1#!/bin/sh 2 3# panic: Counter goes negative 4# cpuid = 4 5# time = 1694583637 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01bac2a960 8# vpanic() at vpanic+0x132/frame 0xfffffe01bac2aa90 9# panic() at panic+0x43/frame 0xfffffe01bac2aaf0 10# sctp_inpcb_free() at sctp_inpcb_free+0xf28/frame 0xfffffe01bac2ab60 11# sctp_close() at sctp_close+0xc0/frame 0xfffffe01bac2abb0 12# soclose() at soclose+0x154/frame 0xfffffe01bac2ac10 13# _fdrop() at _fdrop+0x1b/frame 0xfffffe01bac2ac30 14# closef() at closef+0x1e3/frame 0xfffffe01bac2acc0 15# fdescfree() at fdescfree+0x41a/frame 0xfffffe01bac2ad80 16# exit1() at exit1+0x4a1/frame 0xfffffe01bac2adf0 17# sys_exit() at sys_exit+0xd/frame 0xfffffe01bac2ae00 18# amd64_syscall() at amd64_syscall+0x14f/frame 0xfffffe01bac2af30 19# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01bac2af30 20# --- syscall (1, FreeBSD ELF64, exit), rip = 0x824db2f4a, rsp = 0x8211862b8, rbp = 0x8211862d0 --- 21# KDB: enter: pani[ thread pid 9676 tid 346853 ] 22# Stopped at kdb_enter+0x32: movq $0,0xe27583(%rip) 23# db> x/s version 24# version: FreeBSD 15.0-CURRENT #0 main-n265298-10db91ecec98b1: Tue Sep 12 12:16:45 CEST 2023 25# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO 26# db> 27 28uname -p | grep -Eq "amd64" || exit 0 29[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 30 31. ../default.cfg 32set -u 33prog=$(basename "$0" .sh) 34cat > /tmp/$prog.c <<EOF 35// https://syzkaller.appspot.com/bug?id=d8a54d453b8e643b807a5c3c56728561f01c0fde 36// autogenerated by syzkaller (https://github.com/google/syzkaller) 37// Reported-by: syzbot+d4e1d30d578891245f59@syzkaller.appspotmail.com 38 39#define _GNU_SOURCE 40 41#include <sys/types.h> 42 43#include <pwd.h> 44#include <signal.h> 45#include <stdarg.h> 46#include <stdbool.h> 47#include <stdint.h> 48#include <stdio.h> 49#include <stdlib.h> 50#include <string.h> 51#include <sys/endian.h> 52#include <sys/syscall.h> 53#include <sys/wait.h> 54#include <time.h> 55#include <unistd.h> 56 57static unsigned long long procid; 58 59static void kill_and_wait(int pid, int* status) 60{ 61 kill(pid, SIGKILL); 62 while (waitpid(-1, status, 0) != pid) { 63 } 64} 65 66static void sleep_ms(uint64_t ms) 67{ 68 usleep(ms * 1000); 69} 70 71static uint64_t current_time_ms(void) 72{ 73 struct timespec ts; 74 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 75 exit(1); 76 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 77} 78 79static void execute_one(void); 80 81#define WAIT_FLAGS 0 82 83static void loop(void) 84{ 85 int iter __unused = 0; 86 for (;; iter++) { 87 int pid = fork(); 88 if (pid < 0) 89 exit(1); 90 if (pid == 0) { 91 execute_one(); 92 exit(0); 93 } 94 int status = 0; 95 uint64_t start = current_time_ms(); 96 for (;;) { 97 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 98 break; 99 sleep_ms(1); 100 if (current_time_ms() - start < 5000) 101 continue; 102 kill_and_wait(pid, &status); 103 break; 104 } 105 } 106} 107 108uint64_t r[1] = {0xffffffffffffffff}; 109 110void execute_one(void) 111{ 112 intptr_t res = 0; 113 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 114 if (res != -1) 115 r[0] = res; 116 *(uint8_t*)0x20000040 = 0x1c; 117 *(uint8_t*)0x20000041 = 0x1c; 118 *(uint16_t*)0x20000042 = htobe16(0x4e22 + procid * 4); 119 *(uint32_t*)0x20000044 = 0; 120 *(uint64_t*)0x20000048 = htobe64(0); 121 *(uint64_t*)0x20000050 = htobe64(1); 122 *(uint32_t*)0x20000058 = 0; 123 syscall(SYS_bind, r[0], 0x20000040ul, 0x1cul); 124 *(uint8_t*)0x20000180 = 0x1c; 125 *(uint8_t*)0x20000181 = 0x1c; 126 *(uint16_t*)0x20000182 = htobe16(0x4e22 + procid * 4); 127 *(uint32_t*)0x20000184 = 0; 128 *(uint64_t*)0x20000188 = htobe64(0); 129 *(uint64_t*)0x20000190 = htobe64(1); 130 *(uint32_t*)0x20000198 = 0; 131 syscall(SYS_connect, r[0], 0x20000180ul, 0x1cul); 132 *(uint32_t*)0x20000300 = 0x80000021; 133 syscall(SYS_setsockopt, r[0], 0x84, 0x1b, 0x20000300ul, 4ul); 134 memset((void*)0x20000480, 163, 1); 135 syscall(SYS_sendto, r[0], 0x20000480ul, 0xfffffe5cul, 0x188ul, 0ul, 0ul); 136 *(uint16_t*)0x200000c0 = 0; 137 *(uint16_t*)0x200000c2 = 0x200; 138 *(uint32_t*)0x200000c4 = 0; 139 *(uint32_t*)0x200000c8 = 0; 140 *(uint32_t*)0x200000cc = 0; 141 syscall(SYS_setsockopt, r[0], 0x84, 0x21, 0x200000c0ul, 0x10ul); 142 syscall(SYS_shutdown, r[0], 0ul); 143 syscall(SYS_writev, r[0], 0ul, 0ul); 144} 145int main(void) 146{ 147 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 148 for (procid = 0; procid < 4; procid++) { 149 if (fork() == 0) { 150 loop(); 151 } 152 } 153 sleep(1000000); 154 return 0; 155} 156EOF 157mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 158 159mount | grep -q "on $mntpoint " && umount $mntpoint 160mount -o size=10m -t tmpfs dummy $mntpoint 161 162cd $mntpoint 163for i in `jot 20`; do 164 timeout 3m /tmp/$prog & 165done 166wait 167cd - 168 169umount $mntpoint 170rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core 171exit 0 172