1*8a272653SPeter Holm#!/bin/sh 2*8a272653SPeter Holm 3*8a272653SPeter Holm# panic: sbsndptr_noadv: sb_mb is NULL 4*8a272653SPeter Holm# cpuid = 0 5*8a272653SPeter Holm# time = 1586867804 6*8a272653SPeter Holm# KDB: stack backtrace: 7*8a272653SPeter Holm# db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0025a68360 8*8a272653SPeter Holm# vpanic() at vpanic+0x1c7/frame 0xfffffe0025a683c0 9*8a272653SPeter Holm# panic() at panic+0x43/frame 0xfffffe0025a68420 10*8a272653SPeter Holm# sbsndptr_noadv() at sbsndptr_noadv+0xae/frame 0xfffffe0025a68460 11*8a272653SPeter Holm# rack_output() at rack_output+0x51f5/frame 0xfffffe0025a68700 12*8a272653SPeter Holm# tcp_usr_send() at tcp_usr_send+0x5c7/frame 0xfffffe0025a687e0 13*8a272653SPeter Holm# sosend_generic() at sosend_generic+0x8fd/frame 0xfffffe0025a688e0 14*8a272653SPeter Holm# sosend() at sosend+0xc6/frame 0xfffffe0025a68950 15*8a272653SPeter Holm# kern_sendit() at kern_sendit+0x33d/frame 0xfffffe0025a68a00 16*8a272653SPeter Holm# sendit() at sendit+0x224/frame 0xfffffe0025a68a60 17*8a272653SPeter Holm# sys_sendto() at sys_sendto+0x5c/frame 0xfffffe0025a68ac0 18*8a272653SPeter Holm# amd64_syscall() at amd64_syscall+0x262/frame 0xfffffe0025a68bf0 19*8a272653SPeter Holm 20*8a272653SPeter Holm[ `uname -p` = "i386" ] && exit 0 21*8a272653SPeter Holm 22*8a272653SPeter Holm. ../default.cfg 23*8a272653SPeter Holmcat > /tmp/syzkaller10.c <<EOF 24*8a272653SPeter Holm// https://syzkaller.appspot.com/bug?id=048f650e99696f881872a285cef0e3b9bd4f4e25 25*8a272653SPeter Holm// autogenerated by syzkaller (https://github.com/google/syzkaller) 26*8a272653SPeter Holm 27*8a272653SPeter Holm#define _GNU_SOURCE 28*8a272653SPeter Holm 29*8a272653SPeter Holm#include <pwd.h> 30*8a272653SPeter Holm#include <stdarg.h> 31*8a272653SPeter Holm#include <stdbool.h> 32*8a272653SPeter Holm#include <stdint.h> 33*8a272653SPeter Holm#include <stdio.h> 34*8a272653SPeter Holm#include <stdlib.h> 35*8a272653SPeter Holm#include <string.h> 36*8a272653SPeter Holm#include <sys/endian.h> 37*8a272653SPeter Holm#include <sys/syscall.h> 38*8a272653SPeter Holm#include <unistd.h> 39*8a272653SPeter Holm 40*8a272653SPeter Holmuint64_t r[1] = {0xffffffffffffffff}; 41*8a272653SPeter Holm 42*8a272653SPeter Holmint main(void) 43*8a272653SPeter Holm{ 44*8a272653SPeter Holm syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul); 45*8a272653SPeter Holm intptr_t res = 0; 46*8a272653SPeter Holm res = syscall(SYS_socket, 2ul, 1ul, 0); 47*8a272653SPeter Holm if (res != -1) 48*8a272653SPeter Holm r[0] = res; 49*8a272653SPeter Holm memcpy((void*)0x20000080, 50*8a272653SPeter Holm "rack\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 51*8a272653SPeter Holm "\000\000\000\000\000\000\000\000\000\000\000\000", 52*8a272653SPeter Holm 32); 53*8a272653SPeter Holm *(uint32_t*)0x200000a0 = 0; 54*8a272653SPeter Holm syscall(SYS_setsockopt, r[0], 6, 0x2000, 0x20000080ul, 0x24ul); 55*8a272653SPeter Holm *(uint8_t*)0x20000000 = 0x2c; 56*8a272653SPeter Holm *(uint8_t*)0x20000001 = 2; 57*8a272653SPeter Holm *(uint16_t*)0x20000002 = htobe16(0x4e21); 58*8a272653SPeter Holm *(uint32_t*)0x20000004 = htobe32(-1); 59*8a272653SPeter Holm *(uint8_t*)0x20000008 = 0; 60*8a272653SPeter Holm *(uint8_t*)0x20000009 = 0; 61*8a272653SPeter Holm *(uint8_t*)0x2000000a = 0; 62*8a272653SPeter Holm *(uint8_t*)0x2000000b = 0; 63*8a272653SPeter Holm *(uint8_t*)0x2000000c = 0; 64*8a272653SPeter Holm *(uint8_t*)0x2000000d = 0; 65*8a272653SPeter Holm *(uint8_t*)0x2000000e = 0; 66*8a272653SPeter Holm *(uint8_t*)0x2000000f = 0; 67*8a272653SPeter Holm syscall(SYS_sendto, r[0], 0ul, 0ul, 0ul, 0x20000000ul, 0x10ul); 68*8a272653SPeter Holm *(uint8_t*)0x20000040 = 0x10; 69*8a272653SPeter Holm *(uint8_t*)0x20000041 = 2; 70*8a272653SPeter Holm *(uint16_t*)0x20000042 = htobe16(0x4e21); 71*8a272653SPeter Holm *(uint32_t*)0x20000044 = htobe32(0); 72*8a272653SPeter Holm *(uint8_t*)0x20000048 = 0; 73*8a272653SPeter Holm *(uint8_t*)0x20000049 = 0; 74*8a272653SPeter Holm *(uint8_t*)0x2000004a = 0; 75*8a272653SPeter Holm *(uint8_t*)0x2000004b = 0; 76*8a272653SPeter Holm *(uint8_t*)0x2000004c = 0; 77*8a272653SPeter Holm *(uint8_t*)0x2000004d = 0; 78*8a272653SPeter Holm *(uint8_t*)0x2000004e = 0; 79*8a272653SPeter Holm *(uint8_t*)0x2000004f = 0; 80*8a272653SPeter Holm syscall(SYS_sendto, r[0], 0ul, 0ul, 0x60005ul, 0x20000040ul, 0x10ul); 81*8a272653SPeter Holm return 0; 82*8a272653SPeter Holm} 83*8a272653SPeter HolmEOF 84*8a272653SPeter Holmmycc -o /tmp/syzkaller10 -Wall -Wextra -O2 /tmp/syzkaller10.c -lpthread || 85*8a272653SPeter Holm exit 1 86*8a272653SPeter Holm 87*8a272653SPeter Holm(cd /tmp; ./syzkaller10) & 88*8a272653SPeter Holmsleep 60 89*8a272653SPeter Holmpkill -9 syzkaller10 90*8a272653SPeter Holmwait 91*8a272653SPeter Holm 92*8a272653SPeter Holmrm -f /tmp/syzkaller10 /tmp/syzkaller10.c /tmp/syzkaller10.core 93*8a272653SPeter Holmexit 0 94