1#!/bin/sh 2 3# panic: in_pcblookup_hash_locked: invalid local address 4# cpuid = 11 5# time = 1678303805 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0657e466d0 8# vpanic() at vpanic+0x152/frame 0xfffffe0657e46720 9# panic() at panic+0x43/frame 0xfffffe0657e46780 10# in_pcblookup_hash_locked() at in_pcblookup_hash_locked+0x4e2/frame 0xfffffe0657e467f0 11# in_pcb_lport_dest() at in_pcb_lport_dest+0x28a/frame 0xfffffe0657e468a0 12# in_pcbconnect_setup() at in_pcbconnect_setup+0x31b/frame 0xfffffe0657e46940 13# udp_send() at udp_send+0x68b/frame 0xfffffe0657e46a50 14# udp6_send() at udp6_send+0x287/frame 0xfffffe0657e46c10 15# sosend_dgram() at sosend_dgram+0x327/frame 0xfffffe0657e46c70 16# sousrsend() at sousrsend+0x7e/frame 0xfffffe0657e46cd0 17# kern_sendit() at kern_sendit+0x1bc/frame 0xfffffe0657e46d60 18# sendit() at sendit+0xba/frame 0xfffffe0657e46db0 19# sys_sendto() at sys_sendto+0x4d/frame 0xfffffe0657e46e00 20# amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe0657e46f30 21# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0657e46f30 22# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x822a3a31a, rsp = 0x8208224d8, rbp = 0x820822500 --- 23# KDB: enter: panic 24# [ thread pid 47141 tid 357973 ] 25# Stopped at kdb_enter+0x32: movq $0,0x12906d3(%rip) 26# db> x/s version 27# FreeBSD 14.0-CURRENT #0 main-n261389-109abf744bf76: Wed Mar 8 06:10:24 CET 2023 28# pho@mercat1.netperf.freebsd.org:/usr/src/sys/a 29# db> 30 31[ `uname -p` != "amd64" ] && exit 0 32[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 33 34. ../default.cfg 35prog=$(basename "$0" .sh) 36cat > /tmp/$prog.c <<EOF 37// https://syzkaller.appspot.com/bug?id=7cae38958ddfe2c338548b4217587bd6d89b43e2 38// autogenerated by syzkaller (https://github.com/google/syzkaller) 39// Reported-by: syzbot+c8e3dac881bba85bc029@syzkaller.appspotmail.com 40 41#define _GNU_SOURCE 42 43#include <pwd.h> 44#include <stdarg.h> 45#include <stdbool.h> 46#include <stdint.h> 47#include <stdio.h> 48#include <stdlib.h> 49#include <string.h> 50#include <sys/endian.h> 51#include <sys/syscall.h> 52#include <unistd.h> 53 54uint64_t r[1] = {0xffffffffffffffff}; 55 56int main(void) 57{ 58 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 59 intptr_t res = 0; 60 res = syscall(SYS_socket, 0x1cul, 2ul, 0); 61 if (res != -1) 62 r[0] = res; 63 *(uint32_t*)0x200001c0 = 0; 64 syscall(SYS_setsockopt, r[0], 0x29, 0x1b, 0x200001c0ul, 4ul); 65 *(uint8_t*)0x20000000 = 0x1c; 66 *(uint8_t*)0x20000001 = 0x1c; 67 *(uint16_t*)0x20000002 = htobe16(0x4e22); 68 *(uint32_t*)0x20000004 = 0; 69 memset((void*)0x20000008, 0, 10); 70 memset((void*)0x20000012, 255, 2); 71 *(uint32_t*)0x20000014 = htobe32(0); 72 *(uint32_t*)0x20000018 = 0; 73 syscall(SYS_sendto, r[0], 0ul, 0ul, 0ul, 0x20000000ul, 0x1cul); 74 return 0; 75} 76EOF 77mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 78 79(cd /tmp; timeout 2m ./$prog) 80 81rm -rf /tmp/$prog /tmp/$prog.c /tmp/syzkaller.* 82exit 0 83