Fatal trap NUM: page fault in rtsock_msg_buffer
|
C |
|
|
9 |
35d |
38d
|
2/2 |
34d |
dae64402b3e8
rtsock: fix panic in rtsock_msg_buffer()
|
Fatal trap NUM: general protection fault in rtsock_msg_buffer
|
syz |
|
|
1 |
35d |
35d
|
2/2 |
34d |
dae64402b3e8
rtsock: fix panic in rtsock_msg_buffer()
|
freebsd test error: panic: ASan: Invalid access, NUM-byte write at ADDR, GenericRedZone(fa)
|
|
|
|
2 |
101d |
101d
|
2/2 |
101d |
47112d359b36
kassert: Remove KASAN marking from DEBUG_POISON_POINTER
|
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM (2)
|
C |
|
|
70 |
223d |
269d
|
2/2 |
147d |
71867653008c
udp: improve handling of cached route
|
freebsd test error: Fatal trap NUM: page fault while in kernel mode
|
|
|
|
11 |
192d |
192d
|
2/2 |
192d |
517c5854588e
vm_phys: Make sure that vm_phys_enq_chunk() stays in bounds
|
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (4)
|
|
|
|
1 |
250d |
250d
|
2/2 |
242d |
d66399326cb4
kthread: Set *tdptr earlier in kproc_kthread_add()
|
Fatal trap NUM: page fault in strlcpy
|
C |
|
|
3 |
258d |
259d
|
2/2 |
257d |
b112232e4fb9
uipc_shm: Copyin userpath for ktrace(2)
|
panic: Unaligned free of ADDR from zone ADDR(mbuf) slab ADDR(NUM)
|
C |
|
|
28 |
258d |
259d
|
2/2 |
258d |
fb8a8333b481
unix: return immediately on MSG_OOB
|
Fatal trap NUM: page fault in uipc_soreceive_stream_or_seqpacket
|
C |
|
|
3 |
259d |
259d
|
2/2 |
258d |
d1cbb17a873c
unix: fix the ad hoc STAILQ_PREPEND()
|
panic: Assertion size > NUM failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE
|
C |
|
|
69 |
280d |
284d
|
2/2 |
280d |
b5a9299bb8b9
ktls: catch invalid parameters earlier
|
panic: Assertion size > NUM failed at /syzkaller/managers/i386/kernel/sys/kern/subr_vmem.c:LINE
|
|
|
|
1 |
280d |
280d
|
2/2 |
280d |
b5a9299bb8b9
ktls: catch invalid parameters earlier
|
panic: Assertion !callout_active(&tp->t_callout) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_subr.c:LINE
|
|
|
|
3 |
316d |
317d
|
2/2 |
315d |
57e27ff07aff
tcp: partially undo D43792
|
panic: Assertion !callout_active(&tp->t_callout) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_subr.c:LINE
|
|
|
|
13 |
315d |
317d
|
2/2 |
315d |
57e27ff07aff
tcp: partially undo D43792
|
panic: lock (sleep mutex) sctp-inp not locked @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_usrreq.c:LINE
|
|
|
|
565 |
341d |
341d
|
2/2 |
341d |
a079c891c01b
sctp: restore missing inpcb lock
|
panic: lock (sleep mutex) sctp-inp not locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_usrreq.c:LINE
|
C |
|
|
455 |
341d |
341d
|
2/2 |
341d |
a079c891c01b
sctp: restore missing inpcb lock
|
panic: sbflush_internal: ccc NUM mb ADDR mbcnt NUM
|
C |
|
|
3 |
353d |
353d
|
2/2 |
349d |
59ce044a7856
sockets: on shutdown(2) do sorflush() only in case of generic sockbuf
|
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM
|
C |
|
|
4 |
385d |
395d
|
2/2 |
356d |
7df9da47e8f0
Fix udp IPv4-mapped address
|
panic: Assertion !tcp_in_hpts(tp) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_subr.c:LINE
|
|
|
|
9 |
382d |
384d
|
2/2 |
369d |
ade05d63b727
tcp: stop stack timers in tcp_switch_back_to_default()
|
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (3)
|
|
|
|
1 |
380d |
380d
|
2/2 |
379d |
ae77041e0714
kthread: Set *newtdp earlier in kthread_add1()
|
panic: Assertion !(tp->t_flags2 & TF2_HPTS_CPU_SET) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_hpts.c:LIN
|
C |
|
|
375 |
382d |
384d
|
2/2 |
382d |
3f46be6acadd
tcp_hpts: let tcp_hpts_init() set a random CPU only once
|
panic: Assertion !tcp_in_hpts(tp) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_subr.c:LINE
|
C |
|
|
35 |
382d |
384d
|
2/2 |
382d |
ade05d63b727
tcp: stop stack timers in tcp_switch_back_to_default()
|
panic: Assertion !(tp->t_flags2 & TF2_HPTS_CPU_SET) failed at /syzkaller/managers/i386/kernel/sys/netinet/tcp_hpts.c:LIN
|
|
|
|
211 |
382d |
384d
|
2/2 |
382d |
3f46be6acadd
tcp_hpts: let tcp_hpts_init() set a random CPU only once
|
panic: ASan: Invalid access, NUM-byte read at ADDR, MallocRedZone(fb) (2)
|
|
|
|
6 |
434d |
446d
|
2/2 |
433d |
761ae1ce798a
ktrace: Handle uio_resid underflow via MSG_TRUNC
|
panic: in_pcblookup_hash_locked: invalid local address (2)
|
C |
|
|
94 |
446d |
657d
|
2/2 |
443d |
abca3ae7734f
udp: fix sending of IPv4-mapped addresses
|
panic: in_pcblookup_hash_locked: invalid foreign address (2)
|
C |
|
|
38 |
451d |
657d
|
2/2 |
443d |
abca3ae7734f
udp: fix sending of IPv4-mapped addresses
|
panic: Rack:ADDR sb:ADDR rsm:ADDR -- first rsm mbuf not aligned to sb (2)
|
|
|
|
1 |
495d |
495d
|
2/2 |
445d |
8818f0f1124e
TCP: Fix a rack bug that skyzall found which results in a crash.
|
panic: rsm:ADDR nrsm:ADDR hit at soff:NUM null m
|
|
|
|
1 |
523d |
523d
|
2/2 |
445d |
8818f0f1124e
TCP: Fix a rack bug that skyzall found which results in a crash.
|
panic: mbuf:ADDR len:NUM rsm:ADDR oml:NUM soff:NUM
|
C |
|
|
4 |
447d |
496d
|
2/2 |
446d |
8818f0f1124e
TCP: Fix a rack bug that skyzall found which results in a crash.
|
panic: Counter goes negative (3)
|
C |
|
|
595 |
468d |
1024d
|
2/2 |
467d |
bb56b36d7188
sctp: further improve shutting down the read side of a socket
|
panic: sbflush_internal: residual data (3)
|
C |
|
|
33 |
560d |
926d
|
2/2 |
467d |
81c5f0fac91d
sctp: improve shutting down the read side of a socket
|
panic: malloc: called with spinlock or critical section held
|
C |
|
|
3 |
483d |
483d
|
2/2 |
482d |
6b635c74fd41
aesni: Push FPU sections down further
|
panic: sbcut_internal: no next, len NUM
|
C |
|
|
2 |
501d |
501d
|
2/2 |
487d |
847fa61fad5e
sctp: improve handling of socket shutdown for reading
|
freebsd boot error: Fatal trap NUM: page fault while in kernel mode (2)
|
|
|
|
51 |
507d |
508d
|
2/2 |
502d |
ccdb28275db7
vm_phys_enq_range: no alignment assert for npages==0
|
freebsd boot error: panic: vm_phys_enq_range: page ADDR and npages NUM are misaligned
|
|
|
|
18 |
509d |
509d
|
2/2 |
509d |
b7370efade86
Revert "vm_phys_enqueue_contig: handle npages==0"
|
Fatal trap NUM: page fault in tcp_input_with_port
|
C |
|
|
6 |
532d |
571d
|
2/2 |
515d |
a43e7a96b64e
inpcb: use internal flag to mark pcbs that are inserted into lbgroup
|
panic: in_pcbconnect: inp is already connected
|
C |
|
|
2 |
557d |
557d
|
2/2 |
549d |
de0a2eb2ef86
tcp: Disallow connecting a disconnected socket
|
panic: lock (sleep mutex) unp not locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE
|
C |
|
|
2 |
551d |
551d
|
2/2 |
551d |
712079d38106
unix: Fix uipc_peeraddr() to handle self-connected sockets
|
panic: lock (sleep mutex) unp not locked @ /syzkaller/managers/i386/kernel/sys/kern/uipc_usrreq.c:LINE
|
|
|
|
1 |
551d |
551d
|
2/2 |
551d |
712079d38106
unix: Fix uipc_peeraddr() to handle self-connected sockets
|
panic: filesystem goof: vop_panic[vop_fplookup_vexec]
|
|
|
|
6 |
627d |
627d
|
2/2 |
626d |
4032c388146b
ufs: add missing vop_fplookup ops to fifo vectors
|
panic: ASan: Invalid access, NUM-byte write at ADDR, StackMiddle(f2) (3)
|
|
|
|
4274 |
628d |
629d
|
2/2 |
628d |
030434acaf46
Update rack to the latest code used at NF.
|
panic: in6_pcblookup_hash_locked: invalid local address
|
syz |
|
|
37 |
672d |
688d
|
2/2 |
651d |
aa71d6b4a2ec
netinet: Disallow unspecified addresses in ICMP-embedded packets
|
panic: in_pcblookup_hash_l[o ctkherde:a di nvaplidi d 1l1o86 catlid a1d0dr0e6s9s1 ]
|
|
|
|
1 |
670d |
670d
|
2/2 |
657d |
713264f6b8bc
netinet: Tighten checks for unspecified source addresses
|
panic: in_pcblookup_hash_locked: invalid local address
|
syz |
|
|
165751 |
657d |
689d
|
2/2 |
657d |
713264f6b8bc
netinet: Tighten checks for unspecified source addresses
|
panic: in_pcblookup_hash_locked: invalid foreign address
|
syz |
|
|
152 |
658d |
689d
|
2/2 |
657d |
713264f6b8bc
netinet: Tighten checks for unspecified source addresses
|
freebsd build error (16)
|
|
|
|
214 |
669d |
685d
|
2/2 |
668d |
8c8574acb851
config: Include errno.h in mkmakefile.cc
|
Fatal trap NUM: page fault in sctp_notify_stream_reset_tsn
|
syz |
|
|
2 |
690d |
690d
|
2/2 |
689d |
7b2f1a7fe944
sctp: improve delivery of stream reset notifications
|
Fatal trap NUM: page fault in kern_cpuset_getid
|
C |
|
|
3 |
693d |
694d
|
2/2 |
693d |
2058f075b4af
cpuset: Handle CPU_WHICH_TIDPID wherever cpuset_which() is called.
|
panic: ipreass_callout: stray callout on bucket ADDR
|
|
|
|
10 |
835d |
837d
|
2/2 |
820d |
15b73a2a14d1
ip_reass: use correct comparison in ipreass_callout()
|
panic: ipreass_callout: stray callout on bucket ADDR, NUM < NUM
|
|
|
|
34 |
831d |
835d
|
2/2 |
831d |
15b73a2a14d1
ip_reass: use correct comparison in ipreass_callout()
|
panic: Assertion sb->sb_hiwat >= sb->uxdg_cc failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE
|
C |
|
|
2 |
857d |
857d
|
2/2 |
850d |
820bafd0bc14
unix/dgram: don't panic if socket buffer has negative space
|
Fatal trap NUM: page fault in key_attach
|
C |
|
|
117 |
864d |
865d
|
2/2 |
864d |
b7bf3cb07fcf
keysock: explicitly initialized LIST_HEAD
|
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2)
|
C |
|
|
3 |
971d |
994d
|
2/2 |
866d |
bb995f2ef0e7
sctp: improve handling of send() calls with no user data`
|
panic: seq_out not found rack:ADDR tp:ADDR
|
C |
|
|
108 |
891d |
1288d
|
2/2 |
888d |
5b741298b11c
tcp rack: fix switching to RACK when FIN has been sent
|
Fatal trap NUM: page fault in soclose
|
C |
|
|
245 |
909d |
913d
|
2/2 |
909d |
bafe71fd2720
sctp: do not clobber listening socket with sockbuf operations
|
panic: Assertion v != tid failed at /syzkaller/managers/main/kernel/sys/kern/kern_mutex.c:LINE
|
C |
|
|
245 |
925d |
1565d
|
2/2 |
923d |
a14465e1b9a5
rip6: Fix a lock order reversal in rip6_bind()
|
panic: Assertion v != tid failed at /syzkaller/managers/i386/kernel/sys/kern/kern_mutex.c:LINE
|
syz |
|
|
115 |
928d |
1559d
|
2/2 |
923d |
a14465e1b9a5
rip6: Fix a lock order reversal in rip6_bind()
|
panic: Assertion (t->parent->p_treeflag & P_TREE_REAPER) != NUM failed at /syzkaller/managers/main/kernel/sys/kern/kern_
|
|
|
|
7 |
926d |
969d
|
2/2 |
923d |
1575804961d2
reap_kill_proc(): avoid singlethreading any other process if we are exiting
|
panic: Thread not suspended
|
syz |
|
|
30 |
926d |
970d
|
2/2 |
923d |
1575804961d2
reap_kill_proc(): avoid singlethreading any other process if we are exiting
|
panic: Assertion TD_CAN_RUN(td) failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:LINE
|
C |
|
|
1 |
970d |
970d
|
2/2 |
923d |
1575804961d2
reap_kill_proc(): avoid singlethreading any other process if we are exiting
|
panic: td ADDR is not suspended
|
C |
|
|
11 |
925d |
970d
|
2/2 |
923d |
1575804961d2
reap_kill_proc(): avoid singlethreading any other process if we are exiting
|
panic: already suspended
|
C |
|
|
130 |
923d |
970d
|
2/2 |
923d |
1575804961d2
reap_kill_proc(): avoid singlethreading any other process if we are exiting
|
panic: Lock pf config not exclusively locked @ /syzkaller/managers/i386/kernel/sys/netpfil/pf/pf_ioctl.c:LINE
|
|
|
|
109 |
958d |
1000d
|
2/2 |
924d |
826c58d6656c
pf: add missing unlock on error in DIOCCHANGERULE
|
panic: Lock pf config not exclusively locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:LINE
|
C |
|
|
142 |
958d |
1001d
|
2/2 |
924d |
826c58d6656c
pf: add missing unlock on error in DIOCCHANGERULE
|
Fatal trap NUM: page fault in tcp_sack_output
|
|
|
|
4 |
929d |
930d
|
2/2 |
929d |
ce2525c8108a
tcp: remove goto and address another NULL deref in SACK
|
panic: sctp_inpcb_free: inp ADDR still has socket
|
syz |
|
|
12 |
963d |
1151d
|
2/2 |
933d |
a5c2009dd8ab
sctp: improve handling of sctp inpcb flags
|
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT (2)
|
C |
|
|
27 |
939d |
956d
|
2/2 |
936d |
a3d974082549
pf: make sure the rule tree is allocated in DIOCCHANGERULE
|
panic: sbflush_internal: residual data (2)
|
C |
|
|
263 |
939d |
1201d
|
2/2 |
938d |
a6a596e102be
sctp: improve handling of listen() call
|
panic: Queues are not empty when handling SHUTDOWN-ACK (2)
|
|
|
|
1 |
940d |
940d
|
2/2 |
940d |
64b297e803bd
sctp: improve handling of send() when association is shutdown
|
panic: Warning: Last msg marked incomplete, yet nothing left? (2)
|
C |
|
|
3 |
940d |
949d
|
2/2 |
940d |
2646cd085850
sctp: use a consistent view of the send parameters
|
panic: Queues are not empty when handling SHUTDOWN-COMPLETE
|
C |
|
|
17 |
977d |
1507d
|
2/2 |
940d |
64b297e803bd
sctp: improve handling of send() when association is shutdown
|
panic: sctp: no chunks on the queues (2)
|
syz |
|
|
1813 |
940d |
1584d
|
2/2 |
940d |
2646cd085850
sctp: use a consistent view of the send parameters
|
panic: Assertion clen >= sizeof(*cm) && clen <= cm->cmsg_len failed at /syzkaller/managers/i386/kernel/sys/kern/uipc_usr
|
|
|
|
18 |
941d |
942d
|
2/2 |
941d |
75e7e3ce34d9
unix: fix incorrect assertion in 4682ac697ce
|
panic: Assertion clen >= sizeof(*cm) && clen <= cm->cmsg_len failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usr
|
C |
|
|
6 |
942d |
943d
|
2/2 |
941d |
75e7e3ce34d9
unix: fix incorrect assertion in 4682ac697ce
|
freebsd build error (13)
|
|
|
|
9 |
948d |
949d
|
2/2 |
948d |
4a3e51335e86
cpuset: Fix the KASAN and KMSAN builds
|
Fatal trap NUM: page fault in sctp_wakeup_the_read_socket (3)
|
syz |
|
|
3 |
972d |
978d
|
2/2 |
971d |
490a0f77de77
sctp: improve locking
|
panic: ASan: Invalid access, NUM-byte write at ADDR, UMAUseAfterFree(fd)
|
|
|
|
8 |
980d |
994d
|
2/2 |
979d |
868868f14efc
sctp: improve stopping of timers
|
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd) (2)
|
C |
|
|
7 |
979d |
981d
|
2/2 |
979d |
a12d89332efe
sctp: hold the inp lock while calling ip6_output
|
Fatal trap NUM: page fault in sctp_wakeup_the_read_socket (2)
|
|
|
|
1 |
1056d |
1056d
|
2/2 |
981d |
3dc57df91e65
sctp: don't wakeup 1-to-1 listening sockets for data or notifications
|
Fatal trap NUM: page fault in __mtx_lock_flags (2)
|
C |
|
|
2 |
991d |
991d
|
2/2 |
981d |
3dc57df91e65
sctp: don't wakeup 1-to-1 listening sockets for data or notifications
|
panic: ASan: Invalid access, NUM-byte read in sctp_med_chunk_output
|
C |
|
|
180 |
1136d |
1192d
|
2/2 |
983d |
eeba22217217
sctp: don't keep a pointer to a freed stcb around
|
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd)
|
C |
|
|
515 |
983d |
1103d
|
2/2 |
983d |
eeba22217217
sctp: don't keep a pointer to a freed stcb around
|
panic: ASan: Invalid access, 4-byte write at ADDR, UMAUseAfterFree(fd)
|
C |
|
|
462 |
998d |
1265d
|
2/2 |
995d |
52106f072fd0
sctp: don't refer to a potentially outdated stream
|
panic: ASan: Invalid access, NUM-byte write at ADDR, UseAfterScope(f8)
|
|
|
|
11 |
998d |
1120d
|
2/2 |
996d |
39a22011bbb8
sctp: clear pointer to stack when returning from function.
|
panic: ASan: Invalid access, NUM-byte write at ADDR, StackRight(f3)
|
|
|
|
102 |
997d |
1000d
|
2/2 |
996d |
39a22011bbb8
sctp: clear pointer to stack when returning from function.
|
panic: ASan: Invalid access, NUM-byte write at ADDR, KernelStack(fe)
|
|
|
|
149 |
996d |
1000d
|
2/2 |
996d |
39a22011bbb8
sctp: clear pointer to stack when returning from function.
|
panic: ASan: Invalid access, NUM-byte write at ADDR, StackMiddle(f2) (2)
|
|
|
|
1 |
998d |
998d
|
2/2 |
996d |
39a22011bbb8
sctp: clear pointer to stack when returning from function.
|
panic: ASan: Invalid access, NUM-byte write at ADDR, StackLeft(f1)
|
|
|
|
48 |
997d |
1000d
|
2/2 |
996d |
39a22011bbb8
sctp: clear pointer to stack when returning from function.
|
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT
|
C |
|
|
81 |
1000d |
1001d
|
2/2 |
1000d |
e123e2294cb5
pf: guard against DIOCADDRULE without DIOCXBEGIN
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-tcb @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_outp
|
|
|
|
2 |
1000d |
1000d
|
2/2 |
1000d |
5d0c76c7302b
sctp: don't lock an already locked stcb.
|
panic: Don't own TCB send lock
|
C |
|
|
8016 |
1000d |
1185d
|
2/2 |
1000d |
5ac91821f5d7
sctp: get rid of stcb send lock
|
panic: Association about to be freed (2)
|
C |
|
|
4834 |
1000d |
1037d
|
2/2 |
1000d |
5ac91821f5d7
sctp: get rid of stcb send lock
|
panic: hold_tcblock is false
|
C |
|
|
468 |
1037d |
1038d
|
2/2 |
1037d |
e255f0c9fbd2
sctp: make sure new locking requirements are satisfied.
|
panic: Association about to be freed
|
C |
|
|
57 |
1037d |
1037d
|
2/2 |
1037d |
bdb99f6f5e31
sctp: remove KASSERT() which not always holds
|
panic: create_lock_applied is true
|
C |
|
|
104 |
1037d |
1038d
|
2/2 |
1037d |
2f0656fb9ba2
sctp: don't hold the assoc create lock longer than needed
|
panic: refcount ADDR wraparound (4)
|
|
|
|
21 |
1060d |
1128d
|
2/2 |
1048d |
300cfb96fc22
file: Make fget*() and getvnode*() consistent about initializing *fpp
|
panic: Bad link elm ADDR prev->next != elm (3)
|
|
|
|
8 |
1061d |
1112d
|
2/2 |
1054d |
b84ed4e7f626
filemon: Reject FILEMON_SET_FD commands when the fd is a kqueue
|
panic: lock ADDR is not initialized (2)
|
|
|
|
171 |
1056d |
1072d
|
2/2 |
1056d |
773e3a71b2f1
pf: Initialize pf_kpool mutexes earlier
|
freebsd boot error: can't ssh into the instance
|
|
|
|
22 |
1070d |
1071d
|
2/2 |
1070d |
46d35d415aa9
fork: Copy the vm_stacktop field into the new vmspace
|
panic: lock ADDR is not initialized
|
|
|
|
1457 |
1072d |
1074d
|
2/2 |
1072d |
e5ca5e801d3c
pf: ensure we don't destroy an uninitialised lock
|
Fatal trap NUM: page fault in inp_next
|
syz |
|
|
3 |
1091d |
1096d
|
2/2 |
1087d |
430df2abee90
in_pcb: improve inp_next()
|
panic: mutex blocked lock not owned at /syzkaller/managers/main/kernel/sys/kern/sched_ule.c:LINE
|
C |
|
|
33 |
1087d |
1088d
|
2/2 |
1087d |
6b95cf5bdedc
callout: Wait for the softclock thread to switch before rescheduling
|
Fatal trap NUM: page fault in tcp_usr_send
|
syz |
|
|
1 |
1091d |
1091d
|
2/2 |
1090d |
4287aa56197f
tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
|
panic: overhead (NUM) not a multiple of NUM
|
C |
|
|
248 |
1091d |
1092d
|
2/2 |
1091d |
ca0dd19f0933
sctp: check that the computed frag point is a multiple of 4
|
Fatal trap NUM: page fault in tcp_usr_shutdown
|
C |
|
|
5 |
1091d |
1092d
|
2/2 |
1091d |
4287aa56197f
tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
|
Fatal trap NUM: page fault in tcp_usr_rcvd
|
C |
|
|
7 |
1092d |
1093d
|
2/2 |
1092d |
37a7f5573716
tcp_usr_rcvd: don't cast inp_ppcb to tcpcb before checking inp_flags
|
panic: m_apply, offset > size of mbuf chain
|
C |
|
|
2 |
1098d |
1098d
|
2/2 |
1092d |
989453da0589
sctp: cleanup the SCTP_MAXSEG socket option.
|
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/net/if.c:LINE (2)
|
C |
|
|
314 |
1102d |
1106d
|
2/2 |
1101d |
9f5432d5e5f0
netinet6: ip6_setpktopt() requires NET_EPOCH
|
panic: ASan: Invalid access, 2-byte read at ADDR, UMAUseAfterFree(fd)
|
C |
|
|
1103 |
1103d |
1264d
|
2/2 |
1103d |
014f98b11992
udp: Fix a use-after-free in udp_multi_input()
|
Fatal trap NUM: page fault in memcpy_erms
|
C |
|
|
306 |
1103d |
1110d
|
2/2 |
1103d |
aa2681752d0d
cryptosoft: Don't treat CRYPTO_NULL_HMAC as an hmac algorithm.
|
Fatal trap NUM: page fault while in kernel mode (2)
|
|
|
|
1 |
1117d |
1117d
|
2/2 |
1106d |
12ae3476f35c
tcp_drain(): initialize the inpcb iterator when curvnet is set
|
Fatal trap NUM: page fault in tcp_drain
|
|
|
|
12 |
1116d |
1117d
|
2/2 |
1106d |
12ae3476f35c
tcp_drain(): initialize the inpcb iterator when curvnet is set
|
panic: Lock tcpinp not exclusively locked @ /syzkaller/managers/i386/kernel/sys/netinet/tcp_log_buf.c:LINE
|
|
|
|
13 |
1135d |
1138d
|
2/2 |
1135d |
2f62f92e3745
tcp: Fix a locking issue related to logging
|
panic: Lock tcpinp not exclusively locked @ /syzkaller/managers/main/kernel/sys/netinet/tcp_log_buf.c:LINE
|
|
|
|
6 |
1135d |
1138d
|
2/2 |
1135d |
2f62f92e3745
tcp: Fix a locking issue related to logging
|
panic: witness_warn (2)
|
|
|
|
29 |
1136d |
1138d
|
2/2 |
1136d |
df07bfda67ad
tcp: Fix a locking issue
|
panic: chacha20_poly1305_reinit: invalid nonce length
|
|
|
|
2 |
1147d |
1147d
|
2/2 |
1140d |
442ad83e38e8
crypto: Don't assert on valid IV length for Chacha20-Poly1305.
|
panic: condition vp->v_type == VDIR || VN_IS_DOOMED(vp) not met at /syzkaller/managers/i386/kernel/sys/kern/vfs_cache.c:
|
|
|
|
1 |
1159d |
1159d
|
2/2 |
1153d |
628c3b307fb2
cache: only let non-dir descriptors through when doing EMPTYPATH lookups
|
Fatal trap NUM: page fault in filt_bpfwrite
|
C |
|
|
4 |
1161d |
1167d
|
2/2 |
1154d |
426682b05a4c
bpf: Fix the write filter for detached descriptors
|
panic: ASan: Invalid access, NUM-byte read in newreno_cong_signal
|
C |
|
|
4 |
1155d |
1158d
|
2/2 |
1154d |
b15b0535968e
tcp: allow new reno functions to be called from other CC modules
|
panic: ASan: Invalid access, NUM-byte read in newreno_ack_received
|
|
|
|
2 |
1156d |
1156d
|
2/2 |
1154d |
b15b0535968e
tcp: allow new reno functions to be called from other CC modules
|
panic: Assertion (cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == NUM failed at /syzkaller/managers/main/kernel/sys/kern/v
|
C |
|
|
87 |
1163d |
1164d
|
2/2 |
1163d |
1045352f1503
cache: only assert on flags when dealing with EMPTYPATH
|
panic: TLS trailer length too long: NUM
|
C |
|
|
2 |
1172d |
1172d
|
2/2 |
1167d |
a63752cce646
ktls: Reject attempts to enable AES-CBC with TLS 1.3.
|
panic: filesystem goof: vop_panic[vop_readdir]
|
|
|
|
1 |
1172d |
1172d
|
2/2 |
1167d |
03d5820f738d
mount: Check for !VDIR mount points before handling -o emptydir
|
freebsd build error (9)
|
|
|
|
1 |
1169d |
1169d
|
2/2 |
1168d |
c05b382edb17
Revert "bootstrap: No need to disable shared libraries for bootstrap tools"
|
panic: invalid payload start
|
|
|
|
6 |
1194d |
1306d
|
2/2 |
1173d |
a0cbcbb7917b
cryptodev: Allow some CIOCCRYPT operations with an empty payload.
|
panic: filt_timerattach: periodic timer has a calculated zero timeout
|
|
|
|
12 |
1178d |
1179d
|
2/2 |
1178d |
2f4dbe279f6b
kqueue: fix recent assertion
|
panic: strq ADDR not scheduled
|
|
|
|
12189 |
1178d |
1182d
|
2/2 |
1178d |
3ff3733991ba
sctp: don't keep being locked on a stream which is removed
|
panic: strq ADDR is not scheduled
|
|
|
|
541 |
1181d |
1182d
|
2/2 |
1181d |
28ea9470782d
sctp: provide a specific stream scheduler function for FCFS
|
Fatal trap NUM: page fault in sctp_ss_rrp_packet_done
|
|
|
|
328 |
1181d |
1185d
|
2/2 |
1181d |
5b53e749a95e
sctp: fix usage of stream scheduler functions
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-send-tcb @ /syzkaller/managers/i386/kernel/sys/netinet/sctp
|
|
|
|
2 |
1182d |
1184d
|
2/2 |
1181d |
171633765c43
sctp: avoid locking an already locked mutex
|
Fatal trap NUM: page fault while in kernel mode
|
|
|
|
177 |
1181d |
1185d
|
2/2 |
1181d |
5b53e749a95e
sctp: fix usage of stream scheduler functions
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex sctp-send-tcb @ /syzkaller/managers/main/kernel/sys/netinet/sctp
|
|
|
|
10 |
1182d |
1185d
|
2/2 |
1181d |
171633765c43
sctp: avoid locking an already locked mutex
|
Fatal trap NUM: page fault in sctp_ss_default_select
|
|
|
|
20939 |
1181d |
1185d
|
2/2 |
1181d |
5b53e749a95e
sctp: fix usage of stream scheduler functions
|
Fatal trap NUM: page fault in sctp_ss_fb_select
|
|
|
|
12 |
1182d |
1185d
|
2/2 |
1181d |
5b53e749a95e
sctp: fix usage of stream scheduler functions
|
Fatal trap NUM: page fault in sctp_ss_prio_select
|
|
|
|
761 |
1181d |
1185d
|
2/2 |
1181d |
5b53e749a95e
sctp: fix usage of stream scheduler functions
|
panic: runtime error: invalid memory address or nil pointer dereference
|
|
|
|
12 |
1183d |
1185d
|
2/2 |
1183d |
b1e2f063ae91
amd64 sendsig: fix context corruption
|
freebsd boot error: panic: ASan: Invalid access, NUM-byte read at ADDR, UseAfterScope(f8)
|
|
|
|
270 |
1185d |
1189d
|
2/2 |
1185d |
ca1e447b1048
amd64: Avoid copying td_frame from kernel procs
|
panic: ASan: Invalid access, 2-byte read in sctp_ss_prio_add
|
|
|
|
1 |
1259d |
1259d
|
2/2 |
1189d |
34b1efcea19d
sctp: use a valid outstream when adding it to the scheduler
|
Fatal trap 9: general protection fault in sctp_ss_prio_add
|
|
|
|
1 |
1277d |
1277d
|
2/2 |
1190d |
34b1efcea19d
sctp: use a valid outstream when adding it to the scheduler
|
Fatal trap 12: page fault in sctp_ss_default_add (2)
|
|
|
|
1 |
1267d |
1267d
|
2/2 |
1190d |
34b1efcea19d
sctp: use a valid outstream when adding it to the scheduler
|
panic: ASan: Invalid access, 8-byte read in sctp_ss_default_add
|
|
|
|
326 |
1192d |
1262d
|
2/2 |
1190d |
34b1efcea19d
sctp: use a valid outstream when adding it to the scheduler
|
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (4)
|
C |
|
|
147 |
1265d |
1489d
|
2/2 |
1190d |
34b1efcea19d
sctp: use a valid outstream when adding it to the scheduler
|
panic: ASan: Invalid access, 8-byte read in sctp_ss_fb_add
|
|
|
|
22 |
1227d |
1261d
|
2/2 |
1190d |
34b1efcea19d
sctp: use a valid outstream when adding it to the scheduler
|
panic: ASan: Invalid access, 8-byte read in kern_sendit
|
|
|
|
2 |
1194d |
1234d
|
2/2 |
1191d |
fea1a98ead91
freebsd32: Fix a double copyin in sendmsg() and recvmsg()
|
panic: Bad link elm ADDR prev->next != elm (2)
|
|
|
|
8 |
1191d |
1203d
|
2/2 |
1191d |
e19d93b19dce
sctp: fix FCFS stream scheduler
|
Fatal trap 12: page fault while in kernel mode (3)
|
C |
|
|
140 |
1193d |
1799d
|
2/2 |
1192d |
ade1daa5c0d6
socket: Synchronize soshutdown() with listen(2) and AIO
|
Fatal trap 12: page fault in soo_aio_queue
|
C |
|
|
349 |
1193d |
1297d
|
2/2 |
1192d |
ade1daa5c0d6
socket: Synchronize soshutdown() with listen(2) and AIO
|
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE
|
C |
|
|
3 |
1205d |
1269d
|
2/2 |
1196d |
e6c19aa94da4
sctp: Allow blocking on I/O locks even with non-blocking sockets
|
Fatal trap 12: page fault in __mtx_lock_flags
|
C |
|
|
1065 |
1199d |
1698d
|
2/2 |
1199d |
2d5c48eccd9f
sctp: Tighten up locking around sctp_aloc_assoc()
|
panic: Assertion job->uiop != &job->uio && job->uiop != NULL failed at /syzkaller/managers/i386/kernel/sys/kern/vfs_aio.
|
|
|
|
1 |
1203d |
1203d
|
2/2 |
1199d |
2884918c7338
aio: Fix up the opcode in aiocb32_copyin()
|
panic: ASan: Invalid access, 4-byte read in sctp_sendall_completes
|
|
|
|
39 |
1203d |
1261d
|
2/2 |
1199d |
173a7a4ee4fa
sctp: Fix iterator synchronization in sctp_sendall()
|
panic: Assertion owner->td_proc->p_magic == P_MAGIC failed at /syzkaller/managers/i386/kernel/sys/kern/subr_turnstile.c: (2)
|
|
|
|
9 |
1251d |
1344d
|
2/2 |
1200d |
141fe2dceeae
aio: Interlock with listen(2)
|
panic: ASan: Invalid access, 1-byte read in udp6_common_ctlinput
|
|
|
|
1 |
1242d |
1242d
|
2/2 |
1200d |
b1e6a792d68e
net: Enter a net epoch around protocol if_up/down notifications
|
panic: unexpected security protocol NUM
|
syz |
|
|
7 |
1201d |
1216d
|
2/2 |
1200d |
10eb2a2bde61
ipsec: Validate the protocol identifier in ipsec4_ctlinput()
|
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:LINE (2)
|
|
|
|
68 |
1205d |
1295d
|
2/2 |
1200d |
141fe2dceeae
aio: Interlock with listen(2)
|
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2)
|
C |
|
|
109 |
1203d |
1298d
|
2/2 |
1200d |
141fe2dceeae
aio: Interlock with listen(2)
|
panic: Assertion owner->td_proc->p_magic == P_MAGIC failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:
|
C |
|
|
46 |
1263d |
1518d
|
2/2 |
1200d |
141fe2dceeae
aio: Interlock with listen(2)
|
panic: Lock sctp-info not exclusively locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:LINE
|
C |
|
|
363 |
1201d |
1201d
|
2/2 |
1200d |
0c1a20beb456
sctp: use appropriate argument when freeing association
|
panic: ASan: Invalid access, 8-byte read in osd_get
|
|
|
|
13 |
1202d |
1261d
|
2/2 |
1200d |
187afc58791c
osd: Fix racy assertions
|
Fatal trap 9: general protection fault in strlen
|
C |
|
|
1506 |
1266d |
2024d
|
2/2 |
1201d |
4250aa1188b5
sctp: Clear assoc socket references when freeing a PCB
|
panic: mtx_lock() of destroyed mutex at sys/kern/uipc_sockbuf.c:LINE
|
syz |
|
|
4 |
1351d |
1541d
|
2/2 |
1201d |
4250aa1188b5
sctp: Clear assoc socket references when freeing a PCB
|
panic: mutex so_snd not owned at /syzkaller/managers/i386/kernel/sys/kern/uipc_sockbuf.c:LINE
|
syz |
|
|
1 |
1495d |
1495d
|
2/2 |
1201d |
4250aa1188b5
sctp: Clear assoc socket references when freeing a PCB
|
panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.
|
C |
|
|
131 |
1202d |
1202d
|
2/2 |
1202d |
6e3af6321ba4
sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
|
panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /syzkaller/managers/i386/kernel/sys/netinet/sctp_pcb.
|
|
|
|
111 |
1202d |
1202d
|
2/2 |
1202d |
6e3af6321ba4
sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
|
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/netinet/tcp_output.c:LINE
|
syz |
|
|
707 |
1225d |
2110d
|
2/2 |
1202d |
bd4a39cc93d9
socket: Properly interlock when transitioning to a listening socket
|
panic: ASan: Invalid access, NUM-byte read in strncmp
|
C |
|
|
12 |
1203d |
1207d
|
2/2 |
1203d |
5402baa5b5d1
g_label: Handle small sector sizes when tasting
|
Fatal trap 12: page fault in knlist_remove_kq
|
|
|
|
3 |
1274d |
1282d
|
2/2 |
1208d |
c511383de7a0
kevent: Fix races between timer detach and kqtimer_proc_continue()
|
Fatal trap 12: page fault in filt_timerdetach
|
|
|
|
1 |
1278d |
1278d
|
2/2 |
1208d |
c511383de7a0
kevent: Fix races between timer detach and kqtimer_proc_continue()
|
panic: ASan: Invalid access, 8-byte read in sctp_free_assoc
|
|
|
|
112 |
1209d |
1262d
|
2/2 |
1209d |
d35be50f5779
sctp: Hold association locks across socket wakeups when freeing
|
Fatal trap 9: general protection fault in sctp_free_assoc
|
syz |
|
|
14 |
1271d |
1579d
|
2/2 |
1209d |
d35be50f5779
sctp: Hold association locks across socket wakeups when freeing
|
Fatal trap 9: general protection fault in itimer_proc_continue
|
syz |
|
|
2 |
1303d |
1303d
|
2/2 |
1209d |
3138392a46a4
itimer: Serialize access to the p_itimers array
|
panic: ASan: Invalid access, 1-byte read at ADDR, RedZonePartial(2)
|
|
|
|
17 |
1263d |
1265d
|
2/2 |
1209d |
9e9ba9c73de9
graid: Avoid tasting devices with small sector sizes
|
panic: ASan: Invalid access, 8-byte read in itimer_proc_continue
|
|
|
|
1 |
1248d |
1248d
|
2/2 |
1209d |
3138392a46a4
itimer: Serialize access to the p_itimers array
|
panic: ASan: Invalid access, 1-byte read at ADDR, RedZonePartial(1)
|
|
|
|
13 |
1220d |
1264d
|
2/2 |
1209d |
9e9ba9c73de9
graid: Avoid tasting devices with small sector sizes
|
panic: ASan: Invalid access, 1-byte read in g_raid_md_taste_ddf
|
C |
|
|
18 |
1215d |
1262d
|
2/2 |
1209d |
9e9ba9c73de9
graid: Avoid tasting devices with small sector sizes
|
panic: ASan: Invalid access, 2-byte read in g_raid_md_taste_sii
|
C |
|
|
7 |
1223d |
1248d
|
2/2 |
1209d |
9e9ba9c73de9
graid: Avoid tasting devices with small sector sizes
|
panic: Bad list head ADDR first->prev != head
|
C |
|
|
3409 |
1210d |
2107d
|
2/2 |
1210d |
4a36122b1db1
sctp: Fix racy UNBOUND flag check in sctp_inpcb_bind()
|
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(7)
|
|
|
|
28 |
1263d |
1265d
|
2/2 |
1211d |
564b6aa7fccd
aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
|
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(6)
|
|
|
|
20 |
1263d |
1265d
|
2/2 |
1211d |
564b6aa7fccd
aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
|
panic: ASan: Invalid access, 8-byte read at ADDR, StackMiddle(f2)
|
|
|
|
18 |
1263d |
1265d
|
2/2 |
1211d |
36226163fa48
x86: Mark the trapframe as initialized in ipi_bitmap_handler()
|
panic: ASan: Invalid access, 16-byte read at ADDR, RedZonePartial(3)
|
|
|
|
9 |
1263d |
1264d
|
2/2 |
1211d |
564b6aa7fccd
aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
|
panic: ASan: Invalid access, 16-byte read in aesni_encrypt_icm
|
C |
|
|
114 |
1212d |
1263d
|
2/2 |
1211d |
564b6aa7fccd
aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
|
panic: Assertion lock == sq->sq_lock failed at /syzkaller/managers/i386/kernel/sys/kern/subr_sleepqueue.c:LINE
|
|
|
|
1 |
1290d |
1290d
|
2/2 |
1225d |
c4feb1ab0ae0
sigtimedwait: Use a unique wait channel for sleeping
|
panic: Assertion lock == sq->sq_lock failed at /syzkaller/managers/main/kernel/sys/kern/subr_sleepqueue.c:LINE (2)
|
C |
|
|
7 |
1267d |
1290d
|
2/2 |
1225d |
c4feb1ab0ae0
sigtimedwait: Use a unique wait channel for sleeping
|
panic: ASan: Invalid access, 4-byte read in sctp6_connect
|
|
|
|
64 |
1238d |
1263d
|
2/2 |
1234d |
784692c74019
sctp: improve handling of IPv4 addresses on IPV6 sockets Reported by: syzbot+08fe66e4bfc2777cba95@syzkaller.appspotmail.com MFC after: 3 days
|
panic: ASan: Invalid access, 4-byte read in sctp_sosend
|
C |
|
|
518 |
1234d |
1263d
|
2/2 |
1234d |
b732091a761a
sctp: improve input validation of mapped addresses in send() Reported by: syzbot+35528f275f2eea6317cc@syzkaller.appspotmail.com Reported by: syzbot+ac29916d5f16d241553d@syzkaller.appspotmail.com MFC after: 3 days
|
freebsd boot error: panic: sleeping without a lock
|
|
|
|
6 |
1236d |
1236d
|
2/2 |
1235d |
2694c869ff9f
ktls: fix a panic with INVARIANTS
|
panic: ASan: Invalid access, 4-byte read in tcp_usr_bind
|
C |
|
|
50 |
1236d |
1261d
|
2/2 |
1236d |
3f1f6b6ef7f6
tcp, udp: improve input validation in handling bind()
|
panic: ASan: Invalid access, 4-byte read in udp_bind
|
C |
|
|
69 |
1236d |
1262d
|
2/2 |
1236d |
3f1f6b6ef7f6
tcp, udp: improve input validation in handling bind()
|
panic: pmap_growkernel: no memory to grow kernel (2)
|
syz |
|
|
299 |
1239d |
1699d
|
2/2 |
1236d |
600745f1e226
pf: bound DIOCGETSTATES memory use
|
panic: pmap_kasan_enter_alloc_4k: no memory to grow shadow map
|
C |
|
|
20 |
1239d |
1258d
|
2/2 |
1236d |
600745f1e226
pf: bound DIOCGETSTATES memory use
|
panic: vm_fault_lookup: fault on nofault entry, addr: ADDR (2)
|
C |
|
|
75 |
1275d |
1319d
|
2/2 |
1244d |
64432ad2a2c4
pf: Validate user string nul-termination before copying
|
freebsd boot error: panic: ASan: Invalid access, 1-byte read at ADDR, MallocRedZone(fb)
|
|
|
|
156 |
1259d |
1265d
|
2/2 |
1259d |
4a9a41650c90
uart: Fix an out-of-bounds read in ns8250_bus_probe()
|
panic: Assertion (cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0 failed at /syzkaller/managers/main/kernel/sys/kern/vfs
|
C |
|
|
4 |
1321d |
1321d
|
2/2 |
1261d |
6de3cf14c47d
vn_open_cred(): disallow O_CREAT | O_EMPTY_PATH
|
panic: ASan: Invalid access, 32-byte read at ADDR, StackMiddle(f2)
|
|
|
|
1 |
1263d |
1263d
|
2/2 |
1262d |
36226163fa48
x86: Mark the trapframe as initialized in ipi_bitmap_handler()
|
panic: ASan: Invalid access, 8-byte read in handleevents
|
|
|
|
34 |
1262d |
1263d
|
2/2 |
1262d |
36226163fa48
x86: Mark the trapframe as initialized in ipi_bitmap_handler()
|
panic: thread_lock() of sleep mutex `*Fv @ /syzkaller/managers/main/kernel/sys/kern/kern_switch.c:LINE
|
|
|
|
1 |
1304d |
1304d
|
2/2 |
1301d |
4a59cbc12532
amd64: Avoid enabling interrupts when handling kernel mode prot faults
|
panic: thread_lock() of sleep mutex ` @ /syzkaller/managers/main/kernel/sys/kern/kern_switch.c:LINE
|
C |
|
|
1 |
1304d |
1304d
|
2/2 |
1301d |
4a59cbc12532
amd64: Avoid enabling interrupts when handling kernel mode prot faults
|
panic: Assertion p2->p_ktrioparms == NULL failed at /syzkaller/managers/i386/kernel/sys/kern/kern_ktrace.c:LINE
|
|
|
|
1 |
1309d |
1309d
|
2/2 |
1306d |
f3851b235b23
ktrace: Fix a race with fork()
|
panic: Assertion p2->p_ktrioparms == NULL failed at /syzkaller/managers/main/kernel/sys/kern/kern_ktrace.c:LINE
|
|
|
|
1 |
1309d |
1309d
|
2/2 |
1306d |
f3851b235b23
ktrace: Fix a race with fork()
|
Fatal trap 12: page fault in rack_process_to_cumack (2)
|
syz |
|
|
3 |
1309d |
1309d
|
2/2 |
1307d |
13c0e198ca27
tcp: Fix bugs related to the PUSH bit and rack and an ack war
|
panic: refcount ADDR wraparound (3)
|
C |
|
|
9 |
1310d |
1310d
|
2/2 |
1310d |
6f6cd1e8e8aa
ktrace: Remove vrele() at the end of ktr_writerequest()
|
panic: Non-zero write count
|
|
|
|
98 |
1310d |
1310d
|
2/2 |
1310d |
6f6cd1e8e8aa
ktrace: Remove vrele() at the end of ktr_writerequest()
|
Fatal trap 9: general protection fault in rack_ctloutput
|
syz |
|
|
2 |
1313d |
1313d
|
2/2 |
1311d |
8923ce630492
tcp: Handle stack switch while processing socket options
|
panic: ktrace_enter: flag set
|
C |
|
|
44 |
1311d |
1313d
|
2/2 |
1311d |
e4b16f2fb18b
ktrace: Avoid recursion in namei()
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex so_snd @ /syzkaller/managers/i386/kernel/sys/modules/tcp/rack/..
|
|
|
|
4 |
1312d |
1312d
|
2/2 |
1311d |
39756885633f
rack: honor prior socket buffer lock when doing the upcall
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex so_snd @ /syzkaller/managers/main/kernel/sys/modules/tcp/rack/..
|
|
|
|
2 |
1312d |
1312d
|
2/2 |
1311d |
39756885633f
rack: honor prior socket buffer lock when doing the upcall
|
panic: Memory modified after free ADDR(4096) val=ADDR @ ADDR
|
C |
|
|
1 |
1316d |
1316d
|
2/2 |
1312d |
500eb6dd8040
tcp: Fix sending of TCP segments with IP level options
|
freebsd boot error: panic: scsi_action: ccb ADDR, func_code 0x6 should not be allocated from UMA zone
|
|
|
|
42 |
1317d |
1318d
|
2/2 |
1316d |
5b81e2e1bcdc
virtio_scsi: Zero stack-allocated CCBs
|
Fatal trap 12: page fault in callout_process (2)
|
|
|
|
7 |
1322d |
1350d
|
2/2 |
1319d |
2cca77ee0134
kqueue timer: Remove detached knotes from the process stop queue
|
Fatal trap 9: general protection fault in kqtimer_proc_continue
|
|
|
|
109 |
1319d |
1353d
|
2/2 |
1319d |
2cca77ee0134
kqueue timer: Remove detached knotes from the process stop queue
|
panic: releasing active pmap ADDR
|
C |
|
|
11 |
1321d |
1364d
|
2/2 |
1320d |
9246b3090cbc
fork: Suspend other threads if both RFPROC and RFMEM are not set
|
panic: pmap active ADDR
|
C |
|
|
5 |
1327d |
1364d
|
2/2 |
1320d |
9246b3090cbc
fork: Suspend other threads if both RFPROC and RFMEM are not set
|
Fatal trap 18: integer divide fault in realtimer_expire_l
|
C |
|
|
15 |
1321d |
1348d
|
2/2 |
1320d |
8b3c4231abf0
posix timers: Check for overflow when converting to ns
|
Fatal trap 18: integer divide fault in realtimer_expire
|
C |
|
|
20 |
1351d |
1373d
|
2/2 |
1320d |
8b3c4231abf0
posix timers: Check for overflow when converting to ns
|
Fatal trap 9: general protection fault in crypto_ioctl
|
|
|
|
1 |
1326d |
1326d
|
2/2 |
1321d |
1a04f0156c4e
cryptodev: Fix some input validation bugs
|
panic: crp_iv_start set when IV isn't used
|
C |
|
|
2 |
1324d |
1325d
|
2/2 |
1321d |
1a04f0156c4e
cryptodev: Fix some input validation bugs
|
panic: vm_fault_lookup: fault on nofault entry, addr: ADDR
|
|
|
|
5 |
1325d |
1362d
|
2/2 |
1321d |
c8bbb1272c8b
vfs: Fix error handling in vn_fullpath_hardlink()
|
panic: IV outside buffer length
|
C |
|
|
16 |
1321d |
1327d
|
2/2 |
1321d |
1a04f0156c4e
cryptodev: Fix some input validation bugs
|
Fatal trap 9: general protection fault in mb_free_ext
|
|
|
|
1 |
1323d |
1323d
|
2/2 |
1321d |
1a04f0156c4e
cryptodev: Fix some input validation bugs
|
panic: More encryption data than allowed
|
C |
|
|
2 |
1323d |
1323d
|
2/2 |
1321d |
1a04f0156c4e
cryptodev: Fix some input validation bugs
|
panic: AEAD without a separate IV
|
C |
|
|
25 |
1321d |
1327d
|
2/2 |
1321d |
1a04f0156c4e
cryptodev: Fix some input validation bugs
|
Fatal trap 12: page fault in memcpy_erms
|
C |
|
|
2 |
1322d |
1322d
|
2/2 |
1321d |
1a04f0156c4e
cryptodev: Fix some input validation bugs
|
panic: IV_SEPARATE set when IV isn't used
|
C |
|
|
4 |
1323d |
1325d
|
2/2 |
1321d |
1a04f0156c4e
cryptodev: Fix some input validation bugs
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/main/kernel/sys/kern/kern_sig
|
syz |
|
|
2 |
1350d |
1350d
|
2/2 |
1321d |
5cc1d199412e
realtimer_expire: avoid proc lock recursion when called from itimer_proc_continue()
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/i386/kernel/sys/kern/kern_eve
|
|
|
|
2 |
1350d |
1351d
|
2/2 |
1321d |
75c5cf7a720f
filt_timerexpire: avoid process lock recursion
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/main/kernel/sys/kern/kern_eve
|
|
|
|
1 |
1351d |
1351d
|
2/2 |
1321d |
75c5cf7a720f
filt_timerexpire: avoid process lock recursion
|
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/i386/kernel/sys/kern/kern_sig
|
|
|
|
1 |
1353d |
1353d
|
2/2 |
1321d |
5cc1d199412e
realtimer_expire: avoid proc lock recursion when called from itimer_proc_continue()
|
Fatal trap 12: page fault in pmap_kextract (2)
|
C |
|
|
8 |
1351d |
1352d
|
2/2 |
1351d |
5e98cae661f3
pf: Ensure that we don't use kif passed to pfi_kkif_attach()
|
panic: to_ticks == 0 for timer type 5 (2)
|
syz |
|
|
2 |
1373d |
1373d
|
2/2 |
1371d |
d995cc7e5431
sctp: fix handling of RTO.initial of 1 ms
|
panic: to_ticks == 0 for timer type 5
|
C |
|
|
2 |
1399d |
1399d
|
2/2 |
1395d |
70e95f0b6917
sctp: avoid integer overflow when starting the HB timer
|
Fatal trap 12: page fault in sctp_find_alternate_net
|
syz |
|
|
131 |
1401d |
1544d
|
2/2 |
1400d |
b963ce4588b3
sctp: improve computation of an alternate net
|
panic: pfi_dynaddr_setup: non-NULL dyn (2)
|
C |
|
|
4 |
1432d |
1432d
|
2/2 |
1425d |
7a808c5ee329
pf: Improve pf_rule input validation
|
Fatal trap 12: page fault in copyin_nosmap_erms
|
C |
|
|
8 |
1469d |
1515d
|
2/2 |
1440d |
ea36212bf571
pf: Don't hold PF_RULES_WLOCK during copyin() on DIOCRCLRTSTATS
|
freebsd boot error: panic: IPI scoreboard is zero, initiator 1 target 1
|
|
|
|
9 |
1441d |
1441d
|
2/2 |
1441d |
44121a0fbee0
amd64: fix tlb shootdown when all cpus are passed in the bitmap
|
freebsd boot error: panic: IPI scoreboard is zero, initiator 0 target 0
|
|
|
|
3 |
1441d |
1441d
|
2/2 |
1441d |
44121a0fbee0
amd64: fix tlb shootdown when all cpus are passed in the bitmap
|
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/uipc_ktls.c:LINE
|
C |
|
|
11 |
1446d |
1672d
|
2/2 |
1444d |
6685e259e319
tcp: don't use KTLS socket option on listening sockets
|
panic: Memory modified after free ADDR(112) val=ADDR @ ADDR (2)
|
syz |
|
|
475 |
1448d |
1692d
|
2/2 |
1448d |
a7aa5eea4fff
sctp: improve handling of aborted associations
|
panic: sched_pickcpu: Failed to find a cpu.
|
C |
|
|
4 |
1476d |
1476d
|
2/2 |
1476d |
f1b18a668deb
cpuset_set{affinity,domain}: do not allow empty masks
|
Fatal trap 9: general protection fault in cpuset_setproc
|
syz |
|
|
2 |
1477d |
1477d
|
2/2 |
1476d |
b2780e8537da
kern: cpuset: resolve race between cpuset_lookup/cpuset_rel
|
panic: sleeping without a lock
|
C |
|
|
29 |
1481d |
1647d
|
2/2 |
1480d |
34af05ead3cf
kern: soclose: don't sleep on SO_LINGER w/ timeout=0
|
panic: uma_zalloc_debug: called within spinlock or critical section
|
C |
|
|
9 |
1487d |
1491d
|
2/2 |
1486d |
e07e3fa3c95c
kern: cpuset: drop the lock to allocate domainsets
|
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (3)
|
C |
|
|
12 |
1490d |
1491d
|
2/2 |
1489d |
5d49283f8857
pf: Make tag hashing more robust
|
panic: fc_ioctls != NULL, but fc_nioctls=-NUM
|
|
|
|
5591 |
1491d |
1492d
|
2/2 |
1491d |
3d4ae1b3d110
kern: dup: do not assume oldfde is valid
|
Fatal trap 12: page fault in __mtx_lock_spin_flags
|
|
|
|
3 |
1496d |
1500d
|
2/2 |
1495d |
a33fef5e25ac
callout(9): Fix a race between CPU migration and callout_drain()
|
panic: spin lock held too long
|
C |
|
|
1 |
1500d |
1500d
|
2/2 |
1495d |
a33fef5e25ac
callout(9): Fix a race between CPU migration and callout_drain()
|
Fatal trap 12: page fault in _callout_stop_safe
|
C |
|
|
1 |
1500d |
1500d
|
2/2 |
1495d |
a33fef5e25ac
callout(9): Fix a race between CPU migration and callout_drain()
|
panic: Most recently used by pf_ifnet
|
C |
|
|
6 |
1533d |
1533d
|
2/2 |
1532d |
52b83a06184c
pf: do not remove kifs that are referenced by rules
|
Fatal trap 9: general protection fault in sctp_lower_sosend
|
C |
|
|
22 |
1632d |
1684d
|
2/2 |
1590d |
f5d30f7f7606
Improve the handling of concurrent send() calls for SCTP sockets, especially when having the explicit EOR mode enabled.
|
panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb
|
C |
|
|
2 |
1638d |
1638d
|
2/2 |
1602d |
cfae6a92ac01
Remove an incorrect assertion from in6p_lookup_mcast_ifp().
|
Fatal trap 12: page fault in uipc_ready
|
C |
|
|
5 |
1632d |
1660d
|
2/2 |
1607d |
1b778ba2609f
Fix a logic error in uipc_ready_scan().
|
panic: witness_warn
|
syz |
|
|
1 |
1652d |
1652d
|
2/2 |
1636d |
e54b7cd007b5
Fix the cleanup handling in a error path for TCP BBR.
|
Fatal trap 12: page fault in sctp_find_ifa_in_ep
|
C |
|
|
3 |
1639d |
1639d
|
2/2 |
1636d |
7a3f60e7f571
Fix a bug introduced in https://svnweb.freebsd.org/changeset/base/362173
|
freebsd test error: Fatal trap 12: page fault in in_pcb_lport_dest
|
|
|
|
9 |
1680d |
1680d
|
2/2 |
1656d |
1ec42007fec3
Fix NULL-pointer bug from r361228.
|
Fatal trap 12: page fault in sctp_process_control
|
C |
|
|
47 |
1686d |
1687d
|
2/2 |
1686d |
86fd36c502db
Fix a copy and paste error introduced in r360878.
|
Fatal trap 9: general protection fault in sctp_process_control
|
C |
|
|
11 |
1686d |
1687d
|
2/2 |
1686d |
86fd36c502db
Fix a copy and paste error introduced in r360878.
|
panic: sctp_timer_start of type 1: inp = ADDR, stcb = ADDR, net = 0
|
|
|
|
1 |
1692d |
1692d
|
2/2 |
1687d |
efd5e6929194
Ensure that we have a path when starting the T3 RXT timer.
|
panic: sctp_timer_start of type 10: inp = ADDR, stcb->sctp_ep ADDR
|
|
|
|
1 |
1697d |
1697d
|
2/2 |
1687d |
83ed508055c0
Ensure that the SCTP iterator runs with an stcb and inp, which belong to each other.
|
panic: pfi_dynaddr_setup: dyn is ADDR (2)
|
C |
|
|
22 |
1698d |
1709d
|
2/2 |
1695d |
1ef06ed8def9
pf: Improve DIOCADDRULE validation
|
panic: mallocarray: ADDR * 1064 overflowed
|
C |
|
|
3 |
1705d |
1709d
|
2/2 |
1702d |
a7c8533634ab
pf: Improve input validation
|
Fatal trap 9: general protection fault in in6_selecthlim
|
|
|
|
25 |
1702d |
1703d
|
2/2 |
1702d |
17cb6ddba8ab
Fix order of arguments in fib[46]_lookup calls in SCTP.
|
panic: pfi_dynaddr_setup: dyn is ADDR
|
C |
|
|
7 |
1710d |
1714d
|
2/2 |
1709d |
98582ce38183
pf: Improve ioctl() input validation
|
panic: Assertion size0 > 0 failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE
|
C |
|
|
2 |
1712d |
1712d
|
2/2 |
1711d |
95324dc3f4d2
pf: Do not allow negative ps_len in DIOCGETSTATES
|
panic: mtx_unlock() of destroyed mutex at sys/kern/sys_socket.c:LINE
|
syz |
|
|
1 |
1802d |
1802d
|
2/2 |
1714d |
99258935eb2b
Lock the socket in soo_stat().
|
panic: sbfree: m ADDR !M_NOTREADY
|
C |
|
|
32 |
2084d |
2109d
|
2/2 |
1716d |
dde1b5985fcc
Properly handle disconnected sockets in uipc_ready().
|
panic: allocdirect_merge: old blkno 9384 != new 9384 || old size 4096 != new NUM
|
|
|
|
2 |
1722d |
1722d
|
2/2 |
1717d |
Revert -r359612 as it can cause other panics. An updated version will be made when the issue has been resolved.
|
panic: Duplicate free of ADDR from zone ADDR(mbuf) slab ADDR(8)
|
C |
|
|
1 |
2107d |
2107d
|
2/2 |
1717d |
3d36b367cfb6
sbappendcontrol() needs to avoid clearing M_NOTREADY on data mbufs.
|
panic: to_ticks == 0 for timer type 2
|
C |
|
|
27 |
1731d |
1734d
|
2/2 |
1731d |
25ec35535397
Handle integer overflows correctly when converting msecs and secs to ticks and vice versa. These issues were caught by recently added panic() calls on INVARIANTS systems.
|
panic: mtx_unlock() of spin mutex (null) @ /syzkaller/managers/i386/kernel/sys/kern/sys_socket.c:LINE
|
|
|
|
1 |
1752d |
1752d
|
2/2 |
1739d |
99258935eb2b
Lock the socket in soo_stat().
|
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet/ip_output.c:LINE
|
syz |
|
|
1870 |
1739d |
1797d
|
2/2 |
1739d |
2bdebd0ce3e0
A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
|
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/ip6_output.c:LINE
|
syz |
|
|
229 |
1740d |
1797d
|
2/2 |
1739d |
2bdebd0ce3e0
A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
|
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet6/ip6_output.c:LINE
|
C |
|
|
591 |
1740d |
1797d
|
2/2 |
1739d |
2bdebd0ce3e0
A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
|
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet/ip_output.c:LINE
|
C |
|
|
2840 |
1740d |
1797d
|
2/2 |
1739d |
2bdebd0ce3e0
A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
|
freebsd boot error: Fatal trap 9: general protection fault in biotrack_buf
|
|
|
|
24 |
1778d |
1778d
|
2/2 |
1740d |
dcebfcf3d468
Revert r357710 and 357711 until they can be debugged
|
panic: Most recently used by ip6opt (2)
|
syz |
|
|
4 |
1743d |
1789d
|
2/2 |
1740d |
e02582d1ae44
Fix synchronization in the IPV6_2292PKTOPTIONS set handler.
|
panic: mutex process lock not owned at /syzkaller/managers/i386/kernel/sys/kern/kern_time.c:LINE
|
C |
|
|
33 |
1783d |
1784d
|
2/2 |
1740d |
55aa9af7e971
Remove unneeded assert for curproc. Simplify.
|
panic: cap_rights_is_vset:LINE (3)
|
|
|
|
1 |
1752d |
1752d
|
2/2 |
1740d |
429537caeb13
kern_dup(): Call filecaps_free_prep() in a write section.
|
panic: refcount ADDR wraparound
|
C |
|
|
6 |
1784d |
1784d
|
2/2 |
1740d |
adbdb897689b
fd: always nullify *fdp in fget* routines
|
panic: mutex process lock not owned at /syzkaller/managers/main/kernel/sys/kern/kern_time.c:LINE
|
C |
|
|
83 |
1783d |
1784d
|
2/2 |
1783d |
55aa9af7e971
Remove unneeded assert for curproc. Simplify.
|
panic: condition !vn_need_pageq_flush(vp) not met at /syzkaller/managers/main/kernel/sys/kern/vfs_subr.c:LINE (vgonel)
|
|
|
|
1 |
1788d |
1788d
|
2/2 |
1788d |
0f4d8b77c02c
vfs: revert the overzealous assert added in r357285 to vgone
|
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/net/if.c:LINE
|
|
|
|
3062 |
1902d |
1903d
|
2/2 |
1798d |
Remove epoch assertion from if_setlladdr(). Originally this function was protected by IF_ADDR_LOCK(), which was a mutex, so that two simultaneous if_setlladdr() can't execute. Later it was switched to IF_ADDR_RLOCK(), likely by a mistake. Later it was switched to NET_EPOCH_ENTER(). Then I incorrectly added NET_EPOCH_ASSERT() here.
|
panic: mutex if_addr_lock not owned at /syzkaller/managers/main/kernel/sys/netinet/in_mcast.c:LINE
|
|
|
|
1 |
1819d |
1819d
|
2/2 |
1805d |
31069f383af1
Take the ifnet's address lock in igmp_v3_cancel_link_timers().
|
panic: pipe_destroy_write_buffer: pipe map for ADDR contains residual data
|
syz |
|
|
11 |
1877d |
1921d
|
2/2 |
1868d |
1cbfe73da570
Fix handling of PIPE_EOF in the direct write path.
|
panic: mutex pcbinfohash not owned at /syzkaller/managers/main/kernel/sys/netinet6/in6_pcb.c:LINE
|
C |
|
|
5 |
1871d |
1872d
|
2/2 |
1869d |
c17cd08f5302
It is unclear why in6_pcblookup_local() would require write access to the PCB hash. The function doesn't modify the hash. It always asserted write lock historically, but with epoch conversion this fails in some special cases.
|
panic: in_pcb_lport: laddrp NULL for v4 inp ADDR
|
C |
|
|
8 |
1914d |
2030d
|
2/2 |
1887d |
4a91aa8fc9b6
Ensure that the flags indicating IPv4/IPv6 are not changed by failing bind() calls. This would lead to inconsistent state resulting in a panic. A fix for stable/11 was committed in https://svnweb.freebsd.org/base?view=revision&revision=338986 An accelerated MFC is planned as discussed with emaste@.
|
panic: Assertion td->td_epochnest failed at /syzkaller/managers/i386/kernel/sys/kern/subr_epoch.c:LINE
|
|
|
|
3 |
1902d |
1902d
|
2/2 |
1895d |
ip6_output() has a complex set of gotos, and some can jump out of the epoch section towards return statement. Since entering epoch is cheap, it is easier to cover the whole function with epoch, rather than try to properly maintain its state.
|
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet/igmp.c:LINE
|
|
|
|
2 |
1902d |
1902d
|
2/2 |
1895d |
7299f8c33d62
Enter network epoch in domain callouts.
|
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/in6_ifattach.c:LINE
|
syz |
|
|
2 |
1901d |
1901d
|
2/2 |
1895d |
in6ifa_llaonifp() is never called from fast path, so do not require epoch being entered.
|
Fatal trap 12: page fault in uipc_send
|
syz |
|
|
123 |
1903d |
2035d
|
2/2 |
1902d |
4013d7268446
Fix handling of empty SCM_RIGHTS messages.
|
freebsd boot error: panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/net/if.c:LINE
|
|
|
|
18 |
1903d |
1903d
|
2/2 |
1903d |
In DIAGNOSTIC block of if_delmulti_ifma_flags() enter the network epoch. This quickly plugs the regression from r353292. The locking of multicast definitely needs a broader review today...
|
Fatal trap 18: integer divide fault in kern_fcntl
|
|
|
|
22 |
1927d |
1953d
|
2/2 |
1909d |
4a7b33ecf4d8
Disallow fcntl(F_READAHEAD) when the vnode is not a regular file.
|
panic: rcv_start < rcv_end
|
|
|
|
1 |
1934d |
1934d
|
2/2 |
1910d |
Only update SACK/DSACK lists when a non-empty segment was received. This fixes hitting a KASSERT with a valid packet exchange.
|
Fatal trap 12: page fault in inp_freemoptions (2)
|
syz |
|
|
14 |
2020d |
2030d
|
2/2 |
1911d |
Convert all IPv4 and IPv6 multicast memberships into using a STAILQ instead of a linear array.
|
panic: vm_page_swapqueue: page ADDR is unmanaged
|
|
|
|
1 |
1921d |
1921d
|
2/2 |
1914d |
3a79b409bb89
Fix a race in vm_page_swapqueue().
|
freebsd boot error: panic: sched_pickcpu: Failed to find a cpu.
|
|
|
|
30 |
1916d |
1917d
|
2/2 |
1916d |
967c0718849e
Fix wrong assertion in r352658.
|
panic: m_getm2: len is < 0
|
syz |
|
|
13 |
2103d |
2108d
|
2/2 |
1917d |
2ef5bd2f0c46
Limit the number of bytes which can be queued for SCTP sockets. This is joint work with rrs@. Reported by: syzbot+307f167f9bc214f095bc@syzkaller.appspotmail.com MFC after: 1 week
|
panic: indir_trunc: Bad indirdep 0 from buf ADDR
|
|
|
|
1 |
2028d |
2028d
|
2/2 |
1973d |
577fca0e204d
Lock the vnode before calling ufs_bmap_seekdata().
|
panic: ffs_blkfree_cg: freeing free block (2)
|
|
|
|
2 |
2044d |
2064d
|
2/2 |
1973d |
577fca0e204d
Lock the vnode before calling ufs_bmap_seekdata().
|
Fatal trap 9: general protection fault in sctp_copy_skeylist
|
syz |
|
|
3 |
2027d |
2027d
|
2/2 |
1988d |
8a956abe12c6
When calling sctp_initialize_auth_params(), the inp must have at least a read lock. To avoid more complex locking dances, just call it in sctp_aloc_assoc() when the write lock is still held.
|
panic: udp6_output: non-excl udbinfo lock, excl inp lock: pcbinfo ADDR 0x1 inp ADDR 0x2
|
|
|
|
1 |
2010d |
2010d
|
2/2 |
1990d |
9e44bc22d884
r348494 fixes a race in udp_output(). The same race exists in udp_output6(), therefore apply a similar patch to IPv6.
|
panic: Most recently used by tty
|
syz |
|
|
24 |
2041d |
2056d
|
2/2 |
1998d |
6a01874c5afa
Defer funsetown() calls for a TTY to tty_rel_free().
|
freebsd boot error: panic: Bad entry start/end for new stack entry
|
|
|
|
9 |
2008d |
2008d
|
2/2 |
2001d |
639f3e01b444
Revert r349393, which leads to an assertion failure on bootup, in vm_map_stack_locked.
|
panic: cap_rights_is_vset:LINE
|
syz |
|
|
3 |
2023d |
2023d
|
2/2 |
2003d |
7c3703a69466
Use a consistent snapshot of the fd's rights in fget_mmap().
|
Fatal trap 12: page fault in vm_page_unhold_pages
|
C |
|
|
1169 |
2011d |
2106d
|
2/2 |
2003d |
02476c44c5eb
Fix mutual exclusion in pipe_direct_write().
|
panic: udp_output: shared udbinfo lock, excl inp lock (2)
|
syz |
|
|
7 |
2045d |
2064d
|
2/2 |
2031d |
eafaa1bc35e9
After parts of the locking fixes in r346595, syzkaller found another one in udp_output(). This one is a race condition. We do check on the laddr and lport without holding a lock in order to determine whether we want a read or a write lock (this is in the "sendto/sendmsg" cases where addr (sin) is given).
|
Fatal trap 12: page fault in inp_freemoptions
|
C |
|
|
11 |
2052d |
2105d
|
1/2 |
2049d |
5a1e222bfda7
Close some races in multicast socket option handling.
|
panic: inp_leave_group: imf_sources not empty
|
C |
|
|
6 |
2052d |
2073d
|
1/2 |
2049d |
5a1e222bfda7
Close some races in multicast socket option handling.
|
panic: vm_object_vndeallocate: bad object reference count
|
C |
|
|
974 |
2050d |
2051d
|
1/2 |
2050d |
8cd6a80d7d68
Restore the pre-r347532 behaviour of ignoring wiring failures in mmap().
|
panic: ffs_blkfree_cg: freeing free block
|
C |
|
|
5 |
2107d |
2108d
|
1/2 |
2065d |
a7a455c299b0
Optimize lseek(SEEK_DATA) on UFS.
|
panic: udp_output: shared udbinfo lock, excl inp lock
|
C |
|
|
46 |
2072d |
2110d
|
1/2 |
2071d |
d86ecbe993a7
iFix udp_output() lock inconsistency.
|
Fatal trap 12: page fault in in6_cksum_partial
|
syz |
|
|
6 |
2075d |
2105d
|
1/2 |
2075d |
70a0f3dcdc1f
When a checksum has to be computed for a received IPv6 packet because it is requested by the application using the IPPROTO_IPV6 level socket option IPV6_CHECKSUM on a raw socket, ensure that the packet contains enough bytes to contain the checksum at the specified offset.
|
panic: rtrequest1_fib: locked
|
C |
|
|
10 |
2082d |
2107d
|
1/2 |
2080d |
e6481fd4c46a
When sending a routing message, don't allow the user to set the RTF_RNH_LOCKED flag in rtm_flags, since this flag is used only internally.
|
panic: inp_join_group: imf_sources not empty
|
C |
|
|
398 |
2083d |
2110d
|
1/2 |
2083d |
f1ef572a1ecd
Reinitialize multicast source filter structures after invalidation.
|
Fatal trap 12: page fault in __mtx_assert
|
syz |
|
|
4 |
2101d |
2102d
|
1/2 |
2099d |
7854c63d6fbe
Fix a small bug in the tcp_log_id where the bucket was unlocked and yet the bucket-unlock flag was not changed to false. This can cause a panic if INVARIANTS is on and we go through the right path (though rare).
|
panic: Can't clear local locks with F_UNLCKSYS
|
C |
|
|
9 |
2100d |
2109d
|
1/2 |
2099d |
fd76e780a7c0
Reject F_SETLK_REMOTE commands when sysid == 0.
|
panic: Counter goes negative
|
C |
|
|
2 |
2107d |
2107d
|
1/2 |
2101d |
0d3cf13dabf8
Fix a signed/unsigned bug when receiving SCTP messages. This is joint work with rrs@.
|
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 24 - 0 != 60
|
C |
|
|
2 |
2108d |
2108d
|
1/2 |
2102d |
05fb056c068d
Fix a KASSERT() in tcp_output().
|
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 28 - 0 != 60
|
|
|
|
1 |
2105d |
2105d
|
1/2 |
2102d |
05fb056c068d
Fix a KASSERT() in tcp_output().
|
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 12 - 0 != 60
|
|
|
|
1 |
2110d |
2110d
|
1/2 |
2102d |
05fb056c068d
Fix a KASSERT() in tcp_output().
|
panic: pmap_demote_pde: page table page for a wired mapping is missing
|
C |
|
|
56 |
2104d |
2108d
|
1/2 |
2104d |
64087fd7f372
Disallow preemptive creation of wired superpage mappings.
|
panic: invalid dst page ADDR
|
C |
|
|
33 |
2105d |
2110d
|
1/2 |
2105d |
45d72c7d7fca
vm_fault_copy_entry: accept invalid source pages.
|