1#!/bin/sh 2 3# panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb 4# cpuid = 20 5# time = 1593501338 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe013eaf7e90 8# vpanic() at vpanic+0x182/frame 0xfffffe013eaf7ee0 9# panic() at panic+0x43/frame 0xfffffe013eaf7f40 10# ip6_setmoptions() at ip6_setmoptions+0x23b3/frame 0xfffffe013eaf8120 11# ip6_ctloutput() at ip6_ctloutput+0x1f5/frame 0xfffffe013eaf89f0 12# sosetopt() at sosetopt+0xed/frame 0xfffffe013eaf8a50 13# kern_setsockopt() at kern_setsockopt+0xac/frame 0xfffffe013eaf8ab0 14# sys_setsockopt() at sys_setsockopt+0x24/frame 0xfffffe013eaf8ad0 15# amd64_syscall() at amd64_syscall+0x159/frame 0xfffffe013eaf8bf0 16# fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe013eaf8bf0 17# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x80042813a, rsp = 0x7fffffffe518, rbp = 0x7fffffffe570 --- 18# KDB: enter: panic 19# [ thread pid 2853 tid 100445 ] 20# Stopped at kdb_enter+0x37: movq $0,0x10c4cf6(%rip) 21# db> x/s version 22# version: FreeBSD 13.0-CURRENT #0 r362791: Tue Jun 30 08:57:50 CEST 2020 23# pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO 24# db> reset 25 26[ `uname -p` != "amd64" ] && exit 0 27 28. ../default.cfg 29cat > /tmp/syzkaller18.c <<EOF 30// https://syzkaller.appspot.com/bug?id=c3fe7740671182fd120fa95c67cf305caa9c3397 31// autogenerated by syzkaller (https://github.com/google/syzkaller) 32// Reported-by: syzbot+d01ab3d5e6c1516a393c@syzkaller.appspotmail.com 33 34#define _GNU_SOURCE 35 36#include <pwd.h> 37#include <stdarg.h> 38#include <stdbool.h> 39#include <stdint.h> 40#include <stdio.h> 41#include <stdlib.h> 42#include <string.h> 43#include <sys/endian.h> 44#include <sys/syscall.h> 45#include <unistd.h> 46 47uint64_t r[1] = {0xffffffffffffffff}; 48 49int main(void) 50{ 51 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 52 intptr_t res = 0; 53 res = syscall(SYS_socket, 0x1cul, 2ul, 0); 54 if (res != -1) 55 r[0] = res; 56 *(uint32_t*)0x200001c0 = 0; 57 syscall(SYS_setsockopt, r[0], 0x29, 0x1b, 0x200001c0ul, 4ul); 58 *(uint8_t*)0x20000080 = 0x1c; 59 *(uint8_t*)0x20000081 = 0x1c; 60 *(uint16_t*)0x20000082 = htobe16(0x4e20); 61 *(uint32_t*)0x20000084 = 0; 62 *(uint8_t*)0x20000088 = 0; 63 *(uint8_t*)0x20000089 = 0; 64 *(uint8_t*)0x2000008a = 0; 65 *(uint8_t*)0x2000008b = 0; 66 *(uint8_t*)0x2000008c = 0; 67 *(uint8_t*)0x2000008d = 0; 68 *(uint8_t*)0x2000008e = 0; 69 *(uint8_t*)0x2000008f = 0; 70 *(uint8_t*)0x20000090 = 0; 71 *(uint8_t*)0x20000091 = 0; 72 *(uint8_t*)0x20000092 = -1; 73 *(uint8_t*)0x20000093 = -1; 74 *(uint32_t*)0x20000094 = htobe32(0x7f000001); 75 *(uint32_t*)0x20000098 = 0; 76 syscall(SYS_bind, r[0], 0x20000080ul, 0x18ul); 77 *(uint32_t*)0x200002c0 = 0; 78 *(uint8_t*)0x200002c8 = 0x1c; 79 *(uint8_t*)0x200002c9 = 0x1c; 80 *(uint16_t*)0x200002ca = htobe16(0x4e23); 81 *(uint32_t*)0x200002cc = 4; 82 *(uint8_t*)0x200002d0 = -1; 83 *(uint8_t*)0x200002d1 = 1; 84 *(uint8_t*)0x200002d2 = 0; 85 *(uint8_t*)0x200002d3 = 0; 86 *(uint8_t*)0x200002d4 = 0; 87 *(uint8_t*)0x200002d5 = 0; 88 *(uint8_t*)0x200002d6 = 0; 89 *(uint8_t*)0x200002d7 = 0; 90 *(uint8_t*)0x200002d8 = 0; 91 *(uint8_t*)0x200002d9 = 0; 92 *(uint8_t*)0x200002da = 0; 93 *(uint8_t*)0x200002db = 0; 94 *(uint8_t*)0x200002dc = 0; 95 *(uint8_t*)0x200002dd = 0; 96 *(uint8_t*)0x200002de = 0; 97 *(uint8_t*)0x200002df = 1; 98 *(uint32_t*)0x200002e0 = 0x80000000; 99 *(uint64_t*)0x200002e8 = 0; 100 *(uint64_t*)0x200002f0 = 0; 101 *(uint64_t*)0x200002f8 = 0; 102 *(uint64_t*)0x20000300 = 0; 103 *(uint64_t*)0x20000308 = 0; 104 *(uint64_t*)0x20000310 = 0; 105 *(uint64_t*)0x20000318 = 0; 106 *(uint64_t*)0x20000320 = 0; 107 *(uint64_t*)0x20000328 = 0; 108 *(uint64_t*)0x20000330 = 0; 109 *(uint64_t*)0x20000338 = 0; 110 *(uint64_t*)0x20000340 = 0; 111 syscall(SYS_setsockopt, r[0], 0x29, 0x51, 0x200002c0ul, 0x88ul); 112 return 0; 113} 114EOF 115mycc -o /tmp/syzkaller18 -Wall -Wextra -O0 /tmp/syzkaller18.c || 116 exit 1 117 118(cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) & 119start=`date +%s` 120while pgrep -q swap; do 121 (cd /tmp; timeout 1m ./syzkaller18) 122 [ $((`date +%s` - start)) -ge 60 ] && break 123done 124pkill -9 syzkaller18 125while pkill swap; do sleep 1; done 126wait 127 128rm -f /tmp/syzkaller18 /tmp/syzkaller18.c /tmp/syzkaller18.core 129exit 0 130