UBSan: Undefined Behavior in lf_advlock (3)

8 views

Skip to first unread message

syzbot

unread,

Nov 4, 2022, 7:54:43 AM11/4/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 20b0d5919d8e Update check files to allow for changes due t..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=10049be2880000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=762480b00cb14085f63a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/06f64ff420e0/disk-20b0d591.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e51959721c13/netbsd-20b0d591.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+762480...@syzkaller.appspotmail.com

[ 68.3806366] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/vfs_lockf.c:850:16, signed integer overflow: 1 + 9223372036854775807 cannot be represented in type 'long int'

[ 68.4002707] cpu0: Begin traceback...
[ 68.4106291] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 68.5006288] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 68.5906329] HandleOverflow() at netbsd:HandleOverflow+0x1d0 sys/../common/lib/libc/misc/ubsan.c:375
[ 68.6506307] lf_advlock() at netbsd:lf_advlock+0x2b6a sys/kern/vfs_lockf.c:850
[ 68.6906349] VOP_ADVLOCK() at netbsd:VOP_ADVLOCK+0x14a sys/kern/vnode_if.c:1868
[ 68.7306321] do_fcntl_lock() at netbsd:do_fcntl_lock+0x498 sys/kern/sys_descrip.c:286
[ 68.7806285] sys_fcntl() at netbsd:sys_fcntl+0x14b sys/kern/sys_descrip.c:384
[ 68.8106331] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 68.8106331] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 68.8606292] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 68.8606292] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 68.8606292] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 68.8706302] --- syscall (number 92 via SYS_syscall) ---
[ 68.8806290] netbsd:syscall+0x2da:
[ 68.8907899] cpu0: End traceback...
[ 68.8907899] fatal breakpoint trap in supervisor mode
[ 68.8907899] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x1b2ef2f000 ilevel 0 rsp 0xffffa202480a4620
[ 68.9101902] curlwp 0xffffe6a05526b900 pid 2268.1374 lowest kstack 0xffffa202480a02c0
Stopped in pid 2268.1374 (syz-executor.3) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleOverflow() at netbsd:HandleOverflow+0x1d0 sys/../common/lib/libc/misc/ubsan.c:375
lf_advlock() at netbsd:lf_advlock+0x2b6a sys/kern/vfs_lockf.c:850
VOP_ADVLOCK() at netbsd:VOP_ADVLOCK+0x14a sys/kern/vnode_if.c:1868
do_fcntl_lock() at netbsd:do_fcntl_lock+0x498 sys/kern/sys_descrip.c:286
sys_fcntl() at netbsd:sys_fcntl+0x14b sys/kern/sys_descrip.c:384
sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 92 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/vfs_lockf.c:850:16, signed integer overflow: 1 + 9223372036854775807 cannot be represented in type 'long int'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
2268 >1374 7 0 100 ffffe6a05526b900 syz-executor.3
2268 2268 2 0 10000000 ffffe6a0551550c0 syz-executor.3
1356 1356 3 0 1c0 ffffe6a05538c100 syz-executor.1 pipe_rd
2400 2400 2 0 140 ffffe6a0601b8080 syz-executor.0
2227 2227 2 0 140 ffffe6a055c655c0 syz-executor.2
1245 1245 3 1 1c0 ffffe6a055c65a00 syz-executor.5 pipe_rd
1198 1198 2 0 140 ffffe6a05a130b40 syz-executor.3
1235 1199 3 1 1c0 ffffe6a054a6e480 syz-fuzzer parked
1235 1247 3 1 180 ffffe6a055c65180 syz-fuzzer kqueue
1235 1132 3 1 180 ffffe6a05c0a6300 syz-fuzzer wait
1235 941 3 1 180 ffffe6a05a130700 syz-fuzzer wait
1235 1243 3 0 180 ffffe6a057c3eb00 syz-fuzzer wait
1235 1242 3 1 1c0 ffffe6a057c3e280 syz-fuzzer wait
1235 1241 3 0 180 ffffe6a0567cfac0 syz-fuzzer parked
1235 1080 3 1 180 ffffe6a0567cf680 syz-fuzzer parked
1235 449 3 1 180 ffffe6a05441ab00 syz-fuzzer parked
1235 1225 3 0 180 ffffe6a05405f200 syz-fuzzer parked
1235 1226 3 1 1c0 ffffe6a055c8d600 syz-fuzzer wait
1235 1230 3 1 180 ffffe6a05441a280 syz-fuzzer parked
1235 1235 3 1 1c0 ffffe6a0567cf240 syz-fuzzer parked
1233 1233 3 0 180 ffffe6a056cf0a80 sshd select
1195 1195 3 1 180 ffffe6a056cf0640 getty nanoslp
1196 1196 3 0 180 ffffe6a056cf0200 getty nanoslp
1222 1222 3 0 180 ffffe6a0548e4340 getty nanoslp
1083 1083 3 0 1c0 ffffe6a054095ac0 getty ttyraw
1109 1109 3 1 180 ffffe6a055c8da40 sshd select
1056 1056 3 0 180 ffffe6a055c8d1c0 powerd kqueue
702 702 3 1 180 ffffe6a05538c980 syslogd kqueue
745 745 3 0 180 ffffe6a05526b080 dhcpcd poll
742 742 3 0 180 ffffe6a0548e4780 dhcpcd poll
466 466 3 0 180 ffffe6a0545d7740 dhcpcd poll
598 598 3 0 180 ffffe6a054a6e8c0 dhcpcd poll
292 292 3 0 180 ffffe6a054a6e040 dhcpcd poll
485 485 3 1 180 ffffe6a0548e4bc0 dhcpcd poll
291 291 3 1 180 ffffe6a0544ceb40 dhcpcd poll
1 1 3 0 180 ffffe6a04be4b980 init wait
0 2904 5 0 200 ffffe6a0631c20c0 (zombie)
0 1364 3 0 200 ffffe6a0544ce2c0 acctwatch actwat
0 968 3 0 200 ffffe6a05405f640 physiod physiod
0 196 3 0 200 ffffe6a054095680 pooldrain pooldrain
0 195 2 0 240 ffffe6a054095240 ioflush
0 194 3 1 200 ffffe6a05405fa80 pgdaemon pgdaemon
0 170 3 1 200 ffffe6a051fa7a40 usb7 usbevt
0 169 3 0 200 ffffe6a051fa7600 usb6 usbevt
0 168 3 0 200 ffffe6a051fa71c0 usb5 usbevt
0 167 3 1 200 ffffe6a04ef4aa00 usb4 usbevt
0 166 3 0 200 ffffe6a04ef4a5c0 usb3 usbevt
0 165 3 0 200 ffffe6a04ef4a180 usb2 usbevt
0 31 3 0 200 ffffe6a04bead9c0 usb1 usbevt
0 63 3 0 200 ffffe6a04bead580 usb0 usbevt
0 126 3 1 200 ffffe6a04bce0740 usbtask-dr usbtsk
0 125 3 1 200 ffffe6a04bce0b80 usbtask-hc usbtsk
0 124 3 0 200 ffffe6a04a2a1b00 swwreboot swwreboot
0 123 2 0 240 ffffe6a04bead140 npfgc0
0 122 3 1 200 ffffe6a04be4b540 rt_free rt_free
0 121 3 1 200 ffffe6a04be4b100 unpgc unpgc
0 120 2 0 200 ffffe6a04be4e940 key_timehandler
0 119 3 1 200 ffffe6a04be4e500 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffe6a04be4e0c0 icmp6_wqinput/0 icmp6_wqinput
0 117 2 0 200 ffffe6a04be3a900 nd6_timer
0 116 3 1 200 ffffe6a04be3a4c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffe6a04be3a080 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffe6a04be148c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffe6a04be14480 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffe6a04be14040 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffe6a04bdd7bc0 icmp_wqinput/0 icmp_wqinput
0 110 2 0 200 ffffe6a04bdd7340 rt_timer
0 109 3 1 200 ffffe6a04bdd7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffffe6a04bce0300 entbutler entropy
0 99 3 1 200 ffffe6a04b750b40 viomb balloon
0 98 3 1 200 ffffe6a04b750700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffe6a04b7502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffffe6a04a2a16c0 scsibus0 sccomp
0 29 3 0 200 ffffe6a04a2a1280 pms0 pmsreset
0 28 3 1 200 ffffe6a04a1b4ac0 xcall/1 xcall
0 27 1 1 200 ffffe6a04a1b4680 softser/1
0 26 1 1 200 ffffe6a04a1b4240 softclk/1
0 25 1 1 200 ffffe6a04a187a80 softbio/1
0 24 1 1 200 ffffe6a04a187640 softnet/1
0 > 23 1 1 201 ffffe6a04a187200 idle/1
0 22 3 1 200 ffffe6a17852da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffffe6a17852d600 lnxubdwq lnxubdwq
0 20 3 1 200 ffffe6a17852d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffffe6a178534a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffe6a1785345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffffe6a178534180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffe6a1785539c0 sysmon smtaskq
0 15 3 1 200 ffffe6a178553580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffe6a178553140 pmfevent pmfevent
0 13 3 1 200 ffffe6a17855e980 sopendfree sopendfr
0 12 3 0 200 ffffe6a17855e540 ifwdog ifwdog
0 11 3 0 200 ffffe6a17855e100 iflnkst iflnkst
0 10 3 1 200 ffffe6a179593940 nfssilly nfssilly
0 9 3 0 200 ffffe6a179593500 vdrain vdrain
0 8 3 1 200 ffffe6a1795930c0 modunload mod_unld
0 7 3 0 200 ffffe6a1795bc900 xcall/0 xcall
0 6 1 0 200 ffffe6a1795bc4c0 softser/0
0 5 1 0 200 ffffe6a1795bc080 softclk/0
0 4 1 0 200 ffffe6a1795e98c0 softbio/0
0 3 1 0 200 ffffe6a1795e9480 softnet/0
0 2 1 0 201 ffffe6a1795e9040 idle/0
0 0 2 0 240 ffffffff8673ee00 swapper
[Locks tracked through LWPs]

****** LWP 742.742 (dhcpcd) @ 0xffffe6a0548e4780, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe6a0548e4780 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 466.466 (dhcpcd) @ 0xffffe6a0545d7740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe6a0545d7740 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xffffe6a0548e4bc0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffe6a0548e4bc0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xffffe6a0544ceb40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffe6a0544ceb40 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffe6a17855e100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe6a17855e100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffe6a1795bc080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe6a1795bc080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff8673ee00, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff8673ee00 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at netbsd:kprintf_init+0x72 sys/kern/subr_prf.c:155)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x72
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffe6a05526b900 last held: 0xffffe6a05526b900
last locked* : netbsd:kprintf_lock+0x50
unlocked : netbsd:kprintf_unlock+0x70
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffffa20000007180 0045 00000000 0x0 0x0
0xffffa20000007200 0045 00000000 0x0 0x0
0xffffa20000007280 0045 00000000 0x0 0x0
0xffffa20000007300 0045 00000000 0x0 0x0
0xffffa20000007380 0045 00000000 0x0 0x0
0xffffa20000007400 0045 00000000 0x0 0x0
0xffffa20000007480 0045 00000000 0x0 0x0
0xffffa20000007500 0045 00000000 0x0 0x0
0xffffa20000007580 0045 00000000 0x0 0x0
0xffffa20000007600 0045 00000000 0x0 0x0
0xffffa20000007680 0045 00000000 0x0 0x0
0xffffa20000007700 0041 00000000 0x0 0x0
0xffffa20000007780 0041 00000000 0x0 0x0
0xffffa20000007800 0041 00000000 0x0 0x0
0xffffa20000007880 0041 00000000 0x0 0x0
0xffffa20000007900 0045 00000000 0x0 0x0
0xffffa20000007980 0041 00000000 0x0 0x0
0xffffa20000007a00 0041 00000000 0x0 0x0
0xffffa20000007a80 0041 00000000 0x0 0x0
0xffffa20000007b00 0041 00000000 0x0 0x0
0xffffa20000007b80 0041 00000000 0x0 0x0
0xffffa20000007c00 0041 00000000 0x0 0x0
0xffffa20000007c80 0041 00000000 0x0 0x0
0xffffa20000007d00 0041 00000000 0x0 0x0
0xffffa20000007d80 0041 00000000 0x0 0x0
0xffffa20000007e00 0041 00000000 0x0 0x0
0xffffa20000007e80 0041 00000000 0x0 0x0
0xffffa20000007f00 0041 00000000 0x0 0x0
0xffffa20000007f80 0041 00000000 0x0 0x0
0xffffa20000008000 0041 00000000 0x0 0x0
0xffffa20000008080 0041 00000000 0x0 0x0
0xffffa20000008100 0041 00000000 0x0 0x0
0xffffa20000008180 0041 00000000 0x0 0x0
0xffffa20000008200 0041 00000000 0x0 0x0
0xffffa20000008280 0041 00000000 0x0 0x0
0xffffa20000008300 0041 00000000 0x0 0x0
0xffffa20000008380 0041 00000000 0x0 0x0
0xffffa20000008400 0041 00000000 0x0 0x0
0xffffa20000008480 0041 00000000 0x0 0x0
0xffffa20000008500 0041 00000000 0x0 0x0
0xffffa20000008580 0041 00000000 0x0 0x0
0xffffa20000008600 0045 00000000 0x0 0x0
0xffffa20000008680 0041 00000000 0x0 0x0
0xffffa20000008700 0041 00000000 0x0 0x0
0xffffa20000008780 0041 00000000 0x0 0x0
0xffffa20000008800 0045 00000000 0x0 0x0
0xffffa20000008880 0041 00000000 0x0 0x0
0xffffa20000008900 0041 00000000 0x0 0x0
0xffffa20000008980 0041 00000000 0x0 0x0
0xffffa20000008a00 0041 00000000 0x0 0x0
0xffffa20000008a80 0041 00000000 0x0 0x0
0xffffa20000008b00 0041 00000000 0x0 0x0
0xffffa20000008b80 0041 00000000 0x0 0x0
0xffffa20000008c00 0041 00000000 0x0 0x0
0xffffa20000008c80 0041 00000000 0x0 0x0
0xffffa20000008d00 0041 00000000 0x0 0x0
0xffffa20000008d80 0041 00000000 0x0 0x0
0xffffa20000008e00 0041 00000000 0x0 0x0
0xffffa20000008e80 0041 00000000 0x0 0x0
0xffffa20000008f00 0041 00000000 0x0 0x0
0xffffa20000008f80 0041 00000000 0x0 0x0
0xffffa20000009000 0041 00000000 0x0 0x0
0xffffa20000009080 0045 00000000 0x0 0x0
0xffffa20000009100 0041 00000000 0x0 0x0
0xffffa20000009180 0041 00000000 0x0 0x0
0xffffa20000009200 0041 00000000 0x0 0x0
0xffffa20000009280 0041 00000000 0x0 0x0
0xffffa20000009300 0041 00000000 0x0 0x0
0xffffa20000009380 0041 00000000 0x0 0x0
0xffffa20000009400 0041 00000000 0x0 0x0
0xffffa20000009480 0041 00000000 0x0 0x0
0xffffa20000009500 0041 00000000 0x0 0x0
0xffffa20000009580 0041 00000000 0x0 0x0
0xffffa20000009600 0041 00000000 0x0 0x0
0xffffa20000009680 0041 00000000 0x0 0x0
0xffffa20000009700 0041 00000000 0x0 0x0
0xffffa20000009780 0041 00000000 0x0 0x0
0xffffa20000009800 0041 00000000 0x0 0x0
0xffffa20000009880 0041 00000000 0x0 0x0
0xffffa20000009900 0041 00000000 0x0 0x0
0xffffa20000009980 0041 00000000 0x0 0x0
0xffffa20000009a00 0041 00000000 0x0 0x0
0xffffa20000009a80 0041 00000000 0x0 0x0
0xffffa20000009b00 0041 00000000 0x0 0x0
0xffffa20000009b80 0041 00000000 0x0 0x0
0xffffa20000009c00 0041 00000000 0x0 0x0
0xffffa20000009c80 0041 00000000 0x0 0x0
0xffffa20000009d00 0041 00000000 0x0 0x0
0xffffa20000009d80 0041 00000000 0x0 0x0
0xffffa20000009e00 0041 00000000 0x0 0x0
0xffffa20000009e80 0045 00000000 0x0 0x0
0xffffa20000009f00 0041 00000000 0x0 0x0
0xffffa20000009f80 0041 00000000 0x0 0x0
0xffffa2000000a000 0041 00000000 0x0 0x0
0xffffa2000000a080 0041 00000000 0x0 0x0
0xffffa2000000a100 0041 00000000 0x0 0x0
0xffffa2000000a180 0041 00000000 0x0 0x0
0xffffa2000000a200 0041 00000000 0x0 0x0
0xffffa2000000a280 0041 00000000 0x0 0x0
0xffffa2000000a300 0041 00000000 0x0 0x0
0xffffa2000000a380 0041 00000000 0x0 0x0
0xffffa2000000a400 0041 00000000 0x0 0x0
0xffffa2000000a480 0041 00000000 0x0 0x0
0xffffa2000000a500 0041 00000000 0x0 0x0
0xffffa2000000a580 0041 00000000 0x0 0x0
0xffffa2000000a600 0041 00000000 0x0 0x0
0xffffa2000000a680 0041 00000000 0x0 0x0
0xffffa2000000a700 0041 00000000 0x0 0x0
0xffffa2000000a780 0041 00000000 0x0 0x0
0xffffa2000000a800 0041 00000000 0x0 0x0
0xffffa2000000a880 0041 00000000 0x0 0x0
0xffffa2000000a900 0041 00000000 0x0 0x0
0xffffa2000000a980 0041 00000000 0x0 0x0
0xffffa2000000aa00 0041 00000000 0x0 0x0
0xffffa2000000aa80 0041 00000000 0x0 0x0
0xffffa2000000ab00 0041 00000000 0x0 0x0
0xffffa2000000ab80 0041 00000000 0x0 0x0
0xffffa2000000ac00 0041 00000000 0x0 0x0
0xffffa2000000ac80 0041 00000000 0x0 0x0
0xffffa2000000ad00 0041 00000000 0x0 0x0
0xffffa2000000ad80 0041 00000000 0x0 0x0
0xffffa2000000ae00 0041 00000000 0x0 0x0
0xffffa2000000ae80 0041 00000000 0x0 0x0
0xffffa2000000af00 0045 00000000 0x0 0x0
0xffffa2000000af80 0045 00000000 0x0 0x0
0xffffa2000000b000 0041 00000000 0x0 0x0
0xffffa2000000b080 0041 00000000 0x0 0x0
0xffffa2000000b100 0041 00000000 0x0 0x0
0xffffa2000000b180 0045 00000000 0x0 0x0
0xffffa2000000b200 0041 00000000 0x0 0x0
0xffffa2000000b280 0045 00000000 0x0 0x0
0xffffa2000000b300 0045 00000000 0x0 0x0
0xffffa2000000b380 0045 00000000 0x0 0x0
0xffffa2000000b400 0041 00000000 0x0 0x0
0xffffa2000000b480 0041 00000000 0x0 0x0
0xffffa2000000b500 0045 00000000 0x0 0x0
0xffffa2000000b580 0045 00000000 0x0 0x0
0xffffa2000000b600 0045 00000000 0x0 0x0
0xffffa2000000b680 0045 00000000 0x0 0x0
0xffffa2000000b700 0045 00000000 0x0 0x0
0xffffa2000000b780 0045 00000000 0x0 0x0
0xffffa2000000b800 0045 00000000 0x0 0x0
0xffffa2000000b880 0041 00000000 0x0 0x0
0xffffa2000000b900 0045 00000000 0x0 0x0
0xffffa2000000b980 0045 00000000 0x0 0x0
0xffffa2000000ba00 0045 00000000 0x0 0x0
0xffffa2000000ba80 0045 00000000 0x0 0x0
0xffffa2000000bb00 0045 00000000 0x0 0x0
0xffffa2000000bb80 0045 00000000 0x0 0x0
0xffffa2000000bc00 0045 00000000 0x0 0x0
0xffffa2000000bc80 0041 00000000 0x0 0x0
0xffffa2000000bd00 0045 00000000 0x0 0x0
0xffffa2000000bd80 0045 00000000 0x0 0x0
0xffffa2000000be00 0045 00000000 0x0 0x0
0xffffa2000000be80 0045 00000000 0x0 0x0
0xffffa2000000bf00 0045 00000000 0x0 0x0
0xffffa2000000bf80 0045 00000000 0x0 0x0
0xffffa2000000c000 0045 00000000 0x0 0x0
0xffffa2000000c080 0045 00000000 0x0 0x0
0xffffa2000000c100 0045 00000000 0x0 0x0
0xffffa2000000c180 0045 00000000 0x0 0x0
0xffffa2000000c200 0045 00000000 0x0 0x0
0xffffa2000000c280 0045 00000000 0x0 0x0
0xffffa2000000c300 0045 00000000 0x0 0x0
0xffffa2000000c380 0045 00000000 0x0 0x0
0xffffa2000000c400 0045 00000000 0x0 0x0
0xffffa2000000c480 0045 00000000 0x0 0x0
0xffffa2000000c500 0045 00000000 0x0 0x0
0xffffa2000000c580 0045 00000000 0x0 0x0
0xffffa2000000c600 0045 00000000 0x0 0x0
0xffffa2000000c680 0045 00000000 0x0 0x0
0xffffa2000000c700 0041 00000000 0x0 0x0
0xffffa2000000c780 0041 00000000 0x0 0x0
0xffffa2000000c800 0045 00000000 0x0 0x0
0xffffa2000000c880 0045 00000000 0x0 0x0
0xffffa2000000c900 0045 00000000 0x0 0x0
0xffffa2000000c980 0045 00000000 0x0 0x0
0xffffa2000000ca00 0045 00000000 0x0 0x0
0xffffa2000000ca80 0045 00000000 0x0 0x0
0xffffa2000000cb00 0041 00000000 0x0 0x0
0xffffa2000000cb80 0041 00000000 0x0 0x0
0xffffa2000000cc00 0045 00000000 0x0 0x0
0xffffa2000000cc80 0045 00000000 0x0 0x0
0xffffa2000000cd00 0045 00000000 0x0 0x0
0xffffa2000000cd80 0041 00000000 0x0 0x0
0xffffa2000000ce00 0045 00000000 0x0 0x0
0xffffa2000000ce80 0041 00000000 0x0 0x0
0xffffa2000000cf00 0041 00000000 0x0 0x0
0xffffa2000000cf80 0041 00000000 0x0 0x0
0xffffa2000000d000 0041 00000000 0x0 0x0
0xffffa2000000d080 0045 00000000 0x0 0x0
0xffffa2000000d100 0041 00000000 0x0 0x0
0xffffa2000000d180 0041 00000000 0x0 0x0
0xffffa2000000d200 0041 00000000 0x0 0x0
0xffffa2000000d280 0041 00000000 0x0 0x0
0xffffa2000000d300 0045 00000000 0x0 0x0
0xffffa2000000d380 0041 00000000 0x0 0x0
0xffffa2000000d400 0041 00000000 0x0 0x0
0xffffa2000000d480 0045 00000000 0x0 0x0
0xffffa2000000d500 0041 00000000 0x0 0x0
0xffffa2000000d580 0041 00000000 0x0 0x0
0xffffa2000000d600 0041 00000000 0x0 0x0
0xffffa2000000d680 0041 00000000 0x0 0x0
0xffffa2000000d700 0041 00000000 0x0 0x0
0xffffa2000000d780 0045 00000000 0x0 0x0
0xffffa2000000d800 0041 00000000 0x0 0x0
0xffffa2000000d880 0041 00000000 0x0 0x0
0xffffa2000000d900 0041 00000000 0x0 0x0
0xffffa2000000d980 0041 00000000 0x0 0x0
0xffffa2000000da00 0041 00000000 0x0 0x0
0xffffa2000000da80 0045 00000000 0x0 0x0
0xffffa2000000db00 0045 00000000 0x0 0x0
0xffffa2000000db80 0045 00000000 0x0 0x0
0xffffa2000000dc00 0041 00000000 0x0 0x0
0xffffa2000000dc80 0041 00000000 0x0 0x0
0xffffa2000000dd00 0041 00000000 0x0 0x0
0xffffa2000000dd80 0041 00000000 0x0 0x0
0xffffa2000000de00 0041 00000000 0x0 0x0
0xffffa2000000de80 0041 00000000 0x0 0x0
0xffffa2000000df00 0045 00000000 0x0 0x0
0xffffa2000000df80 0045 00000000 0x0 0x0
0xffffa2000000e000 0045 00000000 0x0 0x0
0xffffa2000000e080 0041 00000000 0x0 0x0
0xffffa2000000e100 0041 00000000 0x0 0x0
0xffffa2000000e180 0045 00000000 0x0 0x0
0xffffa2000000e200 0041 00000000 0x0 0x0
0xffffa2000000e280 0041 00000000 0x0 0x0
0xffffa2000000e300 0045 00000000 0x0 0x0
0xffffa2000000e380 0041 00000000 0x0 0x0
0xffffa2000000e400 0045 00000000 0x0 0x0
0xffffa2000000e480 0041 00000000 0x0 0x0
0xffffa2000000e500 0045 00000000 0x0 0x0
0xffffa2000000e580 0041 00000000 0x0 0x0
0xffffa2000000e600 0045 00000000 0x0 0x0
0xffffa2000000e680 0045 00000000 0x0 0x0
0xffffa2000000e700 0041 00000000 0x0 0x0
0xffffa2000000e780 0041 00000000 0x0 0x0
0xffffa2000000e800 0045 00000000 0x0 0x0
0xffffa2000000e880 0045 00000000 0x0 0x0
0xffffa2000000e900 0041 00000000 0x0 0x0
0xffffa2000000e980 0041 00000000 0x0 0x0
0xffffa2000000ea00 0041 00000000 0x0 0x0
0xffffa2000000ea80 0041 00000000 0x0 0x0
0xffffa2000000eb00 0041 00000000 0x0 0x0
0xffffa2000000eb80 0045 00000000 0x0 0x0
0xffffa2000000ec00 0041 00000000 0x0 0x0
0xffffa2000000ec80 0041 00000000 0x0 0x0
0xffffa2000000ed00 0041 00000000 0x0 0x0
0xffffa2000000ed80 0041 00000000 0x0 0x0
0xffffa2000000ee00 0041 00000000 0x0 0x0
0xffffa2000000ee80 0045 00000000 0x0 0x0
0xffffa2000000ef00 0041 00000000 0x0 0x0
0xffffa2000000ef80 0041 00000000 0x0 0x0
0xffffa2000000f000 0041 00000000 0x0 0x0
0xffffa2000000f080 0045 00000000 0x0 0x0
0xffffa2000000f100 0041 00000000 0x0 0x0
0xffffa2000000f180 0041 00000000 0x0 0x0
0xffffa2000000f200 0041 00000000 0x0 0x0
0xffffa2000000f280 0041 00000000 0x0 0x0
0xffffa2000000f300 0041 00000000 0x0 0x0
0xffffa2000000f380 0041 00000000 0x0 0x0
0xffffa2000000f400 0045 00000000 0x0 0x0
0xffffa2000000f480 0041 00000000 0x0 0x0
0xffffa2000000f500 0041 00000000 0x0 0x0
0xffffa2000000f580 0041 00000000 0x0 0x0
0xffffa2000000f600 0041 00000000 0x0 0x0
0xffffa2000000f680 0045 00000000 0x0 0x0
0xffffa2000000f700 0041 00000000 0x0 0x0
0xffffa2000000f780 0041 00000000 0x0 0x0
0xffffa2000000f800 0041 00000000 0x0 0x0
0xffffa2000000f880 0045 00000000 0x0 0x0
0xffffa2000000f900 0041 00000000 0x0 0x0
0xffffa2000000f980 0045 00000000 0x0 0x0
0xffffa2000000fa00 0041 00000000 0x0 0x0
0xffffa2000000fa80 0041 00000000 0x0 0x0
0xffffa2000000fb00 0041 00000000 0x0 0x0
0xffffa2000000fb80 0041 00000000 0x0 0x0
0xffffa2000000fc00 0045 00000000 0x0 0x0
0xffffa2000000fc80 0041 00000000 0x0 0x0
0xffffa2000000fd00 0045 00000000 0x0 0x0
0xffffa2000000fd80 0041 00000000 0x0 0x0
0xffffa2000000fe00 0041 00000000 0x0 0x0
0xffffa2000000fe80 0041 00000000 0x0 0x0
0xffffa2000000ff00 0041 00000000 0x0 0x0
0xffffa2000000ff80 0041 00000000 0x0 0x0
0xffffa20000010000 0041 00000000 0x0 0x0
0xffffa20000010080 0041 00000000 0x0 0x0
0xffffa20000010100 0041 00000000 0x0 0x0
0xffffa20000010180 0045 00000000 0x0 0x0
0xffffa20000010200 0045 00000000 0x0 0x0
0xffffa20000010280 0041 00000000 0x0 0x0
0xffffa20000010300 0041 00000000 0x0 0x0
0xffffa20000010380 0041 00000000 0x0 0x0
0xffffa20000010400 0041 00000000 0x0 0x0
0xffffa20000010480 0045 00000000 0x0 0x0
0xffffa20000010500 0045 00000000 0x0 0x0
0xffffa20000010580 0041 00000000 0x0 0x0
0xffffa20000010600 0041 00000000 0x0 0x0
0xffffa20000010680 0041 00000000 0x0 0x0
0xffffa20000010700 0041 00000000 0x0 0x0
0xffffa20000010780 0041 00000000 0x0 0x0
0xffffa20000010800 0041 00000000 0x0 0x0
0xffffa20000010880 0041 00000000 0x0 0x0
0xffffa20000010900 0041 00000000 0x0 0x0
0xffffa20000010980 0045 00000000 0x0 0x0
0xffffa20000010a00 0045 00000000 0x0 0x0
0xffffa20000010a80 0045 00000000 0x0 0x0
0xffffa20000010b00 0041 00000000 0x0 0x0
0xffffa20000010b80 0041 00000000 0x0 0x0
0xffffa20000010c00 0041 00000000 0x0 0x0
0xffffa20000010c80 0045 00000000 0x0 0x0
0xffffa20000010d00 0041 00000000 0x0 0x0
0xffffa20000010d80 0041 00000000 0x0 0x0
0xffffa20000010e00 0041 00000000 0x0 0x0
0xffffa20000010e80 0041 00000000 0x0 0x0
0xffffa20000010f00 0041 00000000 0x0 0x0
0xffffa20000010f80 0041 00000000 0x0 0x0
0xffffa20000011000 0041 00000000 0x0 0x0
0xffffa20000011080 0041 00000000 0x0 0x0
0xffffa20000011100 0041 00000000 0x0 0x0
0xffffa20000011180 0041 00000000 0x0 0x0
0xffffa20000011200 0045 00000000 0x0 0x0
0xffffa20000011280 0045 00000000 0x0 0x0
0xffffa20000011300 0041 00000000 0x0 0x0
0xffffa20000011380 0041 00000000 0x0 0x0
0xffffa20000011400 0041 00000000 0x0 0x0
0xffffa20000011480 0041 00000000 0x0 0x0
0xffffa20000011500 0045 00000000 0x0 0x0
0xffffa20000011580 0041 00000000 0x0 0x0
0xffffa20000011600 0041 00000000 0x0 0x0
0xffffa20000011680 0041 00000000 0x0 0x0
0xffffa20000011700 0045 00000000 0x0 0x0
0xffffa20000011780 0045 00000000 0x0 0x0
0xffffa20000011800 0041 00000000 0x0 0x0
0xffffa20000011880 0041 00000000 0x0 0x0
0xffffa20000011900 0041 00000000 0x0 0x0
0xffffa20000011980 0041 00000000 0x0 0x0
0xffffa20000011a00 0041 00000000 0x0 0x0
0xffffa20000011a80 0041 00000000 0x0 0x0
0xffffa20000011b00 0041 00000000 0x0 0x0
0xffffa20000011b80 0041 00000000 0x0 0x0
0xffffa20000011c00 0041 00000000 0x0 0x0
0xffffa20000011c80 0041 00000000 0x0 0x0
0xffffa20000011d00 0041 00000000 0x0 0x0
0xffffa20000011d80 0041 00000000 0x0 0x0
0xffffa20000011e00 0045 00000000 0x0 0x0
0xffffa20000011e80 0041 00000000 0x0 0x0
0xffffa20000011f00 0041 00000000 0x0 0x0
0xffffa20000011f80 0041 00000000 0x0 0x0
0xffffa20000012000 0041 00000000 0x0 0x0
0xffffa20000012080 0041 00000000 0x0 0x0
0xffffa20000012100 0045 00000000 0x0 0x0
0xffffa20000012180 0045 00000000 0x0 0x0
0xffffa20000012200 0041 00000000 0x0 0x0
0xffffa20000012280 0041 00000000 0x0 0x0
0xffffa20000012300 0041 00000000 0x0 0x0
0xffffa20000012380 0041 00000000 0x0 0x0
0xffffa20000012400 0041 00000000 0x0 0x0
0xffffa20000012480 0041 00000000 0x0 0x0
0xffffa20000012500 0041 00000000 0x0 0x0
0xffffa20000012580 0041 00000000 0x0 0x0
0xffffa20000012600 0041 00000000 0x0 0x0
0xffffa20000012680 0045 00000000 0x0 0x0
0xffffa20000012700 0041 00000000 0x0 0x0
0xffffa20000012780 0041 00000000 0x0 0x0
0xffffa20000012800 0041 00000000 0x0 0x0
0xffffa20000012880 0045 00000000 0x0 0x0
0xffffa20000012900 0001 00000000 0x0 0x0
0xffffa20000012980 0001 00000000 0x0 0x0
0xffffa20000012a00 0001 00000000 0x0 0x0
0xffffa20000012a80 0001 00000000 0x0 0x0
0xffffa20000012b00 0001 00000000 0x0 0x0
0xffffa20000012b80 0001 00000000 0x0 0x0
0xffffa20000012c00 0001 00000000 0x0 0x0
0xffffa20000012c80 0001 00000000 0x0 0x0
0xffffa20000012d00 0001 00000000 0x0 0x0
0xffffa20000012d80 0001 00000000 0x0 0x0
0xffffa20000012e00 0001 00000000 0x0 0x0
0xffffa20000012e80 0001 00000000 0x0 0x0
0xffffa20000012f00 0001 00000000 0x0 0x0
0xffffa20000012f80 0001 00000000 0x0 0x0
0xffffa20000013000 0001 00000000 0x0 0x0
0xffffa20000013080 0001 00000000 0x0 0x0
0xffffa20000013100 0001 00000000 0x0 0x0
0xffffa20000013180 0001 00000000 0x0 0x0
0xffffa20000013200 0001 00000000 0x0 0x0
0xffffa20000013280 0001 00000000 0x0 0x0
0xffffa20000013300 0001 00000000 0x0 0x0
0xffffa20000013380 0001 00000000 0x0 0x0
0xffffa20000013400 0001 00000000 0x0 0x0
0xffffa20000013480 0001 00000000 0x0 0x0
0xffffa20000013500 0001 00000000 0x0 0x0
0xffffa20000013580 0001 00000000 0x0 0x0
0xffffa20000013600 0001 00000000 0x0 0x0
0xffffa20000013680 0001 00000000 0x0 0x0
0xffffa20000013700 0001 00000000 0x0 0x0
0xffffa20000013780 0001 00000000 0x0 0x0
0xffffa20000013800 0001 00000000 0x0 0x0
0xffffa20000013880 0001 00000000 0x0 0x0
0xffffa20000013900 0001 00000000 0x0 0x0
0xffffa20000013980 0001 00000000 0x0 0x0
0xffffa20000013a00 0001 00000000 0x0 0x0
0xffffa20000013a80 0001 00000000 0x0 0x0
0xffffa20000013b00 0001 00000000 0x0 0x0
0xffffa20000013b80 0001 00000000 0x0 0x0
0xffffa20000013c00 0001 00000000 0x0 0x0
0xffffa20000013c80 0001 00000000 0x0 0x0
0xffffa20000013d00 0001 00000000 0x0 0x0
0xffffa20000013d80 0001 00000000 0x0 0x0
0xffffa20000013e00 0001 00000000 0x0 0x0
0xffffa20000013e80 0001 00000000 0x0 0x0
0xffffa20000013f00 0001 00000000 0x0 0x0
0xffffa20000013f80 0001 00000000 0x0 0x0
0xffffa20000014000 0001 00000000 0x0 0x0
0xffffa20000014080 0001 00000000 0x0 0x0
0xffffa20000014100 0001 00000000 0x0 0x0
0xffffa20000014180 0001 00000000 0x0 0x0
0xffffa20000014200 0001 00000000 0x0 0x0
0xffffa20000014280 0001 00000000 0x0 0x0
0xffffa20000014300 0001 00000000 0x0 0x0
0xffffa20000014380 0001 00000000 0x0 0x0
0xffffa20000014400 0041 00000000 0x0 0x0
0xffffa20000014480 0041 00000000 0x0 0x0
0xffffa20000014500 0041 00000000 0x0 0x0
0xffffa20000014580 0041 00000000 0x0 0x0
0xffffa20000014600 0041 00000000 0x0 0x0
0xffffa20000014680 0041 00000000 0x0 0x0
0xffffa20000014700 0041 00000000 0x0 0x0
0xffffa20000014780 0041 00000000 0x0 0x0
0xffffa20000014800 0041 00000000 0x0 0x0
0xffffa20000014880 0041 00000000 0x0 0x0
0xffffa20000014900 0041 00000000 0x0 0x0
0xffffa20000014980 0041 00000000 0x0 0x0
0xffffa20000014a00 0041 00000000 0x0 0x0
0xffffa20000014a80 0041 00000000 0x0 0x0
0xffffa20000014b00 0041 00000000 0x0 0x0
0xffffa20000014b80 0041 00000000 0x0 0x0
0xffffa20000014c00 0041 00000000 0x0 0x0
0xffffa20000014c80 0041 00000000 0x0 0x0
0xffffa20000014d00 0041 00000000 0x0 0x0
0xffffa20000014d80 0041 00000000 0x0 0x0
0xffffa20000014e00 0041 00000000 0x0 0x0
0xffffa20000014e80 0041 00000000 0x0 0x0
0xffffa20000014f00 0041 00000000 0x0 0x0
0xffffa20000014f80 0041 00000000 0x0 0x0
0xffffa20000015000 0041 00000000 0x0 0x0
0xffffa20000015080 0041 00000000 0x0 0x0
0xffffa20000015100 0041 00000000 0x0 0x0
0xffffa20000015180 0041 00000000 0x0 0x0
0xffffa20000015200 0041 00000000 0x0 0x0
0xffffa20000015280 0041 00000000 0x0 0x0
0xffffa20000015300 0041 00000000 0x0 0x0
0xffffa20000015380 0041 00000000 0x0 0x0
0xffffa20000015400 0041 00000000 0x0 0x0
0xffffa20000015480 0041 00000000 0x0 0x0
0xffffa20000015500 0041 00000000 0x0 0x0
0xffffa20000015580 0041 00000000 0x0 0x0
0xffffa20000015600 0041 00000000 0x0 0x0
0xffffa20000015680 0041 00000000 0x0 0x0
0xffffa20000015700 0041 00000000 0x0 0x0
0xffffa20000015780 0041 00000000 0x0 0x0
0xffffa20000015800 0041 00000000 0x0 0x0
0xffffa20000015880 0041 00000000 0x0 0x0
0xffffa20000015900 0041 00000000 0x0 0x0
0xffffa20000015980 0041 00000000 0x0 0x0
0xffffa20000015a00 0041 00000000 0x0 0x0
0xffffa20000015a80 0041 00000000 0x0 0x0
0xffffa20000015b00 0001 00000000 0x0 0x0
0xffffa20000015b80 0001 00000000 0x0 0x0
0xffffa20000015c00 0001 00000000 0x0 0x0
0xffffa20000015c80 0001 00000000 0x0 0x0
0xffffa20000015d00 0001 00000000 0x0 0x0
0xffffa20000015d80 0001 00000000 0x0 0x0
0xffffa20000015e00 0001 00000000 0x0 0x0
0xffffa20000015e80 0001 00000000 0x0 0x0
0xffffa20000015f00 0001 00000000 0x0 0x0
0xffffa20000015f80 0001 00000000 0x0 0x0
0xffffa20000016000 0001 00000000 0x0 0x0
0xffffa20000016080 0001 00000000 0x0 0x0
0xffffa20000016100 0001 00000000 0x0 0x0
0xffffa20000016180 0001 00000000 0x0 0x0
0xffffa20000016200 0001 00000000 0x0 0x0
0xffffa20000016280 0001 00000000 0x0 0x0
0xffffa20000016300 0001 00000000 0x0 0x0
0xffffa20000016380 0001 00000000 0x0 0x0
0xffffa20000016400 0001 00000000 0x0 0x0
0xffffa20000016480 0001 00000000 0x0 0x0
0xffffa20000016500 0001 00000000 0x0 0x0
0xffffa20000016580 0001 00000000 0x0 0x0
0xffffa20000016600 0001 00000000 0x0 0x0
0xffffa20000016680 0001 00000000 0x0 0x0
0xffffa20000016700 0001 00000000 0x0 0x0
0xffffa20000016780 0001 00000000 0x0 0x0
0xffffa20000016800 0001 00000000 0x0 0x0
0xffffa20000016880 0001 00000000 0x0 0x0
0xffffa20000016900 0001 00000000 0x0 0x0
0xffffa20000016980 0001 00000000 0x0 0x0
0xffffa20000016a00 0001 00000000 0x0 0x0
0xffffa20000016a80 0001 00000000 0x0 0x0
0xffffa20000016b00 0001 00000000 0x0 0x0
0xffffa20000016b80 0001 00000000 0x0 0x0
0xffffa20000016c00 0001 00000000 0x0 0x0
0xffffa20000016c80 0001 00000000 0x0 0x0
0xffffa20000016d00 0001 00000000 0x0 0x0
0xffffa20000016d80 0001 00000000 0x0 0x0
0xffffa20000016e00 0001 00000000 0x0 0x0
0xffffa20000016e80 0001 00000000 0x0 0x0
0xffffa20000016f00 0001 00000000 0x0 0x0
0xffffa20000016f80 0001 00000000 0x0 0x0
0xffffa20000017000 0001 00000000 0x0 0x0
0xffffa20000017080 0001 00000000 0x0 0x0
0xffffa20000017100 0001 00000000 0x0 0x0
0xffffa20000017180 0001 00000000 0x0 0x0
0xffffa20000017200 0001 00000000 0x0 0x0
0xffffa20000017280 0001 00000000 0x0 0x0
0xffffa20000017300 0001 00000000 0x0 0x0
0xffffa20000017380 0001 00000000 0x0 0x0
0xffffa20000017400 0001 00000000 0x0 0x0
0xffffa20000017480 0001 00000000 0x0 0x0
0xffffa20000017500 0001 00000000 0x0 0x0
0xffffa20000017580 0001 00000000 0x0 0x0
0xffffa20000017600 0041 00000000 0x0 0x0
0xffffa20000017680 0041 00000000 0x0 0x0
0xffffa20000017700 0041 00000000 0x0 0x0
0xffffa20000017780 0041 00000000 0x0 0x0
0xffffa20000017800 0041 00000000 0x0 0x0
0xffffa20000017880 0041 00000000 0x0 0x0
0xffffa20000017900 0041 00000000 0x0 0x0
0xffffa20000017980 0041 00000000 0x0 0x0
0xffffa20000017a00 0041 00000000 0x0 0x0
0xffffa20000017a80 0041 00000000 0x0 0x0
0xffffa20000017b00 0041 00000000 0x0 0x0
0xffffa20000017b80 0041 00000000 0x0 0x0
0xffffa20000017c00 0041 00000000 0x0 0x0
0xffffa20000017c80 0041 00000000 0x0 0x0
0xffffa20000017d00 0041 00000000 0x0 0x0
0xffffa20000017d80 0041 00000000 0x0 0x0
0xffffa20000017e00 0041 00000000 0x0 0x0
0xffffa20000017e80 0041 00000000 0x0 0x0
0xffffa20000017f00 0041 00000000 0x0 0x0
0xffffa20000017f80 0041 00000000 0x0 0x0
0xffffa20000018000 0041 00000000 0x0 0x0
0xffffa20000018080 0041 00000000 0x0 0x0
0xffffa20000018100 0041 00000000 0x0 0x0
0xffffa20000018180 0041 00000000 0x0 0x0
0xffffa20000018200 0041 00000000 0x0 0x0
0xffffa20000018280 0041 00000000 0x0 0x0
0xffffa20000018300 0041 00000000 0x0 0x0
0xffffa20000018380 0041 00000000 0x0 0x0
0xffffa20000018400 0041 00000000 0x0 0x0
0xffffa20000018480 0041 00000000 0x0 0x0
0xffffa20000018500 0041 00000000 0x0 0x0
0xffffa20000018580 0041 00000000 0x0 0x0
0xffffa20000018600 0041 00000000 0x0 0x0
0xffffa20000018680 0041 00000000 0x0 0x0
0xffffa20000018700 0041 00000000 0x0 0x0
0xffffa20000018780 0041 00000000 0x0 0x0
0xffffa20000018800 0041 00000000 0x0 0x0
0xffffa20000018880 0041 00000000 0x0 0x0
0xffffa20000018900 0041 00000000 0x0 0x0
0xffffa20000018980 0041 00000000 0x0 0x0
0xffffa20000018a00 0041 00000000 0x0 0x0
0xffffa20000018a80 0041 00000000 0x0 0x0
0xffffa20000018b00 0041 00000000 0x0 0x0
0xffffa20000018b80 0041 00000000 0x0 0x0
0xffffa20000018c00 0041 00000000 0x0 0x0
0xffffa20000018c80 0041 00000000 0x0 0x0
0xffffa20000018d00 0001 00000000 0x0 0x0
0xffffa20000018d80 0001 00000000 0x0 0x0
0xffffa20000018e00 0001 00000000 0x0 0x0
0xffffa20000018e80 0001 00000000 0x0 0x0
0xffffa20000018f00 0001 00000000 0x0 0x0
0xffffa20000018f80 0001 00000000 0x0 0x0
0xffffa20000019000 0001 00000000 0x0 0x0
0xffffa20000019080 0001 00000000 0x0 0x0
0xffffa20000019100 0001 00000000 0x0 0x0
0xffffa20000019180 0001 00000000 0x0 0x0
0xffffa20000019200 0001 00000000 0x0 0x0
0xffffa20000019280 0001 00000000 0x0 0x0
0xffffa20000019300 0001 00000000 0x0 0x0
0xffffa20000019380 0001 00000000 0x0 0x0
0xffffa20000019400 0001 00000000 0x0 0x0
0xffffa20000019480 0001 00000000 0x0 0x0
0xffffa20000019500 0001 00000000 0x0 0x0
0xffffa20000019580 0001 00000000 0x0 0x0
0xffffa20000019600 0001 00000000 0x0 0x0
0xffffa20000019680 0001 00000000 0x0 0x0
0xffffa20000019700 0001 00000000 0x0 0x0
0xffffa20000019780 0001 00000000 0x0 0x0
0xffffa20000019800 0001 00000000 0x0 0x0
0xffffa20000019880 0001 00000000 0x0 0x0
0xffffa20000019900 0001 00000000 0x0 0x0
0xffffa20000019980 0001 00000000 0x0 0x0
0xffffa20000019a00 0001 00000000 0x0 0x0
0xffffa20000019a80 0001 00000000 0x0 0x0
0xffffa20000019b00 0001 00000000 0x0 0x0
0xffffa20000019b80 0001 00000000 0x0 0x0
0xffffa20000019c00 0001 00000000 0x0 0x0
0xffffa20000019c80 0001 00000000 0x0 0x0
0xffffa20000019d00 0001 00000000 0x0 0x0
0xffffa20000019d80 0001 00000000 0x0 0x0
0xffffa20000019e00 0001 00000000 0x0 0x0
0xffffa20000019e80 0001 00000000 0x0 0x0
0xffffa20000019f00 0001 00000000 0x0 0x0
0xffffa20000019f80 0001 00000000 0x0 0x0
0xffffa2000001a000 0001 00000000 0x0 0x0
0xffffa2000001a080 0001 00000000 0x0 0x0
0xffffa2000001a100 0001 00000000 0x0 0x0
0xffffa2000001a180 0001 00000000 0x0 0x0
0xffffa2000001a200 0001 00000000 0x0 0x0
0xffffa2000001a280 0001 00000000 0x0 0x0
0xffffa2000001a300 0001 00000000 0x0 0x0
0xffffa2000001a380 0001 00000000 0x0 0x0
0xffffa2000001a400 0001 00000000 0x0 0x0
0xffffa2000001a480 0001 00000000 0x0 0x0
0xffffa2000001a500 0001 00000000 0x0 0x0
0xffffa2000001a580 0001 00000000 0x0 0x0
0xffffa2000001a600 0001 00000000 0x0 0x0
0xffffa2000001a680 0001 00000000 0x0 0x0
0xffffa2000001a700 0001 00000000 0x0 0x0
0xffffa2000001a780 0001 00000000 0x0 0x0
0xffffa2000001a800 0041 00000000 0x0 0x0
0xffffa2000001a880 0041 00000000 0x0 0x0
0xffffa2000001a900 0041 00000000 0x0 0x0
0xffffa2000001a980 0041 00000000 0x0 0x0
0xffffa2000001aa00 0041 00000000 0x0 0x0
0xffffa2000001aa80 0041 00000000 0x0 0x0
0xffffa2000001ab00 0041 00000000 0x0 0x0
0xffffa2000001ab80 0041 00000000 0x0 0x0
0xffffa2000001ac00 0041 00000000 0x0 0x0
0xffffa2000001ac80 0041 00000000 0x0 0x0
0xffffa2000001ad00 0041 00000000 0x0 0x0
0xffffa2000001ad80 0041 00000000 0x0 0x0
0xffffa2000001ae00 0041 00000000 0x0 0x0
0xffffa2000001ae80 0041 00000000 0x0 0x0
0xffffa2000001af00 0041 00000000 0x0 0x0
0xffffa2000001af80 0041 00000000 0x0 0x0
0xffffa2000001b000 0041 00000000 0x0 0x0
0xffffa2000001b080 0041 00000000 0x0 0x0
0xffffa2000001b100 0041 00000000 0x0 0x0
0xffffa2000001b180 0041 00000000 0x0 0x0
0xffffa2000001b200 0041 00000000 0x0 0x0
0xffffa2000001b280 0041 00000000 0x0 0x0
0xffffa2000001b300 0041 00000000 0x0 0x0
0xffffa2000001b380 0041 00000000 0x0 0x0
0xffffa2000001b400 0041 00000000 0x0 0x0
0xffffa2000001b480 0041 00000000 0x0 0x0
0xffffa2000001b500 0041 00000000 0x0 0x0
0xffffa2000001b580 0041 00000000 0x0 0x0
0xffffa2000001b600 0041 00000000 0x0 0x0
0xffffa2000001b680 0041 00000000 0x0 0x0
0xffffa2000001b700 0045 00000000 0x0 0x0
0xffffa2000001b780 0045 00000000 0x0 0x0
0xffffa2000001b800 0045 00000000 0x0 0x0
0xffffa2000001b880 0041 00000000 0x0 0x0
0xffffa2000001b900 0041 00000000 0x0 0x0
0xffffa2000001b980 0041 00000000 0x0 0x0
0xffffa2000001ba00 0045 00000000 0x0 0x0
0xffffa2000001ba80 0041 00000000 0x0 0x0
0xffffa2000001bb00 0045 00000000 0x0 0x0
0xffffa2000001bb80 0045 00000000 0x0 0x0
0xffffa2000001bc00 0045 00000000 0x0 0x0
0xffffa2000001bc80 0041 00000000 0x0 0x0
0xffffa2000001bd00 0041 00000000 0x0 0x0
0xffffa2000001bd80 0041 00000000 0x0 0x0
0xffffa2000001be00 0045 00000000 0x0 0x0
0xffffa2000001be80 0041 00000000 0x0 0x0
0xffffa2000001bf00 0001 00000000 0x0 0x0
0xffffa2000001bf80 0001 00000000 0x0 0x0
0xffffa2000001c000 0001 00000000 0x0 0x0
0xffffa2000001c080 0001 00000000 0x0 0x0
0xffffa2000001c100 0001 00000000 0x0 0x0
0xffffa2000001c180 0001 00000000 0x0 0x0
0xffffa2000001c200 0001 00000000 0x0 0x0
0xffffa2000001c280 0001 00000000 0x0 0x0
0xffffa2000001c300 0001 00000000 0x0 0x0
0xffffa2000001c380 0001 00000000 0x0 0x0
0xffffa2000001c400 0001 00000000 0x0 0x0
0xffffa2000001c480 0001 00000000 0x0 0x0
0xffffa2000001c500 0001 00000000 0x0 0x0
0xffffa2000001c580 0001 00000000 0x0 0x0
0xffffa2000001c600 0001 00000000 0x0 0x0
0xffffa2000001c680 0001 00000000 0x0 0x0
0xffffa2000001c700 0001 00000000 0x0 0x0
0xffffa2000001c780 0001 00000000 0x0 0x0
0xffffa2000001c800 0001 00000000 0x0 0x0
0xffffa2000001c880 0001 00000000 0x0 0x0
0xffffa2000001c900 0001 00000000 0x0 0x0
0xffffa2000001c980 0001 00000000 0x0 0x0
0xffffa2000001ca00 0001 00000000 0x0 0x0
0xffffa2000001ca80 0001 00000000 0x0 0x0
0xffffa2000001cb00 0001 00000000 0x0 0x0
0xffffa2000001cb80 0001 00000000 0x0 0x0
0xffffa2000001cc00 0001 00000000 0x0 0x0
0xffffa2000001cc80 0001 00000000 0x0 0x0
0xffffa2000001cd00 0001 00000000 0x0 0x0
0xffffa2000001cd80 0001 00000000 0x0 0x0
0xffffa2000001ce00 0001 00000000 0x0 0x0
0xffffa2000001ce80

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Nov 4, 2022, 8:08:54 AM11/4/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 20b0d5919d8e Update check files to allow for changes due t..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=156fc719880000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=762480b00cb14085f63a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14ce5f16880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1091d541880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/06f64ff420e0/disk-20b0d591.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e51959721c13/netbsd-20b0d591.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+762480...@syzkaller.appspotmail.com

[ 40.9519859] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/vfs_lockf.c:850:16, signed integer overflow: 1 + 9223372036854775807 cannot be represented in type 'long int'

[ 40.9519859] cpu1: Begin traceback...
[ 40.9719755] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 41.0419774] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 41.1019762] HandleOverflow() at netbsd:HandleOverflow+0x1d0 sys/../common/lib/libc/misc/ubsan.c:375
[ 41.1519735] lf_advlock() at netbsd:lf_advlock+0x2b6a sys/kern/vfs_lockf.c:850
[ 41.2019741] VOP_ADVLOCK() at netbsd:VOP_ADVLOCK+0x14a sys/kern/vnode_if.c:1868
[ 41.2519720] do_fcntl_lock() at netbsd:do_fcntl_lock+0x498 sys/kern/sys_descrip.c:286
[ 41.3019729] sys_fcntl() at netbsd:sys_fcntl+0x14b sys/kern/sys_descrip.c:384
[ 41.3519754] sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 41.3519754] sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 41.4019762] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 41.4019762] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 41.4019762] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 41.4219711] --- syscall (number 92 via SYS_syscall) ---
[ 41.4419742] netbsd:syscall+0x2da:
[ 41.4419742] cpu1: End traceback...
[ 41.4419742] fatal breakpoint trap in supervisor mode
[ 41.4519741] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x778c194b61b8 ilevel 0 rsp 0xffff8e02483a2620
[ 41.4619706] curlwp 0xffffe38cdcfe6200 pid 1239.1239 lowest kstack 0xffff8e024839e2c0
Stopped in pid 1239.1239 (syz-executor1266) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleOverflow() at netbsd:HandleOverflow+0x1d0 sys/../common/lib/libc/misc/ubsan.c:375
lf_advlock() at netbsd:lf_advlock+0x2b6a sys/kern/vfs_lockf.c:850
VOP_ADVLOCK() at netbsd:VOP_ADVLOCK+0x14a sys/kern/vnode_if.c:1868
do_fcntl_lock() at netbsd:do_fcntl_lock+0x498 sys/kern/sys_descrip.c:286
sys_fcntl() at netbsd:sys_fcntl+0x14b sys/kern/sys_descrip.c:384

sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 92 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/vfs_lockf.c:850:16, signed integer overflow: 1 + 9223372036854775807 cannot be represented in type 'long int'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1120 1120 2 0 0 ffffe38cdcfe6640 syz-executor1266
990 990 2 0 0 ffffe38cdc9cd580 syz-executor1266
1239 >1239 7 1 0 ffffe38cdcfe6200 syz-executor1266
813 813 2 0 0 ffffe38cdc201540 syz-executor1266
1243 1243 2 1 0 ffffe38cdaa8f200 syz-executor1266
1242 >1242 7 0 0 ffffe38cdce35a40 syz-executor1266
929 929 2 0 140 ffffe38cdadabb00 syz-executor1266
1241 1241 2 1 140 ffffe38cdcdfd180 syz-executor1266
1224 1224 2 1 140 ffffe38cdcdfd5c0 syz-executor1266
449 449 2 1 140 ffffe38cdcdfda00 syz-executor1266
1226 1226 3 0 180 ffffe38cdce35600 syz-executor1266 nanoslp
1230 1230 3 1 40180 ffffe38cdce351c0 sshd select
1184 1184 3 0 180 ffffe38cdb15f740 getty nanoslp
1195 1195 3 0 180 ffffe38cdadab6c0 getty nanoslp
1082 1082 3 1 180 ffffe38cdadab280 getty nanoslp
1196 1196 3 0 1c0 ffffe38cdaa75ac0 getty ttyraw
952 952 3 1 180 ffffe38cdc9cd140 sshd select
1088 1088 3 1 180 ffffe38cdbcf6940 powerd kqueue
700 700 3 0 180 ffffe38cdaedbb40 syslogd kqueue
747 747 3 0 180 ffffe38cdb267780 dhcpcd poll
742 742 3 1 180 ffffe38cdbaae040 dhcpcd poll
466 466 3 0 180 ffffe38cdbaae8c0 dhcpcd poll
598 598 3 0 180 ffffe38cdb267bc0 dhcpcd poll
292 292 3 0 180 ffffe38cdaedb700 dhcpcd poll
485 485 3 0 180 ffffe38cdb15fb80 dhcpcd poll
291 291 3 0 180 ffffe38cdb267340 dhcpcd poll
1 1 3 0 180 ffffe38cd2863540 init wait
0 686 3 0 200 ffffe38cdaa8f640 physiod physiod
0 196 3 0 200 ffffe38cdaa75680 pooldrain pooldrain
0 195 2 0 240 ffffe38cdaa75240 ioflush
0 194 3 1 200 ffffe38cdaa8fa80 pgdaemon pgdaemon
0 170 3 1 200 ffffe38cd89cfa40 usb7 usbevt
0 169 3 1 200 ffffe38cd89cf600 usb6 usbevt
0 168 3 1 200 ffffe38cd89cf1c0 usb5 usbevt
0 167 3 1 200 ffffe38cd592aa00 usb4 usbevt
0 166 3 1 200 ffffe38cd592a5c0 usb3 usbevt
0 165 3 1 200 ffffe38cd592a180 usb2 usbevt
0 31 3 1 200 ffffe38cd38f59c0 usb1 usbevt
0 63 3 0 200 ffffe38cd38f5580 usb0 usbevt
0 126 3 1 200 ffffe38cd38f5140 usbtask-dr usbtsk
0 125 3 1 200 ffffe38cd26e0740 usbtask-hc usbtsk
0 124 3 0 200 ffffe38cd0ca1b00 swwreboot swwreboot
0 123 3 1 200 ffffe38cd2863980 npfgc0 npfgcw
0 122 3 1 200 ffffe38cd2863100 rt_free rt_free
0 121 3 1 200 ffffe38cd283e940 unpgc unpgc
0 120 2 0 200 ffffe38cd283e500 key_timehandler
0 119 3 1 200 ffffe38cd26e0b80 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffe38cd27d7340 icmp6_wqinput/0 icmp6_wqinput
0 117 2 0 200 ffffe38cd283e0c0 nd6_timer
0 116 3 1 200 ffffe38cd282a900 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffe38cd282a4c0 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffe38cd282a080 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffe38cd28148c0 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffe38cd2814480 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffe38cd2814040 icmp_wqinput/0 icmp_wqinput
0 110 2 0 200 ffffe38cd27d7bc0 rt_timer
0 109 3 1 200 ffffe38cd27d7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffffe38cd26e0300 entbutler entropy
0 99 3 0 200 ffffe38cd2150b40 viomb balloon
0 98 3 1 200 ffffe38cd2150700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffe38cd21502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffffe38cd0ca16c0 scsibus0 sccomp
0 29 3 0 200 ffffe38cd0ca1280 pms0 pmsreset
0 28 3 1 200 ffffe38cd0bb4ac0 xcall/1 xcall
0 27 1 1 200 ffffe38cd0bb4680 softser/1
0 26 1 1 200 ffffe38cd0bb4240 softclk/1
0 25 1 1 200 ffffe38cd0b87a80 softbio/1
0 24 1 1 200 ffffe38cd0b87640 softnet/1
0 23 1 1 201 ffffe38cd0b87200 idle/1
0 22 3 1 200 ffffe38dfef2da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffffe38dfef2d600 lnxubdwq lnxubdwq
0 20 3 1 200 ffffe38dfef2d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffffe38dfef34a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffe38dfef345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffffe38dfef34180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffe38dfef539c0 sysmon smtaskq
0 15 3 1 200 ffffe38dfef53580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffe38dfef53140 pmfevent pmfevent
0 13 3 1 200 ffffe38dfef5e980 sopendfree sopendfr
0 12 3 0 200 ffffe38dfef5e540 ifwdog ifwdog
0 11 3 1 200 ffffe38dfef5e100 iflnkst iflnkst
0 10 3 1 200 ffffe38dfff93940 nfssilly nfssilly
0 9 3 0 200 ffffe38dfff93500 vdrain vdrain
0 8 3 1 200 ffffe38dfff930c0 modunload mod_unld
0 7 3 0 200 ffffe38dfffbc900 xcall/0 xcall
0 6 1 0 200 ffffe38dfffbc4c0 softser/0
0 5 1 0 200 ffffe38dfffbc080 softclk/0
0 4 1 0 200 ffffe38dfffe98c0 softbio/0
0 3 1 0 200 ffffe38dfffe9480 softnet/0
0 2 1 0 201 ffffe38dfffe9040 idle/0

0 0 2 0 240 ffffffff8673ee00 swapper
[Locks tracked through LWPs]

****** LWP 990.990 (syz-executor1266) @ 0xffffe38cdc9cd580, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)
lock address : ffffe38cdd081c40
type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffe38cdc9cd580 last held: 0xffffe38cdc9cd580
last locked* : netbsd:uvm_fault_internal+0x75d
unlocked : netbsd:uvm_fault_upper_enter+0x454
owner/count : 0xffffe38cdc9cd580 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffffe38cdb284f80
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffe38cdc9cd580 last held: 0xffffe38cdc9cd580
last locked* : netbsd:pmap_enter_ma+0x3c0
unlocked : netbsd:pmap_extract+0x2c8
owner field : 0xffffe38cdc9cd580 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

* Lock 2 (initialized at netbsd:pmap_ctor+0x9b sys/arch/x86/x86/pmap.c:2861)
lock address : ffffe38cdb284f88
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x9b

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffe38cdc9cd580 last held: 0xffffe38cdc9cd580
last locked* : netbsd:pmap_get_ptp+0x25e
unlocked : netbsd:pmap_get_ptp+0x6dc
owner/count : 0xffffe38cdc9cd580 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 813.813 (syz-executor1266) @ 0xffffe38cdc201540, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 uvm_map_setup sys/uvm/uvm_map.c:4772 [inline])
* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 uvmspace_init sys/uvm/uvm_map.c:4115 [inline])
* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 sys/uvm/uvm_map.c:4094)
lock address : ffffe38cdc6881c0
type : sleep/adaptive
initialized : netbsd:uvmspace_alloc+0x339

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffe38cdc201540 last held: 0xffffe38cdc201540
last locked* : netbsd:vm_map_lock+0x146
unlocked : netbsd:uvm_fault_internal+0x3949
owner/count : 0xffffe38cdc201540 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1243.1243 (syz-executor1266) @ 0xffffe38cdaa8f200, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffffe38cdbaec180
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 1
relevant lwp : 0xffffe38cdaa8f200 last held: 000000000000000000
last locked : netbsd:pmap_extract+0xdb
unlocked* : netbsd:pmap_extract+0x2c8
owner field : 0xffffe38cdaa8f200 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

****** LWP 742.742 (dhcpcd) @ 0xffffe38cdbaae040, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffffe38cdbaae040 last held: 000000000000000000