ASan: Unauthorized Access in union_statvfs

6 views

Skip to first unread message

syzbot

unread,

Feb 6, 2023, 5:24:44 PM2/6/23

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 887fd8f4cf5f Remove an obsolete comment.
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=104e2897480000
kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=7b37dea919e520fdf34a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/81152c2c9229/disk-887fd8f4.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/66ee4b218964/netbsd-887fd8f4.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7b37de...@syzkaller.appspotmail.com

[ 287.1012478] panic: ASan: Unauthorized Access In 0xffffffff818c6539: Addr 0xffffc98013ca7488 [8 bytes, read, PoolUseAfterFree]

[ 287.1205193] cpu0: Begin traceback...
[ 287.1312371] vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:291
[ 287.1812350] panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1059
[ 287.2212347] kasan_report() at netbsd:kasan_report+0x8f kasan_code_name sys/kern/subr_asan.c:168 [inline]
[ 287.2212347] kasan_report() at netbsd:kasan_report+0x8f sys/kern/subr_asan.c:200
[ 287.2612350] __asan_load8() at netbsd:__asan_load8+0xac kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:370 [inline]
[ 287.2612350] __asan_load8() at netbsd:__asan_load8+0xac kasan_shadow_check sys/kern/subr_asan.c:420 [inline]
[ 287.2612350] __asan_load8() at netbsd:__asan_load8+0xac sys/kern/subr_asan.c:1207
[ 287.2912371] union_statvfs() at netbsd:union_statvfs+0x44 sys/fs/union/union_vfsops.c:447
[ 287.3312361] VFS_STATVFS() at netbsd:VFS_STATVFS+0x68 sys/kern/vfs_subr.c:1482
[ 287.3612382] mount_domount() at netbsd:mount_domount+0x86c sys/kern/vfs_mount.c:907
[ 287.4012365] do_sys_mount() at netbsd:do_sys_mount+0x7a1 sys/kern/vfs_syscalls.c:616
[ 287.4312364] compat_40_sys_mount() at netbsd:compat_40_sys_mount+0xbd sys/compat/common/vfs_syscalls_40.c:88
[ 287.4712382] sys___syscall() at netbsd:sys___syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
[ 287.4712382] sys___syscall() at netbsd:sys___syscall+0x10e sys/kern/sys_syscall.c:90
[ 287.5112389] syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
[ 287.5112389] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 287.5112389] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
[ 287.5212372] --- syscall (number 21 via SYS_syscall) ---
[ 287.5312382] netbsd:syscall+0x25a:
[ 287.5418994] cpu0: End traceback...
[ 287.5418994] fatal breakpoint trap in supervisor mode
[ 287.5418994] trap type 1 code 0 rip 0xffffffff8023230d cs 0x8 rflags 0x282 cr2 0x7e5644049000 ilevel 0 rsp 0xffffc98255f0b810
[ 287.5619621] curlwp 0xffffc98013f69500 pid 5590.4002 lowest kstack 0xffffc98255f042c0
Stopped in pid 5590.4002 (syz-executor.3) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:291
panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1059
kasan_report() at netbsd:kasan_report+0x8f kasan_code_name sys/kern/subr_asan.c:168 [inline]
kasan_report() at netbsd:kasan_report+0x8f sys/kern/subr_asan.c:200
__asan_load8() at netbsd:__asan_load8+0xac kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:370 [inline]
__asan_load8() at netbsd:__asan_load8+0xac kasan_shadow_check sys/kern/subr_asan.c:420 [inline]
__asan_load8() at netbsd:__asan_load8+0xac sys/kern/subr_asan.c:1207
union_statvfs() at netbsd:union_statvfs+0x44 sys/fs/union/union_vfsops.c:447
VFS_STATVFS() at netbsd:VFS_STATVFS+0x68 sys/kern/vfs_subr.c:1482
mount_domount() at netbsd:mount_domount+0x86c sys/kern/vfs_mount.c:907
do_sys_mount() at netbsd:do_sys_mount+0x7a1 sys/kern/vfs_syscalls.c:616
compat_40_sys_mount() at netbsd:compat_40_sys_mount+0xbd sys/compat/common/vfs_syscalls_40.c:88
sys___syscall() at netbsd:sys___syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x10e sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
--- syscall (number 21 via SYS_syscall) ---
netbsd:syscall+0x25a:
Panic string: ASan: Unauthorized Access In 0xffffffff818c6539: Addr 0xffffc98013ca7488 [8 bytes, read, PoolUseAfterFree]

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
3879 3738 3 0 180 ffffc98013346980 syz-executor.1 parked
3879 3879 2 0 10040000 ffffc98012be7600 syz-executor.1
5590 5336 3 1 180 ffffc98012b89140 syz-executor.3 parked
5590 >4002 7 0 100 ffffc98013f69500 syz-executor.3
5590 5590 2 0 10040140 ffffc98012c17240 syz-executor.3
3821 5578 2 1 40100 ffffc98012b89580 syz-executor.2
3821 3941 3 0 180 ffffc9801405d340 syz-executor.2 parked
3821 >3821 7 1 10040140 ffffc980134544c0 syz-executor.2
5024 5024 3 0 1c0 ffffc980133a9a40 syz-executor.5 pipe_rd
4813 4813 3 1 1c0 ffffc98013469100 syz-executor.0 pipe_rd
483 483 3 1 1c0 ffffc98012d66780 syz-executor.4 pipe_rd
324 324 3 0 180 ffffc98013edb740 syz-executor.4 parked
322 1351 3 1 1000000 ffffc98013cf7600 syz-executor.4 lwpwait
322 323 3 0 11100000 ffffc98013f15340 syz-executor.4 vfork
406 406 3 0 180 ffffc98014036b00 syz-executor.4 parked
405 405 3 0 0 ffffc980140366c0 syz-executor.4 vfork
404 404 3 0 0 ffffc98014036280 syz-executor.4 vfork
403 403 3 0 0 ffffc98014023ac0 syz-executor.4 vfork
402 402 3 0 0 ffffc98014023680 syz-executor.4 vfork
401 401 3 0 0 ffffc98013430b80 syz-executor.4 vfork
400 400 3 0 0 ffffc98013430740 syz-executor.4 vfork
399 399 3 0 0 ffffc9801343f340 syz-executor.4 vfork
396 396 3 0 0 ffffc98014023240 syz-executor.4 vfork
395 395 3 0 0 ffffc9801401f200 syz-executor.4 vfork
394 394 3 0 0 ffffc98014014a40 syz-executor.4 vfork
393 393 3 0 0 ffffc98014014600 syz-executor.4 vfork
392 392 3 0 0 ffffc980140141c0 syz-executor.4 vfork
391 391 3 0 0 ffffc9801400ba00 syz-executor.4 vfork
390 390 3 0 0 ffffc9801400b5c0 syz-executor.4 vfork
389 389 3 0 0 ffffc9801400b180 syz-executor.4 vfork
388 388 3 0 0 ffffc980140029c0 syz-executor.4 vfork
387 387 3 0 0 ffffc98014002580 syz-executor.4 vfork
386 386 3 0 0 ffffc98014002140 syz-executor.4 vfork
385 385 3 0 0 ffffc98012d0aac0 syz-executor.4 vfork
384 384 3 0 0 ffffc98012d0a680 syz-executor.4 vfork
1624 1624 3 0 0 ffffc98012d0a240 syz-executor.4 vfork
1590 1590 3 0 0 ffffc98012d17b00 syz-executor.4 vfork
1568 1568 3 0 0 ffffc98012d38b80 syz-executor.4 vfork
1592 1592 3 0 0 ffffc98012d38300 syz-executor.4 vfork
1712 1712 3 0 0 ffffc98012dd7940 syz-executor.4 vfork
1707 1707 3 0 0 ffffc98012dd7500 syz-executor.4 vfork
1719 1719 3 0 0 ffffc98013346540 syz-executor.4 vfork
1618 1618 3 0 0 ffffc980133689c0 syz-executor.4 vfork
716 716 3 0 0 ffffc9801338e5c0 syz-executor.4 vfork
1869 1869 3 0 0 ffffc9801338e180 syz-executor.4 vfork
1630 1630 3 0 0 ffffc98012ac30c0 syz-executor.4 vfork
1878 1878 3 0 0 ffffc98012b899c0 syz-executor.4 vfork
1586 398 3 1 1000000 ffffc9801401fa80 syz-executor.4 lwpwait
1586 1632 3 0 1100000 ffffc980133db280 syz-executor.4 vfork
1332 1332 3 1 180 ffffc98012cb4940 syz-executor.4 parked
331 453 3 1 1000000 ffffc98012c84340 syz-executor.4 lwpwait
331 336 3 1 11100000 ffffc98013f5e080 syz-executor.4 vfork
1236 1236 2 1 140 ffffc98013e1a680 syz-executor.3
1247 1247 2 1 140 ffffc98013dd6a80 syz-executor.2
829 829 2 1 140 ffffc98013dd6640 syz-executor.1
1235 1638 3 1 180 ffffc9801406a040 syz-fuzzer kqueue
1235 1209 3 1 180 ffffc98013ebbb40 syz-fuzzer wait
1235 1111 3 0 180 ffffc98013e37280 syz-fuzzer parked
1235 1384 3 0 1c0 ffffc98013e1aac0 syz-fuzzer parked
1235 449 3 0 180 ffffc98013e1a240 syz-fuzzer wait
1235 1115 3 1 180 ffffc98012a95080 syz-fuzzer parked
1235 1130 3 0 180 ffffc98013cf7a40 syz-fuzzer wait
1235 1244 3 0 180 ffffc98013cf71c0 syz-fuzzer wait
1235 942 3 1 180 ffffc98013494a00 syz-fuzzer parked
1235 1132 3 1 180 ffffc980134945c0 syz-fuzzer wait
1235 945 3 0 180 ffffc98013494180 syz-fuzzer parked
1235 1233 3 1 1c0 ffffc980126d7740 syz-fuzzer wait
1235 1231 3 1 180 ffffc980126dabc0 syz-fuzzer parked
1235 1235 3 0 180 ffffc9801338ea00 syz-fuzzer parked
1223 1223 3 1 180 ffffc98012a95900 sshd select
1222 1222 3 1 180 ffffc980133b9a80 getty nanoslp
1224 1224 3 0 180 ffffc980133c5ac0 getty nanoslp
1151 1151 3 0 180 ffffc980133c5240 getty nanoslp
1216 1216 3 0 1c0 ffffc980126da340 getty ttyraw
819 819 3 1 180 ffffc980133b9640 sshd select
1097 1097 3 1 180 ffffc98012d38740 powerd kqueue
699 699 3 1 180 ffffc9801341fb40 syslogd kqueue
605 605 3 0 180 ffffc98012c4ab40 dhcpcd poll
559 559 3 1 180 ffffc98012cb4500 dhcpcd poll
747 747 3 0 180 ffffc98012c276c0 dhcpcd poll
602 602 3 1 180 ffffc98012c4a700 dhcpcd poll
292 292 3 0 180 ffffc98012d9d900 dhcpcd poll
485 485 3 1 180 ffffc98012d9d4c0 dhcpcd poll
291 291 3 0 180 ffffc98012d9d080 dhcpcd poll
1 1 3 0 180 ffffc98012867180 init wait
0 4401 5 1 200 ffffc9801345e0c0 (zombie)
0 673 3 0 200 ffffc980129916c0 physiod physiod
0 196 3 1 200 ffffc98012994700 pooldrain pooldrain
0 195 3 0 200 ffffc980129942c0 ioflush syncer
0 194 3 0 200 ffffc98012991b00 pgdaemon pgdaemon
0 167 3 1 200 ffffc98012950ac0 usb7 usbevt
0 172 3 0 200 ffffc98012950680 usb6 usbevt
0 170 2 0 240 ffffc98012950240 usb5
0 168 3 1 200 ffffc98012905a80 usb4 usbevt
0 166 3 0 200 ffffc98012905640 usb3 usbevt
0 165 2 0 240 ffffc98012905200 usb2
0 31 3 0 200 ffffc980128c9a40 usb1 usbevt
0 63 3 0 200 ffffc980128c9600 usb0 usbevt
0 126 3 1 200 ffffc980128c91c0 usbtask-dr usbtsk
0 125 3 1 200 ffffc98012867a00 usbtask-hc usbtsk
0 124 3 0 200 ffffc98010d76b00 swwreboot swwreboot
0 123 3 0 200 ffffc980128675c0 npfgc0 npfgcw
0 122 3 1 200 ffffc9801285a9c0 rt_free rt_free
0 121 3 1 200 ffffc9801285a580 unpgc unpgc
0 120 3 0 200 ffffc9801285a140 key_timehandler key_timehandler
0 119 3 1 200 ffffc9801270a980 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffc9801270a540 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffffc9801270a100 nd6_timer nd6_timer
0 116 3 1 200 ffffc98012703940 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffc98012703500 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffc980127030c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffc980126f4900 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffc980126f44c0 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffc980126f4080 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffffc980126db8c0 rt_timer rt_timer
0 109 3 1 200 ffffc980126db040 vmem_rehash vmem_rehash
0 100 3 0 200 ffffc980126d7300 entbutler entropy
0 99 3 0 200 ffffc980120bcb40 viomb balloon
0 98 3 1 200 ffffc980120bc700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffc980120bc2c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 ffffc98010d766c0 scsibus0 sccomp
0 29 3 0 200 ffffc98010d76280 pms0 pmsreset
0 28 3 1 200 ffffc98010cbcac0 xcall/1 xcall
0 27 1 1 200 ffffc98010cbc680 softser/1
0 26 1 1 200 ffffc98010cbc240 softclk/1
0 25 1 1 200 ffffc98010cb9a80 softbio/1
0 24 1 1 200 ffffc98010cb9640 softnet/1
0 23 1 1 201 ffffc98010cb9200 idle/1
0 22 3 0 200 ffffc9800fb56a40 lnxsyswq lnxsyswq
0 21 3 0 200 ffffc9800fb56600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffc9800fb561c0 lnxpwrwq lnxpwrwq
0 19 3 0 200 ffffc9800fb55a00 lnxlngwq lnxlngwq
0 18 3 0 200 ffffc9800fb555c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffffc9800fb55180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffc9800fb4e9c0 sysmon smtaskq
0 15 3 0 200 ffffc9800fb4e580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffc9800fb4e140 pmfevent pmfevent
0 13 3 0 200 ffffc9800fb49980 sopendfree sopendfr
0 12 3 0 200 ffffc9800fb49540 ifwdog ifwdog
0 11 3 0 200 ffffc9800fb49100 iflnkst iflnkst
0 10 3 0 200 ffffc9800fb3c940 nfssilly nfssilly
0 9 3 0 200 ffffc9800fb3c500 vdrain vdrain
0 8 3 1 200 ffffc9800fb3c0c0 modunload mod_unld
0 7 3 0 200 ffffc9800fb33900 xcall/0 xcall
0 6 1 0 200 ffffc9800fb334c0 softser/0
0 5 1 0 200 ffffc9800fb33080 softclk/0
0 4 1 0 200 ffffc9800fb318c0 softbio/0
0 3 1 0 200 ffffc9800fb31480 softnet/0
0 2 1 0 201 ffffc9800fb31040 idle/0
0 0 3 0 200 ffffffff83347380 swapper uvm
[Locks tracked through LWPs]

****** LWP 3821.5578 (syz-executor.2) @ 0xffffc98012b89580, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:vhci_attach+0x129 sys/dev/usb/vhci.c:1283)
lock address : ffffc9801269f6f0
type : sleep/adaptive
initialized : netbsd:vhci_attach+0x129
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffffc98012b89580 last held: 0xffffc98012b89580
last locked* : netbsd:vhci_fd_read+0x14f
unlocked : netbsd:vhci_fd_read+0x475
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 559.559 (dhcpcd) @ 0xffffc98012cb4500, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffc98012cb4500 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 747.747 (dhcpcd) @ 0xffffc98012c276c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc98012c276c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xffffc98012d9d4c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffc98012d9d4c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xffffc98012d9d080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc98012d9d080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffc9800fb49100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc9800fb49100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffc9800fb33080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc9800fb33080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff83347380, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff83347380 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at netbsd:kprintf_init+0x61 sys/kern/subr_prf.c:155)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x61
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffc98013f69500 last held: 0xffffc98013f69500
last locked* : netbsd:kprintf_lock+0x33
unlocked : netbsd:kprintf_unlock+0x53
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffffc98000017180 0041 00000000 0x0 0x0
0xffffc98000017200 0041 00000000 0x0 0x0
0xffffc98000017280 0041 00000000 0x0 0x0
0xffffc98000017300 0041 00000000 0x0 0x0
0xffffc98000017380 0041 00000000 0x0 0x0
0xffffc98000017400 0041 00000000 0x0 0x0
0xffffc98000017480 0041 00000000 0x0 0x0
0xffffc98000017500 0041 00000000 0x0 0x0
0xffffc98000017580 0041 00000000 0x0 0x0
0xffffc98000017600 0041 00000000 0x0 0x0
0xffffc98000017680 0041 00000000 0x0 0x0
0xffffc98000017700 0041 00000000 0x0 0x0
0xffffc98000017780 0041 00000000 0x0 0x0
0xffffc98000017800 0041 00000000 0x0 0x0
0xffffc98000017880 0041 00000000 0x0 0x0
0xffffc98000017900 0041 00000000 0x0 0x0
0xffffc98000017980 0041 00000000 0x0 0x0
0xffffc98000017a00 0041 00000000 0x0 0x0
0xffffc98000017a80 0041 00000000 0x0 0x0
0xffffc98000017b00 0041 00000000 0x0 0x0
0xffffc98000017b80 0041 00000000 0x0 0x0
0xffffc98000017c00 0041 00000000 0x0 0x0
0xffffc98000017c80 0041 00000000 0x0 0x0
0xffffc98000017d00 0041 00000000 0x0 0x0
0xffffc98000017d80 0041 00000000 0x0 0x0
0xffffc98000017e00 0041 00000000 0x0 0x0
0xffffc98000017e80 0041 00000000 0x0 0x0
0xffffc98000017f00 0041 00000000 0x0 0x0
0xffffc98000017f80 0041 00000000 0x0 0x0
0xffffc98000018000 0041 00000000 0x0 0x0
0xffffc98000018080 0041 00000000 0x0 0x0
0xffffc98000018100 0041 00000000 0x0 0x0
0xffffc98000018180 0041 00000000 0x0 0x0
0xffffc98000018200 0041 00000000 0x0 0x0
0xffffc98000018280 0041 00000000 0x0 0x0
0xffffc98000018300 0041 00000000 0x0 0x0
0xffffc98000018380 0041 00000000 0x0 0x0
0xffffc98000018400 0041 00000000 0x0 0x0
0xffffc98000018480 0041 00000000 0x0 0x0
0xffffc98000018500 0041 00000000 0x0 0x0
0xffffc98000018580 0041 00000000 0x0 0x0
0xffffc98000018600 0041 00000000 0x0 0x0
0xffffc98000018680 0041 00000000 0x0 0x0
0xffffc98000018700 0041 00000000 0x0 0x0
0xffffc98000018780 0041 00000000 0x0 0x0
0xffffc98000018800 0041 00000000 0x0 0x0
0xffffc98000018880 0041 00000000 0x0 0x0
0xffffc98000018900 0041 00000000 0x0 0x0
0xffffc98000018980 0041 00000000 0x0 0x0
0xffffc98000018a00 0041 00000000 0x0 0x0
0xffffc98000018a80 0041 00000000 0x0 0x0
0xffffc98000018b00 0041 00000000 0x0 0x0
0xffffc98000018b80 0041 00000000 0x0 0x0
0xffffc98000018c00 0041 00000000 0x0 0x0
0xffffc98000018c80 0041 00000000 0x0 0x0
0xffffc98000018d00 0041 00000000 0x0 0x0
0xffffc98000018d80 0041 00000000 0x0 0x0
0xffffc98000018e00 0041 00000000 0x0 0x0
0xffffc98000018e80 0041 00000000 0x0 0x0
0xffffc98000018f00 0041 00000000 0x0 0x0
0xffffc98000018f80 0041 00000000 0x0 0x0
0xffffc98000019000 0041 00000000 0x0 0x0
0xffffc98000019080 0041 00000000 0x0 0x0
0xffffc98000019100 0041 00000000 0x0 0x0
0xffffc98000019180 0041 00000000 0x0 0x0
0xffffc98000019200 0041 00000000 0x0 0x0
0xffffc98000019280 0041 00000000 0x0 0x0
0xffffc98000019300 0041 00000000 0x0 0x0
0xffffc98000019380 0041 00000000 0x0 0x0
0xffffc98000019400 0041 00000000 0x0 0x0
0xffffc98000019480 0041 00000000 0x0 0x0
0xffffc98000019500 0041 00000000 0x0 0x0
0xffffc98000019580 0041 00000000 0x0 0x0
0xffffc98000019600 0041 00000000 0x0 0x0
0xffffc98000019680 0041 00000000 0x0 0x0
0xffffc98000019700 0041 00000000 0x0 0x0
0xffffc98000019780 0041 00000000 0x0 0x0
0xffffc98000019800 0041 00000000 0x0 0x0
0xffffc98000019880 0041 00000000 0x0 0x0
0xffffc98000019900 0041 00000000 0x0 0x0
0xffffc98000019980 0041 00000000 0x0 0x0
0xffffc98000019a00 0041 00000000 0x0 0x0
0xffffc98000019a80 0041 00000000 0x0 0x0
0xffffc98000019b00 0041 00000000 0x0 0x0
0xffffc98000019b80 0041 00000000 0x0 0x0
0xffffc98000019c00 0041 00000000 0x0 0x0
0xffffc98000019c80 0041 00000000 0x0 0x0
0xffffc98000019d00 0041 00000000 0x0 0x0
0xffffc98000019d80 0041 00000000 0x0 0x0
0xffffc98000019e00 0041 00000000 0x0 0x0
0xffffc98000019e80 0041 00000000 0x0 0x0
0xffffc98000019f00 0041 00000000 0x0 0x0
0xffffc98000019f80 0041 00000000 0x0 0x0
0xffffc9800001a000 0041 00000000 0x0 0x0
0xffffc9800001a080 0041 00000000 0x0 0x0
0xffffc9800001a100 0041 00000000 0x0 0x0
0xffffc9800001a180 0041 00000000 0x0 0x0
0xffffc9800001a200 0041 00000000 0x0 0x0
0xffffc9800001a280 0041 00000000 0x0 0x0
0xffffc9800001a300 0041 00000000 0x0 0x0
0xffffc9800001a380 0041 00000000 0x0 0x0
0xffffc9800001a400 0041 00000000 0x0 0x0
0xffffc9800001a480 0041 00000000 0x0 0x0
0xffffc9800001a500 0041 00000000 0x0 0x0
0xffffc9800001a580 0041 00000000 0x0 0x0
0xffffc9800001a600 0041 00000000 0x0 0x0
0xffffc9800001a680 0041 00000000 0x0 0x0
0xffffc9800001a700 0041 00000000 0x0 0x0
0xffffc9800001a780 0041 00000000 0x0 0x0
0xffffc9800001a800 0041 00000000 0x0 0x0
0xffffc9800001a880 0041 00000000 0x0 0x0
0xffffc9800001a900 0041 00000000 0x0 0x0
0xffffc9800001a980 0041 00000000 0x0 0x0
0xffffc9800001aa00 0041 00000000 0x0 0x0
0xffffc9800001aa80 0041 00000000 0x0 0x0
0xffffc9800001ab00 0041 00000000 0x0 0x0
0xffffc9800001ab80 0041 00000000 0x0 0x0
0xffffc9800001ac00 0041 00000000 0x0 0x0
0xffffc9800001ac80 0041 00000000 0x0 0x0
0xffffc9800001ad00 0041 00000000 0x0 0x0
0xffffc9800001ad80 0041 00000000 0x0 0x0
0xffffc9800001ae00 0041 00000000 0x0 0x0
0xffffc9800001ae80 0041 00000000 0x0 0x0
0xffffc9800001af00 0041 00000000 0x0 0x0
0xffffc9800001af80 0041 00000000 0x0 0x0
0xffffc9800001b000 0041 00000000 0x0 0x0
0xffffc9800001b080 0041 00000000 0x0 0x0
0xffffc9800001b100 0041 00000000 0x0 0x0
0xffffc9800001b180 0041 00000000 0x0 0x0
0xffffc9800001b200 0041 00000000 0x0 0x0
0xffffc9800001b280 0041 00000000 0x0 0x0
0xffffc9800001b300 0041 00000000 0x0 0x0
0xffffc9800001b380 0041 00000000 0x0 0x0
0xffffc9800001b400 0041 00000000 0x0 0x0
0xffffc9800001b480 0041 00000000 0x0 0x0
0xffffc9800001b500 0041 00000000 0x0 0x0
0xffffc9800001b580 0041 00000000 0x0 0x0
0xffffc9800001b600 0041 00000000 0x0 0x0
0xffffc9800001b680 0041 00000000 0x0 0x0
0xffffc9800001b700 0041 00000000 0x0 0x0
0xffffc9800001b780 0041 00000000 0x0 0x0
0xffffc9800001b800 0041 00000000 0x0 0x0
0xffffc9800001b880 0041 00000000 0x0 0x0
0xffffc9800001b900 0041 00000000 0x0 0x0
0xffffc9800001b980 0041 00000000 0x0 0x0
0xffffc9800001ba00 0041 00000000 0x0 0x0
0xffffc9800001ba80 0041 00000000 0x0 0x0
0xffffc9800001bb00 0041 00000000 0x0 0x0
0xffffc9800001bb80 0001 00000000 0x0 0x0
0xffffc9800001bc00 0001 00000000 0x0 0x0
0xffffc9800001bc80 0001 00000000 0x0 0x0
0xffffc9800001bd00 0001 00000000 0x0 0x0
0xffffc9800001bd80 0001 00000000 0x0 0x0
0xffffc9800001be00 0001 00000000 0x0 0x0
0xffffc9800001be80 0001 00000000 0x0 0x0
0xffffc9800001bf00 0001 00000000 0x0 0x0
0xffffc9800001bf80 0001 00000000 0x0 0x0
0xffffc9800001c000 0001 00000000 0x0 0x0
0xffffc9800001c080 0001 00000000 0x0 0x0
0xffffc9800001c100 0001 00000000 0x0 0x0
0xffffc9800001c180 0001 00000000 0x0 0x0
0xffffc9800001c200 0001 00000000 0x0 0x0
0xffffc9800001c280 0001 00000000 0x0 0x0
0xffffc9800001c300 0001 00000000 0x0 0x0
0xffffc9800001c380 0001 00000000 0x0 0x0
0xffffc9800001c400 0001 00000000 0x0 0x0
0xffffc9800001c480 0001 00000000 0x0 0x0
0xffffc9800001c500 0001 00000000 0x0 0x0
0xffffc9800001c580 0001 00000000 0x0 0x0
0xffffc9800001c600 0001 00000000 0x0 0x0
0xffffc9800001c680 0001 00000000 0x0 0x0
0xffffc9800001c700 0001 00000000 0x0 0x0
0xffffc9800001c780 0001 00000000 0x0 0x0
0xffffc9800001c800 0001 00000000 0x0 0x0
0xffffc9800001c880 0001 00000000 0x0 0x0
0xffffc9800001c900 0001 00000000 0x0 0x0
0xffffc9800001c980 0001 00000000 0x0 0x0
0xffffc9800001ca00 0001 00000000 0x0 0x0
0xffffc9800001ca80 0001 00000000 0x0 0x0
0xffffc9800001cb00 0001 00000000 0x0 0x0
0xffffc9800001cb80 0001 00000000 0x0 0x0
0xffffc9800001cc00 0001 00000000 0x0 0x0
0xffffc9800001cc80 0001 00000000 0x0 0x0
0xffffc9800001cd00 0001 00000000 0x0 0x0
0xffffc9800001cd80 0001 00000000 0x0 0x0
0xffffc9800001ce00 0001 00000000 0x0 0x0
0xffffc9800001ce80 0001 00000000 0x0 0x0
0xffffc9800001cf00 0001 00000000 0x0 0x0
0xffffc9800001cf80 0001 00000000 0x0 0x0
0xffffc9800001d000 0001 00000000 0x0 0x0
0xffffc9800001d080 0001 00000000 0x0 0x0
0xffffc9800001d100 0001 00000000 0x0 0x0
0xffffc9800001d180 0001 00000000 0x0 0x0
0xffffc9800001d200 0001 00000000 0x0 0x0
0xffffc9800001d280 0001 00000000 0x0 0x0
0xffffc9800001d300 0001 00000000 0x0 0x0
0xffffc9800001d380 0001 00000000 0x0 0x0
0xffffc9800001d400 0001 00000000 0x0 0x0
0xffffc9800001d480 0001 00000000 0x0 0x0
0xffffc9800001d500 0001 00000000 0x0 0x0
0xffffc9800001d580 0001 00000000 0x0 0x0
0xffffc9800001d600 0001 00000000 0x0 0x0
0xffffc9800001d680 0001 00000000 0x0 0x0
0xffffc9800001d700 0001 00000000 0x0 0x0
0xffffc9800001d780 0001 00000000 0x0 0x0
0xffffc9800001d800 0001 00000000 0x0 0x0
0xffffc9800001d880 0001 00000000 0x0 0x0
0xffffc9800001d900 0001 00000000 0x0 0x0
0xffffc9800001d980 0001 00000000 0x0 0x0
0xffffc9800001da00 0001 00000000 0x0 0x0
0xffffc9800001da80 0001 00000000 0x0 0x0
0xffffc9800001db00 0001 00000000 0x0 0x0
0xffffc9800001db80 0001 00000000 0x0 0x0
0xffffc9800001dc00 0001 00000000 0x0 0x0
0xffffc9800001dc80 0001 00000000 0x0 0x0
0xffffc9800001dd00 0001 00000000 0x0 0x0
0xffffc9800001dd80 0001 00000000 0x0 0x0
0xffffc9800001de00 0001 00000000 0x0 0x0
0xffffc9800001de80 0001 00000000 0x0 0x0
0xffffc9800001df00 0001 00000000 0x0 0x0
0xffffc9800001df80 0001 00000000 0x0 0x0
0xffffc9800001e000 0001 00000000 0x0 0x0
0xffffc9800001e080 0001 00000000 0x0 0x0
0xffffc9800001e100 0001 00000000 0x0 0x0
0xffffc9800001e180 0001 00000000 0x0 0x0
0xffffc9800001e200 0001 00000000 0x0 0x0
0xffffc9800001e280 0001 00000000 0x0 0x0
0xffffc9800001e300 0001 00000000 0x0 0x0
0xffffc9800001e380 0001 00000000 0x0 0x0
0xffffc9800001e400 0001 00000000 0x0 0x0
0xffffc9800001e480 0001 00000000 0x0 0x0
0xffffc9800001e500 0001 00000000 0x0 0x0
0xffffc9800001e580 0001 00000000 0x0 0x0
0xffffc9800001e600 0001 00000000 0x0 0x0
0xffffc9800001e680 0001 00000000 0x0 0x0
0xffffc9800001e700 0001 00000000 0x0 0x0
0xffffc9800001e780 0001 00000000 0x0 0x0
0xffffc9800001e800 0001 00000000 0x0 0x0
0xffffc9800001e880 0001 00000000 0x0 0x0
0xffffc9800001e900 0001 00000000 0x0 0x0
0xffffc9800001e980 0001 00000000 0x0 0x0
0xffffc9800001ea00 0001 00000000 0x0 0x0
0xffffc9800001ea80 0001 00000000 0x0 0x0
0xffffc9800001eb00 0001 00000000 0x0 0x0
0xffffc9800001eb80 0001 00000000 0x0 0x0
0xffffc9800001ec00 0001 00000000 0x0 0x0
0xffffc9800001ec80 0001 00000000 0x0 0x0
0xffffc9800001ed00 0001 00000000 0x0 0x0
0xffffc9800001ed80 0001 00000000 0x0 0x0
0xffffc9800001ee00 0001 00000000 0x0 0x0
0xffffc9800001ee80 0001 00000000 0x0 0x0
0xffffc9800001ef00 0001 00000000 0x0 0x0
0xffffc9800001ef80 0001 00000000 0x0 0x0
0xffffc9800001f000 0001 00000000 0x0 0x0
0xffffc9800001f080 0001 00000000 0x0 0x0
0xffffc9800001f100 0001 00000000 0x0 0x0
0xffffc9800001f180 0001 00000000 0x0 0x0
0xffffc9800001f200 0001 00000000 0x0 0x0
0xffffc9800001f280 0001 00000000 0x0 0x0
0xffffc9800001f300 0001 00000000 0x0 0x0
0xffffc9800001f380 0001 00000000 0x0 0x0
0xffffc9800001f400 0001 00000000 0x0 0x0
0xffffc9800001f480 0001 00000000 0x0 0x0
0xffffc9800001f500 0001 00000000 0x0 0x0
0xffffc9800001f580 0001 00000000 0x0 0x0
0xffffc9800001f600 0001 00000000 0x0 0x0
0xffffc9800001f680 0001 00000000 0x0 0x0
0xffffc9800001f700 0001 00000000 0x0 0x0
0xffffc9800001f780 0001 00000000 0x0 0x0
0xffffc9800001f800 0001 00000000 0x0 0x0
0xffffc9800001f880 0001 00000000 0x0 0x0
0xffffc9800001f900 0001 00000000 0x0 0x0
0xffffc9800001f980 0001 00000000 0x0 0x0
0xffffc9800001fa00 0001 00000000 0x0 0x0
0xffffc9800001fa80 0001 00000000 0x0 0x0
0xffffc9800001fb00 0001 00000000 0x0 0x0
0xffffc9800001fb80 0001 00000000 0x0 0x0
0xffffc9800001fc00 0001 00000000 0x0 0x0
0xffffc9800001fc80 0001 00000000 0x0 0x0
0xffffc9800001fd00 0001 00000000 0x0 0x0
0xffffc9800001fd80 0001 00000000 0x0 0x0
0xffffc9800001fe00 0001 00000000 0x0 0x0
0xffffc9800001fe80 0001 00000000 0x0 0x0
0xffffc9800001ff00 0001 00000000 0x0 0x0
0xffffc9800001ff80 0001 00000000 0x0 0x0
0xffffc98000020000 0001 00000000 0x0 0x0
0xffffc98000020080 0001 00000000 0x0 0x0
0xffffc98000020100 0001 00000000 0x0 0x0
0xffffc98000020180 0001 00000000 0x0 0x0
0xffffc98000020200 0001 00000000 0x0 0x0
0xffffc98000020280 0001 00000000 0x0 0x0
0xffffc98000020300 0001 00000000 0x0 0x0
0xffffc98000020380 0001 00000000 0x0 0x0
0xffffc98000020400 0001 00000000 0x0 0x0
0xffffc98000020480 0001 00000000 0x0 0x0
0xffffc98000020500 0001 00000000 0x0 0x0
0xffffc98000020580 0001 00000000 0x0 0x0
0xffffc98000020600 0001 00000000 0x0 0x0
0xffffc98000020680 0001 00000000 0x0 0x0
0xffffc98000020700 0001 00000000 0x0 0x0
0xffffc98000020780 0001 00000000 0x0 0x0
0xffffc98000020800 0001 00000000 0x0 0x0
0xffffc98000020880 0001 00000000 0x0 0x0
0xffffc98000020900 0001 00000000 0x0 0x0
0xffffc98000020980 0001 00000000 0x0 0x0
0xffffc98000020a00 0001 00000000 0x0 0x0
0xffffc98000020a80 0001 00000000 0x0 0x0
0xffffc98000020b00 0001 00000000 0x0 0x0
0xffffc98000020b80 0001 00000000 0x0 0x0
0xffffc98000020c00 0001 00000000 0x0 0x0
0xffffc98000020c80 0001 00000000 0x0 0x0
0xffffc98000020d00 0001 00000000 0x0 0x0
0xffffc98000020d80 0001 00000000 0x0 0x0
0xffffc98000020e00 0001 00000000 0x0 0x0
0xffffc98000020e80 0001 00000000 0x0 0x0
0xffffc98000020f00 0001 00000000 0x0 0x0
0xffffc98000020f80 0001 00000000 0x0 0x0
0xffffc98000021000 0001 00000000 0x0 0x0
0xffffc98000021080 0001 00000000 0x0 0x0
0xffffc98000021100 0001 00000000 0x0 0x0
0xffffc98000021180 0001 00000000 0x0 0x0
0xffffc98000021200 0001 00000000 0x0 0x0
0xffffc98000021280 0001 00000000 0x0 0x0
0xffffc98000021300 0001 00000000 0x0 0x0
0xffffc98000021380 0001 00000000 0x0 0x0
0xffffc98000021400 0001 00000000 0x0 0x0
0xffffc98000021480 0001 00000000 0x0 0x0
0xffffc98000021500 0001 00000000 0x0 0x0
0xffffc98000021580 0001 00000000 0x0 0x0
0xffffc98000021600 0001 00000000 0x0 0x0
0xffffc98000021680 0001 00000000 0x0 0x0
0xffffc98000021700 0001 00000000 0x0 0x0
0xffffc98000021780 0001 00000000 0x0 0x0
0xffffc98000021800 0001 00000000 0x0 0x0
0xffffc98000021880 0001 00000000 0x0 0x0
0xffffc98000021900 0001 00000000 0x0 0x0
0xffffc98000021980 0001 00000000 0x0 0x0
0xffffc98000021a00 0001 00000000 0x0 0x0
0xffffc98000021a80 0001 00000000 0x0 0x0
0xffffc98000021b00 0001 00000000 0x0 0x0
0xffffc98000021b80 0001 00000000 0x0 0x0
0xffffc98000021c00 0001 00000000 0x0 0x0
0xffffc98000021c80 0001 00000000 0x0 0x0
0xffffc98000021d00 0001 00000000 0x0 0x0
0xffffc98000021d80 0001 00000000 0x0 0x0
0xffffc98000021e00 0001 00000000 0x0 0x0
0xffffc98000021e80 0001 00000000 0x0 0x0
0xffffc98000021f00 0001 00000000 0x0 0x0
0xffffc98000021f80 0001 00000000 0x0 0x0
0xffffc98000022000 0001 00000000 0x0 0x0
0xffffc98000022080 0001 00000000 0x0 0x0
0xffffc98000022100 0001 00000000 0x0 0x0
0xffffc98000022180 0001 00000000 0x0 0x0
0xffffc98000022200 0001 00000000 0x0 0x0
0xffffc98000022280 0001 00000000 0x0 0x0
0xffffc98000022300 0001 00000000 0x0 0x0
0xffffc98000022380 0001 00000000 0x0 0x0
0xffffc98000022400 0001 00000000 0x0 0x0
0xffffc98000022480 0001 00000000 0x0 0x0
0xffffc98000022500 0001 00000000 0x0 0x0
0xffffc98000022580 0001 00000000 0x0 0x0
0xffffc98000022600 0001 00000000 0x0 0x0
0xffffc98000022680 0001 00000000 0x0 0x0
0xffffc98000022700 0001 00000000 0x0 0x0
0xffffc98000022780 0001 00000000 0x0 0x0
0xffffc98000022800 0001 00000000 0x0 0x0
0xffffc98000022880 0001 00000000 0x0 0x0
0xffffc98000022900 0001 00000000 0x0 0x0
0xffffc98000022980 0001 00000000 0x0 0x0
0xffffc98000022a00 0001 00000000 0x0 0x0
0xffffc98000022a80 0001 00000000 0x0 0x0
0xffffc98000022b00 0001 00000000 0x0 0x0
0xffffc98000022b80 0001 00000000 0x0 0x0
0xffffc98000022c00 0001 00000000 0x0 0x0
0xffffc98000022c80 0001 00000000 0x0 0x0
0xffffc98000022d00 0001 00000000 0x0 0x0
0xffffc98000022d80 0001 00000000 0x0 0x0
0xffffc98000022e00 0001 00000000 0x0 0x0
0xffffc98000022e80 0001 00000000 0x0 0x0
0xffffc98000022f00 0001 00000000 0x0 0x0
0xffffc98000022f80 0001 00000000 0x0 0x0
0xffffc98000023000 0001 00000000 0x0 0x0
0xffffc98000023080 0001 00000000 0x0 0x0
0xffffc98000023100 0001 00000000 0x0 0x0
0xffffc98000023180 0001 00000000 0x0 0x0
0xffffc98000023200 0001 00000000 0x0 0x0
0xffffc98000023280 0001 00000000 0x0 0x0
0xffffc98000023300 0001 00000000 0x0 0x0
0xffffc98000023380 0001 00000000 0x0 0x0
0xffffc98000023400 0001 00000000 0x0 0x0
0xffffc98000023480 0001 00000000 0x0 0x0
0xffffc98000023500 0001 00000000 0x0 0x0
0xffffc98000023580 0001 00000000 0x0 0x0
0xffffc98000023600 0001 00000000 0x0 0x0
0xffffc98000023680 0001 00000000 0x0 0x0
0xffffc98000023700 0001 00000000 0x0 0x0
0xffffc98000023780 0001 00000000 0x0 0x0
0xffffc98000023800 0001 00000000 0x0 0x0
0xffffc98000023880 0001 00000000 0x0 0x0
0xffffc98000023900 0001 00000000 0x0 0x0
0xffffc98000023980 0001 00000000 0x0 0x0
0xffffc98000023a00 0001 00000000 0x0 0x0
0xffffc98000023a80 0001 00000000 0x0 0x0
0xffffc98000023b00 0001 00000000 0x0 0x0
0xffffc98000023b80 0001 00000000 0x0 0x0
0xffffc98000023c00 0001 00000000 0x0 0x0
0xffffc98000023c80 0001 00000000 0x0 0x0
0xffffc98000023d00 0001 00000000 0x0 0x0
0xffffc98000023d80 0001 00000000 0x0 0x0
0xffffc98000023e00 0001 00000000 0x0 0x0
0xffffc98000023e80 0001 00000000 0x0 0x0
0xffffc98000023f00 0001 00000000 0x0 0x0
0xffffc98000023f80 0001 00000000 0x0 0x0
0xffffc98000024000 0001 00000000 0x0 0x0
0xffffc98000024080 0001 00000000 0x0 0x0
0xffffc98000024100 0001 00000000 0x0 0x0
0xffffc98000024180 0001 00000000 0x0 0x0
0xffffc98000024200 0001 00000000 0x0 0x0
0xffffc98000024280 0001 00000000 0x0 0x0
0xffffc98000024300 0001 00000000 0x0 0x0
0xffffc98000024380 0001 00000000 0x0 0x0
0xffffc98000024400 0001 00000000 0x0 0x0
0xffffc98000024480 0001 00000000 0x0 0x0
0xffffc98000024500 0001 00000000 0x0 0x0
0xffffc98000024580 0001 00000000 0x0 0x0
0xffffc98000024600 0001 00000000 0x0 0x0
0xffffc98000024680 0001 00000000 0x0 0x0
0xffffc98000024700 0001 00000000 0x0 0x0
0xffffc98000024780 0001 00000000 0x0 0x0
0xffffc98000024800 0001 00000000 0x0 0x0
0xffffc98000024880 0001 00000000 0x0 0x0
0xffffc98000024900 0001 00000000 0x0 0x0
0xffffc98000024980 0001 00000000 0x0 0x0
0xffffc98000024a00 0001 00000000 0x0 0x0
0xffffc98000024a80 0001 00000000 0x0 0x0
0xffffc98000024b00 0001 00000000 0x0 0x0
0xffffc98000024b80 0001 00000000 0x0 0x0
0xffffc98000024c00 0001 00000000 0x0 0x0
0xffffc98000024c80 0001 00000000 0x0 0x0
0xffffc98000024d00 0001 00000000 0x0 0x0
0xffffc98000024d80 0001 00000000 0x0 0x0
0xffffc98000024e00 0001 00000000 0x0 0x0
0xffffc98000024e80 0001 00000000 0x0 0x0
0xffffc98000024f00 0001 00000000 0x0 0x0
0xffffc98000024f80 0001 00000000 0x0 0x0
0xffffc98000025000 0001 00000000 0x0 0x0
0xffffc98000025080 0001 00000000 0x0 0x0
0xffffc98000025100 0001 00000000 0x0 0x0
0xffffc98000025180 0001 00000000 0x0 0x0
0xffffc98000025200 0001 00000000 0x0 0x0
0xffffc98000025280 0001 00000000 0x0 0x0
0xffffc98000025300 0001 00000000 0x0 0x0
0xffffc98000025380 0001 00000000 0x0 0x0
0xffffc98000025400 0001 00000000 0x0 0x0
0xffffc98000025480 0001 00000000 0x0 0x0
0xffffc98000025500 0001 00000000 0x0 0x0
0xffffc98000025580 0001 00000000 0x0 0x0
0xffffc98000025600 0001 00000000 0x0 0x0
0xffffc98000025680 0001 00000000 0x0 0x0
0xffffc98000025700 0001 00000000 0x0 0x0
0xffffc98000025780 0001 00000000 0x0 0x0
0xffffc98000025800 0001 00000000 0x0 0x0
0xffffc98000025880 0001 00000000 0x0 0x0
0xffffc98000025900 0001 00000000 0x0 0x0
0xffffc98000025980 0001 00000000 0x0 0x0
0xffffc98000025a00 0001 00000000 0x0 0x0
0xffffc98000025a80 0001 00000000 0x0 0x0
0xffffc98000025b00 0001 00000000 0x0 0x0
0xffffc98000025b80 0001 00000000 0x0 0x0
0xffffc98000025c00 0001 00000000 0x0 0x0
0xffffc98000025c80 0001 00000000 0x0 0x0
0xffffc98000025d00 0001 00000000 0x0 0x0
0xffffc98000025d80 0001 00000000 0x0 0x0
0xffffc98000025e00 0001 00000000 0x0 0x0
0xffffc98000025e80 0001 00000000 0x0 0x0
0xffffc98000025f00 0001 00000000 0x0 0x0
0xffffc98000025f80 0001 00000000 0x0 0x0
0xffffc98000026000 0001 00000000 0x0 0x0
0xffffc98000026080 0001 00000000 0x0 0x0
0xffffc98000026100 0001 00000000 0x0 0x0
0xffffc98000026180 0001 00000000 0x0 0x0
0xffffc98000026200 0001 00000000 0x0 0x0
0xffffc98000026280 0001 00000000 0x0 0x0
0xffffc98000026300 0001 00000000 0x0 0x0
0xffffc98000026380 0001 00000000 0x0 0x0
0xffffc98000026400 0001 00000000 0x0 0x0
0xffffc98000026480 0001 00000000 0x0 0x0
0xffffc98000026500 0001 00000000 0x0 0x0
0xffffc98000026580 0001 00000000 0x0 0x0
0xffffc98000026600 0001 00000000 0x0 0x0
0xffffc98000026680 0001 00000000 0x0 0x0
0xffffc98000026700 0001 00000000 0x0 0x0
0xffffc98000026780 0001 00000000 0x0 0x0
0xffffc98000026800 0001 00000000 0x0 0x0
0xffffc98000026880 0001 00000000 0x0 0x0
0xffffc98000026900 0001 00000000 0x0 0x0
0xffffc98000026980 0001 00000000 0x0 0x0
0xffffc98000026a00 0001 00000000 0x0 0x0
0xffffc98000026a80 0001 00000000 0x0 0x0
0xffffc98000026b00 0001 00000000 0x0 0x0
0xffffc98000026b80 0001 00000000 0x0 0x0
0xffffc98000026c00 0001 00000000 0x0 0x0
0xffffc98000026c80 0001 00000000 0x0 0x0
0xffffc98000026d00 0001 00000000 0x0 0x0
0xffffc98000026d80 0001 00000000 0x0 0x0
0xffffc98000026e00 0001 00000000 0x0 0x0
0xffffc98000026e80 0001 00000000 0x0 0x0
0xffffc98000026f00 0001 00000000 0x0 0x0
0xffffc98000026f80 0001 00000000 0x0 0x0
0xffffc98000027000 0001 00000000 0x0 0x0
0xffffc98000027080 0001 00000000 0x0 0x0
0xffffc98000027100 0001 00000000 0x0 0x0
0xffffc98000027180 0001 00000000 0x0 0x0
0xffffc98000027200 0001 00000000 0x0 0x0
0xffffc98000027280 0001 00000000 0x0 0x0
0xffffc98000027300 0001 00000000 0x0 0x0
0xffffc98000027380 0001 00000000 0x0 0x0
0xffffc98000027400 0001 00000000 0x0 0x0
0xffffc98000027480 0001 00000000 0x0 0x0
0xffffc98000027500 0001 00000000 0x0 0x0
0xffffc98000027580 0001 00000000 0x0 0x0
0xffffc98000027600 0001 00000000 0x0 0x0
0xffffc98000027680 0001 00000000 0x0 0x0
0xffffc98000027700 0001 00000000 0x0 0x0
0xffffc98000027780 0001 00000000 0x0 0x0
0xffffc98000027800 0001 00000000 0x0 0x0
0xffffc98000027880 0001 00000000 0x0 0x0
0xffffc98000027900 0001 00000000 0x0 0x0
0xffffc98000027980 0001 00000000 0x0 0x0
0xffffc98000027a00 0001 00000000 0x0 0x0
0xffffc98000027a80 0001 00000000 0x0 0x0
0xffffc98000027b00 0001 00000000 0x0 0x0
0xffffc98000027b80 0001 00000000 0x0 0x0
0xffffc98000027c00 0001 00000000 0x0 0x0
0xffffc98000027c80 0001 00000000 0x0 0x0
0xffffc98000027d00 0001 00000000 0x0 0x0
0xffffc98000027d80 0001 00000000 0x0 0x0
0xffffc98000027e00 0001 00000000 0x0 0x0
0xffffc98000027e80 0001 00000000 0x0 0x0
0xffffc98000027f00 0001 00000000 0x0 0x0
0xffffc98000027f80 0001 00000000 0x0 0x0
0xffffc98000028000 0001 00000000 0x0 0x0
0xffffc98000028080 0001 00000000 0x0 0x0
0xffffc98000028100 0001 00000000 0x0 0x0
0xffffc98000028180 0001 00000000 0x0 0x0
0xffffc98000028200 0001 00000000 0x0 0x0
0xffffc98000028280 0001 00000000 0x0 0x0
0xffffc98000028300 0001 00000000 0x0 0x0
0xffffc98000028380 0001 00000000 0x0 0x0
0xffffc98000028400 0001 00000000 0x0 0x0
0xffffc98000028480 0001 00000000 0x0 0x0
0xffffc98000028500 0001 00000000 0x0 0x0
0xffffc98000028580 0001 00000000 0x0 0x0
0xffffc98000028600 0001 00000000 0x0 0x0
0xffffc98000028680 0001 00000000 0x0 0x0
0xffffc98000028700 0001 00000000 0x0 0x0
0xffffc98000028780 0001 00000000 0x0 0x0
0xffffc98000028800 0001 00000000 0x0 0x0
0xffffc98000028880 0001 00000000 0x0 0x0
0xffffc98000028900 0001 00000000 0x0 0x0
0xffffc98000028980 0001 00000000 0x0 0x0
0xffffc98000028a00 0001 00000000 0x0 0x0
0xffffc98000028a80 0001 00000000 0x0 0x0
0xffffc98000028b00 0001 00000000 0x0 0x0
0xffffc98000028b80 0001 00000000 0x0 0x0
0xffffc98000028c00 0001 00000000 0x0 0x0
0xffffc98000028c80 0001 00000000 0x0 0x0
0xffffc98000028d00 0001 00000000 0x0 0x0
0xffffc98000028d80 0001 00000000 0x0 0x0
0xffffc98000028e00 0001 00000000 0x0 0x0
0xffffc98000028e80 0001 00000000 0x0 0x0
0xffffc98000028f00 0001 00000000 0x0 0x0
0xffffc98000028f80 0001 00000000 0x0 0x0
0xffffc98000029000 0001 00000000 0x0 0x0
0xffffc98000029080 0001 00000000 0x0 0x0
0xffffc98000029100 0001 00000000 0x0 0x0
0xffffc98000029180 0001 00000000 0x0 0x0
0xffffc98000029200 0001 00000000 0x0 0x0
0xffffc98000029280 0001 00000000 0x0 0x0
0xffffc98000029300 0001 00000000 0x0 0x0
0xffffc98000029380 0001 00000000 0x0 0x0
0xffffc98000029400 0001 00000000 0x0 0x0
0xffffc98000029480 0001 00000000 0x0 0x0
0xffffc98000029500 0001 00000000 0x0 0x0
0xffffc98000029580 0001 00000000 0x0 0x0
0xffffc98000029600 0001 00000000 0x0 0x0
0xffffc98000029680 0001 00000000 0x0 0x0
0xffffc98000029700 0001 00000000 0x0 0x0
0xffffc98000029780 0001 00000000 0x0 0x0
0xffffc98000029800 0001 00000000 0x0 0x0
0xffffc98000029880 0001 00000000 0x0 0x0
0xffffc98000029900 0001 00000000 0x0 0x0
0xffffc98000029980 0001 00000000 0x0 0x0
0xffffc98000029a00 0001 00000000 0x0 0x0
0xffffc98000029a80 0001 00000000 0x0 0x0
0xffffc98000029b00 0001 00000000 0x0 0x0
0xffffc98000029b80 0001 00000000 0x0 0x0
0xffffc98000029c00 0001 00000000 0x0 0x0
0xffffc98000029c80 0001 00000000 0x0 0x0
0xffffc98000029d00 0001 00000000 0x0 0x0
0xffffc98000029d80 0001 00000000 0x0 0x0
0xffffc98000029e00 0001 00000000 0x0 0x0
0xffffc98000029e80 0001 00000000 0x0 0x0
0xffffc98000029f00 0001 00000000 0x0 0x0
0xffffc98000029f80 0001 00000000 0x0 0x0
0xffffc9800002a000 0001 00000000 0x0 0x0
0xffffc9800002a080 0001 00000000 0x0 0x0
0xffffc9800002a100 0001 00000000 0x0 0x0
0xffffc9800002a180 0001 00000000 0x0 0x0
0xffffc9800002a200 0001 00000000 0x0 0x0
0xffffc9800002a280 0001 00000000 0x0 0x0
0xffffc9800002a300 0001 00000000 0x0 0x0
0xffffc9800002a380 0001 00000000 0x0 0x0
0xffffc9800002a400 0001 00000000 0x0 0x0
0xffffc9800002a480 0001 00000000 0x0 0x0
0xffffc9800002a500 0001 00000000 0x0 0x0
0xffffc9800002a580 0001 00000000 0x0 0x0
0xffffc9800002a600 0001 00000000 0x0 0x0
0xffffc9800002a680 0001 00000000 0x0 0x0
0xffffc9800002a700 0001 00000000 0x0 0x0
0xffffc9800002a780 0001 00000000 0x0 0x0
0xffffc9800002a800 0001 00000000 0x0 0x0
0xffffc9800002a880 0001 00000000 0x0 0x0
0xffffc9800002a900 0001 00000000 0x0 0x0
0xffffc9800002a980 0001 00000000 0x0 0x0
0xffffc9800002aa00 0001 00000000 0x0 0x0
0xffffc9800002aa80 0001 00000000 0x0 0x0
0xffffc9800002ab00 0001 00000000 0x0 0x0
0xffffc9800002ab80 0001 00000000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Feb 18, 2023, 11:00:54 PM2/18/23

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: b64aa7c098ba In itimer_arm_real(), KASSERT that it->it_dyi..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16cfbd80c80000

kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=7b37dea919e520fdf34a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a24f20c80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c7985dbf29da/disk-b64aa7c0.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/9a57d12ed20c/netbsd-b64aa7c0.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7b37de...@syzkaller.appspotmail.com

[ 58.6666170] panic: ASan: Unauthorized Access In 0xffffffff818c6759: Addr 0xffff9b001410c8c8 [8 bytes, read, PoolUseAfterFree]

[ 58.6766190] cpu1: Begin traceback...
[ 58.6966060] vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:291
[ 58.7566130] panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1059
[ 58.8066030] kasan_report() at netbsd:kasan_report+0x8f kasan_code_name sys/kern/subr_asan.c:168 [inline]
[ 58.8066030] kasan_report() at netbsd:kasan_report+0x8f sys/kern/subr_asan.c:200
[ 58.8566039] __asan_load8() at netbsd:__asan_load8+0xac kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:370 [inline]
[ 58.8566039] __asan_load8() at netbsd:__asan_load8+0xac kasan_shadow_check sys/kern/subr_asan.c:420 [inline]
[ 58.8566039] __asan_load8() at netbsd:__asan_load8+0xac sys/kern/subr_asan.c:1207
[ 58.8966044] union_statvfs() at netbsd:union_statvfs+0x44 sys/fs/union/union_vfsops.c:448
[ 58.9466043] VFS_STATVFS() at netbsd:VFS_STATVFS+0x68 sys/kern/vfs_subr.c:1482
[ 58.9866151] mount_domount() at netbsd:mount_domount+0x86c sys/kern/vfs_mount.c:907
[ 59.0366054] do_sys_mount() at netbsd:do_sys_mount+0x7a1 sys/kern/vfs_syscalls.c:616
[ 59.0766447] compat_40_sys_mount() at netbsd:compat_40_sys_mount+0xbd sys/compat/common/vfs_syscalls_40.c:88
[ 59.1266301] sys___syscall() at netbsd:sys___syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
[ 59.1266301] sys___syscall() at netbsd:sys___syscall+0x10e sys/kern/sys_syscall.c:90
[ 59.1666156] syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
[ 59.1666156] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 59.1666156] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
[ 59.1866014] --- syscall (number 21 via SYS_syscall) ---
[ 59.1966000] netbsd:syscall+0x25a:
[ 59.1966000] cpu1: End traceback...
[ 59.2066023] fatal breakpoint trap in supervisor mode
[ 59.2066023] trap type 1 code 0 rip 0xffffffff8023230d cs 0x8 rflags 0x282 cr2 0x20001180 ilevel 0 rsp 0xffff9b02486f7810
[ 59.2166079] curlwp 0xffff9b00134544c0 pid 1745.1459 lowest kstack 0xffff9b02486f02c0
Stopped in pid 1745.1459 (syz-executor.2) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:291
panic() at netbsd:panic+0x9e sys/kern/subr_prf.c:1059
kasan_report() at netbsd:kasan_report+0x8f kasan_code_name sys/kern/subr_asan.c:168 [inline]
kasan_report() at netbsd:kasan_report+0x8f sys/kern/subr_asan.c:200
__asan_load8() at netbsd:__asan_load8+0xac kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:370 [inline]
__asan_load8() at netbsd:__asan_load8+0xac kasan_shadow_check sys/kern/subr_asan.c:420 [inline]
__asan_load8() at netbsd:__asan_load8+0xac sys/kern/subr_asan.c:1207

union_statvfs() at netbsd:union_statvfs+0x44 sys/fs/union/union_vfsops.c:448

VFS_STATVFS() at netbsd:VFS_STATVFS+0x68 sys/kern/vfs_subr.c:1482
mount_domount() at netbsd:mount_domount+0x86c sys/kern/vfs_mount.c:907
do_sys_mount() at netbsd:do_sys_mount+0x7a1 sys/kern/vfs_syscalls.c:616
compat_40_sys_mount() at netbsd:compat_40_sys_mount+0xbd sys/compat/common/vfs_syscalls_40.c:88
sys___syscall() at netbsd:sys___syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x10e sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
--- syscall (number 21 via SYS_syscall) ---
netbsd:syscall+0x25a:

Panic string: ASan: Unauthorized Access In 0xffffffff818c6759: Addr 0xffff9b001410c8c8 [8 bytes, read, PoolUseAfterFree]

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1770 1770 3 0 180 ffff9b0013454900 syz-executor.1 pipe_rd
1745 >1459 7 1 0 ffff9b00134544c0 syz-executor.2
1745 1375 3 1 180 ffff9b001345e0c0 syz-executor.2 parked
1745 >1745 7 0 10000140 ffff9b0013430300 syz-executor.2
1760 1760 2 1 140 ffff9b0012cc0980 syz-executor.2
943 942 3 1 180 ffff9b0013e358c0 syz-execprog parked
943 1323 3 0 180 ffff9b0013dbc700 syz-execprog parked
943 1073 2 1 140 ffff9b0013d52b00 syz-execprog
943 1384 3 0 1c0 ffff9b0013d0ba80 syz-execprog wait
943 1246 3 0 1c0 ffff9b0013cf9a40 syz-execprog wait
943 1243 3 0 180 ffff9b0013cf9600 syz-execprog parked
943 1240 3 0 180 ffff9b0012bbe180 syz-execprog parked
943 930 3 0 1c0 ffff9b00133d5b00 syz-execprog parked
943 929 3 0 180 ffff9b00133d5280 syz-execprog parked
943 1241 3 0 1c0 ffff9b00133beac0 syz-execprog parked
943 1223 3 0 180 ffff9b0012a39340 syz-execprog parked
943 1107 2 1 100 ffff9b00126d7b80 syz-execprog
943 943 3 0 1c0 ffff9b0012b6a100 syz-execprog parked
955 955 3 0 180 ffff9b0012b6a540 sshd select
1084 1084 3 0 180 ffff9b0012d23b40 getty nanoslp
1225 1225 3 1 180 ffff9b0012d23700 getty nanoslp
1086 1086 3 1 180 ffff9b0012cfea80 getty nanoslp
1222 1222 3 1 1c0 ffff9b00126da340 getty ttyraw
1111 1111 3 1 180 ffff9b00133b1640 sshd select
1096 1096 3 1 180 ffff9b0012d73040 powerd kqueue
693 693 3 0 180 ffff9b00133ec2c0 syslogd kqueue
747 747 3 0 180 ffff9b0012c6a740 dhcpcd poll
748 748 3 1 180 ffff9b0012cc0100 dhcpcd poll
745 745 3 1 180 ffff9b0012c83bc0 dhcpcd poll
604 604 3 1 180 ffff9b0012c83780 dhcpcd poll
487 487 3 0 180 ffff9b0012db70c0 dhcpcd poll
292 292 3 0 180 ffff9b0012d9d900 dhcpcd poll
485 485 3 0 180 ffff9b0012d9d4c0 dhcpcd poll
1 1 3 0 180 ffff9b0012868180 init wait
0 846 3 0 200 ffff9b00129916c0 physiod physiod
0 196 3 0 200 ffff9b0012994700 pooldrain pooldrain
0 195 3 0 200 ffff9b00129942c0 ioflush syncer
0 194 3 1 200 ffff9b0012991b00 pgdaemon pgdaemon
0 167 3 1 200 ffff9b0012950ac0 usb7 usbevt
0 172 3 1 200 ffff9b0012950680 usb6 usbevt
0 170 3 1 200 ffff9b0012950240 usb5 usbevt
0 168 3 1 200 ffff9b0012905a80 usb4 usbevt
0 166 3 0 200 ffff9b0012905640 usb3 usbevt
0 165 3 0 200 ffff9b0012905200 usb2 usbevt
0 31 3 0 200 ffff9b00128c9a40 usb1 usbevt
0 63 3 1 200 ffff9b00128c9600 usb0 usbevt
0 126 3 1 200 ffff9b00128c91c0 usbtask-dr usbtsk
0 125 3 1 200 ffff9b0012868a00 usbtask-hc usbtsk
0 124 3 0 200 ffff9b0010d76b00 swwreboot swwreboot
0 123 3 1 200 ffff9b00128685c0 npfgc0 npfgcw
0 122 3 1 200 ffff9b001285a9c0 rt_free rt_free
0 121 3 1 200 ffff9b001285a580 unpgc unpgc
0 120 3 0 200 ffff9b001285a140 key_timehandler key_timehandler
0 119 3 1 200 ffff9b001270b980 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffff9b001270b540 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffff9b001270b100 nd6_timer nd6_timer
0 116 3 1 200 ffff9b0012703940 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffff9b0012703500 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffff9b00127030c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffff9b00126f4900 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffff9b00126f44c0 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffff9b00126f4080 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffff9b00126db8c0 rt_timer rt_timer
0 109 3 0 200 ffff9b00126db040 vmem_rehash vmem_rehash
0 100 3 0 200 ffff9b00126d7300 entbutler entropy
0 99 3 0 200 ffff9b00120bcb40 viomb balloon
0 98 3 1 200 ffff9b00120bc700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffff9b00120bc2c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 ffff9b0010d766c0 scsibus0 sccomp
0 29 3 0 200 ffff9b0010d76280 pms0 pmsreset
0 28 3 1 200 ffff9b0010cbcac0 xcall/1 xcall
0 27 1 1 200 ffff9b0010cbc680 softser/1
0 26 1 1 200 ffff9b0010cbc240 softclk/1
0 25 1 1 200 ffff9b0010cb9a80 softbio/1
0 24 1 1 200 ffff9b0010cb9640 softnet/1
0 23 1 1 201 ffff9b0010cb9200 idle/1
0 22 3 0 200 ffff9b000fb56a40 lnxsyswq lnxsyswq
0 21 3 0 200 ffff9b000fb56600 lnxubdwq lnxubdwq
0 20 3 0 200 ffff9b000fb561c0 lnxpwrwq lnxpwrwq
0 19 3 0 200 ffff9b000fb55a00 lnxlngwq lnxlngwq
0 18 3 0 200 ffff9b000fb555c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffff9b000fb55180 lnxrcugc lnxrcugc
0 16 3 0 200 ffff9b000fb4e9c0 sysmon smtaskq
0 15 3 0 200 ffff9b000fb4e580 pmfsuspend pmfsuspend
0 14 3 0 200 ffff9b000fb4e140 pmfevent pmfevent
0 13 3 0 200 ffff9b000fb49980 sopendfree sopendfr
0 12 3 0 200 ffff9b000fb49540 ifwdog ifwdog
0 11 3 0 200 ffff9b000fb49100 iflnkst iflnkst
0 10 3 0 200 ffff9b000fb3c940 nfssilly nfssilly
0 9 3 1 200 ffff9b000fb3c500 vdrain vdrain
0 8 3 0 200 ffff9b000fb3c0c0 modunload mod_unld
0 7 3 0 200 ffff9b000fb33900 xcall/0 xcall
0 6 1 0 200 ffff9b000fb334c0 softser/0
0 5 1 0 200 ffff9b000fb33080 softclk/0
0 4 1 0 200 ffff9b000fb318c0 softbio/0
0 3 1 0 200 ffff9b000fb31480 softnet/0
0 2 1 0 201 ffff9b000fb31040 idle/0

0 0 3 0 200 ffffffff83347380 swapper uvm
[Locks tracked through LWPs]

****** LWP 748.748 (dhcpcd) @ 0xffff9b0012cc0100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffff9b0012cc0100 last held: 000000000000000000