#!/bin/sh

# panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb
# cpuid = 20
# time = 1593501338
# KDB: stack backtrace:
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe013eaf7e90
# vpanic() at vpanic+0x182/frame 0xfffffe013eaf7ee0
# panic() at panic+0x43/frame 0xfffffe013eaf7f40
# ip6_setmoptions() at ip6_setmoptions+0x23b3/frame 0xfffffe013eaf8120
# ip6_ctloutput() at ip6_ctloutput+0x1f5/frame 0xfffffe013eaf89f0
# sosetopt() at sosetopt+0xed/frame 0xfffffe013eaf8a50
# kern_setsockopt() at kern_setsockopt+0xac/frame 0xfffffe013eaf8ab0
# sys_setsockopt() at sys_setsockopt+0x24/frame 0xfffffe013eaf8ad0
# amd64_syscall() at amd64_syscall+0x159/frame 0xfffffe013eaf8bf0
# fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe013eaf8bf0
# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x80042813a, rsp = 0x7fffffffe518, rbp = 0x7fffffffe570 ---
# KDB: enter: panic
# [ thread pid 2853 tid 100445 ]
# Stopped at      kdb_enter+0x37: movq    $0,0x10c4cf6(%rip)
# db> x/s version
# version: FreeBSD 13.0-CURRENT #0 r362791: Tue Jun 30 08:57:50 CEST 2020
# pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO
# db> reset

[ `uname -p` != "amd64" ] && exit 0

. ../default.cfg
cat > /tmp/syzkaller18.c <<EOF
// https://syzkaller.appspot.com/bug?id=c3fe7740671182fd120fa95c67cf305caa9c3397
// autogenerated by syzkaller (https://github.com/google/syzkaller)
// Reported-by: syzbot+d01ab3d5e6c1516a393c@syzkaller.appspotmail.com

#define _GNU_SOURCE

#include <pwd.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <unistd.h>

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
  intptr_t res = 0;
  res = syscall(SYS_socket, 0x1cul, 2ul, 0);
  if (res != -1)
    r[0] = res;
  *(uint32_t*)0x200001c0 = 0;
  syscall(SYS_setsockopt, r[0], 0x29, 0x1b, 0x200001c0ul, 4ul);
  *(uint8_t*)0x20000080 = 0x1c;
  *(uint8_t*)0x20000081 = 0x1c;
  *(uint16_t*)0x20000082 = htobe16(0x4e20);
  *(uint32_t*)0x20000084 = 0;
  *(uint8_t*)0x20000088 = 0;
  *(uint8_t*)0x20000089 = 0;
  *(uint8_t*)0x2000008a = 0;
  *(uint8_t*)0x2000008b = 0;
  *(uint8_t*)0x2000008c = 0;
  *(uint8_t*)0x2000008d = 0;
  *(uint8_t*)0x2000008e = 0;
  *(uint8_t*)0x2000008f = 0;
  *(uint8_t*)0x20000090 = 0;
  *(uint8_t*)0x20000091 = 0;
  *(uint8_t*)0x20000092 = -1;
  *(uint8_t*)0x20000093 = -1;
  *(uint32_t*)0x20000094 = htobe32(0x7f000001);
  *(uint32_t*)0x20000098 = 0;
  syscall(SYS_bind, r[0], 0x20000080ul, 0x18ul);
  *(uint32_t*)0x200002c0 = 0;
  *(uint8_t*)0x200002c8 = 0x1c;
  *(uint8_t*)0x200002c9 = 0x1c;
  *(uint16_t*)0x200002ca = htobe16(0x4e23);
  *(uint32_t*)0x200002cc = 4;
  *(uint8_t*)0x200002d0 = -1;
  *(uint8_t*)0x200002d1 = 1;
  *(uint8_t*)0x200002d2 = 0;
  *(uint8_t*)0x200002d3 = 0;
  *(uint8_t*)0x200002d4 = 0;
  *(uint8_t*)0x200002d5 = 0;
  *(uint8_t*)0x200002d6 = 0;
  *(uint8_t*)0x200002d7 = 0;
  *(uint8_t*)0x200002d8 = 0;
  *(uint8_t*)0x200002d9 = 0;
  *(uint8_t*)0x200002da = 0;
  *(uint8_t*)0x200002db = 0;
  *(uint8_t*)0x200002dc = 0;
  *(uint8_t*)0x200002dd = 0;
  *(uint8_t*)0x200002de = 0;
  *(uint8_t*)0x200002df = 1;
  *(uint32_t*)0x200002e0 = 0x80000000;
  *(uint64_t*)0x200002e8 = 0;
  *(uint64_t*)0x200002f0 = 0;
  *(uint64_t*)0x200002f8 = 0;
  *(uint64_t*)0x20000300 = 0;
  *(uint64_t*)0x20000308 = 0;
  *(uint64_t*)0x20000310 = 0;
  *(uint64_t*)0x20000318 = 0;
  *(uint64_t*)0x20000320 = 0;
  *(uint64_t*)0x20000328 = 0;
  *(uint64_t*)0x20000330 = 0;
  *(uint64_t*)0x20000338 = 0;
  *(uint64_t*)0x20000340 = 0;
  syscall(SYS_setsockopt, r[0], 0x29, 0x51, 0x200002c0ul, 0x88ul);
  return 0;
}
EOF
mycc -o /tmp/syzkaller18 -Wall -Wextra -O0 /tmp/syzkaller18.c ||
    exit 1

(cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) &
start=`date +%s`
while pgrep -q swap; do
	(cd /tmp; timeout 1m ./syzkaller18)
	[ $((`date +%s` - start)) -ge 60 ] && break
done
pkill -9 syzkaller18
while pkill swap; do sleep 1; done
wait

rm -f /tmp/syzkaller18 /tmp/syzkaller18.c /tmp/syzkaller18.core
exit 0