UBSan: Undefined Behavior in umap_bypass

5 views

Skip to first unread message

syzbot

unread,

Nov 16, 2022, 2:52:35 PM11/16/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: e234b948ff02 More ipfilter fixes (Jose Luis Duran)
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16b18601880000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=ecda308a1dd9652836d0
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/96d47d90d567/disk-e234b948.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/4fec51155a0d/netbsd-e234b948.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ecda30...@syzkaller.appspotmail.com

[ 343.7182845] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/miscfs/umapfs/umap_vnops.c:225:17, member access within null pointer of type 'struct componentname'

[ 343.7382706] cpu1: Begin traceback...
[ 343.7582735] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 343.8282750] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 343.8882762] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 343.9282740] umap_bypass() at netbsd:umap_bypass+0x1a3b sys/miscfs/umapfs/umap_vnops.c:225
[ 343.9782764] VOP_WHITEOUT() at netbsd:VOP_WHITEOUT+0x209 sys/kern/vnode_if.c:1903
[ 344.0282729] union_mount() at netbsd:union_mount+0x4b5 sys/fs/union/union_vfsops.c:209
[ 344.0782752] VFS_MOUNT() at netbsd:VFS_MOUNT+0xae sys/kern/vfs_subr.c:1402
[ 344.1282746] mount_domount() at netbsd:mount_domount+0x1da sys/kern/vfs_mount.c:840
[ 344.1782739] do_sys_mount() at netbsd:do_sys_mount+0x288 sys/kern/vfs_syscalls.c:616
[ 344.2182726] compat_40_sys_mount() at netbsd:compat_40_sys_mount+0x5c sys/compat/common/vfs_syscalls_40.c:99
[ 344.2682734] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 344.2682734] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 344.3182720] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 344.3182720] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 344.3182720] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 344.3382726] --- syscall (number 21 via SYS_syscall) ---
[ 344.3482692] netbsd:syscall+0x2da:
[ 344.3582716] cpu1: End traceback...
[ 344.3582716] fatal breakpoint trap in supervisor mode
[ 344.3682685] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x7204d0400000 ilevel 0 rsp 0xffffd4024fe7c570
[ 344.3782685] curlwp 0xfffffce03b621980 pid 5559.4350 lowest kstack 0xffffd4024fe782c0
Stopped in pid 5559.4350 (syz-executor.3) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
umap_bypass() at netbsd:umap_bypass+0x1a3b sys/miscfs/umapfs/umap_vnops.c:225
VOP_WHITEOUT() at netbsd:VOP_WHITEOUT+0x209 sys/kern/vnode_if.c:1903
union_mount() at netbsd:union_mount+0x4b5 sys/fs/union/union_vfsops.c:209
VFS_MOUNT() at netbsd:VFS_MOUNT+0xae sys/kern/vfs_subr.c:1402
mount_domount() at netbsd:mount_domount+0x1da sys/kern/vfs_mount.c:840
do_sys_mount() at netbsd:do_sys_mount+0x288 sys/kern/vfs_syscalls.c:616
compat_40_sys_mount() at netbsd:compat_40_sys_mount+0x5c sys/compat/common/vfs_syscalls_40.c:99
sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 21 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/miscfs/umapfs/umap_vnops.c:225:17, member access within null pointer of type 'struct componentname'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
5559 4493 2 0 0 fffffce03c400480 syz-executor.3
5559 4483 2 0 0 fffffce0408fe5c0 syz-executor.3
5559 5429 2 0 0 fffffce047450200 syz-executor.3
5559 4324 2 0 0 fffffce04a14f500 syz-executor.3
5559 5165 2 0 0 fffffce03d380600 syz-executor.3
5559 4481 2 0 0 fffffce0492e2a40 syz-executor.3
5559 5375 2 0 0 fffffce049f2f900 syz-executor.3
5559 5211 2 0 0 fffffce041a02b00 syz-executor.3
5559 5305 2 0 0 fffffce047d44680 syz-executor.3
5559 5332 2 0 0 fffffce0492e2600 syz-executor.3
5559 >4350 7 1 0 fffffce03b621980 syz-executor.3
5559 4339 2 1 100 fffffce04b6399c0 syz-executor.3
5559 4491 2 1 100 fffffce049ade8c0 syz-executor.3
5559 5559 2 0 10000000 fffffce03bf99080 syz-executor.3
5169 5169 2 0 40140 fffffce0408fea00 syz-executor.3
4434 4337 3 0 40180 fffffce0443462c0 syz-executor.1 parked
4434 >4434 7 0 10040140 fffffce0414e56c0 syz-executor.1
4251 4251 2 1 140 fffffce047450a80 syz-executor.1
3882 3882 3 1 1c0 fffffce03ae53280 getty ttyraw
3577 3577 3 1 1c0 fffffce04b639580 syz-executor.5 pipe_rd
4190 4190 2 1 140 fffffce0414e5280 syz-executor.4
3776 3776 3 0 1c0 fffffce04b77e100 syz-executor.0 pipe_rd
495 495 3 0 180 fffffce049d8b780 syz-executor.1 parked
1771 494 3 0 1000000 fffffce04a14f0c0 syz-executor.1 lwpwait
1771 493 3 0 11a0000 fffffce03c4008c0 syz-executor.1 vfork
1771 1516 5 0 11a0100 fffffce049f2f080 syz-executor.1
1771 1771 5 1 111a0000 fffffce049ade480 syz-executor.1
709 709 3 0 180 fffffce049ade040 syz-executor.1 parked
322 324 3 0 1000000 fffffce049c7bb80 syz-executor.1 lwpwait
322 323 3 0 111a0000 fffffce049d8b340 syz-executor.1 vfork
322 322 5 0 111a0000 fffffce03b057740 syz-executor.1
1210 1210 3 0 180 fffffce03befb0c0 syz-executor.1 parked
331 1357 3 0 1000000 fffffce03befb940 syz-executor.1 lwpwait
331 332 3 0 111a0000 fffffce03b057b80 syz-executor.1 vfork
331 331 5 0 111a0000 fffffce03b057300 syz-executor.1
1233 2949 2 1 140 fffffce03c58c140 syz-fuzzer
1233 1203 3 0 180 fffffce03c58c580 syz-fuzzer wait
1233 1247 3 0 1c0 fffffce0420cfb40 syz-fuzzer parked
1233 1199 3 0 180 fffffce0420cf700 syz-fuzzer wait
1233 829 3 1 180 fffffce041a026c0 syz-fuzzer parked
1233 990 3 1 180 fffffce03b621540 syz-fuzzer parked
1233 1120 3 0 1c0 fffffce03d380a40 syz-fuzzer wait
1233 1241 3 1 1c0 fffffce03b0ed680 syz-fuzzer parked
1233 1080 3 1 180 fffffce03ae53b00 syz-fuzzer parked
1233 449 3 0 180 fffffce03b1d92c0 syz-fuzzer parked
1233 1225 3 0 1c0 fffffce039beca80 syz-fuzzer wait
1233 1226 3 0 1c0 fffffce03ae536c0 syz-fuzzer parked
1233 1231 2 1 140 fffffce03c94e640 syz-fuzzer
1233 1233 3 0 180 fffffce03b0ed240 syz-fuzzer wait
1230 1230 3 0 180 fffffce03c94ea80 sshd select
1184 1184 3 0 180 fffffce03cb27a00 getty nanoslp
1195 1195 3 0 180 fffffce03d3801c0 getty nanoslp
1222 1222 3 0 180 fffffce03c94e200 getty nanoslp
1109 1109 3 1 180 fffffce03c58c9c0 sshd select
1088 1088 3 1 180 fffffce03cb275c0 powerd kqueue
702 702 3 1 180 fffffce03b621100 syslogd kqueue
745 745 3 1 180 fffffce03b8b8340 dhcpcd poll
742 742 3 1 180 fffffce03b8b8780 dhcpcd poll
466 466 3 1 180 fffffce03bf99900 dhcpcd poll
598 598 3 1 180 fffffce03c400040 dhcpcd poll
292 292 3 1 180 fffffce03b1d9700 dhcpcd poll
485 485 3 1 180 fffffce0328e0740 dhcpcd poll
291 291 3 1 180 fffffce03b8b8bc0 dhcpcd poll
1 1 3 1 180 fffffce032a53980 init wait
0 4338 3 0 200 fffffce03cb27180 ktrace ktrwait
0 5084 5 0 200 fffffce047d44240 (zombie)
0 2629 3 0 200 fffffce049d8bbc0 ktrace ktrwait
0 2300 3 0 200 fffffce03b1d9b40 acctwatch actwat
0 2336 3 1 200 fffffce041a02280 ktrace ktrwait
0 1321 3 1 200 fffffce04a14f940 ktrace ktrwait
0 968 3 0 200 fffffce03ac77240 physiod physiod
0 196 3 0 200 fffffce03ac77ac0 ioflush syncer
0 195 3 0 200 fffffce0328e0b80 pooldrain pooldrain
0 194 3 1 200 fffffce03ac77680 pgdaemon pgdaemon
0 170 3 0 200 fffffce039bec640 usb7 usbevt
0 169 3 0 200 fffffce039bec200 usb6 usbevt
0 168 3 1 200 fffffce036b67a40 usb5 usbevt
0 167 3 1 200 fffffce036b67600 usb4 usbevt
0 166 3 0 200 fffffce036b671c0 usb3 usbevt
0 165 3 1 200 fffffce033afaa00 usb2 usbevt
0 31 3 1 200 fffffce033afa5c0 usb1 usbevt
0 63 3 1 200 fffffce033afa180 usb0 usbevt
0 126 3 1 200 fffffce032ace9c0 usbtask-dr usbtsk
0 125 3 0 200 fffffce032ace580 usbtask-hc usbtsk
0 124 3 1 200 fffffce032ace140 swwreboot swwreboot
0 123 3 0 200 fffffce030ea1b00 npfgc0 npfgcw
0 122 3 1 200 fffffce032a53540 rt_free rt_free
0 121 3 1 200 fffffce032a53100 unpgc unpgc
0 120 3 0 200 fffffce032a46940 key_timehandler key_timehandler
0 119 3 1 200 fffffce032a46500 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 fffffce032a460c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 fffffce032a39900 nd6_timer nd6_timer
0 116 3 1 200 fffffce032a394c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 fffffce032a39080 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 fffffce032a148c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 fffffce032a14480 carp_wqinput/0 carp_wqinput
0 112 3 1 200 fffffce032a14040 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 fffffce0329d7bc0 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 fffffce0329d7340 rt_timer rt_timer
0 109 3 0 200 fffffce0329d7780 vmem_rehash vmem_rehash
0 100 3 0 200 fffffce0328e0300 entbutler entropy
0 99 3 1 200 fffffce032350b40 viomb balloon
0 98 3 1 200 fffffce032350700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 fffffce0323502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 fffffce030ea16c0 scsibus0 sccomp
0 29 3 1 200 fffffce030ea1280 pms0 pmsreset
0 28 3 1 200 fffffce030db4ac0 xcall/1 xcall
0 27 1 1 200 fffffce030db4680 softser/1
0 26 1 1 200 fffffce030db4240 softclk/1
0 25 1 1 200 fffffce030d87a80 softbio/1
0 24 1 1 200 fffffce030d87640 softnet/1
0 23 1 1 201 fffffce030d87200 idle/1
0 22 3 1 200 fffffce15f12da40 lnxsyswq lnxsyswq
0 21 3 1 200 fffffce15f12d600 lnxubdwq lnxubdwq
0 20 3 0 200 fffffce15f12d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 fffffce15f134a00 lnxlngwq lnxlngwq
0 18 3 1 200 fffffce15f1345c0 lnxhipwq lnxhipwq
0 17 3 1 200 fffffce15f134180 lnxrcugc lnxrcugc
0 16 3 0 200 fffffce15f1539c0 sysmon smtaskq
0 15 3 1 200 fffffce15f153580 pmfsuspend pmfsuspend
0 14 3 0 200 fffffce15f153140 pmfevent pmfevent
0 13 3 1 200 fffffce15f15e980 sopendfree sopendfr
0 12 3 0 200 fffffce15f15e540 ifwdog ifwdog
0 11 3 0 200 fffffce15f15e100 iflnkst iflnkst
0 10 3 1 200 fffffce160193940 nfssilly nfssilly
0 9 3 0 200 fffffce160193500 vdrain vdrain
0 8 3 1 200 fffffce1601930c0 modunload mod_unld
0 7 3 0 200 fffffce1601bc900 xcall/0 xcall
0 6 1 0 200 fffffce1601bc4c0 softser/0
0 > 5 7 0 200 fffffce1601bc080 softclk/0
0 4 1 0 200 fffffce1601e98c0 softbio/0
0 3 1 0 200 fffffce1601e9480 softnet/0
0 2 1 0 201 fffffce1601e9040 idle/0
0 0 3 0 200 ffffffff8673eec0 swapper uvm
[Locks tracked through LWPs]

****** LWP 5559.4350 (syz-executor.3) @ 0xfffffce03b621980, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:vcache_alloc+0xba sys/kern/vfs_vnode.c:1391)
lock address : fffffce04a800500
type : sleep/adaptive
initialized : netbsd:vcache_alloc+0xba
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffffce03b621980 last held: 0xfffffce03b621980
last locked* : netbsd:genfs_lock+0x220
unlocked : netbsd:genfs_unlock+0x50
owner/count : 0xfffffce03b621980 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 5559.5559 (syz-executor.3) @ 0xfffffce03bf99080, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)
lock address : fffffce0497df080
type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffce03bf99080 last held: 0xfffffce03bf99080
last locked* : netbsd:uvm_fault_internal+0x75d
unlocked : netbsd:uvm_fault_lower_enter+0x86d
owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 742.742 (dhcpcd) @ 0xfffffce03b8b8780, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffce03b8b8780 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 466.466 (dhcpcd) @ 0xfffffce03bf99900, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffce03bf99900 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xfffffce0328e0740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffce0328e0740 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xfffffce03b8b8bc0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffce03b8b8bc0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xfffffce15f15e100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffce15f15e100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xfffffce1601bc080, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffce1601bc080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff8673eec0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff8673eec0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu1:

* Lock 0 (initialized at netbsd:main+0x106 sys/kern/init_main.c:303)
lock address : netbsd:kernel_lock
type : spin
initialized : netbsd:main+0x106
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffffce03b621980 last held: 0xfffffce03b621980
last locked* : netbsd:VOP_WHITEOUT+0x174
unlocked : netbsd:VOP_LOCK+0x303
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at netbsd:kprintf_init+0x72 sys/kern/subr_prf.c:155)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x72
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffffce03b621980 last held: 0xfffffce03b621980
last locked* : netbsd:kprintf_lock+0x50
unlocked : netbsd:kprintf_unlock+0x70
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffffd40000007180 0045 00000000 0x0 0x0
0xffffd40000007200 0045 00000000 0x0 0x0
0xffffd40000007280 0045 00000000 0x0 0x0
0xffffd40000007300 0045 00000000 0x0 0x0
0xffffd40000007380 0045 00000000 0x0 0x0
0xffffd40000007400 0045 00000000 0x0 0x0
0xffffd40000007480 0045 00000000 0x0 0x0
0xffffd40000007500 0045 00000000 0x0 0x0
0xffffd40000007580 0045 00000000 0x0 0x0
0xffffd40000007600 0045 00000000 0x0 0x0
0xffffd40000007680 0045 00000000 0x0 0x0
0xffffd40000007700 0041 00000000 0x0 0x0
0xffffd40000007780 0041 00000000 0x0 0x0
0xffffd40000007800 0041 00000000 0x0 0x0
0xffffd40000007880 0041 00000000 0x0 0x0
0xffffd40000007900 0045 00000000 0x0 0x0
0xffffd40000007980 0041 00000000 0x0 0x0
0xffffd40000007a00 0041 00000000 0x0 0x0
0xffffd40000007a80 0041 00000000 0x0 0x0
0xffffd40000007b00 0041 00000000 0x0 0x0
0xffffd40000007b80 0041 00000000 0x0 0x0
0xffffd40000007c00 0041 00000000 0x0 0x0
0xffffd40000007c80 0041 00000000 0x0 0x0
0xffffd40000007d00 0041 00000000 0x0 0x0
0xffffd40000007d80 0041 00000000 0x0 0x0
0xffffd40000007e00 0041 00000000 0x0 0x0
0xffffd40000007e80 0041 00000000 0x0 0x0
0xffffd40000007f00 0041 00000000 0x0 0x0
0xffffd40000007f80 0041 00000000 0x0 0x0
0xffffd40000008000 0041 00000000 0x0 0x0
0xffffd40000008080 0041 00000000 0x0 0x0
0xffffd40000008100 0041 00000000 0x0 0x0
0xffffd40000008180 0041 00000000 0x0 0x0
0xffffd40000008200 0041 00000000 0x0 0x0
0xffffd40000008280 0041 00000000 0x0 0x0
0xffffd40000008300 0041 00000000 0x0 0x0
0xffffd40000008380 0041 00000000 0x0 0x0
0xffffd40000008400 0041 00000000 0x0 0x0
0xffffd40000008480 0041 00000000 0x0 0x0
0xffffd40000008500 0041 00000000 0x0 0x0
0xffffd40000008580 0041 00000000 0x0 0x0
0xffffd40000008600 0045 00000000 0x0 0x0
0xffffd40000008680 0041 00000000 0x0 0x0
0xffffd40000008700 0041 00000000 0x0 0x0
0xffffd40000008780 0041 00000000 0x0 0x0
0xffffd40000008800 0045 00000000 0x0 0x0
0xffffd40000008880 0041 00000000 0x0 0x0
0xffffd40000008900 0041 00000000 0x0 0x0
0xffffd40000008980 0041 00000000 0x0 0x0
0xffffd40000008a00 0041 00000000 0x0 0x0
0xffffd40000008a80 0041 00000000 0x0 0x0
0xffffd40000008b00 0041 00000000 0x0 0x0
0xffffd40000008b80 0041 00000000 0x0 0x0
0xffffd40000008c00 0041 00000000 0x0 0x0
0xffffd40000008c80 0041 00000000 0x0 0x0
0xffffd40000008d00 0041 00000000 0x0 0x0
0xffffd40000008d80 0041 00000000 0x0 0x0
0xffffd40000008e00 0041 00000000 0x0 0x0
0xffffd40000008e80 0041 00000000 0x0 0x0
0xffffd40000008f00 0041 00000000 0x0 0x0
0xffffd40000008f80 0041 00000000 0x0 0x0
0xffffd40000009000 0041 00000000 0x0 0x0
0xffffd40000009080 0045 00000000 0x0 0x0
0xffffd40000009100 0041 00000000 0x0 0x0
0xffffd40000009180 0041 00000000 0x0 0x0
0xffffd40000009200 0041 00000000 0x0 0x0
0xffffd40000009280 0041 00000000 0x0 0x0
0xffffd40000009300 0041 00000000 0x0 0x0
0xffffd40000009380 0041 00000000 0x0 0x0
0xffffd40000009400 0041 00000000 0x0 0x0
0xffffd40000009480 0041 00000000 0x0 0x0
0xffffd40000009500 0041 00000000 0x0 0x0
0xffffd40000009580 0041 00000000 0x0 0x0
0xffffd40000009600 0041 00000000 0x0 0x0
0xffffd40000009680 0041 00000000 0x0 0x0
0xffffd40000009700 0041 00000000 0x0 0x0
0xffffd40000009780 0041 00000000 0x0 0x0
0xffffd40000009800 0041 00000000 0x0 0x0
0xffffd40000009880 0041 00000000 0x0 0x0
0xffffd40000009900 0041 00000000 0x0 0x0
0xffffd40000009980 0041 00000000 0x0 0x0
0xffffd40000009a00 0041 00000000 0x0 0x0
0xffffd40000009a80 0041 00000000 0x0 0x0
0xffffd40000009b00 0041 00000000 0x0 0x0
0xffffd40000009b80 0041 00000000 0x0 0x0
0xffffd40000009c00 0041 00000000 0x0 0x0
0xffffd40000009c80 0041 00000000 0x0 0x0
0xffffd40000009d00 0041 00000000 0x0 0x0
0xffffd40000009d80 0041 00000000 0x0 0x0
0xffffd40000009e00 0041 00000000 0x0 0x0
0xffffd40000009e80 0045 00000000 0x0 0x0
0xffffd40000009f00 0041 00000000 0x0 0x0
0xffffd40000009f80 0041 00000000 0x0 0x0
0xffffd4000000a000 0041 00000000 0x0 0x0
0xffffd4000000a080 0041 00000000 0x0 0x0
0xffffd4000000a100 0041 00000000 0x0 0x0
0xffffd4000000a180 0041 00000000 0x0 0x0
0xffffd4000000a200 0041 00000000 0x0 0x0
0xffffd4000000a280 0041 00000000 0x0 0x0
0xffffd4000000a300 0041 00000000 0x0 0x0
0xffffd4000000a380 0041 00000000 0x0 0x0
0xffffd4000000a400 0041 00000000 0x0 0x0
0xffffd4000000a480 0041 00000000 0x0 0x0
0xffffd4000000a500 0041 00000000 0x0 0x0
0xffffd4000000a580 0041 00000000 0x0 0x0
0xffffd4000000a600 0041 00000000 0x0 0x0
0xffffd4000000a680 0041 00000000 0x0 0x0
0xffffd4000000a700 0041 00000000 0x0 0x0
0xffffd4000000a780 0041 00000000 0x0 0x0
0xffffd4000000a800 0041 00000000 0x0 0x0
0xffffd4000000a880 0041 00000000 0x0 0x0
0xffffd4000000a900 0041 00000000 0x0 0x0
0xffffd4000000a980 0041 00000000 0x0 0x0
0xffffd4000000aa00 0041 00000000 0x0 0x0
0xffffd4000000aa80 0041 00000000 0x0 0x0
0xffffd4000000ab00 0041 00000000 0x0 0x0
0xffffd4000000ab80 0041 00000000 0x0 0x0
0xffffd4000000ac00 0041 00000000 0x0 0x0
0xffffd4000000ac80 0041 00000000 0x0 0x0
0xffffd4000000ad00 0041 00000000 0x0 0x0
0xffffd4000000ad80 0041 00000000 0x0 0x0
0xffffd4000000ae00 0041 00000000 0x0 0x0
0xffffd4000000ae80 0041 00000000 0x0 0x0
0xffffd4000000af00 0045 00000000 0x0 0x0
0xffffd4000000af80 0045 00000000 0x0 0x0
0xffffd4000000b000 0041 00000000 0x0 0x0
0xffffd4000000b080 0041 00000000 0x0 0x0
0xffffd4000000b100 0041 00000000 0x0 0x0
0xffffd4000000b180 0045 00000000 0x0 0x0
0xffffd4000000b200 0041 00000000 0x0 0x0
0xffffd4000000b280 0045 00000000 0x0 0x0
0xffffd4000000b300 0045 00000000 0x0 0x0
0xffffd4000000b380 0045 00000000 0x0 0x0
0xffffd4000000b400 0041 00000000 0x0 0x0
0xffffd4000000b480 0041 00000000 0x0 0x0
0xffffd4000000b500 0045 00000000 0x0 0x0
0xffffd4000000b580 0045 00000000 0x0 0x0
0xffffd4000000b600 0045 00000000 0x0 0x0
0xffffd4000000b680 0045 00000000 0x0 0x0
0xffffd4000000b700 0045 00000000 0x0 0x0
0xffffd4000000b780 0045 00000000 0x0 0x0
0xffffd4000000b800 0045 00000000 0x0 0x0
0xffffd4000000b880 0041 00000000 0x0 0x0
0xffffd4000000b900 0045 00000000 0x0 0x0
0xffffd4000000b980 0045 00000000 0x0 0x0
0xffffd4000000ba00 0045 00000000 0x0 0x0
0xffffd4000000ba80 0045 00000000 0x0 0x0
0xffffd4000000bb00 0045 00000000 0x0 0x0
0xffffd4000000bb80 0045 00000000 0x0 0x0
0xffffd4000000bc00 0045 00000000 0x0 0x0
0xffffd4000000bc80 0041 00000000 0x0 0x0
0xffffd4000000bd00 0045 00000000 0x0 0x0
0xffffd4000000bd80 0045 00000000 0x0 0x0
0xffffd4000000be00 0045 00000000 0x0 0x0
0xffffd4000000be80 0045 00000000 0x0 0x0
0xffffd4000000bf00 0045 00000000 0x0 0x0
0xffffd4000000bf80 0045 00000000 0x0 0x0
0xffffd4000000c000 0045 00000000 0x0 0x0
0xffffd4000000c080 0045 00000000 0x0 0x0
0xffffd4000000c100 0045 00000000 0x0 0x0
0xffffd4000000c180 0045 00000000 0x0 0x0
0xffffd4000000c200 0045 00000000 0x0 0x0
0xffffd4000000c280 0045 00000000 0x0 0x0
0xffffd4000000c300 0045 00000000 0x0 0x0
0xffffd4000000c380 0045 00000000 0x0 0x0
0xffffd4000000c400 0045 00000000 0x0 0x0
0xffffd4000000c480 0045 00000000 0x0 0x0
0xffffd4000000c500 0045 00000000 0x0 0x0
0xffffd4000000c580 0045 00000000 0x0 0x0
0xffffd4000000c600 0045 00000000 0x0 0x0
0xffffd4000000c680 0045 00000000 0x0 0x0
0xffffd4000000c700 0041 00000000 0x0 0x0
0xffffd4000000c780 0041 00000000 0x0 0x0
0xffffd4000000c800 0045 00000000 0x0 0x0
0xffffd4000000c880 0045 00000000 0x0 0x0
0xffffd4000000c900 0045 00000000 0x0 0x0
0xffffd4000000c980 0045 00000000 0x0 0x0
0xffffd4000000ca00 0045 00000000 0x0 0x0
0xffffd4000000ca80 0045 00000000 0x0 0x0
0xffffd4000000cb00 0041 00000000 0x0 0x0
0xffffd4000000cb80 0041 00000000 0x0 0x0
0xffffd4000000cc00 0045 00000000 0x0 0x0
0xffffd4000000cc80 0045 00000000 0x0 0x0
0xffffd4000000cd00 0045 00000000 0x0 0x0
0xffffd4000000cd80 0041 00000000 0x0 0x0
0xffffd4000000ce00 0045 00000000 0x0 0x0
0xffffd4000000ce80 0041 00000000 0x0 0x0
0xffffd4000000cf00 0041 00000000 0x0 0x0
0xffffd4000000cf80 0041 00000000 0x0 0x0
0xffffd4000000d000 0041 00000000 0x0 0x0
0xffffd4000000d080 0045 00000000 0x0 0x0
0xffffd4000000d100 0041 00000000 0x0 0x0
0xffffd4000000d180 0041 00000000 0x0 0x0
0xffffd4000000d200 0041 00000000 0x0 0x0
0xffffd4000000d280 0041 00000000 0x0 0x0
0xffffd4000000d300 0045 00000000 0x0 0x0
0xffffd4000000d380 0041 00000000 0x0 0x0
0xffffd4000000d400 0041 00000000 0x0 0x0
0xffffd4000000d480 0045 00000000 0x0 0x0
0xffffd4000000d500 0041 00000000 0x0 0x0
0xffffd4000000d580 0041 00000000 0x0 0x0
0xffffd4000000d600 0041 00000000 0x0 0x0
0xffffd4000000d680 0041 00000000 0x0 0x0
0xffffd4000000d700 0041 00000000 0x0 0x0
0xffffd4000000d780 0045 00000000 0x0 0x0
0xffffd4000000d800 0041 00000000 0x0 0x0
0xffffd4000000d880 0041 00000000 0x0 0x0
0xffffd4000000d900 0041 00000000 0x0 0x0
0xffffd4000000d980 0041 00000000 0x0 0x0
0xffffd4000000da00 0041 00000000 0x0 0x0
0xffffd4000000da80 0045 00000000 0x0 0x0
0xffffd4000000db00 0045 00000000 0x0 0x0
0xffffd4000000db80 0045 00000000 0x0 0x0
0xffffd4000000dc00 0041 00000000 0x0 0x0
0xffffd4000000dc80 0041 00000000 0x0 0x0
0xffffd4000000dd00 0041 00000000 0x0 0x0
0xffffd4000000dd80 0041 00000000 0x0 0x0
0xffffd4000000de00 0041 00000000 0x0 0x0
0xffffd4000000de80 0041 00000000 0x0 0x0
0xffffd4000000df00 0045 00000000 0x0 0x0
0xffffd4000000df80 0045 00000000 0x0 0x0
0xffffd4000000e000 0045 00000000 0x0 0x0
0xffffd4000000e080 0041 00000000 0x0 0x0
0xffffd4000000e100 0041 00000000 0x0 0x0
0xffffd4000000e180 0045 00000000 0x0 0x0
0xffffd4000000e200 0041 00000000 0x0 0x0
0xffffd4000000e280 0041 00000000 0x0 0x0
0xffffd4000000e300 0045 00000000 0x0 0x0
0xffffd4000000e380 0041 00000000 0x0 0x0
0xffffd4000000e400 0045 00000000 0x0 0x0
0xffffd4000000e480 0041 00000000 0x0 0x0
0xffffd4000000e500 0045 00000000 0x0 0x0
0xffffd4000000e580 0041 00000000 0x0 0x0
0xffffd4000000e600 0045 00000000 0x0 0x0
0xffffd4000000e680 0045 00000000 0x0 0x0
0xffffd4000000e700 0041 00000000 0x0 0x0
0xffffd4000000e780 0041 00000000 0x0 0x0
0xffffd4000000e800 0045 00000000 0x0 0x0
0xffffd4000000e880 0045 00000000 0x0 0x0
0xffffd4000000e900 0041 00000000 0x0 0x0
0xffffd4000000e980 0041 00000000 0x0 0x0
0xffffd4000000ea00 0041 00000000 0x0 0x0
0xffffd4000000ea80 0041 00000000 0x0 0x0
0xffffd4000000eb00 0041 00000000 0x0 0x0
0xffffd4000000eb80 0045 00000000 0x0 0x0
0xffffd4000000ec00 0041 00000000 0x0 0x0
0xffffd4000000ec80 0041 00000000 0x0 0x0
0xffffd4000000ed00 0041 00000000 0x0 0x0
0xffffd4000000ed80 0041 00000000 0x0 0x0
0xffffd4000000ee00 0041 00000000 0x0 0x0
0xffffd4000000ee80 0045 00000000 0x0 0x0
0xffffd4000000ef00 0041 00000000 0x0 0x0
0xffffd4000000ef80 0041 00000000 0x0 0x0
0xffffd4000000f000 0041 00000000 0x0 0x0
0xffffd4000000f080 0045 00000000 0x0 0x0
0xffffd4000000f100 0041 00000000 0x0 0x0
0xffffd4000000f180 0041 00000000 0x0 0x0
0xffffd4000000f200 0041 00000000 0x0 0x0
0xffffd4000000f280 0041 00000000 0x0 0x0
0xffffd4000000f300 0041 00000000 0x0 0x0
0xffffd4000000f380 0041 00000000 0x0 0x0
0xffffd4000000f400 0045 00000000 0x0 0x0
0xffffd4000000f480 0041 00000000 0x0 0x0
0xffffd4000000f500 0041 00000000 0x0 0x0
0xffffd4000000f580 0041 00000000 0x0 0x0
0xffffd4000000f600 0041 00000000 0x0 0x0
0xffffd4000000f680 0045 00000000 0x0 0x0
0xffffd4000000f700 0041 00000000 0x0 0x0
0xffffd4000000f780 0041 00000000 0x0 0x0
0xffffd4000000f800 0041 00000000 0x0 0x0
0xffffd4000000f880 0045 00000000 0x0 0x0
0xffffd4000000f900 0041 00000000 0x0 0x0
0xffffd4000000f980 0045 00000000 0x0 0x0
0xffffd4000000fa00 0041 00000000 0x0 0x0
0xffffd4000000fa80 0041 00000000 0x0 0x0
0xffffd4000000fb00 0041 00000000 0x0 0x0
0xffffd4000000fb80 0041 00000000 0x0 0x0
0xffffd4000000fc00 0045 00000000 0x0 0x0
0xffffd4000000fc80 0041 00000000 0x0 0x0
0xffffd4000000fd00 0045 00000000 0x0 0x0
0xffffd4000000fd80 0041 00000000 0x0 0x0
0xffffd4000000fe00 0041 00000000 0x0 0x0
0xffffd4000000fe80 0041 00000000 0x0 0x0
0xffffd4000000ff00 0041 00000000 0x0 0x0
0xffffd4000000ff80 0041 00000000 0x0 0x0
0xffffd40000010000 0041 00000000 0x0 0x0
0xffffd40000010080 0041 00000000 0x0 0x0
0xffffd40000010100 0041 00000000 0x0 0x0
0xffffd40000010180 0045 00000000 0x0 0x0
0xffffd40000010200 0045 00000000 0x0 0x0
0xffffd40000010280 0041 00000000 0x0 0x0
0xffffd40000010300 0041 00000000 0x0 0x0
0xffffd40000010380 0041 00000000 0x0 0x0
0xffffd40000010400 0041 00000000 0x0 0x0
0xffffd40000010480 0045 00000000 0x0 0x0
0xffffd40000010500 0045 00000000 0x0 0x0
0xffffd40000010580 0041 00000000 0x0 0x0
0xffffd40000010600 0041 00000000 0x0 0x0
0xffffd40000010680 0041 00000000 0x0 0x0
0xffffd40000010700 0041 00000000 0x0 0x0
0xffffd40000010780 0041 00000000 0x0 0x0
0xffffd40000010800 0041 00000000 0x0 0x0
0xffffd40000010880 0041 00000000 0x0 0x0
0xffffd40000010900 0041 00000000 0x0 0x0
0xffffd40000010980 0045 00000000 0x0 0x0
0xffffd40000010a00 0045 00000000 0x0 0x0
0xffffd40000010a80 0045 00000000 0x0 0x0
0xffffd40000010b00 0041 00000000 0x0 0x0
0xffffd40000010b80 0041 00000000 0x0 0x0
0xffffd40000010c00 0041 00000000 0x0 0x0
0xffffd40000010c80 0045 00000000 0x0 0x0
0xffffd40000010d00 0041 00000000 0x0 0x0
0xffffd40000010d80 0041 00000000 0x0 0x0
0xffffd40000010e00 0041 00000000 0x0 0x0
0xffffd40000010e80 0041 00000000 0x0 0x0
0xffffd40000010f00 0041 00000000 0x0 0x0
0xffffd40000010f80 0041 00000000 0x0 0x0
0xffffd40000011000 0041 00000000 0x0 0x0
0xffffd40000011080 0041 00000000 0x0 0x0
0xffffd40000011100 0041 00000000 0x0 0x0
0xffffd40000011180 0041 00000000 0x0 0x0
0xffffd40000011200 0045 00000000 0x0 0x0
0xffffd40000011280 0045 00000000 0x0 0x0
0xffffd40000011300 0041 00000000 0x0 0x0
0xffffd40000011380 0041 00000000 0x0 0x0
0xffffd40000011400 0041 00000000 0x0 0x0
0xffffd40000011480 0041 00000000 0x0 0x0
0xffffd40000011500 0045 00000000 0x0 0x0
0xffffd40000011580 0041 00000000 0x0 0x0
0xffffd40000011600 0041 00000000 0x0 0x0
0xffffd40000011680 0041 00000000 0x0 0x0
0xffffd40000011700 0045 00000000 0x0 0x0
0xffffd40000011780 0045 00000000 0x0 0x0
0xffffd40000011800 0041 00000000 0x0 0x0
0xffffd40000011880 0041 00000000 0x0 0x0
0xffffd40000011900 0041 00000000 0x0 0x0
0xffffd40000011980 0041 00000000 0x0 0x0
0xffffd40000011a00 0041 00000000 0x0 0x0
0xffffd40000011a80 0041 00000000 0x0 0x0
0xffffd40000011b00 0041 00000000 0x0 0x0
0xffffd40000011b80 0041 00000000 0x0 0x0
0xffffd40000011c00 0041 00000000 0x0 0x0
0xffffd40000011c80 0041 00000000 0x0 0x0
0xffffd40000011d00 0041 00000000 0x0 0x0
0xffffd40000011d80 0041 00000000 0x0 0x0
0xffffd40000011e00 0045 00000000 0x0 0x0
0xffffd40000011e80 0041 00000000 0x0 0x0
0xffffd40000011f00 0041 00000000 0x0 0x0
0xffffd40000011f80 0041 00000000 0x0 0x0
0xffffd40000012000 0041 00000000 0x0 0x0
0xffffd40000012080 0041 00000000 0x0 0x0
0xffffd40000012100 0045 00000000 0x0 0x0
0xffffd40000012180 0045 00000000 0x0 0x0
0xffffd40000012200 0041 00000000 0x0 0x0
0xffffd40000012280 0041 00000000 0x0 0x0
0xffffd40000012300 0041 00000000 0x0 0x0
0xffffd40000012380 0041 00000000 0x0 0x0
0xffffd40000012400 0041 00000000 0x0 0x0
0xffffd40000012480 0041 00000000 0x0 0x0
0xffffd40000012500 0041 00000000 0x0 0x0
0xffffd40000012580 0041 00000000 0x0 0x0
0xffffd40000012600 0041 00000000 0x0 0x0
0xffffd40000012680 0045 00000000 0x0 0x0
0xffffd40000012700 0041 00000000 0x0 0x0
0xffffd40000012780 0041 00000000 0x0 0x0
0xffffd40000012800 0041 00000000 0x0 0x0
0xffffd40000012880 0045 00000000 0x0 0x0
0xffffd40000012900 0001 00000000 0x0 0x0
0xffffd40000012980 0001 00000000 0x0 0x0
0xffffd40000012a00 0001 00000000 0x0 0x0
0xffffd40000012a80 0001 00000000 0x0 0x0
0xffffd40000012b00 0001 00000000 0x0 0x0
0xffffd40000012b80 0001 00000000 0x0 0x0
0xffffd40000012c00 0001 00000000 0x0 0x0
0xffffd40000012c80 0001 00000000 0x0 0x0
0xffffd40000012d00 0001 00000000 0x0 0x0
0xffffd40000012d80 0001 00000000 0x0 0x0
0xffffd40000012e00 0001 00000000 0x0 0x0
0xffffd40000012e80 0001 00000000 0x0 0x0
0xffffd40000012f00 0001 00000000 0x0 0x0
0xffffd40000012f80 0001 00000000 0x0 0x0
0xffffd40000013000 0001 00000000 0x0 0x0
0xffffd40000013080 0001 00000000 0x0 0x0
0xffffd40000013100 0001 00000000 0x0 0x0
0xffffd40000013180 0001 00000000 0x0 0x0
0xffffd40000013200 0001 00000000 0x0 0x0
0xffffd40000013280 0001 00000000 0x0 0x0
0xffffd40000013300 0001 00000000 0x0 0x0
0xffffd40000013380 0001 00000000 0x0 0x0
0xffffd40000013400 0001 00000000 0x0 0x0
0xffffd40000013480 0001 00000000 0x0 0x0
0xffffd40000013500 0001 00000000 0x0 0x0
0xffffd40000013580 0001 00000000 0x0 0x0
0xffffd40000013600 0001 00000000 0x0 0x0
0xffffd40000013680 0001 00000000 0x0 0x0
0xffffd40000013700 0001 00000000 0x0 0x0
0xffffd40000013780 0001 00000000 0x0 0x0
0xffffd40000013800 0001 00000000 0x0 0x0
0xffffd40000013880 0001 00000000 0x0 0x0
0xffffd40000013900 0001 00000000 0x0 0x0
0xffffd40000013980 0001 00000000 0x0 0x0
0xffffd40000013a00 0001 00000000 0x0 0x0
0xffffd40000013a80 0001 00000000 0x0 0x0
0xffffd40000013b00 0001 00000000 0x0 0x0
0xffffd40000013b80 0001 00000000 0x0 0x0
0xffffd40000013c00 0001 00000000 0x0 0x0
0xffffd40000013c80 0001 00000000 0x0 0x0
0xffffd40000013d00 0001 00000000 0x0 0x0
0xffffd40000013d80 0001 00000000 0x0 0x0
0xffffd40000013e00 0001 00000000 0x0 0x0
0xffffd40000013e80 0001 00000000 0x0 0x0
0xffffd40000013f00 0001 00000000 0x0 0x0
0xffffd40000013f80 0001 00000000 0x0 0x0
0xffffd40000014000 0001 00000000 0x0 0x0
0xffffd40000014080 0001 00000000 0x0 0x0
0xffffd40000014100 0001 00000000 0x0 0x0
0xffffd40000014180 0001 00000000 0x0 0x0
0xffffd40000014200 0001 00000000 0x0 0x0
0xffffd40000014280 0001 00000000 0x0 0x0
0xffffd40000014300 0001 00000000 0x0 0x0
0xffffd40000014380 0001 00000000 0x0 0x0
0xffffd40000014400 0041 00000000 0x0 0x0
0xffffd40000014480 0041 00000000 0x0 0x0
0xffffd40000014500 0041 00000000 0x0 0x0
0xffffd40000014580 0041 00000000 0x0 0x0
0xffffd40000014600 0041 00000000 0x0 0x0
0xffffd40000014680 0041 00000000 0x0 0x0
0xffffd40000014700 0041 00000000 0x0 0x0
0xffffd40000014780 0041 00000000 0x0 0x0
0xffffd40000014800 0041 00000000 0x0 0x0
0xffffd40000014880 0041 00000000 0x0 0x0
0xffffd40000014900 0041 00000000 0x0 0x0
0xffffd40000014980 0041 00000000 0x0 0x0
0xffffd40000014a00 0041 00000000 0x0 0x0
0xffffd40000014a80 0041 00000000 0x0 0x0
0xffffd40000014b00 0041 00000000 0x0 0x0
0xffffd40000014b80 0041 00000000 0x0 0x0
0xffffd40000014c00 0041 00000000 0x0 0x0
0xffffd40000014c80 0041 00000000 0x0 0x0
0xffffd40000014d00 0041 00000000 0x0 0x0
0xffffd40000014d80 0041 00000000 0x0 0x0
0xffffd40000014e00 0041 00000000 0x0 0x0
0xffffd40000014e80 0041 00000000 0x0 0x0
0xffffd40000014f00 0041 00000000 0x0 0x0
0xffffd40000014f80 0041 00000000 0x0 0x0
0xffffd40000015000 0041 00000000 0x0 0x0
0xffffd40000015080 0041 00000000 0x0 0x0
0xffffd40000015100 0041 00000000 0x0 0x0
0xffffd40000015180 0041 00000000 0x0 0x0
0xffffd40000015200 0041 00000000 0x0 0x0
0xffffd40000015280 0041 00000000 0x0 0x0
0xffffd40000015300 0041 00000000 0x0 0x0
0xffffd40000015380 0041 00000000 0x0 0x0
0xffffd40000015400 0041 00000000 0x0 0x0
0xffffd40000015480 0041 00000000 0x0 0x0
0xffffd40000015500 0041 00000000 0x0 0x0
0xffffd40000015580 0041 00000000 0x0 0x0
0xffffd40000015600 0041 00000000 0x0 0x0
0xffffd40000015680 0041 00000000 0x0 0x0
0xffffd40000015700 0041 00000000 0x0 0x0
0xffffd40000015780 0041 00000000 0x0 0x0
0xffffd40000015800 0041 00000000 0x0 0x0
0xffffd40000015880 0041 00000000 0x0 0x0
0xffffd40000015900 0041 00000000 0x0 0x0
0xffffd40000015980 0041 00000000 0x0 0x0
0xffffd40000015a00 0041 00000000 0x0 0x0
0xffffd40000015a80 0041 00000000 0x0 0x0
0xffffd40000015b00 0001 00000000 0x0 0x0
0xffffd40000015b80 0001 00000000 0x0 0x0
0xffffd40000015c00 0001 00000000 0x0 0x0
0xffffd40000015c80 0001 00000000 0x0 0x0
0xffffd40000015d00 0001 00000000 0x0 0x0
0xffffd40000015d80 0001 00000000 0x0 0x0
0xffffd40000015e00 0001 00000000 0x0 0x0
0xffffd40000015e80 0001 00000000 0x0 0x0
0xffffd40000015f00 0001 00000000 0x0 0x0
0xffffd40000015f80 0001 00000000 0x0 0x0
0xffffd40000016000 0001 00000000 0x0 0x0
0xffffd40000016080 0001 00000000 0x0 0x0
0xffffd40000016100 0001 00000000 0x0 0x0
0xffffd40000016180 0001 00000000 0x0 0x0
0xffffd40000016200 0001 00000000 0x0 0x0
0xffffd40000016280 0001 00000000 0x0 0x0
0xffffd40000016300 0001 00000000 0x0 0x0
0xffffd40000016380 0001 00000000 0x0 0x0
0xffffd40000016400 0001 00000000 0x0 0x0
0xffffd40000016480 0001 00000000 0x0 0x0
0xffffd40000016500 0001 00000000 0x0 0x0
0xffffd40000016580 0001 00000000 0x0 0x0
0xffffd40000016600 0001 00000000 0x0 0x0
0xffffd40000016680 0001 00000000 0x0 0x0
0xffffd40000016700 0001 00000000 0x0 0x0
0xffffd40000016780 0001 00000000 0x0 0x0
0xffffd40000016800 0001 00000000 0x0 0x0
0xffffd40000016880 0001 00000000 0x0 0x0
0xffffd40000016900 0001 00000000 0x0 0x0
0xffffd40000016980 0001 00000000 0x0 0x0
0xffffd40000016a00 0001 00000000 0x0 0x0
0xffffd40000016a80 0001 00000000 0x0 0x0
0xffffd40000016b00 0001 00000000 0x0 0x0
0xffffd40000016b80 0001 00000000 0x0 0x0
0xffffd40000016c00 0001 00000000 0x0 0x0
0xffffd40000016c80 0001 00000000 0x0 0x0
0xffffd40000016d00 0001 00000000 0x0 0x0
0xffffd40000016d80 0001 00000000 0x0 0x0
0xffffd40000016e00 0001 00000000 0x0 0x0
0xffffd40000016e80 0001 00000000 0x0 0x0
0xffffd40000016f00 0001 00000000 0x0 0x0
0xffffd40000016f80 0001 00000000 0x0 0x0
0xffffd40000017000 0001 00000000 0x0 0x0
0xffffd40000017080 0001 00000000 0x0 0x0
0xffffd40000017100 0001 00000000 0x0 0x0
0xffffd40000017180 0001 00000000 0x0 0x0
0xffffd40000017200 0001 00000000 0x0 0x0
0xffffd40000017280 0001 00000000 0x0 0x0
0xffffd40000017300 0001 00000000 0x0 0x0
0xffffd40000017380 0001 00000000 0x0 0x0
0xffffd40000017400 0001 00000000 0x0 0x0
0xffffd40000017480 0001 00000000 0x0 0x0
0xffffd40000017500 0001 00000000 0x0 0x0
0xffffd40000017580 0001 00000000 0x0 0x0
0xffffd40000017600 0041 00000000 0x0 0x0
0xffffd40000017680 0041 00000000 0x0 0x0
0xffffd40000017700 0041 00000000 0x0 0x0
0xffffd40000017780 0041 00000000 0x0 0x0
0xffffd40000017800 0041 00000000 0x0 0x0
0xffffd40000017880 0041 00000000 0x0 0x0
0xffffd40000017900 0041 00000000 0x0 0x0
0xffffd40000017980 0041 00000000 0x0 0x0
0xffffd40000017a00 0041 00000000 0x0 0x0
0xffffd40000017a80 0041 00000000 0x0 0x0
0xffffd40000017b00 0041 00000000 0x0 0x0
0xffffd40000017b80 0041 00000000 0x0 0x0
0xffffd40000017c00 0041 00000000 0x0 0x0
0xffffd40000017c80 0041 00000000 0x0 0x0
0xffffd40000017d00 0041 00000000 0x0 0x0
0xffffd40000017d80 0041 00000000 0x0 0x0
0xffffd40000017e00 0041 00000000 0x0 0x0
0xffffd40000017e80 0041 00000000 0x0 0x0
0xffffd40000017f00 0041 00000000 0x0 0x0
0xffffd40000017f80 0041 00000000 0x0 0x0
0xffffd40000018000 0041 00000000 0x0 0x0
0xffffd40000018080 0041 00000000 0x0 0x0
0xffffd40000018100 0041 00000000 0x0 0x0
0xffffd40000018180 0041 00000000 0x0 0x0
0xffffd40000018200 0041 00000000 0x0 0x0
0xffffd40000018280 0041 00000000 0x0 0x0
0xffffd40000018300 0041 00000000 0x0 0x0
0xffffd40000018380 0041 00000000 0x0 0x0
0xffffd40000018400 0041 00000000 0x0 0x0
0xffffd40000018480 0041 00000000 0x0 0x0
0xffffd40000018500 0041 00000000 0x0 0x0
0xffffd40000018580 0041 00000000 0x0 0x0
0xffffd40000018600 0041 00000000 0x0 0x0
0xffffd40000018680 0041 00000000 0x0 0x0
0xffffd40000018700 0041 00000000 0x0 0x0
0xffffd40000018780 0041 00000000 0x0 0x0
0xffffd40000018800 0041 00000000 0x0 0x0
0xffffd40000018880 0041 00000000 0x0 0x0
0xffffd40000018900 0041 00000000 0x0 0x0
0xffffd40000018980 0041 00000000 0x0 0x0
0xffffd40000018a00 0041 00000000 0x0 0x0
0xffffd40000018a80 0041 00000000 0x0 0x0
0xffffd40000018b00 0041 00000000 0x0 0x0
0xffffd40000018b80 0041 00000000 0x0 0x0
0xffffd40000018c00 0041 00000000 0x0 0x0
0xffffd40000018c80 0041 00000000 0x0 0x0
0xffffd40000018d00 0001 00000000 0x0 0x0
0xffffd40000018d80 0001 00000000 0x0 0x0
0xffffd40000018e00 0001 00000000 0x0 0x0
0xffffd40000018e80 0001 00000000 0x0 0x0
0xffffd40000018f00 0001 00000000 0x0 0x0
0xffffd40000018f80 0001 00000000 0x0 0x0
0xffffd40000019000 0001 00000000 0x0 0x0
0xffffd40000019080 0001 00000000 0x0 0x0
0xffffd40000019100 0001 00000000 0x0 0x0
0xffffd40000019180 0001 00000000 0x0 0x0
0xffffd40000019200 0001 00000000 0x0 0x0
0xffffd40000019280 0001 00000000 0x0 0x0
0xffffd40000019300 0001 00000000 0x0 0x0
0xffffd40000019380 0001 00000000 0x0 0x0
0xffffd40000019400 0001 00000000 0x0 0x0
0xffffd40000019480 0001 00000000 0x0 0x0
0xffffd40000019500 0001 00000000 0x0 0x0
0xffffd40000019580 0001 00000000 0x0 0x0
0xffffd40000019600 0001 00000000 0x0 0x0
0xffffd40000019680 0001 00000000 0x0 0x0
0xffffd40000019700 0001 00000000 0x0 0x0
0xffffd40000019780 0001 00000000 0x0 0x0
0xffffd40000019800 0001 00000000 0x0 0x0
0xffffd40000019880 0001 00000000 0x0 0x0
0xffffd40000019900 0001 00000000 0x0 0x0
0xffffd40000019980 0001 00000000 0x0 0x0
0xffffd40000019a00 0001 00000000 0x0 0x0
0xffffd40000019a80 0001 00000000 0x0 0x0
0xffffd40000019b00 0001 00000000 0x0 0x0
0xffffd40000019b80 0001 00000000 0x0 0x0
0xffffd40000019c00 0001 00000000 0x0 0x0
0xffffd40000019c80 0001 00000000 0x0 0x0
0xffffd40000019d00 0001 00000000 0x0 0x0
0xffffd40000019d80 0001 00000000 0x0 0x0
0xffffd40000019e00 0001 00000000 0x0 0x0
0xffffd40000019e80 0001 00000000 0x0 0x0
0xffffd40000019f00 0001 00000000 0x0 0x0
0xffffd40000019f80 0001 00000000 0x0 0x0
0xffffd4000001a000 0001 00000000 0x0 0x0
0xffffd4000001a080 0001 00000000 0x0 0x0
0xffffd4000001a100 0001 00000000 0x0 0x0
0xffffd4000001a180 0001 00000000 0x0 0x0
0xffffd4000001a200 0001 00000000 0x0 0x0
0xffffd4000001a280 0001 00000000 0x0 0x0
0xffffd4000001a300 0001 00000000 0x0 0x0
0xffffd4000001a380 0001 00000000 0x0 0x0
0xffffd4000001a400 0001 00000000 0x0 0x0
0xffffd4000001a480 0001 00000000 0x0 0x0
0xffffd4000001a500 0001 00000000 0x0 0x0
0xffffd4000001a580 0001 00000000 0x0 0x0
0xffffd4000001a600 0001 00000000 0x0 0x0
0xffffd4000001a680 0001 00000000 0x0 0x0
0xffffd4000001a700 0001 00000000 0x0 0x0
0xffffd4000001a780 0001 00000000 0x0 0x0
0xffffd4000001a800 0041 00000000 0x0 0x0
0xffffd4000001a880 0041 00000000 0x0 0x0
0xffffd4000001a900 0041 00000000 0x0 0x0
0xffffd4000001a980 0041 00000000 0x0 0x0
0xffffd4000001aa00 0041 00000000 0x0 0x0
0xffffd4000001aa80 0041 00000000 0x0 0x0
0xffffd4000001ab00 0041 00000000 0x0 0x0
0xffffd4000001ab80 0041 00000000 0x0 0x0
0xffffd4000001ac00 0041 00000000 0x0 0x0
0xffffd4000001ac80 0041 00000000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Nov 16, 2022, 3:25:40 PM11/16/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: e234b948ff02 More ipfilter fixes (Jose Luis Duran)
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=115519be880000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=ecda308a1dd9652836d0
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17163fae880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15378f11880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/96d47d90d567/disk-e234b948.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/4fec51155a0d/netbsd-e234b948.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ecda30...@syzkaller.appspotmail.com

[ 35.9432073] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/miscfs/umapfs/umap_vnops.c:225:17, member access within null pointer of type 'struct componentname'

[ 35.9432073] cpu0: Begin traceback...
[ 35.9631962] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 36.0431960] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 36.0931955] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 36.1531968] umap_bypass() at netbsd:umap_bypass+0x1a3b sys/miscfs/umapfs/umap_vnops.c:225
[ 36.2031972] VOP_WHITEOUT() at netbsd:VOP_WHITEOUT+0x209 sys/kern/vnode_if.c:1903
[ 36.2531952] union_mount() at netbsd:union_mount+0x4b5 sys/fs/union/union_vfsops.c:209
[ 36.3031941] VFS_MOUNT() at netbsd:VFS_MOUNT+0xae sys/kern/vfs_subr.c:1402
[ 36.3531946] mount_domount() at netbsd:mount_domount+0x1da sys/kern/vfs_mount.c:840
[ 36.4031959] do_sys_mount() at netbsd:do_sys_mount+0x288 sys/kern/vfs_syscalls.c:616
[ 36.4531945] compat_40_sys_mount() at netbsd:compat_40_sys_mount+0x5c sys/compat/common/vfs_syscalls_40.c:99
[ 36.5031939] sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 36.5031939] sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 36.5631965] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 36.5631965] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 36.5631965] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 36.5731948] --- syscall (number 21 via SYS_syscall) ---
[ 36.5931944] netbsd:syscall+0x2da:
[ 36.5931944] cpu0: End traceback...
[ 36.5931944] fatal breakpoint trap in supervisor mode
[ 36.6057648] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x7f7ea52102a8 ilevel 0 rsp 0xffffbc02483f2570
[ 36.6184968] curlwp 0xffffb7f3351bd2c0 pid 1243.1243 lowest kstack 0xffffbc02483ee2c0
Stopped in pid 1243.1243 (syz-executor3523) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
umap_bypass() at netbsd:umap_bypass+0x1a3b sys/miscfs/umapfs/umap_vnops.c:225
VOP_WHITEOUT() at netbsd:VOP_WHITEOUT+0x209 sys/kern/vnode_if.c:1903
union_mount() at netbsd:union_mount+0x4b5 sys/fs/union/union_vfsops.c:209
VFS_MOUNT() at netbsd:VFS_MOUNT+0xae sys/kern/vfs_subr.c:1402
mount_domount() at netbsd:mount_domount+0x1da sys/kern/vfs_mount.c:840
do_sys_mount() at netbsd:do_sys_mount+0x288 sys/kern/vfs_syscalls.c:616
compat_40_sys_mount() at netbsd:compat_40_sys_mount+0x5c sys/compat/common/vfs_syscalls_40.c:99

sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 21 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/miscfs/umapfs/umap_vnops.c:225:17, member access within null pointer of type 'struct componentname'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1236 1236 2 0 0 ffffb7f333f939c0 syz-executor3523
1245 1245 3 1 0 ffffb7f334b0b200 syz-executor3523 tstile
990 990 3 1 0 ffffb7f3351bdb40 syz-executor3523 tstile
449 449 2 0 0 ffffb7f334b0b640 syz-executor3523
1239 1239 3 1 0 ffffb7f3351bd700 syz-executor3523 tstile
1386 1386 2 1 140 ffffb7f331bf4a80 syz-executor3523
813 813 2 1 0 ffffb7f3330a72c0 syz-executor3523
1243 >1243 7 0 0 ffffb7f3351bd2c0 syz-executor3523
929 929 2 1 140 ffffb7f332e53b00 syz-executor3523
942 942 2 0 140 ffffb7f333d3c540 syz-executor3523
950 950 2 1 140 ffffb7f332e536c0 syz-executor3523
815 815 2 1 140 ffffb7f33530c280 syz-executor3523
1120 1120 3 0 180 ffffb7f33530cb00 syz-executor3523 nanoslp
1224 1224 3 1 180 ffffb7f33530c6c0 sshd select
1225 1225 3 1 180 ffffb7f3349faa40 getty nanoslp
1082 1082 3 1 180 ffffb7f334b0ba80 getty nanoslp
1255 1255 3 1 180 ffffb7f334b53240 getty nanoslp
1216 1216 3 1 1c0 ffffb7f332e53280 getty ttyraw
1098 1098 3 1 180 ffffb7f334b53ac0 sshd select
1094 1094 3 1 180 ffffb7f334b53680 powerd kqueue
702 702 2 0 0 ffffb7f334438180 syslogd
747 747 3 0 180 ffffb7f333b88040 dhcpcd poll
742 742 3 1 180 ffffb7f3332bf740 dhcpcd poll
466 466 3 0 180 ffffb7f334678900 dhcpcd poll
598 598 3 1 180 ffffb7f3332bfb80 dhcpcd poll
292 292 3 0 180 ffffb7f3335d4780 dhcpcd poll
485 485 3 0 180 ffffb7f3335d4340 dhcpcd poll
291 291 3 1 180 ffffb7f32a8e0740 dhcpcd poll
1 1 3 0 180 ffffb7f32aa53980 init wait
0 985 3 0 200 ffffb7f332c77240 physiod physiod
0 196 2 0 240 ffffb7f332c77ac0 ioflush
0 195 3 0 200 ffffb7f32a8e0b80 pooldrain pooldrain
0 194 3 1 200 ffffb7f332c77680 pgdaemon pgdaemon
0 170 3 1 200 ffffb7f331bf4640 usb7 usbevt
0 169 3 1 200 ffffb7f331bf4200 usb6 usbevt
0 168 3 1 200 ffffb7f32eb6fa40 usb5 usbevt
0 167 3 1 200 ffffb7f32eb6f600 usb4 usbevt
0 166 3 1 200 ffffb7f32eb6f1c0 usb3 usbevt
0 165 3 1 200 ffffb7f32bafaa00 usb2 usbevt
0 31 3 1 200 ffffb7f32bafa5c0 usb1 usbevt
0 63 3 1 200 ffffb7f32bafa180 usb0 usbevt
0 126 3 1 200 ffffb7f32aace9c0 usbtask-dr usbtsk
0 125 3 0 200 ffffb7f32aace580 usbtask-hc usbtsk
0 124 3 1 200 ffffb7f32aace140 swwreboot swwreboot
0 123 3 1 200 ffffb7f328ea1b00 npfgc0 npfgcw
0 122 3 1 200 ffffb7f32aa53540 rt_free rt_free
0 121 3 1 200 ffffb7f32aa53100 unpgc unpgc
0 120 2 0 200 ffffb7f32aa4e940 key_timehandler
0 119 3 1 200 ffffb7f32aa4e500 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffb7f32aa4e0c0 icmp6_wqinput/0 icmp6_wqinput
0 117 2 0 200 ffffb7f32aa39900 nd6_timer
0 116 3 1 200 ffffb7f32aa394c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffb7f32aa39080 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffb7f32aa248c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffb7f32aa24480 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffb7f32aa24040 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffb7f32a9d7bc0 icmp_wqinput/0 icmp_wqinput
0 110 2 0 200 ffffb7f32a9d7340 rt_timer
0 109 3 0 200 ffffb7f32a9d7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffffb7f32a8e0300 entbutler entropy
0 99 3 1 200 ffffb7f32a350b40 viomb balloon
0 98 3 1 200 ffffb7f32a350700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffb7f32a3502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffffb7f328ea16c0 scsibus0 sccomp
0 29 3 0 200 ffffb7f328ea1280 pms0 pmsreset
0 28 3 1 200 ffffb7f328db4ac0 xcall/1 xcall
0 27 1 1 200 ffffb7f328db4680 softser/1
0 26 1 1 200 ffffb7f328db4240 softclk/1
0 25 1 1 200 ffffb7f328d87a80 softbio/1
0 24 1 1 200 ffffb7f328d87640 softnet/1
0 23 1 1 201 ffffb7f328d87200 idle/1
0 22 3 1 200 ffffb7f45712da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffffb7f45712d600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffb7f45712d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffffb7f457134a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffb7f4571345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffffb7f457134180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffb7f4571539c0 sysmon smtaskq
0 15 3 1 200 ffffb7f457153580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffb7f457153140 pmfevent pmfevent
0 13 3 1 200 ffffb7f45715e980 sopendfree sopendfr
0 12 3 0 200 ffffb7f45715e540 ifwdog ifwdog
0 11 3 0 200 ffffb7f45715e100 iflnkst iflnkst
0 10 3 1 200 ffffb7f458193940 nfssilly nfssilly
0 9 3 0 200 ffffb7f458193500 vdrain vdrain
0 8 3 1 200 ffffb7f4581930c0 modunload mod_unld
0 7 3 0 200 ffffb7f4581bc900 xcall/0 xcall
0 6 1 0 200 ffffb7f4581bc4c0 softser/0
0 5 1 0 200 ffffb7f4581bc080 softclk/0
0 4 1 0 200 ffffb7f4581e98c0 softbio/0
0 3 1 0 200 ffffb7f4581e9480 softnet/0
0 2 1 0 201 ffffb7f4581e9040 idle/0
0 > 0 7 1 240 ffffffff8673eec0 swapper
[Locks tracked through LWPs]

****** LWP 1236.1236 (syz-executor3523) @ 0xffffb7f333f939c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)

lock address : ffffb7f3351fbbc0

type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffb7f333f939c0 last held: 0xffffb7f333f939c0
last locked* : netbsd:uvm_fault_internal+0x75d
unlocked : netbsd:uvm_fault_upper_enter+0x454
owner/count : 0xffffb7f333f939c0 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffffb7f333f66580
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffb7f333f939c0 last held: 0xffffb7f333f939c0
last locked* : netbsd:pmap_enter_ma+0x3c0
unlocked : netbsd:pmap_enter_ma+0xb24
owner field : 0xffffb7f333f939c0 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1245.1245 (syz-executor3523) @ 0xffffb7f334b0b200, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:vcache_alloc+0xba sys/kern/vfs_vnode.c:1391)

lock address : ffffb7f335de2e80

type : sleep/adaptive
initialized : netbsd:vcache_alloc+0xba
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 3

relevant cpu : 1 last held: 0

relevant lwp : 0xffffb7f334b0b200 last held: 0xffffb7f3351bd2c0

last locked* : netbsd:genfs_lock+0x220
unlocked : netbsd:genfs_unlock+0x50

owner/count : 0xffffb7f3351bd2c0 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 3 waiting writers: 0xffffb7f334b0b200 0xffffb7f3351bdb40 0xffffb7f3351bd700

****** LWP 990.990 (syz-executor3523) @ 0xffffb7f3351bdb40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:vcache_alloc+0xba sys/kern/vfs_vnode.c:1391)

lock address : ffffb7f335de2e80

type : sleep/adaptive
initialized : netbsd:vcache_alloc+0xba
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 3

relevant cpu : 1 last held: 0

relevant lwp : 0xffffb7f3351bdb40 last held: 0xffffb7f3351bd2c0

last locked* : netbsd:genfs_lock+0x220
unlocked : netbsd:genfs_unlock+0x50

owner/count : 0xffffb7f3351bd2c0 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 3 waiting writers: 0xffffb7f334b0b200 0xffffb7f3351bdb40 0xffffb7f3351bd700

****** LWP 449.449 (syz-executor3523) @ 0xffffb7f334b0b640, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)

lock address : ffffb7f333808040

type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffb7f334b0b640 last held: 0xffffb7f334b0b640
last locked* : netbsd:uvm_fault_internal+0x75d
unlocked : netbsd:uvm_fault_upper_enter+0x454
owner/count : 0xffffb7f334b0b640 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffffb7f33349b180
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffb7f334b0b640 last held: 0xffffb7f334b0b640
last locked* : netbsd:pmap_extract+0xdb
unlocked : netbsd:pmap_enter_ma+0xb24
owner field : 0xffffb7f334b0b640 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1239.1239 (syz-executor3523) @ 0xffffb7f3351bd700, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:vcache_alloc+0xba sys/kern/vfs_vnode.c:1391)

lock address : ffffb7f335de2e80

type : sleep/adaptive
initialized : netbsd:vcache_alloc+0xba
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 3

relevant cpu : 1 last held: 0

relevant lwp : 0xffffb7f3351bd700 last held: 0xffffb7f3351bd2c0

last locked* : netbsd:genfs_lock+0x220
unlocked : netbsd:genfs_unlock+0x50

owner/count : 0xffffb7f3351bd2c0 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 3 waiting writers: 0xffffb7f334b0b200 0xffffb7f3351bdb40 0xffffb7f3351bd700

****** LWP 1243.1243 (syz-executor3523) @ 0xffffb7f3351bd2c0, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:vcache_alloc+0xba sys/kern/vfs_vnode.c:1391)

lock address : ffffb7f335de2e80

type : sleep/adaptive
initialized : netbsd:vcache_alloc+0xba
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 3

relevant cpu : 0 last held: 0

relevant lwp : 0xffffb7f3351bd2c0 last held: 0xffffb7f3351bd2c0

last locked* : netbsd:genfs_lock+0x220
unlocked : netbsd:genfs_unlock+0x50

owner/count : 0xffffb7f3351bd2c0 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 3 waiting writers: 0xffffb7f334b0b200 0xffffb7f3351bdb40 0xffffb7f3351bd700

*** Locks wanted: none

****** LWP 742.742 (dhcpcd) @ 0xffffb7f3332bf740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffffb7f3332bf740 last held: 000000000000000000