UBSan: Undefined Behavior in quota1_handle_cmd_quotaon

0 views

Skip to first unread message

syzbot

unread,

Jul 31, 2020, 3:33:18 PM7/31/20

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: c1e1be8b make(1): fix undefined behavior in malformed :S m..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=14288248900000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=8832f540234b996bc5a9
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8832f5...@syzkaller.appspotmail.com

[ 70.0481628] panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/ufs/ufs/ufs_quota1.c:326:23, index -1 is out of range for type 'vnode *[2]'

[ 70.0719582] cpu0: Begin traceback...
[ 70.1181401] vpanic() at netbsd:vpanic+0x2d3 sys/kern/subr_prf.c:290
[ 70.2681422] isAlreadyReported() at netbsd:isAlreadyReported
[ 70.3981407] HandleOutOfBounds() at netbsd:HandleOutOfBounds+0x134 sys/../common/lib/libc/misc/ubsan.c:470
[ 70.5181420] quota1_handle_cmd_quotaon() at netbsd:quota1_handle_cmd_quotaon+0xed1 sys/ufs/ufs/ufs_quota1.c:326
[ 70.6481400] quota_handle_cmd() at netbsd:quota_handle_cmd+0xd8e quota_handle_cmd_quotaon sys/ufs/ufs/ufs_quota.c:648 [inline]
[ 70.6481400] quota_handle_cmd() at netbsd:quota_handle_cmd+0xd8e sys/ufs/ufs/ufs_quota.c:187
[ 70.7681401] ufs_quotactl() at netbsd:ufs_quotactl+0x79 sys/ufs/ufs/ufs_vfsops.c:142
[ 70.8881414] VFS_QUOTACTL() at netbsd:VFS_QUOTACTL+0xa3 sys/kern/vfs_subr.c:1401
[ 71.0081404] vfs_quotactl_quotaon() at netbsd:vfs_quotactl_quotaon+0x36 sys/kern/vfs_quotactl.c:184
[ 71.1281440] compat_50_sys_quotactl() at netbsd:compat_50_sys_quotactl+0x3c0 sys/compat/common/compat_50_quota.c:96
[ 71.2581419] sys___syscall() at netbsd:sys___syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
[ 71.2581419] sys___syscall() at netbsd:sys___syscall+0x1cf sys/kern/sys_syscall.c:77
[ 71.3881476] syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
[ 71.3881476] syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 71.3881476] syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138
[ 71.4185457] --- syscall (number 198) ---
[ 71.4481429] netbsd:syscall+0x2d5:
[ 71.4586101] cpu0: End traceback...
[ 71.4586101] fatal breakpoint trap in supervisor mode
[ 71.4586101] trap type 1 code 0 rip 0xffffffff80221a85 cs 0x8 rflags 0x246 cr2 0x746b5ee3e000 ilevel 0 rsp 0xffff8b00bf147660
[ 71.4870281] curlwp 0xffff8a0d105c1240 pid 1319.1359 lowest kstack 0xffff8b00bf1432c0
Stopped in pid 1319.1359 (syz-executor.4) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x2d3 sys/kern/subr_prf.c:290
isAlreadyReported() at netbsd:isAlreadyReported
HandleOutOfBounds() at netbsd:HandleOutOfBounds+0x134 sys/../common/lib/libc/misc/ubsan.c:470
quota1_handle_cmd_quotaon() at netbsd:quota1_handle_cmd_quotaon+0xed1 sys/ufs/ufs/ufs_quota1.c:326
quota_handle_cmd() at netbsd:quota_handle_cmd+0xd8e quota_handle_cmd_quotaon sys/ufs/ufs/ufs_quota.c:648 [inline]
quota_handle_cmd() at netbsd:quota_handle_cmd+0xd8e sys/ufs/ufs/ufs_quota.c:187
ufs_quotactl() at netbsd:ufs_quotactl+0x79 sys/ufs/ufs/ufs_vfsops.c:142
VFS_QUOTACTL() at netbsd:VFS_QUOTACTL+0xa3 sys/kern/vfs_subr.c:1401
vfs_quotactl_quotaon() at netbsd:vfs_quotactl_quotaon+0x36 sys/kern/vfs_quotactl.c:184
compat_50_sys_quotactl() at netbsd:compat_50_sys_quotactl+0x3c0 sys/compat/common/compat_50_quota.c:96
sys___syscall() at netbsd:sys___syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
sys___syscall() at netbsd:sys___syscall+0x1cf sys/kern/sys_syscall.c:77
syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138
--- syscall (number 198) ---
netbsd:syscall+0x2d5:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/ufs/ufs/ufs_quota1.c:326:23, index -1 is out of range for type 'vnode *[2]'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
1511 1376 2 0 0 ffff8a0d0feb2a80 syz-executor.3
1511 1503 2 0 0 ffff8a0d0feb2200 syz-executor.3
1511 1511 2 1 10000000 ffff8a0d01eb1780 syz-executor.3
544 544 2 1 0 ffff8a0d0f3daa40 syz-executor.1
1319 >1359 7 0 0 ffff8a0d105c1240 syz-executor.4
1319 1319 2 0 10000000 ffff8a0d01eb1bc0 syz-executor.4
1340 1209 2 0 0 ffff8a0d04692a00 syz-executor.0
1340 1330 3 0 80 ffff8a0d01cdc080 syz-executor.0 parked
1340 1340 2 1 10000000 ffff8a0d0f3da1c0 syz-executor.0
944 944 2 1 40 ffff8a0d01cdc900 syz-executor.5
988 988 2 1 40 ffff8a0d0102d300 syz-executor.4
419 419 2 0 40 ffff8a0d046925c0 syz-executor.3
1071 1071 2 1 40 ffff8a0d014c0700 syz-executor.1
1077 1077 2 1 40 ffff8a0d04692180 syz-executor.2
1068 1068 2 0 40 ffff8a0d00b80680 syz-executor.0
1064 1082 3 1 80 ffff8a0d03a069c0 syz-fuzzer parked
1064 855 3 0 c0 ffff8a0d00b80240 syz-fuzzer parked
1064 1075 2 0 40 ffff8a0d03a06580 syz-fuzzer
1064 945 2 0 0 ffff8a0d03a06140 syz-fuzzer
1064 1250 3 0 80 ffff8a0d03710980 syz-fuzzer parked
1064 1253 3 1 80 ffff8a0d03710540 syz-fuzzer parked
1064 1069 3 1 c0 ffff8a0d0063e5c0 syz-fuzzer parked
1064 >1065 7 1 40 ffff8a0d00a2a200 syz-fuzzer
1064 1064 2 0 0 ffff8a0d03710100 syz-fuzzer
1254 1254 3 0 80 ffff8a0d00a2a640 sshd select
948 948 3 0 80 ffff8a0d00a2aa80 getty nanoslp
1088 1088 3 0 80 ffff8a0d01cdc4c0 getty nanoslp
1095 1095 3 0 80 ffff8a0d0102db80 getty nanoslp
1058 1058 3 0 c0 ffff8a0d0287c940 getty ttyraw
939 939 3 1 80 ffff8a0d0287c500 sshd select
853 853 3 1 80 ffff8a0d0287c0c0 powerd kqueue
734 734 3 1 80 ffff8a0d00b80ac0 syslogd kqueue
609 609 3 0 80 ffff8a0d01eb1340 dhcpcd poll
589 589 3 1 80 ffff8a0d00e2a280 dhcpcd poll
587 587 3 0 80 ffff8a0d00e2a6c0 dhcpcd poll
412 412 3 0 80 ffff8a0d0102d740 dhcpcd poll
347 347 3 0 80 ffff8a0d014c0b40 dhcpcd poll
346 346 3 1 80 ffff8a0d00e2ab00 dhcpcd poll
345 345 3 0 80 ffff8a0d014c02c0 dhcpcd poll
1 1 3 0 80 ffff8a0cf848d900 init wait
0 835 3 0 200 ffff8a0d0063ea00 physiod physiod
0 166 3 0 200 ffff8a0d006c7a40 pooldrain pooldrain
0 165 2 0 240 ffff8a0d006c7600 ioflush
0 164 3 1 200 ffff8a0d006c71c0 pgdaemon pgdaemon
0 161 3 0 200 ffff8a0d0063e180 usb7 usbevt
0 31 3 0 200 ffff8a0cfd5e19c0 usb6 usbevt
0 63 3 0 200 ffff8a0cfd5e1580 usb5 usbevt
0 126 3 0 200 ffff8a0cfd5e1140 usb4 usbevt
0 125 2 0 240 ffff8a0cfa56c980 usb3
0 124 3 0 200 ffff8a0cfa56c540 usb2 usbevt
0 123 3 1 200 ffff8a0cfa56c100 usb1 usbevt
0 122 3 0 200 ffff8a0cf84bf940 usb0 usbevt
0 121 3 1 200 ffff8a0cf84bf500 usbtask-dr usbtsk
0 120 3 0 200 ffff8a0cf594aac0 usbtask-hc usbtsk
0 119 3 1 200 ffff8a0cf84bf0c0 npfgc0 npfgcw
0 118 3 1 200 ffff8a0cf848d4c0 rt_free rt_free
0 117 3 1 200 ffff8a0cf848d080 unpgc unpgc
0 116 2 0 200 ffff8a0cf84a08c0 key_timehandler
0 115 3 1 200 ffff8a0cf84a0480 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffff8a0cf84a0040 icmp6_wqinput/0 icmp6_wqinput
0 113 2 0 200 ffff8a0cf8443bc0 nd6_timer
0 112 3 1 200 ffff8a0cf8443780 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffff8a0cf8443340 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffff8a0cf8401700 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffff8a0cf84012c0 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffff8a0cf8406b80 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffff8a0cf8406740 icmp_wqinput/0 icmp_wqinput
0 106 3 1 200 ffff8a0cf8401b40 rt_timer rt_timer
0 105 3 1 200 ffff8a0cf8406300 vmem_rehash vmem_rehash
0 104 3 1 200 ffff8a0cf7d98b00 entbutler entropy
0 30 3 1 200 ffff8a0cf7d986c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffff8a0cf7d98280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffff8a0cf594a680 scsibus0 sccomp
0 26 3 0 200 ffff8a0cf594a240 pms0 pmsreset
0 25 3 1 200 ffff8a0cf587ca80 xcall/1 xcall
0 24 1 1 200 ffff8a0cf587c640 softser/1
0 23 1 1 200 ffff8a0cf587c200 softclk/1
0 22 1 1 200 ffff8a0cf584fa40 softbio/1
0 21 1 1 200 ffff8a0cf584f600 softnet/1
0 20 1 1 201 ffff8a0cf584f1c0 idle/1
0 19 3 0 200 ffff8a0e0578fa00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffff8a0e0578f5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffff8a0e0578f180 lnxsyswq lnxsyswq
0 16 3 0 200 ffff8a0e0579c9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffff8a0e0579c580 sysmon smtaskq
0 14 3 0 200 ffff8a0e0579c140 pmfsuspend pmfsuspend
0 13 3 0 200 ffff8a0e057b9980 pmfevent pmfevent
0 12 3 0 200 ffff8a0e057b9540 sopendfree sopendfr
0 11 3 0 200 ffff8a0e057b9100 iflnkst iflnkst
0 10 3 0 200 ffff8a0e067d8940 nfssilly nfssilly
0 9 3 0 200 ffff8a0e067d8500 vdrain vdrain
0 8 3 0 200 ffff8a0e067d80c0 modunload mod_unld
0 7 3 0 200 ffff8a0e06813900 xcall/0 xcall
0 6 1 0 200 ffff8a0e068134c0 softser/0
0 5 1 0 200 ffff8a0e06813080 softclk/0
0 4 1 0 200 ffff8a0e0683d8c0 softbio/0
0 3 1 0 200 ffff8a0e0683d480 softnet/0
0 2 1 0 201 ffff8a0e0683d040 idle/0
0 0 2 0 240 ffffffff85efbcc0 swapper
[Locks tracked through LWPs]

****** LWP 1511.1511 (syz-executor.3) @ 0xffff8a0d01eb1780, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffff8a0d01b5e180 type : sleep/adaptive
initialized : 0xffffffff80f83ea3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 1
relevant lwp : 0xffff8a0d01eb1780 last held: 000000000000000000
last locked : 0xffffffff80f86557 unlocked*: 0xffffffff80f86c4c
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 544.544 (syz-executor.1) @ 0xffff8a0d0f3daa40, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffff8a0d00bc0b80 type : sleep/adaptive
initialized : 0xffffffff80f83ea3
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff8a0d0f3daa40 last held: 0xffff8a0d0f3daa40
last locked* : 0xffffffff80f86557 unlocked : 0xffffffff80f83be6
owner field : 0xffff8a0d0f3daa40 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1319.1359 (syz-executor.4) @ 0xffff8a0d105c1240, l_stat=7

*** Locks held:

* Lock 0 (initialized at vfs_mountalloc)
lock address : 0xffff8a0e06cba980 type : sleep/adaptive
initialized : 0xffffffff834c0220
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8a0d105c1240 last held: 0xffff8a0d105c1240
last locked* : 0xffffffff830d6c5f unlocked : 0xffffffff834d86a0
owner field : 0xffff8a0d105c1240 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1340.1209 (syz-executor.0) @ 0xffff8a0d04692a00, l_stat=2

*** Locks held:

* Lock 0 (initialized at uvm_obj_init)
lock address : 0xffff8a0d037f8980 type : sleep/adaptive
initialized : 0xffffffff8314d1ae
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8a0d04692a00 last held: 0xffff8a0d04692a00
last locked* : 0xffffffff8311435b unlocked : 0xffffffff83110769
owner/count : 0xffff8a0d04692a00 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at pmap_ctor)
lock address : 0xffff8a0d00bc0980 type : sleep/adaptive
initialized : 0xffffffff80f83ea3
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8a0d04692a00 last held: 0xffff8a0d04692a00
last locked* : 0xffffffff80f86557 unlocked : 0xffffffff80f86c4c
owner field : 0xffff8a0d04692a00 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

* Lock 2 (initialized at pmap_ctor)
lock address : 0xffff8a0d00bc0988 type : sleep/adaptive
initialized : 0xffffffff80f83ed2
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8a0d04692a00 last held: 0xffff8a0d04692a00
last locked* : 0xffffffff80f709bb unlocked : 0xffffffff80f70e2a
owner/count : 0xffff8a0d04692a00 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 944.944 (syz-executor.5) @ 0xffff8a0d01cdc900, l_stat=2

*** Locks held:

* Lock 0 (initialized at filedesc_ctor)
lock address : 0xffff8a0d00c8b240 type : sleep/adaptive
initialized : 0xffffffff831c1124
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff8a0d01cdc900 last held: 0xffff8a0d01cdc900
last locked* : 0xffffffff831cf503 unlocked : 0xffffffff831c5d70
owner field : 0xffff8a0d01cdc900 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1071.1071 (syz-executor.1) @ 0xffff8a0d014c0700, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffff8a0d01c26310 type : sleep/adaptive
initialized : 0xffffffff83135afc
shared holds : 0 exclusive: 0
shares wanted: 1 exclusive: 0
relevant cpu : 1 last held: 65535
relevant lwp : 0xffff8a0d014c0700 last held: 000000000000000000
last locked : 0xffffffff831123d1 unlocked*: 0xffffffff8310ee77
owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 1077.1077 (syz-executor.2) @ 0xffff8a0d04692180, l_stat=2

*** Locks held:

* Lock 0 (initialized at uvm_map_setup)
lock address : 0xffff8a0d00cc0888 type : sleep/adaptive
initialized : 0xffffffff83135afc
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff8a0d04692180 last held: 0xffff8a0d04692180
last locked* : 0xffffffff83127ec1 unlocked : 0xffffffff8310ee77
owner/count : 0xffff8a0d04692180 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 589.589 (dhcpcd) @ 0xffff8a0d00e2a280, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa780 type : sleep/adaptive
initialized : 0xffffffff8323a6a0
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff8a0d00e2a280 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 587.587 (dhcpcd) @ 0xffff8a0d00e2a6c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa780 type : sleep/adaptive
initialized : 0xffffffff8323a6a0
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8a0d00e2a6c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 346.346 (dhcpcd) @ 0xffff8a0d00e2ab00, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa780 type : sleep/adaptive
initialized : 0xffffffff8323a6a0
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff8a0d00e2ab00 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 345.345 (dhcpcd) @ 0xffff8a0d014c02c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa780 type : sleep/adaptive
initialized : 0xffffffff8323a6a0
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8a0d014c02c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffff8a0e057b9100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa780 type : sleep/adaptive
initialized : 0xffffffff8323a6a0
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8a0e057b9100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffff8a0e06813080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa780 type : sleep/adaptive
initialized : 0xffffffff8323a6a0
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8a0e06813080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

PAGE FLAG PQ UOBJECT UANON
0xffff8b0000007180 0045 00000000 0x0 0x0
0xffff8b0000007200 0045 00000000 0x0 0x0
0xffff8b0000007280 0045 00000000 0x0 0x0
0xffff8b0000007300 0045 00000000 0x0 0x0
0xffff8b0000007380 0045 00000000 0x0 0x0
0xffff8b0000007400 0045 00000000 0x0 0x0
0xffff8b0000007480 0045 00000000 0x0 0x0
0xffff8b0000007500 0045 00000000 0x0 0x0
0xffff8b0000007580 0041 00000000 0x0 0x0
0xffff8b0000007600 0041 00000000 0x0 0x0
0xffff8b0000007680 0041 00000000 0x0 0x0
0xffff8b0000007700 0045 00000000 0x0 0x0
0xffff8b0000007780 0045 00000000 0x0 0x0
0xffff8b0000007800 0045 00000000 0x0 0x0
0xffff8b0000007880 0041 00000000 0x0 0x0
0xffff8b0000007900 0041 00000000 0x0 0x0
0xffff8b0000007980 0041 00000000 0x0 0x0
0xffff8b0000007a00 0041 00000000 0x0 0x0
0xffff8b0000007a80 0041 00000000 0x0 0x0
0xffff8b0000007b00 0041 00000000 0x0 0x0
0xffff8b0000007b80 0041 00000000 0x0 0x0
0xffff8b0000007c00 0041 00000000 0x0 0x0
0xffff8b0000007c80 0041 00000000 0x0 0x0
0xffff8b0000007d00 0041 00000000 0x0 0x0
0xffff8b0000007d80 0041 00000000 0x0 0x0
0xffff8b0000007e00 0041 00000000 0x0 0x0
0xffff8b0000007e80 0041 00000000 0x0 0x0
0xffff8b0000007f00 0041 00000000 0x0 0x0
0xffff8b0000007f80 0041 00000000 0x0 0x0
0xffff8b0000008000 0041 00000000 0x0 0x0
0xffff8b0000008080 0041 00000000 0x0 0x0
0xffff8b0000008100 0041 00000000 0x0 0x0
0xffff8b0000008180 0041 00000000 0x0 0x0
0xffff8b0000008200 0041 00000000 0x0 0x0
0xffff8b0000008280 0045 00000000 0x0 0x0
0xffff8b0000008300 0041 00000000 0x0 0x0
0xffff8b0000008380 0041 00000000 0x0 0x0
0xffff8b0000008400 0041 00000000 0x0 0x0
0xffff8b0000008480 0041 00000000 0x0 0x0
0xffff8b0000008500 0041 00000000 0x0 0x0
0xffff8b0000008580 0041 00000000 0x0 0x0
0xffff8b0000008600 0041 00000000 0x0 0x0
0xffff8b0000008680 0041 00000000 0x0 0x0
0xffff8b0000008700 0041 00000000 0x0 0x0
0xffff8b0000008780 0041 00000000 0x0 0x0
0xffff8b0000008800 0041 00000000 0x0 0x0
0xffff8b0000008880 0041 00000000 0x0 0x0
0xffff8b0000008900 0041 00000000 0x0 0x0
0xffff8b0000008980 0041 00000000 0x0 0x0
0xffff8b0000008a00 0041 00000000 0x0 0x0
0xffff8b0000008a80 0045 00000000 0x0 0x0
0xffff8b0000008b00 0041 00000000 0x0 0x0
0xffff8b0000008b80 0041 00000000 0x0 0x0
0xffff8b0000008c00 0041 00000000 0x0 0x0
0xffff8b0000008c80 0041 00000000 0x0 0x0
0xffff8b0000008d00 0041 00000000 0x0 0x0
0xffff8b0000008d80 0041 00000000 0x0 0x0
0xffff8b0000008e00 0041 00000000 0x0 0x0
0xffff8b0000008e80 0041 00000000 0x0 0x0
0xffff8b0000008f00 0045 00000000 0x0 0x0
0xffff8b0000008f80 0041 00000000 0x0 0x0
0xffff8b0000009000 0041 00000000 0x0 0x0
0xffff8b0000009080 0041 00000000 0x0 0x0
0xffff8b0000009100 0041 00000000 0x0 0x0
0xffff8b0000009180 0041 00000000 0x0 0x0
0xffff8b0000009200 0041 00000000 0x0 0x0
0xffff8b0000009280 0041 00000000 0x0 0x0
0xffff8b0000009300 0041 00000000 0x0 0x0
0xffff8b0000009380 0041 00000000 0x0 0x0
0xffff8b0000009400 0041 00000000 0x0 0x0
0xffff8b0000009480 0041 00000000 0x0 0x0
0xffff8b0000009500 0041 00000000 0x0 0x0
0xffff8b0000009580 0045 00000000 0x0 0x0
0xffff8b0000009600 0041 00000000 0x0 0x0
0xffff8b0000009680 0041 00000000 0x0 0x0
0xffff8b0000009700 0041 00000000 0x0 0x0
0xffff8b0000009780 0041 00000000 0x0 0x0
0xffff8b0000009800 0041 00000000 0x0 0x0
0xffff8b0000009880 0041 00000000 0x0 0x0
0xffff8b0000009900 0041 00000000 0x0 0x0
0xffff8b0000009980 0041 00000000 0x0 0x0
0xffff8b0000009a00 0041 00000000 0x0 0x0
0xffff8b0000009a80 0041 00000000 0x0 0x0
0xffff8b0000009b00 0041 00000000 0x0 0x0
0xffff8b0000009b80 0041 00000000 0x0 0x0
0xffff8b0000009c00 0041 00000000 0x0 0x0
0xffff8b0000009c80 0041 00000000 0x0 0x0
0xffff8b0000009d00 0041 00000000 0x0 0x0
0xffff8b0000009d80 0041 00000000 0x0 0x0
0xffff8b0000009e00 0041 00000000 0x0 0x0
0xffff8b0000009e80 0041 00000000 0x0 0x0
0xffff8b0000009f00 0041 00000000 0x0 0x0
0xffff8b0000009f80 0041 00000000 0x0 0x0
0xffff8b000000a000 0041 00000000 0x0 0x0
0xffff8b000000a080 0041 00000000 0x0 0x0
0xffff8b000000a100 0045 00000000 0x0 0x0
0xffff8b000000a180 0041 00000000 0x0 0x0
0xffff8b000000a200 0041 00000000 0x0 0x0
0xffff8b000000a280 0041 00000000 0x0 0x0
0xffff8b000000a300 0041 00000000 0x0 0x0
0xffff8b000000a380 0041 00000000 0x0 0x0
0xffff8b000000a400 0041 00000000 0x0 0x0
0xffff8b000000a480 0041 00000000 0x0 0x0
0xffff8b000000a500 0041 00000000 0x0 0x0
0xffff8b000000a580 0041 00000000 0x0 0x0
0xffff8b000000a600 0041 00000000 0x0 0x0
0xffff8b000000a680 0041 00000000 0x0 0x0
0xffff8b000000a700 0041 00000000 0x0 0x0
0xffff8b000000a780 0041 00000000 0x0 0x0
0xffff8b000000a800 0041 00000000 0x0 0x0
0xffff8b000000a880 0041 00000000 0x0 0x0
0xffff8b000000a900 0041 00000000 0x0 0x0
0xffff8b000000a980 0041 00000000 0x0 0x0
0xffff8b000000aa00 0045 00000000 0x0 0x0
0xffff8b000000aa80 0041 00000000 0x0 0x0
0xffff8b000000ab00 0041 00000000 0x0 0x0
0xffff8b000000ab80 0041 00000000 0x0 0x0
0xffff8b000000ac00 0041 00000000 0x0 0x0
0xffff8b000000ac80 0041 00000000 0x0 0x0
0xffff8b000000ad00 0041 00000000 0x0 0x0
0xffff8b000000ad80 0041 00000000 0x0 0x0
0xffff8b000000ae00 0045 00000000 0x0 0x0
0xffff8b000000ae80 0041 00000000 0x0 0x0
0xffff8b000000af00 0041 00000000 0x0 0x0
0xffff8b000000af80 0041 00000000 0x0 0x0
0xffff8b000000b000 0041 00000000 0x0 0x0
0xffff8b000000b080 0041 00000000 0x0 0x0
0xffff8b000000b100 0041 00000000 0x0 0x0
0xffff8b000000b180 0045 00000000 0x0 0x0
0xffff8b000000b200 0045 00000000 0x0 0x0
0xffff8b000000b280 0045 00000000 0x0 0x0
0xffff8b000000b300 0041 00000000 0x0 0x0
0xffff8b000000b380 0041 00000000 0x0 0x0
0xffff8b000000b400 0041 00000000 0x0 0x0
0xffff8b000000b480 0041 00000000 0x0 0x0
0xffff8b000000b500 0041 00000000 0x0 0x0
0xffff8b000000b580 0045 00000000 0x0 0x0
0xffff8b000000b600 0045 00000000 0x0 0x0
0xffff8b000000b680 0045 00000000 0x0 0x0
0xffff8b000000b700 0041 00000000 0x0 0x0
0xffff8b000000b780 0045 00000000 0x0 0x0
0xffff8b000000b800 0045 00000000 0x0 0x0
0xffff8b000000b880 0045 00000000 0x0 0x0
0xffff8b000000b900 0045 00000000 0x0 0x0
0xffff8b000000b980 0045 00000000 0x0 0x0
0xffff8b000000ba00 0041 00000000 0x0 0x0
0xffff8b000000ba80 0045 00000000 0x0 0x0
0xffff8b000000bb00 0045 00000000 0x0 0x0
0xffff8b000000bb80 0045 00000000 0x0 0x0
0xffff8b000000bc00 0045 00000000 0x0 0x0
0xffff8b000000bc80 0045 00000000 0x0 0x0
0xffff8b000000bd00 0045 00000000 0x0 0x0
0xffff8b000000bd80 0045 00000000 0x0 0x0
0xffff8b000000be00 0041 00000000 0x0 0x0
0xffff8b000000be80 0045 00000000 0x0 0x0
0xffff8b000000bf00 0045 00000000 0x0 0x0
0xffff8b000000bf80 0045 00000000 0x0 0x0
0xffff8b000000c000 0045 00000000 0x0 0x0
0xffff8b000000c080 0045 00000000 0x0 0x0
0xffff8b000000c100 0045 00000000 0x0 0x0
0xffff8b000000c180 0045 00000000 0x0 0x0
0xffff8b000000c200 0041 00000000 0x0 0x0
0xffff8b000000c280 0041 00000000 0x0 0x0
0xffff8b000000c300 0045 00000000 0x0 0x0
0xffff8b000000c380 0045 00000000 0x0 0x0
0xffff8b000000c400 0045 00000000 0x0 0x0
0xffff8b000000c480 0045 00000000 0x0 0x0
0xffff8b000000c500 0045 00000000 0x0 0x0
0xffff8b000000c580 0041 00000000 0x0 0x0
0xffff8b000000c600 0041 00000000 0x0 0x0
0xffff8b000000c680 0041 00000000 0x0 0x0
0xffff8b000000c700 0045 00000000 0x0 0x0
0xffff8b000000c780 0041 00000000 0x0 0x0
0xffff8b000000c800 0045 00000000 0x0 0x0
0xffff8b000000c880 0045 00000000 0x0 0x0
0xffff8b000000c900 0045 00000000 0x0 0x0
0xffff8b000000c980 0041 00000000 0x0 0x0
0xffff8b000000ca00 0041 00000000 0x0 0x0
0xffff8b000000ca80 0041 00000000 0x0 0x0
0xffff8b000000cb00 0041 00000000 0x0 0x0
0xffff8b000000cb80 0041 00000000 0x0 0x0
0xffff8b000000cc00 0041 00000000 0x0 0x0
0xffff8b000000cc80 0041 00000000 0x0 0x0
0xffff8b000000cd00 0041 00000000 0x0 0x0
0xffff8b000000cd80 0041 00000000 0x0 0x0
0xffff8b000000ce00 0045 00000000 0x0 0x0
0xffff8b000000ce80 0041 00000000 0x0 0x0
0xffff8b000000cf00 0041 00000000 0x0 0x0
0xffff8b000000cf80 0041 00000000 0x0 0x0
0xffff8b000000d000 0041 00000000 0x0 0x0
0xffff8b000000d080 0041 00000000 0x0 0x0
0xffff8b000000d100 0041 00000000 0x0 0x0
0xffff8b000000d180 0041 00000000 0x0 0x0
0xffff8b000000d200 0041 00000000 0x0 0x0
0xffff8b000000d280 0041 00000000 0x0 0x0
0xffff8b000000d300 0041 00000000 0x0 0x0
0xffff8b000000d380 0045 00000000 0x0 0x0
0xffff8b000000d400 0041 00000000 0x0 0x0
0xffff8b000000d480 0041 00000000 0x0 0x0
0xffff8b000000d500 0041 00000000 0x0 0x0
0xffff8b000000d580 0041 00000000 0x0 0x0
0xffff8b000000d600 0041 00000000 0x0 0x0
0xffff8b000000d680 0045 00000000 0x0 0x0
0xffff8b000000d700 0045 00000000 0x0 0x0
0xffff8b000000d780 0041 00000000 0x0 0x0
0xffff8b000000d800 0045 00000000 0x0 0x0
0xffff8b000000d880 0041 00000000 0x0 0x0
0xffff8b000000d900 0041 00000000 0x0 0x0
0xffff8b000000d980 0045 00000000 0x0 0x0
0xffff8b000000da00 0041 00000000 0x0 0x0
0xffff8b000000da80 0041 00000000 0x0 0x0
0xffff8b000000db00 0041 00000000 0x0 0x0
0xffff8b000000db80 0045 00000000 0x0 0x0
0xffff8b000000dc00 0041 00000000 0x0 0x0
0xffff8b000000dc80 0045 00000000 0x0 0x0
0xffff8b000000dd00 0045 00000000 0x0 0x0
0xffff8b000000dd80 0045 00000000 0x0 0x0
0xffff8b000000de00 0041 00000000 0x0 0x0
0xffff8b000000de80 0041 00000000 0x0 0x0
0xffff8b000000df00 0041 00000000 0x0 0x0
0xffff8b000000df80 0045 00000000 0x0 0x0
0xffff8b000000e000 0045 00000000 0x0 0x0
0xffff8b000000e080 0045 00000000 0x0 0x0
0xffff8b000000e100 0045 00000000 0x0 0x0
0xffff8b000000e180 0041 00000000 0x0 0x0
0xffff8b000000e200 0041 00000000 0x0 0x0
0xffff8b000000e280 0041 00000000 0x0 0x0
0xffff8b000000e300 0045 00000000 0x0 0x0
0xffff8b000000e380 0045 00000000 0x0 0x0
0xffff8b000000e400 0045 00000000 0x0 0x0
0xffff8b000000e480 0045 00000000 0x0 0x0
0xffff8b000000e500 0041 00000000 0x0 0x0
0xffff8b000000e580 0041 00000000 0x0 0x0
0xffff8b000000e600 0041 00000000 0x0 0x0
0xffff8b000000e680 0041 00000000 0x0 0x0
0xffff8b000000e700 0041 00000000 0x0 0x0
0xffff8b000000e780 0041 00000000 0x0 0x0
0xffff8b000000e800 0045 00000000 0x0 0x0
0xffff8b000000e880 0041 00000000 0x0 0x0
0xffff8b000000e900 0045 00000000 0x0 0x0
0xffff8b000000e980 0041 00000000 0x0 0x0
0xffff8b000000ea00 0041 00000000 0x0 0x0
0xffff8b000000ea80 0041 00000000 0x0 0x0
0xffff8b000000eb00 0045 00000000 0x0 0x0
0xffff8b000000eb80 0041 00000000 0x0 0x0
0xffff8b000000ec00 0041 00000000 0x0 0x0
0xffff8b000000ec80 0045 00000000 0x0 0x0
0xffff8b000000ed00 0041 00000000 0x0 0x0
0xffff8b000000ed80 0041 00000000 0x0 0x0
0xffff8b000000ee00 0041 00000000 0x0 0x0
0xffff8b000000ee80 0041 00000000 0x0 0x0
0xffff8b000000ef00 0041 00000000 0x0 0x0
0xffff8b000000ef80 0041 00000000 0x0 0x0
0xffff8b000000f000 0045 00000000 0x0 0x0
0xffff8b000000f080 0041 00000000 0x0 0x0
0xffff8b000000f100 0041 00000000 0x0 0x0
0xffff8b000000f180 0041 00000000 0x0 0x0
0xffff8b000000f200 0045 00000000 0x0 0x0
0xffff8b000000f280 0041 00000000 0x0 0x0
0xffff8b000000f300 0041 00000000 0x0 0x0
0xffff8b000000f380 0041 00000000 0x0 0x0
0xffff8b000000f400 0041 00000000 0x0 0x0
0xffff8b000000f480 0041 00000000 0x0 0x0
0xffff8b000000f500 0041 00000000 0x0 0x0
0xffff8b000000f580 0041 00000000 0x0 0x0
0xffff8b000000f600 0041 00000000 0x0 0x0
0xffff8b000000f680 0045 00000000 0x0 0x0
0xffff8b000000f700 0041 00000000 0x0 0x0
0xffff8b000000f780 0041 00000000 0x0 0x0
0xffff8b000000f800 0041 00000000 0x0 0x0
0xffff8b000000f880 0041 00000000 0x0 0x0
0xffff8b000000f900 0041 00000000 0x0 0x0
0xffff8b000000f980 0041 00000000 0x0 0x0
0xffff8b000000fa00 0041 00000000 0x0 0x0
0xffff8b000000fa80 0041 00000000 0x0 0x0
0xffff8b000000fb00 0041 00000000 0x0 0x0
0xffff8b000000fb80 0045 00000000 0x0 0x0
0xffff8b000000fc00 0041 00000000 0x0 0x0
0xffff8b000000fc80 0041 00000000 0x0 0x0
0xffff8b000000fd00 0041 00000000 0x0 0x0
0xffff8b000000fd80 0041 00000000 0x0 0x0
0xffff8b000000fe00 0041 00000000 0x0 0x0
0xffff8b000000fe80 0041 00000000 0x0 0x0
0xffff8b000000ff00 0041 00000000 0x0 0x0
0xffff8b000000ff80 0041 00000000 0x0 0x0
0xffff8b0000010000 0041 00000000 0x0 0x0
0xffff8b0000010080 0041 00000000 0x0 0x0
0xffff8b0000010100 0041 00000000 0x0 0x0
0xffff8b0000010180 0045 00000000 0x0 0x0
0xffff8b0000010200 0041 00000000 0x0 0x0
0xffff8b0000010280 0041 00000000 0x0 0x0
0xffff8b0000010300 0041 00000000 0x0 0x0
0xffff8b0000010380 0041 00000000 0x0 0x0
0xffff8b0000010400 0041 00000000 0x0 0x0
0xffff8b0000010480 0041 00000000 0x0 0x0
0xffff8b0000010500 0041 00000000 0x0 0x0
0xffff8b0000010580 0041 00000000 0x0 0x0
0xffff8b0000010600 0041 00000000 0x0 0x0
0xffff8b0000010680 0041 00000000 0x0 0x0
0xffff8b0000010700 0045 00000000 0x0 0x0
0xffff8b0000010780 0041 00000000 0x0 0x0
0xffff8b0000010800 0045 00000000 0x0 0x0
0xffff8b0000010880 0045 00000000 0x0 0x0
0xffff8b0000010900 0045 00000000 0x0 0x0
0xffff8b0000010980 0041 00000000 0x0 0x0
0xffff8b0000010a00 0041 00000000 0x0 0x0
0xffff8b0000010a80 0041 00000000 0x0 0x0
0xffff8b0000010b00 0041 00000000 0x0 0x0
0xffff8b0000010b80 0045 00000000 0x0 0x0
0xffff8b0000010c00 0041 00000000 0x0 0x0
0xffff8b0000010c80 0041 00000000 0x0 0x0
0xffff8b0000010d00 0041 00000000 0x0 0x0
0xffff8b0000010d80 0041 00000000 0x0 0x0
0xffff8b0000010e00 0041 00000000 0x0 0x0
0xffff8b0000010e80 0041 00000000 0x0 0x0
0xffff8b0000010f00 0041 00000000 0x0 0x0
0xffff8b0000010f80 0041 00000000 0x0 0x0
0xffff8b0000011000 0041 00000000 0x0 0x0
0xffff8b0000011080 0041 00000000 0x0 0x0
0xffff8b0000011100 0041 00000000 0x0 0x0
0xffff8b0000011180 0041 00000000 0x0 0x0
0xffff8b0000011200 0041 00000000 0x0 0x0
0xffff8b0000011280 0041 00000000 0x0 0x0
0xffff8b0000011300 0041 00000000 0x0 0x0
0xffff8b0000011380 0041 00000000 0x0 0x0
0xffff8b0000011400 0041 00000000 0x0 0x0
0xffff8b0000011480 0041 00000000 0x0 0x0
0xffff8b0000011500 0041 00000000 0x0 0x0
0xffff8b0000011580 0041 00000000 0x0 0x0
0xffff8b0000011600 0041 00000000 0x0 0x0
0xffff8b0000011680 0041 00000000 0x0 0x0
0xffff8b0000011700 0041 00000000 0x0 0x0
0xffff8b0000011780 0041 00000000 0x0 0x0
0xffff8b0000011800 0045 00000000 0x0 0x0
0xffff8b0000011880 0001 00000000 0x0 0x0
0xffff8b0000011900 0001 00000000 0x0 0x0
0xffff8b0000011980 0001 00000000 0x0 0x0
0xffff8b0000011a00 0001 00000000 0x0 0x0
0xffff8b0000011a80 0001 00000000 0x0 0x0
0xffff8b0000011b00 0001 00000000 0x0 0x0
0xffff8b0000011b80 0001 00000000 0x0 0x0
0xffff8b0000011c00 0001 00000000 0x0 0x0
0xffff8b0000011c80 0001 00000000 0x0 0x0
0xffff8b0000011d00 0001 00000000 0x0 0x0
0xffff8b0000011d80 0001 00000000 0x0 0x0
0xffff8b0000011e00 0001 00000000 0x0 0x0
0xffff8b0000011e80 0001 00000000 0x0 0x0
0xffff8b0000011f00 0001 00000000 0x0 0x0
0xffff8b0000011f80 0001 00000000 0x0 0x0
0xffff8b0000012000 0001 00000000 0x0 0x0
0xffff8b0000012080 0001 00000000 0x0 0x0
0xffff8b0000012100 0001 00000000 0x0 0x0
0xffff8b0000012180 0001 00000000 0x0 0x0
0xffff8b0000012200 0001 00000000 0x0 0x0
0xffff8b0000012280 0001 00000000 0x0 0x0
0xffff8b0000012300 0001 00000000 0x0 0x0
0xffff8b0000012380 0001 00000000 0x0 0x0
0xffff8b0000012400 0001 00000000 0x0 0x0
0xffff8b0000012480 0001 00000000 0x0 0x0
0xffff8b0000012500 0001 00000000 0x0 0x0
0xffff8b0000012580 0001 00000000 0x0 0x0
0xffff8b0000012600 0001 00000000 0x0 0x0
0xffff8b0000012680 0001 00000000 0x0 0x0
0xffff8b0000012700 0001 00000000 0x0 0x0
0xffff8b0000012780 0001 00000000 0x0 0x0
0xffff8b0000012800 0001 00000000 0x0 0x0
0xffff8b0000012880 0001 00000000 0x0 0x0
0xffff8b0000012900 0001 00000000 0x0 0x0
0xffff8b0000012980 0001 00000000 0x0 0x0
0xffff8b0000012a00 0001 00000000 0x0 0x0
0xffff8b0000012a80 0001 00000000 0x0 0x0
0xffff8b0000012b00 0001 00000000 0x0 0x0
0xffff8b0000012b80 0001 00000000 0x0 0x0
0xffff8b0000012c00 0001 00000000 0x0 0x0
0xffff8b0000012c80 0001 00000000 0x0 0x0
0xffff8b0000012d00 0001 00000000 0x0 0x0
0xffff8b0000012d80 0001 00000000 0x0 0x0
0xffff8b0000012e00 0001 00000000 0x0 0x0
0xffff8b0000012e80 0001 00000000 0x0 0x0
0xffff8b0000012f00 0001 00000000 0x0 0x0
0xffff8b0000012f80 0001 00000000 0x0 0x0
0xffff8b0000013000 0001 00000000 0x0 0x0
0xffff8b0000013080 0001 00000000 0x0 0x0
0xffff8b0000013100 0001 00000000 0x0 0x0
0xffff8b0000013180 0001 00000000 0x0 0x0
0xffff8b0000013200 0001 00000000 0x0 0x0
0xffff8b0000013280 0001 00000000 0x0 0x0
0xffff8b0000013300 0001 00000000 0x0 0x0
0xffff8b0000013380 0041 00000000 0x0 0x0
0xffff8b0000013400 0041 00000000 0x0 0x0
0xffff8b0000013480 0041 00000000 0x0 0x0
0xffff8b0000013500 0041 00000000 0x0 0x0
0xffff8b0000013580 0041 00000000 0x0 0x0
0xffff8b0000013600 0041 00000000 0x0 0x0
0xffff8b0000013680 0041 00000000 0x0 0x0
0xffff8b0000013700 0041 00000000 0x0 0x0
0xffff8b0000013780 0041 00000000 0x0 0x0
0xffff8b0000013800 0041 00000000 0x0 0x0
0xffff8b0000013880 0041 00000000 0x0 0x0
0xffff8b0000013900 0041 00000000 0x0 0x0
0xffff8b0000013980 0041 00000000 0x0 0x0
0xffff8b0000013a00 0041 00000000 0x0 0x0
0xffff8b0000013a80 0041 00000000 0x0 0x0
0xffff8b0000013b00 0041 00000000 0x0 0x0
0xffff8b0000013b80 0041 00000000 0x0 0x0
0xffff8b0000013c00 0041 00000000 0x0 0x0
0xffff8b0000013c80 0041 00000000 0x0 0x0
0xffff8b0000013d00 0041 00000000 0x0 0x0
0xffff8b0000013d80 0041 00000000 0x0 0x0
0xffff8b0000013e00 0041 00000000 0x0 0x0
0xffff8b0000013e80 0041 00000000 0x0 0x0
0xffff8b0000013f00 0041 00000000 0x0 0x0
0xffff8b0000013f80 0041 00000000 0x0 0x0
0xffff8b0000014000 0041 00000000 0x0 0x0
0xffff8b0000014080 0041 00000000 0x0 0x0
0xffff8b0000014100 0041 00000000 0x0 0x0
0xffff8b0000014180 0041 00000000 0x0 0x0
0xffff8b0000014200 0041 00000000 0x0 0x0
0xffff8b0000014280 0041 00000000 0x0 0x0
0xffff8b0000014300 0041 00000000 0x0 0x0
0xffff8b0000014380 0041 00000000 0x0 0x0
0xffff8b0000014400 0041 00000000 0x0 0x0
0xffff8b0000014480 0041 00000000 0x0 0x0
0xffff8b0000014500 0041 00000000 0x0 0x0
0xffff8b0000014580 0041 00000000 0x0 0x0
0xffff8b0000014600 0041 00000000 0x0 0x0
0xffff8b0000014680 0041 00000000 0x0 0x0
0xffff8b0000014700 0041 00000000 0x0 0x0
0xffff8b0000014780 0041 00000000 0x0 0x0
0xffff8b0000014800 0041 00000000 0x0 0x0
0xffff8b0000014880 0001 00000000 0x0 0x0
0xffff8b0000014900 0001 00000000 0x0 0x0
0xffff8b0000014980 0001 00000000 0x0 0x0
0xffff8b0000014a00 0001 00000000 0x0 0x0
0xffff8b0000014a80 0001 00000000 0x0 0x0
0xffff8b0000014b00 0001 00000000 0x0 0x0
0xffff8b0000014b80 0001 00000000 0x0 0x0
0xffff8b0000014c00 0001 00000000 0x0 0x0
0xffff8b0000014c80 0001 00000000 0x0 0x0
0xffff8b0000014d00 0001 00000000 0x0 0x0
0xffff8b0000014d80 0001 00000000 0x0 0x0
0xffff8b0000014e00 0001 00000000 0x0 0x0
0xffff8b0000014e80 0001 00000000 0x0 0x0
0xffff8b0000014f00 0001 00000000 0x0 0x0
0xffff8b0000014f80 0001 00000000 0x0 0x0
0xffff8b0000015000 0001 00000000 0x0 0x0
0xffff8b0000015080 0001 00000000 0x0 0x0
0xffff8b0000015100 0001 00000000 0x0 0x0
0xffff8b0000015180 0001 00000000 0x0 0x0
0xffff8b0000015200 0001 00000000 0x0 0x0
0xffff8b0000015280 0001 00000000 0x0 0x0
0xffff8b0000015300 0001 00000000 0x0 0x0
0xffff8b0000015380 0001 00000000 0x0 0x0
0xffff8b0000015400 0001 00000000 0x0 0x0
0xffff8b0000015480 0001 00000000 0x0 0x0
0xffff8b0000015500 0001 00000000 0x0 0x0
0xffff8b0000015580 0001 00000000 0x0 0x0
0xffff8b0000015600 0001 00000000 0x0 0x0
0xffff8b0000015680 0001 00000000 0x0 0x0
0xffff8b0000015700 0001 00000000 0x0 0x0
0xffff8b0000015780 0001 00000000 0x0 0x0
0xffff8b0000015800 0001 00000000 0x0 0x0
0xffff8b0000015880 0001 00000000 0x0 0x0
0xffff8b0000015900 0001 00000000 0x0 0x0
0xffff8b0000015980 0001 00000000 0x0 0x0
0xffff8b0000015a00 0001 00000000 0x0 0x0
0xffff8b0000015a80 0001 00000000 0x0 0x0
0xffff8b0000015b00 0001 00000000 0x0 0x0
0xffff8b0000015b80 0001 00000000 0x0 0x0
0xffff8b0000015c00 0001 00000000 0x0 0x0
0xffff8b0000015c80 0001 00000000 0x0 0x0
0xffff8b0000015d00 0001 00000000 0x0 0x0
0xffff8b0000015d80 0001 00000000 0x0 0x0
0xffff8b0000015e00 0001 00000000 0x0 0x0
0xffff8b0000015e80 0001 00000000 0x0 0x0
0xffff8b0000015f00 0001 00000000 0x0 0x0
0xffff8b0000015f80 0001 00000000 0x0 0x0
0xffff8b0000016000 0001 00000000 0x0 0x0
0xffff8b0000016080 0001 00000000 0x0 0x0
0xffff8b0000016100 0001 00000000 0x0 0x0
0xffff8b0000016180 0001 00000000 0x0 0x0
0xffff8b0000016200 0001 00000000 0x0 0x0
0xffff8b0000016280 0001 00000000 0x0 0x0
0xffff8b0000016300 0001 00000000 0x0 0x0
0xffff8b0000016380 0041 00000000 0x0 0x0
0xffff8b0000016400 0041 00000000 0x0 0x0
0xffff8b0000016480 0041 00000000 0x0 0x0
0xffff8b0000016500 0041 00000000 0x0 0x0
0xffff8b0000016580 0041 00000000 0x0 0x0
0xffff8b0000016600 0041 00000000 0x0 0x0
0xffff8b0000016680 0041 00000000 0x0 0x0
0xffff8b0000016700 0041 00000000 0x0 0x0
0xffff8b0000016780 0041 00000000 0x0 0x0
0xffff8b0000016800 0041 00000000 0x0 0x0
0xffff8b0000016880 0041 00000000 0x0 0x0
0xffff8b0000016900 0041 00000000 0x0 0x0
0xffff8b0000016980 0041 00000000 0x0 0x0
0xffff8b0000016a00 0041 00000000 0x0 0x0
0xffff8b0000016a80 0041 00000000 0x0 0x0
0xffff8b0000016b00 0041 00000000 0x0 0x0
0xffff8b0000016b80 0041 00000000 0x0 0x0
0xffff8b0000016c00 0041 00000000 0x0 0x0
0xffff8b0000016c80 0041 00000000 0x0 0x0
0xffff8b0000016d00 0041 00000000 0x0 0x0
0xffff8b0000016d80 0041 00000000 0x0 0x0
0xffff8b0000016e00 0041 00000000 0x0 0x0
0xffff8b0000016e80 0041 00000000 0x0 0x0
0xffff8b0000016f00 0041 00000000 0x0 0x0
0xffff8b0000016f80 0041 00000000 0x0 0x0
0xffff8b0000017000 0041 00000000 0x0 0x0
0xffff8b0000017080 0041 00000000 0x0 0x0
0xffff8b0000017100 0041 00000000 0x0 0x0
0xffff8b0000017180 0041 00000000 0x0 0x0
0xffff8b0000017200 0041 00000000 0x0 0x0
0xffff8b0000017280 0041 00000000 0x0 0x0
0xffff8b0000017300 0041 00000000 0x0 0x0
0xffff8b0000017380 0041 00000000 0x0 0x0
0xffff8b0000017400 0041 00000000 0x0 0x0
0xffff8b0000017480 0041 00000000 0x0 0x0
0xffff8b0000017500 0041 00000000 0x0 0x0
0xffff8b0000017580 0041 00000000 0x0 0x0
0xffff8b0000017600 0045 00000000 0x0 0x0
0xffff8b0000017680 0041 00000000 0x0 0x0
0xffff8b0000017700 0041 00000000 0x0 0x0
0xffff8b0000017780 0041 00000000 0x0 0x0
0xffff8b0000017800 0041 00000000 0x0 0x0
0xffff8b0000017880 0001 00000000 0x0 0x0
0xffff8b0000017900 0001 00000000 0x0 0x0
0xffff8b0000017980 0001 00000000 0x0 0x0
0xffff8b0000017a00 0001 00000000 0x0 0x0
0xffff8b0000017a80 0001 00000000 0x0 0x0
0xffff8b0000017b00 0001 00000000 0x0 0x0
0xffff8b0000017b80 0001 00000000 0x0 0x0
0xffff8b0000017c00 0001 00000000 0x0 0x0
0xffff8b0000017c80 0001 00000000 0x0 0x0
0xffff8b0000017d00 0001 00000000 0x0 0x0
0xffff8b0000017d80 0001 00000000 0x0 0x0
0xffff8b0000017e00 0001 00000000 0x0 0x0
0xffff8b0000017e80 0001 00000000 0x0 0x0
0xffff8b0000017f00 0001 00000000 0x0 0x0
0xffff8b0000017f80 0001 00000000 0x0 0x0
0xffff8b0000018000 0001 00000000 0x0 0x0
0xffff8b0000018080 0001 00000000 0x0 0x0
0xffff8b0000018100 0001 00000000 0x0 0x0
0xffff8b0000018180 0001 00000000 0x0 0x0
0xffff8b0000018200 0001 00000000 0x0 0x0
0xffff8b0000018280 0001 00000000 0x0 0x0
0xffff8b0000018300 0001 00000000 0x0 0x0
0xffff8b0000018380 0001 00000000 0x0 0x0
0xffff8b0000018400 0001 00000000 0x0 0x0
0xffff8b0000018480 0001 00000000 0x0 0x0
0xffff8b0000018500 0001 00000000 0x0 0x0
0xffff8b0000018580 0001 00000000 0x0 0x0
0xffff8b0000018600 0001 00000000 0x0 0x0
0xffff8b0000018680 0001 00000000 0x0 0x0
0xffff8b0000018700 0001 00000000 0x0 0x0
0xffff8b0000018780 0001 00000000 0x0 0x0
0xffff8b0000018800 0001 00000000 0x0 0x0
0xffff8b0000018880 0001 00000000 0x0 0x0
0xffff8b0000018900 0001 00000000 0x0 0x0
0xffff8b0000018980 0001 00000000 0x0 0x0
0xffff8b0000018a00 0001 00000000 0x0 0x0
0xffff8b0000018a80 0001 00000000 0x0 0x0
0xffff8b0000018b00 0001 00000000 0x0 0x0
0xffff8b0000018b80 0001 00000000 0x0 0x0
0xffff8b0000018c00 0001 00000000 0x0 0x0
0xffff8b0000018c80 0001 00000000 0x0 0x0
0xffff8b0000018d00 0001 00000000 0x0 0x0
0xffff8b0000018d80 0001 00000000 0x0 0x0
0xffff8b0000018e00 0001 00000000 0x0 0x0
0xffff8b0000018e80 0001 00000000 0x0 0x0
0xffff8b0000018f00 0001 00000000 0x0 0x0
0xffff8b0000018f80 0001 00000000 0x0 0x0
0xffff8b0000019000 0001 00000000 0x0 0x0
0xffff8b0000019080 0001 00000000 0x0 0x0
0xffff8b0000019100 0001 00000000 0x0 0x0
0xffff8b0000019180 0001 00000000 0x0 0x0
0xffff8b0000019200 0001 00000000 0x0 0x0
0xffff8b0000019280 0001 00000000 0x0 0x0
0xffff8b0000019300 0001 00000000 0x0 0x0
0xffff8b0000019380 0041 00000000 0x0 0x0
0xffff8b0000019400 0041 00000000 0x0 0x0
0xffff8b0000019480 0041 00000000 0x0 0x0
0xffff8b0000019500 0041 00000000 0x0 0x0
0xffff8b0000019580 0041 00000000 0x0 0x0
0xffff8b0000019600 0045 00000000 0x0 0x0
0xffff8b0000019680 0045 00000000 0x0 0x0
0xffff8b0000019700 0041 00000000 0x0 0x0
0xffff8b0000019780 0041 00000000 0x0 0x0
0xffff8b0000019800 0041 00000000 0x0 0x0
0xffff8b0000019880 0041 00000000 0x0 0x0
0xffff8b0000019900 0041 00000000 0x0 0x0
0xffff8b0000019980 0041 00000000 0x0 0x0
0xffff8b0000019a00 0045 00000000 0x0 0x0
0xffff8b0000019a80 0045 00000000 0x0 0x0
0xffff8b0000019b00 0041 00000000 0x0 0x0
0xffff8b0000019b80 0041 00000000 0x0 0x0
0xffff8b0000019c00 0041 00000000 0x0 0x0
0xffff8b0000019c80 0041 00000000 0x0 0x0
0xffff8b0000019d00 0041 00000000 0x0 0x0
0xffff8b0000019d80 0041 00000000 0x0 0x0
0xffff8b0000019e00 0045 00000000 0x0 0x0
0xffff8b0000019e80 0045 00000000 0x0 0x0
0xffff8b0000019f00 0041 00000000 0x0 0x0
0xffff8b0000019f80 0045 00000000 0x0 0x0
0xffff8b000001a000 0041 00000000 0x0 0x0
0xffff8b000001a080 0041 00000000 0x0 0x0
0xffff8b000001a100 0041 00000000 0x0 0x0
0xffff8b000001a180 0045 00000000 0x0 0x0
0xffff8b000001a200 0045 00000000 0x0 0x0
0xffff8b000001a280 0045 00000000 0x0 0x0
0xffff8b000001a300 0041 00000000 0x0 0x0
0xffff8b000001a380 0045 00000000 0x0 0x0
0xffff8b000001a400 0041 00000000 0x0 0x0
0xffff8b000001a480 0041 00000000 0x0 0x0
0xffff8b000001a500 0041 00000000 0x0 0x0
0xffff8b000001a580 0045 00000000 0x0 0x0
0xffff8b000001a600 0045 00000000 0x0 0x0
0xffff8b000001a680 0045 00000000 0x0 0x0
0xffff8b000001a700 0045 00000000 0x0 0x0
0xffff8b000001a780 0045 00000000 0x0 0x0
0xffff8b000001a800 0041 00000000 0x0 0x0
0xffff8b000001a880 0001 00000000 0x0 0x0
0xffff8b000001a900 0001 00000000 0x0 0x0
0xffff8b000001a980 0001 00000000 0x0 0x0
0xffff8b000001aa00 0001 00000000 0x0 0x0
0xffff8b000001aa80 0001 00000000 0x0 0x0
0xffff8b000001ab00 0001 00000000 0x0 0x0
0xffff8b000001ab80 0001 00000000 0x0 0x0
0xffff8b000001ac00 0001 00000000 0x0 0x0
0xffff8b000001ac80 0001 00000000 0x0 0x0
0xffff8b000001ad00 0001 00000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Jul 31, 2020, 3:49:24 PM7/31/20

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: c1e1be8b make(1): fix undefined behavior in malformed :S m..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=14f5ebf2900000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=8832f540234b996bc5a9
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=151b5298900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=138f8168900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8832f5...@syzkaller.appspotmail.com

[ 51.7059685] panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/ufs/ufs/ufs_quota1.c:326:23, index -1 is out of range for type 'vnode *[2]'

[ 51.7238050] cpu0: Begin traceback...
[ 51.7559431] vpanic() at netbsd:vpanic+0x2d3 sys/kern/subr_prf.c:290
[ 51.8359417] isAlreadyReported() at netbsd:isAlreadyReported
executing program
[ 51.9059472] HandleOutOfBounds() at netbsd:HandleOutOfBounds+0x134 sys/../common/lib/libc/misc/ubsan.c:470
[ 51.9859476] quota1_handle_cmd_quotaon() at netbsd:quota1_handle_cmd_quotaon+0xed1 sys/ufs/ufs/ufs_quota1.c:326
[ 52.0659425] quota_handle_cmd() at netbsd:quota_handle_cmd+0xd8e quota_handle_cmd_quotaon sys/ufs/ufs/ufs_quota.c:648 [inline]
[ 52.0659425] quota_handle_cmd() at netbsd:quota_handle_cmd+0xd8e sys/ufs/ufs/ufs_quota.c:187
[ 52.1459425] ufs_quotactl() at netbsd:ufs_quotactl+0x79 sys/ufs/ufs/ufs_vfsops.c:142
[ 52.2159440] VFS_QUOTACTL() at netbsd:VFS_QUOTACTL+0xa3 sys/kern/vfs_subr.c:1401
[ 52.2959444] vfs_quotactl_quotaon() at netbsd:vfs_quotactl_quotaon+0x36 sys/kern/vfs_quotactl.c:184
[ 52.3759433] compat_50_sys_quotactl() at netbsd:compat_50_sys_quotactl+0x3c0 sys/compat/common/compat_50_quota.c:96
[ 52.4459426] sys_syscall() at netbsd:sys_syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
[ 52.4459426] sys_syscall() at netbsd:sys_syscall+0x1cf sys/kern/sys_syscall.c:77
[ 52.5259458] syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
[ 52.5259458] syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 52.5259458] syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138
[ 52.5459435] --- syscall (number 0) ---
[ 52.5759433] netbsd:syscall+0x2d5:
[ 52.5759433] cpu0: End traceback...
[ 52.5759433] fatal breakpoint trap in supervisor mode
[ 52.5883866] trap type 1 code 0 rip 0xffffffff80221a85 cs 0x8 rflags 0x246 cr2 0x7f7fff2cfba8 ilevel 0 rsp 0xffff9580bf37f660
[ 52.6013822] curlwp 0xffffecb5dbe32140 pid 1099.1099 lowest kstack 0xffff9580bf37b2c0
Stopped in pid 1099.1099 (syz-executor8474) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x2d3 sys/kern/subr_prf.c:290
isAlreadyReported() at netbsd:isAlreadyReported
HandleOutOfBounds() at netbsd:HandleOutOfBounds+0x134 sys/../common/lib/libc/misc/ubsan.c:470
quota1_handle_cmd_quotaon() at netbsd:quota1_handle_cmd_quotaon+0xed1 sys/ufs/ufs/ufs_quota1.c:326
quota_handle_cmd() at netbsd:quota_handle_cmd+0xd8e quota_handle_cmd_quotaon sys/ufs/ufs/ufs_quota.c:648 [inline]
quota_handle_cmd() at netbsd:quota_handle_cmd+0xd8e sys/ufs/ufs/ufs_quota.c:187
ufs_quotactl() at netbsd:ufs_quotactl+0x79 sys/ufs/ufs/ufs_vfsops.c:142
VFS_QUOTACTL() at netbsd:VFS_QUOTACTL+0xa3 sys/kern/vfs_subr.c:1401
vfs_quotactl_quotaon() at netbsd:vfs_quotactl_quotaon+0x36 sys/kern/vfs_quotactl.c:184
compat_50_sys_quotactl() at netbsd:compat_50_sys_quotactl+0x3c0 sys/compat/common/compat_50_quota.c:96

sys_syscall() at netbsd:sys_syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
sys_syscall() at netbsd:sys_syscall+0x1cf sys/kern/sys_syscall.c:77

syscall() at netbsd:syscall+0x2d5 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2d5 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2d5 sys/arch/x86/x86/syscall.c:138

--- syscall (number 0) ---

netbsd:syscall+0x2d5:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/ufs/ufs/ufs_quota1.c:326:23, index -1 is out of range for type 'vnode *[2]'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

419 419 3 1 0 ffffecb5dbe329c0 syz-executor8474 tstile
1078 1078 2 0 0 ffffecb5da991340 syz-executor8474
1084 1084 2 0 0 ffffecb5dbe32580 syz-executor8474
1081 1081 2 0 0 ffffecb5db66b500 syz-executor8474
1070 1070 2 0 0 ffffecb5d9cbd740 syz-executor8474
1099 >1099 7 0 0 ffffecb5dbe32140 syz-executor8474
1071 >1071 7 1 0 ffffecb5d9a026c0 syz-executor8474
1074 1074 2 0 40 ffffecb5d977b240 syz-executor8474
1249 1249 2 1 40 ffffecb5d9b45540 syz-executor8474
1068 1068 2 1 40 ffffecb5d94c3a80 syz-executor8474
1250 1250 3 0 80 ffffecb5d9b45980 syz-executor8474 nanoslp
1120 1120 3 1 40080 ffffecb5d94c3200 sshd select
996 996 3 0 80 ffffecb5d9b45100 getty nanoslp
1097 1097 3 1 80 ffffecb5db66b940 getty nanoslp
1092 1092 3 1 80 ffffecb5d94c3640 getty nanoslp
1088 1088 3 0 c0 ffffecb5d92565c0 getty ttyraw
972 972 3 1 80 ffffecb5d9cbd300 sshd select
847 847 3 0 80 ffffecb5db66b0c0 powerd kqueue
735 735 3 0 80 ffffecb5d985f2c0 syslogd kqueue
595 595 3 0 80 ffffecb5d9a02280 dhcpcd poll
592 592 3 1 80 ffffecb5d977bac0 dhcpcd poll
590 590 3 0 80 ffffecb5d9cbdb80 dhcpcd poll
426 426 3 0 80 ffffecb5d977b680 dhcpcd poll
347 347 3 0 80 ffffecb5d985fb40 dhcpcd poll
346 346 3 1 80 ffffecb5d985f700 dhcpcd poll
345 345 3 0 80 ffffecb5d9a02b00 dhcpcd poll
1 1 3 0 80 ffffecb5d10fa0c0 init wait
0 833 3 0 200 ffffecb5d9256a00 physiod physiod
0 166 3 0 200 ffffecb5d92d6a40 pooldrain pooldrain
0 165 2 0 240 ffffecb5d92d6600 ioflush
0 164 3 1 200 ffffecb5d92d61c0 pgdaemon pgdaemon
0 161 3 0 200 ffffecb5d9256180 usb7 usbevt
0 31 3 1 200 ffffecb5d61e19c0 usb6 usbevt
0 63 3 1 200 ffffecb5d61e1580 usb5 usbevt
0 126 3 1 200 ffffecb5d61e1140 usb4 usbevt
0 125 3 1 200 ffffecb5d3154980 usb3 usbevt
0 124 3 1 200 ffffecb5d3154540 usb2 usbevt
0 123 3 1 200 ffffecb5d3154100 usb1 usbevt
0 122 3 0 200 ffffecb5d10fa940 usb0 usbevt
0 121 3 1 200 ffffecb5d1006300 usbtask-dr usbtsk
0 120 3 0 200 ffffecb5ce54aac0 usbtask-hc usbtsk
0 119 3 0 200 ffffecb5d10fa500 npfgc0 npfgcw
0 118 3 1 200 ffffecb5d1075900 rt_free rt_free
0 117 3 1 200 ffffecb5d10754c0 unpgc unpgc
0 116 3 1 200 ffffecb5d1075080 key_timehandler key_timehandler
0 115 3 1 200 ffffecb5d10988c0 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffffecb5d1098480 icmp6_wqinput/0 icmp6_wqinput
0 113 2 0 200 ffffecb5d1098040 nd6_timer
0 112 3 1 200 ffffecb5d1043bc0 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffffecb5d1043780 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffffecb5d1043340 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffffecb5d1006b80 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffffecb5d1001700 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffffecb5d1001b40 icmp_wqinput/0 icmp_wqinput
0 106 2 0 200 ffffecb5d10012c0 rt_timer
0 105 2 0 200 ffffecb5d1006740 vmem_rehash
0 104 3 0 200 ffffecb5d0998b00 entbutler entropy
0 30 3 1 200 ffffecb5d09986c0 vioif0_txrx/1 vioif0_txrx
0 29 2 0 200 ffffecb5d0998280 vioif0_txrx/0
0 27 3 0 200 ffffecb5ce54a680 scsibus0 sccomp
0 26 3 0 200 ffffecb5ce54a240 pms0 pmsreset
0 25 3 1 200 ffffecb5ce47ca80 xcall/1 xcall
0 24 1 1 200 ffffecb5ce47c640 softser/1
0 23 1 1 200 ffffecb5ce47c200 softclk/1
0 22 1 1 200 ffffecb5ce44fa40 softbio/1
0 21 1 1 200 ffffecb5ce44f600 softnet/1
0 20 1 1 201 ffffecb5ce44f1c0 idle/1
0 19 3 0 200 ffffecb6de38fa00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffffecb6de38f5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffffecb6de38f180 lnxsyswq lnxsyswq
0 16 3 0 200 ffffecb6de39c9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffecb6de39c580 sysmon smtaskq
0 14 3 0 200 ffffecb6de39c140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffecb6de3b9980 pmfevent pmfevent
0 12 3 0 200 ffffecb6de3b9540 sopendfree sopendfr
0 11 3 0 200 ffffecb6de3b9100 iflnkst iflnkst
0 10 3 0 200 ffffecb6df3d8940 nfssilly nfssilly
0 9 3 0 200 ffffecb6df3d8500 vdrain vdrain
0 8 3 0 200 ffffecb6df3d80c0 modunload mod_unld
0 7 3 0 200 ffffecb6df413900 xcall/0 xcall
0 6 1 0 200 ffffecb6df4134c0 softser/0
0 5 1 0 200 ffffecb6df413080 softclk/0
0 4 1 0 200 ffffecb6df43d8c0 softbio/0
0 3 1 0 200 ffffecb6df43d480 softnet/0
0 2 1 0 201 ffffecb6df43d040 idle/0

0 0 2 0 240 ffffffff85efbcc0 swapper
[Locks tracked through LWPs]

****** LWP 419.419 (syz-executor8474) @ 0xffffecb5dbe329c0, l_stat=3

*** Locks held:

* Lock 0 (initialized at pmap_ctor)

lock address : 0xffffecb5d964bf80 type : sleep/adaptive

initialized : 0xffffffff80f83ea3
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1

relevant lwp : 0xffffecb5dbe329c0 last held: 0xffffecb5dbe329c0

last locked* : 0xffffffff80f86557 unlocked : 0xffffffff80f83be6

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1084.1084 (syz-executor8474) @ 0xffffecb5dbe32580, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at amap_alloc1)
lock address : 0xffffecb5dbe1aac0 type : sleep/adaptive
initialized : 0xffffffff830ef20c

shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1

relevant cpu : 0 last held: 1
relevant lwp : 0xffffecb5dbe32580 last held: 000000000000000000
last locked : 0xffffffff8311291c unlocked*: 0xffffffff8310ee58

owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 1099.1099 (syz-executor8474) @ 0xffffecb5dbe32140, l_stat=7

*** Locks held:

* Lock 0 (initialized at vfs_mountalloc)

lock address : 0xffffecb6df8ba980 type : sleep/adaptive

initialized : 0xffffffff834c0220
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffecb5dbe32140 last held: 0xffffecb5dbe32140

last locked* : 0xffffffff830d6c5f unlocked : 0xffffffff834d86a0

owner field : 0xffffecb5dbe32140 wait/spin: 1/0
Turnstile:
=> 0 waiting readers:
=> 1 waiting writers: 0xffffecb5dbe329c0

*** Locks wanted: none

****** LWP 1071.1071 (syz-executor8474) @ 0xffffecb5d9a026c0, l_stat=7

*** Locks held:

* Lock 0 (initialized at amap_alloc1)
lock address : 0xffffecb5dbe1aa80 type : sleep/adaptive
initialized : 0xffffffff830ef20c

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1

relevant lwp : 0xffffecb5d9a026c0 last held: 0xffffecb5d9a026c0
last locked* : 0xffffffff8311291c unlocked : 0xffffffff830f7b2a

owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at pmap_ctor)

lock address : 0xffffecb5d10d8780 type : sleep/adaptive

initialized : 0xffffffff80f83ea3
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 1

relevant lwp : 0xffffecb5d9a026c0 last held: 000000000000000000
last locked : 0xffffffff80f83aa7 unlocked*: 0xffffffff80f83be6

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 592.592 (dhcpcd) @ 0xffffecb5d977bac0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff862fa780 type : sleep/adaptive
initialized : 0xffffffff8323a6a0
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffffecb5d977bac0 last held: 000000000000000000