ASan: Unauthorized Access in usb_free_device

0 views

Skip to first unread message

syzbot

unread,

May 31, 2020, 12:15:16 PM5/31/20

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following crash on:

HEAD commit: 210304d1 Use device_xname() to access dv_xname
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=154607d6100000
kernel config: https://syzkaller.appspot.com/x/.config?x=5702129db7f7788d
dashboard link: https://syzkaller.appspot.com/bug?extid=c7e74d0ae89e9f08f863
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c7e74d...@syzkaller.appspotmail.com

[ 68.8903504] panic: ASan: Unauthorized Access In 0xffffffff806b5ca6: Addr 0xffffb7800fd423c4 [1 byte, read, PoolUseAfterFree]

[ 68.9103833] cpu0: Begin traceback...
[ 68.9203379] vpanic() at netbsd:vpanic+0x22e sys/kern/subr_prf.c:290
[ 68.9403382] snprintf() at netbsd:snprintf
[ 68.9703475] kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:187 [inline]
[ 68.9703475] kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:197
[ 69.0003408] __asan_load1_noabort() at netbsd:__asan_load1_noabort
[ 69.0203380] usb_free_device() at netbsd:usb_free_device+0x79 sys/dev/usb/usb_subr.c:1557
[ 69.0503441] usb_disconnect_port() at netbsd:usb_disconnect_port+0x30c sys/dev/usb/usb_subr.c:1647
[ 69.0803380] uhub_explore() at netbsd:uhub_explore+0x4ee sys/dev/usb/uhub.c:639
[ 69.1103395] usb_discover.isra.2() at netbsd:usb_discover.isra.2+0x18c
[ 69.1403379] usb_event_thread() at netbsd:usb_event_thread+0xd9 sys/dev/usb/usb.c:652
[ 69.1503371] cpu0: End traceback...
[ 69.1604522] fatal breakpoint trap in supervisor mode
[ 69.1604522] trap type 1 code 0 rip 0xffffffff8022094d cs 0x8 rflags 0x282 cr2 0x63a000 ilevel 0 rsp 0xffffb781800baab0
[ 69.1760485] curlwp 0xffffb78012948580 pid 0.122 lowest kstack 0xffffb781800b32c0
Stopped in pid 0.122 (system) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xe9 sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x22e sys/kern/subr_prf.c:290
snprintf() at netbsd:snprintf
kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:187 [inline]
kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:197
__asan_load1_noabort() at netbsd:__asan_load1_noabort
usb_free_device() at netbsd:usb_free_device+0x79 sys/dev/usb/usb_subr.c:1557
usb_disconnect_port() at netbsd:usb_disconnect_port+0x30c sys/dev/usb/usb_subr.c:1647
uhub_explore() at netbsd:uhub_explore+0x4ee sys/dev/usb/uhub.c:639
usb_discover.isra.2() at netbsd:usb_discover.isra.2+0x18c
usb_event_thread() at netbsd:usb_event_thread+0xd9 sys/dev/usb/usb.c:652
ds 3d2f
es f577
fs aa90
gs aae0
rdi ffffffff82bd8bc0 db_onpanic
rsi 1ffffffff057b178
rbp ffffb781800baab0
rbx ffffffff829b4f80 cpu_info_primary
rdx 0
rcx ffffffff8126f839 db_panic+0xd5
rax ffffb78012948580
r8 4
r9 1ffffffff057b178
r10 ffffffff82bd8bc3 db_onpanic+0x3
r11 10
r12 ffffb7816e6aa000
r13 ffffffff8243e950 ostype+0x709b0
r14 ffffb781800bab40
r15 ffffb7816e699060
rip ffffffff8022094d breakpoint+0x5
cs 8
rflags 282
rsp ffffb781800baab0
ss 10
netbsd:breakpoint+0x5: leave
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
1954 1954 3 1 80 ffffb78012d88b80 syz-executor.4 parked
1107 1107 3 0 80 ffffb78012ce9a40 syz-executor.4 parked
1106 287 3 0 80 ffffb78012cc2980 syz-executor.0 parked
1106 944 3 1 400c0 ffffb78012c86340 syz-executor.0 parked
1106 1106 2 1 10040000 ffffb780129dba80 syz-executor.0
859 859 3 0 80 ffffb7801446db00 syz-executor.4 parked
1531 1531 3 1 c0 ffffb780142bc9c0 syz-executor.2 pipe_rd
824 824 3 1 400c0 ffffb780142bc580 syz-executor.4 pipe_rd
814 814 3 0 c0 ffffb780142bc140 syz-executor.5 pipe_rd
695 695 3 1 c0 ffffb78014271980 syz-executor.3 pipe_rd
811 811 3 0 c0 ffffb78014271540 syz-executor.1 pipe_rd
815 > 815 7 1 40 ffffb78014271100 syz-executor.0
999 813 3 0 80 ffffb78012aa2300 syz-fuzzer parked
999 809 3 0 80 ffffb78014072500 syz-fuzzer parked
999 861 3 0 80 ffffb780137c9980 syz-fuzzer kqueue
999 855 3 1 80 ffffb780137d39c0 syz-fuzzer parked
999 726 3 1 80 ffffb78013848a80 syz-fuzzer parked
999 704 3 1 80 ffffb78013848200 syz-fuzzer parked
999 719 3 1 80 ffffb780137ea180 syz-fuzzer parked
999 999 3 1 80 ffffb78012aa2740 syz-fuzzer parked
706 706 3 1 80 ffffb78012aa2b80 sshd select
858 858 3 1 80 ffffb7801387d780 getty nanoslp
846 846 3 1 80 ffffb78012162b00 getty nanoslp
856 856 3 1 80 ffffb780138bb080 getty nanoslp
1756 1756 3 0 c0 ffffb78012747b80 getty ttyraw
691 691 3 1 80 ffffb780137b9500 sshd select
579 579 3 0 80 ffffb78012d2e240 powerd kqueue
437 437 3 1 80 ffffb7801385b280 syslogd kqueue
308 308 3 0 80 ffffb78012bffa00 dhcpcd kqueue
310 310 3 0 80 ffffb78012c7bb80 dhcpcd kqueue
306 306 3 0 80 ffffb78012bff180 dhcpcd kqueue
416 416 3 1 80 ffffb78012c48240 dhcpcd kqueue
204 204 3 1 80 ffffb780136ff780 dhcpcd kqueue
200 200 3 1 80 ffffb78012d88300 dhcpcd kqueue
199 199 3 0 80 ffffb78012d72b40 dhcpcd kqueue
198 198 3 0 80 ffffb78012d72700 dhcpcd kqueue
1 1 3 0 80 ffffb780128e8540 init wait
0 714 3 0 200 ffffb78012965180 physiod physiod
0 63 3 0 200 ffffb780129681c0 pooldrain pooldrain
0 126 3 1 200 ffffb78012965a00 ioflush syncer
0 125 3 1 200 ffffb780129655c0 pgdaemon pgdaemon
0 > 122 7 0 240 ffffb78012948580 usb0
0 121 3 1 200 ffffb78012948140 usbtask-dr usbtsk
0 120 3 0 200 ffffb7800fe5cac0 usbtask-hc usbtsk
0 119 3 1 200 ffffb780128e8980 npfgc0 npfgcw
0 118 3 1 200 ffffb780128e8100 rt_free rt_free
0 117 3 1 200 ffffb780128df940 unpgc unpgc
0 116 3 0 200 ffffb780128df500 key_timehandler key_timehandler
0 115 3 1 200 ffffb780128df0c0 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffffb780128d6900 icmp6_wqinput/0 icmp6_wqinput
0 113 3 0 200 ffffb780128d64c0 nd6_timer nd6_timer
0 112 3 1 200 ffffb780128d6080 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffffb780128d28c0 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffffb780128d2480 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffffb780128d2040 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffffb78012748bc0 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffffb78012748780 icmp_wqinput/0 icmp_wqinput
0 106 3 0 200 ffffb78012747740 rt_timer rt_timer
0 105 3 1 200 ffffb78012748340 vmem_rehash vmem_rehash
0 104 3 0 200 ffffb78012744b40 entbutler entropy
0 30 3 1 200 ffffb780121626c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffffb78012162280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffffb7800fe5c680 scsibus0 sccomp
0 26 3 0 200 ffffb7800fe5c240 pms0 pmsreset
0 25 3 1 200 ffffb7800fd9da80 xcall/1 xcall
0 24 1 1 200 ffffb7800fd9d640 softser/1
0 23 1 1 200 ffffb7800fd9d200 softclk/1
0 22 1 1 200 ffffb7800fd9ba40 softbio/1
0 21 1 1 200 ffffb7800fd9b600 softnet/1
0 20 1 1 201 ffffb7800fd9b1c0 idle/1
0 19 3 0 200 ffffb7800e80aa00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffffb7800e80a5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffffb7800e80a180 lnxsyswq lnxsyswq
0 16 3 0 200 ffffb7800e8049c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffb7800e804580 sysmon smtaskq
0 14 3 0 200 ffffb7800e804140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffb7800e7ff980 pmfevent pmfevent
0 12 3 0 200 ffffb7800e7ff540 sopendfree sopendfr
0 11 3 0 200 ffffb7800e7ff100 iflnkst iflnkst
0 10 3 0 200 ffffb7800e7f3940 nfssilly nfssilly
0 9 3 0 200 ffffb7800e7f3500 vdrain vdrain
0 8 3 0 200 ffffb7800e7f30c0 modunload mod_unld
0 7 3 0 200 ffffb7800e7e6900 xcall/0 xcall
0 6 1 0 200 ffffb7800e7e64c0 softser/0
0 5 1 0 200 ffffb7800e7e6080 softclk/0
0 4 1 0 200 ffffb7800e7e48c0 softbio/0
0 3 1 0 200 ffffb7800e7e4480 softnet/0
0 2 1 0 201 ffffb7800e7e4040 idle/0
0 0 3 0 200 ffffffff82ca4080 swapper uvm
[Locks tracked through LWPs]

****** LWP 310.310 (dhcpcd) @ 0xffffb78012c7bb80, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82d9c840 type : sleep/adaptive
initialized : 0xffffffff816d2c22
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffb78012c7bb80 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 306.306 (dhcpcd) @ 0xffffb78012bff180, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82d9c840 type : sleep/adaptive
initialized : 0xffffffff816d2c22
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffb78012bff180 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 199.199 (dhcpcd) @ 0xffffb78012d72b40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82d9c840 type : sleep/adaptive
initialized : 0xffffffff816d2c22
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffb78012d72b40 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 198.198 (dhcpcd) @ 0xffffb78012d72700, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82d9c840 type : sleep/adaptive
initialized : 0xffffffff816d2c22
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffb78012d72700 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffb7800e7ff100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82d9c840 type : sleep/adaptive
initialized : 0xffffffff816d2c22
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffb7800e7ff100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffb7800e7e6080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82d9c840 type : sleep/adaptive
initialized : 0xffffffff816d2c22
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffb7800e7e6080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

PAGE FLAG PQ UOBJECT UANON
0xffffb78000017180 0041 00000000 0x0 0x0
0xffffb78000017200 0041 00000000 0x0 0x0
0xffffb78000017280 0041 00000000 0x0 0x0
0xffffb78000017300 0041 00000000 0x0 0x0
0xffffb78000017380 0041 00000000 0x0 0x0
0xffffb78000017400 0041 00000000 0x0 0x0
0xffffb78000017480 0041 00000000 0x0 0x0
0xffffb78000017500 0041 00000000 0x0 0x0
0xffffb78000017580 0041 00000000 0x0 0x0
0xffffb78000017600 0041 00000000 0x0 0x0
0xffffb78000017680 0041 00000000 0x0 0x0
0xffffb78000017700 0041 00000000 0x0 0x0
0xffffb78000017780 0041 00000000 0x0 0x0
0xffffb78000017800 0041 00000000 0x0 0x0
0xffffb78000017880 0041 00000000 0x0 0x0
0xffffb78000017900 0041 00000000 0x0 0x0
0xffffb78000017980 0041 00000000 0x0 0x0
0xffffb78000017a00 0041 00000000 0x0 0x0
0xffffb78000017a80 0041 00000000 0x0 0x0
0xffffb78000017b00 0041 00000000 0x0 0x0
0xffffb78000017b80 0041 00000000 0x0 0x0
0xffffb78000017c00 0041 00000000 0x0 0x0
0xffffb78000017c80 0041 00000000 0x0 0x0
0xffffb78000017d00 0041 00000000 0x0 0x0
0xffffb78000017d80 0041 00000000 0x0 0x0
0xffffb78000017e00 0041 00000000 0x0 0x0
0xffffb78000017e80 0041 00000000 0x0 0x0
0xffffb78000017f00 0041 00000000 0x0 0x0
0xffffb78000017f80 0041 00000000 0x0 0x0
0xffffb78000018000 0041 00000000 0x0 0x0
0xffffb78000018080 0041 00000000 0x0 0x0
0xffffb78000018100 0041 00000000 0x0 0x0
0xffffb78000018180 0041 00000000 0x0 0x0
0xffffb78000018200 0041 00000000 0x0 0x0
0xffffb78000018280 0041 00000000 0x0 0x0
0xffffb78000018300 0041 00000000 0x0 0x0
0xffffb78000018380 0041 00000000 0x0 0x0
0xffffb78000018400 0041 00000000 0x0 0x0
0xffffb78000018480 0041 00000000 0x0 0x0
0xffffb78000018500 0041 00000000 0x0 0x0
0xffffb78000018580 0041 00000000 0x0 0x0
0xffffb78000018600 0041 00000000 0x0 0x0
0xffffb78000018680 0041 00000000 0x0 0x0
0xffffb78000018700 0041 00000000 0x0 0x0
0xffffb78000018780 0041 00000000 0x0 0x0
0xffffb78000018800 0041 00000000 0x0 0x0
0xffffb78000018880 0041 00000000 0x0 0x0
0xffffb78000018900 0041 00000000 0x0 0x0
0xffffb78000018980 0041 00000000 0x0 0x0
0xffffb78000018a00 0041 00000000 0x0 0x0
0xffffb78000018a80 0041 00000000 0x0 0x0
0xffffb78000018b00 0041 00000000 0x0 0x0
0xffffb78000018b80 0041 00000000 0x0 0x0
0xffffb78000018c00 0041 00000000 0x0 0x0
0xffffb78000018c80 0041 00000000 0x0 0x0
0xffffb78000018d00 0041 00000000 0x0 0x0
0xffffb78000018d80 0041 00000000 0x0 0x0
0xffffb78000018e00 0041 00000000 0x0 0x0
0xffffb78000018e80 0041 00000000 0x0 0x0
0xffffb78000018f00 0041 00000000 0x0 0x0
0xffffb78000018f80 0041 00000000 0x0 0x0
0xffffb78000019000 0041 00000000 0x0 0x0
0xffffb78000019080 0041 00000000 0x0 0x0
0xffffb78000019100 0041 00000000 0x0 0x0
0xffffb78000019180 0041 00000000 0x0 0x0
0xffffb78000019200 0041 00000000 0x0 0x0
0xffffb78000019280 0041 00000000 0x0 0x0
0xffffb78000019300 0041 00000000 0x0 0x0
0xffffb78000019380 0041 00000000 0x0 0x0
0xffffb78000019400 0041 00000000 0x0 0x0
0xffffb78000019480 0041 00000000 0x0 0x0
0xffffb78000019500 0041 00000000 0x0 0x0
0xffffb78000019580 0041 00000000 0x0 0x0
0xffffb78000019600 0041 00000000 0x0 0x0
0xffffb78000019680 0041 00000000 0x0 0x0
0xffffb78000019700 0041 00000000 0x0 0x0
0xffffb78000019780 0041 00000000 0x0 0x0
0xffffb78000019800 0041 00000000 0x0 0x0
0xffffb78000019880 0041 00000000 0x0 0x0
0xffffb78000019900 0041 00000000 0x0 0x0
0xffffb78000019980 0041 00000000 0x0 0x0
0xffffb78000019a00 0041 00000000 0x0 0x0
0xffffb78000019a80 0041 00000000 0x0 0x0
0xffffb78000019b00 0041 00000000 0x0 0x0
0xffffb78000019b80 0041 00000000 0x0 0x0
0xffffb78000019c00 0041 00000000 0x0 0x0
0xffffb78000019c80 0041 00000000 0x0 0x0
0xffffb78000019d00 0041 00000000 0x0 0x0
0xffffb78000019d80 0041 00000000 0x0 0x0
0xffffb78000019e00 0041 00000000 0x0 0x0
0xffffb78000019e80 0041 00000000 0x0 0x0
0xffffb78000019f00 0041 00000000 0x0 0x0
0xffffb78000019f80 0041 00000000 0x0 0x0
0xffffb7800001a000 0041 00000000 0x0 0x0
0xffffb7800001a080 0041 00000000 0x0 0x0
0xffffb7800001a100 0041 00000000 0x0 0x0
0xffffb7800001a180 0041 00000000 0x0 0x0
0xffffb7800001a200 0041 00000000 0x0 0x0
0xffffb7800001a280 0041 00000000 0x0 0x0
0xffffb7800001a300 0041 00000000 0x0 0x0
0xffffb7800001a380 0041 00000000 0x0 0x0
0xffffb7800001a400 0041 00000000 0x0 0x0
0xffffb7800001a480 0041 00000000 0x0 0x0
0xffffb7800001a500 0041 00000000 0x0 0x0
0xffffb7800001a580 0041 00000000 0x0 0x0
0xffffb7800001a600 0041 00000000 0x0 0x0
0xffffb7800001a680 0041 00000000 0x0 0x0
0xffffb7800001a700 0041 00000000 0x0 0x0
0xffffb7800001a780 0041 00000000 0x0 0x0
0xffffb7800001a800 0041 00000000 0x0 0x0
0xffffb7800001a880 0041 00000000 0x0 0x0
0xffffb7800001a900 0041 00000000 0x0 0x0
0xffffb7800001a980 0041 00000000 0x0 0x0
0xffffb7800001aa00 0041 00000000 0x0 0x0
0xffffb7800001aa80 0041 00000000 0x0 0x0
0xffffb7800001ab00 0041 00000000 0x0 0x0
0xffffb7800001ab80 0041 00000000 0x0 0x0
0xffffb7800001ac00 0041 00000000 0x0 0x0
0xffffb7800001ac80 0041 00000000 0x0 0x0
0xffffb7800001ad00 0041 00000000 0x0 0x0
0xffffb7800001ad80 0041 00000000 0x0 0x0
0xffffb7800001ae00 0041 00000000 0x0 0x0
0xffffb7800001ae80 0041 00000000 0x0 0x0
0xffffb7800001af00 0041 00000000 0x0 0x0
0xffffb7800001af80 0041 00000000 0x0 0x0
0xffffb7800001b000 0041 00000000 0x0 0x0
0xffffb7800001b080 0041 00000000 0x0 0x0
0xffffb7800001b100 0041 00000000 0x0 0x0
0xffffb7800001b180 0041 00000000 0x0 0x0
0xffffb7800001b200 0041 00000000 0x0 0x0
0xffffb7800001b280 0041 00000000 0x0 0x0
0xffffb7800001b300 0041 00000000 0x0 0x0
0xffffb7800001b380 0041 00000000 0x0 0x0
0xffffb7800001b400 0041 00000000 0x0 0x0
0xffffb7800001b480 0041 00000000 0x0 0x0
0xffffb7800001b500 0041 00000000 0x0 0x0
0xffffb7800001b580 0041 00000000 0x0 0x0
0xffffb7800001b600 0041 00000000 0x0 0x0
0xffffb7800001b680 0041 00000000 0x0 0x0
0xffffb7800001b700 0041 00000000 0x0 0x0
0xffffb7800001b780 0041 00000000 0x0 0x0
0xffffb7800001b800 0041 00000000 0x0 0x0
0xffffb7800001b880 0041 00000000 0x0 0x0
0xffffb7800001b900 0041 00000000 0x0 0x0
0xffffb7800001b980 0041 00000000 0x0 0x0
0xffffb7800001ba00 0041 00000000 0x0 0x0
0xffffb7800001ba80 0041 00000000 0x0 0x0
0xffffb7800001bb00 0041 00000000 0x0 0x0
0xffffb7800001bb80 0041 00000000 0x0 0x0
0xffffb7800001bc00 0041 00000000 0x0 0x0
0xffffb7800001bc80 0041 00000000 0x0 0x0
0xffffb7800001bd00 0041 00000000 0x0 0x0
0xffffb7800001bd80 0041 00000000 0x0 0x0
0xffffb7800001be00 0041 00000000 0x0 0x0
0xffffb7800001be80 0041 00000000 0x0 0x0
0xffffb7800001bf00 0041 00000000 0x0 0x0
0xffffb7800001bf80 0041 00000000 0x0 0x0
0xffffb7800001c000 0041 00000000 0x0 0x0
0xffffb7800001c080 0041 00000000 0x0 0x0
0xffffb7800001c100 0041 00000000 0x0 0x0
0xffffb7800001c180 0041 00000000 0x0 0x0
0xffffb7800001c200 0045 00000000 0x0 0x0
0xffffb7800001c280 0041 00000000 0x0 0x0
0xffffb7800001c300 0041 00000000 0x0 0x0
0xffffb7800001c380 0041 00000000 0x0 0x0
0xffffb7800001c400 0041 00000000 0x0 0x0
0xffffb7800001c480 0041 00000000 0x0 0x0
0xffffb7800001c500 0041 00000000 0x0 0x0
0xffffb7800001c580 0041 00000000 0x0 0x0
0xffffb7800001c600 0045 00000000 0x0 0x0
0xffffb7800001c680 0041 00000000 0x0 0x0
0xffffb7800001c700 0041 00000000 0x0 0x0
0xffffb7800001c780 0041 00000000 0x0 0x0
0xffffb7800001c800 0041 00000000 0x0 0x0
0xffffb7800001c880 0041 00000000 0x0 0x0
0xffffb7800001c900 0041 00000000 0x0 0x0
0xffffb7800001c980 0045 00000000 0x0 0x0
0xffffb7800001ca00 0041 00000000 0x0 0x0
0xffffb7800001ca80 0041 00000000 0x0 0x0
0xffffb7800001cb00 0045 00000000 0x0 0x0
0xffffb7800001cb80 0045 00000000 0x0 0x0
0xffffb7800001cc00 0045 00000000 0x0 0x0
0xffffb7800001cc80 0045 00000000 0x0 0x0
0xffffb7800001cd00 0045 00000000 0x0 0x0
0xffffb7800001cd80 0045 00000000 0x0 0x0
0xffffb7800001ce00 0041 00000000 0x0 0x0
0xffffb7800001ce80 0045 00000000 0x0 0x0
0xffffb7800001cf00 0045 00000000 0x0 0x0
0xffffb7800001cf80 0045 00000000 0x0 0x0
0xffffb7800001d000 0045 00000000 0x0 0x0
0xffffb7800001d080 0045 00000000 0x0 0x0
0xffffb7800001d100 0045 00000000 0x0 0x0
0xffffb7800001d180 0041 00000000 0x0 0x0
0xffffb7800001d200 0041 00000000 0x0 0x0
0xffffb7800001d280 0045 00000000 0x0 0x0
0xffffb7800001d300 0041 00000000 0x0 0x0
0xffffb7800001d380 0041 00000000 0x0 0x0
0xffffb7800001d400 0041 00000000 0x0 0x0
0xffffb7800001d480 0041 00000000 0x0 0x0
0xffffb7800001d500 0041 00000000 0x0 0x0
0xffffb7800001d580 0041 00000000 0x0 0x0
0xffffb7800001d600 0041 00000000 0x0 0x0
0xffffb7800001d680 0041 00000000 0x0 0x0
0xffffb7800001d700 0041 00000000 0x0 0x0
0xffffb7800001d780 0041 00000000 0x0 0x0
0xffffb7800001d800 0041 00000000 0x0 0x0
0xffffb7800001d880 0041 00000000 0x0 0x0
0xffffb7800001d900 0041 00000000 0x0 0x0
0xffffb7800001d980 0041 00000000 0x0 0x0
0xffffb7800001da00 0041 00000000 0x0 0x0
0xffffb7800001da80 0041 00000000 0x0 0x0
0xffffb7800001db00 0041 00000000 0x0 0x0
0xffffb7800001db80 0041 00000000 0x0 0x0
0xffffb7800001dc00 0041 00000000 0x0 0x0
0xffffb7800001dc80 0041 00000000 0x0 0x0
0xffffb7800001dd00 0041 00000000 0x0 0x0
0xffffb7800001dd80 0041 00000000 0x0 0x0
0xffffb7800001de00 0041 00000000 0x0 0x0
0xffffb7800001de80 0041 00000000 0x0 0x0
0xffffb7800001df00 0041 00000000 0x0 0x0
0xffffb7800001df80 0041 00000000 0x0 0x0
0xffffb7800001e000 0041 00000000 0x0 0x0
0xffffb7800001e080 0041 00000000 0x0 0x0
0xffffb7800001e100 0041 00000000 0x0 0x0
0xffffb7800001e180 0041 00000000 0x0 0x0
0xffffb7800001e200 0041 00000000 0x0 0x0
0xffffb7800001e280 0041 00000000 0x0 0x0
0xffffb7800001e300 0041 00000000 0x0 0x0
0xffffb7800001e380 0041 00000000 0x0 0x0
0xffffb7800001e400 0041 00000000 0x0 0x0
0xffffb7800001e480 0041 00000000 0x0 0x0
0xffffb7800001e500 0041 00000000 0x0 0x0
0xffffb7800001e580 0041 00000000 0x0 0x0
0xffffb7800001e600 0041 00000000 0x0 0x0
0xffffb7800001e680 0041 00000000 0x0 0x0
0xffffb7800001e700 0041 00000000 0x0 0x0
0xffffb7800001e780 0041 00000000 0x0 0x0
0xffffb7800001e800 0041 00000000 0x0 0x0
0xffffb7800001e880 0041 00000000 0x0 0x0
0xffffb7800001e900 0041 00000000 0x0 0x0
0xffffb7800001e980 0041 00000000 0x0 0x0
0xffffb7800001ea00 0041 00000000 0x0 0x0
0xffffb7800001ea80 0041 00000000 0x0 0x0
0xffffb7800001eb00 0041 00000000 0x0 0x0
0xffffb7800001eb80 0041 00000000 0x0 0x0
0xffffb7800001ec00 0041 00000000 0x0 0x0
0xffffb7800001ec80 0041 00000000 0x0 0x0
0xffffb7800001ed00 0041 00000000 0x0 0x0
0xffffb7800001ed80 0041 00000000 0x0 0x0
0xffffb7800001ee00 0041 00000000 0x0 0x0
0xffffb7800001ee80 0041 00000000 0x0 0x0
0xffffb7800001ef00 0041 00000000 0x0 0x0
0xffffb7800001ef80 0041 00000000 0x0 0x0
0xffffb7800001f000 0041 00000000 0x0 0x0
0xffffb7800001f080 0041 00000000 0x0 0x0
0xffffb7800001f100 0041 00000000 0x0 0x0
0xffffb7800001f180 0041 00000000 0x0 0x0
0xffffb7800001f200 0041 00000000 0x0 0x0
0xffffb7800001f280 0041 00000000 0x0 0x0
0xffffb7800001f300 0041 00000000 0x0 0x0
0xffffb7800001f380 0041 00000000 0x0 0x0
0xffffb7800001f400 0041 00000000 0x0 0x0
0xffffb7800001f480 0041 00000000 0x0 0x0
0xffffb7800001f500 0041 00000000 0x0 0x0
0xffffb7800001f580 0041 00000000 0x0 0x0
0xffffb7800001f600 0041 00000000 0x0 0x0
0xffffb7800001f680 0041 00000000 0x0 0x0
0xffffb7800001f700 0041 00000000 0x0 0x0
0xffffb7800001f780 0041 00000000 0x0 0x0
0xffffb7800001f800 0041 00000000 0x0 0x0
0xffffb7800001f880 0041 00000000 0x0 0x0
0xffffb7800001f900 0041 00000000 0x0 0x0
0xffffb7800001f980 0041 00000000 0x0 0x0
0xffffb7800001fa00 0041 00000000 0x0 0x0
0xffffb7800001fa80 0041 00000000 0x0 0x0
0xffffb7800001fb00 0041 00000000 0x0 0x0
0xffffb7800001fb80 0041 00000000 0x0 0x0
0xffffb7800001fc00 0041 00000000 0x0 0x0
0xffffb7800001fc80 0041 00000000 0x0 0x0
0xffffb7800001fd00 0041 00000000 0x0 0x0
0xffffb7800001fd80 0041 00000000 0x0 0x0
0xffffb7800001fe00 0041 00000000 0x0 0x0
0xffffb7800001fe80 0041 00000000 0x0 0x0
0xffffb7800001ff00 0041 00000000 0x0 0x0
0xffffb7800001ff80 0041 00000000 0x0 0x0
0xffffb78000020000 0041 00000000 0x0 0x0
0xffffb78000020080 0041 00000000 0x0 0x0
0xffffb78000020100 0041 00000000 0x0 0x0
0xffffb78000020180 0041 00000000 0x0 0x0
0xffffb78000020200 0041 00000000 0x0 0x0
0xffffb78000020280 0041 00000000 0x0 0x0
0xffffb78000020300 0041 00000000 0x0 0x0
0xffffb78000020380 0041 00000000 0x0 0x0
0xffffb78000020400 0041 00000000 0x0 0x0
0xffffb78000020480 0041 00000000 0x0 0x0
0xffffb78000020500 0041 00000000 0x0 0x0
0xffffb78000020580 0041 00000000 0x0 0x0
0xffffb78000020600 0041 00000000 0x0 0x0
0xffffb78000020680 0041 00000000 0x0 0x0
0xffffb78000020700 0041 00000000 0x0 0x0
0xffffb78000020780 0041 00000000 0x0 0x0
0xffffb78000020800 0041 00000000 0x0 0x0
0xffffb78000020880 0041 00000000 0x0 0x0
0xffffb78000020900 0041 00000000 0x0 0x0
0xffffb78000020980 0041 00000000 0x0 0x0
0xffffb78000020a00 0041 00000000 0x0 0x0
0xffffb78000020a80 0041 00000000 0x0 0x0
0xffffb78000020b00 0041 00000000 0x0 0x0
0xffffb78000020b80 0041 00000000 0x0 0x0
0xffffb78000020c00 0041 00000000 0x0 0x0
0xffffb78000020c80 0041 00000000 0x0 0x0
0xffffb78000020d00 0041 00000000 0x0 0x0
0xffffb78000020d80 0041 00000000 0x0 0x0
0xffffb78000020e00 0041 00000000 0x0 0x0
0xffffb78000020e80 0041 00000000 0x0 0x0
0xffffb78000020f00 0041 00000000 0x0 0x0
0xffffb78000020f80 0041 00000000 0x0 0x0
0xffffb78000021000 0041 00000000 0x0 0x0
0xffffb78000021080 0041 00000000 0x0 0x0
0xffffb78000021100 0041 00000000 0x0 0x0
0xffffb78000021180 0041 00000000 0x0 0x0
0xffffb78000021200 0041 00000000 0x0 0x0
0xffffb78000021280 0041 00000000 0x0 0x0
0xffffb78000021300 0041 00000000 0x0 0x0
0xffffb78000021380 0041 00000000 0x0 0x0
0xffffb78000021400 0041 00000000 0x0 0x0
0xffffb78000021480 0041 00000000 0x0 0x0
0xffffb78000021500 0041 00000000 0x0 0x0
0xffffb78000021580 0041 00000000 0x0 0x0
0xffffb78000021600 0041 00000000 0x0 0x0
0xffffb78000021680 0041 00000000 0x0 0x0
0xffffb78000021700 0041 00000000 0x0 0x0
0xffffb78000021780 0041 00000000 0x0 0x0
0xffffb78000021800 0041 00000000 0x0 0x0
0xffffb78000021880 0041 00000000 0x0 0x0
0xffffb78000021900 0041 00000000 0x0 0x0
0xffffb78000021980 0041 00000000 0x0 0x0
0xffffb78000021a00 0041 00000000 0x0 0x0
0xffffb78000021a80 0041 00000000 0x0 0x0
0xffffb78000021b00 0041 00000000 0x0 0x0
0xffffb78000021b80 0041 00000000 0x0 0x0
0xffffb78000021c00 0041 00000000 0x0 0x0
0xffffb78000021c80 0041 00000000 0x0 0x0
0xffffb78000021d00 0041 00000000 0x0 0x0
0xffffb78000021d80 0041 00000000 0x0 0x0
0xffffb78000021e00 0041 00000000 0x0 0x0
0xffffb78000021e80 0041 00000000 0x0 0x0
0xffffb78000021f00 0041 00000000 0x0 0x0
0xffffb78000021f80 0041 00000000 0x0 0x0
0xffffb78000022000 0041 00000000 0x0 0x0
0xffffb78000022080 0041 00000000 0x0 0x0
0xffffb78000022100 0041 00000000 0x0 0x0
0xffffb78000022180 0041 00000000 0x0 0x0
0xffffb78000022200 0041 00000000 0x0 0x0
0xffffb78000022280 0041 00000000 0x0 0x0
0xffffb78000022300 0041 00000000 0x0 0x0
0xffffb78000022380 0041 00000000 0x0 0x0
0xffffb78000022400 0041 00000000 0x0 0x0
0xffffb78000022480 0041 00000000 0x0 0x0
0xffffb78000022500 0041 00000000 0x0 0x0
0xffffb78000022580 0041 00000000 0x0 0x0
0xffffb78000022600 0041 00000000 0x0 0x0
0xffffb78000022680 0041 00000000 0x0 0x0
0xffffb78000022700 0041 00000000 0x0 0x0
0xffffb78000022780 0041 00000000 0x0 0x0
0xffffb78000022800 0041 00000000 0x0 0x0
0xffffb78000022880 0041 00000000 0x0 0x0
0xffffb78000022900 0041 00000000 0x0 0x0
0xffffb78000022980 0041 00000000 0x0 0x0
0xffffb78000022a00 0041 00000000 0x0 0x0
0xffffb78000022a80 0041 00000000 0x0 0x0
0xffffb78000022b00 0041 00000000 0x0 0x0
0xffffb78000022b80 0041 00000000 0x0 0x0
0xffffb78000022c00 0041 00000000 0x0 0x0
0xffffb78000022c80 0041 00000000 0x0 0x0
0xffffb78000022d00 0041 00000000 0x0 0x0
0xffffb78000022d80 0041 00000000 0x0 0x0
0xffffb78000022e00 0041 00000000 0x0 0x0
0xffffb78000022e80 0041 00000000 0x0 0x0
0xffffb78000022f00 0041 00000000 0x0 0x0
0xffffb78000022f80 0041 00000000 0x0 0x0
0xffffb78000023000 0041 00000000 0x0 0x0
0xffffb78000023080 0041 00000000 0x0 0x0
0xffffb78000023100 0041 00000000 0x0 0x0
0xffffb78000023180 0041 00000000 0x0 0x0
0xffffb78000023200 0041 00000000 0x0 0x0
0xffffb78000023280 0041 00000000 0x0 0x0
0xffffb78000023300 0041 00000000 0x0 0x0
0xffffb78000023380 0041 00000000 0x0 0x0
0xffffb78000023400 0041 00000000 0x0 0x0
0xffffb78000023480 0041 00000000 0x0 0x0
0xffffb78000023500 0041 00000000 0x0 0x0
0xffffb78000023580 0041 00000000 0x0 0x0
0xffffb78000023600 0041 00000000 0x0 0x0
0xffffb78000023680 0041 00000000 0x0 0x0
0xffffb78000023700 0041 00000000 0x0 0x0
0xffffb78000023780 0041 00000000 0x0 0x0
0xffffb78000023800 0041 00000000 0x0 0x0
0xffffb78000023880 0041 00000000 0x0 0x0
0xffffb78000023900 0041 00000000 0x0 0x0
0xffffb78000023980 0041 00000000 0x0 0x0
0xffffb78000023a00 0041 00000000 0x0 0x0
0xffffb78000023a80 0041 00000000 0x0 0x0
0xffffb78000023b00 0041 00000000 0x0 0x0
0xffffb78000023b80 0041 00000000 0x0 0x0
0xffffb78000023c00 0041 00000000 0x0 0x0
0xffffb78000023c80 0041 00000000 0x0 0x0
0xffffb78000023d00 0041 00000000 0x0 0x0
0xffffb78000023d80 0041 00000000 0x0 0x0
0xffffb78000023e00 0041 00000000 0x0 0x0
0xffffb78000023e80 0041 00000000 0x0 0x0
0xffffb78000023f00 0041 00000000 0x0 0x0
0xffffb78000023f80 0041 00000000 0x0 0x0
0xffffb78000024000 0041 00000000 0x0 0x0
0xffffb78000024080 0041 00000000 0x0 0x0
0xffffb78000024100 0041 00000000 0x0 0x0
0xffffb78000024180 0041 00000000 0x0 0x0
0xffffb78000024200 0041 00000000 0x0 0x0
0xffffb78000024280 0041 00000000 0x0 0x0
0xffffb78000024300 0041 00000000 0x0 0x0
0xffffb78000024380 0041 00000000 0x0 0x0
0xffffb78000024400 0041 00000000 0x0 0x0
0xffffb78000024480 0041 00000000 0x0 0x0
0xffffb78000024500 0041 00000000 0x0 0x0
0xffffb78000024580 0041 00000000 0x0 0x0
0xffffb78000024600 0041 00000000 0x0 0x0
0xffffb78000024680 0041 00000000 0x0 0x0
0xffffb78000024700 0041 00000000 0x0 0x0
0xffffb78000024780 0041 00000000 0x0 0x0
0xffffb78000024800 0041 00000000 0x0 0x0
0xffffb78000024880 0041 00000000 0x0 0x0
0xffffb78000024900 0041 00000000 0x0 0x0
0xffffb78000024980 0041 00000000 0x0 0x0
0xffffb78000024a00 0041 00000000 0x0 0x0
0xffffb78000024a80 0041 00000000 0x0 0x0
0xffffb78000024b00 0041 00000000 0x0 0x0
0xffffb78000024b80 0041 00000000 0x0 0x0
0xffffb78000024c00 0041 00000000 0x0 0x0
0xffffb78000024c80 0041 00000000 0x0 0x0
0xffffb78000024d00 0041 00000000 0x0 0x0
0xffffb78000024d80 0041 00000000 0x0 0x0
0xffffb78000024e00 0041 00000000 0x0 0x0
0xffffb78000024e80 0041 00000000 0x0 0x0
0xffffb78000024f00 0041 00000000 0x0 0x0
0xffffb78000024f80 0041 00000000 0x0 0x0
0xffffb78000025000 0041 00000000 0x0 0x0
0xffffb78000025080 0041 00000000 0x0 0x0
0xffffb78000025100 0041 00000000 0x0 0x0
0xffffb78000025180 0041 00000000 0x0 0x0
0xffffb78000025200 0041 00000000 0x0 0x0
0xffffb78000025280 0041 00000000 0x0 0x0
0xffffb78000025300 0041 00000000 0x0 0x0
0xffffb78000025380 0041 00000000 0x0 0x0
0xffffb78000025400 0041 00000000 0x0 0x0
0xffffb78000025480 0041 00000000 0x0 0x0
0xffffb78000025500 0041 00000000 0x0 0x0
0xffffb78000025580 0041 00000000 0x0 0x0
0xffffb78000025600 0041 00000000 0x0 0x0
0xffffb78000025680 0041 00000000 0x0 0x0
0xffffb78000025700 0041 00000000 0x0 0x0
0xffffb78000025780 0041 00000000 0x0 0x0
0xffffb78000025800 0041 00000000 0x0 0x0
0xffffb78000025880 0041 00000000 0x0 0x0
0xffffb78000025900 0041 00000000 0x0 0x0
0xffffb78000025980 0041 00000000 0x0 0x0
0xffffb78000025a00 0041 00000000 0x0 0x0
0xffffb78000025a80 0041 00000000 0x0 0x0
0xffffb78000025b00 0041 00000000 0x0 0x0
0xffffb78000025b80 0041 00000000 0x0 0x0
0xffffb78000025c00 0041 00000000 0x0 0x0
0xffffb78000025c80 0041 00000000 0x0 0x0
0xffffb78000025d00 0041 00000000 0x0 0x0
0xffffb78000025d80 0041 00000000 0x0 0x0
0xffffb78000025e00 0041 00000000 0x0 0x0
0xffffb78000025e80 0041 00000000 0x0 0x0
0xffffb78000025f00 0041 00000000 0x0 0x0
0xffffb78000025f80 0041 00000000 0x0 0x0
0xffffb78000026000 0041 00000000 0x0 0x0
0xffffb78000026080 0041 00000000 0x0 0x0
0xffffb78000026100 0041 00000000 0x0 0x0
0xffffb78000026180 0041 00000000 0x0 0x0
0xffffb78000026200 0041 00000000 0x0 0x0
0xffffb78000026280 0041 00000000 0x0 0x0
0xffffb78000026300 0041 00000000 0x0 0x0
0xffffb78000026380 0041 00000000 0x0 0x0
0xffffb78000026400 0041 00000000 0x0 0x0
0xffffb78000026480 0041 00000000 0x0 0x0
0xffffb78000026500 0041 00000000 0x0 0x0
0xffffb78000026580 0041 00000000 0x0 0x0
0xffffb78000026600 0041 00000000 0x0 0x0
0xffffb78000026680 0041 00000000 0x0 0x0
0xffffb78000026700 0041 00000000 0x0 0x0
0xffffb78000026780 0041 00000000 0x0 0x0
0xffffb78000026800 0041 00000000 0x0 0x0
0xffffb78000026880 0041 00000000 0x0 0x0
0xffffb78000026900 0041 00000000 0x0 0x0
0xffffb78000026980 0041 00000000 0x0 0x0
0xffffb78000026a00 0001 00000000 0x0 0x0
0xffffb78000026a80 0001 00000000 0x0 0x0
0xffffb78000026b00 0001 00000000 0x0 0x0
0xffffb78000026b80 0001 00000000 0x0 0x0
0xffffb78000026c00 0001 00000000 0x0 0x0
0xffffb78000026c80 0001 00000000 0x0 0x0
0xffffb78000026d00 0001 00000000 0x0 0x0
0xffffb78000026d80 0001 00000000 0x0 0x0
0xffffb78000026e00 0001 00000000 0x0 0x0
0xffffb78000026e80 0001 00000000 0x0 0x0
0xffffb78000026f00 0001 00000000 0x0 0x0
0xffffb78000026f80 0001 00000000 0x0 0x0
0xffffb78000027000 0001 00000000 0x0 0x0
0xffffb78000027080 0001 00000000 0x0 0x0
0xffffb78000027100 0001 00000000 0x0 0x0
0xffffb78000027180 0001 00000000 0x0 0x0
0xffffb78000027200 0001 00000000 0x0 0x0
0xffffb78000027280 0001 00000000 0x0 0x0
0xffffb78000027300 0001 00000000 0x0 0x0
0xffffb78000027380 0001 00000000 0x0 0x0
0xffffb78000027400 0001 00000000 0x0 0x0
0xffffb78000027480 0001 00000000 0x0 0x0
0xffffb78000027500 0001 00000000 0x0 0x0
0xffffb78000027580 0001 00000000 0x0 0x0
0xffffb78000027600 0001 00000000 0x0 0x0
0xffffb78000027680 0001 00000000 0x0 0x0
0xffffb78000027700 0001 00000000 0x0 0x0
0xffffb78000027780 0001 00000000 0x0 0x0
0xffffb78000027800 0001 00000000 0x0 0x0
0xffffb78000027880 0001 00000000 0x0 0x0
0xffffb78000027900 0001 00000000 0x0 0x0
0xffffb78000027980 0001 00000000 0x0 0x0
0xffffb78000027a00 0001 00000000 0x0 0x0
0xffffb78000027a80 0001 00000000 0x0 0x0
0xffffb78000027b00 0001 00000000 0x0 0x0
0xffffb78000027b80 0001 00000000 0x0 0x0
0xffffb78000027c00 0001 00000000 0x0 0x0
0xffffb78000027c80 0001 00000000 0x0 0x0
0xffffb78000027d00 0001 00000000 0x0 0x0
0xffffb78000027d80 0001 00000000 0x0 0x0
0xffffb78000027e00 0001 00000000 0x0 0x0
0xffffb78000027e80 0001 00000000 0x0 0x0
0xffffb78000027f00 0001 00000000 0x0 0x0
0xffffb78000027f80 0001 00000000 0x0 0x0
0xffffb78000028000 0001 00000000 0x0 0x0
0xffffb78000028080 0001 00000000 0x0 0x0
0xffffb78000028100 0001 00000000 0x0 0x0
0xffffb78000028180 0001 00000000 0x0 0x0
0xffffb78000028200 0001 00000000 0x0 0x0
0xffffb78000028280 0001 00000000 0x0 0x0
0xffffb78000028300 0001 00000000 0x0 0x0
0xffffb78000028380 0001 00000000 0x0 0x0
0xffffb78000028400 0001 00000000 0x0 0x0
0xffffb78000028480 0001 00000000 0x0 0x0
0xffffb78000028500 0001 00000000 0x0 0x0
0xffffb78000028580 0001 00000000 0x0 0x0
0xffffb78000028600 0001 00000000 0x0 0x0
0xffffb78000028680 0001 00000000 0x0 0x0
0xffffb78000028700 0001 00000000 0x0 0x0
0xffffb78000028780 0001 00000000 0x0 0x0
0xffffb78000028800 0001 00000000 0x0 0x0
0xffffb78000028880 0001 00000000 0x0 0x0
0xffffb78000028900 0001 00000000 0x0 0x0
0xffffb78000028980 0001 00000000 0x0 0x0
0xffffb78000028a00 0001 00000000 0x0 0x0
0xffffb78000028a80 0001 00000000 0x0 0x0
0xffffb78000028b00 0001 00000000 0x0 0x0
0xffffb78000028b80 0001 00000000 0x0 0x0
0xffffb78000028c00 0001 00000000 0x0 0x0
0xffffb78000028c80 0001 00000000 0x0 0x0
0xffffb78000028d00 0001 00000000 0x0 0x0
0xffffb78000028d80 0001 00000000 0x0 0x0
0xffffb78000028e00 0001 00000000 0x0 0x0
0xffffb78000028e80 0001 00000000 0x0 0x0
0xffffb78000028f00 0001 00000000 0x0 0x0
0xffffb78000028f80 0001 00000000 0x0 0x0
0xffffb78000029000 0001 00000000 0x0 0x0
0xffffb78000029080 0001 00000000 0x0 0x0
0xffffb78000029100 0001 00000000 0x0 0x0
0xffffb78000029180 0001 00000000 0x0 0x0
0xffffb78000029200 0001 00000000 0x0 0x0
0xffffb78000029280 0001 00000000 0x0 0x0
0xffffb78000029300 0001 00000000 0x0 0x0
0xffffb78000029380 0001 00000000 0x0 0x0
0xffffb78000029400 0001 00000000 0x0 0x0
0xffffb78000029480 0001 00000000 0x0 0x0
0xffffb78000029500 0001 00000000 0x0 0x0
0xffffb78000029580 0001 00000000 0x0 0x0
0xffffb78000029600 0001 00000000 0x0 0x0
0xffffb78000029680 0001 00000000 0x0 0x0
0xffffb78000029700 0001 00000000 0x0 0x0
0xffffb78000029780 0001 00000000 0x0 0x0
0xffffb78000029800 0001 00000000 0x0 0x0
0xffffb78000029880 0001 00000000 0x0 0x0
0xffffb78000029900 0001 00000000 0x0 0x0
0xffffb78000029980 0001 00000000 0x0 0x0
0xffffb78000029a00 0001 00000000 0x0 0x0
0xffffb78000029a80 0001 00000000 0x0 0x0
0xffffb78000029b00 0001 00000000 0x0 0x0
0xffffb78000029b80 0001 00000000 0x0 0x0
0xffffb78000029c00 0001 00000000 0x0 0x0
0xffffb78000029c80 0001 00000000 0x0 0x0
0xffffb78000029d00 0001 00000000 0x0 0x0
0xffffb78000029d80 0001 00000000 0x0 0x0
0xffffb78000029e00 0001 00000000 0x0 0x0
0xffffb78000029e80 0001 00000000 0x0 0x0
0xffffb78000029f00 0001 00000000 0x0 0x0
0xffffb78000029f80 0001 00000000 0x0 0x0
0xffffb7800002a000 0001 00000000 0x0 0x0
0xffffb7800002a080 0001 00000000 0x0 0x0
0xffffb7800002a100 0001 00000000 0x0 0x0
0xffffb7800002a180 0001 00000000 0x0 0x0
0xffffb7800002a200 0001 00000000 0x0 0x0
0xffffb7800002a280 0001 00000000 0x0 0x0
0xffffb7800002a300 0001 00000000 0x0 0x0
0xffffb7800002a380 0001 00000000 0x0 0x0
0xffffb7800002a400 0001 00000000 0x0 0x0
0xffffb7800002a480 0001 00000000 0x0 0x0
0xffffb7800002a500 0001 00000000 0x0 0x0
0xffffb7800002a580 0001 00000000 0x0 0x0
0xffffb7800002a600 0001 00000000 0x0 0x0
0xffffb7800002a680 0001 00000000 0x0 0x0
0xffffb7800002a700 0001 00000000 0x0 0x0
0xffffb7800002a780 0001 00000000 0x0 0x0
0xffffb7800002a800 0001 00000000 0x0 0x0
0xffffb7800002a880 0001 00000000 0x0 0x0
0xffffb7800002a900 0001 00000000 0x0 0x0
0xffffb7800002a980 0001 00000000 0x0 0x0
0xffffb7800002aa00 0001 00000000 0x0 0x0
0xffffb7800002aa80 0001 00000000 0x0 0x0
0xffffb7800002ab00 0001 00000000 0x0 0x0
0xffffb7800002ab80 0001 00000000 0x0 0x0
0xffffb7800002ac00 0001 00000000 0x0 0x0
0xffffb7800002ac80 0001 00000000 0x0 0x0
0xffffb7800002ad00 0001 00000000 0x0 0x0
0xffffb7800002ad80 0001 00000000 0x0 0x0
0xffffb7800002ae00 0001 00000000 0x0 0x0
0xffffb7800002ae80 0001 00000000 0x0 0x0
0xffffb7800002af00 0001 00000000 0x0 0x0
0xffffb7800002af80 0001 00000000 0x0 0x0
0xffffb7800002b000 0001 00000000 0x0 0x0
0xffffb7800002b080 0001 00000000 0x0 0x0
0xffffb7800002b100 0001 00000000 0x0 0x0
0xffffb7800002b180 0001 00000000 0x0 0x0
0xffffb7800002b200 0001 00000000 0x0 0x0
0xffffb7800002b280 0001 00000000 0x0 0x0
0xffffb7800002b300 0001 00000000 0x0 0x0
0xffffb7800002b380 0001 00000000 0x0 0x0
0xffffb7800002b400 0001 00000000 0x0 0x0
0xffffb7800002b480 0001 00000000 0x0 0x0
0xffffb7800002b500 0001 00000000 0x0 0x0
0xffffb7800002b580 0001 00000000 0x0 0x0
0xffffb7800002b600 0001 00000000 0x0 0x0
0xffffb7800002b680 0001 00000000 0x0 0x0
0xffffb7800002b700 0001 00000000 0x0 0x0
0xffffb7800002b780 0001 00000000 0x0 0x0
0xffffb7800002b800 0001 00000000 0x0 0x0
0xffffb7800002b880 0001 00000000 0x0 0x0
0xffffb7800002b900 0001 00000000 0x0 0x0
0xffffb7800002b980 0001 00000000 0x0 0x0
0xffffb7800002ba00 0001 00000000 0x0 0x0
0xffffb7800002ba80 0001 00000000 0x0 0x0
0xffffb7800002bb00 0001 00000000 0x0 0x0
0xffffb7800002bb80 0001 00000000 0x0 0x0
0xffffb7800002bc00 0001 00000000 0x0 0x0
0xffffb7800002bc80 0001 00000000 0x0 0x0
0xffffb7800002bd00 0001 00000000 0x0 0x0
0xffffb7800002bd80 0001 00000000 0x0 0x0
0xffffb7800002be00 0001 00000000 0x0 0x0
0xffffb7800002be80 0001 00000000 0x0 0x0
0xffffb7800002bf00 0001 00000000 0x0 0x0
0xffffb7800002bf80 0001 00000000 0x0 0x0
0xffffb7800002c000 0001 00000000 0x0 0x0
0xffffb7800002c080 0001 00000000 0x0 0x0
0xffffb7800002c100 0001 00000000 0x0 0x0
0xffffb7800002c180 0001 00000000 0x0 0x0
0xffffb7800002c200 0001 00000000 0x0 0x0
0xffffb7800002c280 0001 00000000 0x0 0x0
0xffffb7800002c300 0001 00000000 0x0 0x0
0xffffb7800002c380 0001 00000000 0x0 0x0
0xffffb7800002c400 0001 00000000 0x0 0x0
0xffffb7800002c480 0001 00000000 0x0 0x0
0xffffb7800002c500 0001 00000000 0x0 0x0
0xffffb7800002c580 0001 00000000 0x0 0x0
0xffffb7800002c600 0001 00000000 0x0 0x0
0xffffb7800002c680 0001 00000000 0x0 0x0
0xffffb7800002c700 0001 00000000 0x0 0x0
0xffffb7800002c780 0001 00000000 0x0 0x0
0xffffb7800002c800 0001 00000000 0x0 0x0
0xffffb7800002c880 0001 00000000 0x0 0x0
0xffffb7800002c900 0001 00000000 0x0 0x0
0xffffb7800002c980 0001 00000000 0x0 0x0
0xffffb7800002ca00 0001 00000000 0x0 0x0
0xffffb7800002ca80 0001 00000000 0x0 0x0
0xffffb7800002cb00 0001 00000000 0x0 0x0
0xffffb7800002cb80 0001 00000000 0x0 0x0
0xffffb7800002cc00 0001 00000000 0x0 0x0
0xffffb7800002cc80 0001 00000000 0x0 0x0
0xffffb7800002cd00 0001 00000000 0x0 0x0
0xffffb7800002cd80 0001 00000000 0x0 0x0
0xffffb7800002ce00 0001 00000000 0x0 0x0
0xffffb7800002ce80 0001 00000000 0x0 0x0
0xffffb7800002cf00 0001 00000000 0x0 0x0
0xffffb7800002cf80 0001 00000000 0x0 0x0
0xffffb7800002d000 0001 00000000 0x0 0x0
0xffffb7800002d080 0001 00000000 0x0 0x0
0xffffb7800002d100 0001 00000000 0x0 0x0
0xffffb7800002d180 0001 00000000 0x0 0x0
0xffffb7800002d200 0001 00000000 0x0 0x0
0xffffb7800002d280 0001 00000000 0x0 0x0
0xffffb7800002d300 0001 00000000 0x0 0x0
0xffffb7800002d380 0001 00000000 0x0 0x0
0xffffb7800002d400 0001 00000000 0x0 0x0
0xffffb7800002d480 0001 00000000 0x0 0x0
0xffffb7800002d500 0001 00000000 0x0 0x0
0xffffb7800002d580 0001 00000000 0x0 0x0
0xffffb7800002d600 0001 00000000 0x0 0x0
0xffffb7800002d680 0001 00000000 0x0 0x0
0xffffb7800002d700 0001 00000000 0x0 0x0
0xffffb7800002d780 0001 00000000 0x0 0x0
0xffffb7800002d800 0001 00000000 0x0 0x0
0xffffb7800002d880 0001 00000000 0x0 0x0
0xffffb7800002d900 0001 00000000 0x0 0x0
0xffffb7800002d980 0001 00000000 0x0 0x0
0xffffb7800002da00 0001 00000000 0x0 0x0
0xffffb7800002da80 0001 00000000 0x0 0x0
0xffffb7800002db00 0001 00000000 0x0 0x0
0xffffb7800002db80 0001 00000000 0x0 0x0
0xffffb7800002dc00 0001 00000000 0x0 0x0
0xffffb7800002dc80 0001 00000000 0x0 0x0
0xffffb7800002dd00 0001 00000000 0x0 0x0
0xffffb7800002dd80 0001 00000000 0x0 0x0
0xffffb7800002de00 0001 00000000 0x0 0x0
0xffffb7800002de80 0001 00000000 0x0 0x0
0xffffb7800002df00 0001 00000000 0x0 0x0
0xffffb7800002df80 0001 00000000 0x0 0x0
0xffffb7800002e000 0001

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

May 31, 2020, 1:15:16 PM5/31/20

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following crash on:

HEAD commit: 210304d1 Use device_xname() to access dv_xname
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=168972de100000

kernel config: https://syzkaller.appspot.com/x/.config?x=5702129db7f7788d
dashboard link: https://syzkaller.appspot.com/bug?extid=c7e74d0ae89e9f08f863
compiler: g++ (Ubuntu 5.4.0-6ubuntu1~16.04.12) 5.4.0 20160609

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124ca9ce100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b03586100000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c7e74d...@syzkaller.appspotmail.com

[ 51.0647836] panic: ASan: Unauthorized Access In 0xffffffff806b5ca6: Addr 0xffffba80129bca04 [1 byte, read, PoolUseAfterFree]

[ 51.0847667] cpu1: Begin traceback...
[ 51.0947695] vpanic() at netbsd:vpanic+0x22e sys/kern/subr_prf.c:290
[ 51.1147711] snprintf() at netbsd:snprintf
[ 51.1447696] kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:187 [inline]
[ 51.1447696] kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:197
[ 51.1747698] __asan_load1_noabort() at netbsd:__asan_load1_noabort
[ 51.1947684] usb_free_device() at netbsd:usb_free_device+0x79 sys/dev/usb/usb_subr.c:1557
[ 51.2247674] usb_disconnect_port() at netbsd:usb_disconnect_port+0x30c sys/dev/usb/usb_subr.c:1647
[ 51.2447682] uhub_explore() at netbsd:uhub_explore+0x4ee sys/dev/usb/uhub.c:639
[ 51.2747697] usb_discover.isra.2() at netbsd:usb_discover.isra.2+0x18c
[ 51.3047735] usb_event_thread() at netbsd:usb_event_thread+0xd9 sys/dev/usb/usb.c:652
[ 51.3147696] cpu1: End traceback...
[ 51.3247701] fatal breakpoint trap in supervisor mode
[ 51.3247701] trap type 1 code 0 rip 0xffffffff8022094d cs 0x8 rflags 0x282 cr2 0x70e9d6c1e0b0 ilevel 0 rsp 0xffffba81800baab0
[ 51.3347754] curlwp 0xffffba80128fc9c0 pid 0.122 lowest kstack 0xffffba81800b32c0

Stopped in pid 0.122 (system) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xe9 sys/ddb/db_panic.c:67
vpanic() at netbsd:vpanic+0x22e sys/kern/subr_prf.c:290
snprintf() at netbsd:snprintf
kasan_report() at netbsd:kasan_report+0x9c kasan_code_name sys/kern/subr_asan.c:187 [inline]
kasan_report() at netbsd:kasan_report+0x9c sys/kern/subr_asan.c:197
__asan_load1_noabort() at netbsd:__asan_load1_noabort
usb_free_device() at netbsd:usb_free_device+0x79 sys/dev/usb/usb_subr.c:1557
usb_disconnect_port() at netbsd:usb_disconnect_port+0x30c sys/dev/usb/usb_subr.c:1647
uhub_explore() at netbsd:uhub_explore+0x4ee sys/dev/usb/uhub.c:639
usb_discover.isra.2() at netbsd:usb_discover.isra.2+0x18c
usb_event_thread() at netbsd:usb_event_thread+0xd9 sys/dev/usb/usb.c:652
ds 3d2f
es f577
fs aa90
gs aae0
rdi ffffffff82bd8bc0 db_onpanic
rsi 1ffffffff057b178

rbp ffffba81800baab0
rbx ffffba816e699000

rdx 0
rcx ffffffff8126f839 db_panic+0xd5

rax ffffba80128fc9c0

r8 4
r9 1ffffffff057b178
r10 ffffffff82bd8bc3 db_onpanic+0x3
r11 10

r12 ffffba816e6aa000
r13 ffffffff8243e950 ostype+0x709b0
r14 ffffba81800bab40
r15 ffffba816e699060

rip ffffffff8022094d breakpoint+0x5
cs 8
rflags 282

rsp ffffba81800baab0

ss 10
netbsd:breakpoint+0x5: leave
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1105 1105 2 0 40000 ffffba8012b34780 syz-executor0368
1097 1097 2 1 40000 ffffba80136f3340 syz-executor0368
1099 1099 2 0 40000 ffffba8012d6a2c0 syz-executor0368
821 821 2 0 40 ffffba8014076940 syz-executor0368
814 814 2 1 40 ffffba8014076500 syz-executor0368
695 695 2 1 40 ffffba80137d19c0 syz-executor0368
811 811 2 1 40040 ffffba80137d1580 syz-executor0368
1211 1211 2 1 40 ffffba80137fca40 syz-executor0368
808 808 2 0 40 ffffba80137fc600 syz-executor0368
856 856 2 0 40 ffffba8012c97040 syz-executor0368
810 810 3 0 80 ffffba8012b508c0 syz-executor0368 nanoslp
729 729 2 0 0 ffffba8012b50480 sshd
855 855 3 0 80 ffffba8012747b80 getty nanoslp
719 719 3 0 80 ffffba8012747300 getty nanoslp
1505 1505 3 0 80 ffffba80138c2080 getty nanoslp
1189 1189 3 0 c0 ffffba80129cc640 getty ttyraw
726 726 3 0 80 ffffba80137c7100 sshd select
578 578 3 0 80 ffffba8012d2e680 powerd kqueue
435 435 2 1 0 ffffba801385db00 syslogd
308 308 3 0 80 ffffba8012c07a40 dhcpcd kqueue
310 310 3 0 80 ffffba8012c87340 dhcpcd kqueue
306 306 3 0 80 ffffba8012c2aa80 dhcpcd kqueue
349 349 3 0 80 ffffba8012c54280 dhcpcd kqueue
205 205 3 0 80 ffffba8013724040 dhcpcd kqueue
200 200 3 0 80 ffffba8012d8e740 dhcpcd kqueue
199 199 3 0 80 ffffba8012d8e300 dhcpcd kqueue
198 198 3 0 80 ffffba8012d6ab40 dhcpcd kqueue
1 1 3 0 80 ffffba80128e8980 init wait
0 714 3 0 200 ffffba80129655c0 physiod physiod
0 63 3 0 200 ffffba8012967600 pooldrain pooldrain
0 > 126 7 0 240 ffffba80129671c0 ioflush
0 125 3 1 200 ffffba8012965a00 pgdaemon pgdaemon
0 > 122 7 1 240 ffffba80128fc9c0 usb0
0 121 3 1 200 ffffba80128fc580 usbtask-dr usbtsk
0 120 3 1 200 ffffba800fe5cac0 usbtask-hc usbtsk
0 119 3 0 200 ffffba80128fc140 npfgc0 npfgcw
0 118 3 1 200 ffffba80128e8540 rt_free rt_free
0 117 3 1 200 ffffba80128e8100 unpgc unpgc
0 116 3 0 200 ffffba80128df940 key_timehandler key_timehandler
0 115 3 1 200 ffffba80128df500 icmp6_wqinput/1 icmp6_wqinput
0 114 3 0 200 ffffba80128df0c0 icmp6_wqinput/0 icmp6_wqinput
0 113 3 0 200 ffffba80128d6900 nd6_timer nd6_timer
0 112 3 1 200 ffffba80128d64c0 carp6_wqinput/1 carp6_wqinput
0 111 3 0 200 ffffba80128d6080 carp6_wqinput/0 carp6_wqinput
0 110 3 1 200 ffffba80127598c0 carp_wqinput/1 carp_wqinput
0 109 3 0 200 ffffba8012759480 carp_wqinput/0 carp_wqinput
0 108 3 1 200 ffffba8012759040 icmp_wqinput/1 icmp_wqinput
0 107 3 0 200 ffffba8012748bc0 icmp_wqinput/0 icmp_wqinput
0 106 3 0 200 ffffba8012748340 rt_timer rt_timer
0 105 2 1 200 ffffba8012748780 vmem_rehash
0 104 3 0 200 ffffba8012744b40 entbutler entropy
0 30 3 1 200 ffffba80121626c0 vioif0_txrx/1 vioif0_txrx
0 29 3 0 200 ffffba8012162280 vioif0_txrx/0 vioif0_txrx
0 27 3 0 200 ffffba800fe5c680 scsibus0 sccomp
0 26 3 0 200 ffffba800fe5c240 pms0 pmsreset
0 25 3 1 200 ffffba800fd9da80 xcall/1 xcall
0 24 1 1 200 ffffba800fd9d640 softser/1
0 23 1 1 200 ffffba800fd9d200 softclk/1
0 22 1 1 200 ffffba800fd9ba40 softbio/1
0 21 1 1 200 ffffba800fd9b600 softnet/1
0 20 1 1 201 ffffba800fd9b1c0 idle/1
0 19 3 0 200 ffffba800e80aa00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffffba800e80a5c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffffba800e80a180 lnxsyswq lnxsyswq
0 16 3 0 200 ffffba800e8049c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffba800e804580 sysmon smtaskq
0 14 3 0 200 ffffba800e804140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffba800e7ff980 pmfevent pmfevent
0 12 3 0 200 ffffba800e7ff540 sopendfree sopendfr
0 11 3 0 200 ffffba800e7ff100 iflnkst iflnkst
0 10 3 0 200 ffffba800e7f3940 nfssilly nfssilly
0 9 3 0 200 ffffba800e7f3500 vdrain vdrain
0 8 3 0 200 ffffba800e7f30c0 modunload mod_unld
0 7 3 0 200 ffffba800e7e6900 xcall/0 xcall
0 6 1 0 200 ffffba800e7e64c0 softser/0
0 5 1 0 200 ffffba800e7e6080 softclk/0
0 4 1 0 200 ffffba800e7e48c0 softbio/0
0 3 1 0 200 ffffba800e7e4480 softnet/0
0 2 1 0 201 ffffba800e7e4040 idle/0

0 0 3 0 200 ffffffff82ca4080 swapper uvm
[Locks tracked through LWPs]

****** LWP 1099.1099 (syz-executor0368) @ 0xffffba8012d6a2c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffffba8012cdcd80 type : sleep/adaptive
initialized : 0xffffffff80870a87
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffba8012d6a2c0 last held: 0xffffba8012d6a2c0
last locked* : 0xffffffff808725c6 unlocked : 0xffffffff80870745
owner field : 0xffffba8012d6a2c0 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 310.310 (dhcpcd) @ 0xffffba8012c87340, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff82d9c840 type : sleep/adaptive
initialized : 0xffffffff816d2c22
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffba8012c87340 last held: 000000000000000000