1#!/bin/sh 2 3# panic: mutex pcbinfohash not owned at 4# /syzkaller/managers/main/kernel/sys/netinet6/in6_pcb.c:717 5# cpuid = 0 6# time = 1573247472 7# KDB: stack backtrace: 8# db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 9# 0xfffffe0022a56260 10# vpanic() at vpanic+0x1c7/frame 0xfffffe0022a562d0 11# panic() at panic+0x43/frame 0xfffffe0022a56330 12# __mtx_assert() at __mtx_assert+0x18b/frame 0xfffffe0022a56370 13# in6_pcblookup_local() at in6_pcblookup_local+0x53/frame 0xfffffe0022a563c0 14# in_pcb_lport() at in_pcb_lport+0x3fd/frame 0xfffffe0022a56450 15# in_pcbbind_setup() at in_pcbbind_setup+0x28b/frame 0xfffffe0022a564f0 16# in_pcbconnect_setup() at in_pcbconnect_setup+0x4aa/frame 0xfffffe0022a565b0 17# udp_send() at udp_send+0xee4/frame 0xfffffe0022a566c0 18# udp6_send() at udp6_send+0x4e8/frame 0xfffffe0022a56870 19# sosend_dgram() at sosend_dgram+0x54f/frame 0xfffffe0022a568e0 20# sosend() at sosend+0xc6/frame 0xfffffe0022a56950 21# kern_sendit() at kern_sendit+0x32d/frame 0xfffffe0022a56a00 22# sendit() at sendit+0x226/frame 0xfffffe0022a56a60 23# sys_sendto() at sys_sendto+0x5c/frame 0xfffffe0022a56ac0 24# amd64_syscall() at amd64_syscall+0x473/frame 0xfffffe0022a56bf0 25# fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0022a56bf0 26# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x41c3aa, rsp = 27 28. ../default.cfg 29cat > /tmp/syzkaller2.c <<EOF 30// https://syzkaller.appspot.com/bug?id=062e9fde55f117bec30836a4ef1ef121f51faf23 31// autogenerated by syzkaller (https://github.com/google/syzkaller) 32 33#define _GNU_SOURCE 34 35#include <pwd.h> 36#include <stdarg.h> 37#include <stdbool.h> 38#include <stdint.h> 39#include <stdio.h> 40#include <stdlib.h> 41#include <string.h> 42#include <sys/endian.h> 43#include <sys/syscall.h> 44#include <unistd.h> 45 46uint64_t r[1] = {0xffffffffffffffff}; 47 48int main(void) 49{ 50 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul); 51 intptr_t res = 0; 52 res = syscall(SYS_socket, 0x1cul, 2ul, 0ul); 53 if (res != -1) 54 r[0] = res; 55 *(uint32_t*)0x200001c0 = 0; 56 syscall(SYS_setsockopt, r[0], 0x29ul, 0x1bul, 0x200001c0ul, 4ul); 57 *(uint8_t*)0x20000100 = 0x1c; 58 *(uint8_t*)0x20000101 = 0x1c; 59 *(uint16_t*)0x20000102 = htobe16(0x4e21); 60 *(uint32_t*)0x20000104 = 0; 61 *(uint8_t*)0x20000108 = 0; 62 *(uint8_t*)0x20000109 = 0; 63 *(uint8_t*)0x2000010a = 0; 64 *(uint8_t*)0x2000010b = 0; 65 *(uint8_t*)0x2000010c = 0; 66 *(uint8_t*)0x2000010d = 0; 67 *(uint8_t*)0x2000010e = 0; 68 *(uint8_t*)0x2000010f = 0; 69 *(uint8_t*)0x20000110 = 0; 70 *(uint8_t*)0x20000111 = 0; 71 *(uint8_t*)0x20000112 = -1; 72 *(uint8_t*)0x20000113 = -1; 73 *(uint8_t*)0x20000114 = 0xac; 74 *(uint8_t*)0x20000115 = 0x14; 75 *(uint8_t*)0x20000116 = 0; 76 *(uint8_t*)0x20000117 = 0xaa; 77 *(uint32_t*)0x20000118 = 0; 78 syscall(SYS_sendto, r[0], 0ul, 0ul, 0ul, 0x20000100ul, 0x1cul); 79 return 0; 80} 81EOF 82mycc -o /tmp/syzkaller2 -Wall -Wextra -O2 /tmp/syzkaller2.c || 83 exit 1 84rm /tmp/syzkaller2.c 85 86(cd /tmp; ./syzkaller2) 87 88rm -f /tmp/syzkaller2 /tmp/syzkaller2.core 89exit 0 90