MSan: Uninitialized Memory in rum_attach

4 views

Skip to first unread message

syzbot

unread,

Aug 12, 2022, 12:13:32 PM8/12/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 23662f064a67 subr_prf.c & luasystm.c: s/panicing/panicking..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1226ee2d080000
kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=f2cba71b1b1bc91029b3
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f2cba7...@syzkaller.appspotmail.com

[ 62.5144862] panic: MSan: Uninitialized Variable 'val.i' From rum_attach()

[ 62.5286638] cpu0: Begin traceback...
[ 62.5444770] vpanic() at netbsd:vpanic+0xc9d
[ 62.6044780] panic() at netbsd:panic+0x1b3 sys/kern/subr_prf.c:210
[ 62.6544762] __msan_warning() at netbsd:__msan_warning+0x11e kmsan_report_inline sys/kern/subr_msan.c:234 [inline]
[ 62.6544762] __msan_warning() at netbsd:__msan_warning+0x11e sys/kern/subr_msan.c:615
[ 62.7144762] rum_attach() at netbsd:rum_attach+0xfda
[ 62.7644766] config_attach_internal() at netbsd:config_attach_internal+0xdb7 sys/kern/subr_autoconf.c:1775
[ 62.8244817] config_found() at netbsd:config_found+0x411 sys/kern/subr_autoconf.c:1262
[ 62.8844805] usbd_attachwholedevice() at netbsd:usbd_attachwholedevice+0x5ad sys/dev/usb/usb_subr.c:1137
[ 62.9444749] usbd_probe_and_attach() at netbsd:usbd_probe_and_attach+0x100 sys/dev/usb/usb_subr.c:1261
[ 62.9944754] usbd_new_device() at netbsd:usbd_new_device+0x24c2
[ 63.0544768] uhub_explore() at netbsd:uhub_explore+0x3122
[ 63.1244750] usb_discover() at netbsd:usb_discover+0x453 sys/dev/usb/usb.c:1196
[ 63.1844798] usb_event_thread() at netbsd:usb_event_thread+0x2b7 sys/dev/usb/usb.c:728
[ 63.2044769] cpu0: End traceback...
[ 63.2044769] fatal breakpoint trap in supervisor mode
[ 63.2162349] trap type 1 code 0 rip 0xffffffff802228ad cs 0x8 rflags 0x282 cr2 0xa42000 ilevel 0 rsp 0xffff9080c47013e0
[ 63.2269076] curlwp 0xffff908012103180 pid 0.164 lowest kstack 0xffff9080c46fa2c0
Stopped in pid 0.164 (system) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0xc9d
panic() at netbsd:panic+0x1b3 sys/kern/subr_prf.c:210
__msan_warning() at netbsd:__msan_warning+0x11e kmsan_report_inline sys/kern/subr_msan.c:234 [inline]
__msan_warning() at netbsd:__msan_warning+0x11e sys/kern/subr_msan.c:615
rum_attach() at netbsd:rum_attach+0xfda
config_attach_internal() at netbsd:config_attach_internal+0xdb7 sys/kern/subr_autoconf.c:1775
config_found() at netbsd:config_found+0x411 sys/kern/subr_autoconf.c:1262
usbd_attachwholedevice() at netbsd:usbd_attachwholedevice+0x5ad sys/dev/usb/usb_subr.c:1137
usbd_probe_and_attach() at netbsd:usbd_probe_and_attach+0x100 sys/dev/usb/usb_subr.c:1261
usbd_new_device() at netbsd:usbd_new_device+0x24c2
uhub_explore() at netbsd:uhub_explore+0x3122
usb_discover() at netbsd:usb_discover+0x453 sys/dev/usb/usb.c:1196
usb_event_thread() at netbsd:usb_event_thread+0x2b7 sys/dev/usb/usb.c:728
Panic string: MSan: Uninitialized Variable 'val.i' From rum_attach()

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
1747 2256 3 1 1c0 ffff908013745a80 syz-executor.4 parked
1747 969 2 0 0 ffff908013745640 syz-executor.4
1747 1747 2 1 10000140 ffff908013750ac0 syz-executor.4
2344 1854 3 0 180 ffff90801388c700 syz-executor.1 parked
2344 1446 3 1 180 ffff9080136c1600 syz-executor.1 parked
2344 2344 2 0 10000140 ffff908013750680 syz-executor.1
1977 2092 3 0 180 ffff9080136c1a40 syz-executor.5 parked
1977 2010 3 1 180 ffff9080136c11c0 syz-executor.5 nanoslp
1977 1977 2 1 10000140 ffff908013750240 syz-executor.5
982 982 2 0 140 ffff908013635180 syz-executor.5
988 988 3 0 1c0 ffff90801355b9c0 syz-executor.2 pipe_rd
1231 1231 2 0 140 ffff90801355b580 syz-executor.4
1151 1151 3 1 1c0 ffff9080134d9980 syz-executor.3 pipe_rd
1129 1129 2 0 140 ffff9080133a5940 syz-executor.1
1220 1220 3 1 1c0 ffff9080133a5500 syz-executor.0 pipe_rd
1084 1253 3 0 180 ffff908013635a00 syz-fuzzer parked
1084 1236 3 1 180 ffff9080136355c0 syz-fuzzer parked
1084 1194 3 0 180 ffff90801355b140 syz-fuzzer wait
1084 1229 3 1 180 ffff9080134d9540 syz-fuzzer wait
1084 972 2 0 100 ffff9080134d9100 syz-fuzzer
1084 1224 3 1 180 ffff9080133a50c0 syz-fuzzer wait
1084 1223 3 0 180 ffff908012b57900 syz-fuzzer wait
1084 977 3 0 180 ffff908012b574c0 syz-fuzzer wait
1084 1222 3 1 180 ffff908012b57080 syz-fuzzer parked
1084 1221 3 0 180 ffff908012430b40 syz-fuzzer parked
1084 1111 3 1 180 ffff908012b3b8c0 syz-fuzzer wait
1084 1078 2 1 140 ffff908012af1bc0 syz-fuzzer
1084 1084 3 0 180 ffff908012af1780 syz-fuzzer parked
1252 1252 3 1 180 ffff90801229cac0 sshd select
1076 1076 3 1 180 ffff908012b3b480 getty nanoslp
1070 1070 3 0 180 ffff90801229c680 getty nanoslp
1069 1069 3 1 180 ffff90801229c240 getty nanoslp
1126 1126 3 0 1c0 ffff90801219b600 getty ttyraw
926 926 3 1 180 ffff908012b3b040 sshd select
872 872 3 0 180 ffff908012331280 powerd kqueue
689 689 3 1 180 ffff9080124deb80 syslogd kqueue
547 547 3 0 180 ffff908012430700 dhcpcd poll
546 546 3 0 180 ffff9080123316c0 dhcpcd poll
600 600 3 0 180 ffff9080124302c0 dhcpcd poll
587 587 3 0 180 ffff908012af1340 dhcpcd poll
289 289 3 0 180 ffff9080124de740 dhcpcd poll
288 288 3 0 180 ffff908012331b00 dhcpcd poll
351 351 3 0 180 ffff9080124de300 dhcpcd poll
1 1 3 0 180 ffff908011ebd940 init wait
0 827 2 1 200 ffff908013745200 ktrace
0 939 3 0 200 ffff90801219ba40 physiod physiod
0 194 3 0 200 ffff9080121a4a80 pooldrain pooldrain
0 193 2 1 240 ffff9080121a4640 ioflush
0 192 3 1 200 ffff9080121a4200 pgdaemon pgdaemon
0 169 3 0 200 ffff90801219b1c0 usb7 usbevt
0 167 3 0 200 ffff908012103a00 usb6 usbevt
0 165 3 0 200 ffff9080121035c0 usb5 usbevt
0 > 164 7 0 240 ffff908012103180 usb4
0 31 3 0 200 ffff9080120699c0 usb3 usbevt
0 63 3 0 200 ffff908012069580 usb2 usbevt
0 126 3 0 200 ffff908012069140 usb1 usbevt
0 125 3 0 200 ffff908011ecc980 usb0 usbevt
0 124 3 1 200 ffff908011ecc540 usbtask-dr usbtsk
0 123 3 1 200 ffff9080117c46c0 usbtask-hc usbtsk
0 122 3 1 200 ffff908011ecc100 npfgc0 npfgcw
0 121 3 1 200 ffff908011ebd500 rt_free rt_free
0 120 3 1 200 ffff908011ebd0c0 unpgc unpgc
0 119 2 0 200 ffff908011eb9900 key_timehandler
0 118 3 1 200 ffff908011eb94c0 icmp6_wqinput/1 icmp6_wqinput
0 117 3 0 200 ffff908011eb9080 icmp6_wqinput/0 icmp6_wqinput
0 116 2 0 200 ffff908011e9b8c0 nd6_timer
0 115 3 1 200 ffff908011e9b480 carp6_wqinput/1 carp6_wqinput
0 114 3 0 200 ffff908011e9b040 carp6_wqinput/0 carp6_wqinput
0 113 3 1 200 ffff908011cc4b80 carp_wqinput/1 carp_wqinput
0 112 3 0 200 ffff908011cc4740 carp_wqinput/0 carp_wqinput
0 111 3 1 200 ffff908011cc4300 icmp_wqinput/1 icmp_wqinput
0 110 3 0 200 ffff908011cc5780 icmp_wqinput/0 icmp_wqinput
0 109 2 0 200 ffff908011cc5340 rt_timer
0 108 2 0 200 ffff908011cc5bc0 vmem_rehash
0 99 3 0 200 ffff9080117c6b40 entbutler entropy
0 98 2 1 240 ffff9080117c6700 viomb
0 97 3 1 200 ffff9080117c62c0 vioif0_txrx/1 vioif0_txrx
0 96 3 0 200 ffff9080117c4b00 vioif0_txrx/0 vioif0_txrx
0 29 3 0 200 ffff9080117c4280 scsibus0 sccomp
0 28 3 0 200 ffff9080103c0ac0 pms0 pmsreset
0 27 3 1 200 ffff9080103c0680 xcall/1 xcall
0 26 1 1 200 ffff9080103c0240 softser/1
0 25 1 1 200 ffff9080103bfa80 softclk/1
0 24 1 1 200 ffff9080103bf640 softbio/1
0 23 1 1 200 ffff9080103bf200 softnet/1
0 22 1 1 201 ffff90800f1f3a40 idle/1
0 21 3 0 200 ffff90800f1f3600 lnxsyswq lnxsyswq
0 20 3 0 200 ffff90800f1f31c0 lnxubdwq lnxubdwq
0 19 3 0 200 ffff90800f1f1a00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffff90800f1f15c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffff90800f1f1180 lnxhipwq lnxhipwq
0 16 3 0 200 ffff90800f1ec9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffff90800f1ec580 sysmon smtaskq
0 14 3 0 200 ffff90800f1ec140 pmfsuspend pmfsuspend
0 13 3 0 200 ffff90800f1e8980 pmfevent pmfevent
0 12 3 0 200 ffff90800f1e8540 sopendfree sopendfr
0 11 3 0 200 ffff90800f1e8100 iflnkst iflnkst
0 10 3 0 200 ffff90800f1de940 nfssilly nfssilly
0 9 3 0 200 ffff90800f1de500 vdrain vdrain
0 8 3 1 200 ffff90800f1de0c0 modunload mod_unld
0 7 3 0 200 ffff90800ebdb900 xcall/0 xcall
0 6 1 0 200 ffff90800ebdb4c0 softser/0
0 5 1 0 200 ffff90800ebdb080 softclk/0
0 4 1 0 200 ffff90800ebd98c0 softbio/0
0 3 1 0 200 ffff90800ebd9480 softnet/0
0 2 1 0 201 ffff90800ebd9040 idle/0
0 > 0 7 1 240 ffffffff86869280 swapper
[Locks tracked through LWPs]

****** LWP 546.546 (dhcpcd) @ 0xffff9080123316c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff868f7dc0 type : sleep/adaptive
initialized : 0xffffffff851a8713
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9080123316c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 600.600 (dhcpcd) @ 0xffff9080124302c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff868f7dc0 type : sleep/adaptive
initialized : 0xffffffff851a8713
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9080124302c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 288.288 (dhcpcd) @ 0xffff908012331b00, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff868f7dc0 type : sleep/adaptive
initialized : 0xffffffff851a8713
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff908012331b00 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 351.351 (dhcpcd) @ 0xffff9080124de300, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff868f7dc0 type : sleep/adaptive
initialized : 0xffffffff851a8713
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9080124de300 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffff90800f1e8100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff868f7dc0 type : sleep/adaptive
initialized : 0xffffffff851a8713
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff90800f1e8100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffff90800ebdb080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff868f7dc0 type : sleep/adaptive
initialized : 0xffffffff851a8713
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff90800ebdb080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff86869280, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff868f7dc0 type : sleep/adaptive
initialized : 0xffffffff851a8713
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffffff86869280 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at main)
lock address : 0xffffffff868f7cc0 type : spin
initialized : 0xffffffff8508bd94
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff908012103180 last held: 0xffff908012103180
last locked* : 0xffffffff8524ee6b unlocked : 0xffffffff850bc56e
curcpu holds : 2 wanted by: 000000000000000000

* Lock 1 (initialized at kprintf_init)
lock address : 0xffffffff868aac00 type : spin
initialized : 0xffffffff853c5cbc
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff908012103180 last held: 0xffff908012103180
last locked* : 0xffffffff853c6ae4 unlocked : 0xffffffff853c74ee
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffff908000017180 0001 00000000 0x0 0x0
0xffff908000017200 0041 00000000 0x0 0x0
0xffff908000017280 0041 00000000 0x0 0x0
0xffff908000017300 0041 00000000 0x0 0x0
0xffff908000017380 0041 00000000 0x0 0x0
0xffff908000017400 0041 00000000 0x0 0x0
0xffff908000017480 0041 00000000 0x0 0x0
0xffff908000017500 0041 00000000 0x0 0x0
0xffff908000017580 0041 00000000 0x0 0x0
0xffff908000017600 0041 00000000 0x0 0x0
0xffff908000017680 0041 00000000 0x0 0x0
0xffff908000017700 0041 00000000 0x0 0x0
0xffff908000017780 0041 00000000 0x0 0x0
0xffff908000017800 0041 00000000 0x0 0x0
0xffff908000017880 0041 00000000 0x0 0x0
0xffff908000017900 0041 00000000 0x0 0x0
0xffff908000017980 0041 00000000 0x0 0x0
0xffff908000017a00 0041 00000000 0x0 0x0
0xffff908000017a80 0041 00000000 0x0 0x0
0xffff908000017b00 0041 00000000 0x0 0x0
0xffff908000017b80 0041 00000000 0x0 0x0
0xffff908000017c00 0041 00000000 0x0 0x0
0xffff908000017c80 0041 00000000 0x0 0x0
0xffff908000017d00 0041 00000000 0x0 0x0
0xffff908000017d80 0041 00000000 0x0 0x0
0xffff908000017e00 0041 00000000 0x0 0x0
0xffff908000017e80 0041 00000000 0x0 0x0
0xffff908000017f00 0041 00000000 0x0 0x0
0xffff908000017f80 0041 00000000 0x0 0x0
0xffff908000018000 0041 00000000 0x0 0x0
0xffff908000018080 0041 00000000 0x0 0x0
0xffff908000018100 0041 00000000 0x0 0x0
0xffff908000018180 0041 00000000 0x0 0x0
0xffff908000018200 0041 00000000 0x0 0x0
0xffff908000018280 0041 00000000 0x0 0x0
0xffff908000018300 0041 00000000 0x0 0x0
0xffff908000018380 0041 00000000 0x0 0x0
0xffff908000018400 0041 00000000 0x0 0x0
0xffff908000018480 0041 00000000 0x0 0x0
0xffff908000018500 0041 00000000 0x0 0x0
0xffff908000018580 0041 00000000 0x0 0x0
0xffff908000018600 0041 00000000 0x0 0x0
0xffff908000018680 0041 00000000 0x0 0x0
0xffff908000018700 0041 00000000 0x0 0x0
0xffff908000018780 0041 00000000 0x0 0x0
0xffff908000018800 0041 00000000 0x0 0x0
0xffff908000018880 0041 00000000 0x0 0x0
0xffff908000018900 0041 00000000 0x0 0x0
0xffff908000018980 0041 00000000 0x0 0x0
0xffff908000018a00 0041 00000000 0x0 0x0
0xffff908000018a80 0041 00000000 0x0 0x0
0xffff908000018b00 0041 00000000 0x0 0x0
0xffff908000018b80 0041 00000000 0x0 0x0
0xffff908000018c00 0041 00000000 0x0 0x0
0xffff908000018c80 0041 00000000 0x0 0x0
0xffff908000018d00 0041 00000000 0x0 0x0
0xffff908000018d80 0041 00000000 0x0 0x0
0xffff908000018e00 0041 00000000 0x0 0x0
0xffff908000018e80 0041 00000000 0x0 0x0
0xffff908000018f00 0041 00000000 0x0 0x0
0xffff908000018f80 0041 00000000 0x0 0x0
0xffff908000019000 0041 00000000 0x0 0x0
0xffff908000019080 0041 00000000 0x0 0x0
0xffff908000019100 0041 00000000 0x0 0x0
0xffff908000019180 0041 00000000 0x0 0x0
0xffff908000019200 0041 00000000 0x0 0x0
0xffff908000019280 0041 00000000 0x0 0x0
0xffff908000019300 0041 00000000 0x0 0x0
0xffff908000019380 0041 00000000 0x0 0x0
0xffff908000019400 0041 00000000 0x0 0x0
0xffff908000019480 0041 00000000 0x0 0x0
0xffff908000019500 0041 00000000 0x0 0x0
0xffff908000019580 0041 00000000 0x0 0x0
0xffff908000019600 0041 00000000 0x0 0x0
0xffff908000019680 0041 00000000 0x0 0x0
0xffff908000019700 0041 00000000 0x0 0x0
0xffff908000019780 0041 00000000 0x0 0x0
0xffff908000019800 0041 00000000 0x0 0x0
0xffff908000019880 0041 00000000 0x0 0x0
0xffff908000019900 0041 00000000 0x0 0x0
0xffff908000019980 0041 00000000 0x0 0x0
0xffff908000019a00 0041 00000000 0x0 0x0
0xffff908000019a80 0041 00000000 0x0 0x0
0xffff908000019b00 0041 00000000 0x0 0x0
0xffff908000019b80 0041 00000000 0x0 0x0
0xffff908000019c00 0041 00000000 0x0 0x0
0xffff908000019c80 0041 00000000 0x0 0x0
0xffff908000019d00 0041 00000000 0x0 0x0
0xffff908000019d80 0041 00000000 0x0 0x0
0xffff908000019e00 0041 00000000 0x0 0x0
0xffff908000019e80 0041 00000000 0x0 0x0
0xffff908000019f00 0041 00000000 0x0 0x0
0xffff908000019f80 0041 00000000 0x0 0x0
0xffff90800001a000 0041 00000000 0x0 0x0
0xffff90800001a080 0041 00000000 0x0 0x0
0xffff90800001a100 0041 00000000 0x0 0x0
0xffff90800001a180 0041 00000000 0x0 0x0
0xffff90800001a200 0041 00000000 0x0 0x0
0xffff90800001a280 0041 00000000 0x0 0x0
0xffff90800001a300 0041 00000000 0x0 0x0
0xffff90800001a380 0041 00000000 0x0 0x0
0xffff90800001a400 0041 00000000 0x0 0x0
0xffff90800001a480 0041 00000000 0x0 0x0
0xffff90800001a500 0041 00000000 0x0 0x0
0xffff90800001a580 0041 00000000 0x0 0x0
0xffff90800001a600 0041 00000000 0x0 0x0
0xffff90800001a680 0041 00000000 0x0 0x0
0xffff90800001a700 0041 00000000 0x0 0x0
0xffff90800001a780 0041 00000000 0x0 0x0
0xffff90800001a800 0041 00000000 0x0 0x0
0xffff90800001a880 0041 00000000 0x0 0x0
0xffff90800001a900 0041 00000000 0x0 0x0
0xffff90800001a980 0041 00000000 0x0 0x0
0xffff90800001aa00 0041 00000000 0x0 0x0
0xffff90800001aa80 0041 00000000 0x0 0x0
0xffff90800001ab00 0041 00000000 0x0 0x0
0xffff90800001ab80 0041 00000000 0x0 0x0
0xffff90800001ac00 0041 00000000 0x0 0x0
0xffff90800001ac80 0041 00000000 0x0 0x0
0xffff90800001ad00 0041 00000000 0x0 0x0
0xffff90800001ad80 0041 00000000 0x0 0x0
0xffff90800001ae00 0041 00000000 0x0 0x0
0xffff90800001ae80 0041 00000000 0x0 0x0
0xffff90800001af00 0041 00000000 0x0 0x0
0xffff90800001af80 0041 00000000 0x0 0x0
0xffff90800001b000 0041 00000000 0x0 0x0
0xffff90800001b080 0041 00000000 0x0 0x0
0xffff90800001b100 0041 00000000 0x0 0x0
0xffff90800001b180 0041 00000000 0x0 0x0
0xffff90800001b200 0041 00000000 0x0 0x0
0xffff90800001b280 0041 00000000 0x0 0x0
0xffff90800001b300 0041 00000000 0x0 0x0
0xffff90800001b380 0041 00000000 0x0 0x0
0xffff90800001b400 0041 00000000 0x0 0x0
0xffff90800001b480 0041 00000000 0x0 0x0
0xffff90800001b500 0041 00000000 0x0 0x0
0xffff90800001b580 0041 00000000 0x0 0x0
0xffff90800001b600 0041 00000000 0x0 0x0
0xffff90800001b680 0041 00000000 0x0 0x0
0xffff90800001b700 0041 00000000 0x0 0x0
0xffff90800001b780 0041 00000000 0x0 0x0
0xffff90800001b800 0041 00000000 0x0 0x0
0xffff90800001b880 0041 00000000 0x0 0x0
0xffff90800001b900 0041 00000000 0x0 0x0
0xffff90800001b980 0041 00000000 0x0 0x0
0xffff90800001ba00 0041 00000000 0x0 0x0
0xffff90800001ba80 0041 00000000 0x0 0x0
0xffff90800001bb00 0041 00000000 0x0 0x0
0xffff90800001bb80 0041 00000000 0x0 0x0
0xffff90800001bc00 0041 00000000 0x0 0x0
0xffff90800001bc80 0041 00000000 0x0 0x0
0xffff90800001bd00 0041 00000000 0x0 0x0
0xffff90800001bd80 0041 00000000 0x0 0x0
0xffff90800001be00 0041 00000000 0x0 0x0
0xffff90800001be80 0041 00000000 0x0 0x0
0xffff90800001bf00 0041 00000000 0x0 0x0
0xffff90800001bf80 0041 00000000 0x0 0x0
0xffff90800001c000 0041 00000000 0x0 0x0
0xffff90800001c080 0041 00000000 0x0 0x0
0xffff90800001c100 0041 00000000 0x0 0x0
0xffff90800001c180 0041 00000000 0x0 0x0
0xffff90800001c200 0041 00000000 0x0 0x0
0xffff90800001c280 0041 00000000 0x0 0x0
0xffff90800001c300 0041 00000000 0x0 0x0
0xffff90800001c380 0041 00000000 0x0 0x0
0xffff90800001c400 0041 00000000 0x0 0x0
0xffff90800001c480 0041 00000000 0x0 0x0
0xffff90800001c500 0041 00000000 0x0 0x0
0xffff90800001c580 0041 00000000 0x0 0x0
0xffff90800001c600 0041 00000000 0x0 0x0
0xffff90800001c680 0041 00000000 0x0 0x0
0xffff90800001c700 0041 00000000 0x0 0x0
0xffff90800001c780 0001 00000000 0x0 0x0
0xffff90800001c800 0001 00000000 0x0 0x0
0xffff90800001c880 0001 00000000 0x0 0x0
0xffff90800001c900 0001 00000000 0x0 0x0
0xffff90800001c980 0001 00000000 0x0 0x0
0xffff90800001ca00 0001 00000000 0x0 0x0
0xffff90800001ca80 0001 00000000 0x0 0x0
0xffff90800001cb00 0001 00000000 0x0 0x0
0xffff90800001cb80 0001 00000000 0x0 0x0
0xffff90800001cc00 0001 00000000 0x0 0x0
0xffff90800001cc80 0001 00000000 0x0 0x0
0xffff90800001cd00 0001 00000000 0x0 0x0
0xffff90800001cd80 0001 00000000 0x0 0x0
0xffff90800001ce00 0001 00000000 0x0 0x0
0xffff90800001ce80 0001 00000000 0x0 0x0
0xffff90800001cf00 0001 00000000 0x0 0x0
0xffff90800001cf80 0001 00000000 0x0 0x0
0xffff90800001d000 0001 00000000 0x0 0x0
0xffff90800001d080 0001 00000000 0x0 0x0
0xffff90800001d100 0001 00000000 0x0 0x0
0xffff90800001d180 0001 00000000 0x0 0x0
0xffff90800001d200 0001 00000000 0x0 0x0
0xffff90800001d280 0001 00000000 0x0 0x0
0xffff90800001d300 0001 00000000 0x0 0x0
0xffff90800001d380 0001 00000000 0x0 0x0
0xffff90800001d400 0001 00000000 0x0 0x0
0xffff90800001d480 0001 00000000 0x0 0x0
0xffff90800001d500 0001 00000000 0x0 0x0
0xffff90800001d580 0001 00000000 0x0 0x0
0xffff90800001d600 0001 00000000 0x0 0x0
0xffff90800001d680 0001 00000000 0x0 0x0
0xffff90800001d700 0001 00000000 0x0 0x0
0xffff90800001d780 0001 00000000 0x0 0x0
0xffff90800001d800 0001 00000000 0x0 0x0
0xffff90800001d880 0001 00000000 0x0 0x0
0xffff90800001d900 0001 00000000 0x0 0x0
0xffff90800001d980 0001 00000000 0x0 0x0
0xffff90800001da00 0001 00000000 0x0 0x0
0xffff90800001da80 0001 00000000 0x0 0x0
0xffff90800001db00 0001 00000000 0x0 0x0
0xffff90800001db80 0001 00000000 0x0 0x0
0xffff90800001dc00 0001 00000000 0x0 0x0
0xffff90800001dc80 0001 00000000 0x0 0x0
0xffff90800001dd00 0001 00000000 0x0 0x0
0xffff90800001dd80 0001 00000000 0x0 0x0
0xffff90800001de00 0001 00000000 0x0 0x0
0xffff90800001de80 0001 00000000 0x0 0x0
0xffff90800001df00 0001 00000000 0x0 0x0
0xffff90800001df80 0001 00000000 0x0 0x0
0xffff90800001e000 0001 00000000 0x0 0x0
0xffff90800001e080 0001 00000000 0x0 0x0
0xffff90800001e100 0001 00000000 0x0 0x0
0xffff90800001e180 0001 00000000 0x0 0x0
0xffff90800001e200 0001 00000000 0x0 0x0
0xffff90800001e280 0001 00000000 0x0 0x0
0xffff90800001e300 0001 00000000 0x0 0x0
0xffff90800001e380 0001 00000000 0x0 0x0
0xffff90800001e400 0001 00000000 0x0 0x0
0xffff90800001e480 0001 00000000 0x0 0x0
0xffff90800001e500 0001 00000000 0x0 0x0
0xffff90800001e580 0001 00000000 0x0 0x0
0xffff90800001e600 0001 00000000 0x0 0x0
0xffff90800001e680 0001 00000000 0x0 0x0
0xffff90800001e700 0001 00000000 0x0 0x0
0xffff90800001e780 0001 00000000 0x0 0x0
0xffff90800001e800 0001 00000000 0x0 0x0
0xffff90800001e880 0001 00000000 0x0 0x0
0xffff90800001e900 0001 00000000 0x0 0x0
0xffff90800001e980 0001 00000000 0x0 0x0
0xffff90800001ea00 0001 00000000 0x0 0x0
0xffff90800001ea80 0001 00000000 0x0 0x0
0xffff90800001eb00 0001 00000000 0x0 0x0
0xffff90800001eb80 0001 00000000 0x0 0x0
0xffff90800001ec00 0001 00000000 0x0 0x0
0xffff90800001ec80 0001 00000000 0x0 0x0
0xffff90800001ed00 0001 00000000 0x0 0x0
0xffff90800001ed80 0001 00000000 0x0 0x0
0xffff90800001ee00 0001 00000000 0x0 0x0
0xffff90800001ee80 0001 00000000 0x0 0x0
0xffff90800001ef00 0001 00000000 0x0 0x0
0xffff90800001ef80 0001 00000000 0x0 0x0
0xffff90800001f000 0001 00000000 0x0 0x0
0xffff90800001f080 0001 00000000 0x0 0x0
0xffff90800001f100 0001 00000000 0x0 0x0
0xffff90800001f180 0001 00000000 0x0 0x0
0xffff90800001f200 0001 00000000 0x0 0x0
0xffff90800001f280 0001 00000000 0x0 0x0
0xffff90800001f300 0001 00000000 0x0 0x0
0xffff90800001f380 0001 00000000 0x0 0x0
0xffff90800001f400 0001 00000000 0x0 0x0
0xffff90800001f480 0001 00000000 0x0 0x0
0xffff90800001f500 0001 00000000 0x0 0x0
0xffff90800001f580 0001 00000000 0x0 0x0
0xffff90800001f600 0001 00000000 0x0 0x0
0xffff90800001f680 0001 00000000 0x0 0x0
0xffff90800001f700 0001 00000000 0x0 0x0
0xffff90800001f780 0001 00000000 0x0 0x0
0xffff90800001f800 0001 00000000 0x0 0x0
0xffff90800001f880 0001 00000000 0x0 0x0
0xffff90800001f900 0001 00000000 0x0 0x0
0xffff90800001f980 0001 00000000 0x0 0x0
0xffff90800001fa00 0001 00000000 0x0 0x0
0xffff90800001fa80 0001 00000000 0x0 0x0
0xffff90800001fb00 0001 00000000 0x0 0x0
0xffff90800001fb80 0001 00000000 0x0 0x0
0xffff90800001fc00 0001 00000000 0x0 0x0
0xffff90800001fc80 0001 00000000 0x0 0x0
0xffff90800001fd00 0001 00000000 0x0 0x0
0xffff90800001fd80 0001 00000000 0x0 0x0
0xffff90800001fe00 0001 00000000 0x0 0x0
0xffff90800001fe80 0001 00000000 0x0 0x0
0xffff90800001ff00 0001 00000000 0x0 0x0
0xffff90800001ff80 0001 00000000 0x0 0x0
0xffff908000020000 0001 00000000 0x0 0x0
0xffff908000020080 0001 00000000 0x0 0x0
0xffff908000020100 0001 00000000 0x0 0x0
0xffff908000020180 0001 00000000 0x0 0x0
0xffff908000020200 0001 00000000 0x0 0x0
0xffff908000020280 0001 00000000 0x0 0x0
0xffff908000020300 0001 00000000 0x0 0x0
0xffff908000020380 0001 00000000 0x0 0x0
0xffff908000020400 0001 00000000 0x0 0x0
0xffff908000020480 0001 00000000 0x0 0x0
0xffff908000020500 0001 00000000 0x0 0x0
0xffff908000020580 0001 00000000 0x0 0x0
0xffff908000020600 0001 00000000 0x0 0x0
0xffff908000020680 0001 00000000 0x0 0x0
0xffff908000020700 0001 00000000 0x0 0x0
0xffff908000020780 0001 00000000 0x0 0x0
0xffff908000020800 0001 00000000 0x0 0x0
0xffff908000020880 0001 00000000 0x0 0x0
0xffff908000020900 0001 00000000 0x0 0x0
0xffff908000020980 0001 00000000 0x0 0x0
0xffff908000020a00 0001 00000000 0x0 0x0
0xffff908000020a80 0001 00000000 0x0 0x0
0xffff908000020b00 0001 00000000 0x0 0x0
0xffff908000020b80 0001 00000000 0x0 0x0
0xffff908000020c00 0001 00000000 0x0 0x0
0xffff908000020c80 0001 00000000 0x0 0x0
0xffff908000020d00 0001 00000000 0x0 0x0
0xffff908000020d80 0001 00000000 0x0 0x0
0xffff908000020e00 0001 00000000 0x0 0x0
0xffff908000020e80 0001 00000000 0x0 0x0
0xffff908000020f00 0001 00000000 0x0 0x0
0xffff908000020f80 0001 00000000 0x0 0x0
0xffff908000021000 0001 00000000 0x0 0x0
0xffff908000021080 0001 00000000 0x0 0x0
0xffff908000021100 0001 00000000 0x0 0x0
0xffff908000021180 0001 00000000 0x0 0x0
0xffff908000021200 0001 00000000 0x0 0x0
0xffff908000021280 0001 00000000 0x0 0x0
0xffff908000021300 0001 00000000 0x0 0x0
0xffff908000021380 0001 00000000 0x0 0x0
0xffff908000021400 0001 00000000 0x0 0x0
0xffff908000021480 0001 00000000 0x0 0x0
0xffff908000021500 0001 00000000 0x0 0x0
0xffff908000021580 0001 00000000 0x0 0x0
0xffff908000021600 0001 00000000 0x0 0x0
0xffff908000021680 0001 00000000 0x0 0x0
0xffff908000021700 0001 00000000 0x0 0x0
0xffff908000021780 0001 00000000 0x0 0x0
0xffff908000021800 0001 00000000 0x0 0x0
0xffff908000021880 0001 00000000 0x0 0x0
0xffff908000021900 0001 00000000 0x0 0x0
0xffff908000021980 0001 00000000 0x0 0x0
0xffff908000021a00 0001 00000000 0x0 0x0
0xffff908000021a80 0001 00000000 0x0 0x0
0xffff908000021b00 0001 00000000 0x0 0x0
0xffff908000021b80 0001 00000000 0x0 0x0
0xffff908000021c00 0001 00000000 0x0 0x0
0xffff908000021c80 0001 00000000 0x0 0x0
0xffff908000021d00 0001 00000000 0x0 0x0
0xffff908000021d80 0001 00000000 0x0 0x0
0xffff908000021e00 0001 00000000 0x0 0x0
0xffff908000021e80 0001 00000000 0x0 0x0
0xffff908000021f00 0001 00000000 0x0 0x0
0xffff908000021f80 0001 00000000 0x0 0x0
0xffff908000022000 0001 00000000 0x0 0x0
0xffff908000022080 0001 00000000 0x0 0x0
0xffff908000022100 0001 00000000 0x0 0x0
0xffff908000022180 0001 00000000 0x0 0x0
0xffff908000022200 0001 00000000 0x0 0x0
0xffff908000022280 0001 00000000 0x0 0x0
0xffff908000022300 0001 00000000 0x0 0x0
0xffff908000022380 0001 00000000 0x0 0x0
0xffff908000022400 0001 00000000 0x0 0x0
0xffff908000022480 0001 00000000 0x0 0x0
0xffff908000022500 0001 00000000 0x0 0x0
0xffff908000022580 0001 00000000 0x0 0x0
0xffff908000022600 0001 00000000 0x0 0x0
0xffff908000022680 0001 00000000 0x0 0x0
0xffff908000022700 0001 00000000 0x0 0x0
0xffff908000022780 0001 00000000 0x0 0x0
0xffff908000022800 0001 00000000 0x0 0x0
0xffff908000022880 0001 00000000 0x0 0x0
0xffff908000022900 0001 00000000 0x0 0x0
0xffff908000022980 0001 00000000 0x0 0x0
0xffff908000022a00 0001 00000000 0x0 0x0
0xffff908000022a80 0001 00000000 0x0 0x0
0xffff908000022b00 0001 00000000 0x0 0x0
0xffff908000022b80 0001 00000000 0x0 0x0
0xffff908000022c00 0001 00000000 0x0 0x0
0xffff908000022c80 0001 00000000 0x0 0x0
0xffff908000022d00 0001 00000000 0x0 0x0
0xffff908000022d80 0001 00000000 0x0 0x0
0xffff908000022e00 0001 00000000 0x0 0x0
0xffff908000022e80 0001 00000000 0x0 0x0
0xffff908000022f00 0001 00000000 0x0 0x0
0xffff908000022f80 0001 00000000 0x0 0x0
0xffff908000023000 0001 00000000 0x0 0x0
0xffff908000023080 0001 00000000 0x0 0x0
0xffff908000023100 0001 00000000 0x0 0x0
0xffff908000023180 0001 00000000 0x0 0x0
0xffff908000023200 0001 00000000 0x0 0x0
0xffff908000023280 0001 00000000 0x0 0x0
0xffff908000023300 0001 00000000 0x0 0x0
0xffff908000023380 0001 00000000 0x0 0x0
0xffff908000023400 0001 00000000 0x0 0x0
0xffff908000023480 0001 00000000 0x0 0x0
0xffff908000023500 0001 00000000 0x0 0x0
0xffff908000023580 0001 00000000 0x0 0x0
0xffff908000023600 0001 00000000 0x0 0x0
0xffff908000023680 0001 00000000 0x0 0x0
0xffff908000023700 0001 00000000 0x0 0x0
0xffff908000023780 0001 00000000 0x0 0x0
0xffff908000023800 0001 00000000 0x0 0x0
0xffff908000023880 0001 00000000 0x0 0x0
0xffff908000023900 0001 00000000 0x0 0x0
0xffff908000023980 0001 00000000 0x0 0x0
0xffff908000023a00 0001 00000000 0x0 0x0
0xffff908000023a80 0001 00000000 0x0 0x0
0xffff908000023b00 0001 00000000 0x0 0x0
0xffff908000023b80 0001 00000000 0x0 0x0
0xffff908000023c00 0001 00000000 0x0 0x0
0xffff908000023c80 0001 00000000 0x0 0x0
0xffff908000023d00 0001 00000000 0x0 0x0
0xffff908000023d80 0001 00000000 0x0 0x0
0xffff908000023e00 0001 00000000 0x0 0x0
0xffff908000023e80 0001 00000000 0x0 0x0
0xffff908000023f00 0001 00000000 0x0 0x0
0xffff908000023f80 0001 00000000 0x0 0x0
0xffff908000024000 0001 00000000 0x0 0x0
0xffff908000024080 0001 00000000 0x0 0x0
0xffff908000024100 0001 00000000 0x0 0x0
0xffff908000024180 0001 00000000 0x0 0x0
0xffff908000024200 0001 00000000 0x0 0x0
0xffff908000024280 0001 00000000 0x0 0x0
0xffff908000024300 0001 00000000 0x0 0x0
0xffff908000024380 0001 00000000 0x0 0x0
0xffff908000024400 0001 00000000 0x0 0x0
0xffff908000024480 0001 00000000 0x0 0x0
0xffff908000024500 0001 00000000 0x0 0x0
0xffff908000024580 0001 00000000 0x0 0x0
0xffff908000024600 0001 00000000 0x0 0x0
0xffff908000024680 0001 00000000 0x0 0x0
0xffff908000024700 0001 00000000 0x0 0x0
0xffff908000024780 0001 00000000 0x0 0x0
0xffff908000024800 0001 00000000 0x0 0x0
0xffff908000024880 0001 00000000 0x0 0x0
0xffff908000024900 0001 00000000 0x0 0x0
0xffff908000024980 0001 00000000 0x0 0x0
0xffff908000024a00 0001 00000000 0x0 0x0
0xffff908000024a80 0001 00000000 0x0 0x0
0xffff908000024b00 0001 00000000 0x0 0x0
0xffff908000024b80 0001 00000000 0x0 0x0
0xffff908000024c00 0001 00000000 0x0 0x0
0xffff908000024c80 0001 00000000 0x0 0x0
0xffff908000024d00 0001 00000000 0x0 0x0
0xffff908000024d80 0001 00000000 0x0 0x0
0xffff908000024e00 0001 00000000 0x0 0x0
0xffff908000024e80 0001 00000000 0x0 0x0
0xffff908000024f00 0001 00000000 0x0 0x0
0xffff908000024f80 0001 00000000 0x0 0x0
0xffff908000025000 0001 00000000 0x0 0x0
0xffff908000025080 0001 00000000 0x0 0x0
0xffff908000025100 0001 00000000 0x0 0x0
0xffff908000025180 0001 00000000 0x0 0x0
0xffff908000025200 0001 00000000 0x0 0x0
0xffff908000025280 0001 00000000 0x0 0x0
0xffff908000025300 0001 00000000 0x0 0x0
0xffff908000025380 0001 00000000 0x0 0x0
0xffff908000025400 0001 00000000 0x0 0x0
0xffff908000025480 0001 00000000 0x0 0x0
0xffff908000025500 0001 00000000 0x0 0x0
0xffff908000025580 0001 00000000 0x0 0x0
0xffff908000025600 0001 00000000 0x0 0x0
0xffff908000025680 0001 00000000 0x0 0x0
0xffff908000025700 0001 00000000 0x0 0x0
0xffff908000025780 0001 00000000 0x0 0x0
0xffff908000025800 0001 00000000 0x0 0x0
0xffff908000025880 0001 00000000 0x0 0x0
0xffff908000025900 0001 00000000 0x0 0x0
0xffff908000025980 0001 00000000 0x0 0x0
0xffff908000025a00 0001 00000000 0x0 0x0
0xffff908000025a80 0001 00000000 0x0 0x0
0xffff908000025b00 0001 00000000 0x0 0x0
0xffff908000025b80 0001 00000000 0x0 0x0
0xffff908000025c00 0001 00000000 0x0 0x0
0xffff908000025c80 0001 00000000 0x0 0x0
0xffff908000025d00 0001 00000000 0x0 0x0
0xffff908000025d80 0001 00000000 0x0 0x0
0xffff908000025e00 0001 00000000 0x0 0x0
0xffff908000025e80 0001 00000000 0x0 0x0
0xffff908000025f00 0001 00000000 0x0 0x0
0xffff908000025f80 0001 00000000 0x0 0x0
0xffff908000026000 0001 00000000 0x0 0x0
0xffff908000026080 0001 00000000 0x0 0x0
0xffff908000026100 0001 00000000 0x0 0x0
0xffff908000026180 0001 00000000 0x0 0x0
0xffff908000026200 0001 00000000 0x0 0x0
0xffff908000026280 0001 00000000 0x0 0x0
0xffff908000026300 0001 00000000 0x0 0x0
0xffff908000026380 0001 00000000 0x0 0x0
0xffff908000026400 0001 00000000 0x0 0x0
0xffff908000026480 0001 00000000 0x0 0x0
0xffff908000026500 0001 00000000 0x0 0x0
0xffff908000026580 0001 00000000 0x0 0x0
0xffff908000026600 0001 00000000 0x0 0x0
0xffff908000026680 0001 00000000 0x0 0x0
0xffff908000026700 0001 00000000 0x0 0x0
0xffff908000026780 0001 00000000 0x0 0x0
0xffff908000026800 0001 00000000 0x0 0x0
0xffff908000026880 0001 00000000 0x0 0x0
0xffff908000026900 0001 00000000 0x0 0x0
0xffff908000026980 0001 00000000 0x0 0x0
0xffff908000026a00 0001 00000000 0x0 0x0
0xffff908000026a80 0001 00000000 0x0 0x0
0xffff908000026b00 0001 00000000 0x0 0x0
0xffff908000026b80 0001 00000000 0x0 0x0
0xffff908000026c00 0001 00000000 0x0 0x0
0xffff908000026c80 0001 00000000 0x0 0x0
0xffff908000026d00 0001 00000000 0x0 0x0
0xffff908000026d80 0001 00000000 0x0 0x0
0xffff908000026e00 0001 00000000 0x0 0x0
0xffff908000026e80 0001 00000000 0x0 0x0
0xffff908000026f00 0001 00000000 0x0 0x0
0xffff908000026f80 0001 00000000 0x0 0x0
0xffff908000027000 0001 00000000 0x0 0x0
0xffff908000027080 0001 00000000 0x0 0x0
0xffff908000027100 0001 00000000 0x0 0x0
0xffff908000027180 0001 00000000 0x0 0x0
0xffff908000027200 0001 00000000 0x0 0x0
0xffff908000027280 0001 00000000 0x0 0x0
0xffff908000027300 0001 00000000 0x0 0x0
0xffff908000027380 0001 00000000 0x0 0x0
0xffff908000027400 0001 00000000 0x0 0x0
0xffff908000027480 0001 00000000 0x0 0x0
0xffff908000027500 0001 00000000 0x0 0x0
0xffff908000027580 0001 00000000 0x0 0x0
0xffff908000027600 0001 00000000 0x0 0x0
0xffff908000027680 0001 00000000 0x0 0x0
0xffff908000027700 0001 00000000 0x0 0x0
0xffff908000027780 0001 00000000 0x0 0x0
0xffff908000027800 0001 00000000 0x0 0x0
0xffff908000027880 0001 00000000 0x0 0x0
0xffff908000027900 0001 00000000 0x0 0x0
0xffff908000027980 0001 00000000 0x0 0x0
0xffff908000027a00 0001 00000000 0x0 0x0
0xffff908000027a80 0001 00000000 0x0 0x0
0xffff908000027b00 0001 00000000 0x0 0x0
0xffff908000027b80 0001 00000000 0x0 0x0
0xffff908000027c00 0001 00000000 0x0 0x0
0xffff908000027c80 0001 00000000 0x0 0x0
0xffff908000027d00 0001 00000000 0x0 0x0
0xffff908000027d80 0001 00000000 0x0 0x0
0xffff908000027e00 0001 00000000 0x0 0x0
0xffff908000027e80 0001 00000000 0x0 0x0
0xffff908000027f00 0001 00000000 0x0 0x0
0xffff908000027f80 0001 00000000 0x0 0x0
0xffff908000028000 0001 00000000 0x0 0x0
0xffff908000028080 0001 00000000 0x0 0x0
0xffff908000028100 0001 00000000 0x0 0x0
0xffff908000028180 0001 00000000 0x0 0x0
0xffff908000028200 0001 00000000 0x0 0x0
0xffff908000028280 0001 00000000 0x0 0x0
0xffff908000028300 0001 00000000 0x0 0x0
0xffff908000028380 0001 00000000 0x0 0x0
0xffff908000028400 0001 00000000 0x0 0x0
0xffff908000028480 0001 00000000 0x0 0x0
0xffff908000028500 0001 00000000 0x0 0x0
0xffff908000028580 0001 00000000 0x0 0x0
0xffff908000028600 0001 00000000 0x0 0x0
0xffff908000028680 0001 00000000 0x0 0x0
0xffff908000028700 0001 00000000 0x0 0x0
0xffff908000028780 0001 00000000 0x0 0x0
0xffff908000028800 0001 00000000 0x0 0x0
0xffff908000028880 0001 00000000 0x0 0x0
0xffff908000028900 0001 00000000 0x0 0x0
0xffff908000028980 0001 00000000 0x0 0x0
0xffff908000028a00 0001 00000000 0x0 0x0
0xffff908000028a80 0001 00000000 0x0 0x0
0xffff908000028b00 0001 00000000 0x0 0x0
0xffff908000028b80 0001 00000000 0x0 0x0
0xffff908000028c00 0001 00000000 0x0 0x0
0xffff908000028c80 0001 00000000 0x0 0x0
0xffff908000028d00 0001 00000000 0x0 0x0
0xffff908000028d80 0001 00000000 0x0 0x0
0xffff908000028e00 0001 00000000 0x0 0x0
0xffff908000028e80 0001 00000000 0x0 0x0
0xffff908000028f00 0001 00000000 0x0 0x0
0xffff908000028f80 0001 00000000 0x0 0x0
0xffff908000029000 0001 00000000 0x0 0x0
0xffff908000029080 0001 00000000 0x0 0x0
0xffff908000029100 0001 00000000 0x0 0x0
0xffff908000029180 0001 00000000 0x0 0x0
0xffff908000029200 0001 00000000 0x0 0x0
0xffff908000029280 0001 00000000 0x0 0x0
0xffff908000029300 0001 00000000 0x0 0x0
0xffff908000029380 0001 00000000 0x0 0x0
0xffff908000029400 0001 00000000 0x0 0x0
0xffff908000029480 0001 00000000 0x0 0x0
0xffff908000029500 0001 00000000 0x0 0x0
0xffff908000029580 0001 00000000 0x0 0x0
0xffff908000029600 0001 00000000 0x0 0x0
0xffff908000029680 0001 00000000 0x0 0x0
0xffff908000029700 0001 00000000 0x0 0x0
0xffff908000029780 0001 00000000 0x0 0x0
0xffff908000029800 0001 00000000 0x0 0x0
0xffff908000029880 0001 00000000 0x0 0x0
0xffff908000029900 0001 00000000 0x0 0x0
0xffff908000029980 0001 00000000 0x0 0x0
0xffff908000029a00 0001 00000000 0x0 0x0
0xffff908000029a80 0001 00000000 0x0 0x0
0xffff908000029b00 0001 00000000 0x0 0x0
0xffff908000029b80 0001 00000000 0x0 0x0
0xffff908000029c00 0001 00000000 0x0 0x0
0xffff908000029c80 0001 00000000 0x0 0x0
0xffff908000029d00 0001 00000000 0x0 0x0
0xffff908000029d80 0001 00000000 0x0 0x0
0xffff908000029e00 0001 00000000 0x0 0x0
0xffff908000029e80 0001 00000000 0x0 0x0
0xffff908000029f00 0001 00000000 0x0 0x0
0xffff908000029f80 0001 00000000 0x0 0x0
0xffff90800002a000 0001 00000000 0x0 0x0
0xffff90800002a080 0001 00000000 0x0 0x0
0xffff90800002a100 0001 00000000 0x0 0x0
0xffff90800002a180 0001 00000000 0x0 0x0
0xffff90800002a200 0001 00000000 0x0 0x0
0xffff90800002a280 0001 00000000 0x0 0x0
0xffff90800002a300 0001 00000000 0x0 0x0
0xffff90800002a380 0001 00000000 0x0 0x0
0xffff90800002a400 0001 00000000 0x0 0x0
0xffff90800002a480 0001 00000000 0x0 0x0
0xffff90800002a500 0001 00000000 0x0 0x0
0xffff90800002a580 0001 00000000 0x0 0x0
0xffff90800002a600 0001 00000000 0x0 0x0
0xffff90800002a680 0001 00000000 0x0 0x0
0xffff90800002a700 0001 00000000 0x0 0x0
0xffff90800002a780 0001 00000000 0x0 0x0
0xffff90800002a800 0001 00000000 0x0 0x0
0xffff90800002a880 0001 00000000 0x0 0x0
0xffff90800002a900 0001 00000000 0x0 0x0
0xffff90800002a980 0001 00000000 0x0 0x0
0xffff90800002aa00 0001 00000000 0x0 0x0
0xffff90800002aa80 0001 00000000 0x0 0x0
0xffff90800002ab00 0001 00000000 0x0 0x0
0xffff90800002ab80 0001 00000000 0x0 0x0
0xffff90800002ac00 0001 00000000 0x0 0x0
0xffff90800002ac80 0001 00000000 0x0 0x0
0xffff90800002ad00 0001 00000000 0x0 0x0
0xffff90800002ad80 0001 00000000 0x0 0x0
0xffff90800002ae00 0001 00000000 0x0 0x0
0xffff90800002ae80 0001 00000000 0x0 0x0
0xffff90800002af00 0001 00000000 0x0 0x0
0xffff90800002af80 0001 00000000 0x0 0x0
0xffff90800002b000 0001 00000000 0x0 0x0
0xffff90800002b080 0001 00000000 0x0 0x0
0xffff90800002b100 0001 00000000 0x0 0x0
0xffff90800002b180 0001 00000000 0x0 0x0
0xffff90800002b200 0001 00000000 0x0 0x0
0xffff90800002b280 0001 00000000 0x0 0x0
0xffff90800002b300 0001 00000000 0x0 0x0
0xffff90800002b380 0001 00000000 0x0 0x0
0xffff90800002b400 0001 00000000 0x0 0x0
0xffff90800002b480 0001 00000000 0x0 0x0
0xffff90800002b500 0001 00000000 0x0 0x0
0xffff90800002b580 0001 00000000 0x0 0x0
0xffff90800002b600 0001 00000000 0x0 0x0
0xffff90800002b680 0001 00000000 0x0 0x0
0xffff90800002b700 0001 00000000 0x0 0x0
0xffff90800002b780 0001 00000000 0x0 0x0
0xffff90800002b800 0001 00000000 0x0 0x0
0xffff90800002b880 0001 00000000 0x0 0x0
0xffff90800002b900 0001 00000000 0x0 0x0
0xffff90800002b980 0001 00000000 0x0 0x0
0xffff90800002ba00 0001 00000000 0x0 0x0
0xffff90800002ba80 0001 00000000 0x0 0x0
0xffff90800002bb00 0001 00000000 0x0 0x0
0xffff90800002bb80 0001 00000000 0x0 0x0
0xffff90800002bc00 0001 00000000 0x0 0x0
0xffff90800002bc80 0001 00000000 0x0 0x0
0xffff90800002bd00 0001 00000000 0x0 0x0
0xffff90800002bd80 0001 00000000 0x0 0x0
0xffff90800002be00 0001 00000000 0x0 0x0
0xffff90800002be80 0001 00000000 0x0 0x0
0xffff90800002bf00 0001 00000000 0x0 0x0
0xffff90800002bf80 0001 00000000 0x0 0x0
0xffff90800002c000 0001 00000000 0x0 0x0
0xffff90800002c080 0001 00000000 0x0 0x0
0xffff90800002c100 0001 00000000 0x0 0x0
0xffff90800002c180 0001 00000000 0x0 0x0
0xffff90800002c200 0001 00000000 0x0 0x0
0xffff90800002c280 0001 00000000 0x0 0x0
0xffff90800002c300 0001 00000000 0x0 0x0
0xffff90800002c380 0001 00000000 0x0 0x0
0xffff90800002c400 0001 00000000 0x0 0x0
0xffff90800002c480 0001 00000000 0x0 0x0
0xffff90800002c500 0001 00000000 0x0 0x0
0xffff90800002c580 0001 00000000 0x0 0x0
0xffff90800002c600 0001 00000000 0x0 0x0
0xffff90800002c680 0001 00000000 0x0 0x0
0xffff90800002c700 0001 00000000 0x0 0x0
0xffff90800002c780 0001 00000000 0x0 0x0
0xffff90800002c800 0001 00000000 0x0 0x0
0xffff90800002c880 0001 00000000 0x0 0x0
0xffff90800002c900 0001 00000000 0x0 0x0
0xffff90800002c980 0001 00000000 0x0 0x0
0xffff90800002ca00 0001 00000000 0x0 0x0
0xffff90800002ca80 0001 00000000 0x0 0x0
0xffff90800002cb00 0001 00000000 0x0 0x0
0xffff90800002cb80 0001 00000000 0x0 0x0
0xffff90800002cc00 0001 00000000 0x0 0x0
0xffff90800002cc80 0001 00000000 0x0 0x0
0xffff90800002cd00 0001 00000000 0x0 0x0
0x

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Aug 12, 2022, 12:28:30 PM8/12/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 23662f064a67 subr_prf.c & luasystm.c: s/panicing/panicking..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=10799e35080000

kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=f2cba71b1b1bc91029b3
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11197b4b080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f2cba7...@syzkaller.appspotmail.com

[ 41.4776736] panic: MSan: Uninitialized Variable 'val.i' From rum_attach()

[ 41.4876597] cpu1: Begin traceback...
[ 41.5076624] vpanic() at netbsd:vpanic+0xc9d
[ 41.5476651] panic() at netbsd:panic+0x1b3 sys/kern/subr_prf.c:210
[ 41.5976660] __msan_warning() at netbsd:__msan_warning+0x11e kmsan_report_inline sys/kern/subr_msan.c:234 [inline]
[ 41.5976660] __msan_warning() at netbsd:__msan_warning+0x11e sys/kern/subr_msan.c:615
[ 41.6476731] rum_attach() at netbsd:rum_attach+0xfda
[ 41.6976668] config_attach_internal() at netbsd:config_attach_internal+0xdb7 sys/kern/subr_autoconf.c:1775
[ 41.7476703] config_found() at netbsd:config_found+0x411 sys/kern/subr_autoconf.c:1262
[ 41.7976653] usbd_attachwholedevice() at netbsd:usbd_attachwholedevice+0x5ad sys/dev/usb/usb_subr.c:1137
[ 41.8476715] usbd_probe_and_attach() at netbsd:usbd_probe_and_attach+0x100 sys/dev/usb/usb_subr.c:1261
[ 41.8976653] usbd_new_device() at netbsd:usbd_new_device+0x24c2
[ 41.9476733] uhub_explore() at netbsd:uhub_explore+0x3122
[ 42.0076680] usb_discover() at netbsd:usb_discover+0x453 sys/dev/usb/usb.c:1196
[ 42.0576668] usb_event_thread() at netbsd:usb_event_thread+0x2b7 sys/dev/usb/usb.c:728
[ 42.0776658] cpu1: End traceback...
[ 42.0776658] fatal breakpoint trap in supervisor mode
[ 42.0876612] trap type 1 code 0 rip 0xffffffff802228ad cs 0x8 rflags 0x282 cr2 0x7828fe5ddff8 ilevel 0 rsp 0xffffa600c06dd3e0
[ 42.0976567] curlwp 0xffffa60011ed0980 pid 0.125 lowest kstack 0xffffa600c06d62c0
Stopped in pid 0.125 (system) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0xc9d
panic() at netbsd:panic+0x1b3 sys/kern/subr_prf.c:210
__msan_warning() at netbsd:__msan_warning+0x11e kmsan_report_inline sys/kern/subr_msan.c:234 [inline]
__msan_warning() at netbsd:__msan_warning+0x11e sys/kern/subr_msan.c:615
rum_attach() at netbsd:rum_attach+0xfda
config_attach_internal() at netbsd:config_attach_internal+0xdb7 sys/kern/subr_autoconf.c:1775
config_found() at netbsd:config_found+0x411 sys/kern/subr_autoconf.c:1262
usbd_attachwholedevice() at netbsd:usbd_attachwholedevice+0x5ad sys/dev/usb/usb_subr.c:1137
usbd_probe_and_attach() at netbsd:usbd_probe_and_attach+0x100 sys/dev/usb/usb_subr.c:1261
usbd_new_device() at netbsd:usbd_new_device+0x24c2
uhub_explore() at netbsd:uhub_explore+0x3122
usb_discover() at netbsd:usb_discover+0x453 sys/dev/usb/usb.c:1196
usb_event_thread() at netbsd:usb_event_thread+0x2b7 sys/dev/usb/usb.c:728
Panic string: MSan: Uninitialized Variable 'val.i' From rum_attach()

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1092 1105 3 0 180 ffffa6001337d540 syz-executor.0 nanoslp
1092 1227 3 0 180 ffffa6001337d100 syz-executor.0 parked
1092 >1092 7 0 10000000 ffffa60013379940 syz-executor.0
1128 1128 3 0 180 ffffa600133790c0 syz-executor.0 nanoslp
1221 1151 3 0 180 ffffa60013379500 syz-execprog parked
1221 1195 3 0 180 ffffa60012b58900 syz-execprog wait
1221 422 3 0 180 ffffa60012b584c0 syz-execprog parked
1221 1075 3 1 180 ffffa60012b58080 syz-execprog parked
1221 733 3 0 180 ffffa6001242d700 syz-execprog kqueue
1221 1194 3 1 180 ffffa600123306c0 syz-execprog parked
1221 1222 3 0 180 ffffa60012b3e8c0 syz-execprog parked
1221 1221 3 1 40180 ffffa60012b3e480 syz-execprog parked
1078 1078 3 1 180 ffffa6001229aac0 sshd select
1080 1080 3 1 180 ffffa60012330280 getty nanoslp
1072 1072 3 0 180 ffffa6001229a680 getty nanoslp
1069 1069 3 1 180 ffffa6001229a240 getty nanoslp
1074 1074 3 1 1c0 ffffa6001219b600 getty ttyraw
926 926 3 1 180 ffffa60012b3e040 sshd select
873 873 3 0 180 ffffa60012af0bc0 powerd kqueue
689 689 3 0 180 ffffa600124dfb80 syslogd kqueue
602 602 3 0 180 ffffa60012af0780 dhcpcd poll
547 547 3 0 180 ffffa6001242db40 dhcpcd poll
464 464 3 0 180 ffffa60012af0340 dhcpcd poll
589 589 3 1 180 ffffa6001242d2c0 dhcpcd poll
289 289 3 0 180 ffffa600124df740 dhcpcd poll
288 288 3 0 180 ffffa60012330b00 dhcpcd poll
351 351 3 0 180 ffffa600124df300 dhcpcd poll
1 1 3 0 180 ffffa60011ebe940 init wait
0 968 3 0 200 ffffa6001219ba40 physiod physiod
0 194 3 1 200 ffffa600121a4a80 pooldrain pooldrain
0 193 2 1 240 ffffa600121a4640 ioflush
0 192 3 0 200 ffffa600121a4200 pgdaemon pgdaemon
0 169 3 1 200 ffffa6001219b1c0 usb7 usbevt
0 167 3 1 200 ffffa60012103a00 usb6 usbevt
0 165 3 1 200 ffffa600121035c0 usb5 usbevt
0 164 3 1 200 ffffa60012103180 usb4 usbevt
0 31 3 1 200 ffffa600120699c0 usb3 usbevt
0 63 3 1 200 ffffa60012069580 usb2 usbevt
0 126 3 1 200 ffffa60012069140 usb1 usbevt
0 > 125 7 1 240 ffffa60011ed0980 usb0
0 124 3 1 200 ffffa60011ed0540 usbtask-dr usbtsk
0 123 3 1 200 ffffa600117c46c0 usbtask-hc usbtsk
0 122 3 0 200 ffffa60011ed0100 npfgc0 npfgcw
0 121 3 1 200 ffffa60011ebe500 rt_free rt_free
0 120 3 1 200 ffffa60011ebe0c0 unpgc unpgc
0 119 3 0 200 ffffa60011eba900 key_timehandler key_timehandler
0 118 3 1 200 ffffa60011eba4c0 icmp6_wqinput/1 icmp6_wqinput
0 117 3 0 200 ffffa60011eba080 icmp6_wqinput/0 icmp6_wqinput
0 116 2 1 200 ffffa60011e9b8c0 nd6_timer
0 115 3 1 200 ffffa60011e9b480 carp6_wqinput/1 carp6_wqinput
0 114 3 0 200 ffffa60011e9b040 carp6_wqinput/0 carp6_wqinput
0 113 3 1 200 ffffa60011cc4b80 carp_wqinput/1 carp_wqinput
0 112 3 0 200 ffffa60011cc4740 carp_wqinput/0 carp_wqinput
0 111 3 1 200 ffffa60011cc4300 icmp_wqinput/1 icmp_wqinput
0 110 3 0 200 ffffa60011cc5780 icmp_wqinput/0 icmp_wqinput
0 109 3 0 200 ffffa60011cc5340 rt_timer rt_timer
0 108 3 1 200 ffffa60011cc5bc0 vmem_rehash vmem_rehash
0 99 3 0 200 ffffa600117c6b40 entbutler entropy
0 98 3 1 200 ffffa600117c6700 viomb balloon
0 97 3 1 200 ffffa600117c62c0 vioif0_txrx/1 vioif0_txrx
0 96 3 0 200 ffffa600117c4b00 vioif0_txrx/0 vioif0_txrx
0 29 3 0 200 ffffa600117c4280 scsibus0 sccomp
0 28 3 0 200 ffffa600103c0ac0 pms0 pmsreset
0 27 3 1 200 ffffa600103c0680 xcall/1 xcall
0 26 1 1 200 ffffa600103c0240 softser/1
0 25 1 1 200 ffffa600103bfa80 softclk/1
0 24 1 1 200 ffffa600103bf640 softbio/1
0 23 1 1 200 ffffa600103bf200 softnet/1
0 22 1 1 201 ffffa6000f1f3a40 idle/1
0 21 3 0 200 ffffa6000f1f3600 lnxsyswq lnxsyswq
0 20 3 0 200 ffffa6000f1f31c0 lnxubdwq lnxubdwq
0 19 3 0 200 ffffa6000f1f1a00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffffa6000f1f15c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffffa6000f1f1180 lnxhipwq lnxhipwq
0 16 3 0 200 ffffa6000f1ec9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffa6000f1ec580 sysmon smtaskq
0 14 3 0 200 ffffa6000f1ec140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffa6000f1e8980 pmfevent pmfevent
0 12 3 0 200 ffffa6000f1e8540 sopendfree sopendfr
0 11 3 1 200 ffffa6000f1e8100 iflnkst iflnkst
0 10 3 0 200 ffffa6000f1de940 nfssilly nfssilly
0 9 3 0 200 ffffa6000f1de500 vdrain vdrain
0 8 3 1 200 ffffa6000f1de0c0 modunload mod_unld
0 7 3 0 200 ffffa6000ebdb900 xcall/0 xcall
0 6 1 0 200 ffffa6000ebdb4c0 softser/0
0 5 1 0 200 ffffa6000ebdb080 softclk/0
0 4 1 0 200 ffffa6000ebd98c0 softbio/0
0 3 1 0 200 ffffa6000ebd9480 softnet/0
0 2 1 0 201 ffffa6000ebd9040 idle/0
0 0 2 1 240 ffffffff86869280 swapper
[Locks tracked through LWPs]

****** LWP 1092.1092 (syz-executor.0) @ 0xffffa60013379940, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at main)
lock address : 0xffffffff868f7cc0 type : spin
initialized : 0xffffffff8508bd94
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 1
relevant cpu : 0 last held: 1
relevant lwp : 0xffffa60013379940 last held: 0xffffa60011ed0980

last locked* : 0xffffffff8524ee6b unlocked : 0xffffffff850bc56e
curcpu holds : 2 wanted by: 000000000000000000

****** LWP 547.547 (dhcpcd) @ 0xffffa6001242db40, l_stat=3

relevant lwp : 0xffffa6001242db40 last held: 000000000000000000