syzbot


panic: Memory modified after free ADDR(256) val=0 @ ADDR

Status: closed as invalid on 2021/01/02 09:27
Reported-by: syzbot+f82c67821f14f6e2cc50@syzkaller.appspotmail.com
First crash: 2021d, last: 2015d

Sample crash report:
Kernel page fault with the following nonpanic: Memory modified after free 0xfffff80004995d00(256) val=0 @ 0xfffff80004995d00

cpuid = 0
time = 1558105051
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe00212a41b0
vpanic() at vpanic+0x1e0/frame 0xfffffe00212a4210
panic() at panic+0x43/frame 0xfffffe00212a4270
trash_ctor() at trash_ctor+0xaa/frame 0xfffffe00212a42b0
mb_ctor_mbuf() at mb_ctor_mbuf+0x30/frame 0xfffffe00212a42f0
uma_zalloc_arg() at uma_zalloc_arg+0x1036/frame 0xfffffe00212a43a0
m_getm2() at m_getm2+0x1c0/frame 0xfffffe00212a4410
sctp_get_mbuf_for_msg() at sctp_get_mbuf_for_msg+0x4a/frame 0xfffffe00212a4450
sctp_send_shutdown() at sctp_send_shutdown+0x8d/frame 0xfffffe00212a44a0
sctp_lower_sosend() at sctp_lower_sosend+0x5044/frame 0xfffffe00212a4670
sctp_sosend() at sctp_sosend+0x510/frame 0xfffffe00212a47a0
sosend() at sosend+0xc6/frame 0xfffffe00212a4810
kern_sendit() at kern_sendit+0x35e/frame 0xfffffe00212a48c0
sendit() at sendit+0x226/frame 0xfffffe00212a4920
sys_sendmsg() at sys_sendmsg+0x8b/frame 0xfffffe00212a4980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe00212a4ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe00212a4ab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x41309a, rsp = 0x7fffdffdcf38, rbp = 0x3 ---
KDB: enter: panic
[ thread pid 806 tid 100127 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why
db> 

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/17 15:13 freebsd 85eaade994ec 2755003a console log report syz ci-freebsd-main
2019/05/16 07:07 freebsd 61d95603409a 051c49fe console log report syz ci-freebsd-main
2019/05/14 23:10 freebsd 92e7c0f46ef2 2e630085 console log report syz ci-freebsd-main
2019/05/11 00:27 freebsd fbc304aae0ef 46caad94 console log report syz ci-freebsd-main
2019/05/17 14:54 freebsd 85eaade994ec 2755003a console log report ci-freebsd-main
2019/05/14 22:31 freebsd 92e7c0f46ef2 2e630085 console log report ci-freebsd-main
* Struck through repros no longer work on HEAD.