Extra filters: [With Repro]
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Closed Patch
panic: size_on_reasm_queue is NUM (4) 2 syz, C 5 922d 1000d 0/2 never 429f2fb48b92 sctp: hold tcp lock when calling sctp_calc_rwnd()
panic: m_apply, length > size of mbuf chain (NUM extra) 2 syz, C 3 448d 448d 0/2 never 1f5b1de1fdf2 ipv6: account for jumbo payload option
Fatal trap NUM: page fault in __mtx_lock_flags (5) -1 syz, C 3 345d 379d 2/2 335d 9d9fa9a2c22f unix: Fix handling of listening sockets during garbage collection
panic: vfs_knl_assert_locked: vnode is not locked but should be 2 1 415d 415d 2/2 337d 99cb3dca4773 vnode: Rework vput() to avoid holding the vnode lock after decrementing
panic: freevnode: cannot lock vp ADDR for pollinfo destroy 2 syz, C 4 388d 397d 2/2 337d 99cb3dca4773 vnode: Rework vput() to avoid holding the vnode lock after decrementing
freebsd test error: panic: _proc_set_cred: ref NUM not NUM on cred ADDR -1 4 343d 343d 2/2 343d d7a138207fa4 Revert "kern: RACCT: Keep process credentials alive via references"
panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE 2 syz, C 9 415d 431d 2/2 364d 4548b9f3a816 unix/stream: plug a corner case when control externalization failed
panic: Assertion pd->pcksum failed at /syzkaller/managers/main/kernel/sys/netpfil/pf/pf.c:LINE (2) 2 1 382d 382d 2/2 377d dd2fc08d8543 pf: fix possibe SCTP panic
panic: Assertion pd->pcksum failed at /syzkaller/managers/i386/kernel/sys/netpfil/pf/pf.c:LINE (2) 2 1 410d 410d 2/2 401d c23eda976a8a pf: fix possible pd->pcksum NULL deref
freebsd build error (21) -1 607 401d 485d 2/2 401d 13e7b21901a5 Makefile.inc1: Build openssl as a certctl dependency on old FreeBSD
panic: kern_clock_gettime: NUM 2 syz, C 88 435d 486d 2/2 434d 7556b55f0d67 time: Handle kern_clock_gettime() failures in kern_clock_nanosleep()
panic: Assertion too many supplementary groups failed at /syzkaller/managers/main/kernel/sys/kern/kern_prot.c:LINE 2 syz 227 436d 441d 2/2 436d 28f618fcc2b4 kern: fix a panic in crcopysafe() found by syzkaller
panic: sleeping thread holds ncvn 2 1 440d 440d 2/2 439d c2230ad3b121 inotify: Avoid calling vrele() with a namecache mutex held
panic: handle_written_inodeblock: live inodedep ADDR 2 346 442d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: handle_workitem_remove: lost dir inodedep 2 65 442d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: handle_workitem_remove: bad file delta 2 syz, C 91 442d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: handle_workitem_remove: file ino NUM negative i_nlink -NUM 2 24 442d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: handle_workitem_remove: directory ino ADDR negative i_nlink -NUM 2 1 443d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: handle_workitem_remove: file ino ADDR negative i_nlink -NUM 2 1 443d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: handle_workitem_remove: directory ino NUM negative i_nlink -NUM 2 23 442d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: Assertion ip->i_mode != NUM failed at /syzkaller/managers/main/kernel/sys/ufs/ffs/ffs_softdep.c:LINE 2 syz, C 244 442d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: Assertion ip->i_mode != NUM failed at /syzkaller/managers/i386/kernel/sys/ufs/ffs/ffs_softdep.c:LINE 2 30 442d 443d 2/2 442d 2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: VOP_READDIR: eofflag not set 2 43 448d 449d 2/2 448d b4f610a6851d vfs: Handle zero-length directory reads
panic: tcp_do_segment: sent too much: NUM>NUM 2 61 453d 528d 2/2 452d e46c15a0f848 tcp: fix the test that a duplicate ACK has no data
panic: in6_pcbconnect: inp is already connected 2 8 465d 471d 2/2 464d 96f544bcc1cb tcp: don't allow to connect a TCP/IPv6 endpoint in TIME WAIT state
Fatal trap NUM: page fault in _vn_lock -1 syz, C 561 468d 469d 2/2 468d 5ae9f8e9ac5e md: Restore guards in mddestroy()
Fatal trap NUM: page fault in destroy_indir -1 syz, C 503 468d 469d 2/2 468d 5ae9f8e9ac5e md: Restore guards in mddestroy()
panic: tcp_default_fb_init: connection ADDR in unexpected state NUM 2 15 470d 474d 2/2 470d e0f7e7324884 tcp: remove an invalid KASSERT
Fatal trap NUM: page fault in in_pcbremhash_locked -1 syz, C 219 485d 600d 2/2 484d ba3d547967c8 tcp: Fix the SO_REUSEPORT_LB check
panic: mutex so_rcv not owned at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE 2 syz, C 7 519d 522d 2/2 509d c44d6f43a68f unix/stream: provide uipc_cantrcvmore()
panic: zone pf frag entries initialization after use. 2 1 527d 527d 2/2 524d b70fadca623f pf: fix dealing with 0 limits
panic: sofree:NUM curvnet is NULL, so=ADDR 2 syz, C 49 526d 527d 2/2 526d 9a7d03c7df35 sendfile: cover the entire sendfile operation under CURVNET_SET()
Fatal trap NUM: page fault in unp_dispose -1 2 526d 526d 2/2 526d 964fe0fd4d52 unix: fix skipping of M_NOTREADY mbufs in unp_dispose()
panic: aio_process_rw: opcode NUM 2 syz, C 2 531d 531d 2/2 530d ab01a5f5628e aio: Fix opcode handling in aio_process_rw()
panic: vm_pager_assert_in: page ADDR is mapped (2) 2 syz, C 3 539d 542d 2/2 538d 1cce7d86c86a vm_map: fix iterator jump size
panic: ktls_frame: mapped mbuf ADDR (top = ADDR) 2 syz, C 4 544d 544d 2/2 540d 1000cc4a0d39 so_splice: Disallow splicing with KTLS-enabled sockets
panic: _pctrie_lookup_node: freed node in iter path 2 syz, C 5 543d 544d 2/2 543d bcd96c3180d6 vm_object: reset iter in page_clean
freebsd build error (20) -1 23 543d 616d 2/2 543d b66e75bffc22 kcov: Fix the build
panic: neg writecount increment NUM + -NUM = -NUM 2 syz, C 2 553d 553d 2/2 550d 509189bb4109 fhopen: Enable handling of O_PATH, fix some bugs
panic: Bad link elm ADDR next->prev != elm (4) 2 2 570d 592d 2/2 550d a6268f89d58c proc: Disallow re-enabling of process itimers during exit
panic: vm_page_free_prep: attempting to free a PG_NOFREE page 2 2520 553d 804d 2/2 552d ae10431c9833 vm_page: Allow PG_NOFREE pages to be freed
panic: unhandled af NUM (2) 2 syz, C 5 553d 553d 2/2 552d 646b453110aa pf: fix pf_ioctl_add_addr() validation
panic: mutex sctp-inp not owned at /syzkaller/managers/main/kernel/sys/kern/kern_mutex.c:LINE 2 1 564d 564d 2/2 563d e8623834ca29 sctp: fix double unlock in case adding a remote address fails
panic: ASan: Invalid access, NUM-byte read at ADDR, StackMiddle(f2) (2) 2 syz, C 16 908d 1452d 2/2 563d 68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: ASan: Invalid access, NUM-byte read at ADDR, UseAfterScope(f8) (2) 2 syz, C 452 908d 1606d 2/2 563d 68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: ASan: Invalid access, NUM-byte read at ADDR, StackRight(f3) 2 syz 3 919d 923d 2/2 563d 68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: mpred ADDR doesn't precede pindex 0x763 2 1 566d 566d 2/2 565d 93c4f310fc65 vm_fault: correct mpred update after alloc fail
panic: mpred ADDR doesn't precede pindex 0xbdc 2 1 567d 567d 2/2 565d 93c4f310fc65 vm_fault: correct mpred update after alloc fail
panic: Empty stailq ADDR->stqh_last is ADDR, not head's first field address (2) 2 1 571d 571d 2/2 565d e9a846468acf ktrace: Use STAILQ_EMPTY_ATOMIC when checking for records in userret()
panic: Assertion M_WRITABLE(m0) failed at /syzkaller/managers/main/kernel/sys/kern/uipc_mbuf.c:LINE 2 syz, C 40 763d 764d 2/2 565d 299175f2e52e Revert "Assert that mbufs are writable if we write to them"
panic: mpred ADDR doesn't precede pindex 0x5c2 2 1 566d 566d 2/2 565d 93c4f310fc65 vm_fault: correct mpred update after alloc fail
panic: unhandled af NUM 2 23 590d 590d 2/2 589d 80b64ef0a10b pf: don't assert on address family in pf_addrcpy()
panic: nl_buf_alloc: invalid length ADDR 2 syz, C 2 594d 594d 2/2 593d a80bbc4e9597 netlink: refuse a send(2) that is larger than socket buffer
panic: inpcb ADDR is not in a load balance group 2 4 629d 629d 2/2 600d 16369f33c5d9 inpcb: Remove an incorrect assertion in in_pcblbgroup_find()
panic: Empty stailq ADDR->stqh_last is ADDR, not head's first field address 2 1 617d 617d 2/2 600d 36631977d8c9 ktr: Use STAILQ_EMPTY_ATOMIC when checking for records in ktr_drain()
Fatal trap NUM: page fault in rtsock_msg_buffer -1 syz, C 9 696d 699d 2/2 695d dae64402b3e8 rtsock: fix panic in rtsock_msg_buffer()
Fatal trap NUM: general protection fault in rtsock_msg_buffer -1 syz 1 696d 696d 2/2 695d dae64402b3e8 rtsock: fix panic in rtsock_msg_buffer()
freebsd test error: panic: ASan: Invalid access, NUM-byte write at ADDR, GenericRedZone(fa) -1 2 761d 761d 2/2 761d 47112d359b36 kassert: Remove KASAN marking from DEBUG_POISON_POINTER
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM (2) 2 syz, C 70 884d 929d 2/2 808d 71867653008c udp: improve handling of cached route
freebsd test error: Fatal trap NUM: page fault while in kernel mode -1 11 852d 853d 2/2 852d 517c5854588e vm_phys: Make sure that vm_phys_enq_chunk() stays in bounds
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (4) -1 1 910d 910d 2/2 902d d66399326cb4 kthread: Set *tdptr earlier in kproc_kthread_add()
Fatal trap NUM: page fault in strlcpy -1 syz, C 3 919d 919d 2/2 918d b112232e4fb9 uipc_shm: Copyin userpath for ktrace(2)
panic: Unaligned free of ADDR from zone ADDR(mbuf) slab ADDR(NUM) 2 syz, C 28 919d 919d 2/2 919d fb8a8333b481 unix: return immediately on MSG_OOB
Fatal trap NUM: page fault in uipc_soreceive_stream_or_seqpacket -1 syz, C 3 919d 919d 2/2 919d d1cbb17a873c unix: fix the ad hoc STAILQ_PREPEND()
panic: Assertion size > NUM failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE 2 syz, C 69 940d 945d 2/2 940d b5a9299bb8b9 ktls: catch invalid parameters earlier
panic: Assertion size > NUM failed at /syzkaller/managers/i386/kernel/sys/kern/subr_vmem.c:LINE 2 1 941d 941d 2/2 940d b5a9299bb8b9 ktls: catch invalid parameters earlier
panic: Assertion !callout_active(&tp->t_callout) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_subr.c:LINE 2 3 976d 977d 2/2 975d 57e27ff07aff tcp: partially undo D43792
panic: Assertion !callout_active(&tp->t_callout) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_subr.c:LINE 2 13 975d 977d 2/2 975d 57e27ff07aff tcp: partially undo D43792
panic: lock (sleep mutex) sctp-inp not locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_usrreq.c:LINE 2 565 1002d 1002d 2/2 1001d a079c891c01b sctp: restore missing inpcb lock
panic: lock (sleep mutex) sctp-inp not locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_usrreq.c:LINE 2 syz, C 455 1001d 1002d 2/2 1001d a079c891c01b sctp: restore missing inpcb lock
panic: sbflush_internal: ccc NUM mb ADDR mbcnt NUM 2 syz, C 3 1014d 1014d 2/2 1010d 59ce044a7856 sockets: on shutdown(2) do sorflush() only in case of generic sockbuf
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM 2 syz, C 4 1046d 1055d 2/2 1017d 7df9da47e8f0 Fix udp IPv4-mapped address
panic: Assertion !tcp_in_hpts(tp) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_subr.c:LINE 2 9 1042d 1045d 2/2 1030d ade05d63b727 tcp: stop stack timers in tcp_switch_back_to_default()
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (3) -1 1 1041d 1041d 2/2 1040d ae77041e0714 kthread: Set *newtdp earlier in kthread_add1()
panic: Assertion !(tp->t_flags2 & TF2_HPTS_CPU_SET) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_hpts.c:LIN 2 syz, C 375 1042d 1045d 2/2 1042d 3f46be6acadd tcp_hpts: let tcp_hpts_init() set a random CPU only once
panic: Assertion !tcp_in_hpts(tp) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_subr.c:LINE 2 syz, C 35 1042d 1045d 2/2 1042d ade05d63b727 tcp: stop stack timers in tcp_switch_back_to_default()
panic: Assertion !(tp->t_flags2 & TF2_HPTS_CPU_SET) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_hpts.c:LIN 2 211 1043d 1045d 2/2 1042d 3f46be6acadd tcp_hpts: let tcp_hpts_init() set a random CPU only once
panic: ASan: Invalid access, NUM-byte read at ADDR, MallocRedZone(fb) (2) 2 6 1095d 1106d 2/2 1093d 761ae1ce798a ktrace: Handle uio_resid underflow via MSG_TRUNC
panic: in_pcblookup_hash_locked: invalid local address (2) 2 syz, C 94 1107d 1317d 2/2 1103d abca3ae7734f udp: fix sending of IPv4-mapped addresses
panic: in_pcblookup_hash_locked: invalid foreign address (2) 2 syz, C 38 1111d 1317d 2/2 1103d abca3ae7734f udp: fix sending of IPv4-mapped addresses
panic: Rack:ADDR sb:ADDR rsm:ADDR -- first rsm mbuf not aligned to sb (2) 2 1 1156d 1156d 2/2 1106d 8818f0f1124e TCP: Fix a rack bug that skyzall found which results in a crash.
panic: rsm:ADDR nrsm:ADDR hit at soff:NUM null m 2 1 1184d 1184d 2/2 1106d 8818f0f1124e TCP: Fix a rack bug that skyzall found which results in a crash.
panic: mbuf:ADDR len:NUM rsm:ADDR oml:NUM soff:NUM 2 syz, C 4 1107d 1156d 2/2 1106d 8818f0f1124e TCP: Fix a rack bug that skyzall found which results in a crash.
panic: Counter goes negative (3) 2 syz, C 595 1129d 1685d 2/2 1127d bb56b36d7188 sctp: further improve shutting down the read side of a socket
panic: sbflush_internal: residual data (3) 2 syz, C 33 1220d 1587d 2/2 1128d 81c5f0fac91d sctp: improve shutting down the read side of a socket
panic: malloc: called with spinlock or critical section held 2 syz, C 3 1143d 1143d 2/2 1143d 6b635c74fd41 aesni: Push FPU sections down further
panic: sbcut_internal: no next, len NUM 2 syz, C 2 1161d 1161d 2/2 1148d 847fa61fad5e sctp: improve handling of socket shutdown for reading
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (2) -1 51 1167d 1168d 2/2 1162d ccdb28275db7 vm_phys_enq_range: no alignment assert for npages==0
freebsd boot error: panic: vm_phys_enq_range: page ADDR and npages NUM are misaligned -1 18 1170d 1170d 2/2 1169d b7370efade86 Revert "vm_phys_enqueue_contig: handle npages==0"
Fatal trap NUM: page fault in tcp_input_with_port -1 syz, C 6 1192d 1232d 2/2 1176d a43e7a96b64e inpcb: use internal flag to mark pcbs that are inserted into lbgroup
panic: in_pcbconnect: inp is already connected 2 syz, C 2 1217d 1217d 2/2 1210d de0a2eb2ef86 tcp: Disallow connecting a disconnected socket
panic: lock (sleep mutex) unp not locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE 2 syz, C 2 1212d 1212d 2/2 1211d 712079d38106 unix: Fix uipc_peeraddr() to handle self-connected sockets
panic: lock (sleep mutex) unp not locked @ /syzkaller/managers/i386/kernel/sys/kern/uipc_usrreq.c:LINE 2 1 1212d 1212d 2/2 1211d 712079d38106 unix: Fix uipc_peeraddr() to handle self-connected sockets
panic: filesystem goof: vop_panic[vop_fplookup_vexec] 2 6 1287d 1287d 2/2 1286d 4032c388146b ufs: add missing vop_fplookup ops to fifo vectors
panic: ASan: Invalid access, NUM-byte write at ADDR, StackMiddle(f2) (3) 2 4274 1289d 1290d 2/2 1289d 030434acaf46 Update rack to the latest code used at NF.
panic: in6_pcblookup_hash_locked: invalid local address 2 syz 37 1333d 1349d 2/2 1311d aa71d6b4a2ec netinet: Disallow unspecified addresses in ICMP-embedded packets
panic: in_pcblookup_hash_l[o ctkherde:a di nvaplidi d 1l1o86 catlid a1d0dr0e6s9s1 ] 2 1 1330d 1330d 2/2 1318d 713264f6b8bc netinet: Tighten checks for unspecified source addresses
panic: in_pcblookup_hash_locked: invalid local address 2 syz 165751 1318d 1349d 2/2 1318d 713264f6b8bc netinet: Tighten checks for unspecified source addresses
panic: in_pcblookup_hash_locked: invalid foreign address 2 syz 152 1318d 1349d 2/2 1318d 713264f6b8bc netinet: Tighten checks for unspecified source addresses
freebsd build error (16) -1 214 1329d 1345d 2/2 1329d 8c8574acb851 config: Include errno.h in mkmakefile.cc
Fatal trap NUM: page fault in sctp_notify_stream_reset_tsn -1 syz 2 1351d 1351d 2/2 1350d 7b2f1a7fe944 sctp: improve delivery of stream reset notifications
Fatal trap NUM: page fault in kern_cpuset_getid -1 syz, C 3 1354d 1354d 2/2 1353d 2058f075b4af cpuset: Handle CPU_WHICH_TIDPID wherever cpuset_which() is called.
panic: ipreass_callout: stray callout on bucket ADDR 2 10 1496d 1497d 2/2 1481d 15b73a2a14d1 ip_reass: use correct comparison in ipreass_callout()
panic: ipreass_callout: stray callout on bucket ADDR, NUM < NUM 2 34 1491d 1496d 2/2 1491d 15b73a2a14d1 ip_reass: use correct comparison in ipreass_callout()
panic: Assertion sb->sb_hiwat >= sb->uxdg_cc failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE 2 syz, C 2 1518d 1518d 2/2 1511d 820bafd0bc14 unix/dgram: don't panic if socket buffer has negative space
Fatal trap NUM: page fault in key_attach -1 syz, C 117 1525d 1525d 2/2 1524d b7bf3cb07fcf keysock: explicitly initialized LIST_HEAD
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2) 2 syz, C 3 1632d 1655d 2/2 1526d bb995f2ef0e7 sctp: improve handling of send() calls with no user data`
panic: seq_out not found rack:ADDR tp:ADDR 2 syz, C 108 1552d 1949d 2/2 1548d 5b741298b11c tcp rack: fix switching to RACK when FIN has been sent
Fatal trap NUM: page fault in soclose -1 syz, C 245 1570d 1573d 2/2 1570d bafe71fd2720 sctp: do not clobber listening socket with sockbuf operations
panic: Assertion v != tid failed at /syzkaller/managers/main/kernel/sys/kern/kern_mutex.c:LINE 2 syz, C 245 1585d 2225d 2/2 1583d a14465e1b9a5 rip6: Fix a lock order reversal in rip6_bind()
panic: Assertion v != tid failed at /syzkaller/managers/i386/kernel/sys/kern/kern_mutex.c:LINE 2 syz 115 1589d 2219d 2/2 1583d a14465e1b9a5 rip6: Fix a lock order reversal in rip6_bind()
panic: Assertion (t->parent->p_treeflag & P_TREE_REAPER) != NUM failed at /syzkaller/managers/main/kernel/sys/kern/kern_ 2 7 1586d 1630d 2/2 1584d 1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Thread not suspended 2 syz 30 1586d 1630d 2/2 1584d 1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Assertion TD_CAN_RUN(td) failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:LINE 2 syz, C 1 1630d 1630d 2/2 1584d 1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: td ADDR is not suspended 2 syz, C 11 1585d 1631d 2/2 1584d 1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: already suspended 2 syz, C 130 1584d 1631d 2/2 1584d 1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Lock pf config not exclusively locked @ /syzkaller/managers/i386/kernel/sys/netpfil/pf/pf_ioctl.c:LINE 2 109 1618d 1661d 2/2 1585d 826c58d6656c pf: add missing unlock on error in DIOCCHANGERULE
panic: Lock pf config not exclusively locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:LINE 2 syz, C 142 1618d 1661d 2/2 1585d 826c58d6656c pf: add missing unlock on error in DIOCCHANGERULE
Fatal trap NUM: page fault in tcp_sack_output -1 4 1590d 1590d 2/2 1590d ce2525c8108a tcp: remove goto and address another NULL deref in SACK
panic: sctp_inpcb_free: inp ADDR still has socket 2 syz 12 1623d 1812d 2/2 1593d a5c2009dd8ab sctp: improve handling of sctp inpcb flags
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT (2) -1 syz, C 27 1599d 1616d 2/2 1597d a3d974082549 pf: make sure the rule tree is allocated in DIOCCHANGERULE
panic: sbflush_internal: residual data (2) 2 syz, C 263 1599d 1862d 2/2 1599d a6a596e102be sctp: improve handling of listen() call
panic: Queues are not empty when handling SHUTDOWN-ACK (2) 2 1 1600d 1600d 2/2 1600d 64b297e803bd sctp: improve handling of send() when association is shutdown
panic: Warning: Last msg marked incomplete, yet nothing left? (2) 2 syz, C 3 1601d 1609d 2/2 1600d 2646cd085850 sctp: use a consistent view of the send parameters
panic: Queues are not empty when handling SHUTDOWN-COMPLETE 2 syz, C 17 1638d 2168d 2/2 1600d 64b297e803bd sctp: improve handling of send() when association is shutdown
panic: sctp: no chunks on the queues (2) 2 syz 1813 1601d 2245d 2/2 1600d 2646cd085850 sctp: use a consistent view of the send parameters
panic: Assertion clen >= sizeof(*cm) && clen <= cm->cmsg_len failed at /syzkaller/managers/i386/kernel/sys/kern/uipc_usr 2 18 1602d 1603d 2/2 1602d 75e7e3ce34d9 unix: fix incorrect assertion in 4682ac697ce
panic: Assertion clen >= sizeof(*cm) && clen <= cm->cmsg_len failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usr 2 syz, C 6 1603d 1603d 2/2 1602d 75e7e3ce34d9 unix: fix incorrect assertion in 4682ac697ce
freebsd build error (13) -1 9 1609d 1609d 2/2 1609d 4a3e51335e86 cpuset: Fix the KASAN and KMSAN builds
Fatal trap NUM: page fault in sctp_wakeup_the_read_socket (3) -1 syz 3 1633d 1638d 2/2 1631d 490a0f77de77 sctp: improve locking
panic: ASan: Invalid access, NUM-byte write at ADDR, UMAUseAfterFree(fd) 2 8 1641d 1655d 2/2 1639d 868868f14efc sctp: improve stopping of timers
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd) (2) 2 syz, C 7 1640d 1641d 2/2 1639d a12d89332efe sctp: hold the inp lock while calling ip6_output
Fatal trap NUM: page fault in sctp_wakeup_the_read_socket (2) -1 1 1716d 1716d 2/2 1642d 3dc57df91e65 sctp: don't wakeup 1-to-1 listening sockets for data or notifications
Fatal trap NUM: page fault in __mtx_lock_flags (2) -1 syz, C 2 1652d 1652d 2/2 1642d 3dc57df91e65 sctp: don't wakeup 1-to-1 listening sockets for data or notifications
panic: ASan: Invalid access, NUM-byte read in sctp_med_chunk_output 2 syz, C 180 1796d 1853d 2/2 1643d eeba22217217 sctp: don't keep a pointer to a freed stcb around
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd) 2 syz, C 515 1643d 1763d 2/2 1643d eeba22217217 sctp: don't keep a pointer to a freed stcb around
panic: ASan: Invalid access, 4-byte write at ADDR, UMAUseAfterFree(fd) 2 syz, C 462 1659d 1925d 2/2 1656d 52106f072fd0 sctp: don't refer to a potentially outdated stream
panic: ASan: Invalid access, NUM-byte write at ADDR, UseAfterScope(f8) 2 11 1659d 1780d 2/2 1657d 39a22011bbb8 sctp: clear pointer to stack when returning from function.
panic: ASan: Invalid access, NUM-byte write at ADDR, StackRight(f3) 2 102 1657d 1661d 2/2 1657d 39a22011bbb8 sctp: clear pointer to stack when returning from function.
panic: ASan: Invalid access, NUM-byte write at ADDR, KernelStack(fe) 2 149 1657d 1661d 2/2 1657d 39a22011bbb8 sctp: clear pointer to stack when returning from function.
panic: ASan: Invalid access, NUM-byte write at ADDR, StackMiddle(f2) (2) 2 1 1659d 1659d 2/2 1657d 39a22011bbb8 sctp: clear pointer to stack when returning from function.
panic: ASan: Invalid access, NUM-byte write at ADDR, StackLeft(f1) 2 48 1657d 1661d 2/2 1657d 39a22011bbb8 sctp: clear pointer to stack when returning from function.
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT -1 syz, C 81 1660d 1661d 2/2 1660d e123e2294cb5 pf: guard against DIOCADDRULE without DIOCXBEGIN
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-tcb @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_outp 2 2 1661d 1661d 2/2 1660d 5d0c76c7302b sctp: don't lock an already locked stcb.
panic: Don't own TCB send lock 2 syz, C 8016 1661d 1845d 2/2 1661d 5ac91821f5d7 sctp: get rid of stcb send lock
panic: Association about to be freed (2) 2 syz, C 4834 1661d 1698d 2/2 1661d 5ac91821f5d7 sctp: get rid of stcb send lock
panic: hold_tcblock is false 2 syz, C 468 1698d 1698d 2/2 1698d e255f0c9fbd2 sctp: make sure new locking requirements are satisfied.
panic: Association about to be freed 2 syz, C 57 1698d 1698d 2/2 1698d bdb99f6f5e31 sctp: remove KASSERT() which not always holds
panic: create_lock_applied is true 2 syz, C 104 1698d 1698d 2/2 1698d 2f0656fb9ba2 sctp: don't hold the assoc create lock longer than needed
panic: refcount ADDR wraparound (4) 2 21 1721d 1788d 2/2 1709d 300cfb96fc22 file: Make fget*() and getvnode*() consistent about initializing *fpp
panic: Bad link elm ADDR prev->next != elm (3) 2 8 1721d 1773d 2/2 1715d b84ed4e7f626 filemon: Reject FILEMON_SET_FD commands when the fd is a kqueue
panic: lock ADDR is not initialized (2) 2 171 1717d 1732d 2/2 1717d 773e3a71b2f1 pf: Initialize pf_kpool mutexes earlier
freebsd boot error: can't ssh into the instance -1 22 1731d 1731d 2/2 1731d 46d35d415aa9 fork: Copy the vm_stacktop field into the new vmspace
panic: lock ADDR is not initialized 2 1457 1732d 1735d 2/2 1732d e5ca5e801d3c pf: ensure we don't destroy an uninitialised lock
Fatal trap NUM: page fault in inp_next -1 syz 3 1751d 1757d 2/2 1747d 430df2abee90 in_pcb: improve inp_next()
panic: mutex blocked lock not owned at /syzkaller/managers/main/kernel/sys/kern/sched_ule.c:LINE 2 syz, C 33 1748d 1749d 2/2 1748d 6b95cf5bdedc callout: Wait for the softclock thread to switch before rescheduling
Fatal trap NUM: page fault in tcp_usr_send -1 syz 1 1752d 1752d 2/2 1751d 4287aa56197f tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
panic: overhead (NUM) not a multiple of NUM 2 syz, C 248 1752d 1752d 2/2 1752d ca0dd19f0933 sctp: check that the computed frag point is a multiple of 4
Fatal trap NUM: page fault in tcp_usr_shutdown -1 syz, C 5 1752d 1753d 2/2 1752d 4287aa56197f tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
Fatal trap NUM: page fault in tcp_usr_rcvd -1 syz, C 7 1753d 1753d 2/2 1752d 37a7f5573716 tcp_usr_rcvd: don't cast inp_ppcb to tcpcb before checking inp_flags
panic: m_apply, offset > size of mbuf chain 2 syz, C 2 1759d 1759d 2/2 1752d 989453da0589 sctp: cleanup the SCTP_MAXSEG socket option.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/net/if.c:LINE (2) 2 syz, C 314 1762d 1766d 2/2 1762d 9f5432d5e5f0 netinet6: ip6_setpktopt() requires NET_EPOCH
panic: ASan: Invalid access, 2-byte read at ADDR, UMAUseAfterFree(fd) 2 syz, C 1103 1763d 1924d 2/2 1763d 014f98b11992 udp: Fix a use-after-free in udp_multi_input()
Fatal trap NUM: page fault in memcpy_erms -1 syz, C 306 1764d 1770d 2/2 1764d aa2681752d0d cryptosoft: Don't treat CRYPTO_NULL_HMAC as an hmac algorithm.
Fatal trap NUM: page fault while in kernel mode (2) -1 1 1777d 1777d 2/2 1766d 12ae3476f35c tcp_drain(): initialize the inpcb iterator when curvnet is set
Fatal trap NUM: page fault in tcp_drain -1 12 1777d 1777d 2/2 1766d 12ae3476f35c tcp_drain(): initialize the inpcb iterator when curvnet is set
panic: Lock tcpinp not exclusively locked @ /syzkaller/managers/i386/kernel/sys/netinet/tcp_log_buf.c:LINE 2 13 1796d 1799d 2/2 1795d 2f62f92e3745 tcp: Fix a locking issue related to logging
panic: Lock tcpinp not exclusively locked @ /syzkaller/managers/main/kernel/sys/netinet/tcp_log_buf.c:LINE 2 6 1795d 1798d 2/2 1795d 2f62f92e3745 tcp: Fix a locking issue related to logging
panic: witness_warn (2) 2 29 1797d 1798d 2/2 1797d df07bfda67ad tcp: Fix a locking issue
panic: chacha20_poly1305_reinit: invalid nonce length 2 2 1807d 1807d 2/2 1800d 442ad83e38e8 crypto: Don't assert on valid IV length for Chacha20-Poly1305.
panic: condition vp->v_type == VDIR || VN_IS_DOOMED(vp) not met at /syzkaller/managers/i386/kernel/sys/kern/vfs_cache.c: 2 1 1819d 1819d 2/2 1813d 628c3b307fb2 cache: only let non-dir descriptors through when doing EMPTYPATH lookups
Fatal trap NUM: page fault in filt_bpfwrite -1 syz, C 4 1822d 1828d 2/2 1814d 426682b05a4c bpf: Fix the write filter for detached descriptors
panic: ASan: Invalid access, NUM-byte read in newreno_cong_signal 2 syz, C 4 1815d 1818d 2/2 1815d b15b0535968e tcp: allow new reno functions to be called from other CC modules
panic: ASan: Invalid access, NUM-byte read in newreno_ack_received 2 2 1816d 1817d 2/2 1815d b15b0535968e tcp: allow new reno functions to be called from other CC modules
panic: Assertion (cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == NUM failed at /syzkaller/managers/main/kernel/sys/kern/v 2 syz, C 87 1824d 1824d 2/2 1824d 1045352f1503 cache: only assert on flags when dealing with EMPTYPATH
panic: TLS trailer length too long: NUM 2 syz, C 2 1832d 1832d 2/2 1827d a63752cce646 ktls: Reject attempts to enable AES-CBC with TLS 1.3.
panic: filesystem goof: vop_panic[vop_readdir] 2 1 1832d 1832d 2/2 1827d 03d5820f738d mount: Check for !VDIR mount points before handling -o emptydir
freebsd build error (9) -1 1 1830d 1830d 2/2 1829d c05b382edb17 Revert "bootstrap: No need to disable shared libraries for bootstrap tools"
panic: invalid payload start 2 6 1854d 1967d 2/2 1834d a0cbcbb7917b cryptodev: Allow some CIOCCRYPT operations with an empty payload.
panic: filt_timerattach: periodic timer has a calculated zero timeout 2 12 1839d 1840d 2/2 1839d 2f4dbe279f6b kqueue: fix recent assertion
panic: strq ADDR not scheduled 2 12189 1839d 1842d 2/2 1839d 3ff3733991ba sctp: don't keep being locked on a stream which is removed
panic: strq ADDR is not scheduled 2 541 1842d 1842d 2/2 1842d 28ea9470782d sctp: provide a specific stream scheduler function for FCFS
Fatal trap NUM: page fault in sctp_ss_rrp_packet_done -1 328 1842d 1846d 2/2 1842d 5b53e749a95e sctp: fix usage of stream scheduler functions
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-send-tcb @ /syzkaller/managers/i386/kernel/sys/netinet/sctp 2 2 1842d 1845d 2/2 1842d 171633765c43 sctp: avoid locking an already locked mutex
Fatal trap NUM: page fault while in kernel mode -1 177 1842d 1846d 2/2 1842d 5b53e749a95e sctp: fix usage of stream scheduler functions
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-send-tcb @ /syzkaller/managers/main/kernel/sys/netinet/sctp 2 10 1842d 1845d 2/2 1842d 171633765c43 sctp: avoid locking an already locked mutex
Fatal trap NUM: page fault in sctp_ss_default_select -1 20939 1842d 1846d 2/2 1842d 5b53e749a95e sctp: fix usage of stream scheduler functions
Fatal trap NUM: page fault in sctp_ss_fb_select -1 12 1842d 1845d 2/2 1842d 5b53e749a95e sctp: fix usage of stream scheduler functions
Fatal trap NUM: page fault in sctp_ss_prio_select -1 761 1842d 1846d 2/2 1842d 5b53e749a95e sctp: fix usage of stream scheduler functions
panic: runtime error: invalid memory address or nil pointer dereference 2 12 1843d 1846d 2/2 1843d b1e2f063ae91 amd64 sendsig: fix context corruption
freebsd boot error: panic: ASan: Invalid access, NUM-byte read at ADDR, UseAfterScope(f8) -1 270 1846d 1849d 2/2 1846d ca1e447b1048 amd64: Avoid copying td_frame from kernel procs
panic: ASan: Invalid access, 2-byte read in sctp_ss_prio_add 2 1 1920d 1920d 2/2 1850d 34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
Fatal trap 9: general protection fault in sctp_ss_prio_add -1 1 1937d 1937d 2/2 1850d 34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
Fatal trap 12: page fault in sctp_ss_default_add (2) -1 1 1927d 1927d 2/2 1850d 34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
panic: ASan: Invalid access, 8-byte read in sctp_ss_default_add 2 326 1853d 1922d 2/2 1850d 34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (4) 2 syz, C 147 1926d 2149d 2/2 1850d 34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
panic: ASan: Invalid access, 8-byte read in sctp_ss_fb_add 2 22 1888d 1921d 2/2 1850d 34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
panic: ASan: Invalid access, 8-byte read in kern_sendit 2 2 1854d 1895d 2/2 1851d fea1a98ead91 freebsd32: Fix a double copyin in sendmsg() and recvmsg()
panic: Bad link elm ADDR prev->next != elm (2) 2 8 1852d 1863d 2/2 1851d e19d93b19dce sctp: fix FCFS stream scheduler
Fatal trap 12: page fault while in kernel mode (3) -1 syz, C 140 1853d 2460d 2/2 1853d ade1daa5c0d6 socket: Synchronize soshutdown() with listen(2) and AIO
Fatal trap 12: page fault in soo_aio_queue -1 syz, C 349 1854d 1958d 2/2 1853d ade1daa5c0d6 socket: Synchronize soshutdown() with listen(2) and AIO
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE 2 syz, C 3 1866d 1930d 2/2 1857d e6c19aa94da4 sctp: Allow blocking on I/O locks even with non-blocking sockets
Fatal trap 12: page fault in __mtx_lock_flags -1 syz, C 1065 1859d 2358d 2/2 1859d 2d5c48eccd9f sctp: Tighten up locking around sctp_aloc_assoc()
panic: Assertion job->uiop != &job->uio && job->uiop != NULL failed at /syzkaller/managers/i386/kernel/sys/kern/vfs_aio. 2 1 1863d 1863d 2/2 1859d 2884918c7338 aio: Fix up the opcode in aiocb32_copyin()
panic: ASan: Invalid access, 4-byte read in sctp_sendall_completes 2 39 1864d 1921d 2/2 1860d 173a7a4ee4fa sctp: Fix iterator synchronization in sctp_sendall()
panic: Assertion owner->td_proc->p_magic == P_MAGIC failed at /syzkaller/managers/i386/kernel/sys/kern/subr_turnstile.c: (2) 2 9 1911d 2004d 2/2 1860d 141fe2dceeae aio: Interlock with listen(2)
panic: ASan: Invalid access, 1-byte read in udp6_common_ctlinput 2 1 1902d 1902d 2/2 1860d b1e6a792d68e net: Enter a net epoch around protocol if_up/down notifications
panic: unexpected security protocol NUM 2 syz 7 1862d 1876d 2/2 1860d 10eb2a2bde61 ipsec: Validate the protocol identifier in ipsec4_ctlinput()
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:LINE (2) 2 68 1866d 1956d 2/2 1860d 141fe2dceeae aio: Interlock with listen(2)
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2) 2 syz, C 109 1863d 1958d 2/2 1860d 141fe2dceeae aio: Interlock with listen(2)
panic: Assertion owner->td_proc->p_magic == P_MAGIC failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c: 2 syz, C 46 1924d 2179d 2/2 1860d 141fe2dceeae aio: Interlock with listen(2)
panic: Lock sctp-info not exclusively locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:LINE 2 syz, C 363 1861d 1862d 2/2 1861d 0c1a20beb456 sctp: use appropriate argument when freeing association
panic: ASan: Invalid access, 8-byte read in osd_get 2 13 1862d 1921d 2/2 1861d 187afc58791c osd: Fix racy assertions
Fatal trap 9: general protection fault in strlen -1 syz, C 1506 1926d 2684d 2/2 1861d 4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: mtx_lock() of destroyed mutex at sys/kern/uipc_sockbuf.c:LINE 2 syz 4 2012d 2202d 2/2 1861d 4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: mutex so_snd not owned at /syzkaller/managers/i386/kernel/sys/kern/uipc_sockbuf.c:LINE 2 syz 1 2155d 2155d 2/2 1861d 4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb. 2 syz, C 131 1862d 1863d 2/2 1862d 6e3af6321ba4 sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_pcb. 2 111 1862d 1863d 2/2 1862d 6e3af6321ba4 sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/netinet/tcp_output.c:LINE 2 syz 707 1885d 2771d 2/2 1863d bd4a39cc93d9 socket: Properly interlock when transitioning to a listening socket
panic: ASan: Invalid access, NUM-byte read in strncmp 2 syz, C 12 1863d 1868d 2/2 1863d 5402baa5b5d1 g_label: Handle small sector sizes when tasting
Fatal trap 12: page fault in knlist_remove_kq -1 3 1935d 1943d 2/2 1869d c511383de7a0 kevent: Fix races between timer detach and kqtimer_proc_continue()
Fatal trap 12: page fault in filt_timerdetach -1 1 1939d 1939d 2/2 1869d c511383de7a0 kevent: Fix races between timer detach and kqtimer_proc_continue()
panic: ASan: Invalid access, 8-byte read in sctp_free_assoc 2 112 1870d 1922d 2/2 1870d d35be50f5779 sctp: Hold association locks across socket wakeups when freeing
Fatal trap 9: general protection fault in sctp_free_assoc -1 syz 14 1931d 2239d 2/2 1870d d35be50f5779 sctp: Hold association locks across socket wakeups when freeing
Fatal trap 9: general protection fault in itimer_proc_continue -1 syz 2 1964d 1964d 2/2 1870d 3138392a46a4 itimer: Serialize access to the p_itimers array
panic: ASan: Invalid access, 1-byte read at ADDR, RedZonePartial(2) 2 17 1924d 1925d 2/2 1870d 9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: ASan: Invalid access, 8-byte read in itimer_proc_continue 2 1 1908d 1908d 2/2 1870d 3138392a46a4 itimer: Serialize access to the p_itimers array
panic: ASan: Invalid access, 1-byte read at ADDR, RedZonePartial(1) 2 13 1881d 1924d 2/2 1870d 9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: ASan: Invalid access, 1-byte read in g_raid_md_taste_ddf 2 syz, C 18 1875d 1922d 2/2 1870d 9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: ASan: Invalid access, 2-byte read in g_raid_md_taste_sii 2 syz, C 7 1883d 1908d 2/2 1870d 9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: Bad list head ADDR first->prev != head 2 syz, C 3409 1871d 2768d 2/2 1871d 4a36122b1db1 sctp: Fix racy UNBOUND flag check in sctp_inpcb_bind()
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(7) 2 28 1923d 1926d 2/2 1871d 564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(6) 2 20 1923d 1926d 2/2 1871d 564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: ASan: Invalid access, 8-byte read at ADDR, StackMiddle(f2) 2 18 1924d 1925d 2/2 1871d 36226163fa48 x86: Mark the trapframe as initialized in ipi_bitmap_handler()
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(3) 2 9 1924d 1924d 2/2 1871d 564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: ASan: Invalid access, 16-byte read in aesni_encrypt_icm 2 syz, C 114 1872d 1923d 2/2 1871d 564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: Assertion lock == sq->sq_lock failed at /syzkaller/managers/i386/kernel/sys/kern/subr_sleepqueue.c:LINE 2 1 1950d 1950d 2/2 1885d c4feb1ab0ae0 sigtimedwait: Use a unique wait channel for sleeping
panic: Assertion lock == sq->sq_lock failed at /syzkaller/managers/main/kernel/sys/kern/subr_sleepqueue.c:LINE (2) 2 syz, C 7 1928d 1951d 2/2 1885d c4feb1ab0ae0 sigtimedwait: Use a unique wait channel for sleeping
panic: ASan: Invalid access, 4-byte read in sctp6_connect 2 64 1899d 1923d 2/2 1894d 784692c74019 sctp: improve handling of IPv4 addresses on IPV6 sockets Reported by: syzbot+08fe66e4bfc2777cba95@syzkaller.appspotmail.com MFC after: 3 days
panic: ASan: Invalid access, 4-byte read in sctp_sosend 2 syz, C 518 1894d 1923d 2/2 1894d b732091a761a sctp: improve input validation of mapped addresses in send() Reported by: syzbot+35528f275f2eea6317cc@syzkaller.appspotmail.com Reported by: syzbot+ac29916d5f16d241553d@syzkaller.appspotmail.com MFC after: 3 days
freebsd boot error: panic: sleeping without a lock -1 6 1897d 1897d 2/2 1896d 2694c869ff9f ktls: fix a panic with INVARIANTS
panic: ASan: Invalid access, 4-byte read in tcp_usr_bind 2 syz, C 50 1897d 1921d 2/2 1896d 3f1f6b6ef7f6 tcp, udp: improve input validation in handling bind()
panic: ASan: Invalid access, 4-byte read in udp_bind 2 syz, C 69 1897d 1922d 2/2 1896d 3f1f6b6ef7f6 tcp, udp: improve input validation in handling bind()
panic: pmap_growkernel: no memory to grow kernel (2) 2 syz 299 1899d 2359d 2/2 1897d 600745f1e226 pf: bound DIOCGETSTATES memory use
panic: pmap_kasan_enter_alloc_4k: no memory to grow shadow map 2 syz, C 20 1900d 1919d 2/2 1897d 600745f1e226 pf: bound DIOCGETSTATES memory use
panic: vm_fault_lookup: fault on nofault entry, addr: ADDR (2) 2 syz, C 75 1935d 1979d 2/2 1905d 64432ad2a2c4 pf: Validate user string nul-termination before copying
freebsd boot error: panic: ASan: Invalid access, 1-byte read at ADDR, MallocRedZone(fb) -1 156 1919d 1926d 2/2 1919d 4a9a41650c90 uart: Fix an out-of-bounds read in ns8250_bus_probe()
panic: Assertion (cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0 failed at /syzkaller/managers/main/kernel/sys/kern/vfs 2 syz, C 4 1982d 1982d 2/2 1922d 6de3cf14c47d vn_open_cred(): disallow O_CREAT | O_EMPTY_PATH
panic: ASan: Invalid access, 32-byte read at ADDR, StackMiddle(f2) 2 1 1924d 1923d 2/2 1923d 36226163fa48 x86: Mark the trapframe as initialized in ipi_bitmap_handler()
panic: ASan: Invalid access, 8-byte read in handleevents 2 34 1923d 1923d 2/2 1923d 36226163fa48 x86: Mark the trapframe as initialized in ipi_bitmap_handler()
panic: thread_lock() of sleep mutex `*Fv @ /syzkaller/managers/main/kernel/sys/kern/kern_switch.c:LINE 2 1 1965d 1965d 2/2 1962d 4a59cbc12532 amd64: Avoid enabling interrupts when handling kernel mode prot faults
panic: thread_lock() of sleep mutex ` @ /syzkaller/managers/main/kernel/sys/kern/kern_switch.c:LINE 2 syz, C 1 1965d 1965d 2/2 1962d 4a59cbc12532 amd64: Avoid enabling interrupts when handling kernel mode prot faults
panic: Assertion p2->p_ktrioparms == NULL failed at /syzkaller/managers/i386/kernel/sys/kern/kern_ktrace.c:LINE 2 1 1969d 1969d 2/2 1966d f3851b235b23 ktrace: Fix a race with fork()
panic: Assertion p2->p_ktrioparms == NULL failed at /syzkaller/managers/main/kernel/sys/kern/kern_ktrace.c:LINE 2 1 1970d 1970d 2/2 1966d f3851b235b23 ktrace: Fix a race with fork()
Fatal trap 12: page fault in rack_process_to_cumack (2) -1 syz 3 1970d 1970d 2/2 1968d 13c0e198ca27 tcp: Fix bugs related to the PUSH bit and rack and an ack war
panic: refcount ADDR wraparound (3) 2 syz, C 9 1971d 1971d 2/2 1970d 6f6cd1e8e8aa ktrace: Remove vrele() at the end of ktr_writerequest()
panic: Non-zero write count 2 98 1970d 1971d 2/2 1970d 6f6cd1e8e8aa ktrace: Remove vrele() at the end of ktr_writerequest()
Fatal trap 9: general protection fault in rack_ctloutput -1 syz 2 1973d 1974d 2/2 1972d 8923ce630492 tcp: Handle stack switch while processing socket options
panic: ktrace_enter: flag set 2 syz, C 44 1972d 1973d 2/2 1972d e4b16f2fb18b ktrace: Avoid recursion in namei()
panic: _mtx_lock_sleep: recursed on non-recursive mutex so_snd @ /syzkaller/managers/i386/kernel/sys/modules/tcp/rack/.. 2 4 1972d 1973d 2/2 1972d 39756885633f rack: honor prior socket buffer lock when doing the upcall
panic: _mtx_lock_sleep: recursed on non-recursive mutex so_snd @ /syzkaller/managers/main/kernel/sys/modules/tcp/rack/.. 2 2 1972d 1973d 2/2 1972d 39756885633f rack: honor prior socket buffer lock when doing the upcall
panic: Memory modified after free ADDR(4096) val=ADDR @ ADDR 2 syz, C 1 1977d 1977d 2/2 1973d 500eb6dd8040 tcp: Fix sending of TCP segments with IP level options
freebsd boot error: panic: scsi_action: ccb ADDR, func_code 0x6 should not be allocated from UMA zone -1 42 1977d 1978d 2/2 1977d 5b81e2e1bcdc virtio_scsi: Zero stack-allocated CCBs
Fatal trap 12: page fault in callout_process (2) -1 7 1983d 2011d 2/2 1980d 2cca77ee0134 kqueue timer: Remove detached knotes from the process stop queue
Fatal trap 9: general protection fault in kqtimer_proc_continue -1 109 1980d 2014d 2/2 1980d 2cca77ee0134 kqueue timer: Remove detached knotes from the process stop queue
panic: releasing active pmap ADDR 2 syz, C 11 1982d 2025d 2/2 1980d 9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
panic: pmap active ADDR 2 syz, C 5 1988d 2025d 2/2 1980d 9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
Fatal trap 18: integer divide fault in realtimer_expire_l -1 syz, C 15 1982d 2009d 2/2 1980d 8b3c4231abf0 posix timers: Check for overflow when converting to ns
Fatal trap 18: integer divide fault in realtimer_expire -1 syz, C 20 2012d 2033d 2/2 1980d 8b3c4231abf0 posix timers: Check for overflow when converting to ns
Fatal trap 9: general protection fault in crypto_ioctl -1 1 1987d 1987d 2/2 1981d 1a04f0156c4e cryptodev: Fix some input validation bugs
panic: crp_iv_start set when IV isn't used 2 syz, C 2 1985d 1986d 2/2 1982d 1a04f0156c4e cryptodev: Fix some input validation bugs
panic: vm_fault_lookup: fault on nofault entry, addr: ADDR 2 5 1985d 2023d 2/2 1982d c8bbb1272c8b vfs: Fix error handling in vn_fullpath_hardlink()
panic: IV outside buffer length 2 syz, C 16 1982d 1987d 2/2 1982d 1a04f0156c4e cryptodev: Fix some input validation bugs
Fatal trap 9: general protection fault in mb_free_ext -1 1 1984d 1984d 2/2 1982d 1a04f0156c4e cryptodev: Fix some input validation bugs
panic: More encryption data than allowed 2 syz, C 2 1983d 1983d 2/2 1982d 1a04f0156c4e cryptodev: Fix some input validation bugs
panic: AEAD without a separate IV 2 syz, C 25 1982d 1988d 2/2 1982d 1a04f0156c4e cryptodev: Fix some input validation bugs
Fatal trap 12: page fault in memcpy_erms -1 syz, C 2 1983d 1983d 2/2 1982d 1a04f0156c4e cryptodev: Fix some input validation bugs
panic: IV_SEPARATE set when IV isn't used 2 syz, C 4 1983d 1986d 2/2 1982d 1a04f0156c4e cryptodev: Fix some input validation bugs
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/main/kernel/sys/kern/kern_sig 2 syz 2 2011d 2011d 2/2 1982d 5cc1d199412e realtimer_expire: avoid proc lock recursion when called from itimer_proc_continue()
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/i386/kernel/sys/kern/kern_eve 2 2 2010d 2011d 2/2 1982d 75c5cf7a720f filt_timerexpire: avoid process lock recursion
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/main/kernel/sys/kern/kern_eve 2 1 2012d 2012d 2/2 1982d 75c5cf7a720f filt_timerexpire: avoid process lock recursion
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/i386/kernel/sys/kern/kern_sig 2 1 2014d 2014d 2/2 1982d 5cc1d199412e realtimer_expire: avoid proc lock recursion when called from itimer_proc_continue()
Fatal trap 12: page fault in pmap_kextract (2) -1 syz, C 8 2012d 2013d 2/2 2012d 5e98cae661f3 pf: Ensure that we don't use kif passed to pfi_kkif_attach()
panic: to_ticks == 0 for timer type 5 (2) 2 syz 2 2034d 2034d 2/2 2032d d995cc7e5431 sctp: fix handling of RTO.initial of 1 ms
panic: to_ticks == 0 for timer type 5 2 syz, C 2 2060d 2060d 2/2 2055d 70e95f0b6917 sctp: avoid integer overflow when starting the HB timer
Fatal trap 12: page fault in sctp_find_alternate_net -1 syz 131 2062d 2205d 2/2 2061d b963ce4588b3 sctp: improve computation of an alternate net
panic: pfi_dynaddr_setup: non-NULL dyn (2) 2 syz, C 4 2092d 2092d 2/2 2086d 7a808c5ee329 pf: Improve pf_rule input validation
Fatal trap 12: page fault in copyin_nosmap_erms -1 syz, C 8 2130d 2176d 2/2 2100d ea36212bf571 pf: Don't hold PF_RULES_WLOCK during copyin() on DIOCRCLRTSTATS
freebsd boot error: panic: IPI scoreboard is zero, initiator 1 target 1 -1 9 2102d 2102d 2/2 2102d 44121a0fbee0 amd64: fix tlb shootdown when all cpus are passed in the bitmap
freebsd boot error: panic: IPI scoreboard is zero, initiator 0 target 0 -1 3 2102d 2102d 2/2 2102d 44121a0fbee0 amd64: fix tlb shootdown when all cpus are passed in the bitmap
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/uipc_ktls.c:LINE 2 syz, C 11 2107d 2333d 2/2 2104d 6685e259e319 tcp: don't use KTLS socket option on listening sockets
panic: Memory modified after free ADDR(112) val=ADDR @ ADDR (2) 2 syz 475 2109d 2352d 2/2 2109d a7aa5eea4fff sctp: improve handling of aborted associations
panic: sched_pickcpu: Failed to find a cpu. 2 syz, C 4 2137d 2137d 2/2 2136d f1b18a668deb cpuset_set{affinity,domain}: do not allow empty masks
Fatal trap 9: general protection fault in cpuset_setproc -1 syz 2 2138d 2138d 2/2 2136d b2780e8537da kern: cpuset: resolve race between cpuset_lookup/cpuset_rel
panic: sleeping without a lock 2 syz, C 29 2142d 2308d 2/2 2141d 34af05ead3cf kern: soclose: don't sleep on SO_LINGER w/ timeout=0
panic: uma_zalloc_debug: called within spinlock or critical section 2 syz, C 9 2148d 2152d 2/2 2147d e07e3fa3c95c kern: cpuset: drop the lock to allocate domainsets
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (3) 2 syz, C 12 2150d 2152d 2/2 2149d 5d49283f8857 pf: Make tag hashing more robust
panic: fc_ioctls != NULL, but fc_nioctls=-NUM 2 5591 2152d 2153d 2/2 2152d 3d4ae1b3d110 kern: dup: do not assume oldfde is valid
Fatal trap 12: page fault in __mtx_lock_spin_flags -1 3 2156d 2161d 2/2 2155d a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
panic: spin lock held too long 2 syz, C 1 2160d 2160d 2/2 2155d a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
Fatal trap 12: page fault in _callout_stop_safe -1 syz, C 1 2160d 2160d 2/2 2155d a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
panic: Most recently used by pf_ifnet 2 syz, C 6 2193d 2194d 2/2 2192d 52b83a06184c pf: do not remove kifs that are referenced by rules
Fatal trap 9: general protection fault in sctp_lower_sosend -1 syz, C 22 2292d 2345d 2/2 2251d f5d30f7f7606 Improve the handling of concurrent send() calls for SCTP sockets, especially when having the explicit EOR mode enabled.
panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb 2 syz, C 2 2299d 2299d 2/2 2262d cfae6a92ac01 Remove an incorrect assertion from in6p_lookup_mcast_ifp().
Fatal trap 12: page fault in uipc_ready -1 syz, C 5 2293d 2321d 2/2 2268d 1b778ba2609f Fix a logic error in uipc_ready_scan().
panic: witness_warn 2 syz 1 2312d 2312d 2/2 2296d e54b7cd007b5 Fix the cleanup handling in a error path for TCP BBR.
Fatal trap 12: page fault in sctp_find_ifa_in_ep -1 syz, C 3 2299d 2299d 2/2 2297d 7a3f60e7f571 Fix a bug introduced in https://svnweb.freebsd.org/changeset/base/362173
freebsd test error: Fatal trap 12: page fault in in_pcb_lport_dest -1 9 2340d 2340d 2/2 2317d 1ec42007fec3 Fix NULL-pointer bug from r361228.
Fatal trap 12: page fault in sctp_process_control -1 syz, C 47 2347d 2348d 2/2 2347d 86fd36c502db Fix a copy and paste error introduced in r360878.
Fatal trap 9: general protection fault in sctp_process_control -1 syz, C 11 2347d 2348d 2/2 2347d 86fd36c502db Fix a copy and paste error introduced in r360878.
panic: sctp_timer_start of type 1: inp = ADDR, stcb = ADDR, net = 0 2 1 2352d 2352d 2/2 2348d efd5e6929194 Ensure that we have a path when starting the T3 RXT timer.
panic: sctp_timer_start of type 10: inp = ADDR, stcb->sctp_ep ADDR 2 1 2358d 2358d 2/2 2348d 83ed508055c0 Ensure that the SCTP iterator runs with an stcb and inp, which belong to each other.
panic: pfi_dynaddr_setup: dyn is ADDR (2) 2 syz, C 22 2358d 2369d 2/2 2355d 1ef06ed8def9 pf: Improve DIOCADDRULE validation
panic: mallocarray: ADDR * 1064 overflowed 2 syz, C 3 2366d 2370d 2/2 2362d a7c8533634ab pf: Improve input validation
Fatal trap 9: general protection fault in in6_selecthlim -1 25 2362d 2363d 2/2 2362d 17cb6ddba8ab Fix order of arguments in fib[46]_lookup calls in SCTP.
panic: pfi_dynaddr_setup: dyn is ADDR 2 syz, C 7 2370d 2375d 2/2 2369d 98582ce38183 pf: Improve ioctl() input validation
panic: Assertion size0 > 0 failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE 2 syz, C 2 2373d 2373d 2/2 2371d 95324dc3f4d2 pf: Do not allow negative ps_len in DIOCGETSTATES
panic: mtx_unlock() of destroyed mutex at sys/kern/sys_socket.c:LINE 2 syz 1 2462d 2462d 2/2 2374d 99258935eb2b Lock the socket in soo_stat().
panic: sbfree: m ADDR !M_NOTREADY 2 syz, C 32 2745d 2770d 2/2 2377d dde1b5985fcc Properly handle disconnected sockets in uipc_ready().
panic: allocdirect_merge: old blkno 9384 != new 9384 || old size 4096 != new NUM 2 2 2382d 2383d 2/2 2378d Revert -r359612 as it can cause other panics. An updated version will be made when the issue has been resolved.
panic: Duplicate free of ADDR from zone ADDR(mbuf) slab ADDR(8) 2 syz, C 1 2768d 2768d 2/2 2378d 3d36b367cfb6 sbappendcontrol() needs to avoid clearing M_NOTREADY on data mbufs.
panic: to_ticks == 0 for timer type 2 2 syz, C 27 2392d 2395d 2/2 2391d 25ec35535397 Handle integer overflows correctly when converting msecs and secs to ticks and vice versa. These issues were caught by recently added panic() calls on INVARIANTS systems.
panic: mtx_unlock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:LINE 2 1 2413d 2413d 2/2 2399d 99258935eb2b Lock the socket in soo_stat().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet/ip_output.c:LINE 2 syz 1870 2400d 2458d 2/2 2400d 2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/ip6_output.c:LINE 2 syz 229 2401d 2458d 2/2 2400d 2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet6/ip6_output.c:LINE 2 syz, C 591 2400d 2458d 2/2 2400d 2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet/ip_output.c:LINE 2 syz, C 2840 2400d 2458d 2/2 2400d 2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
freebsd boot error: Fatal trap 9: general protection fault in biotrack_buf -1 24 2439d 2439d 2/2 2400d dcebfcf3d468 Revert r357710 and 357711 until they can be debugged
panic: Most recently used by ip6opt (2) 2 syz 4 2404d 2449d 2/2 2400d e02582d1ae44 Fix synchronization in the IPV6_2292PKTOPTIONS set handler.
panic: mutex process lock not owned at /syzkaller/managers/i386/kernel/sys/kern/kern_time.c:LINE 2 syz, C 33 2444d 2445d 2/2 2400d 55aa9af7e971 Remove unneeded assert for curproc. Simplify.
panic: cap_rights_is_vset:LINE (3) 2 1 2412d 2412d 2/2 2400d 429537caeb13 kern_dup(): Call filecaps_free_prep() in a write section.
panic: refcount ADDR wraparound 2 syz, C 6 2445d 2445d 2/2 2400d adbdb897689b fd: always nullify *fdp in fget* routines
panic: mutex process lock not owned at /syzkaller/managers/main/kernel/sys/kern/kern_time.c:LINE 2 syz, C 83 2444d 2445d 2/2 2443d 55aa9af7e971 Remove unneeded assert for curproc. Simplify.
panic: condition !vn_need_pageq_flush(vp) not met at /syzkaller/managers/main/kernel/sys/kern/vfs_subr.c:LINE (vgonel) 2 1 2449d 2449d 2/2 2448d 0f4d8b77c02c vfs: revert the overzealous assert added in r357285 to vgone
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/net/if.c:LINE 2 3062 2563d 2564d 2/2 2459d Remove epoch assertion from if_setlladdr(). Originally this function was protected by IF_ADDR_LOCK(), which was a mutex, so that two simultaneous if_setlladdr() can't execute. Later it was switched to IF_ADDR_RLOCK(), likely by a mistake. Later it was switched to NET_EPOCH_ENTER(). Then I incorrectly added NET_EPOCH_ASSERT() here.
panic: mutex if_addr_lock not owned at /syzkaller/managers/main/kernel/sys/netinet/in_mcast.c:LINE 2 1 2479d 2479d 2/2 2466d 31069f383af1 Take the ifnet's address lock in igmp_v3_cancel_link_timers().
panic: pipe_destroy_write_buffer: pipe map for ADDR contains residual data 2 syz 11 2538d 2581d 2/2 2529d 1cbfe73da570 Fix handling of PIPE_EOF in the direct write path.
panic: mutex pcbinfohash not owned at /syzkaller/managers/main/kernel/sys/netinet6/in6_pcb.c:LINE 2 syz, C 5 2531d 2532d 2/2 2530d c17cd08f5302 It is unclear why in6_pcblookup_local() would require write access to the PCB hash. The function doesn't modify the hash. It always asserted write lock historically, but with epoch conversion this fails in some special cases.
panic: in_pcb_lport: laddrp NULL for v4 inp ADDR 2 syz, C 8 2575d 2691d 2/2 2547d 4a91aa8fc9b6 Ensure that the flags indicating IPv4/IPv6 are not changed by failing bind() calls. This would lead to inconsistent state resulting in a panic. A fix for stable/11 was committed in https://svnweb.freebsd.org/base?view=revision&revision=338986 An accelerated MFC is planned as discussed with emaste@.
panic: Assertion td->td_epochnest failed at /syzkaller/managers/i386/kernel/sys/kern/subr_epoch.c:LINE 2 3 2563d 2563d 2/2 2556d ip6_output() has a complex set of gotos, and some can jump out of the epoch section towards return statement. Since entering epoch is cheap, it is easier to cover the whole function with epoch, rather than try to properly maintain its state.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet/igmp.c:LINE 2 2 2563d 2563d 2/2 2556d 7299f8c33d62 Enter network epoch in domain callouts.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/in6_ifattach.c:LINE 2 syz 2 2561d 2562d 2/2 2556d in6ifa_llaonifp() is never called from fast path, so do not require epoch being entered.
Fatal trap 12: page fault in uipc_send -1 syz 123 2564d 2696d 2/2 2563d 4013d7268446 Fix handling of empty SCM_RIGHTS messages.
freebsd boot error: panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/net/if.c:LINE -1 18 2564d 2564d 2/2 2563d In DIAGNOSTIC block of if_delmulti_ifma_flags() enter the network epoch. This quickly plugs the regression from r353292. The locking of multicast definitely needs a broader review today...
Fatal trap 18: integer divide fault in kern_fcntl -1 22 2587d 2614d 2/2 2569d 4a7b33ecf4d8 Disallow fcntl(F_READAHEAD) when the vnode is not a regular file.
panic: rcv_start < rcv_end 2 1 2594d 2594d 2/2 2570d Only update SACK/DSACK lists when a non-empty segment was received. This fixes hitting a KASSERT with a valid packet exchange.
Fatal trap 12: page fault in inp_freemoptions (2) -1 syz 14 2681d 2690d 2/2 2571d Convert all IPv4 and IPv6 multicast memberships into using a STAILQ instead of a linear array.
panic: vm_page_swapqueue: page ADDR is unmanaged 2 1 2581d 2581d 2/2 2574d 3a79b409bb89 Fix a race in vm_page_swapqueue().
freebsd boot error: panic: sched_pickcpu: Failed to find a cpu. -1 30 2577d 2577d 2/2 2576d 967c0718849e Fix wrong assertion in r352658.
panic: m_getm2: len is < 0 2 syz 13 2764d 2769d 2/2 2578d 2ef5bd2f0c46 Limit the number of bytes which can be queued for SCTP sockets. This is joint work with rrs@. Reported by: syzbot+307f167f9bc214f095bc@syzkaller.appspotmail.com MFC after: 1 week
panic: indir_trunc: Bad indirdep 0 from buf ADDR 2 1 2688d 2688d 2/2 2634d 577fca0e204d Lock the vnode before calling ufs_bmap_seekdata().
panic: ffs_blkfree_cg: freeing free block (2) 2 2 2704d 2725d 2/2 2634d 577fca0e204d Lock the vnode before calling ufs_bmap_seekdata().
Fatal trap 9: general protection fault in sctp_copy_skeylist -1 syz 3 2687d 2687d 2/2 2649d 8a956abe12c6 When calling sctp_initialize_auth_params(), the inp must have at least a read lock. To avoid more complex locking dances, just call it in sctp_aloc_assoc() when the write lock is still held.
panic: udp6_output: non-excl udbinfo lock, excl inp lock: pcbinfo ADDR 0x1 inp ADDR 0x2 2 1 2670d 2670d 2/2 2650d 9e44bc22d884 r348494 fixes a race in udp_output(). The same race exists in udp_output6(), therefore apply a similar patch to IPv6.
panic: Most recently used by tty 2 syz 24 2702d 2717d 2/2 2659d 6a01874c5afa Defer funsetown() calls for a TTY to tty_rel_free().
freebsd boot error: panic: Bad entry start/end for new stack entry -1 9 2668d 2668d 2/2 2661d 639f3e01b444 Revert r349393, which leads to an assertion failure on bootup, in vm_map_stack_locked.
panic: cap_rights_is_vset:LINE 2 syz 3 2683d 2684d 2/2 2664d 7c3703a69466 Use a consistent snapshot of the fd's rights in fget_mmap().
Fatal trap 12: page fault in vm_page_unhold_pages -1 syz, C 1169 2672d 2766d 2/2 2664d 02476c44c5eb Fix mutual exclusion in pipe_direct_write().
panic: udp_output: shared udbinfo lock, excl inp lock (2) 2 syz 7 2706d 2724d 2/2 2692d eafaa1bc35e9 After parts of the locking fixes in r346595, syzkaller found another one in udp_output(). This one is a race condition. We do check on the laddr and lport without holding a lock in order to determine whether we want a read or a write lock (this is in the "sendto/sendmsg" cases where addr (sin) is given).
Fatal trap 12: page fault in inp_freemoptions -1 syz, C 11 2712d 2766d 1/2 2710d 5a1e222bfda7 Close some races in multicast socket option handling.
panic: inp_leave_group: imf_sources not empty 2 syz, C 6 2712d 2733d 1/2 2710d 5a1e222bfda7 Close some races in multicast socket option handling.
panic: vm_object_vndeallocate: bad object reference count 2 syz, C 974 2711d 2712d 1/2 2711d 8cd6a80d7d68 Restore the pre-r347532 behaviour of ignoring wiring failures in mmap().
panic: ffs_blkfree_cg: freeing free block 2 syz, C 5 2768d 2768d 1/2 2725d a7a455c299b0 Optimize lseek(SEEK_DATA) on UFS.
panic: udp_output: shared udbinfo lock, excl inp lock 2 syz, C 46 2733d 2771d 1/2 2732d d86ecbe993a7 iFix udp_output() lock inconsistency.
Fatal trap 12: page fault in in6_cksum_partial -1 syz 6 2736d 2765d 1/2 2735d 70a0f3dcdc1f When a checksum has to be computed for a received IPv6 packet because it is requested by the application using the IPPROTO_IPV6 level socket option IPV6_CHECKSUM on a raw socket, ensure that the packet contains enough bytes to contain the checksum at the specified offset.
panic: rtrequest1_fib: locked 2 syz, C 10 2742d 2768d 1/2 2740d e6481fd4c46a When sending a routing message, don't allow the user to set the RTF_RNH_LOCKED flag in rtm_flags, since this flag is used only internally.
panic: inp_join_group: imf_sources not empty 2 syz, C 398 2744d 2771d 1/2 2744d f1ef572a1ecd Reinitialize multicast source filter structures after invalidation.
Fatal trap 12: page fault in __mtx_assert -1 syz 4 2761d 2763d 1/2 2760d 7854c63d6fbe Fix a small bug in the tcp_log_id where the bucket was unlocked and yet the bucket-unlock flag was not changed to false. This can cause a panic if INVARIANTS is on and we go through the right path (though rare).
panic: Can't clear local locks with F_UNLCKSYS 2 syz, C 9 2761d 2770d 1/2 2760d fd76e780a7c0 Reject F_SETLK_REMOTE commands when sysid == 0.
panic: Counter goes negative 2 syz, C 2 2767d 2767d 1/2 2761d 0d3cf13dabf8 Fix a signed/unsigned bug when receiving SCTP messages. This is joint work with rrs@.
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 24 - 0 != 60 2 syz, C 2 2769d 2769d 1/2 2763d 05fb056c068d Fix a KASSERT() in tcp_output().
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 28 - 0 != 60 2 1 2766d 2766d 1/2 2763d 05fb056c068d Fix a KASSERT() in tcp_output().
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 12 - 0 != 60 2 1 2770d 2770d 1/2 2763d 05fb056c068d Fix a KASSERT() in tcp_output().
panic: pmap_demote_pde: page table page for a wired mapping is missing 2 syz, C 56 2765d 2769d 1/2 2764d 64087fd7f372 Disallow preemptive creation of wired superpage mappings.
panic: invalid dst page ADDR 2 syz, C 33 2766d 2770d 1/2 2765d 45d72c7d7fca vm_fault_copy_entry: accept invalid source pages.