1#!/bin/sh 2 3# panic: Queues are not empty when handling SHUTDOWN-COMPLETE 4# cpuid = 10 5# time = 1650546082 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00e49be680 8# vpanic() at vpanic+0x17f/frame 0xfffffe00e49be6d0 9# panic() at panic+0x43/frame 0xfffffe00e49be730 10# sctp_handle_shutdown_complete() at sctp_handle_shutdown_complete+0xea/frame 0xfffffe00e49be750 11# sctp_process_control() at sctp_process_control+0x1561/frame 0xfffffe00e49bea90 12# sctp_common_input_processing() at sctp_common_input_processing+0x514/frame 0xfffffe00e49bec00 13# sctp6_input_with_port() at sctp6_input_with_port+0x228/frame 0xfffffe00e49becf0 14# sctp6_input() at sctp6_input+0xb/frame 0xfffffe00e49bed00 15# ip6_input() at ip6_input+0xc2f/frame 0xfffffe00e49bede0 16# swi_net() at swi_net+0x191/frame 0xfffffe00e49bee60 17# ithread_loop() at ithread_loop+0x279/frame 0xfffffe00e49beef0 18# fork_exit() at fork_exit+0x80/frame 0xfffffe00e49bef30 19# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00e49bef30 20# --- trap 0, rip = 0, rsp = 0, rbp = 0 --- 21# KDB: enter: panic 22# [ thread pid 12 tid 100077 ] 23# Stopped at kdb_enter+0x32: movq $0,0x12797a3(%rip) 24# db> x/s version 25# FreeBSD 14.0-CURRENT #0 main-n254961-b91a48693a53e: Thu Apr 21 09:39:27 CEST 2022 26# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO 27# db> 28 29[ `uname -p` != "amd64" ] && exit 0 30 31. ../default.cfg 32cat > /tmp/syzkaller51.c <<EOF 33// https://syzkaller.appspot.com/bug?id=358f4bcd3d53267e6f5f069677688bad5cf7c1f4 34// autogenerated by syzkaller (https://github.com/google/syzkaller) 35// Reported-by: syzbot+341e9ebd9d24ca7dc62a@syzkaller.appspotmail.com 36 37#define _GNU_SOURCE 38 39#include <sys/types.h> 40 41#include <pwd.h> 42#include <signal.h> 43#include <stdarg.h> 44#include <stdbool.h> 45#include <stdint.h> 46#include <stdio.h> 47#include <stdlib.h> 48#include <string.h> 49#include <sys/endian.h> 50#include <sys/syscall.h> 51#include <sys/wait.h> 52#include <time.h> 53#include <unistd.h> 54 55static void kill_and_wait(int pid, int* status) 56{ 57 kill(pid, SIGKILL); 58 while (waitpid(-1, status, 0) != pid) { 59 } 60} 61 62static void sleep_ms(uint64_t ms) 63{ 64 usleep(ms * 1000); 65} 66 67static uint64_t current_time_ms(void) 68{ 69 struct timespec ts; 70 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 71 exit(1); 72 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 73} 74 75static void execute_one(void); 76 77#define WAIT_FLAGS 0 78 79static void loop(void) 80{ 81 int iter __unused = 0; 82 for (;; iter++) { 83 int pid = fork(); 84 if (pid < 0) 85 exit(1); 86 if (pid == 0) { 87 execute_one(); 88 exit(0); 89 } 90 int status = 0; 91 uint64_t start = current_time_ms(); 92 for (;;) { 93 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 94 break; 95 sleep_ms(1); 96 if (current_time_ms() - start < 5000) 97 continue; 98 kill_and_wait(pid, &status); 99 break; 100 } 101 } 102} 103 104uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; 105 106void execute_one(void) 107{ 108 intptr_t res = 0; 109 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 110 if (res != -1) 111 r[0] = res; 112 *(uint8_t*)0x20000000 = 0x1c; 113 *(uint8_t*)0x20000001 = 0x1c; 114 *(uint16_t*)0x20000002 = htobe16(0x4e22); 115 *(uint32_t*)0x20000004 = 0; 116 memset((void*)0x20000008, 0, 16); 117 *(uint32_t*)0x20000018 = 0; 118 syscall(SYS_bind, r[0], 0x20000000ul, 0x1cul); 119 syscall(SYS_listen, r[0], 5); 120 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 121 if (res != -1) 122 r[1] = res; 123 memset((void*)0x20000240, 202, 1); 124 *(uint8_t*)0x20000040 = 0x1c; 125 *(uint8_t*)0x20000041 = 0x1c; 126 *(uint16_t*)0x20000042 = htobe16(0x4e22); 127 *(uint32_t*)0x20000044 = 0; 128 *(uint64_t*)0x20000048 = htobe64(0); 129 *(uint64_t*)0x20000050 = htobe64(1); 130 *(uint32_t*)0x20000058 = 0; 131 syscall(SYS_sendto, r[1], 0x20000240ul, 1ul, 0ul, 0x20000040ul, 0x1cul); 132 syscall(SYS_dup2, r[0], r[1]); 133 res = syscall(SYS_accept, r[1], 0ul, 0ul); 134 if (res != -1) 135 r[2] = res; 136 *(uint64_t*)0x20001980 = 0; 137 *(uint32_t*)0x20001988 = 0; 138 *(uint64_t*)0x20001990 = 0x200018c0; 139 *(uint64_t*)0x200018c0 = 0x20000400; 140 memcpy( 141 (void*)0x20000400, 142 "\xe1\xb9\x03\xdc\x43\xbc\x11\x92\xcb\x81\xb0\x96\xe0\x09\xde\x05\x09\x0b" 143 "\x44\x42\x6a\x68\x20\x0d\x0a\x78\x94\x0a\xbc\xcb\x4d\x0b\x1d\x3e\xc6\x6a" 144 "\xc2\x43\x46\x14\x08\x20\x01\x43\x3e\xf2\xc1\xb6\x6a\x0e\x5e\x13\xa8\xcf" 145 "\x99\x01\x1d\x5a\xb4\xe1\x7e\xa4\x98\x7d\x56\xb5\x86\xa3\xbb\x1e\x3e\xb5" 146 "\x85\x89\x43\xf9\x0d\xee\x7e\x8d\xc5\xac\x60\xed\x23\x62\xc7\x05\x0b\x3b" 147 "\x37\x6c\x77\x77\x5f\x1e\x0f\xa0\x90\x50\xc1\x97\x45\x47\x7f\xe7\x64\xff" 148 "\x92\x61\x9f\x9c\x06\xee\x37\x89\xf8\x81\x6e\xf7\xeb\xe5\xe1\xbd\xa8\xcc" 149 "\x50\xce\x6b\x9b\x7e\x9a\x62\x5c\x71\xd4\x41\x55\x90\x6b\xe5\x92\x55\xe0" 150 "\x3e\xc5\xfd\xfd\xbb\x5d\x2c\xf2\x70\x22\xdb\x96\x07\x02\xe6\xae\x67\xb2" 151 "\xcd\x1b\xf6\xab\x30\x3a\xfd\x24\x5d\xb7\x37\x95\x21\x4c\xc6\x8a\x29\x50" 152 "\xec\x8d\x33\x21\x6a\x93\x20\x30\x43\xe4\x54\xeb\x98\x2b\x40\x9a\x2a\x1d" 153 "\x48\x77\xc8\xf3\x06\xdf\xa3\x80\x07\xab\x8c\x6e\x30\x13\x84\x4d\xf4\x48" 154 "\x1e\x5b\x0f\xbd\x84\xe0\x17\xbe\x81\xc9\x47\xc5\x6b\x0b\xc0\x70\x74\xcb" 155 "\x6d\xe1\xe3\xeb\xdc\xe8\xbf\x72\x22\x92\x0b\x2b\xfe\xda\x7f\xcf\x96", 156 251); 157 *(uint64_t*)0x200018c8 = 0xfb; 158 *(uint64_t*)0x200018d0 = 0; 159 *(uint64_t*)0x200018d8 = 0; 160 *(uint64_t*)0x200018e0 = 0x20000600; 161 *(uint64_t*)0x200018e8 = 0; 162 *(uint64_t*)0x200018f0 = 0; 163 *(uint64_t*)0x200018f8 = 0; 164 *(uint64_t*)0x20001900 = 0; 165 *(uint64_t*)0x20001908 = 0; 166 *(uint64_t*)0x20001910 = 0; 167 *(uint64_t*)0x20001918 = 0; 168 *(uint64_t*)0x20001920 = 0; 169 *(uint64_t*)0x20001928 = 0; 170 *(uint64_t*)0x20001930 = 0; 171 *(uint64_t*)0x20001938 = 0; 172 *(uint64_t*)0x20001940 = 0; 173 *(uint64_t*)0x20001948 = 0; 174 *(uint32_t*)0x20001998 = 9; 175 *(uint64_t*)0x200019a0 = 0; 176 *(uint32_t*)0x200019a8 = 0; 177 *(uint32_t*)0x200019ac = 0x101; 178 syscall(SYS_sendmsg, r[2], 0x20001980ul, 0x20104ul); 179} 180int main(void) 181{ 182 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 183 loop(); 184 return 0; 185} 186EOF 187mycc -o /tmp/syzkaller51 -Wall -Wextra -O0 /tmp/syzkaller51.c || exit 1 188 189kldstat | grep -q sctp || { kldload sctp.ko && loaded=1; } 190 191(cd /tmp; timeout 3m ./syzkaller51) 192 193rm -rf /tmp/syzkaller51 /tmp/syzkaller51.c /tmp/syzkaller.* 194[ $loaded ] && kldunload sctp.ko 195exit 0 196