1#!/bin/sh 2 3# panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /usr/src/sys/netinet/sctp_pcb.c:1856 4# cpuid = 10 5# time = 1631108444 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe065f32e7f0 8# vpanic() at vpanic+0x187/frame 0xfffffe065f32e850 9# panic() at panic+0x43/frame 0xfffffe065f32e8b0 10# __rw_wlock_hard() at __rw_wlock_hard+0x7d1/frame 0xfffffe065f32e960 11# _rw_wlock_cookie() at _rw_wlock_cookie+0xb7/frame 0xfffffe065f32e9a0 12# sctp_swap_inpcb_for_listen() at sctp_swap_inpcb_for_listen+0x7f/frame 0xfffffe065f32e9f0 13# sctp_listen() at sctp_listen+0x248/frame 0xfffffe065f32ea60 14# solisten() at solisten+0x42/frame 0xfffffe065f32ea80 15# kern_listen() at kern_listen+0x7d/frame 0xfffffe065f32eac0 16# amd64_syscall() at amd64_syscall+0x147/frame 0xfffffe065f32ebf0 17# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe065f32ebf0 18# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x800380a4a, rsp = 0x7fffffffe9b8, rbp = 0x7fffffffe9d0 --- 19# KDB: enter: panic 20# [ thread pid 26683 tid 924765 ] 21# Stopped at kdb_enter+0x37: movq $0,0x12724de(%rip) 22# db> x/s version 23# version: FreeBSD 14.0-CURRENT #0 main-n249253-4ccbbe5f0689: Wed Sep 8 07:26:48 CEST 2021 24# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO\012 25# db> 26 27# Fixed by 6e3af6321ba4 - main - sctp: Fix lock recursion in sctp_swap_inpcb_for_listen() 28 29[ `uname -p` != "amd64" ] && exit 0 30[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 31 32. ../default.cfg 33cat > /tmp/syzkaller44.c <<EOF 34// https://syzkaller.appspot.com/bug?id=367509f8fdee02c7d5a6c24b77eb2643792ef376 35// autogenerated by syzkaller (https://github.com/google/syzkaller) 36// Reported-by: syzbot+a1b6cef257ad145b7187@syzkaller.appspotmail.com 37 38#define _GNU_SOURCE 39 40#include <pwd.h> 41#include <stdarg.h> 42#include <stdbool.h> 43#include <stdint.h> 44#include <stdio.h> 45#include <stdlib.h> 46#include <string.h> 47#include <sys/endian.h> 48#include <sys/syscall.h> 49#include <unistd.h> 50 51uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; 52 53int main(void) 54{ 55 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 56 intptr_t res = 0; 57 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 58 if (res != -1) 59 r[0] = res; 60 *(uint32_t*)0x20000140 = 0; 61 syscall(SYS_setsockopt, r[0], 0x84, 0x1c, 0x20000140ul, 4ul); 62 *(uint8_t*)0x20000080 = 0x46; 63 *(uint8_t*)0x20000081 = 0x1c; 64 *(uint16_t*)0x20000082 = htobe16(0x4e22); 65 *(uint32_t*)0x20000084 = 0; 66 memset((void*)0x20000088, 0, 16); 67 *(uint32_t*)0x20000098 = 0; 68 syscall(SYS_bind, r[0], 0x20000080ul, 0x1cul); 69 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 70 if (res != -1) 71 r[1] = res; 72 *(uint32_t*)0x20000140 = 0; 73 syscall(SYS_setsockopt, r[1], 0x84, 0x1c, 0x20000140ul, 4ul); 74 *(uint8_t*)0x20000080 = 0x46; 75 *(uint8_t*)0x20000081 = 0x1c; 76 *(uint16_t*)0x20000082 = htobe16(0x4e22); 77 *(uint32_t*)0x20000084 = 0; 78 memset((void*)0x20000088, 0, 16); 79 *(uint32_t*)0x20000098 = 0; 80 syscall(SYS_bind, r[1], 0x20000080ul, 0x1cul); 81 syscall(SYS_listen, r[1], 0); 82 return 0; 83} 84EOF 85mycc -o /tmp/syzkaller44 -Wall -Wextra -O0 /tmp/syzkaller44.c || exit 1 86 87kldstat -v | grep -q sctp || kldload sctp.ko 88(cd /tmp; timeout 3m ./syzkaller44) 89 90rm -rf /tmp/syzkaller44 /tmp/syzkaller44.c /tmp/syzkaller.* 91exit 0 92