1100384Speter#!/bin/sh 2100384Speter 3100384Speter# panic: Counter goes negative 4100384Speter# cpuid = 8 5100384Speter# time = 1653397881 6100384Speter# KDB: stack backtrace: 7100384Speter# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe014386fa40 8100384Speter# vpanic() at vpanic+0x17f/frame 0xfffffe014386fa90 9100384Speter# panic() at panic+0x43/frame 0xfffffe014386faf0 10100384Speter# sctp_sorecvmsg() at sctp_sorecvmsg+0xf8e/frame 0xfffffe014386fc10 11100384Speter# sctp_soreceive() at sctp_soreceive+0x196/frame 0xfffffe014386fe00 12100384Speter# soreceive() at soreceive+0x4b/frame 0xfffffe014386fe20 13100384Speter# soaio_process_sb() at soaio_process_sb+0x581/frame 0xfffffe014386feb0 14100384Speter# soaio_kproc_loop() at soaio_kproc_loop+0xa9/frame 0xfffffe014386fef0 15100384Speter# fork_exit() at fork_exit+0x80/frame 0xfffffe014386ff30 16100384Speter# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe014386ff30 17100384Speter# --- trap 0xc, rip = 0x8220e08da, rsp = 0x820a211b8, rbp = 0x820a211e0 --- 18100384Speter# KDB: enter: panic 19100384Speter# [ thread pid 78762 tid 931834 ] 20100384Speter# Stopped at kdb_enter+0x32: movq $0,0x1278fc3(%rip) 21100384Speter# db> x/s version 22100384Speter# FreeBSD 14.0-CURRENT #0 reap-n255780-cbbb27164fa: Tue May 24 13:42:53 CEST 2022 23100384Speter# pho@mercat1.netperf.freebsd.org:/var/tmp/deviant3/sys/amd64/compile/PHO 24100384Speter# db> 25100384Speter 26100384Speter[ `uname -p` != "amd64" ] && exit 0 27118031Sobrien 28118031Sobrien. ../default.cfg 29118031Sobriencat > /tmp/syzkaller55.c <<EOF 30104738Speter// https://syzkaller.appspot.com/bug?id=ce7f451c017537296074d9203baaec292b311365 31104738Speter// autogenerated by syzkaller (https://github.com/google/syzkaller) 32100384Speter// Reported-by: syzbot+e256d42e9b390564530a@syzkaller.appspotmail.com 33100384Speter 34100384Speter#define _GNU_SOURCE 35100384Speter 36100384Speter#include <sys/types.h> 37100384Speter 38123746Speter#include <pwd.h> 39100384Speter#include <signal.h> 40100384Speter#include <stdarg.h> 41100384Speter#include <stdbool.h> 42100384Speter#include <stdint.h> 43100384Speter#include <stdio.h> 44100384Speter#include <stdlib.h> 45100384Speter#include <string.h> 46100384Speter#include <sys/endian.h> 47100384Speter#include <sys/syscall.h> 48100384Speter#include <sys/wait.h> 49100384Speter#include <time.h> 50100384Speter#include <unistd.h> 51100384Speter 52100384Speterstatic unsigned long long procid; 53100384Speter 54100384Speterstatic void kill_and_wait(int pid, int* status) 55100384Speter{ 56100384Speter kill(pid, SIGKILL); 57100384Speter while (waitpid(-1, status, 0) != pid) { 58100384Speter } 59100384Speter} 60100384Speter 61113859Sjhbstatic void sleep_ms(uint64_t ms) 62100384Speter{ 63100384Speter usleep(ms * 1000); 64100384Speter} 65100384Speter 66100384Speterstatic uint64_t current_time_ms(void) 67100384Speter{ 68127140Sjhb struct timespec ts; 69100384Speter if (clock_gettime(CLOCK_MONOTONIC, &ts)) 70100384Speter exit(1); 71100384Speter return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; 72100384Speter} 73100384Speter 74100384Speterstatic void execute_one(void); 75100384Speter 76100384Speter#define WAIT_FLAGS 0 77100384Speter 78119333Speterstatic void loop(void) 79119333Speter{ 80119333Speter int iter __unused = 0; 81100384Speter for (;; iter++) { 82121719Speter int pid = fork(); 83121719Speter if (pid < 0) 84121719Speter exit(1); 85121719Speter if (pid == 0) { 86121719Speter execute_one(); 87100384Speter exit(0); 88119333Speter } 89100384Speter int status = 0; 90127140Sjhb uint64_t start = current_time_ms(); 91127140Sjhb for (;;) { 92136152Sjhb if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) 93100384Speter break; 94136152Sjhb sleep_ms(1); 95136152Sjhb if (current_time_ms() - start < 5000) 96136152Sjhb continue; 97136152Sjhb kill_and_wait(pid, &status); 98136152Sjhb break; 99100384Speter } 100100384Speter } 101127140Sjhb} 102127140Sjhb 103127140Sjhbuint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; 104100384Speter 105100384Spetervoid execute_one(void) 106100384Speter{ 107100384Speter intptr_t res = 0; 108100384Speter res = syscall(SYS_socket, 0x1cul, 1ul, 0x84); 109100384Speter if (res != -1) 110100384Speter r[0] = res; 111100384Speter *(uint8_t*)0x20000000 = 0x1c; 112100384Speter *(uint8_t*)0x20000001 = 0x1c; 113100384Speter *(uint16_t*)0x20000002 = htobe16(0x4e23 + procid * 4); 114100384Speter *(uint32_t*)0x20000004 = 0; 115100384Speter memset((void*)0x20000008, 0, 16); 116100384Speter *(uint32_t*)0x20000018 = 0; 117100384Speter syscall(SYS_bind, r[0], 0x20000000ul, 0x1cul); 118100384Speter *(uint8_t*)0x20000080 = 0x1c; 119100384Speter *(uint8_t*)0x20000081 = 0x1c; 120127140Sjhb *(uint16_t*)0x20000082 = htobe16(0x4e23 + procid * 4); 121100384Speter *(uint32_t*)0x20000084 = 0; 122100384Speter *(uint64_t*)0x20000088 = htobe64(0); 123100384Speter *(uint64_t*)0x20000090 = htobe64(1); 124100384Speter *(uint32_t*)0x20000098 = 0; 125128597Smarcel syscall(SYS_connect, r[0], 0x20000080ul, 0x1cul); 126100384Speter *(uint32_t*)0x20000400 = r[0]; 127100384Speter *(uint64_t*)0x20000408 = 0; 128100384Speter *(uint64_t*)0x20000410 = 0x20000040; 129100384Speter memset((void*)0x20000040, 27, 1); 130100384Speter *(uint64_t*)0x20000418 = 1; 131100384Speter *(uint32_t*)0x20000420 = 0; 132100384Speter *(uint32_t*)0x20000424 = 0; 133100384Speter *(uint64_t*)0x20000428 = 0; 134100384Speter *(uint32_t*)0x20000430 = 0; 135100384Speter *(uint32_t*)0x20000434 = 0; 136100384Speter *(uint64_t*)0x20000438 = 0; 137100384Speter *(uint64_t*)0x20000440 = 0; 138100384Speter *(uint64_t*)0x20000448 = 0; 139100384Speter *(uint32_t*)0x20000450 = 0; 140100384Speter *(uint32_t*)0x20000454 = 0; 141100384Speter *(uint32_t*)0x20000458 = 0; 142100384Speter *(uint64_t*)0x20000460 = 0; 143100384Speter *(uint64_t*)0x20000468 = 0; 144100384Speter *(uint64_t*)0x20000470 = 0; 145100384Speter *(uint64_t*)0x20000478 = 0; 146128260Speter *(uint64_t*)0x20000480 = 0; 147100384Speter *(uint64_t*)0x20000488 = 0; 148100384Speter *(uint64_t*)0x20000490 = 0; 149100384Speter *(uint64_t*)0x20000498 = 0; 150128260Speter syscall(SYS_aio_read, 0x20000400ul); 151100384Speter memset((void*)0x200000c0, 89, 1); 152128597Smarcel syscall(SYS_sendto, r[0], 0x200000c0ul, 1ul, 0ul, 0ul, 0ul); 153100384Speter syscall(SYS_shutdown, r[0], 0ul); 154128597Smarcel res = syscall(SYS_socket, 0x1cul, 5ul, 0x84); 155100384Speter if (res != -1) 156128260Speter r[1] = res; 157100384Speter *(uint64_t*)0x200003c0 = 0; 158100384Speter *(uint32_t*)0x200003c8 = 0; 159100384Speter *(uint64_t*)0x200003d0 = 0x20000300; 160100384Speter *(uint64_t*)0x20000300 = 0x20000200; 161100384Speter memset((void*)0x20000200, 30, 1); 162100384Speter *(uint64_t*)0x20000308 = 1; 163100384Speter *(uint32_t*)0x200003d8 = 1; 164107849Salfred *(uint64_t*)0x200003e0 = 0; 165107849Salfred *(uint32_t*)0x200003e8 = 0; 166100384Speter *(uint32_t*)0x200003ec = 0; 167100384Speter syscall(SYS_sendmsg, r[0], 0x200003c0ul, 0ul); 168100384Speter res = syscall(SYS_dup2, r[0], r[1]); 169100384Speter if (res != -1) 170107849Salfred r[2] = res; 171100384Speter *(uint32_t*)0x20000140 = 0; 172100384Speter memcpy((void*)0x20000144, "\x0a\x00\x01\x00\x01", 5); 173100384Speter syscall(SYS_setsockopt, r[2], 0x84, 0x901, 0x20000140ul, 0xaul); 174100384Speter} 175100384Speterint main(void) 176100384Speter{ 177100384Speter syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul); 178100384Speter for (procid = 0; procid < 4; procid++) { 179100384Speter if (fork() == 0) { 180100384Speter loop(); 181100384Speter } 182100384Speter } 183100384Speter sleep(1000000); 184100384Speter return 0; 185100384Speter} 186100384SpeterEOF 187128597Smarcelmycc -o /tmp/syzkaller55 -Wall -Wextra -O0 /tmp/syzkaller55.c || exit 1 188100384Speter 189100384Speterkldstat | grep -q sctp || kldload sctp.ko 190100384Speterstart=`date +%s` 191100384Speterwhile [ $((`date +%s` - start)) -lt 120 ]; do 192100384Speter (cd /tmp; timeout 3m ./syzkaller55) 193100384Speterdone 194100384Speter 195121719Speterrm -rf /tmp/syzkaller55 /tmp/syzkaller55.c /tmp/syzkaller55.core \ 196121719Speter /tmp/syzkaller.?????? 197100384Speterexit 0 198119333Speter