UBSan: Undefined Behavior in vn_seek

0 views

Skip to first unread message

syzbot

unread,

Jan 12, 2022, 8:24:33 PM1/12/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: ccebc6438312 A few more sysinst message catalog adjustments
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=134877cfb00000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=b9f9a02148a40675c38a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b9f9a0...@syzkaller.appspotmail.com

[ 53.8984675] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/vfs_vnops.c:1135:10, signed integer overflow: 4620693217681866751 + 4620693217681866751 cannot be represented in type 'long int'

[ 53.9184567] cpu1: Begin traceback...
01:23:10 executing program 3:
r0 = open$dir(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
r1 = dup(r0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1, 0x10, 0xffffffffffffffff, 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000001580)=[{0x0}], 0x1, 0x0)
mknodat(r1, &(0x7f0000000000)='./file1\x00', 0x1000, 0x0)

[ 53.9384566] vpanic() at netbsd:vpanic+0x2d0 sys/kern/subr_prf.c:290
[ 53.9984567] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 54.0484570] HandleOverflow() at netbsd:HandleOverflow+0x1d0 sys/../common/lib/libc/misc/ubsan.c:375
[ 54.0984563] vn_seek() at netbsd:vn_seek+0x2de sys/kern/vfs_vnops.c:1135
[ 54.1484568] sys_lseek() at netbsd:sys_lseek+0x148 sys/kern/vfs_syscalls.c:2961
[ 54.1884568] sys___syscall() at netbsd:sys___syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
[ 54.1884568] sys___syscall() at netbsd:sys___syscall+0x1cf sys/kern/sys_syscall.c:77
[ 54.2284579] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 54.2284579] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 54.2284579] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 54.2484566] --- syscall (number 198) ---
[ 54.2584556] netbsd:syscall+0x2da:
[ 54.2584556] cpu1: End traceback...
[ 54.2684568] fatal breakpoint trap in supervisor mode
[ 54.2684568] trap type 1 code 0 rip 0xffffffff80221a95 cs 0x8 rflags 0x246 cr2 0x20001580 ilevel 0 rsp 0xffffd180cd064790
[ 54.2784548] curlwp 0xfffffd1316ef9740 pid 2482.2346 lowest kstack 0xffffd180cd0602c0
Stopped in pid 2482.2346 (syz-executor.5) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2d0 sys/kern/subr_prf.c:290
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleOverflow() at netbsd:HandleOverflow+0x1d0 sys/../common/lib/libc/misc/ubsan.c:375
vn_seek() at netbsd:vn_seek+0x2de sys/kern/vfs_vnops.c:1135
sys_lseek() at netbsd:sys_lseek+0x148 sys/kern/vfs_syscalls.c:2961
sys___syscall() at netbsd:sys___syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
sys___syscall() at netbsd:sys___syscall+0x1cf sys/kern/sys_syscall.c:77
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 198) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/vfs_vnops.c:1135:10, signed integer overflow: 4620693217681866751 + 4620693217681866751 cannot be represented in type 'long int'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
2612 2612 2 0 0 fffffd1315f55340 syz-executor.3
2636 2916 2 0 0 fffffd1316eef080 syz-executor.4
2636 2636 2 0 10000000 fffffd1315f5e700 syz-executor.4
2732 2639 3 0 180 fffffd130968fb80 syz-executor.2 parked
2732 2732 2 0 10000000 fffffd13167d06c0 syz-executor.2
1481 2736 3 0 180 fffffd1316e9b940 syz-executor.0 parked
1481 1481 2 0 10000000 fffffd13120d4ac0 syz-executor.0
2482 >2346 7 1 100 fffffd1316ef9740 syz-executor.5
2482 2482 2 1 10000000 fffffd13120d4240 syz-executor.5
2512 2257 3 0 180 fffffd13120d4680 syz-executor.1 parked
2512 2512 2 0 10040000 fffffd130a08a900 syz-executor.1
1151 1151 2 0 140 fffffd130924cb00 syz-executor.5
1001 1001 2 0 40 fffffd130ac1e980 syz-executor.3
1130 1130 2 0 140 fffffd130acb7580 syz-executor.4
1075 1075 2 0 140 fffffd130b4d3a80 syz-executor.2
1220 1220 2 0 140 fffffd130acb7140 syz-executor.1
424 424 2 0 140 fffffd1308e70200 syz-executor.0
1193 1224 3 0 180 fffffd130a08a080 syz-fuzzer kqueue
1193 1082 2 0 40 fffffd130b4d3640 syz-fuzzer
1193 1222 3 0 180 fffffd130b4d3200 syz-fuzzer parked
1193 1221 2 1 140 fffffd130924c6c0 syz-fuzzer
1193 1084 3 0 180 fffffd1308e9d680 syz-fuzzer parked
1193 1078 3 1 180 fffffd130924c280 syz-fuzzer parked
1193 >1111 7 0 10000140 fffffd1308e9dac0 syz-fuzzer
1193 1193 3 0 180 fffffd130b387a40 syz-fuzzer parked
1085 1085 3 0 180 fffffd1309ee45c0 sshd select
1126 1126 3 0 180 fffffd130ac1e540 getty nanoslp
1073 1073 3 1 180 fffffd1309ee4180 getty nanoslp
1255 1255 3 1 180 fffffd130b387600 getty nanoslp
1069 1069 3 0 1c0 fffffd130b3871c0 getty ttyraw
926 926 3 1 180 fffffd1309ee4a00 sshd select
952 952 3 1 180 fffffd130acb79c0 powerd kqueue
687 687 3 0 180 fffffd1309807bc0 syslogd kqueue
739 739 3 0 180 fffffd130a5888c0 dhcpcd poll
546 546 3 0 180 fffffd1309769b40 dhcpcd poll
600 600 3 0 180 fffffd130968f740 dhcpcd poll
587 587 3 0 180 fffffd130a588040 dhcpcd poll
289 289 3 0 180 fffffd1309807780 dhcpcd poll
288 288 3 0 180 fffffd1309807340 dhcpcd poll
351 351 3 1 180 fffffd1300572b40 dhcpcd poll
1 1 3 0 180 fffffd1300bfe980 init wait
0 1838 2 1 200 fffffd13097692c0 ktrace
0 1619 5 0 200 fffffd1315f5eb40 (zombie)
0 1746 3 0 200 fffffd1316ef9300 ktrace ktrwait
0 1351 3 0 200 fffffd130a588480 acctwatch actwat
0 935 3 0 200 fffffd1308e70640 physiod physiod
0 194 3 1 200 fffffd1308e9d240 ioflush syncer
0 193 3 0 200 fffffd1300bdd300 pooldrain pooldrain
0 192 3 1 200 fffffd1308e70a80 pgdaemon pgdaemon
0 166 3 1 200 fffffd1306daaa40 usb7 usbevt
0 165 3 1 200 fffffd1306daa600 usb6 usbevt
0 164 3 1 200 fffffd1306daa1c0 usb5 usbevt
0 163 3 1 200 fffffd1303d6da00 usb4 usbevt
0 31 3 1 200 fffffd1303d6d5c0 usb3 usbevt
0 63 3 1 200 fffffd1303d6d180 usb2 usbevt
0 126 3 1 200 fffffd1300c889c0 usb1 usbevt
0 125 3 1 200 fffffd1300c88580 usb0 usbevt
0 124 3 1 200 fffffd1300bdd740 usbtask-dr usbtsk
0 123 3 0 200 fffffd130053d6c0 usbtask-hc usbtsk
0 122 3 0 200 fffffd1300c88140 npfgc0 npfgcw
0 121 3 1 200 fffffd1300bfe540 rt_free rt_free
0 120 3 1 200 fffffd1300bfe100 unpgc unpgc
0 119 3 0 200 fffffd1300c59940 key_timehandler key_timehandler
0 118 3 1 200 fffffd1300c59500 icmp6_wqinput/1 icmp6_wqinput
0 117 3 0 200 fffffd1300c590c0 icmp6_wqinput/0 icmp6_wqinput
0 116 3 0 200 fffffd1300c34900 nd6_timer nd6_timer
0 115 3 1 200 fffffd1300c344c0 carp6_wqinput/1 carp6_wqinput
0 114 3 0 200 fffffd1300c34080 carp6_wqinput/0 carp6_wqinput
0 113 3 1 200 fffffd1300c0f8c0 carp_wqinput/1 carp_wqinput
0 112 3 0 200 fffffd1300c0f480 carp_wqinput/0 carp_wqinput
0 111 3 1 200 fffffd1300c0f040 icmp_wqinput/1 icmp_wqinput
0 110 3 0 200 fffffd1300bfabc0 icmp_wqinput/0 icmp_wqinput
0 109 3 0 200 fffffd1300bfa780 rt_timer rt_timer
0 108 3 1 200 fffffd1300bfa340 vmem_rehash vmem_rehash
0 107 3 0 200 fffffd1300bddb80 entbutler entropy
0 98 3 1 200 fffffd1300572700 viomb balloon
0 97 3 1 200 fffffd13005722c0 vioif0_txrx/1 vioif0_txrx
0 96 3 0 200 fffffd130053db00 vioif0_txrx/0 vioif0_txrx
0 29 3 1 200 fffffd130053d280 scsibus0 sccomp
0 28 3 0 200 fffffd12fefcbac0 pms0 pmsreset
0 27 3 1 200 fffffd12fefcb680 xcall/1 xcall
0 26 1 1 200 fffffd12fefcb240 softser/1
0 25 1 1 200 fffffd12fef9ea80 softclk/1
0 24 1 1 200 fffffd12fef9e640 softbio/1
0 23 1 1 200 fffffd12fef9e200 softnet/1
0 22 1 1 201 fffffd142df3ba40 idle/1
0 21 3 0 200 fffffd142df3b600 lnxsyswq lnxsyswq
0 20 3 0 200 fffffd142df3b1c0 lnxubdwq lnxubdwq
0 19 3 1 200 fffffd142df40a00 lnxpwrwq lnxpwrwq
0 18 3 1 200 fffffd142df405c0 lnxlngwq lnxlngwq
0 17 3 1 200 fffffd142df40180 lnxhipwq lnxhipwq
0 16 3 0 200 fffffd142df619c0 lnxrcugc lnxrcugc
0 15 3 0 200 fffffd142df61580 sysmon smtaskq
0 14 3 1 200 fffffd142df61140 pmfsuspend pmfsuspend
0 13 3 0 200 fffffd142df6a980 pmfevent pmfevent
0 12 3 1 200 fffffd142df6a540 sopendfree sopendfr
0 11 3 1 200 fffffd142df6a100 iflnkst iflnkst
0 10 3 1 200 fffffd142ef9b940 nfssilly nfssilly
0 9 3 0 200 fffffd142ef9b500 vdrain vdrain
0 8 3 1 200 fffffd142ef9b0c0 modunload mod_unld
0 7 3 0 200 fffffd142efc6900 xcall/0 xcall
0 6 1 0 200 fffffd142efc64c0 softser/0
0 5 1 0 200 fffffd142efc6080 softclk/0
0 4 1 0 200 fffffd142eff38c0 softbio/0
0 3 1 0 200 fffffd142eff3480 softnet/0
0 2 1 0 201 fffffd142eff3040 idle/0
0 0 3 0 200 ffffffff8657e3c0 swapper uvm
[Locks tracked through LWPs]

****** LWP 546.546 (dhcpcd) @ 0xfffffd1309769b40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff869b3040 type : sleep/adaptive
initialized : 0xffffffff8375ada7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffd1309769b40 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 600.600 (dhcpcd) @ 0xfffffd130968f740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff869b3040 type : sleep/adaptive
initialized : 0xffffffff8375ada7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffd130968f740 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 288.288 (dhcpcd) @ 0xfffffd1309807340, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff869b3040 type : sleep/adaptive
initialized : 0xffffffff8375ada7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffd1309807340 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 351.351 (dhcpcd) @ 0xfffffd1300572b40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff869b3040 type : sleep/adaptive
initialized : 0xffffffff8375ada7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffd1300572b40 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xfffffd142df6a100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff869b3040 type : sleep/adaptive
initialized : 0xffffffff8375ada7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffd142df6a100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xfffffd142efc6080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff869b3040 type : sleep/adaptive
initialized : 0xffffffff8375ada7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffd142efc6080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff8657e3c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff869b3040 type : sleep/adaptive
initialized : 0xffffffff8375ada7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff8657e3c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

PAGE FLAG PQ UOBJECT UANON
0xffffd18000007180 0045 00000000 0x0 0x0
0xffffd18000007200 0045 00000000 0x0 0x0
0xffffd18000007280 0045 00000000 0x0 0x0
0xffffd18000007300 0045 00000000 0x0 0x0
0xffffd18000007380 0045 00000000 0x0 0x0
0xffffd18000007400 0045 00000000 0x0 0x0
0xffffd18000007480 0045 00000000 0x0 0x0
0xffffd18000007500 0045 00000000 0x0 0x0
0xffffd18000007580 0045 00000000 0x0 0x0
0xffffd18000007600 0041 00000000 0x0 0x0
0xffffd18000007680 0041 00000000 0x0 0x0
0xffffd18000007700 0041 00000000 0x0 0x0
0xffffd18000007780 0041 00000000 0x0 0x0
0xffffd18000007800 0041 00000000 0x0 0x0
0xffffd18000007880 0045 00000000 0x0 0x0
0xffffd18000007900 0045 00000000 0x0 0x0
0xffffd18000007980 0041 00000000 0x0 0x0
0xffffd18000007a00 0041 00000000 0x0 0x0
0xffffd18000007a80 0041 00000000 0x0 0x0
0xffffd18000007b00 0041 00000000 0x0 0x0
0xffffd18000007b80 0041 00000000 0x0 0x0
0xffffd18000007c00 0041 00000000 0x0 0x0
0xffffd18000007c80 0041 00000000 0x0 0x0
0xffffd18000007d00 0041 00000000 0x0 0x0
0xffffd18000007d80 0041 00000000 0x0 0x0
0xffffd18000007e00 0041 00000000 0x0 0x0
0xffffd18000007e80 0041 00000000 0x0 0x0
0xffffd18000007f00 0041 00000000 0x0 0x0
0xffffd18000007f80 0041 00000000 0x0 0x0
0xffffd18000008000 0041 00000000 0x0 0x0
0xffffd18000008080 0041 00000000 0x0 0x0
0xffffd18000008100 0041 00000000 0x0 0x0
0xffffd18000008180 0041 00000000 0x0 0x0
0xffffd18000008200 0041 00000000 0x0 0x0
0xffffd18000008280 0041 00000000 0x0 0x0
0xffffd18000008300 0041 00000000 0x0 0x0
0xffffd18000008380 0041 00000000 0x0 0x0
0xffffd18000008400 0041 00000000 0x0 0x0
0xffffd18000008480 0041 00000000 0x0 0x0
0xffffd18000008500 0041 00000000 0x0 0x0
0xffffd18000008580 0041 00000000 0x0 0x0
0xffffd18000008600 0041 00000000 0x0 0x0
0xffffd18000008680 0041 00000000 0x0 0x0
0xffffd18000008700 0041 00000000 0x0 0x0
0xffffd18000008780 0041 00000000 0x0 0x0
0xffffd18000008800 0041 00000000 0x0 0x0
0xffffd18000008880 0041 00000000 0x0 0x0
0xffffd18000008900 0041 00000000 0x0 0x0
0xffffd18000008980 0041 00000000 0x0 0x0
0xffffd18000008a00 0041 00000000 0x0 0x0
0xffffd18000008a80 0041 00000000 0x0 0x0
0xffffd18000008b00 0041 00000000 0x0 0x0
0xffffd18000008b80 0045 00000000 0x0 0x0
0xffffd18000008c00 0045 00000000 0x0 0x0
0xffffd18000008c80 0041 00000000 0x0 0x0
0xffffd18000008d00 0041 00000000 0x0 0x0
0xffffd18000008d80 0041 00000000 0x0 0x0
0xffffd18000008e00 0041 00000000 0x0 0x0
0xffffd18000008e80 0041 00000000 0x0 0x0
0xffffd18000008f00 0041 00000000 0x0 0x0
0xffffd18000008f80 0041 00000000 0x0 0x0
0xffffd18000009000 0041 00000000 0x0 0x0
0xffffd18000009080 0041 00000000 0x0 0x0
0xffffd18000009100 0041 00000000 0x0 0x0
0xffffd18000009180 0041 00000000 0x0 0x0
0xffffd18000009200 0041 00000000 0x0 0x0
0xffffd18000009280 0041 00000000 0x0 0x0
0xffffd18000009300 0041 00000000 0x0 0x0
0xffffd18000009380 0041 00000000 0x0 0x0
0xffffd18000009400 0041 00000000 0x0 0x0
0xffffd18000009480 0045 00000000 0x0 0x0
0xffffd18000009500 0041 00000000 0x0 0x0
0xffffd18000009580 0041 00000000 0x0 0x0
0xffffd18000009600 0041 00000000 0x0 0x0
0xffffd18000009680 0041 00000000 0x0 0x0
0xffffd18000009700 0041 00000000 0x0 0x0
0xffffd18000009780 0041 00000000 0x0 0x0
0xffffd18000009800 0041 00000000 0x0 0x0
0xffffd18000009880 0041 00000000 0x0 0x0
0xffffd18000009900 0041 00000000 0x0 0x0
0xffffd18000009980 0041 00000000 0x0 0x0
0xffffd18000009a00 0041 00000000 0x0 0x0
0xffffd18000009a80 0041 00000000 0x0 0x0
0xffffd18000009b00 0041 00000000 0x0 0x0
0xffffd18000009b80 0041 00000000 0x0 0x0
0xffffd18000009c00 0041 00000000 0x0 0x0
0xffffd18000009c80 0041 00000000 0x0 0x0
0xffffd18000009d00 0041 00000000 0x0 0x0
0xffffd18000009d80 0041 00000000 0x0 0x0
0xffffd18000009e00 0041 00000000 0x0 0x0
0xffffd18000009e80 0041 00000000 0x0 0x0
0xffffd18000009f00 0041 00000000 0x0 0x0
0xffffd18000009f80 0041 00000000 0x0 0x0
0xffffd1800000a000 0041 00000000 0x0 0x0
0xffffd1800000a080 0041 00000000 0x0 0x0
0xffffd1800000a100 0041 00000000 0x0 0x0
0xffffd1800000a180 0041 00000000 0x0 0x0
0xffffd1800000a200 0045 00000000 0x0 0x0
0xffffd1800000a280 0045 00000000 0x0 0x0
0xffffd1800000a300 0041 00000000 0x0 0x0
0xffffd1800000a380 0041 00000000 0x0 0x0
0xffffd1800000a400 0041 00000000 0x0 0x0
0xffffd1800000a480 0041 00000000 0x0 0x0
0xffffd1800000a500 0041 00000000 0x0 0x0
0xffffd1800000a580 0041 00000000 0x0 0x0
0xffffd1800000a600 0041 00000000 0x0 0x0
0xffffd1800000a680 0041 00000000 0x0 0x0
0xffffd1800000a700 0041 00000000 0x0 0x0
0xffffd1800000a780 0041 00000000 0x0 0x0
0xffffd1800000a800 0041 00000000 0x0 0x0
0xffffd1800000a880 0041 00000000 0x0 0x0
0xffffd1800000a900 0041 00000000 0x0 0x0
0xffffd1800000a980 0041 00000000 0x0 0x0
0xffffd1800000aa00 0041 00000000 0x0 0x0
0xffffd1800000aa80 0041 00000000 0x0 0x0
0xffffd1800000ab00 0041 00000000 0x0 0x0
0xffffd1800000ab80 0041 00000000 0x0 0x0
0xffffd1800000ac00 0041 00000000 0x0 0x0
0xffffd1800000ac80 0041 00000000 0x0 0x0
0xffffd1800000ad00 0041 00000000 0x0 0x0
0xffffd1800000ad80 0041 00000000 0x0 0x0
0xffffd1800000ae00 0045 00000000 0x0 0x0
0xffffd1800000ae80 0045 00000000 0x0 0x0
0xffffd1800000af00 0045 00000000 0x0 0x0
0xffffd1800000af80 0041 00000000 0x0 0x0
0xffffd1800000b000 0041 00000000 0x0 0x0
0xffffd1800000b080 0041 00000000 0x0 0x0
0xffffd1800000b100 0041 00000000 0x0 0x0
0xffffd1800000b180 0045 00000000 0x0 0x0
0xffffd1800000b200 0045 00000000 0x0 0x0
0xffffd1800000b280 0045 00000000 0x0 0x0
0xffffd1800000b300 0045 00000000 0x0 0x0
0xffffd1800000b380 0045 00000000 0x0 0x0
0xffffd1800000b400 0041 00000000 0x0 0x0
0xffffd1800000b480 0041 00000000 0x0 0x0
0xffffd1800000b500 0045 00000000 0x0 0x0
0xffffd1800000b580 0045 00000000 0x0 0x0
0xffffd1800000b600 0045 00000000 0x0 0x0
0xffffd1800000b680 0045 00000000 0x0 0x0
0xffffd1800000b700 0045 00000000 0x0 0x0
0xffffd1800000b780 0045 00000000 0x0 0x0
0xffffd1800000b800 0041 00000000 0x0 0x0
0xffffd1800000b880 0041 00000000 0x0 0x0
0xffffd1800000b900 0045 00000000 0x0 0x0
0xffffd1800000b980 0045 00000000 0x0 0x0
0xffffd1800000ba00 0045 00000000 0x0 0x0
0xffffd1800000ba80 0045 00000000 0x0 0x0
0xffffd1800000bb00 0045 00000000 0x0 0x0
0xffffd1800000bb80 0045 00000000 0x0 0x0
0xffffd1800000bc00 0045 00000000 0x0 0x0
0xffffd1800000bc80 0041 00000000 0x0 0x0
0xffffd1800000bd00 0045 00000000 0x0 0x0
0xffffd1800000bd80 0045 00000000 0x0 0x0
0xffffd1800000be00 0045 00000000 0x0 0x0
0xffffd1800000be80 0045 00000000 0x0 0x0
0xffffd1800000bf00 0045 00000000 0x0 0x0
0xffffd1800000bf80 0045 00000000 0x0 0x0
0xffffd1800000c000 0045 00000000 0x0 0x0
0xffffd1800000c080 0041 00000000 0x0 0x0
0xffffd1800000c100 0045 00000000 0x0 0x0
0xffffd1800000c180 0045 00000000 0x0 0x0
0xffffd1800000c200 0045 00000000 0x0 0x0
0xffffd1800000c280 0045 00000000 0x0 0x0
0xffffd1800000c300 0045 00000000 0x0 0x0
0xffffd1800000c380 0045 00000000 0x0 0x0
0xffffd1800000c400 0045 00000000 0x0 0x0
0xffffd1800000c480 0045 00000000 0x0 0x0
0xffffd1800000c500 0045 00000000 0x0 0x0
0xffffd1800000c580 0045 00000000 0x0 0x0
0xffffd1800000c600 0045 00000000 0x0 0x0
0xffffd1800000c680 0045 00000000 0x0 0x0
0xffffd1800000c700 0041 00000000 0x0 0x0
0xffffd1800000c780 0045 00000000 0x0 0x0
0xffffd1800000c800 0045 00000000 0x0 0x0
0xffffd1800000c880 0045 00000000 0x0 0x0
0xffffd1800000c900 0045 00000000 0x0 0x0
0xffffd1800000c980 0045 00000000 0x0 0x0
0xffffd1800000ca00 0041 00000000 0x0 0x0
0xffffd1800000ca80 0041 00000000 0x0 0x0
0xffffd1800000cb00 0041 00000000 0x0 0x0
0xffffd1800000cb80 0041 00000000 0x0 0x0
0xffffd1800000cc00 0045 00000000 0x0 0x0
0xffffd1800000cc80 0045 00000000 0x0 0x0
0xffffd1800000cd00 0041 00000000 0x0 0x0
0xffffd1800000cd80 0041 00000000 0x0 0x0
0xffffd1800000ce00 0041 00000000 0x0 0x0
0xffffd1800000ce80 0041 00000000 0x0 0x0
0xffffd1800000cf00 0041 00000000 0x0 0x0
0xffffd1800000cf80 0041 00000000 0x0 0x0
0xffffd1800000d000 0045 00000000 0x0 0x0
0xffffd1800000d080 0045 00000000 0x0 0x0
0xffffd1800000d100 0041 00000000 0x0 0x0
0xffffd1800000d180 0041 00000000 0x0 0x0
0xffffd1800000d200 0041 00000000 0x0 0x0
0xffffd1800000d280 0041 00000000 0x0 0x0
0xffffd1800000d300 0045 00000000 0x0 0x0
0xffffd1800000d380 0041 00000000 0x0 0x0
0xffffd1800000d400 0041 00000000 0x0 0x0
0xffffd1800000d480 0045 00000000 0x0 0x0
0xffffd1800000d500 0041 00000000 0x0 0x0
0xffffd1800000d580 0041 00000000 0x0 0x0
0xffffd1800000d600 0041 00000000 0x0 0x0
0xffffd1800000d680 0045 00000000 0x0 0x0
0xffffd1800000d700 0041 00000000 0x0 0x0
0xffffd1800000d780 0041 00000000 0x0 0x0
0xffffd1800000d800 0041 00000000 0x0 0x0
0xffffd1800000d880 0045 00000000 0x0 0x0
0xffffd1800000d900 0041 00000000 0x0 0x0
0xffffd1800000d980 0041 00000000 0x0 0x0
0xffffd1800000da00 0041 00000000 0x0 0x0
0xffffd1800000da80 0041 00000000 0x0 0x0
0xffffd1800000db00 0045 00000000 0x0 0x0
0xffffd1800000db80 0045 00000000 0x0 0x0
0xffffd1800000dc00 0041 00000000 0x0 0x0
0xffffd1800000dc80 0041 00000000 0x0 0x0
0xffffd1800000dd00 0041 00000000 0x0 0x0
0xffffd1800000dd80 0041 00000000 0x0 0x0
0xffffd1800000de00 0045 00000000 0x0 0x0
0xffffd1800000de80 0041 00000000 0x0 0x0
0xffffd1800000df00 0045 00000000 0x0 0x0
0xffffd1800000df80 0045 00000000 0x0 0x0
0xffffd1800000e000 0041 00000000 0x0 0x0
0xffffd1800000e080 0041 00000000 0x0 0x0
0xffffd1800000e100 0045 00000000 0x0 0x0
0xffffd1800000e180 0045 00000000 0x0 0x0
0xffffd1800000e200 0041 00000000 0x0 0x0
0xffffd1800000e280 0045 00000000 0x0 0x0
0xffffd1800000e300 0045 00000000 0x0 0x0
0xffffd1800000e380 0045 00000000 0x0 0x0
0xffffd1800000e400 0045 00000000 0x0 0x0
0xffffd1800000e480 0041 00000000 0x0 0x0
0xffffd1800000e500 0041 00000000 0x0 0x0
0xffffd1800000e580 0041 00000000 0x0 0x0
0xffffd1800000e600 0041 00000000 0x0 0x0
0xffffd1800000e680 0041 00000000 0x0 0x0
0xffffd1800000e700 0041 00000000 0x0 0x0
0xffffd1800000e780 0041 00000000 0x0 0x0
0xffffd1800000e800 0045 00000000 0x0 0x0
0xffffd1800000e880 0041 00000000 0x0 0x0
0xffffd1800000e900 0041 00000000 0x0 0x0
0xffffd1800000e980 0041 00000000 0x0 0x0
0xffffd1800000ea00 0041 00000000 0x0 0x0
0xffffd1800000ea80 0045 00000000 0x0 0x0
0xffffd1800000eb00 0041 00000000 0x0 0x0
0xffffd1800000eb80 0041 00000000 0x0 0x0
0xffffd1800000ec00 0041 00000000 0x0 0x0
0xffffd1800000ec80 0045 00000000 0x0 0x0
0xffffd1800000ed00 0045 00000000 0x0 0x0
0xffffd1800000ed80 0045 00000000 0x0 0x0
0xffffd1800000ee00 0041 00000000 0x0 0x0
0xffffd1800000ee80 0041 00000000 0x0 0x0
0xffffd1800000ef00 0041 00000000 0x0 0x0
0xffffd1800000ef80 0045 00000000 0x0 0x0
0xffffd1800000f000 0041 00000000 0x0 0x0
0xffffd1800000f080 0045 00000000 0x0 0x0
0xffffd1800000f100 0041 00000000 0x0 0x0
0xffffd1800000f180 0041 00000000 0x0 0x0
0xffffd1800000f200 0041 00000000 0x0 0x0
0xffffd1800000f280 0041 00000000 0x0 0x0
0xffffd1800000f300 0041 00000000 0x0 0x0
0xffffd1800000f380 0041 00000000 0x0 0x0
0xffffd1800000f400 0045 00000000 0x0 0x0
0xffffd1800000f480 0041 00000000 0x0 0x0
0xffffd1800000f500 0041 00000000 0x0 0x0
0xffffd1800000f580 0041 00000000 0x0 0x0
0xffffd1800000f600 0041 00000000 0x0 0x0
0xffffd1800000f680 0041 00000000 0x0 0x0
0xffffd1800000f700 0041 00000000 0x0 0x0
0xffffd1800000f780 0041 00000000 0x0 0x0
0xffffd1800000f800 0041 00000000 0x0 0x0
0xffffd1800000f880 0041 00000000 0x0 0x0
0xffffd1800000f900 0041 00000000 0x0 0x0
0xffffd1800000f980 0041 00000000 0x0 0x0
0xffffd1800000fa00 0045 00000000 0x0 0x0
0xffffd1800000fa80 0041 00000000 0x0 0x0
0xffffd1800000fb00 0041 00000000 0x0 0x0
0xffffd1800000fb80 0041 00000000 0x0 0x0
0xffffd1800000fc00 0045 00000000 0x0 0x0
0xffffd1800000fc80 0045 00000000 0x0 0x0
0xffffd1800000fd00 0045 00000000 0x0 0x0
0xffffd1800000fd80 0045 00000000 0x0 0x0
0xffffd1800000fe00 0041 00000000 0x0 0x0
0xffffd1800000fe80 0041 00000000 0x0 0x0
0xffffd1800000ff00 0041 00000000 0x0 0x0
0xffffd1800000ff80 0041 00000000 0x0 0x0
0xffffd18000010000 0041 00000000 0x0 0x0
0xffffd18000010080 0041 00000000 0x0 0x0
0xffffd18000010100 0041 00000000 0x0 0x0
0xffffd18000010180 0041 00000000 0x0 0x0
0xffffd18000010200 0045 00000000 0x0 0x0
0xffffd18000010280 0045 00000000 0x0 0x0
0xffffd18000010300 0041 00000000 0x0 0x0
0xffffd18000010380 0041 00000000 0x0 0x0
0xffffd18000010400 0041 00000000 0x0 0x0
0xffffd18000010480 0041 00000000 0x0 0x0
0xffffd18000010500 0045 00000000 0x0 0x0
0xffffd18000010580 0045 00000000 0x0 0x0
0xffffd18000010600 0041 00000000 0x0 0x0
0xffffd18000010680 0041 00000000 0x0 0x0
0xffffd18000010700 0041 00000000 0x0 0x0
0xffffd18000010780 0041 00000000 0x0 0x0
0xffffd18000010800 0041 00000000 0x0 0x0
0xffffd18000010880 0045 00000000 0x0 0x0
0xffffd18000010900 0041 00000000 0x0 0x0
0xffffd18000010980 0041 00000000 0x0 0x0
0xffffd18000010a00 0041 00000000 0x0 0x0
0xffffd18000010a80 0041 00000000 0x0 0x0
0xffffd18000010b00 0041 00000000 0x0 0x0
0xffffd18000010b80 0041 00000000 0x0 0x0
0xffffd18000010c00 0041 00000000 0x0 0x0
0xffffd18000010c80 0041 00000000 0x0 0x0
0xffffd18000010d00 0041 00000000 0x0 0x0
0xffffd18000010d80 0045 00000000 0x0 0x0
0xffffd18000010e00 0041 00000000 0x0 0x0
0xffffd18000010e80 0041 00000000 0x0 0x0
0xffffd18000010f00 0041 00000000 0x0 0x0
0xffffd18000010f80 0041 00000000 0x0 0x0
0xffffd18000011000 0041 00000000 0x0 0x0
0xffffd18000011080 0045 00000000 0x0 0x0
0xffffd18000011100 0041 00000000 0x0 0x0
0xffffd18000011180 0041 00000000 0x0 0x0
0xffffd18000011200 0041 00000000 0x0 0x0
0xffffd18000011280 0041 00000000 0x0 0x0
0xffffd18000011300 0041 00000000 0x0 0x0
0xffffd18000011380 0041 00000000 0x0 0x0
0xffffd18000011400 0041 00000000 0x0 0x0
0xffffd18000011480 0041 00000000 0x0 0x0
0xffffd18000011500 0041 00000000 0x0 0x0
0xffffd18000011580 0041 00000000 0x0 0x0
0xffffd18000011600 0045 00000000 0x0 0x0
0xffffd18000011680 0045 00000000 0x0 0x0
0xffffd18000011700 0045 00000000 0x0 0x0
0xffffd18000011780 0041 00000000 0x0 0x0
0xffffd18000011800 0041 00000000 0x0 0x0
0xffffd18000011880 0041 00000000 0x0 0x0
0xffffd18000011900 0041 00000000 0x0 0x0
0xffffd18000011980 0045 00000000 0x0 0x0
0xffffd18000011a00 0041 00000000 0x0 0x0
0xffffd18000011a80 0041 00000000 0x0 0x0
0xffffd18000011b00 0041 00000000 0x0 0x0
0xffffd18000011b80 0045 00000000 0x0 0x0
0xffffd18000011c00 0041 00000000 0x0 0x0
0xffffd18000011c80 0041 00000000 0x0 0x0
0xffffd18000011d00 0045 00000000 0x0 0x0
0xffffd18000011d80 0041 00000000 0x0 0x0
0xffffd18000011e00 0041 00000000 0x0 0x0
0xffffd18000011e80 0041 00000000 0x0 0x0
0xffffd18000011f00 0041 00000000 0x0 0x0
0xffffd18000011f80 0041 00000000 0x0 0x0
0xffffd18000012000 0041 00000000 0x0 0x0
0xffffd18000012080 0041 00000000 0x0 0x0
0xffffd18000012100 0041 00000000 0x0 0x0
0xffffd18000012180 0041 00000000 0x0 0x0
0xffffd18000012200 0041 00000000 0x0 0x0
0xffffd18000012280 0041 00000000 0x0 0x0
0xffffd18000012300 0041 00000000 0x0 0x0
0xffffd18000012380 0041 00000000 0x0 0x0
0xffffd18000012400 0041 00000000 0x0 0x0
0xffffd18000012480 0041 00000000 0x0 0x0
0xffffd18000012500 0041 00000000 0x0 0x0
0xffffd18000012580 0045 00000000 0x0 0x0
0xffffd18000012600 0041 00000000 0x0 0x0
0xffffd18000012680 0041 00000000 0x0 0x0
0xffffd18000012700 0041 00000000 0x0 0x0
0xffffd18000012780 0041 00000000 0x0 0x0
0xffffd18000012800 0041 00000000 0x0 0x0
0xffffd18000012880 0041 00000000 0x0 0x0
0xffffd18000012900 0041 00000000 0x0 0x0
0xffffd18000012980 0041 00000000 0x0 0x0
0xffffd18000012a00 0041 00000000 0x0 0x0
0xffffd18000012a80 0041 00000000 0x0 0x0
0xffffd18000012b00 0041 00000000 0x0 0x0
0xffffd18000012b80 0041 00000000 0x0 0x0
0xffffd18000012c00 0041 00000000 0x0 0x0
0xffffd18000012c80 0041 00000000 0x0 0x0
0xffffd18000012d00 0041 00000000 0x0 0x0
0xffffd18000012d80 0041 00000000 0x0 0x0
0xffffd18000012e00 0041 00000000 0x0 0x0
0xffffd18000012e80 0041 00000000 0x0 0x0
0xffffd18000012f00 0041 00000000 0x0 0x0
0xffffd18000012f80 0041 00000000 0x0 0x0
0xffffd18000013000 0041 00000000 0x0 0x0
0xffffd18000013080 0045 00000000 0x0 0x0
0xffffd18000013100 0001 00000000 0x0 0x0
0xffffd18000013180 0001 00000000 0x0 0x0
0xffffd18000013200 0001 00000000 0x0 0x0
0xffffd18000013280 0001 00000000 0x0 0x0
0xffffd18000013300 0001 00000000 0x0 0x0
0xffffd18000013380 0001 00000000 0x0 0x0
0xffffd18000013400 0001 00000000 0x0 0x0
0xffffd18000013480 0001 00000000 0x0 0x0
0xffffd18000013500 0001 00000000 0x0 0x0
0xffffd18000013580 0001 00000000 0x0 0x0
0xffffd18000013600 0001 00000000 0x0 0x0
0xffffd18000013680 0001 00000000 0x0 0x0
0xffffd18000013700 0001 00000000 0x0 0x0
0xffffd18000013780 0001 00000000 0x0 0x0
0xffffd18000013800 0001 00000000 0x0 0x0
0xffffd18000013880 0001 00000000 0x0 0x0
0xffffd18000013900 0001 00000000 0x0 0x0
0xffffd18000013980 0001 00000000 0x0 0x0
0xffffd18000013a00 0001 00000000 0x0 0x0
0xffffd18000013a80 0001 00000000 0x0 0x0
0xffffd18000013b00 0001 00000000 0x0 0x0
0xffffd18000013b80 0001 00000000 0x0 0x0
0xffffd18000013c00 0001 00000000 0x0 0x0
0xffffd18000013c80 0001 00000000 0x0 0x0
0xffffd18000013d00 0001 00000000 0x0 0x0
0xffffd18000013d80 0001 00000000 0x0 0x0
0xffffd18000013e00 0001 00000000 0x0 0x0
0xffffd18000013e80 0001 00000000 0x0 0x0
0xffffd18000013f00 0001 00000000 0x0 0x0
0xffffd18000013f80 0001 00000000 0x0 0x0
0xffffd18000014000 0001 00000000 0x0 0x0
0xffffd18000014080 0001 00000000 0x0 0x0
0xffffd18000014100 0001 00000000 0x0 0x0
0xffffd18000014180 0001 00000000 0x0 0x0
0xffffd18000014200 0001 00000000 0x0 0x0
0xffffd18000014280 0001 00000000 0x0 0x0
0xffffd18000014300 0001 00000000 0x0 0x0
0xffffd18000014380 0001 00000000 0x0 0x0
0xffffd18000014400 0001 00000000 0x0 0x0
0xffffd18000014480 0001 00000000 0x0 0x0
0xffffd18000014500 0001 00000000 0x0 0x0
0xffffd18000014580 0001 00000000 0x0 0x0
0xffffd18000014600 0001 00000000 0x0 0x0
0xffffd18000014680 0001 00000000 0x0 0x0
0xffffd18000014700 0001 00000000 0x0 0x0
0xffffd18000014780 0001 00000000 0x0 0x0
0xffffd18000014800 0001 00000000 0x0 0x0
0xffffd18000014880 0001 00000000 0x0 0x0
0xffffd18000014900 0001 00000000 0x0 0x0
0xffffd18000014980 0001 00000000 0x0 0x0
0xffffd18000014a00 0001 00000000 0x0 0x0
0xffffd18000014a80 0001 00000000 0x0 0x0
0xffffd18000014b00 0001 00000000 0x0 0x0
0xffffd18000014b80 0001 00000000 0x0 0x0
0xffffd18000014c00 0041 00000000 0x0 0x0
0xffffd18000014c80 0041 00000000 0x0 0x0
0xffffd18000014d00 0041 00000000 0x0 0x0
0xffffd18000014d80 0041 00000000 0x0 0x0
0xffffd18000014e00 0041 00000000 0x0 0x0
0xffffd18000014e80 0041 00000000 0x0 0x0
0xffffd18000014f00 0041 00000000 0x0 0x0
0xffffd18000014f80 0041 00000000 0x0 0x0
0xffffd18000015000 0041 00000000 0x0 0x0
0xffffd18000015080 0041 00000000 0x0 0x0
0xffffd18000015100 0041 00000000 0x0 0x0
0xffffd18000015180 0041 00000000 0x0 0x0
0xffffd18000015200 0041 00000000 0x0 0x0
0xffffd18000015280 0041 00000000 0x0 0x0
0xffffd18000015300 0041 00000000 0x0 0x0
0xffffd18000015380 0041 00000000 0x0 0x0
0xffffd18000015400 0041 00000000 0x0 0x0
0xffffd18000015480 0041 00000000 0x0 0x0
0xffffd18000015500 0041 00000000 0x0 0x0
0xffffd18000015580 0041 00000000 0x0 0x0
0xffffd18000015600 0041 00000000 0x0 0x0
0xffffd18000015680 0041 00000000 0x0 0x0
0xffffd18000015700 0041 00000000 0x0 0x0
0xffffd18000015780 0041 00000000 0x0 0x0
0xffffd18000015800 0041 00000000 0x0 0x0
0xffffd18000015880 0041 00000000 0x0 0x0
0xffffd18000015900 0041 00000000 0x0 0x0
0xffffd18000015980 0041 00000000 0x0 0x0
0xffffd18000015a00 0041 00000000 0x0 0x0
0xffffd18000015a80 0041 00000000 0x0 0x0
0xffffd18000015b00 0041 00000000 0x0 0x0
0xffffd18000015b80 0041 00000000 0x0 0x0
0xffffd18000015c00 0041 00000000 0x0 0x0
0xffffd18000015c80 0041 00000000 0x0 0x0
0xffffd18000015d00 0041 00000000 0x0 0x0
0xffffd18000015d80 0041 00000000 0x0 0x0
0xffffd18000015e00 0041 00000000 0x0 0x0
0xffffd18000015e80 0041 00000000 0x0 0x0
0xffffd18000015f00 0041 00000000 0x0 0x0
0xffffd18000015f80 0041 00000000 0x0 0x0
0xffffd18000016000 0041 00000000 0x0 0x0
0xffffd18000016080 0041 00000000 0x0 0x0
0xffffd18000016100 0001 00000000 0x0 0x0
0xffffd18000016180 0001 00000000 0x0 0x0
0xffffd18000016200 0001 00000000 0x0 0x0
0xffffd18000016280 0001 00000000 0x0 0x0
0xffffd18000016300 0001 00000000 0x0 0x0
0xffffd18000016380 0001 00000000 0x0 0x0
0xffffd18000016400 0001 00000000 0x0 0x0
0xffffd18000016480 0001 00000000 0x0 0x0
0xffffd18000016500 0001 00000000 0x0 0x0
0xffffd18000016580 0001 00000000 0x0 0x0
0xffffd18000016600 0001 00000000 0x0 0x0
0xffffd18000016680 0001 00000000 0x0 0x0
0xffffd18000016700 0001 00000000 0x0 0x0
0xffffd18000016780 0001 00000000 0x0 0x0
0xffffd18000016800 0001 00000000 0x0 0x0
0xffffd18000016880 0001 00000000 0x0 0x0
0xffffd18000016900 0001 00000000 0x0 0x0
0xffffd18000016980 0001 00000000 0x0 0x0
0xffffd18000016a00 0001 00000000 0x0 0x0
0xffffd18000016a80 0001 00000000 0x0 0x0
0xffffd18000016b00 0001 00000000 0x0 0x0
0xffffd18000016b80 0001 00000000 0x0 0x0
0xffffd18000016c00 0001 00000000 0x0 0x0
0xffffd18000016c80 0001 00000000 0x0 0x0
0xffffd18000016d00 0001 00000000 0x0 0x0
0xffffd18000016d80 0001 00000000 0x0 0x0
0xffffd18000016e00 0001 00000000 0x0 0x0
0xffffd18000016e80 0001 00000000 0x0 0x0
0xffffd18000016f00 0001 00000000 0x0 0x0
0xffffd18000016f80 0001 00000000 0x0 0x0
0xffffd18000017000 0001 00000000 0x0 0x0
0xffffd18000017080 0001 00000000 0x0 0x0
0xffffd18000017100 0001 00000000 0x0 0x0
0xffffd18000017180 0001 00000000 0x0 0x0
0xffffd18000017200 0001 00000000 0x0 0x0
0xffffd18000017280 0001 00000000 0x0 0x0
0xffffd18000017300 0001 00000000 0x0 0x0
0xffffd18000017380 0001 00000000 0x0 0x0
0xffffd18000017400 0001 00000000 0x0 0x0
0xffffd18000017480 0001 00000000 0x0 0x0
0xffffd18000017500 0001 00000000 0x0 0x0
0xffffd18000017580 0001 00000000 0x0 0x0
0xffffd18000017600 0001 00000000 0x0 0x0
0xffffd18000017680 0001 00000000 0x0 0x0
0xffffd18000017700 0001 00000000 0x0 0x0
0xffffd18000017780 0001 00000000 0x0 0x0
0xffffd18000017800 0001 00000000 0x0 0x0
0xffffd18000017880 0001 00000000 0x0 0x0
0xffffd18000017900 0001 00000000 0x0 0x0
0xffffd18000017980 0001 00000000 0x0 0x0
0xffffd18000017a00 0001 00000000 0x0 0x0
0xffffd18000017a80 0001 00000000 0x0 0x0
0xffffd18000017b00 0001 00000000 0x0 0x0
0xffffd18000017b80 0001 00000000 0x0 0x0
0xffffd18000017c00 0041 00000000 0x0 0x0
0xffffd18000017c80 0041 00000000 0x0 0x0
0xffffd18000017d00 0041 00000000 0x0 0x0
0xffffd18000017d80 0041 00000000 0x0 0x0
0xffffd18000017e00 0041 00000000 0x0 0x0
0xffffd18000017e80 0041 00000000 0x0 0x0
0xffffd18000017f00 0041 00000000 0x0 0x0
0xffffd18000017f80 0041 00000000 0x0 0x0
0xffffd18000018000 0041 00000000 0x0 0x0
0xffffd18000018080 0041 00000000 0x0 0x0
0xffffd18000018100 0041 00000000 0x0 0x0
0xffffd18000018180 0041 00000000 0x0 0x0
0xffffd18000018200 0041 00000000 0x0 0x0
0xffffd18000018280 0041 00000000 0x0 0x0
0xffffd18000018300 0041 00000000 0x0 0x0
0xffffd18000018380 0041 00000000 0x0 0x0
0xffffd18000018400 0041 00000000 0x0 0x0
0xffffd18000018480 0041 00000000 0x0 0x0
0xffffd18000018500 0041 00000000 0x0 0x0
0xffffd18000018580 0041 00000000 0x0 0x0
0xffffd18000018600 0041 00000000 0x0 0x0
0xffffd18000018680 0041 00000000 0x0 0x0
0xffffd18000018700 0041 00000000 0x0 0x0
0xffffd18000018780 0041 00000000 0x0 0x0
0xffffd18000018800 0041 00000000 0x0 0x0
0xffffd18000018880 0041 00000000 0x0 0x0
0xffffd18000018900 0041 00000000 0x0 0x0
0xffffd18000018980 0041 00000000 0x0 0x0
0xffffd18000018a00 0041 00000000 0x0 0x0
0xffffd18000018a80 0041 00000000 0x0 0x0
0xffffd18000018b00 0041 00000000 0x0 0x0
0xffffd18000018b80 0041 00000000 0x0 0x0
0xffffd18000018c00 0041 00000000 0x0 0x0
0xffffd18000018c80 0041 00000000 0x0 0x0
0xffffd18000018d00 0041 00000000 0x0 0x0
0xffffd18000018d80 0041 00000000 0x0 0x0
0xffffd18000018e00 0041 00000000 0x0 0x0
0xffffd18000018e80 0041 00000000 0x0 0x0
0xffffd18000018f00 0041 00000000 0x0 0x0
0xffffd18000018f80 0041 00000000 0x0 0x0
0xffffd18000019000 0041 00000000 0x0 0x0
0xffffd18000019080 0041 00000000 0x0 0x0
0xffffd18000019100 0001 00000000 0x0 0x0
0xffffd18000019180 0001 00000000 0x0 0x0
0xffffd18000019200 0001 00000000 0x0 0x0
0xffffd18000019280 0001 00000000 0x0 0x0
0xffffd18000019300 0001 00000000 0x0 0x0
0xffffd18000019380 0001 00000000 0x0 0x0
0xffffd18000019400 0001 00000000 0x0 0x0
0xffffd18000019480 0001 00000000 0x0 0x0
0xffffd18000019500 0001 00000000 0x0 0x0
0xffffd18000019580 0001 00000000 0x0 0x0
0xffffd18000019600 0001 00000000 0x0 0x0
0xffffd18000019680 0001 00000000 0x0 0x0
0xffffd18000019700 0001 00000000 0x0 0x0
0xffffd18000019780 0001 00000000 0x0 0x0
0xffffd18000019800 0001 00000000 0x0 0x0
0xffffd18000019880 0001 00000000 0x0 0x0
0xffffd18000019900 0001 00000000 0x0 0x0
0xffffd18000019980 0001 00000000 0x0 0x0
0xffffd18000019a00 0001 00000000 0x0 0x0
0xffffd18000019a80 0001 00000000 0x0 0x0
0xffffd18000019b00 0001 00000000 0x0 0x0
0xffffd18000019b80 0001 00000000 0x0 0x0
0xffffd18000019c00 0001 00000000 0x0 0x0
0xffffd18000019c80 0001 00000000 0x0 0x0
0xffffd18000019d00 0001 00000000 0x0 0x0
0xffffd18000019d80 0001 00000000 0x0 0x0
0xffffd18000019e00 0001 00000000 0x0 0x0
0xffffd18000019e80 0001 00000000 0x0 0x0
0xffffd18000019f00 0001 00000000 0x0 0x0
0xffffd18000019f80 0001 00000000 0x0 0x0
0xffffd1800001a000 0001 00000000 0x0 0x0
0xffffd1800001a080 0001 00000000 0x0 0x0
0xffffd1800001a100 0001 00000000 0x0 0x0
0xffffd1800001a180 0001 00000000 0x0 0x0
0xffffd1800001a200 0001 00000000 0x0 0x0
0xffffd1800001a280 0001 00000000 0x0 0x0
0xffffd1800001a300 0001 00000000 0x0 0x0
0xffffd1800001a380 0001 00000000 0x0 0x0
0xffffd1800001a400 0001 00000000 0x0 0x0
0xffffd1800001a480 0001 00000000 0x0 0x0
0xffffd1800001a500 0001 00000000 0x0 0x0
0xffffd1800001a580 0001 00000000 0x0 0x0
0xffffd1800001a600 0001 00000000 0x0 0x0
0xffffd1800001a680 0001 00000000 0x0 0x0
0xffffd1800001a700 0001 00000000 0x0 0x0
0xffffd1800001a780 0001 00000000 0x0 0x0
0xffffd1800001a800 0001 00000000 0x0 0x0
0xffffd1800001a880 0001 00000000 0x0 0x0
0xffffd1800001a900 0001 00000000 0x0 0x0
0xffffd1800001a980 0001 00000000 0x0 0x0
0xffffd1800001aa00 0001 00000000 0x0 0x0
0xffffd1800001aa80 0001 00000000 0x0 0x0
0xffffd1800001ab00 0001 00000000 0x0 0x0
0xffffd1800001ab80 0001 00000000 0x0 0x0
0xffffd1800001ac00 0041 00000000 0x0 0x0
0xffffd1800001ac80 0041 00000000 0x0 0x0
0xffffd1800001ad00 0041 00000000 0x0 0x0
0xffffd1800001ad80 0041 00000000 0x0 0x0
0xffffd1800001ae00 0041 00000000 0x0 0x0
0xffffd1800001ae80 0041 00000000 0x0 0x0
0xffffd1800001af00 0041 00000000 0x0 0x0
0xffffd1800001af80 0041 00000000 0x0 0x0
0xffffd1800001b000 0041 00000000 0x0 0x0
0xffffd1800001b080 0041 00000000 0x0 0x0
0xffffd1800001b100 0041 00000000 0x0 0x0
0xffffd1800001b180 0041 00000000 0x0 0x0
0xffffd1800001b200 0041 00000000 0x0 0x0
0xffffd1800001b280 0041 00000000 0x0 0x0
0xffffd1800001b300 0041 00000000 0x0 0x0
0xffffd1800001b380 0041 00000000 0x0 0x0
0xffffd1800001b400 0045 00000000 0x0 0x0
0xffffd1800001b480 0041 00000000 0x0 0x0
0xffffd1800001b500 0041 00000000 0x0 0x0
0xffffd1800001b580 0041 00000000 0x0 0x0
0xffffd1800001b600 0045 00000000 0x0 0x0
0xffffd1800001b680 0045 00000000 0x0 0x0
0xffffd1800001b700 0045 00000000 0x0 0x0
0xffffd1800001b780 0041 00000000 0x0 0x0
0xffffd1800001b800 0045 00000000 0x0 0x0
0xffffd1800001b880 0041 00000000 0x0 0x0
0xffffd1800001b900 0041 00000000 0x0 0x0
0xffffd1800001b980 0041 00000000 0x0 0x0
0xffffd1800001ba00 0045 00000000 0x0 0x0
0xffffd1800001ba80 0045 00000000 0x0 0x0
0xffffd1800001bb00 0045 00000000 0x0 0x0
0xffffd1800001bb80 0045 00000000 0x0 0x0
0xffffd1800001bc00 0045 00000000 0x0 0x0
0xffffd1800001bc80 0041 00000000 0x0 0x0
0xffffd1800001bd00 0045 00000000 0x0 0x0
0xffffd1800001bd80 0041 00000000 0x0 0x0
0xffffd1800001be00 0045 00000000 0x0 0x0
0xffffd1800001be80 0045 00000000 0x0 0x0
0xffffd1800001bf00 0045 00000000 0x0 0x0
0xffffd1800001bf80 0045 00000000 0x0 0x0
0xffffd1800001c000 0045 00000000 0x0 0x0
0xffffd1800001c080 0041 00000000 0x0 0x0
0xffffd1800001c100 0045 00000000 0x0 0x0
0xffffd1800001c180 0041 00000000 0x0 0x0
0xffffd1800001c200 0001 00000000 0x0 0x0
0xffffd1800001c280 0001 00000000 0x0 0x0
0xffffd1800001c300 0001 00000000 0x0 0x0
0xffffd1800001c380 0001 00000000 0x0 0x0
0xffffd1800001c400 0001 00000000 0x0 0x0
0xffffd1800001c480 0001 00000000 0x0 0x0
0xffffd1800001c500 0001 00000000 0x0 0x0
0xffffd1800001c580 0001 00000000 0x0 0x0
0xffffd1800001c600 0001 00000000 0x0 0x0
0xffffd1800001c680 0001 00000000 0x0 0x0
0xffffd1800001c700 0001 00000000 0x0 0x0
0xffffd1800001c780 0001 00000000 0x0 0x0
0xffffd1800001c800 0001 00000000 0x0 0x0
0xffffd1800001c880 0001 00000000 0x0 0x0
0xffffd1800001c900 0001 00000000 0x0 0x0
0xffffd1800001c980 0001 00000000 0x0 0x0
0xffffd1800001ca00 0001 00000000 0x0 0x0
0xffffd1800001ca80 0001 00000000 0x0 0x0
0xffffd1800001cb00 0001 00000000 0x0 0x0
0xffffd1800001cb80 0001 00000000 0x0 0x0
0xffffd1800001cc00 0001 00000000 0x0 0x0
0xffffd1800001cc80 0001 00000000 0x0 0x0
0xffffd1800001cd00 0001 00000000 0x0 0x0
0xffffd1800001cd80 0001 00000000 0x0 0x0
0xffffd1800001ce00 0001 00000000 0x0 0x0
0xffffd1800001ce80 0001 00000000 0x0 0x0
0xffffd1800001cf00 0001 00000000 0x0 0x0
0xffffd1800001cf80 0001 00000000 0x0 0x0
0xffffd1800001d000 0001 00000000 0x0 0x0
0xffffd1800001d080 0001 00000000 0x0 0x0
0xffffd1800001d100 0001 00000000 0x0 0x0
0xffffd1800001d180 0001 00000000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Mar 11, 2022, 2:07:21 PM3/11/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: c4733e605ce2 convert non-config-handled "DEBUG_ROOT" to ap..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=119954d9700000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=b9f9a02148a40675c38a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f9e709700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1508bd29700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b9f9a0...@syzkaller.appspotmail.com

[ 45.7422059] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/vfs_vnops.c:1135:10, signed integer overflow: 4611686018427389952 + 4611686018427389952 cannot be represented in type 'long int'

[ 45.7521921] cpu1: Begin traceback...
[ 45.7721921] vpanic() at netbsd:vpanic+0x2d0 sys/kern/subr_prf.c:290
[ 45.8321936] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 45.9122096] HandleOverflow() at netbsd:HandleOverflow+0x1d0 sys/../common/lib/libc/misc/ubsan.c:375
[ 45.9621982] vn_seek() at netbsd:vn_seek+0x2de sys/kern/vfs_vnops.c:1135
[ 46.0021941] sys_lseek() at netbsd:sys_lseek+0x148 sys/kern/vfs_syscalls.c:2968
[ 46.0521930] sys_syscall() at netbsd:sys_syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
[ 46.0521930] sys_syscall() at netbsd:sys_syscall+0x1cf sys/kern/sys_syscall.c:77
[ 46.0921926] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 46.0921926] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 46.0921926] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 46.1021944] --- syscall (number 0) ---
[ 46.1221936] netbsd:syscall+0x2da:
[ 46.1221936] cpu1: End traceback...
[ 46.1321947] fatal breakpoint trap in supervisor mode
[ 46.1321947] trap type 1 code 0 rip 0xffffffff80221a95 cs 0x8 rflags 0x246 cr2 0x7d5d75242490 ilevel 0 rsp 0xffffb400c8304790
[ 46.1421913] curlwp 0xffffd47141c2c540 pid 1124.1124 lowest kstack 0xffffb400c83002c0
Stopped in pid 1124.1124 (syz-executor3163) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2d0 sys/kern/subr_prf.c:290
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleOverflow() at netbsd:HandleOverflow+0x1d0 sys/../common/lib/libc/misc/ubsan.c:375
vn_seek() at netbsd:vn_seek+0x2de sys/kern/vfs_vnops.c:1135

sys_lseek() at netbsd:sys_lseek+0x148 sys/kern/vfs_syscalls.c:2968
sys_syscall() at netbsd:sys_syscall+0x1cf sy_call sys/sys/syscallvar.h:66 [inline]
sys_syscall() at netbsd:sys_syscall+0x1cf sys/kern/sys_syscall.c:77

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138

--- syscall (number 0) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/vfs_vnops.c:1135:10, signed integer overflow: 4611686018427389952 + 4611686018427389952 cannot be represented in type 'long int'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1231 1231 3 0 0 ffffd47140e4d700 syz-executor3163 tstile
1130 1130 3 0 0 ffffd471419fe500 syz-executor3163 tstile
1124 >1124 7 1 0 ffffd47141c2c540 syz-executor3163
1086 1086 2 1 0 ffffd47140d97bc0 syz-executor3163
844 844 2 1 0 ffffd47141c2c980 syz-executor3163
424 424 2 0 0 ffffd47142257140 syz-executor3163
1227 1227 3 0 0 ffffd4714280a1c0 syz-executor3163 tstile
1194 1194 2 0 0 ffffd471422579c0 syz-executor3163
1105 1105 2 0 140 ffffd47140b63ac0 syz-executor3163
1075 1075 2 1 140 ffffd47140df8280 syz-executor3163
1222 1222 2 1 140 ffffd471407f2600 syz-executor3163
1255 1255 3 0 180 ffffd47140b63240 syz-executor3163 nanoslp
1054 1054 2 1 100 ffffd47140b63680 sshd
873 873 3 0 180 ffffd47142fa0180 getty nanoslp
1070 1070 3 0 180 ffffd47142257580 getty nanoslp
1068 1068 3 0 180 ffffd4714280a600 getty nanoslp
1073 1073 3 0 1c0 ffffd47142fa0a00 getty ttyraw
1093 1093 3 1 180 ffffd47140df8b00 sshd select
956 956 3 1 180 ffffd47142fa05c0 powerd kqueue
690 690 3 0 180 ffffd47140d97340 syslogd kqueue
602 602 3 1 180 ffffd47141086b80 dhcpcd poll
739 739 3 1 180 ffffd47141086300 dhcpcd poll
546 546 3 1 180 ffffd471418eb040 dhcpcd poll
589 589 3 1 180 ffffd47140e4d2c0 dhcpcd poll
289 289 3 1 180 ffffd47140e4db40 dhcpcd poll
288 288 3 1 180 ffffd47140df86c0 dhcpcd poll
351 351 3 1 180 ffffd47141086740 dhcpcd poll
1 1 3 1 180 ffffd47138686540 init wait
0 967 3 0 200 ffffd471407f2a40 physiod physiod
0 194 3 1 200 ffffd4714087da80 pooldrain pooldrain
0 193 2 1 240 ffffd4714087d640 ioflush
0 192 3 0 200 ffffd4714087d200 pgdaemon pgdaemon
0 166 3 1 200 ffffd471407f21c0 usb7 usbevt
0 165 3 1 200 ffffd4713d78da00 usb6 usbevt
0 164 3 1 200 ffffd4713d78d5c0 usb5 usbevt
0 163 3 1 200 ffffd4713d78d180 usb4 usbevt
0 31 3 1 200 ffffd4713a7109c0 usb3 usbevt
0 63 3 1 200 ffffd4713a710580 usb2 usbevt
0 126 3 1 200 ffffd4713a710140 usb1 usbevt
0 125 3 1 200 ffffd47138686980 usb0 usbevt
0 124 3 1 200 ffffd47137f6ab40 usbtask-dr usbtsk
0 123 3 0 200 ffffd47137f3d6c0 usbtask-hc usbtsk
0 122 3 0 200 ffffd471385dd300 npfgc0 npfgcw
0 121 3 1 200 ffffd47138686100 rt_free rt_free
0 120 3 1 200 ffffd47138659940 unpgc unpgc
0 119 3 0 200 ffffd47138659500 key_timehandler key_timehandler
0 118 3 1 200 ffffd471386590c0 icmp6_wqinput/1 icmp6_wqinput
0 117 3 0 200 ffffd4713862c900 icmp6_wqinput/0 icmp6_wqinput
0 116 3 0 200 ffffd4713862c4c0 nd6_timer nd6_timer
0 115 3 1 200 ffffd4713862c080 carp6_wqinput/1 carp6_wqinput
0 114 3 0 200 ffffd471386178c0 carp6_wqinput/0 carp6_wqinput
0 113 3 1 200 ffffd47138617480 carp_wqinput/1 carp_wqinput
0 112 3 0 200 ffffd47138617040 carp_wqinput/0 carp_wqinput
0 111 3 1 200 ffffd47138611bc0 icmp_wqinput/1 icmp_wqinput
0 110 3 0 200 ffffd47138611780 icmp_wqinput/0 icmp_wqinput
0 109 3 0 200 ffffd47138611340 rt_timer rt_timer
0 108 3 1 200 ffffd471385dd740 vmem_rehash vmem_rehash
0 107 3 0 200 ffffd471385ddb80 entbutler entropy
0 98 3 1 200 ffffd47137f6a700 viomb balloon
0 97 3 1 200 ffffd47137f6a2c0 vioif0_txrx/1 vioif0_txrx
0 96 3 0 200 ffffd47137f3db00 vioif0_txrx/0 vioif0_txrx
0 29 3 0 200 ffffd47137f3d280 scsibus0 sccomp
0 28 3 1 200 ffffd471369d3ac0 pms0 pmsreset
0 27 3 1 200 ffffd471369d3680 xcall/1 xcall
0 26 1 1 200 ffffd471369d3240 softser/1
0 25 1 1 200 ffffd4713699ea80 softclk/1
0 24 1 1 200 ffffd4713699e640 softbio/1
0 23 1 1 200 ffffd4713699e200 softnet/1
0 22 1 1 201 ffffd4726593ba40 idle/1
0 21 3 1 200 ffffd4726593b600 lnxsyswq lnxsyswq
0 20 3 1 200 ffffd4726593b1c0 lnxubdwq lnxubdwq
0 19 3 1 200 ffffd47265940a00 lnxpwrwq lnxpwrwq
0 18 3 1 200 ffffd472659405c0 lnxlngwq lnxlngwq
0 17 3 1 200 ffffd47265940180 lnxhipwq lnxhipwq
0 16 3 0 200 ffffd472659619c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffd47265961580 sysmon smtaskq
0 14 3 1 200 ffffd47265961140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffd4726596a980 pmfevent pmfevent
0 12 3 0 200 ffffd4726596a540 sopendfree sopendfr
0 11 3 0 200 ffffd4726596a100 iflnkst iflnkst
0 10 3 1 200 ffffd4726699b940 nfssilly nfssilly
0 9 3 0 200 ffffd4726699b500 vdrain vdrain
0 8 3 0 200 ffffd4726699b0c0 modunload mod_unld
0 7 3 0 200 ffffd472669c6900 xcall/0 xcall
0 6 1 0 200 ffffd472669c64c0 softser/0
0 5 1 0 200 ffffd472669c6080 softclk/0
0 4 1 0 200 ffffd472669f38c0 softbio/0
0 3 1 0 200 ffffd472669f3480 softnet/0
0 2 1 0 201 ffffd472669f3040 idle/0
0 > 0 7 0 240 ffffffff8652e380 swapper
[Locks tracked through LWPs]

****** LWP 1086.1086 (syz-executor3163) @ 0xffffd47140d97bc0, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffffd471430637c0 type : sleep/adaptive
initialized : 0xffffffff8399bd90

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 1
relevant lwp : 0xffffd47140d97bc0 last held: 000000000000000000
last locked : 0xffffffff839fa3d0 unlocked*: 0xffffffff839fa554
owner/count : 0xffffd4714280a1c0 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 2 waiting writers: 0xffffd47140e4d700 0xffffd471419fe500

****** LWP 844.844 (syz-executor3163) @ 0xffffd47141c2c980, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffffd47140e86f80 type : sleep/adaptive
initialized : 0xffffffff80fdebed
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 0

relevant cpu : 1 last held: 1
relevant lwp : 0xffffd47141c2c980 last held: 0xffffd47141c2c980
last locked* : 0xffffffff80fe12f6 unlocked : 0xffffffff80fde9b8
owner field : 0xffffd47141c2c980 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1194.1194 (syz-executor3163) @ 0xffffd471422579c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at uvmspace_alloc)
lock address : 0xffffd471386821a0 type : sleep/adaptive
initialized : 0xffffffff835bbf55
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffd471422579c0 last held: 0xffffd471422579c0
last locked* : 0xffffffff835aa24f unlocked : 0xffffffff83591998
owner/count : 000000000000000000 flags : 000000000000000000

Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at amap_alloc1)
lock address : 0xffffd471437e0f80 type : sleep/adaptive
initialized : 0xffffffff8356fc0a

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 1
relevant cpu : 0 last held: 1
relevant lwp : 0xffffd471422579c0 last held: 000000000000000000
last locked : 0xffffffff83593fee unlocked*: 0xffffffff835900bf
owner/count : 000000000000000000 flags : 000000000000000000

Turnstile: no active turnstile for this lock.

****** LWP 739.739 (dhcpcd) @ 0xffffd47141086300, l_stat=3