1*bce30c89SPeter Holm#!/bin/sh 2*bce30c89SPeter Holm 3*bce30c89SPeter Holm# panic: in_pcblookup_hash_locked: invalid local address 4*bce30c89SPeter Holm# cpuid = 11 5*bce30c89SPeter Holm# time = 1678303805 6*bce30c89SPeter Holm# KDB: stack backtrace: 7*bce30c89SPeter Holm# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0657e466d0 8*bce30c89SPeter Holm# vpanic() at vpanic+0x152/frame 0xfffffe0657e46720 9*bce30c89SPeter Holm# panic() at panic+0x43/frame 0xfffffe0657e46780 10*bce30c89SPeter Holm# in_pcblookup_hash_locked() at in_pcblookup_hash_locked+0x4e2/frame 0xfffffe0657e467f0 11*bce30c89SPeter Holm# in_pcb_lport_dest() at in_pcb_lport_dest+0x28a/frame 0xfffffe0657e468a0 12*bce30c89SPeter Holm# in_pcbconnect_setup() at in_pcbconnect_setup+0x31b/frame 0xfffffe0657e46940 13*bce30c89SPeter Holm# udp_send() at udp_send+0x68b/frame 0xfffffe0657e46a50 14*bce30c89SPeter Holm# udp6_send() at udp6_send+0x287/frame 0xfffffe0657e46c10 15*bce30c89SPeter Holm# sosend_dgram() at sosend_dgram+0x327/frame 0xfffffe0657e46c70 16*bce30c89SPeter Holm# sousrsend() at sousrsend+0x7e/frame 0xfffffe0657e46cd0 17*bce30c89SPeter Holm# kern_sendit() at kern_sendit+0x1bc/frame 0xfffffe0657e46d60 18*bce30c89SPeter Holm# sendit() at sendit+0xba/frame 0xfffffe0657e46db0 19*bce30c89SPeter Holm# sys_sendto() at sys_sendto+0x4d/frame 0xfffffe0657e46e00 20*bce30c89SPeter Holm# amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe0657e46f30 21*bce30c89SPeter Holm# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0657e46f30 22*bce30c89SPeter Holm# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x822a3a31a, rsp = 0x8208224d8, rbp = 0x820822500 --- 23*bce30c89SPeter Holm# KDB: enter: panic 24*bce30c89SPeter Holm# [ thread pid 47141 tid 357973 ] 25*bce30c89SPeter Holm# Stopped at kdb_enter+0x32: movq $0,0x12906d3(%rip) 26*bce30c89SPeter Holm# db> x/s version 27*bce30c89SPeter Holm# FreeBSD 14.0-CURRENT #0 main-n261389-109abf744bf76: Wed Mar 8 06:10:24 CET 2023 28*bce30c89SPeter Holm# pho@mercat1.netperf.freebsd.org:/usr/src/sys/a 29*bce30c89SPeter Holm# db> 30*bce30c89SPeter Holm 31*bce30c89SPeter Holm[ `uname -p` != "amd64" ] && exit 0 32*bce30c89SPeter Holm[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 33*bce30c89SPeter Holm 34*bce30c89SPeter Holm. ../default.cfg 35*bce30c89SPeter Holmprog=$(basename "$0" .sh) 36*bce30c89SPeter Holmcat > /tmp/$prog.c <<EOF 37*bce30c89SPeter Holm// https://syzkaller.appspot.com/bug?id=7cae38958ddfe2c338548b4217587bd6d89b43e2 38*bce30c89SPeter Holm// autogenerated by syzkaller (https://github.com/google/syzkaller) 39*bce30c89SPeter Holm// Reported-by: syzbot+c8e3dac881bba85bc029@syzkaller.appspotmail.com 40*bce30c89SPeter Holm 41*bce30c89SPeter Holm#define _GNU_SOURCE 42*bce30c89SPeter Holm 43*bce30c89SPeter Holm#include <pwd.h> 44*bce30c89SPeter Holm#include <stdarg.h> 45*bce30c89SPeter Holm#include <stdbool.h> 46*bce30c89SPeter Holm#include <stdint.h> 47*bce30c89SPeter Holm#include <stdio.h> 48*bce30c89SPeter Holm#include <stdlib.h> 49*bce30c89SPeter Holm#include <string.h> 50*bce30c89SPeter Holm#include <sys/endian.h> 51*bce30c89SPeter Holm#include <sys/syscall.h> 52*bce30c89SPeter Holm#include <unistd.h> 53*bce30c89SPeter Holm 54*bce30c89SPeter Holmuint64_t r[1] = {0xffffffffffffffff}; 55*bce30c89SPeter Holm 56*bce30c89SPeter Holmint main(void) 57*bce30c89SPeter Holm{ 58*bce30c89SPeter Holm syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 59*bce30c89SPeter Holm intptr_t res = 0; 60*bce30c89SPeter Holm res = syscall(SYS_socket, 0x1cul, 2ul, 0); 61*bce30c89SPeter Holm if (res != -1) 62*bce30c89SPeter Holm r[0] = res; 63*bce30c89SPeter Holm *(uint32_t*)0x200001c0 = 0; 64*bce30c89SPeter Holm syscall(SYS_setsockopt, r[0], 0x29, 0x1b, 0x200001c0ul, 4ul); 65*bce30c89SPeter Holm *(uint8_t*)0x20000000 = 0x1c; 66*bce30c89SPeter Holm *(uint8_t*)0x20000001 = 0x1c; 67*bce30c89SPeter Holm *(uint16_t*)0x20000002 = htobe16(0x4e22); 68*bce30c89SPeter Holm *(uint32_t*)0x20000004 = 0; 69*bce30c89SPeter Holm memset((void*)0x20000008, 0, 10); 70*bce30c89SPeter Holm memset((void*)0x20000012, 255, 2); 71*bce30c89SPeter Holm *(uint32_t*)0x20000014 = htobe32(0); 72*bce30c89SPeter Holm *(uint32_t*)0x20000018 = 0; 73*bce30c89SPeter Holm syscall(SYS_sendto, r[0], 0ul, 0ul, 0ul, 0x20000000ul, 0x1cul); 74*bce30c89SPeter Holm return 0; 75*bce30c89SPeter Holm} 76*bce30c89SPeter HolmEOF 77*bce30c89SPeter Holmmycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 78*bce30c89SPeter Holm 79*bce30c89SPeter Holm(cd /tmp; timeout 2m ./$prog) 80*bce30c89SPeter Holm 81*bce30c89SPeter Holmrm -rf /tmp/$prog /tmp/$prog.c /tmp/syzkaller.* 82*bce30c89SPeter Holmexit 0 83