xref: /freebsd/tools/test/stress2/misc/syzkaller82.sh (revision c1c58c0019430c9df12499e14046fe077c62c6d3)

#!/bin/sh

# panic: m_apply, length > size of mbuf chain (8 extra)
# cpuid = 1
# time = 1753341719
# KDB: stack backtrace:
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01f00c5080
# vpanic() at vpanic+0x136/frame 0xfffffe01f00c51b0
# panic() at panic+0x43/frame 0xfffffe01f00c5210
# m_apply() at m_apply+0x2d3/frame 0xfffffe01f00c5260
# sctp_delayed_cksum() at sctp_delayed_cksum+0x4c/frame 0xfffffe01f00c5290
# ip6_output_delayed_csum() at ip6_output_delayed_csum+0xaa/frame 0xfffffe01f00c52d0
# ip6_output() at ip6_output+0x19e6/frame 0xfffffe01f00c5490
# sctp_lowlevel_chunk_output() at sctp_lowlevel_chunk_output+0x104f/frame 0xfffffe01f00c55d0
# sctp_med_chunk_output() at sctp_med_chunk_output+0x2ad2/frame 0xfffffe01f00c5fb0
# sctp_chunk_output() at sctp_chunk_output+0x121c/frame 0xfffffe01f00c6960
# sctp_lower_sosend() at sctp_lower_sosend+0x146c/frame 0xfffffe01f00c6b50
# sctp_sosend() at sctp_sosend+0x333/frame 0xfffffe01f00c6c70
# sousrsend() at sousrsend+0x79/frame 0xffkern_sendit() at kern_sendit+0x1be/frame 0xfffffe01f00c6d60
# sendit() at sendit+0x1ab/frame 0xfffffe01f00c6db0
# sys_sendto() at sys_sendto+0x4d/frame 0xfffffe01f00c6e00
# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe01f00c6f30
# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01f00c6f30
# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x823035b0a, rsp = 0x8208fa048, rbp = 0x8208fa060 ---
# KDB: enter: panic
# [ thread pid 41871 tid 736799 ]
# Stopped at      kdb_enter+0x33: movq    $0,0x1231b52(%rip)
# db> x/s version
# version: FreeBSD 15.0-CURRENT #0 main-n279001-7502c1f27082-dirty: Wed Jul 23 20:31:48 CEST 2025
# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
# db>

[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1

. ../default.cfg
set -u
prog=$(basename "$0" .sh)
cat > /tmp/$prog.c <<EOF
// https://syzkaller.appspot.com/bug?id=09297b76b7db4aa29c86ac971062bc078b06c0ff
// autogenerated by syzkaller (https://github.com/google/syzkaller)
// syzbot+73fe316271df473230eb@syzkaller.appspotmail.com

#define _GNU_SOURCE

#include <pwd.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <unistd.h>

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  res = syscall(SYS_socket, /*domain=*/0x1cul, /*type=SOCK_STREAM*/ 1ul,
                /*proto=*/0x84);
  if (res != -1)
    r[0] = res;
  *(uint8_t*)0x2000000001c0 = 0x10;
  *(uint8_t*)0x2000000001c1 = 2;
  *(uint16_t*)0x2000000001c2 = htobe16(0x4e23);
  *(uint32_t*)0x2000000001c4 = htobe32(0);
  memset((void*)0x2000000001c8, 0, 8);
  memset((void*)0x2000000001d0, 0, 112);
  *(uint32_t*)0x200000000240 = 0;
  *(uint32_t*)0x200000000244 = 0x5234;
  *(uint32_t*)0x200000000248 = 0xffff;
  *(uint32_t*)0x20000000024c = 0x314;
  *(uint32_t*)0x200000000250 = 0x3bb;
  *(uint16_t*)0x200000000254 = 2;
  *(uint8_t*)0x200000000256 = 9;
  syscall(SYS_setsockopt, /*fd=*/r[0], /*level=*/0x84, /*opt=*/0xa,
          /*val=*/0x2000000001c0ul, /*len=*/0x98ul);
  *(uint8_t*)0x200000000000 = 0x1c;
  *(uint8_t*)0x200000000001 = 0x1c;
  *(uint16_t*)0x200000000002 = htobe16(0x4e22);
  *(uint32_t*)0x200000000004 = 0;
  memset((void*)0x200000000008, 0, 16);
  *(uint32_t*)0x200000000018 = 0;
  syscall(SYS_bind, /*fd=*/r[0], /*addr=*/0x200000000000ul, /*addrlen=*/0x1cul);
  *(uint8_t*)0x200000000180 = 0x5f;
  *(uint8_t*)0x200000000181 = 0x1c;
  *(uint16_t*)0x200000000182 = htobe16(0x4e22);
  *(uint32_t*)0x200000000184 = 0;
  *(uint64_t*)0x200000000188 = htobe64(0);
  *(uint64_t*)0x200000000190 = htobe64(1);
  *(uint32_t*)0x200000000198 = 0;
  syscall(SYS_connect, /*fd=*/r[0], /*addr=*/0x200000000180ul,
          /*addrlen=*/0x1cul);
  memset((void*)0x2000000020c0, 209, 1);
  syscall(SYS_sendto, /*fd=*/r[0], /*buf=*/0x2000000020c0ul, /*len=*/0xffeful,
          /*f=MSG_NOSIGNAL|MSG_EOF|MSG_DONTWAIT|MSG_DONTROUTE*/ 0x20184ul,
          /*addr=*/0ul, /*addrlen=*/0ul);
  return 0;
}
EOF
mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c || exit 1

work=/tmp/$prog.dir
rm -rf $work
mkdir $work
cd /tmp/$prog.dir
kldstat | grep -q sctp || { kldload sctp.ko && loaded=1; }
timeout 3m /tmp/$prog > /dev/null 2>&1

rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work
[ $loaded ] && kldunload sctp.ko
exit 0