1*abe84e61SPeter Holm#!/bin/sh 2*abe84e61SPeter Holm 3*abe84e61SPeter Holm# panic: mutex so_rcv not owned at ../../../kern/uipc_usrreq.c:1750 4*abe84e61SPeter Holm# cpuid = 5 5*abe84e61SPeter Holm# time = 1746938647 6*abe84e61SPeter Holm# KDB: stack backtrace: 7*abe84e61SPeter Holm# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01e75c5b40 8*abe84e61SPeter Holm# vpanic() at vpanic+0x136/frame 0xfffffe01e75c5c70 9*abe84e61SPeter Holm# panic() at panic+0x43/frame 0xfffffe01e75c5cd0 10*abe84e61SPeter Holm# __mtx_assert() at __mtx_assert+0xa9/frame 0xfffffe01e75c5ce0 11*abe84e61SPeter Holm# knote() at knote+0x45/frame 0xfffffe01e75c5d30 12*abe84e61SPeter Holm# sowwakeup_locked() at sowwakeup_locked+0xc8/frame 0xfffffe01e75c5d50 13*abe84e61SPeter Holm# socantsendmore() at socantsendmore+0x4f/frame 0xfffffe01e75c5d70 14*abe84e61SPeter Holm# uipc_shutdown() at uipc_shutdown+0x113/frame 0xfffffe01e75c5db0 15*abe84e61SPeter Holm# soshutdown() at soshutdown+0x3e/frame 0xfffffe01e75c5dd0 16*abe84e61SPeter Holm# kern_shutdown() at kern_shutdown+0x5e/frame 0xfffffe01e75c5e00 17*abe84e61SPeter Holm# amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe01e75c5f30 18*abe84e61SPeter Holm# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01e75c5f30 19*abe84e61SPeter Holm# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x82281772a, rsp = 0x82092efd8, rbp = 0x82092f000 --- 20*abe84e61SPeter Holm# KDB: enter: panic 21*abe84e61SPeter Holm# [ thread pid 54792 tid 1014483 ] 22*abe84e61SPeter Holm# Stopped at kdb_enter+0x33: movq $0,0x122f192(%rip) 23*abe84e61SPeter Holm# db> x/s version 24*abe84e61SPeter Holm# version: FreeBSD 15.0-CURRENT #0 main-n277201-48578dcb6b7e-dirty: Sat May 10 13:10:42 CEST 2025 25*abe84e61SPeter Holm# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO 26*abe84e61SPeter Holm# db> 27*abe84e61SPeter Holm 28*abe84e61SPeter Holm[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1 29*abe84e61SPeter Holm 30*abe84e61SPeter Holm. ../default.cfg 31*abe84e61SPeter Holmset -u 32*abe84e61SPeter Holmprog=$(basename "$0" .sh) 33*abe84e61SPeter Holmcat > /tmp/$prog.c <<EOF 34*abe84e61SPeter Holm// https://syzkaller.appspot.com/bug?id=ac94349a29f2efc40e9274239e4ca9b2c473a4e7 35*abe84e61SPeter Holm// autogenerated by syzkaller (https://github.com/google/syzkaller) 36*abe84e61SPeter Holm// syzkaller.appspot.com/x/repro.c?x=16c074d4580000 37*abe84e61SPeter Holm 38*abe84e61SPeter Holm#define _GNU_SOURCE 39*abe84e61SPeter Holm 40*abe84e61SPeter Holm#include <pwd.h> 41*abe84e61SPeter Holm#include <stdarg.h> 42*abe84e61SPeter Holm#include <stdbool.h> 43*abe84e61SPeter Holm#include <stdint.h> 44*abe84e61SPeter Holm#include <stdio.h> 45*abe84e61SPeter Holm#include <stdlib.h> 46*abe84e61SPeter Holm#include <string.h> 47*abe84e61SPeter Holm#include <sys/endian.h> 48*abe84e61SPeter Holm#include <sys/syscall.h> 49*abe84e61SPeter Holm#include <unistd.h> 50*abe84e61SPeter Holm 51*abe84e61SPeter Holmuint64_t r[1] = {0xffffffffffffffff}; 52*abe84e61SPeter Holm 53*abe84e61SPeter Holmint main(void) 54*abe84e61SPeter Holm{ 55*abe84e61SPeter Holm syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, 56*abe84e61SPeter Holm /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, 57*abe84e61SPeter Holm /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, 58*abe84e61SPeter Holm /*fd=*/(intptr_t)-1, /*offset=*/0ul); 59*abe84e61SPeter Holm const char* reason; 60*abe84e61SPeter Holm (void)reason; 61*abe84e61SPeter Holm intptr_t res = 0; 62*abe84e61SPeter Holm if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { 63*abe84e61SPeter Holm } 64*abe84e61SPeter Holm res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul, 65*abe84e61SPeter Holm /*proto=*/0, /*fds=*/0x200000000040ul); 66*abe84e61SPeter Holm if (res != -1) 67*abe84e61SPeter Holm r[0] = *(uint32_t*)0x200000000044; 68*abe84e61SPeter Holm syscall(SYS_fcntl, /*fd=*/r[0], /*cmd=*/4ul, /*flags=FASYNC*/ 0x40ul); 69*abe84e61SPeter Holm syscall(SYS_shutdown, /*fd=*/r[0], /*how=*/2ul); 70*abe84e61SPeter Holm return 0; 71*abe84e61SPeter Holm} 72*abe84e61SPeter HolmEOF 73*abe84e61SPeter Holmmycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1 74*abe84e61SPeter Holm 75*abe84e61SPeter Holmwork=/tmp/$prog.dir 76*abe84e61SPeter Holmrm -rf $work 77*abe84e61SPeter Holmmkdir $work 78*abe84e61SPeter Holmcd /tmp/$prog.dir 79*abe84e61SPeter Holmtimeout 3m /tmp/$prog > /dev/null 2>&1 80*abe84e61SPeter Holm 81*abe84e61SPeter Holmrm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work 82*abe84e61SPeter Holmexit 0 83