0xffffd08000017d00 0041 00000000 0x0 0x0
0xffffd08000017d80 0041 00000000 0x0 0x0
0xffffd08000017e00 0041 00000000 0x0 0x0
0xffffd08000017e80 0041 00000000 0x0 0x0
0xffffd08000017f00 0041 00000000 0x0 0x0
0xffffd08000017f80 0041 00000000 0x0 0x0
0xffffd08000018000 0041 00000000 0x0 0x0
0xffffd08000018080 0041 00000000 0x0 0x0
0xffffd08000018100 0041 00000000 0x0 0x0
0xffffd08000018180 0041 00000000 0x0 0x0
0xffffd08000018200 0041 00000000 0x0 0x0
0xffffd08000018280 0041 00000000 0x0 0x0
0xffffd08000018300 0041 00000000 0x0 0x0
0xffffd08000018380 0041 00000000 0x0 0x0
0xffffd08000018400 0041 00000000 0x0 0x0
0xffffd08000018480 0041 00000000 0x0 0x0
0xffffd08000018500 0041 00000000 0x0 0x0
0xffffd08000018580 0041 00000000 0x0 0x0
0xffffd08000018600 0041 00000000 0x0 0x0
0xffffd08000018680 0041 00000000 0x0 0x0
0xffffd08000018700 0041 00000000 0x0 0x0
0xffffd08000018780 0041 00000000 0x0 0x0
0xffffd08000018800 0041 00000000 0x0 0x0
0xffffd08000018880 0041 00000000 0x0 0x0
0xffffd08000018900 0041 00000000 0x0 0x0
0xffffd08000018980 0041 00000000 0x0 0x0
0xffffd08000018a00 0041 00000000 0x0 0x0
0xffffd08000018a80 0041 00000000 0x0 0x0
0xffffd08000018b00 0041 00000000 0x0 0x0
0xffffd08000018b80 0041 00000000 0x0 0x0
0xffffd08000018c00 0041 00000000 0x0 0x0
0xffffd08000018c80 0041 00000000 0x0 0x0
0xffffd08000018d00 0041 00000000 0x0 0x0
0xffffd08000018d80 0041 00000000 0x0 0x0
0xffffd08000018e00 0041 00000000 0x0 0x0
0xffffd08000018e80 0041 00000000 0x0 0x0
0xffffd08000018f00 0041 00000000 0x0 0x0
0xffffd08000018f80 0041 00000000 0x0 0x0
0xffffd08000019000 0041 00000000 0x0 0x0
0xffffd08000019080 0041 00000000 0x0 0x0
0xffffd08000019100 0041 00000000 0x0 0x0
0xffffd08000019180 0041 00000000 0x0 0x0
0xffffd08000019200 0041 00000000 0x0 0x0
0xffffd08000019280 0041 00000000 0x0 0x0
0xffffd08000019300 0041 00000000 0x0 0x0
0xffffd08000019380 0041 00000000 0x0 0x0
0xffffd08000019400 0041 00000000 0x0 0x0
0xffffd08000019480 0001 00000000 0x0 0x0
0xffffd08000019500 0001 00000000 0x0 0x0
0xffffd08000019580 0001 00000000 0x0 0x0
0xffffd08000019600 0001 00000000 0x0 0x0
0xffffd08000019680 0001 00000000 0x0 0x0
0xffffd08000019700 0001 00000000 0x0 0x0
0xffffd08000019780 0001 00000000 0x0 0x0
0xffffd08000019800 0001 00000000 0x0 0x0
0xffffd08000019880 0001 00000000 0x0 0x0
0xffffd08000019900 0001 00000000 0x0 0x0
0xffffd08000019980 0001 00000000 0x0 0x0
0xffffd08000019a00 0001 00000000 0x0 0x0
0xffffd08000019a80 0001 00000000 0x0 0x0
0xffffd08000019b00 0001 00000000 0x0 0x0
0xffffd08000019b80 0001 00000000 0x0 0x0
0xffffd08000019c00 0001 00000000 0x0 0x0
0xffffd08000019c80 0001 00000000 0x0 0x0
0xffffd08000019d00 0001 00000000 0x0 0x0
0xffffd08000019d80 0001 00000000 0x0 0x0
0xffffd08000019e00 0001 00000000 0x0 0x0
0xffffd08000019e80 0001 00000000 0x0 0x0
0xffffd08000019f00 0001 00000000 0x0 0x0
0xffffd08000019f80 0001 00000000 0x0 0x0
0xffffd0800001a000 0001 00000000 0x0 0x0
0xffffd0800001a080 0001 00000000 0x0 0x0
0xffffd0800001a100 0001 00000000 0x0 0x0
0xffffd0800001a180 0001 00000000 0x0 0x0
0xffffd0800001a200 0001 00000000 0x0 0x0
0xffffd0800001a280 0001 00000000 0x0 0x0
0xffffd0800001a300 0001 00000000 0x0 0x0
0xffffd0800001a380 0001 00000000 0x0 0x0
0xffffd0800001a400 0001 00000000 0x0 0x0
0xffffd0800001a480 0001 00000000 0x0 0x0
0xffffd0800001a500 0001 00000000 0x0 0x0
0xffffd0800001a580 0001 00000000 0x0 0x0
0xffffd0800001a600 0001 00000000 0x0 0x0
0xffffd0800001a680 0001 00000000 0x0 0x0
0xffffd0800001a700 0001 00000000 0x0 0x0
0xffffd0800001a780 0001 00000000 0x0 0x0
0xffffd0800001a800 0001 00000000 0x0 0x0
0xffffd0800001a880 0001 00000000 0x0 0x0
0xffffd0800001a900 0001 00000000 0x0 0x0
0xffffd0800001a980 0001 00000000 0x0 0x0
0xffffd0800001aa00 0001 00000000 0x0 0x0
0xffffd0800001aa80 0001 00000000 0x0 0x0
0xffffd0800001ab00 0001 00000000 0x0 0x0
0xffffd0800001ab80 0001 00000000 0x0 0x0
0xffffd0800001ac00 0001 00000000 0x0 0x0
0xffffd0800001ac80 0001 00000000 0x0 0x0
0xffffd0800001ad00 0001 00000000 0x0 0x0
0xffffd0800001ad80 0001 00000000 0x0 0x0
0xffffd0800001ae00 0001 00000000 0x0 0x0
0xffffd0800001ae80 0001 00000000 0x0 0x0
0xffffd0800001af00 0001 00000000 0x0 0x0
0xffffd0800001af80 0041 00000000 0x0 0x0
0xffffd0800001b000 0041 00000000 0x0 0x0
0xffffd0800001b080 0041 00000000 0x0 0x0
0xffffd0800001b100 0041 00000000 0x0 0x0
0xffffd0800001b180 0041 00000000 0x0 0x0
0xffffd0800001b200 0041 00000000 0x0 0x0
0xffffd0800001b280 0041 00000000 0x0 0x0
0xffffd0800001b300 0041 00000000 0x0 0x0
0xffffd0800001b380 0041 00000000 0x0 0x0
0xffffd0800001b400 0041 00000000 0x0 0x0
0xffffd0800001b480 0041 00000000 0x0 0x0
0xffffd0800001b500 0041 00000000 0x0 0x0
0xffffd0800001b580 0041 00000000 0x0 0x0
0xffffd0800001b600 0041 00000000 0x0 0x0
0xffffd0800001b680 0041 00000000 0x0 0x0
0xffffd0800001b700 0041 00000000 0x0 0x0
0xffffd0800001b780 0041 00000000 0x0 0x0
0xffffd0800001b800 0041 00000000 0x0 0x0
0xffffd0800001b880 0041 00000000 0x0 0x0
0xffffd0800001b900 0041 00000000 0x0 0x0
0xffffd0800001b980 0041 00000000 0x0 0x0
0xffffd0800001ba00 0041 00000000 0x0 0x0
0xffffd0800001ba80 0041 00000000 0x0 0x0
0xffffd0800001bb00 0045 00000000 0x0 0x0
0xffffd0800001bb80 0045 00000000 0x0 0x0
0xffffd0800001bc00 0041 00000000 0x0 0x0
0xffffd0800001bc80 0041 00000000 0x0 0x0
0xffffd0800001bd00 0041 00000000 0x0 0x0
0xffffd0800001bd80 0041 00000000 0x0 0x0
0xffffd0800001be00 0045 00000000 0x0 0x0
0xffffd0800001be80 0041 00000000 0x0 0x0
0xffffd0800001bf00 0045 00000000 0x0 0x0
0xffffd0800001bf80 0045 00000000 0x0 0x0
0xffffd0800001c000 0041 00000000 0x0 0x0
0xffffd0800001c080 0041 00000000 0x0 0x0
0xffffd0800001c100 0041 00000000 0x0 0x0
0xffffd0800001c180 0041 00000000 0x0 0x0
0xffffd0800001c200 0045 00000000 0x0 0x0
0xffffd0800001c280 0041 00000000 0x0 0x0
0xffffd0800001c300 0045 00000000 0x0 0x0
0xffffd0800001c380 0045 00000000 0x0 0x0
0xffffd0800001c400 0041 00000000 0x0 0x0
0xffffd0800001c480 0041 00000000 0x0 0x0
0xffffd0800001c500 0041 00000000 0x0 0x0
0xffffd0800001c580 0041 00000000 0x0 0x0
0xffffd0800001c600 0045 00000000 0x0 0x0
0xffffd0800001c680 0045 00000000 0x0 0x0
0xffffd0800001c700 0045 00000000 0x0 0x0
0xffffd0800001c780 0045 00000000 0x0 0x0
0xffffd0800001c800 0045 00000000 0x0 0x0
0xffffd0800001c880 0041 00000000 0x0 0x0
0xffffd0800001c900 0001 00000000 0x0 0x0
0xffffd0800001c980 0001 00000000 0x0 0x0
0xffffd0800001ca00 0001 00000000 0x0 0x0
0xffffd0800001ca80 0001 00000000 0x0 0x0
0xffffd0800001cb00 0001 00000000 0x0 0x0
0xffffd0800001cb80 0001 00000000 0x0 0x0
0xffffd0800001cc00 0001 00000000 0x0 0x0
0xffffd0800001cc80 0001 00000000 0x0 0x0
0xffffd0800001cd00 0001 00000000 0x0 0x0
0xffffd0800001cd80 0001 00000000 0x0 0x0
0xffffd0800001ce00 0001 00000000 0x0 0x0
0xffffd0800001ce80 0001 00000000 0x0 0x0
0xffffd0800001cf00 0001 00000000 0x0 0x0
0xffffd0800001cf80 0001 00000000 0x0 0x0
0xffffd0800001d000 0001 00000000 0x0 0x0
0xffffd0800001d080 0001 00000000 0x0 0x0
0xffffd0800001d100 0001 00000000 0x0 0x0
0xffffd0800001d180 0001 00000000 0x0 0x0
0xffffd0800001d200 0001 00000000 0x0 0x0
0xffffd0800001d280 0001 00000000 0x0 0x0
0xffffd0800001d300 0001 00000000 0x0 0x0
0xffffd0800001d380 0001 00000000 0x0 0x0
0xffffd0800001d400 0001 00000000 0x0 0x0
0xffffd0800001d480 0001 00000000 0x0 0x0
0xffffd0800001d500 0001 00000000 0x0 0x0
0xffffd0800001d580 0001 00000000 0x0 0x0
0xffffd0800001d600 0001 00000000 0x0 0x0
0xffffd0800001d680 0001 00000000 0x0 0x0
0xffffd0800001d700 0001 00000000 0x0 0x0
0xffffd0800001d780 0001 00000000 0x0 0x0
0xffffd0800001d800 0001 00000000 0x0 0x0
0xffffd0800001d880 0001 00000000 0x0 0x0
0xffffd0800001d900 0001 00000000 0x0 0x0
0xffffd0800001d980 0

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Dec 7, 2021, 5:47:26 PM12/7/21

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 0f5320a36768 Match variable names to register names. Same ..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=14b9e2b9b00000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=017911f90e0f9766bc71
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17ae329db00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11dbe575b00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+017911...@syzkaller.appspotmail.com

[ 39.7886745] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/usb/usb_subr.c:1810:23, member access within null pointer of type 'struct usb_config_descriptor_t'

[ 39.8086621] cpu1: Begin traceback...
[ 39.8286653] vpanic() at netbsd:vpanic+0x2d0 sys/kern/subr_prf.c:290
[ 39.8686646] isAlreadyReported() at netbsd:isAlreadyReported
[ 39.9086653] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 39.9486658] usb_free_device() at netbsd:usb_free_device+0x597 sys/dev/usb/usb_subr.c:1810
[ 39.9886660] usb_disconnect_port() at netbsd:usb_disconnect_port+0x410 sys/dev/usb/usb_subr.c:1904
[ 40.0286658] uhub_explore() at netbsd:uhub_explore+0x747 sys/dev/usb/uhub.c:663
[ 40.0786685] usb_discover() at netbsd:usb_discover+0x234 sys/dev/usb/usb.c:1197
[ 40.1186674] usb_event_thread() at netbsd:usb_event_thread+0x1c1 sys/dev/usb/usb.c:750
[ 40.1286674] cpu1: End traceback...
[ 40.1386680] fatal breakpoint trap in supervisor mode
[ 40.1386680] trap type 1 code 0 rip 0xffffffff80221a95 cs 0x8 rflags 0x246 cr2 0x7611bcb33f20 ilevel 0 rsp 0xffffbb80c0fae870
[ 40.1486645] curlwp 0xffffebae1bb21980 pid 0.123 lowest kstack 0xffffbb80c0faa2c0
Stopped in pid 0.123 (system) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2d0 sys/kern/subr_prf.c:290
isAlreadyReported() at netbsd:isAlreadyReported
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
usb_free_device() at netbsd:usb_free_device+0x597 sys/dev/usb/usb_subr.c:1810
usb_disconnect_port() at netbsd:usb_disconnect_port+0x410 sys/dev/usb/usb_subr.c:1904
uhub_explore() at netbsd:uhub_explore+0x747 sys/dev/usb/uhub.c:663
usb_discover() at netbsd:usb_discover+0x234 sys/dev/usb/usb.c:1197
usb_event_thread() at netbsd:usb_event_thread+0x1c1 sys/dev/usb/usb.c:750
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/usb/usb_subr.c:1810:23, member access within null pointer of type 'struct usb_config_descriptor_t'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1074 1075 2 1 0 ffffebae2550f100 syz-executor3074
1074 1251 2 1 40140 ffffebae25267940 syz-executor3074
1074 1074 2 0 10040000 ffffebae22fca680 syz-executor3074
1078 1078 3 0 180 ffffebae242e94c0 syz-executor3074 nanoslp
1069 1069 3 0 180 ffffebae22fca240 sshd select
1094 1094 3 0 180 ffffebae25267500 getty nanoslp
1111 1111 3 0 180 ffffebae252670c0 getty nanoslp
997 997 3 1 180 ffffebae1aa282c0 getty nanoslp
1099 1099 3 0 1c0 ffffebae22cc5a80 getty ttyraw
948 948 3 1 180 ffffebae242e9900 sshd select
1121 1121 3 0 180 ffffebae231f2b00 powerd kqueue
672 > 672 7 0 100 ffffebae234e6300 syslogd
595 595 3 0 180 ffffebae2333e700 dhcpcd poll
593 593 3 1 180 ffffebae2333e2c0 dhcpcd poll
592 592 3 0 180 ffffebae2320abc0 dhcpcd poll
580 580 3 1 180 ffffebae2320a340 dhcpcd poll
349 349 3 1 180 ffffebae234e6740 dhcpcd poll
348 348 3 0 180 ffffebae231f2280 dhcpcd poll
347 347 3 1 180 ffffebae231f26c0 dhcpcd poll
1 1 3 0 180 ffffebae1aa79940 init wait
0 850 3 0 200 ffffebae22c22a40 physiod physiod
0 192 3 0 200 ffffebae22cc5640 ioflush syncer
0 166 3 0 200 ffffebae1aa28700 pooldrain pooldrain
0 165 3 1 200 ffffebae22cc5200 pgdaemon pgdaemon
0 162 3 1 200 ffffebae22c221c0 usb7 usbevt
0 161 3 0 200 ffffebae1fbd5a00 usb6 usbevt
0 31 3 1 200 ffffebae1fbd55c0 usb5 usbevt
0 63 3 1 200 ffffebae1fbd5180 usb4 usbevt
0 126 3 1 200 ffffebae1cb709c0 usb3 usbevt
0 125 3 1 200 ffffebae1cb70580 usb2 usbevt
0 124 3 1 200 ffffebae1cb70140 usb1 usbevt
0 > 123 7 1 240 ffffebae1bb21980 usb0
0 122 3 1 200 ffffebae1bb21540 usbtask-dr usbtsk
0 121 3 1 200 ffffebae1bb21100 usbtask-hc usbtsk
0 120 3 0 200 ffffebae18ee4ac0 npfgc0 npfgcw
0 119 3 1 200 ffffebae1aa79500 rt_free rt_free
0 118 3 1 200 ffffebae1aa790c0 unpgc unpgc
0 117 3 0 200 ffffebae1aa7c900 key_timehandler key_timehandler
0 116 3 1 200 ffffebae1aa7c4c0 icmp6_wqinput/1 icmp6_wqinput
0 115 3 0 200 ffffebae1aa7c080 icmp6_wqinput/0 icmp6_wqinput
0 114 3 0 200 ffffebae1aa778c0 nd6_timer nd6_timer
0 113 3 1 200 ffffebae1aa77480 carp6_wqinput/1 carp6_wqinput
0 112 3 0 200 ffffebae1aa77040 carp6_wqinput/0 carp6_wqinput
0 111 3 1 200 ffffebae1aa4abc0 carp_wqinput/1 carp_wqinput
0 110 3 0 200 ffffebae1aa4a780 carp_wqinput/0 carp_wqinput
0 109 3 1 200 ffffebae1aa4a340 icmp_wqinput/1 icmp_wqinput
0 108 3 0 200 ffffebae1aa25b80 icmp_wqinput/0 icmp_wqinput
0 107 3 0 200 ffffebae1aa28b40 rt_timer rt_timer
0 106 3 1 200 ffffebae1aa25740 vmem_rehash vmem_rehash
0 105 3 1 200 ffffebae1aa25300 entbutler entropy
0 96 3 1 200 ffffebae1a37db00 viomb balloon
0 30 3 1 200 ffffebae1a37d6c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffffebae1a37d280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffffebae18ee4680 scsibus0 sccomp
0 26 3 1 200 ffffebae18ee4240 pms0 pmsreset
0 25 3 1 200 ffffebae18deca80 xcall/1 xcall
0 24 1 1 200 ffffebae18dec640 softser/1
0 23 1 1 200 ffffebae18dec200 softclk/1
0 22 1 1 200 ffffebae18dcfa40 softbio/1
0 21 1 1 200 ffffebae18dcf600 softnet/1
0 20 1 1 201 ffffebae18dcf1c0 idle/1
0 19 3 0 200 ffffebaf47d3ea00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffffebaf47d3e5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffffebaf47d3e180 lnxsyswq lnxsyswq
0 16 3 0 200 ffffebaf47d639c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffebaf47d63580 sysmon smtaskq
0 14 3 0 200 ffffebaf47d63140 pmfsuspend pmfsuspend
0 13 3 1 200 ffffebaf47d68980 pmfevent pmfevent
0 12 3 1 200 ffffebaf47d68540 sopendfree sopendfr
0 11 3 0 200 ffffebaf47d68100 iflnkst iflnkst
0 10 3 0 200 ffffebaf48d9b940 nfssilly nfssilly
0 9 3 0 200 ffffebaf48d9b500 vdrain vdrain
0 8 3 1 200 ffffebaf48d9b0c0 modunload mod_unld
0 7 3 0 200 ffffebaf48dc6900 xcall/0 xcall
0 6 1 0 200 ffffebaf48dc64c0 softser/0
0 5 1 0 200 ffffebaf48dc6080 softclk/0
0 4 1 0 200 ffffebaf48df38c0 softbio/0
0 3 1 0 200 ffffebaf48df3480 softnet/0
0 2 1 0 201 ffffebaf48df3040 idle/0

0 0 3 0 200 ffffffff85f57280 swapper uvm
[Locks tracked through LWPs]

****** LWP 672.672 (syslogd) @ 0xffffebae234e6300, l_stat=7

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffffebae251c8980 type : sleep/adaptive
initialized : 0xffffffff8365b8a0

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffebae234e6300 last held: 0xffffebae234e6300
last locked* : 0xffffffff836b92b0 unlocked : 0xffffffff836b9434
owner/count : 0xffffebae234e6300 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at uvm_obj_init)
lock address : 0xffffebaf492ca0c0 type : sleep/adaptive
initialized : 0xffffffff832929fe

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 1

relevant cpu : 0 last held: 0

relevant lwp : 0xffffebae234e6300 last held: 000000000000000000
last locked : 0xffffffff8324749c unlocked*: 0xffffffff8324d7e6
owner/count : 000000000000000000 flags : 000000000000000000

Turnstile: no active turnstile for this lock.

****** LWP 593.593 (dhcpcd) @ 0xffffebae2333e2c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8637ec80 type : sleep/adaptive
initialized : 0xffffffff8338cea7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffffebae2333e2c0 last held: 000000000000000000