1#!/bin/sh 2 3# panic: sbflush_internal: ccc 0 mb 0 mbcnt 256 4# cpuid = 6 5# time = 1653879149 6# KDB: stack backtrace: 7# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0694766c00 8# vpanic() at vpanic+0x17f/frame 0xfffffe0694766c50 9# panic() at panic+0x43/frame 0xfffffe0694766cb0 10# sbrelease_internal() at sbrelease_internal+0xb9/frame 0xfffffe0694766cd0 11# solisten_proto() at solisten_proto+0xb5/frame 0xfffffe0694766d30 12# sctp_listen() at sctp_listen+0x2f7/frame 0xfffffe0694766da0 13# solisten() at solisten+0x42/frame 0xfffffe0694766dc0 14# kern_listen() at kern_listen+0x7d/frame 0xfffffe0694766e00 15# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe0694766f30 16# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0694766f30 17# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x82222e7da, rsp = 0x820d68d88, rbp = 0x820d68f00 --- 18# KDB: enter: panic 19# [ thread pid 12921 tid 741095 ] 20# Stopped at kdb_enter+0x32: movq $0,0x1277ff3(%rip) 21# db> x/s version 22# FreeBSD 14.0-CURRENT #0 main-n255847-d46174cd8838b: Sat May 28 20:56:08 CEST 2022 23# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO 24# db> 25 26[ `uname -p` != "amd64" ] && exit 0 27 28. ../default.cfg 29cat > /tmp/syzkaller57.c <<EOF 30// https://syzkaller.appspot.com/bug?id=66d47f23f24ecf5536fd47d81defdb917c307bd2 31// autogenerated by syzkaller (https://github.com/google/syzkaller) 32// Reported-by: syzbot+6c484f116b9dc88f7db1@syzkaller.appspotmail.com 33 34#define _GNU_SOURCE 35 36#include <sys/types.h> 37 38#include <dirent.h> 39#include <errno.h> 40#include <pwd.h> 41#include <setjmp.h> 42#include <signal.h> 43#include <stdarg.h> 44#include <stdbool.h> 45#include <stdint.h> 46#include <stdio.h> 47#include <stdlib.h> 48#include <string.h> 49#include <sys/endian.h> 50#include <sys/stat.h> 51#include <sys/syscall.h> 52#include <sys/wait.h> 53#include <time.h> 54#include <unistd.h> 55 56static __thread int skip_segv; 57static __thread jmp_buf segv_env; 58 59static void segv_handler(int sig, siginfo_t* info, void* ctx __unused) 60{ 61 uintptr_t addr = (uintptr_t)info->si_addr; 62 const uintptr_t prog_start = 1 << 20; 63 const uintptr_t prog_end = 100 << 20; 64 int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; 65 int valid = addr < prog_start || addr > prog_end; 66 if (sig == SIGBUS) { 67 valid = 1; 68 } 69 if (skip && valid) { 70 _longjmp(segv_env, 1); 71 } 72 exit(sig); 73} 74 75static void install_segv_handler(void) 76{ 77 struct sigaction sa; 78 memset(&sa, 0, sizeof(sa)); 79 sa.sa_sigaction = segv_handler; 80 sa.sa_flags = SA_NODEFER | SA_SIGINFO; 81 sigaction(SIGSEGV, &sa, NULL); 82 sigaction(SIGBUS, &sa, NULL); 83} 84 85#define NONFAILING(...) \ 86 ({ \ 87 int ok = 1; \ 88 __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 89 if (_setjmp(segv_env) == 0) { \ 90 __VA_ARGS__; \ 91 } else \ 92 ok = 0; \ 93 __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ 94 ok; \ 95 }) 96 97static void kill_and_wait(int pid, int* status) 98{ 99 kill(pid, SIGKILL); 100 while (waitpid(-1, status, 0) != pid) { 101 } 102} 103 104static void sleep_ms(uint64_t ms) 105{ 106 usleep(ms * 1000); 107} 108 109static uint64_t current_time_ms(void) 110{ 111 struct timespec ts; 112 if (clock_gettime(CLOCK_MONOTONIC, &ts)) 113 exit(1); 114 return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 115} 116 117static void use_temporary_dir(void) 118{ 119 char tmpdir_template[] = "./syzkaller.XXXXXX"; 120 char* tmpdir = mkdtemp(tmpdir_template); 121 if (!tmpdir) 122 exit(1); 123 if (chmod(tmpdir, 0777)) 124 exit(1); 125 if (chdir(tmpdir)) 126 exit(1); 127} 128 129static void __attribute__((noinline)) remove_dir(const char* dir) 130{ 131 DIR* dp = opendir(dir); 132 if (dp == NULL) { 133 if (errno == EACCES) { 134 if (rmdir(dir)) 135 exit(1); 136 return; 137 } 138 exit(1); 139 } 140 struct dirent* ep = 0; 141 while ((ep = readdir(dp))) { 142 if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) 143 continue; 144 char filename[FILENAME_MAX]; 145 snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); 146 struct stat st; 147 if (lstat(filename, &st)) 148 exit(1); 149 if (S_ISDIR(st.st_mode)) { 150 remove_dir(filename); 151 continue; 152 } 153 if (unlink(filename)) 154 exit(1); 155 } 156 closedir(dp); 157 if (rmdir(dir)) 158 exit(1); 159} 160 161static void execute_one(void); 162 163#define WAIT_FLAGS 0 164 165static void loop(void) 166{ 167 int iter = 0; 168 for (;; iter++) { 169 char cwdbuf[32]; 170 sprintf(cwdbuf, "./%d", iter); 171 if (mkdir(cwdbuf, 0777)) 172 exit(1); 173 int pid = fork(); 174 if (pid < 0) 175 exit(1); 176 if (pid == 0) { 177 if (chdir(cwdbuf)) 178 exit(1); 179 execute_one(); 180 exit(0); 181 } 182 int status = 0; 183 uint64_t start = current_time_ms(); 184 for (;;) { 185 if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 186 break; 187 sleep_ms(1); 188 if (current_time_ms() - start < 5000) { 189 continue; 190 } 191 kill_and_wait(pid, &status); 192 break; 193 } 194 remove_dir(cwdbuf); 195 } 196} 197 198uint64_t r[1] = {0xffffffffffffffff}; 199 200void execute_one(void) 201{ 202 intptr_t res = 0; 203 res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 204 if (res != -1) 205 r[0] = res; 206 NONFAILING(*(uint8_t*)0x20000000 = 0x1c); 207 NONFAILING(*(uint8_t*)0x20000001 = 0x1c); 208 NONFAILING(*(uint16_t*)0x20000002 = htobe16(0x4e22)); 209 NONFAILING(*(uint32_t*)0x20000004 = 0x20); 210 NONFAILING(memset((void*)0x20000008, 0, 16)); 211 NONFAILING(*(uint32_t*)0x20000018 = 0x20); 212 syscall(SYS_bind, r[0], 0x20000000ul, 0x1cul); 213 NONFAILING(*(uint8_t*)0x20000180 = 0x1c); 214 NONFAILING(*(uint8_t*)0x20000181 = 0x1c); 215 NONFAILING(*(uint16_t*)0x20000182 = htobe16(0x4e22)); 216 NONFAILING(*(uint32_t*)0x20000184 = 4); 217 NONFAILING(*(uint64_t*)0x20000188 = htobe64(0)); 218 NONFAILING(*(uint64_t*)0x20000190 = htobe64(1)); 219 NONFAILING(*(uint32_t*)0x20000198 = 4); 220 syscall(SYS_connect, r[0], 0x20000180ul, 0x1cul); 221 NONFAILING(memcpy( 222 (void*)0x20000480, 223 "\xa3\x1b\xe1\x78\x8e\x58\x9b\x38\x59\xf3\xbb\xdd\x7e\xf7\x51\x23\x97\x31" 224 "\xb2\x90\x4a\xd0\x4e\xb7\xdc\x37\xc6\x95\xf6\x05\x5c\xa8\x36\x54\x7e\x7b" 225 "\x6c\xc3\x7d\xae\x2a\xe4\x77\x08\x94\x67\x3c\x89\x65\x93\x24\x1c\x56\x3e" 226 "\x08\x69\x05\x35\xeb\x3b\x7f\x19\x7d\xda\x44\x54\xb4\x42\x4f\x34\xc8\x81" 227 "\x69\x4e\xac\xef\xa6\xd4\xb1\x61\x9d\xf1\x0b\x97\x7c\xd9\x82\x16\xc9\x7b" 228 "\x2e\xb3\x9f\x02\xde\x0f\xae\xe7\x0b\xec\xa3\x66\x3c\x2e\x6c\xd1\xca\x02" 229 "\xae\x0f\xd5\x65\xb9\x7c\x5c\xa0\xea\xfc\xa4\xc9\x13\x73\x14\x16\xba\xcc" 230 "\xae\x89\xe2\x68\x77\xfc\x2a\x8c\xa3\xee\xa8\x45\xf7\xc2\xcb\x48\x93\xe5" 231 "\x83\x52\x45\x26\xe3\xeb\x73\xa2\xe4\xf1\x11\xcf\x40\x5f\xef\x99\xc2\xa1" 232 "\xeb\x2c\x96\x70\x56\x88\xc8\xc7\x6b\xa1\x66\xd2\x23\x20\x07\x62\x69\xd2" 233 "\x1c\x52\xbb\x5e\x86\x43\x7d\x6c\x65\x44\x42\xf6\xd8\x45\xe2\xff\x77\xf9" 234 "\x24\xf0\x1d\x29\xf6\xd3\x74\x83\x25\x40\x56\x50\x17\x7f\xc3\x60\xd7\xed" 235 "\xb1\xfb\x7a\x74\x38\x2b\x47\x34\x93\x9c\xee\xc9\xb0\xbf\x7d\xc4\x19\xe2" 236 "\x77\x49\xbc\x71\x9c\x30\x8b\x57\x0f\x13\x4d\x93\x9d\x53\xa8\x03\xc1\x3b" 237 "\x5d\xc3\xbc\x20\xc4\x9e\xc1\x62\x69\xca\x92\x0f\x04\xa1\x0b\xea\xe7\x61" 238 "\x79\x99\x5a\x53\x1a\x27\x40\xf0\x0b\xc5\xe8\xb5\xf0\xd8\x1c\xd2\xca\x99" 239 "\x16\x70\xa8\xc5\xac\x0a\x6b\x99\x31\x0c\x90\xe2\xa5\xe0\xe3\x7c\x99\x3c" 240 "\xbd\xeb\x42\xcf\x74\xe0\xa8\xea\x4e\x64\xd8\x30\x46\x6d\x6e\x83\x7f\x21" 241 "\x00\x5c\xcf\x79\xfe\x19\xdd\xd5\xaf\x69\x9e\x1b\x67\xd5\x3f\x18\x4d\xe5" 242 "\x2a\xec\x02\x12\x92", 243 347)); 244 syscall(SYS_sendto, r[0], 0x20000480ul, 0x15bul, 0x20108ul, 0ul, 0ul); 245 syscall(SYS_listen, r[0], 0x1f); 246} 247int main(void) 248{ 249 syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 250 install_segv_handler(); 251 use_temporary_dir(); 252 loop(); 253 return 0; 254} 255EOF 256mycc -o /tmp/syzkaller57 -Wall -Wextra -O0 /tmp/syzkaller57.c || exit 1 257 258kldstat | grep -q sctp || { kldload sctp.ko && loaded=1; } 259for i in `jot 3`; do 260 (cd /tmp; timeout 3m ./syzkaller57) & 261done 262wait 263 264rm -rf /tmp/syzkaller57 /tmp/syzkaller57.c /tmp/syzkaller57.core \ 265 /tmp/syzkaller.?????? 266[ $loaded ] && kldunload sctp.ko 267exit 0 268