syzbot


panic: IV outside buffer length

Status: fixed on 2021/05/12 09:03
Reported-by: syzbot+c9e8f6ff5cb7fa6a1250@syzkaller.appspotmail.com
Fix commit: 1a04f0156c4e cryptodev: Fix some input validation bugs
First crash: 641d, last: 636d

Sample crash report:
panic: IV outside buffer length
cpuid = 1
time = 1620335102
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0094954510
vpanic() at vpanic+0x1c7/frame 0xfffffe0094954570
panic() at panic+0x43/frame 0xfffffe00949545d0
crp_sanity() at crp_sanity+0x885/frame 0xfffffe0094954630
crypto_dispatch() at crypto_dispatch+0x1a/frame 0xfffffe0094954660
crypto_ioctl() at crypto_ioctl+0x1f9e/frame 0xfffffe0094954780
devfs_ioctl() at devfs_ioctl+0x14e/frame 0xfffffe00949547e0
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x78/frame 0xfffffe0094954810
vn_ioctl() at vn_ioctl+0x278/frame 0xfffffe0094954930
devfs_ioctl_f() at devfs_ioctl_f+0x47/frame 0xfffffe0094954970
kern_ioctl() at kern_ioctl+0x3cd/frame 0xfffffe00949549e0
sys_ioctl() at sys_ioctl+0x265/frame 0xfffffe0094954ab0
amd64_syscall() at amd64_syscall+0x247/frame 0xfffffe0094954bf0
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0094954bf0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x2b3cfa, rsp = 0x7fffffffea68, rbp = 0x7fffffffea80 ---
KDB: enter: panic
[ thread pid 787 tid 100113 ]
Stopped at      kdb_enter+0x67: movq    $0,0x163a5ae(%rip)
db> 
db> set $lines = 0
db> set $maxwidth = 0
db> show registers
cs                        0x20
ds                        0x3b
es                        0x3b
fs                        0x13
gs                        0x1b
ss                        0x28
rax                       0x12
rcx                       0x80
rdx         0xffffffff819c182a
rbx                          0
rsp         0xfffffe00949544f0
rbp         0xfffffe0094954510
rsi                        0x1
rdi                          0
r8                           0
r9          0x8080808080808080
r10         0xfffffe00949543e0
r11              0x1ff6bfff59c
r12         0xffffffff82267ac0  ddb_dbbe
r13                          0
r14         0xffffffff81a72b70
r15         0xffffffff81a72b70
rip         0xffffffff8112ebd7  kdb_enter+0x67
rflags                    0x86
kdb_enter+0x67: movq    $0,0x163a5ae(%rip)
db> show proc
Process 787 (syz-executor5553140) at 0xfffff800315f3a70:
 state: NORMAL
 uid: 0  gids: 0, 0, 5
 parent: pid 785 at 0xfffff80004e93000
 ABI: FreeBSD ELF64
 flag: 0x10004000  flag2: 0
 arguments: ./syz-executor555314098
 reaper: 0xfffff8000452a538 reapsubtree: 1
 sigparent: 20
 vmspace: 0xfffffe0094bf73e0
   (map 0xfffffe0094bf73e0)
   (map.pmap 0xfffffe0094bf74a0)
   (pmap 0xfffffe0094bf7500)
 threads: 1
100113                   Run     CPU 1                       syz-executor5553140
db> ps
  pid  ppid  pgrp   uid  state   wmesg   wchan               cmd
  787   785   785     0  R       CPU 1                       syz-executor5553140
  785   783   785     0  Ss      pause   0xfffff80004e930b0  csh
  783   694   783     0  Ss      select  0xfffff80031387340  sshd
  760     1   760     0  Ss+     ttyin   0xfffff800049d8cb0  getty
  759     1   759     0  Ss+     ttyin   0xfffff80004cf48b0  getty
  758     1   758     0  Ss+     ttyin   0xfffff80004cf4cb0  getty
  757     1   757     0  Ss+     ttyin   0xfffff80004cfc0b0  getty
  756     1   756     0  Ss+     ttyin   0xfffff80004cfc4b0  getty
  755     1   755     0  Ss+     ttyin   0xfffff80004cfc8b0  getty
  754     1   754     0  Ss+     ttyin   0xfffff80004cfccb0  getty
  753     1   753     0  Ss+     ttyin   0xfffff80004c6e0b0  getty
  752     1   752     0  Ss+     ttyin   0xfffff80004c6e4b0  getty
  750     1    24     0  S+      piperd  0xfffff800260765d0  logger
  749   748    24     0  S+      nanslp  0xffffffff8273c8e1  sleep
  748     1    24     0  S+      wait    0xfffff80004fdd538  sh
  698     1   698     0  Ss      nanslp  0xffffffff8273c8e0  cron
  694     1   694     0  Ss      select  0xfffff80031387640  sshd
  507     1   507     0  Ss      select  0xfffff80031387a40  syslogd
  436     1   436     0  Ss      select  0xfffff80031387840  devd
  435     1   435    65  Ss      select  0xfffff800313875c0  dhclient
  350     1   350     0  Ss      select  0xfffff800313876c0  dhclient
  347     1   347     0  Ss      select  0xfffff80031387940  dhclient
   23     0     0     0  DL      syncer  0xffffffff8282bd50  [syncer]
   22     0     0     0  DL      vlruwt  0xfffff80004e93a70  [vnlru]
   21     0     0     0  DL      (threaded)                  [bufdaemon]
100080                   D       qsleep  0xffffffff8282ae00  [bufdaemon]
100085                   D       -       0xffffffff8220ae00  [bufspacedaemon-0]
100098                   D       sdflush 0xfffff80004f8ece8  [/ worker]
   20     0     0     0  DL      psleep  0xffffffff82852c08  [vmdaemon]
   19     0     0     0  DL      (threaded)                  [pagedaemon]
100078                   D       psleep  0xffffffff82847078  [dom0]
100086                   D       launds  0xffffffff82847084  [laundry: dom0]
100087                   D       umarcl  0xffffffff815c8de0  [uma]
   18     0     0     0  DL      -       0xffffffff82570c78  [rand_harvestq]
   17     0     0     0  DL      waiting 0xffffffff82e34828  [sctp_iterator]
   16     0     0     0  DL      pftm    0xffffffff830273c0  [pf purge]
   15     0     0     0  DL      -       0xffffffff8282845c  [soaiod4]
    9     0     0     0  DL      -       0xffffffff8282845c  [soaiod3]
    8     0     0     0  DL      -       0xffffffff8282845c  [soaiod2]
    7     0     0     0  DL      -       0xffffffff8282845c  [soaiod1]
    6     0     0     0  DL      (threaded)                  [cam]
100043                   D       -       0xffffffff82448140  [doneq0]
100044                   D       -       0xffffffff824480c0  [async]
100077                   D       -       0xffffffff82447f90  [scanner]
   14     0     0     0  DL      seqstat 0xfffff8000463b888  [sequencer 00]
    5     0     0     0  DL      crypto_ 0xfffff8000462fd80  [crypto returns 1]
    4     0     0     0  DL      crypto_ 0xfffff8000462fd30  [crypto returns 0]
    3     0     0     0  DL      crypto_ 0xffffffff828445a0  [crypto]
   13     0     0     0  DL      (threaded)                  [geom]
100034                   D       -       0xffffffff8271c120  [g_event]
100035                   D       -       0xffffffff8271c128  [g_up]
100036                   D       -       0xffffffff8271c130  [g_down]
    2     0     0     0  DL      (threaded)                  [KTLS]
100027                   D       -       0xfffff80004574700  [thr_0]
100028                   D       -       0xfffff80004574780  [thr_1]
   12     0     0     0  WL      (threaded)                  [intr]
100012                   I                                   [swi6: task queue]
100016                   I                                   [swi6: Giant taskq]
100018                   I                                   [swi5: fast taskq]
100029                   I                                   [swi1: netisr 0]
100030                   I                                   [swi3: vm]
100031                   I                                   [swi4: clock (0)]
100032                   I                                   [swi4: clock (1)]
100045                   I                                   [irq24: virtio_pci0]
100046                   I                                   [irq25: virtio_pci0]
100047                   I                                   [irq26: virtio_pci0]
100048                   I                                   [irq27: virtio_pci0]
100049                   I                                   [irq28: virtio_pci1]
100050                   I                                   [irq29: virtio_pci1]
100051                   I                                   [irq30: virtio_pci1]
100052                   I                                   [irq31: virtio_pci1]
100053                   I                                   [irq32: virtio_pci1]
100058                   I                                   [irq10: virtio_pci2]
100060                   I                                   [irq1: atkbd0]
100061                   I                                   [irq12: psm0]
100062                   I                                   [swi0: uart uart++]
100070                   I                                   [swi1: pf send]
100083                   I                                   [swi1: hpts]
100084                   I                                   [swi1: hpts]
   11     0     0     0  RL      (threaded)                  [idle]
100003                   Run     CPU 0                       [idle: cpu0]
100004                   CanRun                              [idle: cpu1]
    1     0     1     0  SLs     wait    0xfffff8000452a538  [init]
   10     0     0     0  DL      audit_w 0xffffffff82844ab0  [audit]
    0     0     0     0  DLs     (threaded)                  [kernel]
100000                   D       swapin  0xffffffff8271c6b0  [swapper]
100005                   D       -       0xfffff80004144800  [softirq_0]
100006                   D       -       0xfffff80004144700  [softirq_1]
100007                   D       -       0xfffff80004144600  [if_io_tqg_0]
100008                   D       -       0xfffff80004144500  [if_io_tqg_1]
100009                   D       -       0xfffff80004144400  [if_config_tqg_0]
100010                   D       -       0xfffff8000457a600  [kqueue_ctx taskq]
100011                   D       -       0xfffff8000457a500  [in6m_free taskq]
100013                   D       -       0xfffff8000457a200  [linuxkpi_irq_wq]
100014                   D       -       0xfffff8000457a100  [inm_free taskq]
100015                   D       -       0xfffff8000457a000  [aiod_kick taskq]
100017                   D       -       0xfffff80004574c00  [thread taskq]
100019                   D       -       0xfffff80004574900  [linuxkpi_short_wq_0]
100020                   D       -       0xfffff80004574900  [linuxkpi_short_wq_1]
100021                   D       -       0xfffff80004574900  [linuxkpi_short_wq_2]
100022                   D       -       0xfffff80004574900  [linuxkpi_short_wq_3]
100023                   D       -       0xfffff80004574800  [linuxkpi_long_wq_0]
100024                   D       -       0xfffff80004574800  [linuxkpi_long_wq_1]
100025                   D       -       0xfffff80004574800  [linuxkpi_long_wq_2]
100026                   D       -       0xfffff80004574800  [linuxkpi_long_wq_3]
100033                   D       -       0xfffff80004574100  [firmware taskq]
100037                   D       -       0xfffff8000462ee00  [crypto_0]
100038                   D       -       0xfffff8000462ee00  [crypto_1]
100054                   D       -       0xfffff8000462e800  [vtnet0 rxq 0]
100055                   D       -       0xfffff8000462e700  [vtnet0 txq 0]
100056                   D       -       0xfffff8000462e600  [vtnet0 rxq 1]
100057                   D       -       0xfffff8000462e500  [vtnet0 txq 1]
100059                   D       vtbslp  0xfffff80004974100  [virtio_balloon]
100063                   D       -       0xfffff80004973b00  [mca taskq]
100066                   D       -       0xffffffff81e1f4b1  [deadlkres]
100072                   D       -       0xfffff80004c3e700  [acpi_task_0]
100073                   D       -       0xfffff80004c3e700  [acpi_task_1]
100074                   D       -       0xfffff80004c3e700  [acpi_task_2]
100076                   D       -       0xfffff8000462ed00  [CAM taskq]
db> show all locks
db> show malloc
              Type        InUse        MemUse     Requests
           pf_hash            5        11524K            5
            devbuf         4216         4340K         4241
          tcp_hpts            5         3201K            5
         sysctloid        33530         1980K        33597
             vtbuf           24         1968K           46
              kobj          332         1328K          492
            newblk          583         1170K          601
          vfscache            3         1025K            3
               pcb           23          537K           77
          inodedep           50          531K           71
         ufs_quota            1          512K            1
          vfs_hash            1          512K            1
           callout            2          512K            2
              intr            4          472K            4
           subproc           98          204K          840
            acpica         1674          184K        55406
         vnet_data            1          168K            1
           tidhash            3          141K            3
           pagedep           14          132K           18
        tfo_ccache            1          128K            1
               sem            4          106K            4
            DEVFS1          103          103K          112
            linker          294          102K          318
               bus          995           81K         3509
          mtx_pool            2           72K            2
          syncache            1           68K            1
          acpitask            1           64K            1
       ddb_capture            1           64K            1
            module          508           64K          508
              temp           18           33K         1611
         hostcache            1           32K            1
               shm            1           32K            1
           kdtrace          161           32K          903
            DEVFS3          122           31K          132
              umtx          242           31K          242
               msg            4           30K            4
              vmem            3           26K            4
        gtaskqueue           18           26K           18
            kbdmux            6           22K            6
        DEVFS_RULE           56           20K           56
               BPF           10           18K           10
         ufs_mount            5           17K            6
              proc            3           17K            3
               tty           16           16K           16
           ithread           99           16K           99
            bus-sc           33           14K         1719
            KTRACE          100           13K          100
              kenv           93           12K           93
      eventhandler          133           12K          133
            ifaddr           30           12K           32
          routetbl           50           11K          176
              rman           84           10K          425
              GEOM           60           10K          489
         bmsafemap            4            9K           41
              UART           12            9K           12
           devstat            4            9K            4
              ksem            1            8K            1
               rpc            2            8K            2
             shmfd            1            8K            1
       pfs_vncache            1            8K            1
         pfs_nodes           20            8K           20
     audit_evclass          236            8K          294
            sglist            5            7K            5
           CAM DEV            3            6K          510
         taskqueue           57            6K           57
              cred           23            6K          244
         CAM queue            5            6K         1528
       ufs_dirhash           24            5K           24
               UMA          265            5K          265
            dirrem           17            5K           28
            plimit           17            5K          337
                vt           11            5K           11
             ifnet            3            5K            3
           memdesc            1            4K            1
               MCA           32            4K           32
             evdev            4            4K            4
          filedesc            1            4K            1
           acpisem           28            4K           28
             hhook           13            4K           13
       ether_multi           40            4K           50
            diradd           25            4K           36
           lltable           11            4K           11
          pf_ifnet            5            3K            6
       fpukern_ctx            3            3K            3
         in6_multi           25            3K           25
            kqueue           46            3K          790
           pwddesc           46            3K          788
          terminal           11            3K           11
           session           20            3K           32
           uidinfo            3            3K            9
        local_apic            1            2K            1
           io_apic            1            2K            1
         ipsec-saq            2            2K            2
             selfd           27            2K         9452
             lockf           16            2K           26
         proc-args           39            2K          491
            crypto            5            2K            5
            Unitno           27            2K           39
           CAM XPT           22            2K          543
       ipsecpolicy            2            2K            2
           acpidev           20            2K           20
               msi            9            2K            9
             clone            9            2K            9
           softdep            1            1K            1
            sahead            1            1K            1
          secasvar            1            1K            1
       vnodemarker            2            1K            8
      NFSD session            1            1K            1
        CAM periph            4            1K          271
            select            7            1K           29
             ipsec            3            1K            3
          indirdep            3            1K            3
             nhops            6            1K            6
         toponodes            6            1K            6
            isadev            6            1K            6
             mount           16            1K           89
          pci_link           10            1K           10
          sctp_ifa            5            1K            6
            ip6ndp            4            1K            5
 encap_export_host           12            1K           12
         newdirblk            4            1K            8
             mkdir            4            1K           16
          in_multi            2            1K            4
              pfil            4            1K            4
           CAM SIM            2            1K            2
              cdev            2            1K            2
             xform            7            1K           54
    chacha20random            1            1K            1
            DEVFSP            5            1K           10
       inpcbpolicy           10            1K          137
               osd            3            1K           10
          sctp_ifn            2            1K            6
      NFSD lckfile            1            1K            1
     NFSD V4client            1            1K            1
             DEVFS            9            1K           10
               mld            2            1K            2
              igmp            2            1K            2
            vnodes            1            1K            1
              ktls            1            1K            1
            feeder            7            1K            7
           tcpfunc            3            1K            3
        loginclass            3            1K            7
            prison            6            1K            6
             linux            5            1K            6
        aesni_data            2            1K            2
            apmdev            1            1K            1
          atkbddev            2            1K            2
     CAM dev queue            2            1K            2
 CAM I/O Scheduler            1            1K            1
          CAM path            4            1K         1034
          procdesc            1            1K            6
          pmchooks            1            1K            1
          nexusdev            7            1K            7
            soname            4            1K         3233
          filecaps            4            1K           66
               tun            3            1K            3
          sctp_vrf            1            1K            1
              vnet            1            1K            1
           entropy            2            1K           35
          acpiintr            1            1K            1
               pmc            1            1K            1
              cpus            2            1K            2
    vnet_data_free            1            1K            1
           Per-cpu            1            1K            1
          freework            1            1K           26
          p1003.1b            1            1K            1
            mqdata            0            0K            0
          pf_table            0            0K            0
           pf_rule            0            0K            0
           pf_altq            0            0K            0
           pf_osfp            0            0K            0
           pf_temp            0            0K            0
        sctp_mcore            0            0K            0
        sctp_socko            0            0K            0
         sctp_iter            0            0K            3
         sctp_mvrf            0            0K            0
         sctp_timw            0            0K            0
         sctp_cpal            0            0K            0
         sctp_cmsg            0            0K            0
         sctp_stre            0            0K            0
         sctp_athi            0            0K            0
         sctp_athm            0            0K            0
         sctp_atky            0            0K            0
         sctp_atcl            0            0K            0
         sctp_a_it            0            0K            3
         sctp_aadr            0            0K            0
         sctp_stro            0            0K            0
         sctp_stri            0            0K            0
          sctp_map            0            0K            0
       NFSD string            0            0K            0
       NFSD V4lock            0            0K            0
        madt_table            0            0K            2
          smartpqi            0            0K            0
      NFSD V4state            0            0K            0
     NFSD srvcache            0            0K            0
       msdosfs_fat            0            0K            0
     msdosfs_mount            0            0K            0
      msdosfs_node            0            0K            0
              iavf            0            0K            0
               ixl            0            0K            0
            DEVFS4            0            0K            0
            DEVFS2            0            0K            0
            gntdev            0            0K            0
       privcmd_dev            0            0K            0
        ice-resmgr            0            0K            0
         ice-osdep            0            0K            0
               ice            0            0K            0
             axgbe            0            0K            0
        evtchn_dev            0            0K            0
          xenstore            0            0K            0
         ciss_data            0            0K            0
         BACKLIGHT            0            0K            0
               xnb            0            0K            0
              xbbd            0            0K            0
               xbd            0            0K            0
           Balloon            0            0K            0
          sysmouse            0            0K            0
            vtfont            0            0K            0
          xen_intr            0            0K            0
           xen_hvm            0            0K            0
         legacydrv            0            0K            0
            qpidrv            0            0K            0
           ath_hal            0            0K            0
            athdev            0            0K            0
      dmar_idpgtbl            0            0K            0
          dmar_dom            0            0K            0
          dmar_ctx            0            0K            0
           ata_pci            0            0K            0
           ata_dma            0            0K            0
       ata_generic            0            0K            0
              isci            0            0K            0
      iommu_dmamap            0            0K            0
               amr            0            0K            0
     hyperv_socket            0            0K            0
           bxe_ilt            0            0K            0
            xenbus            0            0K            0
            pvscsi            0            0K            0
           scsi_da            0            0K           69
     vm_fictitious            0            0K            0
            ata_da            0            0K            0
           scsi_ch            0            0K            0
           scsi_cd            0            0K            0
       AHCI driver            0            0K            0
            USBdev            0            0K            0
               USB            0            0K            0
               agp            0            0K            0
           nvme_da            0            0K            0
           UMAHash            0            0K            0
           acpipwr            0            0K            0
         acpi_perf            0            0K            0
         vm_pgdata            0            0K            0
           jblocks            0            0K            0
          savedino            0            0K           14
          sentinel            0            0K            0
            jfsync            0            0K            0
            jtrunc            0            0K            0
             sbdep            0            0K            2
           jsegdep            0            0K            0
              jseg            0            0K            0
         jfreefrag            0            0K            0
          jfreeblk            0            0K            0
           jnewblk            0            0K            0
            jmvref            0            0K            0
           jremref            0            0K            0
           jaddref            0            0K            0
           freedep            0            0K            0
          freefile            0            0K            9
          freeblks            0            0K           25
          freefrag            0            0K            7
        allocindir            0            0K            0
       allocdirect            0            0K            0
          ufs_trim            0            0K            0
           mactemp            0            0K            0
     audit_trigger            0            0K            0
 audit_pipe_presel            0            0K            0
     audit_pipeent            0            0K            0
        audit_pipe            0            0K            0
      audit_evname            0            0K            0
         audit_bsm            0            0K            0
      audit_gidset            0            0K            0
        audit_text            0            0K            0
        audit_path            0            0K            0
        audit_data            0            0K            0
        audit_cred            0            0K            0
            twsbuf            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
         MLX5E_TLS            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
            MLX5EN            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
          MLX5DUMP            0            0K            0
        MLX5EEPROM            0            0K            0
        MLX5EEPROM            0            0K            0
          seq_file            0            0K            0
             radix            0            0K            0
               idr            0            0K            0
            lkpifw            0            0K            0
               NLM            0            0K            0
    ipsec-spdcache            0            0K            0
         ipsec-reg            0            0K            0
        ipsec-misc            0            0K            0
      ipsecrequest            0            0K            0
            ip6opt            0            0K            3
       ip6_msource            0            0K            0
      ip6_moptions            0            0K            0
       in6_mfilter            0            0K            0
             frag6            0            0K            0
            tcplog            0            0K            0
        tcp_hwpace            0            0K            0
      twe_commands            0            0K            0
               LRO            0            0K            0
      newreno data            0            0K            0
        ip_msource            0            0K            0
       ip_moptions            0            0K            0
        in_mfilter            0            0K            0
              ipid            0            0K            0
         80211scan            0            0K            0
      80211ratectl            0            0K            0
        80211power            0            0K            0
       80211nodeie            0            0K            0
         80211node            0            0K            0
      80211mesh_gt            0            0K            0
      80211mesh_rt            0            0K            0
         80211perr            0            0K            0
         80211prep            0            0K            0
         80211preq            0            0K            0
          80211dfs            0            0K            0
       80211crypto            0            0K            0
          80211vap            0            0K            0
             iflib            0            0K            0
              vlan            0            0K            0
               gif            0            0K            0
           ifdescr            0            0K            0
              zlib            0            0K            0
           fadvise            0            0K            0
           VN POLL            0            0K            0
      twa_commands            0            0K            0
            statfs            0            0K          197
     namei_tracker            0            0K            0
       export_host            0            0K            0
        cl_savebuf            0            0K            6
       tcp_log_dev            0            0K            0
      midi buffers            0            0K            0
             mixer            0            0K            0
              ac97            0            0K            0
             hdacc            0            0K            0
              hdac            0            0K            0
              hdaa            0            0K            0
         acpicmbat            0            0K            0
       SIIS driver            0            0K            0
           CAM CCB            0            0K         1743
               PUC            0            0K            0
          ppbusdev            0            0K            0
agtiapi_MemAlloc malloc            0            0K            0
    osti_cacheable            0            0K            0
          tempbuff            0            0K            0
            biobuf            0            0K            0
              aios            0            0K            0
               lio            0            0K            0
               acl            0            0K            0
          tempbuff            0            0K            0
          mbuf_tag            0            0K           27
ag_tgt_map_t malloc            0            0K            0
ag_slr_map_t malloc            0            0K            0
lDevFlags * malloc            0            0K            0
tiDeviceHandle_t * malloc            0            0K            0
ag_portal_data_t malloc            0            0K            0
ag_device_t malloc            0            0K            0
     STLock malloc            0            0K            0
          CCB List            0            0K            0
            sr_iov            0            0K            0
               OCS            0            0K            0
               OCS            0            0K            0
              nvme            0            0K            0
               nvd            0            0K            0
            netmap            0            0K            0
            mwldev            0            0K            0
        MVS driver            0            0K            0
     CAM ccb queue            0            0K            0
          mrsasbuf            0            0K            0
          mpt_user            0            0K            0
          mps_user            0            0K            0
              accf            0            0K            0
               pts            0            0K            0
               iov            0            0K        13522
          ioctlops            0            0K           86
           eventfd            0            0K            0
           Witness            0            0K            0
             stack            0            0K            0
            MPSSAS            0            0K            0
               mps            0            0K            0
          mpr_user            0            0K            0
            MPRSAS            0            0K            0
               mpr            0            0K            0
            mfibuf            0            0K            0
              sbuf            0            0K          288
        md_sectors            0            0K            0
          firmware            0            0K            0
        compressor            0            0K            0
           md_disk            0            0K            0
              SWAP            0            0K            0
           malodev            0            0K            0
               LED            0            0K            0
         sysctltmp            0            0K          619
            sysctl            0            0K            3
              ekcd            0            0K            0
            dumper            0            0K            0
          sendfile            0            0K            0
              rctl            0            0K            0
          ix_sriov            0            0K            0
        aacraidcam            0            0K            0
       aacraid_buf            0            0K            0
                ix            0            0K            0
            ipsbuf            0            0K            0
             cache            0            0K            0
            iirbuf            0            0K            0
          kcovinfo            0            0K            0
      prison_racct            0            0K            0
       Fail Points            0            0K            0
             sigio            0            0K            1
filedesc_to_leader            0            0K            0
               pwd            0            0K            0
       tty console            0            0K            0
            aaccam            0            0K            0
            aacbuf            0            0K            0
              zstd            0            0K            0
            XZ_DEC            0            0K            0
            nvlist            0            0K            0
          SCSI ENC            0            0K            0
           SCSI sa            0            0K            0
         scsi_pass            0            0K            0
        isofs_node            0            0K            0
       isofs_mount            0            0K            0
     tr_raid5_data            0            0K            0
    tr_raid1e_data            0            0K            0
     tr_raid1_data            0            0K            0
     tr_raid0_data            0            0K            0
    tr_concat_data            0            0K            0
       md_sii_data            0            0K            0
   md_promise_data            0            0K            0
    md_nvidia_data            0            0K            0
   md_jmicron_data            0            0K            0
     md_intel_data            0            0K            0
       md_ddf_data            0            0K            0
         raid_data            0            0K           72
     geom_flashmap            0            0K            0
         tmpfs dir            0            0K            0
        tmpfs name            0            0K            0
       tmpfs mount            0            0K            0
           NFS FHA            0            0K            0
         newnfsmnt            0            0K            0
  newnfsclient_req            0            0K            0
   NFSCL layrecall            0            0K            0
     NFSCL session            0            0K            0
     NFSCL sockreq            0            0K            0
     NFSCL devinfo            0            0K            0
     NFSCL flayout            0            0K            0
      NFSCL layout            0            0K            0
     NFSD rollback            0            0K            0
      NFSCL diroff            0            0K            0
       NEWdirectio            0            0K            0
        NEWNFSnode            0            0K            0
         NFSCL lck            0            0K            0
      NFSCL lckown            0            0K            0
      NFSCL client            0            0K            0
       NFSCL deleg            0            0K            0
        NFSCL open            0            0K            0
       NFSCL owner            0            0K            0
            NFS fh            0            0K            0
           NFS req            0            0K            0
     NFSD usrgroup            0            0K            0
db> show uma
              Zone   Size    Used    Free    Requests  Sleeps  Bucket  Total Mem    XFree
   mbuf_jumbo_page   4096    8320     964       13377       0     254   38027264        0
              pbuf   2624       0     973           0       0       2    2553152        0
              mbuf    256    8578     947       15631       0     254    2438400        0
          BUF TRIE    144     176   13292         422       0      62    1939392        0
        malloc-384    384    4116       4        4116       0      30    1582080        0
        malloc-128    128   10990      15       11003       0     126    1408640        0
       malloc-4096   4096     332       1         492       0       2    1363968        0
       UMA Slabs 0    112   10089      24       10089       0     126    1132656        0
         FFS inode   1160     502      16         511       0       8     600880        0
            lkpimm    160       1    2324           1       0      62     372000        0
          lkpicurr    160       2    2323           2       0      62     372000        0
        RADIX NODE    144    2058     291       20242       0      63     338256        0
         malloc-64     64    3987     297        4970       0     254     274176        0
      malloc-65536  65536       4       0           4       0       1     262144        0
        256 Bucket   2048     106      16       10338       0       8     249856        0
             VNODE    448     532      17         543       0      30     245952        0
         VM OBJECT    264     895      35       12739       0      30     245520        0
       malloc-4096   4096      56       3         798       0       2     241664        0
         malloc-16     16   13710     290       13781       0     254     224000        0
            DEVCTL   1024       0     216         116       0       0     221184        0
            THREAD   1808     114       7         114       0       8     218768        0
      malloc-65536  65536       1       2         183       0       1     196608        0
         UMA Zones    768     237       2         237       0      16     183552        0
        malloc-256    256     681      24        1023       0      62     180480        0
         malloc-32     32    5172     246        5983       0     254     173376        0
        malloc-128    128    1282      51       29051       0     126     170624        0
      malloc-65536  65536       2       0           2       0       1     131072        0
       FFS2 dinode    256     502       8         511       0      62     130560        0
        malloc-128    128     928      33        1907       0     126     123008        0
          ksiginfo    112      34    1010          49       0     126     116928        0
         MAP ENTRY     96     836     382       38165       0     126     116928        0
       malloc-1024   1024     104       8         116       0      16     114688        0
         vmem btag     56    1882      50        1882       0     254     108192        0
       malloc-8192   8192       9       4         138       0       1     106496        0
       S VFS Cache    104     969      45        1007       0     126     105456        0
      mbuf_cluster   2048      45       1          45       0     254      94208        0
       malloc-2048   2048       2      44        1745       0       8      94208        0
          UMA Kegs    384     222       1         222       0      30      85632        0
            clpbuf   2624       0      32          18       0      16      83968        0
      malloc-16384  16384       4       1         181       0       1      81920        0
             g_bio    408       0     180        4446       0      30      73440        0
           VMSPACE   2544      23       4         766       0       4      68688        0
              PROC   1336      45       6         787       0       8      68136        0
      malloc-65536  65536       1       0           1       0       1      65536        0
      malloc-65536  65536       0       1           8       0       1      65536        0
      malloc-65536  65536       1       0           1       0       1      65536        0
      malloc-32768  32768       0       2         130       0       1      65536        0
      malloc-32768  32768       2       0           2       0       1      65536        0
       malloc-4096   4096      14       1         109       0       2      61440        0
         filedesc0   1072      46      10         788       0       8      60032        0
        malloc-256    256     175      50         767       0      62      57600        0
        128 Bucket   1024      44      11         643       0      16      56320        0
        malloc-128    128     118     285         419       0     126      51584        0
      malloc-16384  16384       3       0           3       0       1      49152        0
       malloc-2048   2048       4      18         511       0       8      45056        0
         malloc-64     64     526     167       14835       0     254      44352        0
        malloc-128    128     293      48         452       0     126      43648        0
         32 Bucket    256      47     118        3841       0      62      42240        0
       malloc-8192   8192       5       0           5       0       1      40960        0
        malloc-256    256     140      10         157       0      62      38400        0
           DIRHASH   1024      34       2          34       0      16      36864        0
             NAMEI   1024       0      36       12033       0      16      36864        0
        malloc-512    512       4      68         512       0      30      36864        0
            pcpu-8      8    4150     458        4178       0     254      36864        0
        malloc-384    384      69      21         102       0      30      34560        0
      malloc-32768  32768       1       0           1       0       1      32768        0
       malloc-8192   8192       3       1           5       0       1      32768        0
       malloc-4096   4096       7       1         539       0       2      32768        0
           pcpu-64     64     478      34         478       0     254      32768        0
         64 Bucket    512      53      11        1299       0      30      32768        0
         malloc-64     64     487      17         704       0     254      32256        0
        malloc-256    256      82      38         137       0      62      30720        0
        malloc-384    384      68       2          68       0      30      26880        0
            socket    944      18      10        1254       0     254      26432        0
       malloc-1024   1024      10      14        1082       0      16      24576        0
       malloc-1024   1024      18       6          22       0      16      24576        0
            ttyinq    160     135      15         300       0      62      24000        0
             tcpcb   1048       3      19           7       0     254      23056        0
           ttyoutq    256      72      18         160       0      62      23040        0
        malloc-384    384      52       8          52       0      30      23040        0
       malloc-4096   4096       3       2         201       0       2      20480        0
       malloc-2048   2048       6       4          83       0       8      20480        0
         TURNSTILE    136     122      25         122       0      62      19992        0
       Mountpoints   2752       2       5           2       0       4      19264        0
        malloc-256    256      13      62         345       0      62      19200        0
      malloc-16384  16384       1       0           1       0       1      16384        0
       malloc-8192   8192       2       0           2       0       1      16384        0
       malloc-2048   2048       3       5         268       0       8      16384        0
       malloc-2048   2048       6       2           6       0       8      16384        0
       malloc-1024   1024      12       4          12       0      16      16384        0
       malloc-1024   1024      12       4          12       0      16      16384        0
         malloc-64     64     127     125         155       0     254      16128        0
         malloc-32     32     335     169         433       0     254      16128        0
          8 Bucket     80      37     163         472       0     126      16000        0
              pipe    744       7      13         286       0      16      14880        0
        SLEEPQUEUE     88     122      38         122       0     126      14080        0
       malloc-2048   2048       5       1         196       0       8      12288        0
       malloc-1024   1024       5       7          21       0      16      12288        0
       malloc-1024   1024       8       4           9       0      16      12288        0
        malloc-512    512       3      21         189       0      30      12288        0
         malloc-64     64      66     123        9520       0     254      12096        0
         malloc-64     64     115      74        1626       0     254      12096        0
         malloc-64     64      24     165         293       0     254      12096        0
         malloc-32     32      70     308        3964       0     254      12096        0
             Files     80      72      78        6527       0     126      12000        0
         udp_inpcb    488       6      18         126       0     254      11712        0
              kenv    258      15      30        1049       0      30      11610        0
       mbuf_packet    256       0      45          94       0     254      11520        0
        malloc-256    256      14      31         102       0      62      11520        0
        malloc-256    256      20      25         618       0      62      11520        0
       malloc-8192   8192       1       0           1       0       1       8192        0
       malloc-8192   8192       1       0           1       0       1       8192        0
       malloc-8192   8192       1       0           1       0       1       8192        0
       malloc-2048   2048       3       1           3       0       8       8192        0
       malloc-1024   1024       0       8           4       0      16       8192        0
        malloc-512    512       6      10          12       0      30       8192        0
        malloc-512    512       8       8           8       0      30       8192        0
           rtentry    176      13      33          17       0      62       8096        0
              PGRP     88      20      72          32       0     126       8096        0
          rl_entry     40      27     175          27       0     254       8080        0
        sctp_laddr     48       0     168           4       0     254       8064        0
             udpcb     32       6     246         126       0     254       8064        0
               PWD     32      10     242         102       0     254       8064        0
         malloc-64     64       8     118           9       0     254       8064        0
         malloc-32     32      37     215         769       0     254       8064        0
         malloc-32     32      30     222         191       0     254       8064        0
         16 Bucket    144      33      23         197       0      62       8064        0
          4 Bucket     48       5     163          48       0     254       8064        0
          2 Bucket     32      41     211         494       0     254       8064        0
      vtnet_tx_hdr     24       0     334        1416       0     254       8016        0
             KNOTE    160       0      50           8       0      62       8000        0
         malloc-16     16       1     499           4       0     254       8000        0
         malloc-16     16      20     480          59       0     254       8000        0
         malloc-16     16     298     202         504       0     254       8000        0
         malloc-16     16      23     477          24       0     254       8000        0
         malloc-16     16     190     310        1445       0     254       8000        0
         malloc-16     16      26     474       25397       0     254       8000        0
         malloc-16     16      14     486          20       0     254       8000        0
        malloc-128    128       5      57          12       0     126       7936        0
        malloc-128    128      39      23          56       0     126       7936        0
        malloc-128    128      10      52          79       0     126       7936        0
             ripcb    488       1      15           4       0     254       7808        0
         tcp_inpcb    488       3      13           7       0     254       7808        0
     routing nhops    256      10      20          17       0      62       7680        0
             unpcb    256       7      23        1100       0     254       7680        0
        malloc-384    384       0      20          19       0      30       7680        0
        malloc-384    384       5      15         352       0      30       7680        0
        malloc-384    384      20       0          20       0      30       7680        0
        malloc-256    256      21       9         293       0      62       7680        0
     FPU_save_area    832       1       8           1       0      16       7488        0
            cpuset    104       7      55           7       0     126       6448        0
 epoch_record pcpu    256       4      12           4       0      62       4096        0
       malloc-4096   4096       0       1           3       0       2       4096        0
       malloc-2048   2048       1       1           1       0       8       4096        0
        malloc-512    512       0       8           2       0      30       4096        0
           pcpu-16     16       7     249           7       0     254       4096        0
         hostcache     64       1      62           1       0     254       4032        0
          syncache    168       0      24           5       0     254       4032        0
         malloc-32     32       6     120          11       0     254       4032        0
         malloc-32     32       0     126           2       0     254       4032        0
         malloc-32     32     103      23         227       0     254       4032        0
           cryptop    280       1      13           1       0      30       3920        0
       UMA Slabs 1    176       8      14           8       0      62       3872        0
        malloc-384    384       1       9           2       0      30       3840        0
            mqnode    416       3       6           3       0      30       3744        0
        KMAP ENTRY     96      12      27          12       0       0       3744        0
              vmem   1856       1       1           1       0       8       3712        0
           SMR CPU     32       3      60           3       0     254       2016        0
        SMR SHARED     24       3      60           3       0     254       1512        0
       FFS1 dinode    128       0       0           0       0     126          0        0
             swblk    136       0       0           0       0      62          0        0
          swpctrie    144       0       0           0       0      62          0        0
   sctp_asconf_ack     48       0       0           0       0     254          0        0
       sctp_asconf     40       0       0           0       0     254          0        0
sctp_stream_msg_out    112       0       0           0       0     254          0        0
        sctp_readq    152       0       0           0       0     254          0        0
        sctp_chunk    152       0       0           0       0     254          0        0
        sctp_raddr    736       0       0           0       0     254          0        0
         sctp_asoc   2288       0       0           0       0     254          0        0
           sctp_ep   1280       0       0           0       0     254          0        0
   pf state scrubs     40       0       0           0       0     254          0        0
   pf frag entries     40       0       0           0       0     254          0        0
          pf frags    248       0       0           0       0      62          0        0
  pf table entries    160       0       0           0       0      62          0        0
pf table entry counters     64       0       0           0       0     254          0        0
   pf source nodes    136       0       0           0       0     254          0        0
     pf state keys     88       0       0           0       0     126          0        0
         pf states    296       0       0           0       0     254          0        0
           pf tags    104       0       0           0       0     126          0        0
          pf mtags     48       0       0           0       0     254          0        0
      tcp_rack_pcb    704       0       0           0       0      16          0        0
      tcp_rack_map    120       0       0           0       0     126          0        0
       tcp_bbr_pcb    832       0       0           0       0      16          0        0
       tcp_bbr_map    128       0       0           0       0     126          0        0
    IPsec SA lft_c     16       0       0           0       0     254          0        0
     udplite_inpcb    488       0       0           0       0     254          0        0
      tcp_log_node    120       0       0           0       0     126          0        0
    tcp_log_bucket    176       0       0           0       0      62          0        0
           tcp_log    416       0       0           0       0     254          0        0
          tcpreass     48       0       0           0       0     254          0        0
tfo_ccache_entries     80       0       0           0       0     126          0        0
               tfo      4       0       0           0       0     254          0        0
          sackhole     32       0       0           0       0     254          0        0
             tcptw     88       0       0           0       0     254          0        0
               ipq     56       0       0           0       0     254          0        0
            itimer    352       0       0           0       0      30          0        0
            AIOLIO    272       0       0           0       0      30          0        0
             AIOCB    552       0       0           0       0      16          0        0
              AIOP     32       0       0           0       0     254          0        0
               AIO    208       0       0           0       0      62          0        0
        TMPFS node    224       0       0           0       0      62          0        0
        mqnotifier    216       0       0           0       0      62          0        0
            mvdata     64       0       0           0       0     254          0        0
            mqueue    248       0       0           0       0      62          0        0
           NCLNODE    584       0       0           0       0      16          0        0
     LTS VFS Cache    360       0       0           0       0      30          0        0
       L VFS Cache    320       0       0           0       0      30          0        0
     STS VFS Cache    144       0       0           0       0      62          0        0
  linux_dma_object     24       0       0           0       0     254          0        0
  linux_dma_pctrie    144       0       0           0       0      62          0        0
   IOMMU_MAP_ENTRY    120       0       0           0       0     126          0        0
      ktls_session    192       0       0           0       0      62          0        0
    mbuf_jumbo_16k  16384       0       0           0       0     254          0        0
     mbuf_jumbo_9k   9216       0       0           0       0     254          0        0
      audit_record   1280       0       0           0       0       8          0        0
         domainset     40       0       0           0       0     254          0        0
        MAC labels     40       0       0           0       0     254          0        0
            vnpbuf   2624       0       0           0       0      64          0        0
            mdpbuf   2624       0       0           0       0       3          0        0
           nfspbuf   2624       0       0           0       0      16          0        0
            swwbuf   2624       0       0           0       0       8          0        0
            swrbuf   2624       0       0           0       0      16          0        0
          umtx_shm     88       0       0           0       0     126          0        0
           umtx pi     96       0       0           0       0     126          0        0
rangeset pctrie nodes    144       0       0           0       0      62          0        0
      malloc-65536  65536       0       0           0       0       1          0        0
      malloc-65536  65536       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-32768  32768       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
      malloc-16384  16384       0       0           0       0       1          0        0
       malloc-8192   8192       0       0           0       0       1          0        0
       malloc-4096   4096       0       0           0       0       2          0        0
       malloc-4096   4096       0       0           0       0       2          0        0
        malloc-512    512       0       0           0       0      30          0        0
        malloc-512    512       0       0           0       0      30          0        0
        malloc-512    512       0       0           0       0      30          0        0
           pcpu-32     32       0       0           0       0     254          0        0
            pcpu-4      4       0       0           0       0     254          0        0
            fakepg    104       0       0           0       0     126          0        0
          UMA Hash    256       0       0           0       0      62          0        0

Crashes (16):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-freebsd-main 2021/05/06 21:07 freebsd-src 0ec3e991112d 06585184 console log report syz C panic: IV outside buffer length
ci-freebsd-main 2021/05/12 04:32 freebsd-src b8f113cab91f 86294427 console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/11 17:05 freebsd-src 3cbad8287aa0 ca873091 console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/11 13:52 freebsd-src 3cbad8287aa0 ca873091 console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/10 23:42 freebsd-src c55b340f824d ca873091 console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/10 16:36 freebsd-src 8725f0b9dbd2 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/10 03:45 freebsd-src c2c9ef3cedf6 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/09 20:12 freebsd-src c2c9ef3cedf6 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/09 18:12 freebsd-src c2c9ef3cedf6 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/09 17:21 freebsd-src c2c9ef3cedf6 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/09 12:47 freebsd-src 6cb13813caa0 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/09 09:34 freebsd-src 6cb13813caa0 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/09 06:12 freebsd-src 6cb13813caa0 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/09 06:12 freebsd-src 6cb13813caa0 bc5434be console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/07 13:55 freebsd-src fb53b42e36a9 f6da8120 console log report panic: IV outside buffer length
ci-freebsd-main 2021/05/06 20:54 freebsd-src 0ec3e991112d 06585184 console log report panic: IV outside buffer length
* Struck through repros no longer work on HEAD.