ASan: Unauthorized Access in wsmousedoioctl

1 view

Skip to first unread message

syzbot

unread,

Sep 9, 2020, 5:58:24 AM9/9/20

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 75502d1b Added the explain about locking order in iavf(4)
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=13a40cdd900000
kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=05e82a187a2eaefa60b1
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+05e82a...@syzkaller.appspotmail.com

[ 331.3939459] panic: ASan: Unauthorized Access In 0xffffffff815f74de: Addr 0xffff9a80138e6330 [8 bytes, read, PoolUseAfterFree]

[ 331.4116362] cpu0: Begin traceback...
[ 331.4739092] vpanic() at netbsd:vpanic+0x26f sys/kern/subr_prf.c:290
[ 331.5939100] snprintf() at netbsd:snprintf
[ 331.7239115] kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:186 [inline]
[ 331.7239115] kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:196
[ 331.8539105] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_4byte_isvalid sys/kern/subr_asan.c:346 [inline]
[ 331.8539105] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:360 [inline]
[ 331.8539105] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_check sys/kern/subr_asan.c:412 [inline]
[ 331.8539105] __asan_load8() at netbsd:__asan_load8+0x294 sys/kern/subr_asan.c:1199
[ 331.9839122] wsmousedoioctl() at netbsd:wsmousedoioctl+0x184 wsmouse_do_ioctl sys/dev/wscons/wsmouse.c:721 [inline]
[ 331.9839122] wsmousedoioctl() at netbsd:wsmousedoioctl+0x184 sys/dev/wscons/wsmouse.c:689
[ 332.1039112] cdev_ioctl() at netbsd:cdev_ioctl+0x145 sys/kern/subr_devsw.c:935
[ 332.2239154] spec_ioctl() at netbsd:spec_ioctl+0x20c sys/miscfs/specfs/spec_vnops.c:902
[ 332.3539134] VOP_IOCTL() at netbsd:VOP_IOCTL+0x15b sys/kern/vnode_if.c:646
[ 332.4839160] vn_ioctl() at netbsd:vn_ioctl+0x1e4 sys/kern/vfs_vnops.c:778
[ 332.6139128] sys_fcntl() at netbsd:sys_fcntl+0xb70 sys/kern/sys_descrip.c:482
[ 332.7339118] sys___syscall() at netbsd:sys___syscall+0xfe sy_call sys/sys/syscallvar.h:65 [inline]
[ 332.7339118] sys___syscall() at netbsd:sys___syscall+0xfe sys/kern/sys_syscall.c:77
[ 332.8539147] syscall() at netbsd:syscall+0x281 sy_call sys/sys/syscallvar.h:65 [inline]
[ 332.8539147] syscall() at netbsd:syscall+0x281 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 332.8539147] syscall() at netbsd:syscall+0x281 sys/arch/x86/x86/syscall.c:138
[ 332.8839137] --- syscall (number 198) ---
[ 332.9139131] netbsd:syscall+0x281:
[ 332.9261241] cpu0: End traceback...
[ 332.9261241] fatal breakpoint trap in supervisor mode
[ 332.9352119] trap type 1 code 0 rip 0xffffffff80220a1d cs 0x8 rflags 0x286 cr2 0x7ba3e6ab7ff8 ilevel 0 rsp 0xffff9a81937a0640
[ 332.9463892] curlwp 0xffff9a8014397a80 pid 2237.1444 lowest kstack 0xffff9a81937992c0
Stopped in pid 2237.1444 (syz-executor.5) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x26f sys/kern/subr_prf.c:290
snprintf() at netbsd:snprintf
kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:186 [inline]
kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:196
__asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_4byte_isvalid sys/kern/subr_asan.c:346 [inline]
__asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:360 [inline]
__asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_check sys/kern/subr_asan.c:412 [inline]
__asan_load8() at netbsd:__asan_load8+0x294 sys/kern/subr_asan.c:1199
wsmousedoioctl() at netbsd:wsmousedoioctl+0x184 wsmouse_do_ioctl sys/dev/wscons/wsmouse.c:721 [inline]
wsmousedoioctl() at netbsd:wsmousedoioctl+0x184 sys/dev/wscons/wsmouse.c:689
cdev_ioctl() at netbsd:cdev_ioctl+0x145 sys/kern/subr_devsw.c:935
spec_ioctl() at netbsd:spec_ioctl+0x20c sys/miscfs/specfs/spec_vnops.c:902
VOP_IOCTL() at netbsd:VOP_IOCTL+0x15b sys/kern/vnode_if.c:646
vn_ioctl() at netbsd:vn_ioctl+0x1e4 sys/kern/vfs_vnops.c:778
sys_fcntl() at netbsd:sys_fcntl+0xb70 sys/kern/sys_descrip.c:482
sys___syscall() at netbsd:sys___syscall+0xfe sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0xfe sys/kern/sys_syscall.c:77
syscall() at netbsd:syscall+0x281 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x281 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x281 sys/arch/x86/x86/syscall.c:138
--- syscall (number 198) ---
netbsd:syscall+0x281:
Panic string: ASan: Unauthorized Access In 0xffffffff815f74de: Addr 0xffff9a80138e6330 [8 bytes, read, PoolUseAfterFree]

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
2660 1478 3 0 80 ffff9a80127c7740 syz-executor.3 parked
2660 2660 2 0 10000000 ffff9a8012aa0740 syz-executor.3
2237 >1444 7 0 0 ffff9a8014397a80 syz-executor.5
2237 2354 3 0 80 ffff9a8012aa0b80 syz-executor.5 nanoslp
2237 2237 2 0 10000000 ffff9a8012c17580 syz-executor.5
2262 2022 3 1 80 ffff9a8013821a00 syz-executor.0 parked
2262 2235 3 1 80 ffff9a8012bd1940 syz-executor.0 parked
2262 2262 2 1 10040000 ffff9a80138c9300 syz-executor.0
2211 1354 2 1 40000 ffff9a80129fd6c0 syz-executor.2
2211 2211 2 1 10040000 ffff9a8012b09040 syz-executor.2
2222 2222 3 0 40080 ffff9a801379c100 syz-executor.2 parked
1877 1877 3 0 80 ffff9a8012d140c0 syz-executor.0 parked
2215 2215 3 0 80 ffff9a8013837600 syz-executor.0 parked
1836 1836 3 1 80 ffff9a8014491b00 syz-executor.4 parked
1498 1498 3 0 80 ffff9a8014442ac0 syz-executor.4 parked
1859 1859 3 1 80 ffff9a80144b5b80 syz-executor.3 parked
1716 1716 3 1 80 ffff9a80144a8b40 syz-executor.5 parked
1767 1767 3 0 80 ffff9a8014491280 syz-executor.3 parked
1584 1584 3 0 80 ffff9a80127c7300 syz-executor.5 parked
1535 1535 3 1 80 ffff9a80129cea80 syz-executor.5 parked
1620 1620 3 1 80 ffff9a80127c42c0 syz-executor.5 parked
954 954 3 0 80 ffff9a80144c5bc0 syz-executor.3 parked
1216 1216 2 1 40 ffff9a8014397200 syz-executor.5
1086 >1086 7 1 40 ffff9a801431fa40 syz-executor.4
1102 1102 2 0 40 ffff9a801431f600 syz-executor.2
1218 1218 2 0 40 ffff9a801431f1c0 syz-executor.3
1217 1217 2 1 40 ffff9a80141b0a00 syz-executor.1
1105 1105 2 1 40 ffff9a8012c56600 syz-executor.0
1065 416 2 1 40 ffff9a80141b05c0 syz-fuzzer
1065 939 3 0 80 ffff9a80141b0180 syz-fuzzer parked
1065 1064 3 1 80 ffff9a80138e1480 syz-fuzzer parked
1065 1081 3 1 80 ffff9a80138e1040 syz-fuzzer parked
1065 1107 3 1 80 ffff9a80140e89c0 syz-fuzzer parked
1065 1119 3 1 c0 ffff9a80140e8580 syz-fuzzer parked
1065 1080 3 1 c0 ffff9a80138d5bc0 syz-fuzzer parked
1065 1066 2 1 40 ffff9a8012ac3340 syz-fuzzer
1065 1065 3 0 80 ffff9a8012c3b5c0 syz-fuzzer parked
1075 1075 3 1 80 ffff9a8012c561c0 sshd select
1249 1249 3 0 80 ffff9a8012b2b900 getty nanoslp
1095 1095 3 0 80 ffff9a8012b2b4c0 getty nanoslp
1101 1101 3 1 80 ffff9a8012bd10c0 getty nanoslp
1092 1092 3 1 c0 ffff9a8012ac3780 getty ttyraw
949 949 3 1 80 ffff9a80138c9740 sshd select
975 975 3 0 80 ffff9a80137f79c0 powerd kqueue
685 685 3 1 80 ffff9a801386e280 syslogd kqueue
599 599 3 1 80 ffff9a8012cc1700 dhcpcd poll
736 736 3 0 80 ffff9a8012d2d140 dhcpcd poll
600 600 3 0 80 ffff9a8012cf68c0 dhcpcd poll
433 433 3 1 80 ffff9a8012cd2740 dhcpcd poll
350 350 3 0 80 ffff9a8012df4900 dhcpcd poll
349 349 3 1 80 ffff9a8012df44c0 dhcpcd poll
348 348 3 1 80 ffff9a8012df4080 dhcpcd poll
1 1 3 0 80 ffff9a80128cf140 init wait
0 1490 5 1 600 ffff9a801451a480 (zombie)
0 796 3 0 200 ffff9a80129fb240 physiod physiod
0 162 3 0 200 ffff9a80129fd280 pooldrain pooldrain
0 165 3 1 200 ffff9a80129fbac0 ioflush syncer
0 166 3 1 200 ffff9a80129fb680 pgdaemon pgdaemon
0 161 3 1 200 ffff9a80129ce640 usb7 usbevt
0 31 3 0 200 ffff9a80129ce200 usb6 usbevt
0 63 3 1 200 ffff9a8012981a40 usb5 usbevt
0 126 3 0 200 ffff9a8012981600 usb4 usbevt
0 125 3 0 200 ffff9a80129811c0 usb3 usbevt
0 124 3 0 200 ffff9a801292ea00 usb2 usbevt
0 123 3 1 200 ffff9a801292e5c0 usb1 usbevt
0 122 3 0 200 ffff9a801292e180 usb0 usbevt
0 121 3 0 200 ffff9a80128cf9c0 usbtask-dr usbtsk
0 120 3 0 200 ffff9a800fe35ac0 usbtask-hc usbtsk
0 119 3 1 200 ffff9a80128cf580 npfgc0 npfgcw
0 118 3 1 200 ffff9a80127fe980 rt_free rt_free
0 117 3 0 200 ffff9a80127fe540 unpgc unpgc
0 116 3 0 200 ffff9a80127fe100 key_timehandler key_timehandler
0 115 3 1 200 ffff9a80127f3940 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffff9a80127f3500 icmp6_wqinput/0 icmp6_wqinput
0 113 3 0 200 ffff9a80127f30c0 nd6_timer nd6_timer
0 112 3 1 200 ffff9a80127ea900 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffff9a80127ea4c0 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffff9a80127ea080 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffff9a80127da8c0 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffff9a80127da480 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffff9a80127da040 icmp_wqinput/0 icmp_wqinput
0 106 3 0 200 ffff9a80127c8340 rt_timer rt_timer
0 105 2 1 200 ffff9a80127c8bc0 vmem_rehash
0 104 3 0 200 ffff9a80127c8780 entbutler entropy
0 30 3 1 200 ffff9a801213b6c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffff9a801213b280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffff9a800fe35680 scsibus0 sccomp
0 26 3 0 200 ffff9a800fe35240 pms0 pmsreset
0 25 3 1 200 ffff9a800fd89a80 xcall/1 xcall
0 24 1 1 200 ffff9a800fd89640 softser/1
0 > 23 7 1 200 ffff9a800fd89200 softclk/1
0 22 1 1 200 ffff9a800fd87a40 softbio/1
0 21 1 1 200 ffff9a800fd87600 softnet/1
0 20 1 1 201 ffff9a800fd871c0 idle/1
0 19 3 0 200 ffff9a800e7f9a00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffff9a800e7f95c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffff9a800e7f9180 lnxsyswq lnxsyswq
0 16 3 0 200 ffff9a800e7f19c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffff9a800e7f1580 sysmon smtaskq
0 14 3 0 200 ffff9a800e7f1140 pmfsuspend pmfsuspend
0 13 3 0 200 ffff9a800e7ed980 pmfevent pmfevent
0 12 3 0 200 ffff9a800e7ed540 sopendfree sopendfr
0 11 3 1 200 ffff9a800e7ed100 iflnkst iflnkst
0 10 3 0 200 ffff9a800e7e1940 nfssilly nfssilly
0 9 3 0 200 ffff9a800e7e1500 vdrain vdrain
0 8 3 0 200 ffff9a800e7e10c0 modunload mod_unld
0 7 3 0 200 ffff9a800e7d4900 xcall/0 xcall
0 6 1 0 200 ffff9a800e7d44c0 softser/0
0 5 3 0 200 ffff9a800e7d4080 softclk/0 tstile
0 4 1 0 200 ffff9a800e7d28c0 softbio/0
0 3 1 0 200 ffff9a800e7d2480 softnet/0
0 2 1 0 201 ffff9a800e7d2040 idle/0
0 0 3 1 200 ffffffff82ee8400 swapper uvm
[Locks tracked through LWPs]

****** LWP 2211.1354 (syz-executor.2) @ 0xffff9a80129fd6c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at vhci_attach)
lock address : 0xffff9a80127266d8 type : sleep/adaptive
initialized : 0xffffffff80b99e44
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff9a80129fd6c0 last held: 0xffff9a80129fd6c0
last locked* : 0xffffffff80b9be6a unlocked : 0xffffffff80b9c1b1
owner field : 0xffff9a80129fd6c0 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1086.1086 (syz-executor.4) @ 0xffff9a801431fa40, l_stat=7

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffff9a8014389280 type : sleep/adaptive
initialized : 0xffffffff81a7715c
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff9a801431fa40 last held: 0xffff9a801431fa40
last locked* : 0xffffffff81aaac42 unlocked : 0xffffffff81aaaca4
owner/count : 0xffff9a801431fa40 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at vcache_alloc)
lock address : 0xffff9a8014389a00 type : sleep/adaptive
initialized : 0xffffffff81a7715c
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff9a801431fa40 last held: 0xffff9a801431fa40
last locked* : 0xffffffff81aaac42 unlocked : 0xffffffff81aaaca4
owner/count : 0xffff9a801431fa40 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1217.1217 (syz-executor.1) @ 0xffff9a80141b0a00, l_stat=2

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffff9a80141b2ec0 type : sleep/adaptive
initialized : 0xffffffff81a7715c
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff9a80141b0a00 last held: 0xffff9a80141b0a00
last locked* : 0xffffffff81aaac42 unlocked : 0xffffffff81aaaca4
owner/count : 0xffff9a80141b0a00 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 736.736 (dhcpcd) @ 0xffff9a8012d2d140, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82feec80 type : sleep/adaptive
initialized : 0xffffffff818fa065
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9a8012d2d140 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 600.600 (dhcpcd) @ 0xffff9a8012cf68c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82feec80 type : sleep/adaptive
initialized : 0xffffffff818fa065
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9a8012cf68c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 349.349 (dhcpcd) @ 0xffff9a8012df44c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82feec80 type : sleep/adaptive
initialized : 0xffffffff818fa065
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff9a8012df44c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 348.348 (dhcpcd) @ 0xffff9a8012df4080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82feec80 type : sleep/adaptive
initialized : 0xffffffff818fa065
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff9a8012df4080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffff9a800e7ed100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82feec80 type : sleep/adaptive
initialized : 0xffffffff818fa065
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff9a800e7ed100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffff9a800e7d4080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82feec80 type : sleep/adaptive
initialized : 0xffffffff818fa065
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9a800e7d4080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at main)
lock address : 0xffffffff82feeb80 type : spin
initialized : 0xffffffff81cae7b2
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9a8014397a80 last held: 0xffff9a8014397a80
last locked* : 0xffffffff8197d011 unlocked : 0xffffffff813a0680
curcpu holds : 1 wanted by: 000000000000000000

******* Locks held on cpu1:

* Lock 0 (initialized at sched_cpuattach)
lock address : 0xffff9a800e71e380 type : spin
initialized : 0xffffffff8191ad67
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff9a800fd89200 last held: 0xffff9a80138c9300
last locked* : 0xffffffff819358c0 unlocked : 0xffffffff8191c5df
owner field : 0x0000000000000700 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffff9a8000017180 0041 00000000 0x0 0x0
0xffff9a8000017200 0001 00000000 0x0 0x0
0xffff9a8000017280 0001 00000000 0x0 0x0
0xffff9a8000017300 0001 00000000 0x0 0x0
0xffff9a8000017380 0001 00000000 0x0 0x0
0xffff9a8000017400 0001 00000000 0x0 0x0
0xffff9a8000017480 0001 00000000 0x0 0x0
0xffff9a8000017500 0001 00000000 0x0 0x0
0xffff9a8000017580 0001 00000000 0x0 0x0
0xffff9a8000017600 0001 00000000 0x0 0x0
0xffff9a8000017680 0001 00000000 0x0 0x0
0xffff9a8000017700 0001 00000000 0x0 0x0
0xffff9a8000017780 0001 00000000 0x0 0x0
0xffff9a8000017800 0001 00000000 0x0 0x0
0xffff9a8000017880 0001 00000000 0x0 0x0
0xffff9a8000017900 0001 00000000 0x0 0x0
0xffff9a8000017980 0001 00000000 0x0 0x0
0xffff9a8000017a00 0001 00000000 0x0 0x0
0xffff9a8000017a80 0001 00000000 0x0 0x0
0xffff9a8000017b00 0001 00000000 0x0 0x0
0xffff9a8000017b80 0001 00000000 0x0 0x0
0xffff9a8000017c00 0001 00000000 0x0 0x0
0xffff9a8000017c80 0001 00000000 0x0 0x0
0xffff9a8000017d00 0001 00000000 0x0 0x0
0xffff9a8000017d80 0001 00000000 0x0 0x0
0xffff9a8000017e00 0001 00000000 0x0 0x0
0xffff9a8000017e80 0001 00000000 0x0 0x0
0xffff9a8000017f00 0001 00000000 0x0 0x0
0xffff9a8000017f80 0001 00000000 0x0 0x0
0xffff9a8000018000 0001 00000000 0x0 0x0
0xffff9a8000018080 0001 00000000 0x0 0x0
0xffff9a8000018100 0001 00000000 0x0 0x0
0xffff9a8000018180 0001 00000000 0x0 0x0
0xffff9a8000018200 0001 00000000 0x0 0x0
0xffff9a8000018280 0001 00000000 0x0 0x0
0xffff9a8000018300 0001 00000000 0x0 0x0
0xffff9a8000018380 0001 00000000 0x0 0x0
0xffff9a8000018400 0001 00000000 0x0 0x0
0xffff9a8000018480 0001 00000000 0x0 0x0
0xffff9a8000018500 0001 00000000 0x0 0x0
0xffff9a8000018580 0001 00000000 0x0 0x0
0xffff9a8000018600 0001 00000000 0x0 0x0
0xffff9a8000018680 0001 00000000 0x0 0x0
0xffff9a8000018700 0001 00000000 0x0 0x0
0xffff9a8000018780 0001 00000000 0x0 0x0
0xffff9a8000018800 0001 00000000 0x0 0x0
0xffff9a8000018880 0001 00000000 0x0 0x0
0xffff9a8000018900 0001 00000000 0x0 0x0
0xffff9a8000018980 0001 00000000 0x0 0x0
0xffff9a8000018a00 0001 00000000 0x0 0x0
0xffff9a8000018a80 0001 00000000 0x0 0x0
0xffff9a8000018b00 0001 00000000 0x0 0x0
0xffff9a8000018b80 0001 00000000 0x0 0x0
0xffff9a8000018c00 0001 00000000 0x0 0x0
0xffff9a8000018c80 0001 00000000 0x0 0x0
0xffff9a8000018d00 0001 00000000 0x0 0x0
0xffff9a8000018d80 0001 00000000 0x0 0x0
0xffff9a8000018e00 0001 00000000 0x0 0x0
0xffff9a8000018e80 0001 00000000 0x0 0x0
0xffff9a8000018f00 0001 00000000 0x0 0x0
0xffff9a8000018f80 0001 00000000 0x0 0x0
0xffff9a8000019000 0001 00000000 0x0 0x0
0xffff9a8000019080 0001 00000000 0x0 0x0
0xffff9a8000019100 0001 00000000 0x0 0x0
0xffff9a8000019180 0001 00000000 0x0 0x0
0xffff9a8000019200 0001 00000000 0x0 0x0
0xffff9a8000019280 0001 00000000 0x0 0x0
0xffff9a8000019300 0001 00000000 0x0 0x0
0xffff9a8000019380 0001 00000000 0x0 0x0
0xffff9a8000019400 0001 00000000 0x0 0x0
0xffff9a8000019480 0001 00000000 0x0 0x0
0xffff9a8000019500 0001 00000000 0x0 0x0
0xffff9a8000019580 0001 00000000 0x0 0x0
0xffff9a8000019600 0001 00000000 0x0 0x0
0xffff9a8000019680 0001 00000000 0x0 0x0
0xffff9a8000019700 0001 00000000 0x0 0x0
0xffff9a8000019780 0001 00000000 0x0 0x0
0xffff9a8000019800 0001 00000000 0x0 0x0
0xffff9a8000019880 0001 00000000 0x0 0x0
0xffff9a8000019900 0001 00000000 0x0 0x0
0xffff9a8000019980 0001 00000000 0x0 0x0
0xffff9a8000019a00 0001 00000000 0x0 0x0
0xffff9a8000019a80 0001 00000000 0x0 0x0
0xffff9a8000019b00 0001 00000000 0x0 0x0
0xffff9a8000019b80 0001 00000000 0x0 0x0
0xffff9a8000019c00 0001 00000000 0x0 0x0
0xffff9a8000019c80 0001 00000000 0x0 0x0
0xffff9a8000019d00 0001 00000000 0x0 0x0
0xffff9a8000019d80 0001 00000000 0x0 0x0
0xffff9a8000019e00 0001 00000000 0x0 0x0
0xffff9a8000019e80 0001 00000000 0x0 0x0
0xffff9a8000019f00 0001 00000000 0x0 0x0
0xffff9a8000019f80 0001 00000000 0x0 0x0
0xffff9a800001a000 0001 00000000 0x0 0x0
0xffff9a800001a080 0001 00000000 0x0 0x0
0xffff9a800001a100 0001 00000000 0x0 0x0
0xffff9a800001a180 0001 00000000 0x0 0x0
0xffff9a800001a200 0001 00000000 0x0 0x0
0xffff9a800001a280 0001 00000000 0x0 0x0
0xffff9a800001a300 0001 00000000 0x0 0x0
0xffff9a800001a380 0001 00000000 0x0 0x0
0xffff9a800001a400 0001 00000000 0x0 0x0
0xffff9a800001a480 0001 00000000 0x0 0x0
0xffff9a800001a500 0001 00000000 0x0 0x0
0xffff9a800001a580 0001 00000000 0x0 0x0
0xffff9a800001a600 0001 00000000 0x0 0x0
0xffff9a800001a680 0001 00000000 0x0 0x0
0xffff9a800001a700 0001 00000000 0x0 0x0
0xffff9a800001a780 0001 00000000 0x0 0x0
0xffff9a800001a800 0001 00000000 0x0 0x0
0xffff9a800001a880 0001 00000000 0x0 0x0
0xffff9a800001a900 0001 00000000 0x0 0x0
0xffff9a800001a980 0001 00000000 0x0 0x0
0xffff9a800001aa00 0001 00000000 0x0 0x0
0xffff9a800001aa80 0001 00000000 0x0 0x0
0xffff9a800001ab00 0001 00000000 0x0 0x0
0xffff9a800001ab80 0001 00000000 0x0 0x0
0xffff9a800001ac00 0001 00000000 0x0 0x0
0xffff9a800001ac80 0001 00000000 0x0 0x0
0xffff9a800001ad00 0001 00000000 0x0 0x0
0xffff9a800001ad80 0001 00000000 0x0 0x0
0xffff9a800001ae00 0001 00000000 0x0 0x0
0xffff9a800001ae80 0001 00000000 0x0 0x0
0xffff9a800001af00 0001 00000000 0x0 0x0
0xffff9a800001af80 0001 00000000 0x0 0x0
0xffff9a800001b000 0001 00000000 0x0 0x0
0xffff9a800001b080 0001 00000000 0x0 0x0
0xffff9a800001b100 0001 00000000 0x0 0x0
0xffff9a800001b180 0001 00000000 0x0 0x0
0xffff9a800001b200 0001 00000000 0x0 0x0
0xffff9a800001b280 0001 00000000 0x0 0x0
0xffff9a800001b300 0001 00000000 0x0 0x0
0xffff9a800001b380 0001 00000000 0x0 0x0
0xffff9a800001b400 0001 00000000 0x0 0x0
0xffff9a800001b480 0001 00000000 0x0 0x0
0xffff9a800001b500 0001 00000000 0x0 0x0
0xffff9a800001b580 0001 00000000 0x0 0x0
0xffff9a800001b600 0001 00000000 0x0 0x0
0xffff9a800001b680 0001 00000000 0x0 0x0
0xffff9a800001b700 0001 00000000 0x0 0x0
0xffff9a800001b780 0001 00000000 0x0 0x0
0xffff9a800001b800 0001 00000000 0x0 0x0
0xffff9a800001b880 0001 00000000 0x0 0x0
0xffff9a800001b900 0001 00000000 0x0 0x0
0xffff9a800001b980 0001 00000000 0x0 0x0
0xffff9a800001ba00 0001 00000000 0x0 0x0
0xffff9a800001ba80 0001 00000000 0x0 0x0
0xffff9a800001bb00 0001 00000000 0x0 0x0
0xffff9a800001bb80 0001 00000000 0x0 0x0
0xffff9a800001bc00 0001 00000000 0x0 0x0
0xffff9a800001bc80 0001 00000000 0x0 0x0
0xffff9a800001bd00 0001 00000000 0x0 0x0
0xffff9a800001bd80 0001 00000000 0x0 0x0
0xffff9a800001be00 0001 00000000 0x0 0x0
0xffff9a800001be80 0001 00000000 0x0 0x0
0xffff9a800001bf00 0001 00000000 0x0 0x0
0xffff9a800001bf80 0001 00000000 0x0 0x0
0xffff9a800001c000 0001 00000000 0x0 0x0
0xffff9a800001c080 0001 00000000 0x0 0x0
0xffff9a800001c100 0001 00000000 0x0 0x0
0xffff9a800001c180 0001 00000000 0x0 0x0
0xffff9a800001c200 0001 00000000 0x0 0x0
0xffff9a800001c280 0001 00000000 0x0 0x0
0xffff9a800001c300 0001 00000000 0x0 0x0
0xffff9a800001c380 0001 00000000 0x0 0x0
0xffff9a800001c400 0001 00000000 0x0 0x0
0xffff9a800001c480 0001 00000000 0x0 0x0
0xffff9a800001c500 0001 00000000 0x0 0x0
0xffff9a800001c580 0001 00000000 0x0 0x0
0xffff9a800001c600 0001 00000000 0x0 0x0
0xffff9a800001c680 0001 00000000 0x0 0x0
0xffff9a800001c700 0001 00000000 0x0 0x0
0xffff9a800001c780 0001 00000000 0x0 0x0
0xffff9a800001c800 0001 00000000 0x0 0x0
0xffff9a800001c880 0001 00000000 0x0 0x0
0xffff9a800001c900 0001 00000000 0x0 0x0
0xffff9a800001c980 0001 00000000 0x0 0x0
0xffff9a800001ca00 0001 00000000 0x0 0x0
0xffff9a800001ca80 0001 00000000 0x0 0x0
0xffff9a800001cb00 0001 00000000 0x0 0x0
0xffff9a800001cb80 0001 00000000 0x0 0x0
0xffff9a800001cc00 0001 00000000 0x0 0x0
0xffff9a800001cc80 0001 00000000 0x0 0x0
0xffff9a800001cd00 0001 00000000 0x0 0x0
0xffff9a800001cd80 0001 00000000 0x0 0x0
0xffff9a800001ce00 0001 00000000 0x0 0x0
0xffff9a800001ce80 0001 00000000 0x0 0x0
0xffff9a800001cf00 0001 00000000 0x0 0x0
0xffff9a800001cf80 0001 00000000 0x0 0x0
0xffff9a800001d000 0001 00000000 0x0 0x0
0xffff9a800001d080 0001 00000000 0x0 0x0
0xffff9a800001d100 0001 00000000 0x0 0x0
0xffff9a800001d180 0001 00000000 0x0 0x0
0xffff9a800001d200 0001 00000000 0x0 0x0
0xffff9a800001d280 0001 00000000 0x0 0x0
0xffff9a800001d300 0001 00000000 0x0 0x0
0xffff9a800001d380 0001 00000000 0x0 0x0
0xffff9a800001d400 0001 00000000 0x0 0x0
0xffff9a800001d480 0001 00000000 0x0 0x0
0xffff9a800001d500 0001 00000000 0x0 0x0
0xffff9a800001d580 0001 00000000 0x0 0x0
0xffff9a800001d600 0001 00000000 0x0 0x0
0xffff9a800001d680 0001 00000000 0x0 0x0
0xffff9a800001d700 0001 00000000 0x0 0x0
0xffff9a800001d780 0001 00000000 0x0 0x0
0xffff9a800001d800 0001 00000000 0x0 0x0
0xffff9a800001d880 0001 00000000 0x0 0x0
0xffff9a800001d900 0001 00000000 0x0 0x0
0xffff9a800001d980 0001 00000000 0x0 0x0
0xffff9a800001da00 0001 00000000 0x0 0x0
0xffff9a800001da80 0001 00000000 0x0 0x0
0xffff9a800001db00 0001 00000000 0x0 0x0
0xffff9a800001db80 0001 00000000 0x0 0x0
0xffff9a800001dc00 0001 00000000 0x0 0x0
0xffff9a800001dc80 0001 00000000 0x0 0x0
0xffff9a800001dd00 0001 00000000 0x0 0x0
0xffff9a800001dd80 0001 00000000 0x0 0x0
0xffff9a800001de00 0001 00000000 0x0 0x0
0xffff9a800001de80 0001 00000000 0x0 0x0
0xffff9a800001df00 0001 00000000 0x0 0x0
0xffff9a800001df80 0001 00000000 0x0 0x0
0xffff9a800001e000 0001 00000000 0x0 0x0
0xffff9a800001e080 0001 00000000 0x0 0x0
0xffff9a800001e100 0001 00000000 0x0 0x0
0xffff9a800001e180 0001 00000000 0x0 0x0
0xffff9a800001e200 0001 00000000 0x0 0x0
0xffff9a800001e280 0001 00000000 0x0 0x0
0xffff9a800001e300 0001 00000000 0x0 0x0
0xffff9a800001e380 0001 00000000 0x0 0x0
0xffff9a800001e400 0001 00000000 0x0 0x0
0xffff9a800001e480 0001 00000000 0x0 0x0
0xffff9a800001e500 0001 00000000 0x0 0x0
0xffff9a800001e580 0001 00000000 0x0 0x0
0xffff9a800001e600 0001 00000000 0x0 0x0
0xffff9a800001e680 0001 00000000 0x0 0x0
0xffff9a800001e700 0001 00000000 0x0 0x0
0xffff9a800001e780 0001 00000000 0x0 0x0
0xffff9a800001e800 0001 00000000 0x0 0x0
0xffff9a800001e880 0001 00000000 0x0 0x0
0xffff9a800001e900 0001 00000000 0x0 0x0
0xffff9a800001e980 0001 00000000 0x0 0x0
0xffff9a800001ea00 0001 00000000 0x0 0x0
0xffff9a800001ea80 0001 00000000 0x0 0x0
0xffff9a800001eb00 0001 00000000 0x0 0x0
0xffff9a800001eb80 0001 00000000 0x0 0x0
0xffff9a800001ec00 0001 00000000 0x0 0x0
0xffff9a800001ec80 0001 00000000 0x0 0x0
0xffff9a800001ed00 0001 00000000 0x0 0x0
0xffff9a800001ed80 0001 00000000 0x0 0x0
0xffff9a800001ee00 0001 00000000 0x0 0x0
0xffff9a800001ee80 0001 00000000 0x0 0x0
0xffff9a800001ef00 0001 00000000 0x0 0x0
0xffff9a800001ef80 0001 00000000 0x0 0x0
0xffff9a800001f000 0001 00000000 0x0 0x0
0xffff9a800001f080 0001 00000000 0x0 0x0
0xffff9a800001f100 0001 00000000 0x0 0x0
0xffff9a800001f180 0001 00000000 0x0 0x0
0xffff9a800001f200 0001 00000000 0x0 0x0
0xffff9a800001f280 0001 00000000 0x0 0x0
0xffff9a800001f300 0001 00000000 0x0 0x0
0xffff9a800001f380 0001 00000000 0x0 0x0
0xffff9a800001f400 0001 00000000 0x0 0x0
0xffff9a800001f480 0001 00000000 0x0 0x0
0xffff9a800001f500 0001 00000000 0x0 0x0
0xffff9a800001f580 0001 00000000 0x0 0x0
0xffff9a800001f600 0001 00000000 0x0 0x0
0xffff9a800001f680 0001 00000000 0x0 0x0
0xffff9a800001f700 0001 00000000 0x0 0x0
0xffff9a800001f780 0001 00000000 0x0 0x0
0xffff9a800001f800 0001 00000000 0x0 0x0
0xffff9a800001f880 0001 00000000 0x0 0x0
0xffff9a800001f900 0001 00000000 0x0 0x0
0xffff9a800001f980 0001 00000000 0x0 0x0
0xffff9a800001fa00 0001 00000000 0x0 0x0
0xffff9a800001fa80 0001 00000000 0x0 0x0
0xffff9a800001fb00 0001 00000000 0x0 0x0
0xffff9a800001fb80 0001 00000000 0x0 0x0
0xffff9a800001fc00 0001 00000000 0x0 0x0
0xffff9a800001fc80 0001 00000000 0x0 0x0
0xffff9a800001fd00 0001 00000000 0x0 0x0
0xffff9a800001fd80 0001 00000000 0x0 0x0
0xffff9a800001fe00 0001 00000000 0x0 0x0
0xffff9a800001fe80 0001 00000000 0x0 0x0
0xffff9a800001ff00 0001 00000000 0x0 0x0
0xffff9a800001ff80 0001 00000000 0x0 0x0
0xffff9a8000020000 0001 00000000 0x0 0x0
0xffff9a8000020080 0001 00000000 0x0 0x0
0xffff9a8000020100 0001 00000000 0x0 0x0
0xffff9a8000020180 0001 00000000 0x0 0x0
0xffff9a8000020200 0001 00000000 0x0 0x0
0xffff9a8000020280 0001 00000000 0x0 0x0
0xffff9a8000020300 0001 00000000 0x0 0x0
0xffff9a8000020380 0001 00000000 0x0 0x0
0xffff9a8000020400 0001 00000000 0x0 0x0
0xffff9a8000020480 0001 00000000 0x0 0x0
0xffff9a8000020500 0001 00000000 0x0 0x0
0xffff9a8000020580 0001 00000000 0x0 0x0
0xffff9a8000020600 0001 00000000 0x0 0x0
0xffff9a8000020680 0001 00000000 0x0 0x0
0xffff9a8000020700 0001 00000000 0x0 0x0
0xffff9a8000020780 0001 00000000 0x0 0x0
0xffff9a8000020800 0001 00000000 0x0 0x0
0xffff9a8000020880 0001 00000000 0x0 0x0
0xffff9a8000020900 0001 00000000 0x0 0x0
0xffff9a8000020980 0001 00000000 0x0 0x0
0xffff9a8000020a00 0001 00000000 0x0 0x0
0xffff9a8000020a80 0001 00000000 0x0 0x0
0xffff9a8000020b00 0001 00000000 0x0 0x0
0xffff9a8000020b80 0001 00000000 0x0 0x0
0xffff9a8000020c00 0001 00000000 0x0 0x0
0xffff9a8000020c80 0001 00000000 0x0 0x0
0xffff9a8000020d00 0001 00000000 0x0 0x0
0xffff9a8000020d80 0001 00000000 0x0 0x0
0xffff9a8000020e00 0001 00000000 0x0 0x0
0xffff9a8000020e80 0001 00000000 0x0 0x0
0xffff9a8000020f00 0001 00000000 0x0 0x0
0xffff9a8000020f80 0001 00000000 0x0 0x0
0xffff9a8000021000 0001 00000000 0x0 0x0
0xffff9a8000021080 0001 00000000 0x0 0x0
0xffff9a8000021100 0001 00000000 0x0 0x0
0xffff9a8000021180 0001 00000000 0x0 0x0
0xffff9a8000021200 0001 00000000 0x0 0x0
0xffff9a8000021280 0001 00000000 0x0 0x0
0xffff9a8000021300 0001 00000000 0x0 0x0
0xffff9a8000021380 0001 00000000 0x0 0x0
0xffff9a8000021400 0001 00000000 0x0 0x0
0xffff9a8000021480 0001 00000000 0x0 0x0
0xffff9a8000021500 0001 00000000 0x0 0x0
0xffff9a8000021580 0001 00000000 0x0 0x0
0xffff9a8000021600 0001 00000000 0x0 0x0
0xffff9a8000021680 0001 00000000 0x0 0x0
0xffff9a8000021700 0001 00000000 0x0 0x0
0xffff9a8000021780 0001 00000000 0x0 0x0
0xffff9a8000021800 0001 00000000 0x0 0x0
0xffff9a8000021880 0001 00000000 0x0 0x0
0xffff9a8000021900 0001 00000000 0x0 0x0
0xffff9a8000021980 0001 00000000 0x0 0x0
0xffff9a8000021a00 0001 00000000 0x0 0x0
0xffff9a8000021a80 0001 00000000 0x0 0x0
0xffff9a8000021b00 0001 00000000 0x0 0x0
0xffff9a8000021b80 0001 00000000 0x0 0x0
0xffff9a8000021c00 0001 00000000 0x0 0x0
0xffff9a8000021c80 0001 00000000 0x0 0x0
0xffff9a8000021d00 0001 00000000 0x0 0x0
0xffff9a8000021d80 0001 00000000 0x0 0x0
0xffff9a8000021e00 0001 00000000 0x0 0x0
0xffff9a8000021e80 0001 00000000 0x0 0x0
0xffff9a8000021f00 0001 00000000 0x0 0x0
0xffff9a8000021f80 0001 00000000 0x0 0x0
0xffff9a8000022000 0001 00000000 0x0 0x0
0xffff9a8000022080 0001 00000000 0x0 0x0
0xffff9a8000022100 0001 00000000 0x0 0x0
0xffff9a8000022180 0001 00000000 0x0 0x0
0xffff9a8000022200 0001 00000000 0x0 0x0
0xffff9a8000022280 0001 00000000 0x0 0x0
0xffff9a8000022300 0001 00000000 0x0 0x0
0xffff9a8000022380 0001 00000000 0x0 0x0
0xffff9a8000022400 0001 00000000 0x0 0x0
0xffff9a8000022480 0001 00000000 0x0 0x0
0xffff9a8000022500 0001 00000000 0x0 0x0
0xffff9a8000022580 0001 00000000 0x0 0x0
0xffff9a8000022600 0001 00000000 0x0 0x0
0xffff9a8000022680 0001 00000000 0x0 0x0
0xffff9a8000022700 0001 00000000 0x0 0x0
0xffff9a8000022780 0001 00000000 0x0 0x0
0xffff9a8000022800 0001 00000000 0x0 0x0
0xffff9a8000022880 0001 00000000 0x0 0x0
0xffff9a8000022900 0001 00000000 0x0 0x0
0xffff9a8000022980 0001 00000000 0x0 0x0
0xffff9a8000022a00 0001 00000000 0x0 0x0
0xffff9a8000022a80 0001 00000000 0x0 0x0
0xffff9a8000022b00 0001 00000000 0x0 0x0
0xffff9a8000022b80 0001 00000000 0x0 0x0
0xffff9a8000022c00 0001 00000000 0x0 0x0
0xffff9a8000022c80 0001 00000000 0x0 0x0
0xffff9a8000022d00 0001 00000000 0x0 0x0
0xffff9a8000022d80 0001 00000000 0x0 0x0
0xffff9a8000022e00 0001 00000000 0x0 0x0
0xffff9a8000022e80 0001 00000000 0x0 0x0
0xffff9a8000022f00 0001 00000000 0x0 0x0
0xffff9a8000022f80 0001 00000000 0x0 0x0
0xffff9a8000023000 0001 00000000 0x0 0x0
0xffff9a8000023080 0001 00000000 0x0 0x0
0xffff9a8000023100 0001 00000000 0x0 0x0
0xffff9a8000023180 0001 00000000 0x0 0x0
0xffff9a8000023200 0001 00000000 0x0 0x0
0xffff9a8000023280 0001 00000000 0x0 0x0
0xffff9a8000023300 0001 00000000 0x0 0x0
0xffff9a8000023380 0001 00000000 0x0 0x0
0xffff9a8000023400 0001 00000000 0x0 0x0
0xffff9a8000023480 0001 00000000 0x0 0x0
0xffff9a8000023500 0001 00000000 0x0 0x0
0xffff9a8000023580 0001 00000000 0x0 0x0
0xffff9a8000023600 0001 00000000 0x0 0x0
0xffff9a8000023680 0001 00000000 0x0 0x0
0xffff9a8000023700 0001 00000000 0x0 0x0
0xffff9a8000023780 0001 00000000 0x0 0x0
0xffff9a8000023800 0001 00000000 0x0 0x0
0xffff9a8000023880 0001 00000000 0x0 0x0
0xffff9a8000023900 0001 00000000 0x0 0x0
0xffff9a8000023980 0001 00000000 0x0 0x0
0xffff9a8000023a00 0001 00000000 0x0 0x0
0xffff9a8000023a80 0001 00000000 0x0 0x0
0xffff9a8000023b00 0001 00000000 0x0 0x0
0xffff9a8000023b80 0001 00000000 0x0 0x0
0xffff9a8000023c00 0001 00000000 0x0 0x0
0xffff9a8000023c80 0001 00000000 0x0 0x0
0xffff9a8000023d00 0001 00000000 0x0 0x0
0xffff9a8000023d80 0001 00000000 0x0 0x0
0xffff9a8000023e00 0001 00000000 0x0 0x0
0xffff9a8000023e80 0001 00000000 0x0 0x0
0xffff9a8000023f00 0001 00000000 0x0 0x0
0xffff9a8000023f80 0001 00000000 0x0 0x0
0xffff9a8000024000 0001 00000000 0x0 0x0
0xffff9a8000024080 0001 00000000 0x0 0x0
0xffff9a8000024100 0001 00000000 0x0 0x0
0xffff9a8000024180 0001 00000000 0x0 0x0
0xffff9a8000024200 0001 00000000 0x0 0x0
0xffff9a8000024280 0001 00000000 0x0 0x0
0xffff9a8000024300 0001 00000000 0x0 0x0
0xffff9a8000024380 0001 00000000 0x0 0x0
0xffff9a8000024400 0001 00000000 0x0 0x0
0xffff9a8000024480 0001 00000000 0x0 0x0
0xffff9a8000024500 0001 00000000 0x0 0x0
0xffff9a8000024580 0001 00000000 0x0 0x0
0xffff9a8000024600 0001 00000000 0x0 0x0
0xffff9a8000024680 0001 00000000 0x0 0x0
0xffff9a8000024700 0001 00000000 0x0 0x0
0xffff9a8000024780 0001 00000000 0x0 0x0
0xffff9a8000024800 0001 00000000 0x0 0x0
0xffff9a8000024880 0001 00000000 0x0 0x0
0xffff9a8000024900 0001 00000000 0x0 0x0
0xffff9a8000024980 0001 00000000 0x0 0x0
0xffff9a8000024a00 0001 00000000 0x0 0x0
0xffff9a8000024a80 0001 00000000 0x0 0x0
0xffff9a8000024b00 0001 00000000 0x0 0x0
0xffff9a8000024b80 0001 00000000 0x0 0x0
0xffff9a8000024c00 0001 00000000 0x0 0x0
0xffff9a8000024c80 0001 00000000 0x0 0x0
0xffff9a8000024d00 0001 00000000 0x0 0x0
0xffff9a8000024d80 0001 00000000 0x0 0x0
0xffff9a8000024e00 0001 00000000 0x0 0x0
0xffff9a8000024e80 0001 00000000 0x0 0x0
0xffff9a8000024f00 0001 00000000 0x0 0x0
0xffff9a8000024f80 0001 00000000 0x0 0x0
0xffff9a8000025000 0001 00000000 0x0 0x0
0xffff9a8000025080 0001 00000000 0x0 0x0
0xffff9a8000025100 0001 00000000 0x0 0x0
0xffff9a8000025180 0001 00000000 0x0 0x0
0xffff9a8000025200 0001 00000000 0x0 0x0
0xffff9a8000025280 0001 00000000 0x0 0x0
0xffff9a8000025300 0001 00000000 0x0 0x0
0xffff9a8000025380 0001 00000000 0x0 0x0
0xffff9a8000025400 0001 00000000 0x0 0x0
0xffff9a8000025480 0001 00000000 0x0 0x0
0xffff9a8000025500 0001 00000000 0x0 0x0
0xffff9a8000025580 0001 00000000 0x0 0x0
0xffff9a8000025600 0001 00000000 0x0 0x0
0xffff9a8000025680 0001 00000000 0x0 0x0
0xffff9a8000025700 0001 00000000 0x0 0x0
0xffff9a8000025780 0001 00000000 0x0 0x0
0xffff9a8000025800 0001 00000000 0x0 0x0
0xffff9a8000025880 0001 00000000 0x0 0x0
0xffff9a8000025900 0001 00000000 0x0 0x0
0xffff9a8000025980 0001 00000000 0x0 0x0
0xffff9a8000025a00 0001 00000000 0x0 0x0
0xffff9a8000025a80 0001 00000000 0x0 0x0
0xffff9a8000025b00 0001 00000000 0x0 0x0
0xffff9a8000025b80 0001 00000000 0x0 0x0
0xffff9a8000025c00 0001 00000000 0x0 0x0
0xffff9a8000025c80 0001 00000000 0x0 0x0
0xffff9a8000025d00 0001 00000000 0x0 0x0
0xffff9a8000025d80 0001 00000000 0x0 0x0
0xffff9a8000025e00 0001 00000000 0x0 0x0
0xffff9a8000025e80 0001 00000000 0x0 0x0
0xffff9a8000025f00 0001 00000000 0x0 0x0
0xffff9a8000025f80 0001 00000000 0x0 0x0
0xffff9a8000026000 0001 00000000 0x0 0x0
0xffff9a8000026080 0001 00000000 0x0 0x0
0xffff9a8000026100 0001 00000000 0x0 0x0
0xffff9a8000026180 0001 00000000 0x0 0x0
0xffff9a8000026200 0001 00000000 0x0 0x0
0xffff9a8000026280 0001 00000000 0x0 0x0
0xffff9a8000026300 0001 00000000 0x0 0x0
0xffff9a8000026380 0001 00000000 0x0 0x0
0xffff9a8000026400 0001 00000000 0x0 0x0
0xffff9a8000026480 0001 00000000 0x0 0x0
0xffff9a8000026500 0001 00000000 0x0 0x0
0xffff9a8000026580 0001 00000000 0x0 0x0
0xffff9a8000026600 0001 00000000 0x0 0x0
0xffff9a8000026680 0001 00000000 0x0 0x0
0xffff9a8000026700 0001 00000000 0x0 0x0
0xffff9a8000026780 0001 00000000 0x0 0x0
0xffff9a8000026800 0001 00000000 0x0 0x0
0xffff9a8000026880 0001 00000000 0x0 0x0
0xffff9a8000026900 0001 00000000 0x0 0x0
0xffff9a8000026980 0001 00000000 0x0 0x0
0xffff9a8000026a00 0001 00000000 0x0 0x0
0xffff9a8000026a80 0001 00000000 0x0 0x0
0xffff9a8000026b00 0001 00000000 0x0 0x0
0xffff9a8000026b80 0001 00000000 0x0 0x0
0xffff9a8000026c00 0001 00000000 0x0 0x0
0xffff9a8000026c80 0001 00000000 0x0 0x0
0xffff9a8000026d00 0001 00000000 0x0 0x0
0xffff9a8000026d80 0001 00000000 0x0 0x0
0xffff9a8000026e00 0001 00000000 0x0 0x0
0xffff9a8000026e80 0001 00000000 0x0 0x0
0xffff9a8000026f00 0001 00000000 0x0 0x0
0xffff9a8000026f80 0001 00000000 0x0 0x0
0xffff9a8000027000 0001 00000000 0x0 0x0
0xffff9a8000027080 0001 00000000 0x0 0x0
0xffff9a8000027100 0001 00000000 0x0 0x0
0xffff9a8000027180 0001 00000000 0x0 0x0
0xffff9a8000027200 0001 00000000 0x0 0x0
0xffff9a8000027280 0001 00000000 0x0 0x0
0xffff9a8000027300 0001 00000000 0x0 0x0
0xffff9a8000027380 0001 00000000 0x0 0x0
0xffff9a8000027400 0001 00000000 0x0 0x0
0xffff9a8000027480 0001 00000000 0x0 0x0
0xffff9a8000027500 0001 00000000 0x0 0x0
0xffff9a8000027580 0001 00000000 0x0 0x0
0xffff9a8000027600 0001 00000000 0x0 0x0
0xffff9a8000027680 0001 00000000 0x0 0x0
0xffff9a8000027700 0001 00000000 0x0 0x0
0xffff9a8000027780 0001 00000000 0x0 0x0
0xffff9a8000027800 0001 00000000 0x0 0x0
0xffff9a8000027880 0001 00000000 0x0 0x0
0xffff9a8000027900 0001 00000000 0x0 0x0
0xffff9a8000027980 0001 00000000 0x0 0x0
0xffff9a8000027a00 0001 00000000 0x0 0x0
0xffff9a8000027a80 0001 00000000 0x0 0x0
0xffff9a8000027b00 0001 00000000 0x0 0x0
0xffff9a8000027b80 0001 00000000 0x0 0x0
0xffff9a8000027c00 0001 00000000 0x0 0x0
0xffff9a8000027c80 0001 00000000 0x0 0x0
0xffff9a8000027d00 0001 00000000 0x0 0x0
0xffff9a8000027d80 0001 00000000 0x0 0x0
0xffff9a8000027e00 0001 00000000 0x0 0x0
0xffff9a8000027e80 0001 00000000 0x0 0x0
0xffff9a8000027f00 0001 00000000 0x0 0x0
0xffff9a8000027f80 0001 00000000 0x0 0x0
0xffff9a8000028000 0001 00000000 0x0 0x0
0xffff9a8000028080 0001 00000000 0x0 0x0
0xffff9a8000028100 0001 00000000 0x0 0x0
0xffff9a8000028180 0001 00000000 0x0 0x0
0xffff9a8000028200 0001 00000000 0x0 0x0
0xffff9a8000028280 0001 00000000 0x0 0x0
0xffff9a8000028300 0001 00000000 0x0 0x0
0xffff9a8000028380 0001 00000000 0x0 0x0
0xffff9a8000028400 0001 00000000 0x0 0x0
0xffff9a8000028480 0001 00000000 0x0 0x0
0xffff9a8000028500 0001 00000000 0x0 0x0
0xffff9a8000028580 0001 00000000 0x0 0x0
0xffff9a8000028600 0001 00000000 0x0 0x0
0xffff9a8000028680 0001 00000000 0x0 0x0
0xffff9a8000028700 0001 00000000 0x0 0x0
0xffff9a8000028780 0001 00000000 0x0 0x0
0xffff9a8000028800 0001 00000000 0x0 0x0
0xffff9a8000028880 0001 00000000 0x0 0x0
0xffff9a8000028900 0001 00000000 0x0 0x0
0xffff9a8000028980 0001 00000000 0x0 0x0
0xffff9a8000028a00 0001 00000000 0x0 0x0
0xffff9a8000028a80 0001 00000000 0x0 0x0
0xffff9a8000028b00 0001 00000000 0x0 0x0
0xffff9a8000028b80 0001 00000000 0x0 0x0
0xffff9a8000028c00 0001 00000000 0x0 0x0
0xffff9a8000028c80 0001 00000000 0x0 0x0
0xffff9a8000028d00 0001 00000000 0x0 0x0
0xffff9a8000028d80 0001 00000000 0x0 0x0
0xffff9a8000028e00 0001 00000000 0x0 0x0
0xffff9a8000028e80 0001 00000000 0x0 0x0
0xffff9a8000028f00 0001 00000000 0x0 0x0
0xffff9a8000028f80 0001 00000000 0x0 0x0
0xffff9a8000029000 0001 00000000 0x0 0x0
0xffff9a8000029080 0001 00000000 0x0 0x0
0xffff9a8000029100 0001 00000000 0x0 0x0
0xffff9a8000029180 0001 00000000 0x0 0x0
0xffff9a8000029200 0001 00000000 0x0 0x0
0xffff9a8000029280 0001 00000000 0x0 0x0
0xffff9a8000029300 0001 00000000 0x0 0x0
0xffff9a8000029380 0001 00000000 0x0 0x0
0xffff9a8000029400 0001 00000000 0x0 0x0
0xffff9a8000029480 0001 00000000 0x0 0x0
0xffff9a8000029500 0001 00000000 0x0 0x0
0xffff9a8000029580 0001 00000000 0x0 0x0
0xffff9a8000029600 0001 00000000 0x0 0x0
0xffff9a8000029680 0001 00000000 0x0 0x0
0xffff9a8000029700 0001 00000000 0x0 0x0
0xffff9a8000029780 0001 00000000 0x0 0x0
0xffff9a8000029800 0001 00000000 0x0 0x0
0xffff9a8000029880 0001 00000000 0x0 0x0
0xffff9a8000029900 0001 00000000 0x0 0x0
0xffff9a8000029980 0001 00000000 0x0 0x0
0xffff9a8000029a00 0001 00000000 0x0 0x0
0xffff9a8000029a80 0001 00000000 0x0 0x0
0xffff9a8000029b00 0001 00000000 0x0 0x0
0xffff9a8000029b80 0001 00000000 0x0 0x0
0xffff9a8000029c00 0001 00000000 0x0 0x0
0xffff9a8000029c80 0001 00000000 0x0 0x0
0xffff9a8000029d00 0001 00000000 0x0 0x0
0xffff9a8000029d80 0001 00000000 0x0 0x0
0xffff9a8000029e00 0001 00000000 0x0 0x0
0xffff9a8000029e80 0001 00000000 0x0 0x0
0xffff9a8000029f00 0001 00000000 0x0 0x0
0xffff9a8000029f80 0001 00000000 0x0 0x0
0xffff9a800002a000 0001 00000000 0x0 0x0
0xffff9a800002a080 0001 00000000 0x0 0x0
0xffff9a800002a100 0001 00000000 0x0 0x0
0xffff9a800002a180 0001 00000000 0x0 0x0
0xffff9a800002a200 0001 00000000 0x0 0x0
0xffff9a800002a280 0001 00000000 0x0 0x0
0xffff9a800002a300 0001 00000000 0x0 0x0
0xffff9a800002a380 0001 00000000 0x0 0x0
0xffff9a800002a400 0001 00000000 0x0 0x0
0xffff9a800002a480 0001 00000000 0x0 0x0
0xffff9a800002a500 0001 00000000 0x0 0x0
0xffff9a800002a580 0001 00000000 0x0 0x0
0xffff9a800002a600 0001 00000000 0x0 0x0
0xffff9a800002a680 0001 00000000 0x0 0x0
0xffff9a800002a700 0001 00000000 0x0 0x0
0xffff9a800002a780 0001 00000000 0x0 0x0
0xffff9a800002a800 0001 00000000 0x0 0x0
0xffff9a800002a880 0001 00000000 0x0 0x0
0xffff9a800002a900 0001 00000000 0x0 0x0
0xffff9a800002a980 0001 00000000 0x0 0x0
0xffff9a800002aa00 0001 00000000 0x0 0x0
0xffff9a800002aa80 0001 00000000 0x0 0x0
0xffff9a800002ab00 0001 00000000 0x0 0x0
0xffff9a800002ab80 0001 00000000 0x0 0x0
0xffff9a800002ac00 0001 00000000 0x0 0x0
0xffff9a800002ac80 0001 00000000 0x0 0x0
0xffff9a800002ad00 0001 00000000 0x0 0x0
0xffff9a800002ad80 0001 00000000 0x0 0x0
0xffff9a800002ae00 0001 00000000 0x0 0x0
0xffff9a800002ae80 0001 00000000 0x0 0x0
0xffff9a800002af00 0001 00000000 0x0 0x0
0xffff9a800002af80 0001 00000000 0x0 0x0
0xffff9a800002b000 0001 00000000 0x0 0x0
0xffff9a800002b080 0001 000000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Sep 9, 2020, 6:22:16 AM9/9/20

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 75502d1b Added the explain about locking order in iavf(4)
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=10140429900000

kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=05e82a187a2eaefa60b1
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16b96631900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13aaff35900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+05e82a...@syzkaller.appspotmail.com

[ 116.0019761] panic: ASan: Unauthorized Access In 0xffffffff815f74de: Addr 0xffffbe00141c1470 [8 bytes, read, PoolUseAfterFree]

[ 116.0119102] cpu1: Begin traceback...
[ 116.0419130] vpanic() at netbsd:vpanic+0x26f sys/kern/subr_prf.c:290
[ 116.1219161] snprintf() at netbsd:snprintf
[ 116.2119153] kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:186 [inline]
[ 116.2119153] kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:196
[ 116.2919115] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_4byte_isvalid sys/kern/subr_asan.c:346 [inline]
[ 116.2919115] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:360 [inline]
[ 116.2919115] __asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_check sys/kern/subr_asan.c:412 [inline]
[ 116.2919115] __asan_load8() at netbsd:__asan_load8+0x294 sys/kern/subr_asan.c:1199
[ 116.3819145] wsmousedoioctl() at netbsd:wsmousedoioctl+0x184 wsmouse_do_ioctl sys/dev/wscons/wsmouse.c:721 [inline]
[ 116.3819145] wsmousedoioctl() at netbsd:wsmousedoioctl+0x184 sys/dev/wscons/wsmouse.c:689
[ 116.4719132] cdev_ioctl() at netbsd:cdev_ioctl+0x145 sys/kern/subr_devsw.c:935
[ 116.5519148] spec_ioctl() at netbsd:spec_ioctl+0x20c sys/miscfs/specfs/spec_vnops.c:902
[ 116.6319201] VOP_IOCTL() at netbsd:VOP_IOCTL+0x15b sys/kern/vnode_if.c:646
[ 116.7219169] vn_ioctl() at netbsd:vn_ioctl+0x1e4 sys/kern/vfs_vnops.c:778
[ 116.8019162] sys_fcntl() at netbsd:sys_fcntl+0xb70 sys/kern/sys_descrip.c:482
[ 116.8819150] sys_syscall() at netbsd:sys_syscall+0xfe sy_call sys/sys/syscallvar.h:65 [inline]
[ 116.8819150] sys_syscall() at netbsd:sys_syscall+0xfe sys/kern/sys_syscall.c:77
[ 116.9719140] syscall() at netbsd:syscall+0x281 sy_call sys/sys/syscallvar.h:65 [inline]
[ 116.9719140] syscall() at netbsd:syscall+0x281 sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 116.9719140] syscall() at netbsd:syscall+0x281 sys/arch/x86/x86/syscall.c:138
[ 116.9919151] --- syscall (number 0) ---
[ 117.0119147] netbsd:syscall+0x281:
[ 117.0219115] cpu1: End traceback...
[ 117.0219115] fatal breakpoint trap in supervisor mode
[ 117.0319099] trap type 1 code 0 rip 0xffffffff80220a1d cs 0x8 rflags 0x286 cr2 0x7b983ee3ed30 ilevel 0 rsp 0xffffbe018755d640
[ 117.0419106] curlwp 0xffffbe0012c6ba80 pid 1100.1100 lowest kstack 0xffffbe01875562c0
Stopped in pid 1100.1100 (syz-executor6533) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x26f sys/kern/subr_prf.c:290
snprintf() at netbsd:snprintf
kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:186 [inline]
kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:196
__asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_4byte_isvalid sys/kern/subr_asan.c:346 [inline]
__asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_8byte_isvalid sys/kern/subr_asan.c:360 [inline]
__asan_load8() at netbsd:__asan_load8+0x294 kasan_shadow_check sys/kern/subr_asan.c:412 [inline]
__asan_load8() at netbsd:__asan_load8+0x294 sys/kern/subr_asan.c:1199
wsmousedoioctl() at netbsd:wsmousedoioctl+0x184 wsmouse_do_ioctl sys/dev/wscons/wsmouse.c:721 [inline]
wsmousedoioctl() at netbsd:wsmousedoioctl+0x184 sys/dev/wscons/wsmouse.c:689
cdev_ioctl() at netbsd:cdev_ioctl+0x145 sys/kern/subr_devsw.c:935
spec_ioctl() at netbsd:spec_ioctl+0x20c sys/miscfs/specfs/spec_vnops.c:902
VOP_IOCTL() at netbsd:VOP_IOCTL+0x15b sys/kern/vnode_if.c:646
vn_ioctl() at netbsd:vn_ioctl+0x1e4 sys/kern/vfs_vnops.c:778
sys_fcntl() at netbsd:sys_fcntl+0xb70 sys/kern/sys_descrip.c:482

sys_syscall() at netbsd:sys_syscall+0xfe sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0xfe sys/kern/sys_syscall.c:77

syscall() at netbsd:syscall+0x281 sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x281 sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x281 sys/arch/x86/x86/syscall.c:138

--- syscall (number 0) ---
netbsd:syscall+0x281:
Panic string: ASan: Unauthorized Access In 0xffffffff815f74de: Addr 0xffffbe00141c1470 [8 bytes, read, PoolUseAfterFree]

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1190 1190 2 0 0 ffffbe0012c6b640 syz-executor6533
1127 1127 2 0 0 ffffbe0012ca3280 syz-executor6533
1100 >1100 7 1 0 ffffbe0012c6ba80 syz-executor6533
1083 1083 2 0 0 ffffbe0012bfb540 syz-executor6533
1084 1084 2 0 0 ffffbe0012c80680 syz-executor6533
1076 1076 2 0 0 ffffbe0012ad5780 syz-executor6533
419 419 2 1 40 ffffbe00138dd8c0 syz-executor6533
1079 1079 2 0 40 ffffbe00138dd480 syz-executor6533
1071 1071 2 1 40 ffffbe00138dd040 syz-executor6533
1251 1251 2 0 40 ffffbe0012bbb4c0 syz-executor6533
1081 1081 2 0 40 ffffbe0012ad5340 syz-executor6533
1095 1095 2 0 40 ffffbe0012b14480 syz-executor6533
950 950 3 0 40080 ffffbe0012aafb80 syz-executor6533 nanoslp
939 939 3 1 80 ffffbe0012c6b200 sshd select
1252 1252 3 1 80 ffffbe0012bbb080 getty nanoslp
1064 1064 3 0 80 ffffbe00140e89c0 getty nanoslp
1249 1249 3 1 80 ffffbe00140e8580 getty nanoslp
858 858 3 0 c0 ffffbe0012a2f6c0 getty ttyraw
975 975 3 1 80 ffffbe00138c7b80 sshd select
974 974 3 0 80 ffffbe00137f69c0 powerd kqueue
682 682 3 0 80 ffffbe0013858ac0 syslogd kqueue
599 599 3 0 80 ffffbe0012cee780 dhcpcd poll
736 736 3 1 80 ffffbe0012d24980 dhcpcd poll
600 600 3 1 80 ffffbe0012cfa8c0 dhcpcd poll
580 580 3 1 80 ffffbe0012cee340 dhcpcd poll
350 350 3 0 80 ffffbe0012dff4c0 dhcpcd poll
349 349 3 1 80 ffffbe0012dff080 dhcpcd poll
348 348 3 0 80 ffffbe0012de08c0 dhcpcd poll
1 1 3 0 80 ffffbe00128c2980 init wait
0 796 3 0 200 ffffbe00129e6a80 physiod physiod
0 162 3 0 200 ffffbe00129fcac0 pooldrain pooldrain
0 > 167 7 0 240 ffffbe00129fc680 ioflush
0 165 3 1 200 ffffbe00129fc240 pgdaemon pgdaemon
0 160 3 1 200 ffffbe00129e6200 usb7 usbevt
0 31 3 1 200 ffffbe001299ba40 usb6 usbevt
0 63 3 0 200 ffffbe001299b600 usb5 usbevt
0 126 3 0 200 ffffbe001299b1c0 usb4 usbevt
0 125 3 1 200 ffffbe0012949a00 usb3 usbevt
0 124 3 1 200 ffffbe00129495c0 usb2 usbevt
0 123 3 0 200 ffffbe0012949180 usb1 usbevt
0 122 3 1 200 ffffbe00128d69c0 usb0 usbevt
0 121 3 0 200 ffffbe00128d6580 usbtask-dr usbtsk
0 120 3 0 200 ffffbe000fe35ac0 usbtask-hc usbtsk
0 119 3 0 200 ffffbe00128d6140 npfgc0 npfgcw
0 118 3 0 200 ffffbe00128c2540 rt_free rt_free
0 117 3 0 200 ffffbe00128c2100 unpgc unpgc
0 116 2 0 200 ffffbe00127f8940 key_timehandler
0 115 3 1 200 ffffbe00127f8500 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffffbe00127f80c0 icmp6_wqinput/0 icmp6_wqinput
0 113 2 0 200 ffffbe00127ed900 nd6_timer
0 112 3 1 200 ffffbe00127ed4c0 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffffbe00127ed080 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffffbe00127da8c0 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffffbe00127da480 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffffbe00127da040 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffffbe00127c9bc0 icmp_wqinput/0 icmp_wqinput
0 106 2 0 200 ffffbe00127c9780 rt_timer
0 105 3 0 200 ffffbe00127c9340 vmem_rehash vmem_rehash
0 104 3 0 200 ffffbe00127c6740 entbutler entropy
0 30 3 1 200 ffffbe001213b6c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffffbe001213b280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffffbe000fe35680 scsibus0 sccomp
0 26 3 0 200 ffffbe000fe35240 pms0 pmsreset
0 25 3 1 200 ffffbe000fd89a80 xcall/1 xcall
0 24 1 1 200 ffffbe000fd89640 softser/1
0 23 1 1 200 ffffbe000fd89200 softclk/1
0 22 1 1 200 ffffbe000fd87a40 softbio/1
0 21 1 1 200 ffffbe000fd87600 softnet/1
0 20 1 1 201 ffffbe000fd871c0 idle/1
0 19 3 0 200 ffffbe000e7f9a00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffffbe000e7f95c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffffbe000e7f9180 lnxsyswq lnxsyswq
0 16 3 0 200 ffffbe000e7f19c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffbe000e7f1580 sysmon smtaskq
0 14 3 0 200 ffffbe000e7f1140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffbe000e7ed980 pmfevent pmfevent
0 12 3 0 200 ffffbe000e7ed540 sopendfree sopendfr
0 11 3 1 200 ffffbe000e7ed100 iflnkst iflnkst
0 10 3 0 200 ffffbe000e7e1940 nfssilly nfssilly
0 9 3 0 200 ffffbe000e7e1500 vdrain vdrain
0 8 3 0 200 ffffbe000e7e10c0 modunload mod_unld
0 7 3 0 200 ffffbe000e7d4900 xcall/0 xcall
0 6 1 0 200 ffffbe000e7d44c0 softser/0
0 > 5 7 0 200 ffffbe000e7d4080 softclk/0
0 4 1 0 200 ffffbe000e7d28c0 softbio/0
0 3 1 0 200 ffffbe000e7d2480 softnet/0
0 2 1 0 201 ffffbe000e7d2040 idle/0
0 0 2 1 240 ffffffff82ee8400 swapper
[Locks tracked through LWPs]

****** LWP 1251.1251 (syz-executor6533) @ 0xffffbe0012bbb4c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at amap_ctor)
lock address : 0xffffbe0012e30980 type : sleep/adaptive
initialized : 0xffffffff818427eb

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffbe0012bbb4c0 last held: 0xffffbe0012bbb4c0
last locked* : 0xffffffff8185310c unlocked : 0xffffffff81844c80
owner/count : 0xffffbe0012bbb4c0 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 736.736 (dhcpcd) @ 0xffffbe0012d24980, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82feec80 type : sleep/adaptive
initialized : 0xffffffff818fa065
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffffbe0012d24980 last held: 000000000000000000