129 lines
4.0 KiB
Bash
Executable File
129 lines
4.0 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb
|
|
# cpuid = 20
|
|
# time = 1593501338
|
|
# KDB: stack backtrace:
|
|
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe013eaf7e90
|
|
# vpanic() at vpanic+0x182/frame 0xfffffe013eaf7ee0
|
|
# panic() at panic+0x43/frame 0xfffffe013eaf7f40
|
|
# ip6_setmoptions() at ip6_setmoptions+0x23b3/frame 0xfffffe013eaf8120
|
|
# ip6_ctloutput() at ip6_ctloutput+0x1f5/frame 0xfffffe013eaf89f0
|
|
# sosetopt() at sosetopt+0xed/frame 0xfffffe013eaf8a50
|
|
# kern_setsockopt() at kern_setsockopt+0xac/frame 0xfffffe013eaf8ab0
|
|
# sys_setsockopt() at sys_setsockopt+0x24/frame 0xfffffe013eaf8ad0
|
|
# amd64_syscall() at amd64_syscall+0x159/frame 0xfffffe013eaf8bf0
|
|
# fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe013eaf8bf0
|
|
# --- syscall (0, FreeBSD ELF64, nosys), rip = 0x80042813a, rsp = 0x7fffffffe518, rbp = 0x7fffffffe570 ---
|
|
# KDB: enter: panic
|
|
# [ thread pid 2853 tid 100445 ]
|
|
# Stopped at kdb_enter+0x37: movq $0,0x10c4cf6(%rip)
|
|
# db> x/s version
|
|
# version: FreeBSD 13.0-CURRENT #0 r362791: Tue Jun 30 08:57:50 CEST 2020
|
|
# pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO
|
|
# db> reset
|
|
|
|
[ `uname -p` != "amd64" ] && exit 0
|
|
|
|
. ../default.cfg
|
|
cat > /tmp/syzkaller18.c <<EOF
|
|
// https://syzkaller.appspot.com/bug?id=c3fe7740671182fd120fa95c67cf305caa9c3397
|
|
// autogenerated by syzkaller (https://github.com/google/syzkaller)
|
|
// Reported-by: syzbot+d01ab3d5e6c1516a393c@syzkaller.appspotmail.com
|
|
|
|
#define _GNU_SOURCE
|
|
|
|
#include <pwd.h>
|
|
#include <stdarg.h>
|
|
#include <stdbool.h>
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <sys/endian.h>
|
|
#include <sys/syscall.h>
|
|
#include <unistd.h>
|
|
|
|
uint64_t r[1] = {0xffffffffffffffff};
|
|
|
|
int main(void)
|
|
{
|
|
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
|
|
intptr_t res = 0;
|
|
res = syscall(SYS_socket, 0x1cul, 2ul, 0);
|
|
if (res != -1)
|
|
r[0] = res;
|
|
*(uint32_t*)0x200001c0 = 0;
|
|
syscall(SYS_setsockopt, r[0], 0x29, 0x1b, 0x200001c0ul, 4ul);
|
|
*(uint8_t*)0x20000080 = 0x1c;
|
|
*(uint8_t*)0x20000081 = 0x1c;
|
|
*(uint16_t*)0x20000082 = htobe16(0x4e20);
|
|
*(uint32_t*)0x20000084 = 0;
|
|
*(uint8_t*)0x20000088 = 0;
|
|
*(uint8_t*)0x20000089 = 0;
|
|
*(uint8_t*)0x2000008a = 0;
|
|
*(uint8_t*)0x2000008b = 0;
|
|
*(uint8_t*)0x2000008c = 0;
|
|
*(uint8_t*)0x2000008d = 0;
|
|
*(uint8_t*)0x2000008e = 0;
|
|
*(uint8_t*)0x2000008f = 0;
|
|
*(uint8_t*)0x20000090 = 0;
|
|
*(uint8_t*)0x20000091 = 0;
|
|
*(uint8_t*)0x20000092 = -1;
|
|
*(uint8_t*)0x20000093 = -1;
|
|
*(uint32_t*)0x20000094 = htobe32(0x7f000001);
|
|
*(uint32_t*)0x20000098 = 0;
|
|
syscall(SYS_bind, r[0], 0x20000080ul, 0x18ul);
|
|
*(uint32_t*)0x200002c0 = 0;
|
|
*(uint8_t*)0x200002c8 = 0x1c;
|
|
*(uint8_t*)0x200002c9 = 0x1c;
|
|
*(uint16_t*)0x200002ca = htobe16(0x4e23);
|
|
*(uint32_t*)0x200002cc = 4;
|
|
*(uint8_t*)0x200002d0 = -1;
|
|
*(uint8_t*)0x200002d1 = 1;
|
|
*(uint8_t*)0x200002d2 = 0;
|
|
*(uint8_t*)0x200002d3 = 0;
|
|
*(uint8_t*)0x200002d4 = 0;
|
|
*(uint8_t*)0x200002d5 = 0;
|
|
*(uint8_t*)0x200002d6 = 0;
|
|
*(uint8_t*)0x200002d7 = 0;
|
|
*(uint8_t*)0x200002d8 = 0;
|
|
*(uint8_t*)0x200002d9 = 0;
|
|
*(uint8_t*)0x200002da = 0;
|
|
*(uint8_t*)0x200002db = 0;
|
|
*(uint8_t*)0x200002dc = 0;
|
|
*(uint8_t*)0x200002dd = 0;
|
|
*(uint8_t*)0x200002de = 0;
|
|
*(uint8_t*)0x200002df = 1;
|
|
*(uint32_t*)0x200002e0 = 0x80000000;
|
|
*(uint64_t*)0x200002e8 = 0;
|
|
*(uint64_t*)0x200002f0 = 0;
|
|
*(uint64_t*)0x200002f8 = 0;
|
|
*(uint64_t*)0x20000300 = 0;
|
|
*(uint64_t*)0x20000308 = 0;
|
|
*(uint64_t*)0x20000310 = 0;
|
|
*(uint64_t*)0x20000318 = 0;
|
|
*(uint64_t*)0x20000320 = 0;
|
|
*(uint64_t*)0x20000328 = 0;
|
|
*(uint64_t*)0x20000330 = 0;
|
|
*(uint64_t*)0x20000338 = 0;
|
|
*(uint64_t*)0x20000340 = 0;
|
|
syscall(SYS_setsockopt, r[0], 0x29, 0x51, 0x200002c0ul, 0x88ul);
|
|
return 0;
|
|
}
|
|
EOF
|
|
mycc -o /tmp/syzkaller18 -Wall -Wextra -O0 /tmp/syzkaller18.c ||
|
|
exit 1
|
|
|
|
(cd ../testcases/swap; ./swap -t 1m -i 20 -h > /dev/null 2>&1) &
|
|
start=`date +%s`
|
|
while pgrep -q swap; do
|
|
(cd /tmp; timeout 1m ./syzkaller18)
|
|
[ $((`date +%s` - start)) -ge 60 ] && break
|
|
done
|
|
pkill -9 syzkaller18 swap
|
|
wait
|
|
|
|
rm -f /tmp/syzkaller18 /tmp/syzkaller18.c /tmp/syzkaller18.core
|
|
exit 0
|