1*5b42ac29SPeter Holm#!/bin/sh 2*5b42ac29SPeter Holm 3*5b42ac29SPeter Holm# panic: Assertion sb->sb_hiwat >= sb->uxdg_cc failed at ../../../kern/uipc_usrreq.c:1099 4*5b42ac29SPeter Holm# cpuid = 9 5*5b42ac29SPeter Holm# time = 1660909804 6*5b42ac29SPeter Holm# KDB: stack backtrace: 7*5b42ac29SPeter Holm# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01401e7970 8*5b42ac29SPeter Holm# vpanic() at vpanic+0x151/frame 0xfffffe01401e79c0 9*5b42ac29SPeter Holm# panic() at panic+0x43/frame 0xfffffe01401e7a20 10*5b42ac29SPeter Holm# uipc_dgram_sbspace() at uipc_dgram_sbspace+0x51/frame 0xfffffe01401e7a30 11*5b42ac29SPeter Holm# uipc_sosend_dgram() at uipc_sosend_dgram+0x690/frame 0xfffffe01401e7ac0 12*5b42ac29SPeter Holm# sosend() at sosend+0x49/frame 0xfffffe01401e7af0 13*5b42ac29SPeter Holm# soo_write() at soo_write+0x43/frame 0xfffffe01401e7b20 14*5b42ac29SPeter Holm# filemon_close_log() at filemon_close_log+0xd5/frame 0xfffffe01401e7b90 15*5b42ac29SPeter Holm# filemon_dtr() at filemon_dtr+0x31/frame 0xfffffe01401e7bb0 16*5b42ac29SPeter Holm# devfs_destroy_cdevpriv() at devfs_destroy_cdevpriv+0xab/frame 0xfffffe01401e7bd0 17*5b42ac29SPeter Holm# devfs_close_f() at devfs_close_f+0x64/frame 0xfffffe01401e7c00 18*5b42ac29SPeter Holm# _fdrop() at _fdrop+0x1b/frame 0xfffffe01401e7c20 19*5b42ac29SPeter Holm# closef() at closef+0x1db/frame 0xfffffe01401e7cb0 20*5b42ac29SPeter Holm# fdescfree() at fdescfree+0x433/frame 0xfffffe01401e7d80 21*5b42ac29SPeter Holm# exit1() at exit1+0x4df/frame 0xfffffe01401e7df0 22*5b42ac29SPeter Holm# sys_exit() at sys_exit+0xd/frame 0xfffffe01401e7e00 23*5b42ac29SPeter Holm# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe01401e7f30 24*5b42ac29SPeter Holm# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01401e7f30 25*5b42ac29SPeter Holm# --- syscall (1, FreeBSD ELF64, sys_exit), rip = 0x82301d16a, rsp = 0x8209bf628, rbp = 0x8209bf640 --- 26*5b42ac29SPeter Holm# KDB: enter: panic 27*5b42ac29SPeter Holm# [ thread pid 2876 tid 100222 ] 28*5b42ac29SPeter Holm# Stopped at x32: movq $0,0x12a1323(%rip) 29*5b42ac29SPeter Holm# db> x/s version 30*5b42ac29SPeter Holm# version: FreeBSD 14.0-CURRENT #0 main-n257506-eed634d113d-dirty: Thu Aug 18 13:56:53 CEST 2022 31*5b42ac29SPeter Holm# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO\012 32*5b42ac29SPeter Holm# db> 33*5b42ac29SPeter Holm 34*5b42ac29SPeter Holm. ../default.cfg 35*5b42ac29SPeter Holmcat > /tmp/syzkaller62.c <<EOF 36*5b42ac29SPeter Holm// https://syzkaller.appspot.com/bug?id=582310beb894769fc836748eec49b8d2f905e5ef 37*5b42ac29SPeter Holm// autogenerated by syzkaller (https://github.com/google/syzkaller) 38*5b42ac29SPeter Holm// Reported-by: syzbot+6e8be1ec8d77578a3df4@syzkaller.appspotmail.com 39*5b42ac29SPeter Holm 40*5b42ac29SPeter Holm#define _GNU_SOURCE 41*5b42ac29SPeter Holm 42*5b42ac29SPeter Holm#include <pwd.h> 43*5b42ac29SPeter Holm#include <stdarg.h> 44*5b42ac29SPeter Holm#include <stdbool.h> 45*5b42ac29SPeter Holm#include <stdint.h> 46*5b42ac29SPeter Holm#include <stdio.h> 47*5b42ac29SPeter Holm#include <stdlib.h> 48*5b42ac29SPeter Holm#include <string.h> 49*5b42ac29SPeter Holm#include <sys/endian.h> 50*5b42ac29SPeter Holm#include <sys/syscall.h> 51*5b42ac29SPeter Holm#include <unistd.h> 52*5b42ac29SPeter Holm 53*5b42ac29SPeter Holmuint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; 54*5b42ac29SPeter Holm 55*5b42ac29SPeter Holmint main(void) 56*5b42ac29SPeter Holm{ 57*5b42ac29SPeter Holm syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 58*5b42ac29SPeter Holm intptr_t res = 0; 59*5b42ac29SPeter Holm memcpy((void*)0x20000040, "/dev/filemon\000", 13); 60*5b42ac29SPeter Holm res = syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000040ul, 0ul, 0ul); 61*5b42ac29SPeter Holm if (res != -1) 62*5b42ac29SPeter Holm r[0] = res; 63*5b42ac29SPeter Holm res = syscall(SYS_socketpair, 1ul, 2ul, 0, 0x20000080ul); 64*5b42ac29SPeter Holm if (res != -1) 65*5b42ac29SPeter Holm r[1] = *(uint32_t*)0x20000084; 66*5b42ac29SPeter Holm *(uint32_t*)0x200000c0 = r[1]; 67*5b42ac29SPeter Holm syscall(SYS_ioctl, r[0], 0xc0045301ul, 0x200000c0ul); 68*5b42ac29SPeter Holm *(uint32_t*)0x20000040 = 3; 69*5b42ac29SPeter Holm syscall(SYS_setsockopt, r[1], 0xffff, 0x1001, 0x20000040ul, 4ul); 70*5b42ac29SPeter Holm return 0; 71*5b42ac29SPeter Holm} 72*5b42ac29SPeter HolmEOF 73*5b42ac29SPeter Holmmycc -o /tmp/syzkaller62 -Wall -Wextra -O0 /tmp/syzkaller62.c || exit 1 74*5b42ac29SPeter Holm 75*5b42ac29SPeter Holmkldstat | grep -q filemon || { kldload filemon.ko && loaded=1; } 76*5b42ac29SPeter Holm 77*5b42ac29SPeter Holm(cd /tmp; timeout -k 3s 2s ./syzkaller62) 78*5b42ac29SPeter Holm 79*5b42ac29SPeter Holmrm -rf /tmp/syzkaller62 /tmp/syzkaller62.c /tmp/syzkaller62.core \ 80*5b42ac29SPeter Holm /tmp/syzkaller.?????? 81*5b42ac29SPeter Holm# Unload causes: Fatal trap 12: page fault while in kernel mode 82*5b42ac29SPeter Holm#[ $loaded ] && kldunload -f filemon.ko 83*5b42ac29SPeter Holmexit 0 84