18a272653SPeter Holm#!/bin/sh 28a272653SPeter Holm 38a272653SPeter Holm# panic: sched_pickcpu: Failed to find a cpu. 48a272653SPeter Holm# cpuid = 1 58a272653SPeter Holm# time = 1607419071 68a272653SPeter Holm# KDB: stack backtrace: 78a272653SPeter Holm# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01bb640770 88a272653SPeter Holm# vpanic() at vpanic+0x181/frame 0xfffffe01bb6407c0 98a272653SPeter Holm# panic() at panic+0x43/frame 0xfffffe01bb640820 108a272653SPeter Holm# sched_pickcpu() at sched_pickcpu+0x4a2/frame 0xfffffe01bb6408d0 118a272653SPeter Holm# sched_add() at sched_add+0x5d/frame 0xfffffe01bb640900 128a272653SPeter Holm# setrunnable() at setrunnable+0x77/frame 0xfffffe01bb640930 138a272653SPeter Holm# wakeup_one() at wakeup_one+0x1d/frame 0xfffffe01bb640950 148a272653SPeter Holm# do_lock_umutex() at do_lock_umutex+0x64c/frame 0xfffffe01bb640a40 158a272653SPeter Holm# __umtx_op_wait_umutex() at __umtx_op_wait_umutex+0x49/frame 0xfffffe01bb640a80 168a272653SPeter Holm# sys__umtx_op() at sys__umtx_op+0x7a/frame 0xfffffe01bb640ac0 178a272653SPeter Holm# amd64_syscall() at amd64_syscall+0x147/frame 0xfffffe01bb640bf0 188a272653SPeter Holm# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01bb640bf0 198a272653SPeter Holm# --- syscall (454, FreeBSD ELF64, sys__umtx_op), rip = 0x800254a8c, rsp = 0x7fffdf3f7e88, rbp = 0x7fffdf3f7eb0 --- 208a272653SPeter Holm# KDB: enter: panic 218a272653SPeter Holm# [ thread pid 58597 tid 106100 ] 228a272653SPeter Holm# Stopped at kdb_enter+0x37: movq $0,0x10a7766(%rip) 238a272653SPeter Holm# db> x/s version 248a272653SPeter Holm# version: FreeBSD 13.0-CURRENT #0 r368405: Mon Dec 7 10:33:35 CET 2020 258a272653SPeter Holm# pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO 268a272653SPeter Holm# db> 278a272653SPeter Holm 288a272653SPeter Holm[ `uname -p` != "amd64" ] && exit 0 298a272653SPeter Holm 308a272653SPeter Holm# Fixed by r368462 318a272653SPeter Holm 32*59cdd0e2SGordon Bergling# May change policy for random threads to domainset_fixed 331346766fSPeter Holmexit 0 341346766fSPeter Holm 358a272653SPeter Holm. ../default.cfg 368a272653SPeter Holmcat > /tmp/syzkaller30.c <<EOF 378a272653SPeter Holm// https://syzkaller.appspot.com/bug?id=6652adb41773e5c471c98342fefcbfb041af9ac8 388a272653SPeter Holm// autogenerated by syzkaller (https://github.com/google/syzkaller) 398a272653SPeter Holm// Reported-by: syzbot+4e3b1009de98d2fabcda@syzkaller.appspotmail.com 408a272653SPeter Holm 418a272653SPeter Holm#define _GNU_SOURCE 428a272653SPeter Holm 438a272653SPeter Holm#include <pwd.h> 448a272653SPeter Holm#include <stdarg.h> 458a272653SPeter Holm#include <stdbool.h> 468a272653SPeter Holm#include <stdint.h> 478a272653SPeter Holm#include <stdio.h> 488a272653SPeter Holm#include <stdlib.h> 498a272653SPeter Holm#include <string.h> 508a272653SPeter Holm#include <sys/endian.h> 518a272653SPeter Holm#include <sys/syscall.h> 528a272653SPeter Holm#include <unistd.h> 538a272653SPeter Holm 548a272653SPeter Holmint main(void) 558a272653SPeter Holm{ 568a272653SPeter Holm syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 578a272653SPeter Holm 588a272653SPeter Holm *(uint64_t*)0x200000c0 = 0; 598a272653SPeter Holm syscall(SYS_cpuset_setaffinity, 2ul, 2ul, 0x100000000000000ul, 0x20ul, 608a272653SPeter Holm 0x200000c0ul); 618a272653SPeter Holm return 0; 628a272653SPeter Holm} 638a272653SPeter HolmEOF 648a272653SPeter Holmmycc -o /tmp/syzkaller30 -Wall -Wextra -O0 /tmp/syzkaller30.c || 658a272653SPeter Holm exit 1 668a272653SPeter Holm 678a272653SPeter Holm(cd /tmp; timeout 3m ./syzkaller30) 688a272653SPeter Holm 69014a2b1aSPeter Holmrm -rf /tmp/syzkaller30 /tmp/syzkaller30.c /tmp/syzkaller.* 708a272653SPeter Holmexit 0 71