syzbot


panic: in_pcb_lport: laddrp NULL for v4 inp ADDR

Status: fixed on 2019/10/25 02:43
Reported-by: syzbot+2609a378d89264ff5a42@syzkaller.appspotmail.com
Fix commit: 4a91aa8fc9b6 Ensure that the flags indicating IPv4/IPv6 are not changed by failing bind() calls. This would lead to inconsistent state resulting in a panic. A fix for stable/11 was committed in https://svnweb.freebsd.org/base?view=revision&revision=338986 An accelerated MFC is planned as discussed with emaste@.
First crash: 1796d, last: 1680d

Sample crash report:
login: panic: in_pcb_lport: laddrp NULL for v4 inp 0xfffff8000b33e988
cpuid = 0
time = 1559570156
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe001f695660
vpanic() at vpanic+0x1e0/frame 0xfffffe001f6956c0
panic() at panic+0x43/frame 0xfffffe001f695720
in_pcb_lport() at in_pcb_lport+0x4c7/frame 0xfffffe001f6957b0
in6_pcbsetport() at in6_pcbsetport+0xc3/frame 0xfffffe001f6957f0
in6_pcbbind() at in6_pcbbind+0x26a/frame 0xfffffe001f6958a0
tcp6_usr_listen() at tcp6_usr_listen+0x176/frame 0xfffffe001f695900
solisten() at solisten+0x7a/frame 0xfffffe001f695940
kern_listen() at kern_listen+0x132/frame 0xfffffe001f695980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe001f695ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe001f695ab0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x458a4a, rsp = 0x7fffdffdcf88, rbp = 0x6b72c0 ---
KDB: enter: panic
[ thread pid 759 tid 100104 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/03 13:59 freebsd c7cdb4a80779 63bf051f console log report syz C ci-freebsd-main
2019/06/03 14:17 freebsd c7cdb4a80779 63bf051f console log report syz ci-freebsd-i386
2019/06/09 22:42 freebsd af823c22958c 0159583c console log report ci-freebsd-main
2019/06/07 05:16 freebsd d539480f53f3 698773cb console log report ci-freebsd-main
2019/06/07 04:04 freebsd f6eb4393c0bd 698773cb console log report ci-freebsd-main
2019/06/03 18:20 freebsd c7cdb4a80779 63bf051f console log report ci-freebsd-main
2019/06/03 13:40 freebsd c7cdb4a80779 63bf051f console log report ci-freebsd-main
2019/09/27 16:40 freebsd 0eeddc2571a9 d8074e0b console log report ci-freebsd-i386
* Struck through repros no longer work on HEAD.