1#!/bin/sh 2 3# panic: td 0xfffffe010e6ff000 is not suspended 4# cpuid = 2 5# time = 1654661460 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0143924c10 8# vpanic() at vpanic+0x17f/frame 0xfffffe0143924c60 9# panic() at panic+0x43/frame 0xfffffe0143924cc0 10# thread_single() at thread_single+0x736/frame 0xfffffe0143924d40 11# fork1() at fork1+0x1e1/frame 0xfffffe0143924da0 12# sys_rfork() at sys_rfork+0xa4/frame 0xfffffe0143924e00 13# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe0143924f30 14# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0143924f30 15# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x821be4d1a, rsp = 0x8276b8f48, rbp = 0x8276b8f70 --- 16# KDB: enter: panic 17# [ thread pid 2860 tid 100362 ] 18# Stopped at kdb_enter+0x32: movq $0,0x1277d83(%rip) 19# db> x/s version 20# FreeBSD 14.0-CURRENT #0 reap-n255837-0bdda1ded8d: Thu May 26 22:38:04 CEST 2022 21# pho@mercat1.netperf.freebsd.org:/var/tmp/deviant3/sys/amd64/compile/PHO 22# db> 23 24# Submitted by: markj 25 26[ `uname -p` != "amd64" ] && exit 0 27 28. ../default.cfg 29cat > /tmp/syzkaller58.c <<EOF 30// autogenerated by syzkaller (https://github.com/google/syzkaller) 31 32#define _GNU_SOURCE 33 34#include <sys/types.h> 35 36#include <errno.h> 37#include <pthread.h> 38#include <pwd.h> 39#include <signal.h> 40#include <stdarg.h> 41#include <stdbool.h> 42#include <stdint.h> 43#include <stdio.h> 44#include <stdlib.h> 45#include <string.h> 46#include <sys/endian.h> 47#include <sys/syscall.h> 48#include <sys/wait.h> 49#include <time.h> 50#include <unistd.h> 51 52static unsigned long long procid; 53 54static void kill_and_wait(int pid, int* status) 55{ 56 kill(pid, SIGKILL); 57 while (waitpid(-1, status, 0) != pid) { 58 } 59} 60 61static void sleep_ms(uint64_t ms) 62{ 63 usleep(ms * 1000); 64} 65 66static uint64_t current_time_ms(void) 67{ 68 struct timespec ts; 69 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 70 exit(1); 71 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 72} 73 74static void thread_start(void* (*fn)(void*), void* arg) 75{ 76 pthread_t th; 77 pthread_attr_t attr; 78 pthread_attr_init(&attr); 79 pthread_attr_setstacksize(&attr, 128 << 10); 80 int i = 0; 81 for (; i < 100; i++) { 82 if (pthread_create(&th, &attr, fn, arg) == 0) { 83 pthread_attr_destroy(&attr); 84 return; 85 } 86 if (errno == EAGAIN) { 87 usleep(50); 88 continue; 89 } 90 break; 91 } 92 exit(1); 93} 94 95typedef struct { 96 pthread_mutex_t mu; 97 pthread_cond_t cv; 98 int state; 99} event_t; 100 101static void event_init(event_t* ev) 102{ 103 if (pthread_mutex_init(&ev->mu, 0)) 104 exit(1); 105 if (pthread_cond_init(&ev->cv, 0)) 106 exit(1); 107 ev->state = 0; 108} 109 110static void event_reset(event_t* ev) 111{ 112 ev->state = 0; 113} 114 115static void event_set(event_t* ev) 116{ 117 pthread_mutex_lock(&ev->mu); 118 if (ev->state) 119 exit(1); 120 ev->state = 1; 121 pthread_mutex_unlock(&ev->mu); 122 pthread_cond_broadcast(&ev->cv); 123} 124 125static void event_wait(event_t* ev) 126{ 127 pthread_mutex_lock(&ev->mu); 128 while (!ev->state) 129 pthread_cond_wait(&ev->cv, &ev->mu); 130 pthread_mutex_unlock(&ev->mu); 131} 132 133static int event_isset(event_t* ev) 134{ 135 pthread_mutex_lock(&ev->mu); 136 int res = ev->state; 137 pthread_mutex_unlock(&ev->mu); 138 return res; 139} 140 141static int event_timedwait(event_t* ev, uint64_t timeout) 142{ 143 uint64_t start = current_time_ms(); 144 uint64_t now = start; 145 pthread_mutex_lock(&ev->mu); 146 for (;;) { 147 if (ev->state) 148 break; 149 uint64_t remain = timeout - (now - start); 150 struct timespec ts; 151 ts.tv_sec = remain / 1000; 152 ts.tv_nsec = (remain % 1000) * 1000 * 1000; 153 pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); 154 now = current_time_ms(); 155 if (now - start > timeout) 156 break; 157 } 158 int res = ev->state; 159 pthread_mutex_unlock(&ev->mu); 160 return res; 161} 162 163struct thread_t { 164 int created, call; 165 event_t ready, done; 166}; 167 168static struct thread_t threads[16]; 169static void execute_call(int call); 170static int running; 171 172static void* thr(void* arg) 173{ 174 struct thread_t* th = (struct thread_t*)arg; 175 for (;;) { 176 event_wait(&th->ready); 177 event_reset(&th->ready); 178 execute_call(th->call); 179 __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); 180 event_set(&th->done); 181 } 182 return 0; 183} 184 185static void execute_one(void) 186{ 187 int i, call, thread; 188 for (call = 0; call < 5; call++) { 189 for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); 190 thread++) { 191 struct thread_t* th = &threads[thread]; 192 if (!th->created) { 193 th->created = 1; 194 event_init(&th->ready); 195 event_init(&th->done); 196 event_set(&th->done); 197 thread_start(thr, th); 198 } 199 if (!event_isset(&th->done)) 200 continue; 201 event_reset(&th->done); 202 th->call = call; 203 __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); 204 event_set(&th->ready); 205 event_timedwait(&th->done, 50); 206 break; 207 } 208 } 209 for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) 210 sleep_ms(1); 211} 212 213static void execute_one(void); 214 215#define WAIT_FLAGS 0 216 217static void loop(void) 218{ 219 int iter __unused = 0; 220 for (;; iter++) { 221 int pid = fork(); 222 if (pid < 0) 223 exit(1); 224 if (pid == 0) { 225 execute_one(); 226 exit(0); 227 } 228 int status = 0; 229 uint64_t start = current_time_ms(); 230 for (;;) { 231 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 232 break; 233 sleep_ms(1); 234 if (current_time_ms() - start < 5000) 235 continue; 236 kill_and_wait(pid, &status); 237 break; 238 } 239 } 240} 241 242void execute_call(int call) 243{ 244 switch (call) { 245 case 0: 246 syscall(SYS_rfork, 0x93000ul); 247 break; 248 case 1: 249 syscall(SYS_kqueue); 250 break; 251 case 2: 252 *(uint32_t*)0x20000000 = 0x1d; 253 *(uint32_t*)0x20000004 = 0; 254 *(uint32_t*)0x20000008 = 0; 255 *(uint32_t*)0x2000000c = 0; 256 *(uint32_t*)0x20000010 = 0; 257 memset((void*)0x20000014, 0, 60); 258 syscall(SYS_procctl, 0ul, 0, 6ul, 0x20000000ul); 259 break; 260 case 3: 261 syscall(SYS_kevent, -1, 0ul, 0ul, 0ul, 0ul, 0ul); 262 break; 263 case 4: 264 syscall(SYS_truncate, 0ul, 4ul); 265 break; 266 } 267} 268int main(void) 269{ 270 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 271 for (procid = 0; procid < 2; procid++) { 272 if (fork() == 0) { 273 loop(); 274 } 275 } 276 sleep(1000000); 277 return 0; 278} 279 280 281EOF 282mycc -o /tmp/syzkaller58 -Wall -Wextra -O0 /tmp/syzkaller58.c -lpthread \ 283 || exit 1 284 285(cd /tmp; timeout 3m ./syzkaller58) 286 287rm -rf /tmp/syzkaller58 /tmp/syzkaller58.c /tmp/syzkaller58.core \ 288 /tmp/syzkaller.?????? 289[ $loaded ] && kldunload sctp.ko 290exit 0 291