18a272653SPeter Holm#!/bin/sh 28a272653SPeter Holm 38a272653SPeter Holm# panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb 48a272653SPeter Holm# cpuid = 20 58a272653SPeter Holm# time = 1593501338 68a272653SPeter Holm# KDB: stack backtrace: 78a272653SPeter Holm# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe013eaf7e90 88a272653SPeter Holm# vpanic() at vpanic+0x182/frame 0xfffffe013eaf7ee0 98a272653SPeter Holm# panic() at panic+0x43/frame 0xfffffe013eaf7f40 108a272653SPeter Holm# ip6_setmoptions() at ip6_setmoptions+0x23b3/frame 0xfffffe013eaf8120 118a272653SPeter Holm# ip6_ctloutput() at ip6_ctloutput+0x1f5/frame 0xfffffe013eaf89f0 128a272653SPeter Holm# sosetopt() at sosetopt+0xed/frame 0xfffffe013eaf8a50 138a272653SPeter Holm# kern_setsockopt() at kern_setsockopt+0xac/frame 0xfffffe013eaf8ab0 148a272653SPeter Holm# sys_setsockopt() at sys_setsockopt+0x24/frame 0xfffffe013eaf8ad0 158a272653SPeter Holm# amd64_syscall() at amd64_syscall+0x159/frame 0xfffffe013eaf8bf0 168a272653SPeter Holm# fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe013eaf8bf0 178a272653SPeter Holm# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x80042813a, rsp = 0x7fffffffe518, rbp = 0x7fffffffe570 --- 188a272653SPeter Holm# KDB: enter: panic 198a272653SPeter Holm# [ thread pid 2853 tid 100445 ] 208a272653SPeter Holm# Stopped at kdb_enter+0x37: movq $0,0x10c4cf6(%rip) 218a272653SPeter Holm# db> x/s version 228a272653SPeter Holm# version: FreeBSD 13.0-CURRENT #0 r362791: Tue Jun 30 08:57:50 CEST 2020 238a272653SPeter Holm# pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO 248a272653SPeter Holm# db> reset 258a272653SPeter Holm 268a272653SPeter Holm[ `uname -p` != "amd64" ] && exit 0 278a272653SPeter Holm 288a272653SPeter Holm. ../default.cfg 298a272653SPeter Holmcat > /tmp/syzkaller18.c <<EOF 308a272653SPeter Holm// https://syzkaller.appspot.com/bug?id=c3fe7740671182fd120fa95c67cf305caa9c3397 318a272653SPeter Holm// autogenerated by syzkaller (https://github.com/google/syzkaller) 328a272653SPeter Holm// Reported-by: syzbot+d01ab3d5e6c1516a393c@syzkaller.appspotmail.com 338a272653SPeter Holm 348a272653SPeter Holm#define _GNU_SOURCE 358a272653SPeter Holm 368a272653SPeter Holm#include <pwd.h> 378a272653SPeter Holm#include <stdarg.h> 388a272653SPeter Holm#include <stdbool.h> 398a272653SPeter Holm#include <stdint.h> 408a272653SPeter Holm#include <stdio.h> 418a272653SPeter Holm#include <stdlib.h> 428a272653SPeter Holm#include <string.h> 438a272653SPeter Holm#include <sys/endian.h> 448a272653SPeter Holm#include <sys/syscall.h> 458a272653SPeter Holm#include <unistd.h> 468a272653SPeter Holm 478a272653SPeter Holmuint64_t r[1] = {0xffffffffffffffff}; 488a272653SPeter Holm 498a272653SPeter Holmint main(void) 508a272653SPeter Holm{ 518a272653SPeter Holm syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 528a272653SPeter Holm intptr_t res = 0; 538a272653SPeter Holm res = syscall(SYS_socket, 0x1cul, 2ul, 0); 548a272653SPeter Holm if (res != -1) 558a272653SPeter Holm r[0] = res; 568a272653SPeter Holm *(uint32_t*)0x200001c0 = 0; 578a272653SPeter Holm syscall(SYS_setsockopt, r[0], 0x29, 0x1b, 0x200001c0ul, 4ul); 588a272653SPeter Holm *(uint8_t*)0x20000080 = 0x1c; 598a272653SPeter Holm *(uint8_t*)0x20000081 = 0x1c; 608a272653SPeter Holm *(uint16_t*)0x20000082 = htobe16(0x4e20); 618a272653SPeter Holm *(uint32_t*)0x20000084 = 0; 628a272653SPeter Holm *(uint8_t*)0x20000088 = 0; 638a272653SPeter Holm *(uint8_t*)0x20000089 = 0; 648a272653SPeter Holm *(uint8_t*)0x2000008a = 0; 658a272653SPeter Holm *(uint8_t*)0x2000008b = 0; 668a272653SPeter Holm *(uint8_t*)0x2000008c = 0; 678a272653SPeter Holm *(uint8_t*)0x2000008d = 0; 688a272653SPeter Holm *(uint8_t*)0x2000008e = 0; 698a272653SPeter Holm *(uint8_t*)0x2000008f = 0; 708a272653SPeter Holm *(uint8_t*)0x20000090 = 0; 718a272653SPeter Holm *(uint8_t*)0x20000091 = 0; 728a272653SPeter Holm *(uint8_t*)0x20000092 = -1; 738a272653SPeter Holm *(uint8_t*)0x20000093 = -1; 748a272653SPeter Holm *(uint32_t*)0x20000094 = htobe32(0x7f000001); 758a272653SPeter Holm *(uint32_t*)0x20000098 = 0; 768a272653SPeter Holm syscall(SYS_bind, r[0], 0x20000080ul, 0x18ul); 778a272653SPeter Holm *(uint32_t*)0x200002c0 = 0; 788a272653SPeter Holm *(uint8_t*)0x200002c8 = 0x1c; 798a272653SPeter Holm *(uint8_t*)0x200002c9 = 0x1c; 808a272653SPeter Holm *(uint16_t*)0x200002ca = htobe16(0x4e23); 818a272653SPeter Holm *(uint32_t*)0x200002cc = 4; 828a272653SPeter Holm *(uint8_t*)0x200002d0 = -1; 838a272653SPeter Holm *(uint8_t*)0x200002d1 = 1; 848a272653SPeter Holm *(uint8_t*)0x200002d2 = 0; 858a272653SPeter Holm *(uint8_t*)0x200002d3 = 0; 868a272653SPeter Holm *(uint8_t*)0x200002d4 = 0; 878a272653SPeter Holm *(uint8_t*)0x200002d5 = 0; 888a272653SPeter Holm *(uint8_t*)0x200002d6 = 0; 898a272653SPeter Holm *(uint8_t*)0x200002d7 = 0; 908a272653SPeter Holm *(uint8_t*)0x200002d8 = 0; 918a272653SPeter Holm *(uint8_t*)0x200002d9 = 0; 928a272653SPeter Holm *(uint8_t*)0x200002da = 0; 938a272653SPeter Holm *(uint8_t*)0x200002db = 0; 948a272653SPeter Holm *(uint8_t*)0x200002dc = 0; 958a272653SPeter Holm *(uint8_t*)0x200002dd = 0; 968a272653SPeter Holm *(uint8_t*)0x200002de = 0; 978a272653SPeter Holm *(uint8_t*)0x200002df = 1; 988a272653SPeter Holm *(uint32_t*)0x200002e0 = 0x80000000; 998a272653SPeter Holm *(uint64_t*)0x200002e8 = 0; 1008a272653SPeter Holm *(uint64_t*)0x200002f0 = 0; 1018a272653SPeter Holm *(uint64_t*)0x200002f8 = 0; 1028a272653SPeter Holm *(uint64_t*)0x20000300 = 0; 1038a272653SPeter Holm *(uint64_t*)0x20000308 = 0; 1048a272653SPeter Holm *(uint64_t*)0x20000310 = 0; 1058a272653SPeter Holm *(uint64_t*)0x20000318 = 0; 1068a272653SPeter Holm *(uint64_t*)0x20000320 = 0; 1078a272653SPeter Holm *(uint64_t*)0x20000328 = 0; 1088a272653SPeter Holm *(uint64_t*)0x20000330 = 0; 1098a272653SPeter Holm *(uint64_t*)0x20000338 = 0; 1108a272653SPeter Holm *(uint64_t*)0x20000340 = 0; 1118a272653SPeter Holm syscall(SYS_setsockopt, r[0], 0x29, 0x51, 0x200002c0ul, 0x88ul); 1128a272653SPeter Holm return 0; 1138a272653SPeter Holm} 1148a272653SPeter HolmEOF 1158a272653SPeter Holmmycc -o /tmp/syzkaller18 -Wall -Wextra -O0 /tmp/syzkaller18.c || 1168a272653SPeter Holm exit 1 1178a272653SPeter Holm 1188a272653SPeter Holm(cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) & 1198a272653SPeter Holmstart=`date +%s` 1208a272653SPeter Holmwhile pgrep -q swap; do 1218a272653SPeter Holm (cd /tmp; timeout 1m ./syzkaller18) 1228a272653SPeter Holm [ $((`date +%s` - start)) -ge 60 ] && break 1238a272653SPeter Holmdone 124*2f0baec1SPeter Holmpkill -9 syzkaller18 125*2f0baec1SPeter Holmwhile pkill swap; do sleep 1; done 1268a272653SPeter Holmwait 1278a272653SPeter Holm 1288a272653SPeter Holmrm -f /tmp/syzkaller18 /tmp/syzkaller18.c /tmp/syzkaller18.core 1298a272653SPeter Holmexit 0 130