The branch main has been updated by pho:
URL:
https://cgit.FreeBSD.org/src/commit/?id=c1c58c0019430c9df12499e14046fe077c62c6d3
commit c1c58c0019430c9df12499e14046fe077c62c6d3
Author: Peter Holm <p...@freebsd.org>
AuthorDate: 2025-08-01 09:54:05 +0000
Commit: Peter Holm <p...@freebsd.org>
CommitDate: 2025-08-01 09:54:05 +0000
stress2: Added two syzkaller reproducers and updated the exclude list
---
tools/test/stress2/misc/all.exclude | 2 +
tools/test/stress2/misc/syzkaller82.sh | 122 ++++++++++++++++++++++++
tools/test/stress2/misc/syzkaller83.sh | 168 +++++++++++++++++++++++++++++++++
3 files changed, 292 insertions(+)
diff --git a/tools/test/stress2/misc/all.exclude
b/tools/test/stress2/misc/all.exclude
index 54524c92eac0..f9b32db95799 100644
--- a/tools/test/stress2/misc/all.exclude
+++ b/tools/test/stress2/misc/all.exclude
@@ -73,6 +73,8 @@ syzkaller66.sh panic: in_pcbconnect: inp is
already connected 20230621
syzkaller67.sh panic: ASan: Invalid access, 8-byte read at ...
20230621
syzkaller80.sh panic
20250711
syzkaller81.sh panic
20250711
+syzkaller82.sh panic: m_apply, length > size of mbuf chain
20250724
+quota3.sh https://people.freebsd.org/~pho/stress/log/log0604.txt
20250728
quota6.sh https://people.freebsd.org/~pho/stress/log/log0456.txt
20240707
truss3.sh WiP
20200915
zfs18.sh https://people.freebsd.org/~pho/stress/log/log0560.txt
20241118
diff --git a/tools/test/stress2/misc/syzkaller82.sh
b/tools/test/stress2/misc/syzkaller82.sh
new file mode 100755
index 000000000000..c810942eb060
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller82.sh
@@ -0,0 +1,122 @@
+#!/bin/sh
+
+# panic: m_apply, length > size of mbuf chain (8 extra)
+# cpuid = 1
+# time = 1753341719
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe01f00c5080
+# vpanic() at vpanic+0x136/frame 0xfffffe01f00c51b0
+# panic() at panic+0x43/frame 0xfffffe01f00c5210
+# m_apply() at m_apply+0x2d3/frame 0xfffffe01f00c5260
+# sctp_delayed_cksum() at sctp_delayed_cksum+0x4c/frame 0xfffffe01f00c5290
+# ip6_output_delayed_csum() at ip6_output_delayed_csum+0xaa/frame
0xfffffe01f00c52d0
+# ip6_output() at ip6_output+0x19e6/frame 0xfffffe01f00c5490
+# sctp_lowlevel_chunk_output() at sctp_lowlevel_chunk_output+0x104f/frame
0xfffffe01f00c55d0
+# sctp_med_chunk_output() at sctp_med_chunk_output+0x2ad2/frame
0xfffffe01f00c5fb0
+# sctp_chunk_output() at sctp_chunk_output+0x121c/frame 0xfffffe01f00c6960
+# sctp_lower_sosend() at sctp_lower_sosend+0x146c/frame 0xfffffe01f00c6b50
+# sctp_sosend() at sctp_sosend+0x333/frame 0xfffffe01f00c6c70
+# sousrsend() at sousrsend+0x79/frame 0xffkern_sendit() at
kern_sendit+0x1be/frame 0xfffffe01f00c6d60
+# sendit() at sendit+0x1ab/frame 0xfffffe01f00c6db0
+# sys_sendto() at sys_sendto+0x4d/frame 0xfffffe01f00c6e00
+# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe01f00c6f30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01f00c6f30
+# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x823035b0a, rsp =
0x8208fa048, rbp = 0x8208fa060 ---
+# KDB: enter: panic
+# [ thread pid 41871 tid 736799 ]
+# Stopped at kdb_enter+0x33: movq $0,0x1231b52(%rip)
+# db> x/s version
+# version: FreeBSD 15.0-CURRENT #0 main-n279001-7502c1f27082-dirty: Wed Jul 23
20:31:48 CEST 2025
+# p...@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+//
https://syzkaller.appspot.com/bug?id=09297b76b7db4aa29c86ac971062bc078b06c0ff
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+73fe316271df47323...@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <pwd.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+uint64_t r[1] = {0xffffffffffffffff};
+
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ intptr_t res = 0;
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ res = syscall(SYS_socket, /*domain=*/0x1cul, /*type=SOCK_STREAM*/ 1ul,
+ /*proto=*/0x84);
+ if (res != -1)
+ r[0] = res;
+ *(uint8_t*)0x2000000001c0 = 0x10;
+ *(uint8_t*)0x2000000001c1 = 2;
+ *(uint16_t*)0x2000000001c2 = htobe16(0x4e23);
+ *(uint32_t*)0x2000000001c4 = htobe32(0);
+ memset((void*)0x2000000001c8, 0, 8);
+ memset((void*)0x2000000001d0, 0, 112);
+ *(uint32_t*)0x200000000240 = 0;
+ *(uint32_t*)0x200000000244 = 0x5234;
+ *(uint32_t*)0x200000000248 = 0xffff;
+ *(uint32_t*)0x20000000024c = 0x314;
+ *(uint32_t*)0x200000000250 = 0x3bb;
+ *(uint16_t*)0x200000000254 = 2;
+ *(uint8_t*)0x200000000256 = 9;
+ syscall(SYS_setsockopt, /*fd=*/r[0], /*level=*/0x84, /*opt=*/0xa,
+ /*val=*/0x2000000001c0ul, /*len=*/0x98ul);
+ *(uint8_t*)0x200000000000 = 0x1c;
+ *(uint8_t*)0x200000000001 = 0x1c;
+ *(uint16_t*)0x200000000002 = htobe16(0x4e22);
+ *(uint32_t*)0x200000000004 = 0;
+ memset((void*)0x200000000008, 0, 16);
+ *(uint32_t*)0x200000000018 = 0;
+ syscall(SYS_bind, /*fd=*/r[0], /*addr=*/0x200000000000ul,
/*addrlen=*/0x1cul);
+ *(uint8_t*)0x200000000180 = 0x5f;
+ *(uint8_t*)0x200000000181 = 0x1c;
+ *(uint16_t*)0x200000000182 = htobe16(0x4e22);
+ *(uint32_t*)0x200000000184 = 0;
+ *(uint64_t*)0x200000000188 = htobe64(0);
+ *(uint64_t*)0x200000000190 = htobe64(1);
+ *(uint32_t*)0x200000000198 = 0;
+ syscall(SYS_connect, /*fd=*/r[0], /*addr=*/0x200000000180ul,
+ /*addrlen=*/0x1cul);
+ memset((void*)0x2000000020c0, 209, 1);
+ syscall(SYS_sendto, /*fd=*/r[0], /*buf=*/0x2000000020c0ul, /*len=*/0xffeful,
+ /*f=MSG_NOSIGNAL|MSG_EOF|MSG_DONTWAIT|MSG_DONTROUTE*/ 0x20184ul,
+ /*addr=*/0ul, /*addrlen=*/0ul);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c || exit 1
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+kldstat | grep -q sctp || { kldload sctp.ko && loaded=1; }
+timeout 3m /tmp/$prog > /dev/null 2>&1
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work
+[ $loaded ] && kldunload sctp.ko
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller83.sh
b/tools/test/stress2/misc/syzkaller83.sh
new file mode 100755
index 000000000000..418bfd75982d
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller83.sh
@@ -0,0 +1,168 @@
+#!/bin/sh
+
+# panic: handle_workitem_remove: bad file delta
+# cpuid = 2
+# time = 1753799597
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame
0xfffffe00ffc84b70
+# vpanic() at vpanic+0x136/frame 0xfffffe00ffc84ca0
+# panic() at panic+0x43/frame 0xfffffe00ffc84d00
+# handle_workitem_remove() at handle_workitem_remove+0x68d/frame
0xfffffe00ffc84d70
+# handle_workitem_remove() at handle_workitem_remove+0x52d/frame
0xfffffe00ffc84de0
+# process_worklist_item() at process_worklist_item+0x21e/frame
0xfffffe00ffc84e70
+# softdep_process_worklist() at softdep_process_worklist+0xbd/frame
0xfffffe00ffc84eb0
+# softdep_flush() at softdep_flush+0x10f/frame 0xfffffe00ffc84ef0
+# fork_exit() at fork_exit+0x82/frame 0xfffffe00ffc84f30
+# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00ffc84f30
+# --- trap 0, rip = 0, rsp = 0, rbp = 0 ---
+# KDB: enter: panic
+# [ thread pid 16 tid 100253 ]
+# Stopped at kdb_enter+0x33: movq $0,0x1230852(%rip)
+# db> x/s version
+# version: FreeBSD 15.0-CURRENT #0 main-n279158-f1f77adfd9bc-dirty: Tue Jul 29
15:49:28 CEST 2025
+# p...@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+//
https://syzkaller.appspot.com/bug?id=0a60b828818a364deb4721d58b2ed5167b1f6296
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static void kill_and_wait(int pid, int* status)
+{
+ kill(pid, SIGKILL);
+ while (waitpid(-1, status, 0) != pid) {
+ }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+// int iter = 0;
+ for (;; /*iter++*/) {
+ int pid = fork();
+ if (pid < 0)
+ exit(1);
+ if (pid == 0) {
+ execute_one();
+ exit(0);
+ }
+ int status = 0;
+ uint64_t start = current_time_ms();
+ for (;;) {
+ sleep_ms(10);
+ if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+ break;
+ if (current_time_ms() - start < 5000)
+ continue;
+ kill_and_wait(pid, &status);
+ break;
+ }
+ }
+}
+
+uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
+
+void execute_one(void)
+{
+ intptr_t res = 0;
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ memcpy((void*)0x200000000180, "./file0\000", 8);
+ syscall(SYS_mkdir, /*path=*/0x200000000180ul, /*mode=*/0ul);
+ memcpy((void*)0x200000000000, "./file0/file0\000", 14);
+ syscall(SYS_mkdir, /*path=*/0x200000000000ul, /*mode=*/0ul);
+ memcpy((void*)0x200000000080, ".\000", 2);
+ res = syscall(SYS_open, /*file=*/0x200000000080ul,
+ /*flags=O_DIRECT*/ 0x10000ul, /*mode=*/0ul);
+ if (res != -1)
+ r[0] = res;
+ memcpy((void*)0x200000000080, ".\000", 2);
+ res =
+ syscall(SYS_open, /*file=*/0x200000000080ul, /*flags=*/0ul,
/*mode=*/0ul);
+ if (res != -1)
+ r[1] = res;
+ memcpy((void*)0x200000000080, ".\000", 2);
+ res = syscall(SYS_open, /*file=*/0x200000000080ul, /*flags=O_NONBLOCK*/ 4ul,
+ /*mode=*/0ul);
+ if (res != -1)
+ r[2] = res;
+ memcpy((void*)0x200000000100, "./file1\000", 8);
+ syscall(SYS_mkdirat, /*fd=*/r[2], /*path=*/0x200000000100ul,
+ /*mode=S_IROTH|S_IWUSR*/ 0x84ul);
+ memcpy((void*)0x200000000340, "./file0/file0\000", 14);
+ memcpy((void*)0x200000000380, "./file1\000", 8);
+ syscall(SYS_renameat, /*oldfd=*/r[0], /*old=*/0x200000000340ul,
+ /*newfd=*/r[1], /*new=*/0x200000000380ul);
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ loop();
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c || exit 1
+
+(cd ../testcases/swap; ./swap -t 3m -i 30 -l 100 > /dev/null 2>&1) &
+sleep 5
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+for i in `jot 30`; do
+ (
+ mkdir d$i
+ cd d$i
+ timeout 3m /tmp/$prog > /dev/null 2>&1 &
+ )
+done
+while pgrep -q $prog; do sleep 2; done
+while pkill swap; do :; done
+wait
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work
+exit 0
