15b42ac29SPeter Holm#!/bin/sh 25b42ac29SPeter Holm 35b42ac29SPeter Holm# panic: Assertion sb->sb_hiwat >= sb->uxdg_cc failed at ../../../kern/uipc_usrreq.c:1099 45b42ac29SPeter Holm# cpuid = 9 55b42ac29SPeter Holm# time = 1660909804 65b42ac29SPeter Holm# KDB: stack backtrace: 75b42ac29SPeter Holm# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01401e7970 85b42ac29SPeter Holm# vpanic() at vpanic+0x151/frame 0xfffffe01401e79c0 95b42ac29SPeter Holm# panic() at panic+0x43/frame 0xfffffe01401e7a20 105b42ac29SPeter Holm# uipc_dgram_sbspace() at uipc_dgram_sbspace+0x51/frame 0xfffffe01401e7a30 115b42ac29SPeter Holm# uipc_sosend_dgram() at uipc_sosend_dgram+0x690/frame 0xfffffe01401e7ac0 125b42ac29SPeter Holm# sosend() at sosend+0x49/frame 0xfffffe01401e7af0 135b42ac29SPeter Holm# soo_write() at soo_write+0x43/frame 0xfffffe01401e7b20 145b42ac29SPeter Holm# filemon_close_log() at filemon_close_log+0xd5/frame 0xfffffe01401e7b90 155b42ac29SPeter Holm# filemon_dtr() at filemon_dtr+0x31/frame 0xfffffe01401e7bb0 165b42ac29SPeter Holm# devfs_destroy_cdevpriv() at devfs_destroy_cdevpriv+0xab/frame 0xfffffe01401e7bd0 175b42ac29SPeter Holm# devfs_close_f() at devfs_close_f+0x64/frame 0xfffffe01401e7c00 185b42ac29SPeter Holm# _fdrop() at _fdrop+0x1b/frame 0xfffffe01401e7c20 195b42ac29SPeter Holm# closef() at closef+0x1db/frame 0xfffffe01401e7cb0 205b42ac29SPeter Holm# fdescfree() at fdescfree+0x433/frame 0xfffffe01401e7d80 215b42ac29SPeter Holm# exit1() at exit1+0x4df/frame 0xfffffe01401e7df0 225b42ac29SPeter Holm# sys_exit() at sys_exit+0xd/frame 0xfffffe01401e7e00 235b42ac29SPeter Holm# amd64_syscall() at amd64_syscall+0x145/frame 0xfffffe01401e7f30 245b42ac29SPeter Holm# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01401e7f30 255b42ac29SPeter Holm# --- syscall (1, FreeBSD ELF64, sys_exit), rip = 0x82301d16a, rsp = 0x8209bf628, rbp = 0x8209bf640 --- 265b42ac29SPeter Holm# KDB: enter: panic 275b42ac29SPeter Holm# [ thread pid 2876 tid 100222 ] 285b42ac29SPeter Holm# Stopped at x32: movq $0,0x12a1323(%rip) 295b42ac29SPeter Holm# db> x/s version 305b42ac29SPeter Holm# version: FreeBSD 14.0-CURRENT #0 main-n257506-eed634d113d-dirty: Thu Aug 18 13:56:53 CEST 2022 315b42ac29SPeter Holm# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO\012 325b42ac29SPeter Holm# db> 335b42ac29SPeter Holm 345b42ac29SPeter Holm. ../default.cfg 355b42ac29SPeter Holmcat > /tmp/syzkaller62.c <<EOF 365b42ac29SPeter Holm// https://syzkaller.appspot.com/bug?id=582310beb894769fc836748eec49b8d2f905e5ef 375b42ac29SPeter Holm// autogenerated by syzkaller (https://github.com/google/syzkaller) 385b42ac29SPeter Holm// Reported-by: syzbot+6e8be1ec8d77578a3df4@syzkaller.appspotmail.com 395b42ac29SPeter Holm 405b42ac29SPeter Holm#define _GNU_SOURCE 415b42ac29SPeter Holm 425b42ac29SPeter Holm#include <pwd.h> 435b42ac29SPeter Holm#include <stdarg.h> 445b42ac29SPeter Holm#include <stdbool.h> 455b42ac29SPeter Holm#include <stdint.h> 465b42ac29SPeter Holm#include <stdio.h> 475b42ac29SPeter Holm#include <stdlib.h> 485b42ac29SPeter Holm#include <string.h> 495b42ac29SPeter Holm#include <sys/endian.h> 505b42ac29SPeter Holm#include <sys/syscall.h> 515b42ac29SPeter Holm#include <unistd.h> 525b42ac29SPeter Holm 535b42ac29SPeter Holmuint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; 545b42ac29SPeter Holm 555b42ac29SPeter Holmint main(void) 565b42ac29SPeter Holm{ 575b42ac29SPeter Holm syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 585b42ac29SPeter Holm intptr_t res = 0; 595b42ac29SPeter Holm memcpy((void*)0x20000040, "/dev/filemon\000", 13); 605b42ac29SPeter Holm res = syscall(SYS_openat, 0xffffffffffffff9cul, 0x20000040ul, 0ul, 0ul); 615b42ac29SPeter Holm if (res != -1) 625b42ac29SPeter Holm r[0] = res; 635b42ac29SPeter Holm res = syscall(SYS_socketpair, 1ul, 2ul, 0, 0x20000080ul); 645b42ac29SPeter Holm if (res != -1) 655b42ac29SPeter Holm r[1] = *(uint32_t*)0x20000084; 665b42ac29SPeter Holm *(uint32_t*)0x200000c0 = r[1]; 675b42ac29SPeter Holm syscall(SYS_ioctl, r[0], 0xc0045301ul, 0x200000c0ul); 685b42ac29SPeter Holm *(uint32_t*)0x20000040 = 3; 695b42ac29SPeter Holm syscall(SYS_setsockopt, r[1], 0xffff, 0x1001, 0x20000040ul, 4ul); 705b42ac29SPeter Holm return 0; 715b42ac29SPeter Holm} 725b42ac29SPeter HolmEOF 735b42ac29SPeter Holmmycc -o /tmp/syzkaller62 -Wall -Wextra -O0 /tmp/syzkaller62.c || exit 1 745b42ac29SPeter Holm 755b42ac29SPeter Holmkldstat | grep -q filemon || { kldload filemon.ko && loaded=1; } 765b42ac29SPeter Holm 775b42ac29SPeter Holm(cd /tmp; timeout -k 3s 2s ./syzkaller62) 785b42ac29SPeter Holm 795b42ac29SPeter Holmrm -rf /tmp/syzkaller62 /tmp/syzkaller62.c /tmp/syzkaller62.core \ 805b42ac29SPeter Holm /tmp/syzkaller.?????? 815b42ac29SPeter Holm# Unload causes: Fatal trap 12: page fault while in kernel mode 825b42ac29SPeter Holm#[ $loaded ] && kldunload -f filemon.ko 835b42ac29SPeter Holmexit 0 84