1#!/bin/sh 2 3# panic: m_apply, length > size of mbuf chain (8 extra) 4# cpuid = 1 5# time = 1753341719 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01f00c5080 8# vpanic() at vpanic+0x136/frame 0xfffffe01f00c51b0 9# panic() at panic+0x43/frame 0xfffffe01f00c5210 10# m_apply() at m_apply+0x2d3/frame 0xfffffe01f00c5260 11# sctp_delayed_cksum() at sctp_delayed_cksum+0x4c/frame 0xfffffe01f00c5290 12# ip6_output_delayed_csum() at ip6_output_delayed_csum+0xaa/frame 0xfffffe01f00c52d0 13# ip6_output() at ip6_output+0x19e6/frame 0xfffffe01f00c5490 14# sctp_lowlevel_chunk_output() at sctp_lowlevel_chunk_output+0x104f/frame 0xfffffe01f00c55d0 15# sctp_med_chunk_output() at sctp_med_chunk_output+0x2ad2/frame 0xfffffe01f00c5fb0 16# sctp_chunk_output() at sctp_chunk_output+0x121c/frame 0xfffffe01f00c6960 17# sctp_lower_sosend() at sctp_lower_sosend+0x146c/frame 0xfffffe01f00c6b50 18# sctp_sosend() at sctp_sosend+0x333/frame 0xfffffe01f00c6c70 19# sousrsend() at sousrsend+0x79/frame 0xffkern_sendit() at kern_sendit+0x1be/frame 0xfffffe01f00c6d60 20# sendit() at sendit+0x1ab/frame 0xfffffe01f00c6db0 21# sys_sendto() at sys_sendto+0x4d/frame 0xfffffe01f00c6e00 22# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe01f00c6f30 23# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01f00c6f30 24# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x823035b0a, rsp = 0x8208fa048, rbp = 0x8208fa060 --- 25# KDB: enter: panic 26# [ thread pid 41871 tid 736799 ] 27# Stopped at kdb_enter+0x33: movq $0,0x1231b52(%rip) 28# db> x/s version 29# version: FreeBSD 15.0-CURRENT #0 main-n279001-7502c1f27082-dirty: Wed Jul 23 20:31:48 CEST 2025 30# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO 31# db> 32 33[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 34 35. ../default.cfg 36set -u 37prog=$(basename "$0" .sh) 38cat > /tmp/$prog.c <<EOF 39// https://syzkaller.appspot.com/bug?id=09297b76b7db4aa29c86ac971062bc078b06c0ff 40// autogenerated by syzkaller (https://github.com/google/syzkaller) 41// syzbot+73fe316271df473230eb@syzkaller.appspotmail.com 42 43#define _GNU_SOURCE 44 45#include <pwd.h> 46#include <stdarg.h> 47#include <stdbool.h> 48#include <stdint.h> 49#include <stdio.h> 50#include <stdlib.h> 51#include <string.h> 52#include <sys/endian.h> 53#include <sys/syscall.h> 54#include <unistd.h> 55 56uint64_t r[1] = {0xffffffffffffffff}; 57 58int main(void) 59{ 60 syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, 61 /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, 62 /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, 63 /*fd=*/(intptr_t)-1, /*offset=*/0ul); 64 const char* reason; 65 (void)reason; 66 intptr_t res = 0; 67 if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { 68 } 69 res = syscall(SYS_socket, /*domain=*/0x1cul, /*type=SOCK_STREAM*/ 1ul, 70 /*proto=*/0x84); 71 if (res != -1) 72 r[0] = res; 73 *(uint8_t*)0x2000000001c0 = 0x10; 74 *(uint8_t*)0x2000000001c1 = 2; 75 *(uint16_t*)0x2000000001c2 = htobe16(0x4e23); 76 *(uint32_t*)0x2000000001c4 = htobe32(0); 77 memset((void*)0x2000000001c8, 0, 8); 78 memset((void*)0x2000000001d0, 0, 112); 79 *(uint32_t*)0x200000000240 = 0; 80 *(uint32_t*)0x200000000244 = 0x5234; 81 *(uint32_t*)0x200000000248 = 0xffff; 82 *(uint32_t*)0x20000000024c = 0x314; 83 *(uint32_t*)0x200000000250 = 0x3bb; 84 *(uint16_t*)0x200000000254 = 2; 85 *(uint8_t*)0x200000000256 = 9; 86 syscall(SYS_setsockopt, /*fd=*/r[0], /*level=*/0x84, /*opt=*/0xa, 87 /*val=*/0x2000000001c0ul, /*len=*/0x98ul); 88 *(uint8_t*)0x200000000000 = 0x1c; 89 *(uint8_t*)0x200000000001 = 0x1c; 90 *(uint16_t*)0x200000000002 = htobe16(0x4e22); 91 *(uint32_t*)0x200000000004 = 0; 92 memset((void*)0x200000000008, 0, 16); 93 *(uint32_t*)0x200000000018 = 0; 94 syscall(SYS_bind, /*fd=*/r[0], /*addr=*/0x200000000000ul, /*addrlen=*/0x1cul); 95 *(uint8_t*)0x200000000180 = 0x5f; 96 *(uint8_t*)0x200000000181 = 0x1c; 97 *(uint16_t*)0x200000000182 = htobe16(0x4e22); 98 *(uint32_t*)0x200000000184 = 0; 99 *(uint64_t*)0x200000000188 = htobe64(0); 100 *(uint64_t*)0x200000000190 = htobe64(1); 101 *(uint32_t*)0x200000000198 = 0; 102 syscall(SYS_connect, /*fd=*/r[0], /*addr=*/0x200000000180ul, 103 /*addrlen=*/0x1cul); 104 memset((void*)0x2000000020c0, 209, 1); 105 syscall(SYS_sendto, /*fd=*/r[0], /*buf=*/0x2000000020c0ul, /*len=*/0xffeful, 106 /*f=MSG_NOSIGNAL|MSG_EOF|MSG_DONTWAIT|MSG_DONTROUTE*/ 0x20184ul, 107 /*addr=*/0ul, /*addrlen=*/0ul); 108 return 0; 109} 110EOF 111mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c || exit 1 112 113work=/tmp/$prog.dir 114rm -rf $work 115mkdir $work 116cd /tmp/$prog.dir 117kldstat | grep -q sctp || { kldload sctp.ko && loaded=1; } 118timeout 3m /tmp/$prog > /dev/null 2>&1 119 120rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work 121[ $loaded ] && kldunload sctp.ko 122exit 0 123