90 lines
2.9 KiB
Bash
Executable File
90 lines
2.9 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# panic: mutex pcbinfohash not owned at
|
|
# /syzkaller/managers/main/kernel/sys/netinet6/in6_pcb.c:717
|
|
# cpuid = 0
|
|
# time = 1573247472
|
|
# KDB: stack backtrace:
|
|
# db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame
|
|
# 0xfffffe0022a56260
|
|
# vpanic() at vpanic+0x1c7/frame 0xfffffe0022a562d0
|
|
# panic() at panic+0x43/frame 0xfffffe0022a56330
|
|
# __mtx_assert() at __mtx_assert+0x18b/frame 0xfffffe0022a56370
|
|
# in6_pcblookup_local() at in6_pcblookup_local+0x53/frame 0xfffffe0022a563c0
|
|
# in_pcb_lport() at in_pcb_lport+0x3fd/frame 0xfffffe0022a56450
|
|
# in_pcbbind_setup() at in_pcbbind_setup+0x28b/frame 0xfffffe0022a564f0
|
|
# in_pcbconnect_setup() at in_pcbconnect_setup+0x4aa/frame 0xfffffe0022a565b0
|
|
# udp_send() at udp_send+0xee4/frame 0xfffffe0022a566c0
|
|
# udp6_send() at udp6_send+0x4e8/frame 0xfffffe0022a56870
|
|
# sosend_dgram() at sosend_dgram+0x54f/frame 0xfffffe0022a568e0
|
|
# sosend() at sosend+0xc6/frame 0xfffffe0022a56950
|
|
# kern_sendit() at kern_sendit+0x32d/frame 0xfffffe0022a56a00
|
|
# sendit() at sendit+0x226/frame 0xfffffe0022a56a60
|
|
# sys_sendto() at sys_sendto+0x5c/frame 0xfffffe0022a56ac0
|
|
# amd64_syscall() at amd64_syscall+0x473/frame 0xfffffe0022a56bf0
|
|
# fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe0022a56bf0
|
|
# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x41c3aa, rsp =
|
|
|
|
. ../default.cfg
|
|
cat > /tmp/syzkaller2.c <<EOF
|
|
// https://syzkaller.appspot.com/bug?id=062e9fde55f117bec30836a4ef1ef121f51faf23
|
|
// autogenerated by syzkaller (https://github.com/google/syzkaller)
|
|
|
|
#define _GNU_SOURCE
|
|
|
|
#include <pwd.h>
|
|
#include <stdarg.h>
|
|
#include <stdbool.h>
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <sys/endian.h>
|
|
#include <sys/syscall.h>
|
|
#include <unistd.h>
|
|
|
|
uint64_t r[1] = {0xffffffffffffffff};
|
|
|
|
int main(void)
|
|
{
|
|
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul);
|
|
intptr_t res = 0;
|
|
res = syscall(SYS_socket, 0x1cul, 2ul, 0ul);
|
|
if (res != -1)
|
|
r[0] = res;
|
|
*(uint32_t*)0x200001c0 = 0;
|
|
syscall(SYS_setsockopt, r[0], 0x29ul, 0x1bul, 0x200001c0ul, 4ul);
|
|
*(uint8_t*)0x20000100 = 0x1c;
|
|
*(uint8_t*)0x20000101 = 0x1c;
|
|
*(uint16_t*)0x20000102 = htobe16(0x4e21);
|
|
*(uint32_t*)0x20000104 = 0;
|
|
*(uint8_t*)0x20000108 = 0;
|
|
*(uint8_t*)0x20000109 = 0;
|
|
*(uint8_t*)0x2000010a = 0;
|
|
*(uint8_t*)0x2000010b = 0;
|
|
*(uint8_t*)0x2000010c = 0;
|
|
*(uint8_t*)0x2000010d = 0;
|
|
*(uint8_t*)0x2000010e = 0;
|
|
*(uint8_t*)0x2000010f = 0;
|
|
*(uint8_t*)0x20000110 = 0;
|
|
*(uint8_t*)0x20000111 = 0;
|
|
*(uint8_t*)0x20000112 = -1;
|
|
*(uint8_t*)0x20000113 = -1;
|
|
*(uint8_t*)0x20000114 = 0xac;
|
|
*(uint8_t*)0x20000115 = 0x14;
|
|
*(uint8_t*)0x20000116 = 0;
|
|
*(uint8_t*)0x20000117 = 0xaa;
|
|
*(uint32_t*)0x20000118 = 0;
|
|
syscall(SYS_sendto, r[0], 0ul, 0ul, 0ul, 0x20000100ul, 0x1cul);
|
|
return 0;
|
|
}
|
|
EOF
|
|
mycc -o /tmp/syzkaller2 -Wall -Wextra -O2 /tmp/syzkaller2.c ||
|
|
exit 1
|
|
rm /tmp/syzkaller2.c
|
|
|
|
(cd /tmp; ./syzkaller2)
|
|
|
|
rm -f /tmp/syzkaller2 /tmp/syzkaller2.core
|
|
exit 0
|