Applied filters: WithRepro (drop)

Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Closed	Patch
panic: size_on_reasm_queue is NUM (4)	2	syz, C			5	923d	1001d	0/2	never	429f2fb48b92 sctp: hold tcp lock when calling sctp_calc_rwnd()
panic: m_apply, length > size of mbuf chain (NUM extra)	2	syz, C			3	449d	449d	0/2	never	1f5b1de1fdf2 ipv6: account for jumbo payload option
Fatal trap NUM: page fault in __mtx_lock_flags (5)	-1	syz, C			3	346d	380d	2/2	336d	9d9fa9a2c22f unix: Fix handling of listening sockets during garbage collection
panic: freevnode: cannot lock vp ADDR for pollinfo destroy	2	syz, C			4	389d	398d	2/2	339d	99cb3dca4773 vnode: Rework vput() to avoid holding the vnode lock after decrementing
panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	2	syz, C			9	416d	432d	2/2	365d	4548b9f3a816 unix/stream: plug a corner case when control externalization failed
panic: kern_clock_gettime: NUM	2	syz, C			88	436d	488d	2/2	435d	7556b55f0d67 time: Handle kern_clock_gettime() failures in kern_clock_nanosleep()
panic: Assertion too many supplementary groups failed at /syzkaller/managers/main/kernel/sys/kern/kern_prot.c:LINE	2	syz			227	437d	442d	2/2	437d	28f618fcc2b4 kern: fix a panic in crcopysafe() found by syzkaller
panic: handle_workitem_remove: bad file delta	2	syz, C			91	443d	444d	2/2	443d	2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: Assertion ip->i_mode != NUM failed at /syzkaller/managers/main/kernel/sys/ufs/ffs/ffs_softdep.c:LINE	2	syz, C			244	443d	444d	2/2	443d	2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
Fatal trap NUM: page fault in _vn_lock	-1	syz, C			561	469d	470d	2/2	469d	5ae9f8e9ac5e md: Restore guards in mddestroy()
Fatal trap NUM: page fault in destroy_indir	-1	syz, C			503	469d	470d	2/2	469d	5ae9f8e9ac5e md: Restore guards in mddestroy()
Fatal trap NUM: page fault in in_pcbremhash_locked	-1	syz, C			219	486d	602d	2/2	486d	ba3d547967c8 tcp: Fix the SO_REUSEPORT_LB check
panic: mutex so_rcv not owned at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	2	syz, C			7	521d	523d	2/2	510d	c44d6f43a68f unix/stream: provide uipc_cantrcvmore()
panic: sofree:NUM curvnet is NULL, so=ADDR	2	syz, C			49	527d	529d	2/2	527d	9a7d03c7df35 sendfile: cover the entire sendfile operation under CURVNET_SET()
panic: aio_process_rw: opcode NUM	2	syz, C			2	532d	532d	2/2	531d	ab01a5f5628e aio: Fix opcode handling in aio_process_rw()
panic: vm_pager_assert_in: page ADDR is mapped (2)	2	syz, C			3	540d	543d	2/2	540d	1cce7d86c86a vm_map: fix iterator jump size
panic: ktls_frame: mapped mbuf ADDR (top = ADDR)	2	syz, C			4	545d	545d	2/2	541d	1000cc4a0d39 so_splice: Disallow splicing with KTLS-enabled sockets
panic: _pctrie_lookup_node: freed node in iter path	2	syz, C			5	545d	546d	2/2	544d	bcd96c3180d6 vm_object: reset iter in page_clean
panic: neg writecount increment NUM + -NUM = -NUM	2	syz, C			2	554d	554d	2/2	551d	509189bb4109 fhopen: Enable handling of O_PATH, fix some bugs
panic: unhandled af NUM (2)	2	syz, C			5	554d	555d	2/2	553d	646b453110aa pf: fix pf_ioctl_add_addr() validation
panic: ASan: Invalid access, NUM-byte read at ADDR, StackMiddle(f2) (2)	2	syz, C			16	909d	1453d	2/2	564d	68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: ASan: Invalid access, NUM-byte read at ADDR, UseAfterScope(f8) (2)	2	syz, C			452	909d	1607d	2/2	564d	68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: ASan: Invalid access, NUM-byte read at ADDR, StackRight(f3)	2	syz			3	920d	924d	2/2	564d	68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: Assertion M_WRITABLE(m0) failed at /syzkaller/managers/main/kernel/sys/kern/uipc_mbuf.c:LINE	2	syz, C			40	764d	765d	2/2	566d	299175f2e52e Revert "Assert that mbufs are writable if we write to them"
panic: nl_buf_alloc: invalid length ADDR	2	syz, C			2	595d	595d	2/2	594d	a80bbc4e9597 netlink: refuse a send(2) that is larger than socket buffer
Fatal trap NUM: page fault in rtsock_msg_buffer	-1	syz, C			9	697d	700d	2/2	696d	dae64402b3e8 rtsock: fix panic in rtsock_msg_buffer()
Fatal trap NUM: general protection fault in rtsock_msg_buffer	-1	syz			1	697d	697d	2/2	696d	dae64402b3e8 rtsock: fix panic in rtsock_msg_buffer()
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM (2)	2	syz, C			70	885d	931d	2/2	809d	71867653008c udp: improve handling of cached route
Fatal trap NUM: page fault in strlcpy	-1	syz, C			3	920d	920d	2/2	919d	b112232e4fb9 uipc_shm: Copyin userpath for ktrace(2)
panic: Unaligned free of ADDR from zone ADDR(mbuf) slab ADDR(NUM)	2	syz, C			28	920d	921d	2/2	920d	fb8a8333b481 unix: return immediately on MSG_OOB
Fatal trap NUM: page fault in uipc_soreceive_stream_or_seqpacket	-1	syz, C			3	920d	921d	2/2	920d	d1cbb17a873c unix: fix the ad hoc STAILQ_PREPEND()
panic: Assertion size > NUM failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE	2	syz, C			69	941d	946d	2/2	941d	b5a9299bb8b9 ktls: catch invalid parameters earlier
panic: lock (sleep mutex) sctp-inp not locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_usrreq.c:LINE	2	syz, C			455	1003d	1003d	2/2	1002d	a079c891c01b sctp: restore missing inpcb lock
panic: sbflush_internal: ccc NUM mb ADDR mbcnt NUM	2	syz, C			3	1015d	1015d	2/2	1011d	59ce044a7856 sockets: on shutdown(2) do sorflush() only in case of generic sockbuf
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM	2	syz, C			4	1047d	1057d	2/2	1018d	7df9da47e8f0 Fix udp IPv4-mapped address
panic: Assertion !(tp->t_flags2 & TF2_HPTS_CPU_SET) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_hpts.c:LIN	2	syz, C			375	1044d	1046d	2/2	1043d	3f46be6acadd tcp_hpts: let tcp_hpts_init() set a random CPU only once
panic: Assertion !tcp_in_hpts(tp) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_subr.c:LINE	2	syz, C			35	1043d	1046d	2/2	1043d	ade05d63b727 tcp: stop stack timers in tcp_switch_back_to_default()
panic: in_pcblookup_hash_locked: invalid local address (2)	2	syz, C			94	1108d	1318d	2/2	1105d	abca3ae7734f udp: fix sending of IPv4-mapped addresses
panic: in_pcblookup_hash_locked: invalid foreign address (2)	2	syz, C			38	1112d	1318d	2/2	1105d	abca3ae7734f udp: fix sending of IPv4-mapped addresses
panic: mbuf:ADDR len:NUM rsm:ADDR oml:NUM soff:NUM	2	syz, C			4	1108d	1158d	2/2	1107d	8818f0f1124e TCP: Fix a rack bug that skyzall found which results in a crash.
panic: Counter goes negative (3)	2	syz, C			595	1130d	1686d	2/2	1129d	bb56b36d7188 sctp: further improve shutting down the read side of a socket
panic: sbflush_internal: residual data (3)	2	syz, C			33	1222d	1588d	2/2	1129d	81c5f0fac91d sctp: improve shutting down the read side of a socket
panic: malloc: called with spinlock or critical section held	2	syz, C			3	1144d	1144d	2/2	1144d	6b635c74fd41 aesni: Push FPU sections down further
panic: sbcut_internal: no next, len NUM	2	syz, C			2	1162d	1162d	2/2	1149d	847fa61fad5e sctp: improve handling of socket shutdown for reading
Fatal trap NUM: page fault in tcp_input_with_port	-1	syz, C			6	1193d	1233d	2/2	1177d	a43e7a96b64e inpcb: use internal flag to mark pcbs that are inserted into lbgroup
panic: in_pcbconnect: inp is already connected	2	syz, C			2	1218d	1218d	2/2	1211d	de0a2eb2ef86 tcp: Disallow connecting a disconnected socket
panic: lock (sleep mutex) unp not locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	2	syz, C			2	1213d	1213d	2/2	1212d	712079d38106 unix: Fix uipc_peeraddr() to handle self-connected sockets
panic: in6_pcblookup_hash_locked: invalid local address	2	syz			37	1334d	1350d	2/2	1313d	aa71d6b4a2ec netinet: Disallow unspecified addresses in ICMP-embedded packets
panic: in_pcblookup_hash_locked: invalid local address	2	syz			165751	1319d	1350d	2/2	1319d	713264f6b8bc netinet: Tighten checks for unspecified source addresses
panic: in_pcblookup_hash_locked: invalid foreign address	2	syz			152	1319d	1350d	2/2	1319d	713264f6b8bc netinet: Tighten checks for unspecified source addresses
Fatal trap NUM: page fault in sctp_notify_stream_reset_tsn	-1	syz			2	1352d	1352d	2/2	1351d	7b2f1a7fe944 sctp: improve delivery of stream reset notifications
Fatal trap NUM: page fault in kern_cpuset_getid	-1	syz, C			3	1355d	1355d	2/2	1354d	2058f075b4af cpuset: Handle CPU_WHICH_TIDPID wherever cpuset_which() is called.
panic: Assertion sb->sb_hiwat >= sb->uxdg_cc failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	2	syz, C			2	1519d	1519d	2/2	1512d	820bafd0bc14 unix/dgram: don't panic if socket buffer has negative space
Fatal trap NUM: page fault in key_attach	-1	syz, C			117	1526d	1527d	2/2	1526d	b7bf3cb07fcf keysock: explicitly initialized LIST_HEAD
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2)	2	syz, C			3	1633d	1656d	2/2	1528d	bb995f2ef0e7 sctp: improve handling of send() calls with no user data`
panic: seq_out not found rack:ADDR tp:ADDR	2	syz, C			108	1553d	1950d	2/2	1550d	5b741298b11c tcp rack: fix switching to RACK when FIN has been sent
Fatal trap NUM: page fault in soclose	-1	syz, C			245	1571d	1575d	2/2	1571d	bafe71fd2720 sctp: do not clobber listening socket with sockbuf operations
panic: Assertion v != tid failed at /syzkaller/managers/main/kernel/sys/kern/kern_mutex.c:LINE	2	syz, C			245	1586d	2227d	2/2	1585d	a14465e1b9a5 rip6: Fix a lock order reversal in rip6_bind()
panic: Assertion v != tid failed at /syzkaller/managers/i386/kernel/sys/kern/kern_mutex.c:LINE	2	syz			115	1590d	2221d	2/2	1585d	a14465e1b9a5 rip6: Fix a lock order reversal in rip6_bind()
panic: Thread not suspended	2	syz			30	1587d	1632d	2/2	1585d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Assertion TD_CAN_RUN(td) failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:LINE	2	syz, C			1	1632d	1632d	2/2	1585d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: td ADDR is not suspended	2	syz, C			11	1587d	1632d	2/2	1585d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: already suspended	2	syz, C			130	1585d	1632d	2/2	1585d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Lock pf config not exclusively locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:LINE	2	syz, C			142	1619d	1663d	2/2	1586d	826c58d6656c pf: add missing unlock on error in DIOCCHANGERULE
panic: sctp_inpcb_free: inp ADDR still has socket	2	syz			12	1624d	1813d	2/2	1594d	a5c2009dd8ab sctp: improve handling of sctp inpcb flags
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT (2)	-1	syz, C			27	1601d	1617d	2/2	1598d	a3d974082549 pf: make sure the rule tree is allocated in DIOCCHANGERULE
panic: sbflush_internal: residual data (2)	2	syz, C			263	1601d	1863d	2/2	1600d	a6a596e102be sctp: improve handling of listen() call
panic: Warning: Last msg marked incomplete, yet nothing left? (2)	2	syz, C			3	1602d	1611d	2/2	1601d	2646cd085850 sctp: use a consistent view of the send parameters
panic: Queues are not empty when handling SHUTDOWN-COMPLETE	2	syz, C			17	1639d	2169d	2/2	1601d	64b297e803bd sctp: improve handling of send() when association is shutdown
panic: sctp: no chunks on the queues (2)	2	syz			1813	1602d	2246d	2/2	1601d	2646cd085850 sctp: use a consistent view of the send parameters
panic: Assertion clen >= sizeof(*cm) && clen <= cm->cmsg_len failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usr	2	syz, C			6	1604d	1604d	2/2	1603d	75e7e3ce34d9 unix: fix incorrect assertion in 4682ac697ce
Fatal trap NUM: page fault in sctp_wakeup_the_read_socket (3)	-1	syz			3	1634d	1640d	2/2	1632d	490a0f77de77 sctp: improve locking
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd) (2)	2	syz, C			7	1641d	1643d	2/2	1641d	a12d89332efe sctp: hold the inp lock while calling ip6_output
Fatal trap NUM: page fault in __mtx_lock_flags (2)	-1	syz, C			2	1653d	1653d	2/2	1643d	3dc57df91e65 sctp: don't wakeup 1-to-1 listening sockets for data or notifications
panic: ASan: Invalid access, NUM-byte read in sctp_med_chunk_output	2	syz, C			180	1797d	1854d	2/2	1644d	eeba22217217 sctp: don't keep a pointer to a freed stcb around
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd)	2	syz, C			515	1644d	1764d	2/2	1644d	eeba22217217 sctp: don't keep a pointer to a freed stcb around
panic: ASan: Invalid access, 4-byte write at ADDR, UMAUseAfterFree(fd)	2	syz, C			462	1660d	1926d	2/2	1657d	52106f072fd0 sctp: don't refer to a potentially outdated stream
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT	-1	syz, C			81	1661d	1663d	2/2	1661d	e123e2294cb5 pf: guard against DIOCADDRULE without DIOCXBEGIN
panic: Don't own TCB send lock	2	syz, C			8016	1662d	1846d	2/2	1662d	5ac91821f5d7 sctp: get rid of stcb send lock
panic: Association about to be freed (2)	2	syz, C			4834	1662d	1699d	2/2	1662d	5ac91821f5d7 sctp: get rid of stcb send lock
panic: hold_tcblock is false	2	syz, C			468	1699d	1699d	2/2	1699d	e255f0c9fbd2 sctp: make sure new locking requirements are satisfied.
panic: Association about to be freed	2	syz, C			57	1699d	1699d	2/2	1699d	bdb99f6f5e31 sctp: remove KASSERT() which not always holds
panic: create_lock_applied is true	2	syz, C			104	1699d	1699d	2/2	1699d	2f0656fb9ba2 sctp: don't hold the assoc create lock longer than needed
Fatal trap NUM: page fault in inp_next	-1	syz			3	1752d	1758d	2/2	1749d	430df2abee90 in_pcb: improve inp_next()
panic: mutex blocked lock not owned at /syzkaller/managers/main/kernel/sys/kern/sched_ule.c:LINE	2	syz, C			33	1749d	1750d	2/2	1749d	6b95cf5bdedc callout: Wait for the softclock thread to switch before rescheduling
Fatal trap NUM: page fault in tcp_usr_send	-1	syz			1	1753d	1753d	2/2	1752d	4287aa56197f tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
panic: overhead (NUM) not a multiple of NUM	2	syz, C			248	1753d	1753d	2/2	1753d	ca0dd19f0933 sctp: check that the computed frag point is a multiple of 4
Fatal trap NUM: page fault in tcp_usr_shutdown	-1	syz, C			5	1753d	1754d	2/2	1753d	4287aa56197f tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
Fatal trap NUM: page fault in tcp_usr_rcvd	-1	syz, C			7	1754d	1754d	2/2	1753d	37a7f5573716 tcp_usr_rcvd: don't cast inp_ppcb to tcpcb before checking inp_flags
panic: m_apply, offset > size of mbuf chain	2	syz, C			2	1760d	1760d	2/2	1753d	989453da0589 sctp: cleanup the SCTP_MAXSEG socket option.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/net/if.c:LINE (2)	2	syz, C			314	1763d	1767d	2/2	1763d	9f5432d5e5f0 netinet6: ip6_setpktopt() requires NET_EPOCH
panic: ASan: Invalid access, 2-byte read at ADDR, UMAUseAfterFree(fd)	2	syz, C			1103	1764d	1925d	2/2	1764d	014f98b11992 udp: Fix a use-after-free in udp_multi_input()
Fatal trap NUM: page fault in memcpy_erms	-1	syz, C			306	1765d	1772d	2/2	1765d	aa2681752d0d cryptosoft: Don't treat CRYPTO_NULL_HMAC as an hmac algorithm.
Fatal trap NUM: page fault in filt_bpfwrite	-1	syz, C			4	1823d	1829d	2/2	1815d	426682b05a4c bpf: Fix the write filter for detached descriptors
panic: ASan: Invalid access, NUM-byte read in newreno_cong_signal	2	syz, C			4	1817d	1819d	2/2	1816d	b15b0535968e tcp: allow new reno functions to be called from other CC modules
panic: Assertion (cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == NUM failed at /syzkaller/managers/main/kernel/sys/kern/v	2	syz, C			87	1825d	1825d	2/2	1825d	1045352f1503 cache: only assert on flags when dealing with EMPTYPATH
panic: TLS trailer length too long: NUM	2	syz, C			2	1833d	1833d	2/2	1828d	a63752cce646 ktls: Reject attempts to enable AES-CBC with TLS 1.3.
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (4)	2	syz, C			147	1927d	2150d	2/2	1852d	34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
Fatal trap 12: page fault while in kernel mode (3)	-1	syz, C			140	1854d	2461d	2/2	1854d	ade1daa5c0d6 socket: Synchronize soshutdown() with listen(2) and AIO
Fatal trap 12: page fault in soo_aio_queue	-1	syz, C			349	1855d	1959d	2/2	1854d	ade1daa5c0d6 socket: Synchronize soshutdown() with listen(2) and AIO
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE	2	syz, C			3	1867d	1931d	2/2	1858d	e6c19aa94da4 sctp: Allow blocking on I/O locks even with non-blocking sockets
Fatal trap 12: page fault in __mtx_lock_flags	-1	syz, C			1065	1860d	2359d	2/2	1860d	2d5c48eccd9f sctp: Tighten up locking around sctp_aloc_assoc()
panic: unexpected security protocol NUM	2	syz			7	1863d	1878d	2/2	1861d	10eb2a2bde61 ipsec: Validate the protocol identifier in ipsec4_ctlinput()
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2)	2	syz, C			109	1864d	1959d	2/2	1861d	141fe2dceeae aio: Interlock with listen(2)
panic: Assertion owner->td_proc->p_magic == P_MAGIC failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:	2	syz, C			46	1925d	2180d	2/2	1861d	141fe2dceeae aio: Interlock with listen(2)
panic: Lock sctp-info not exclusively locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:LINE	2	syz, C			363	1862d	1863d	2/2	1862d	0c1a20beb456 sctp: use appropriate argument when freeing association
Fatal trap 9: general protection fault in strlen	-1	syz, C			1506	1928d	2686d	2/2	1862d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: mtx_lock() of destroyed mutex at sys/kern/uipc_sockbuf.c:LINE	2	syz			4	2013d	2203d	2/2	1862d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: mutex so_snd not owned at /syzkaller/managers/i386/kernel/sys/kern/uipc_sockbuf.c:LINE	2	syz			1	2157d	2157d	2/2	1862d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.	2	syz, C			131	1864d	1864d	2/2	1863d	6e3af6321ba4 sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/netinet/tcp_output.c:LINE	2	syz			707	1887d	2772d	2/2	1864d	bd4a39cc93d9 socket: Properly interlock when transitioning to a listening socket
panic: ASan: Invalid access, NUM-byte read in strncmp	2	syz, C			12	1865d	1869d	2/2	1865d	5402baa5b5d1 g_label: Handle small sector sizes when tasting
Fatal trap 9: general protection fault in sctp_free_assoc	-1	syz			14	1932d	2241d	2/2	1871d	d35be50f5779 sctp: Hold association locks across socket wakeups when freeing
Fatal trap 9: general protection fault in itimer_proc_continue	-1	syz			2	1965d	1965d	2/2	1871d	3138392a46a4 itimer: Serialize access to the p_itimers array
panic: ASan: Invalid access, 1-byte read in g_raid_md_taste_ddf	2	syz, C			18	1876d	1923d	2/2	1871d	9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: ASan: Invalid access, 2-byte read in g_raid_md_taste_sii	2	syz, C			7	1884d	1910d	2/2	1871d	9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: Bad list head ADDR first->prev != head	2	syz, C			3409	1872d	2769d	2/2	1872d	4a36122b1db1 sctp: Fix racy UNBOUND flag check in sctp_inpcb_bind()
panic: ASan: Invalid access, 16-byte read in aesni_encrypt_icm	2	syz, C			114	1874d	1924d	2/2	1872d	564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: Assertion lock == sq->sq_lock failed at /syzkaller/managers/main/kernel/sys/kern/subr_sleepqueue.c:LINE (2)	2	syz, C			7	1929d	1952d	2/2	1886d	c4feb1ab0ae0 sigtimedwait: Use a unique wait channel for sleeping
panic: ASan: Invalid access, 4-byte read in sctp_sosend	2	syz, C			518	1896d	1924d	2/2	1896d	b732091a761a sctp: improve input validation of mapped addresses in send() Reported by: syzbot+35528f275f2eea6317cc@syzkaller.appspotmail.com Reported by: syzbot+ac29916d5f16d241553d@syzkaller.appspotmail.com MFC after: 3 days
panic: ASan: Invalid access, 4-byte read in tcp_usr_bind	2	syz, C			50	1898d	1922d	2/2	1898d	3f1f6b6ef7f6 tcp, udp: improve input validation in handling bind()
panic: ASan: Invalid access, 4-byte read in udp_bind	2	syz, C			69	1898d	1923d	2/2	1898d	3f1f6b6ef7f6 tcp, udp: improve input validation in handling bind()
panic: pmap_growkernel: no memory to grow kernel (2)	2	syz			299	1900d	2361d	2/2	1898d	600745f1e226 pf: bound DIOCGETSTATES memory use
panic: pmap_kasan_enter_alloc_4k: no memory to grow shadow map	2	syz, C			20	1901d	1920d	2/2	1898d	600745f1e226 pf: bound DIOCGETSTATES memory use
panic: vm_fault_lookup: fault on nofault entry, addr: ADDR (2)	2	syz, C			75	1937d	1980d	2/2	1906d	64432ad2a2c4 pf: Validate user string nul-termination before copying
panic: Assertion (cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0 failed at /syzkaller/managers/main/kernel/sys/kern/vfs	2	syz, C			4	1983d	1983d	2/2	1923d	6de3cf14c47d vn_open_cred(): disallow O_CREAT | O_EMPTY_PATH
panic: thread_lock() of sleep mutex ` @ /syzkaller/managers/main/kernel/sys/kern/kern_switch.c:LINE	2	syz, C			1	1966d	1966d	2/2	1963d	4a59cbc12532 amd64: Avoid enabling interrupts when handling kernel mode prot faults
Fatal trap 12: page fault in rack_process_to_cumack (2)	-1	syz			3	1971d	1971d	2/2	1969d	13c0e198ca27 tcp: Fix bugs related to the PUSH bit and rack and an ack war
panic: refcount ADDR wraparound (3)	2	syz, C			9	1972d	1972d	2/2	1972d	6f6cd1e8e8aa ktrace: Remove vrele() at the end of ktr_writerequest()
Fatal trap 9: general protection fault in rack_ctloutput	-1	syz			2	1975d	1975d	2/2	1973d	8923ce630492 tcp: Handle stack switch while processing socket options
panic: ktrace_enter: flag set	2	syz, C			44	1973d	1974d	2/2	1973d	e4b16f2fb18b ktrace: Avoid recursion in namei()
panic: Memory modified after free ADDR(4096) val=ADDR @ ADDR	2	syz, C			1	1978d	1978d	2/2	1974d	500eb6dd8040 tcp: Fix sending of TCP segments with IP level options
panic: releasing active pmap ADDR	2	syz, C			11	1983d	2026d	2/2	1981d	9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
panic: pmap active ADDR	2	syz, C			5	1989d	2026d	2/2	1981d	9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
Fatal trap 18: integer divide fault in realtimer_expire_l	-1	syz, C			15	1983d	2010d	2/2	1981d	8b3c4231abf0 posix timers: Check for overflow when converting to ns
Fatal trap 18: integer divide fault in realtimer_expire	-1	syz, C			20	2013d	2034d	2/2	1981d	8b3c4231abf0 posix timers: Check for overflow when converting to ns
panic: crp_iv_start set when IV isn't used	2	syz, C			2	1986d	1987d	2/2	1983d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: IV outside buffer length	2	syz, C			16	1983d	1989d	2/2	1983d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: More encryption data than allowed	2	syz, C			2	1984d	1984d	2/2	1983d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: AEAD without a separate IV	2	syz, C			25	1983d	1989d	2/2	1983d	1a04f0156c4e cryptodev: Fix some input validation bugs
Fatal trap 12: page fault in memcpy_erms	-1	syz, C			2	1984d	1984d	2/2	1983d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: IV_SEPARATE set when IV isn't used	2	syz, C			4	1984d	1987d	2/2	1983d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/main/kernel/sys/kern/kern_sig	2	syz			2	2012d	2012d	2/2	1983d	5cc1d199412e realtimer_expire: avoid proc lock recursion when called from itimer_proc_continue()
Fatal trap 12: page fault in pmap_kextract (2)	-1	syz, C			8	2013d	2014d	2/2	2013d	5e98cae661f3 pf: Ensure that we don't use kif passed to pfi_kkif_attach()
panic: to_ticks == 0 for timer type 5 (2)	2	syz			2	2035d	2035d	2/2	2033d	d995cc7e5431 sctp: fix handling of RTO.initial of 1 ms
panic: to_ticks == 0 for timer type 5	2	syz, C			2	2061d	2061d	2/2	2056d	70e95f0b6917 sctp: avoid integer overflow when starting the HB timer
Fatal trap 12: page fault in sctp_find_alternate_net	-1	syz			131	2063d	2206d	2/2	2062d	b963ce4588b3 sctp: improve computation of an alternate net
panic: pfi_dynaddr_setup: non-NULL dyn (2)	2	syz, C			4	2093d	2094d	2/2	2087d	7a808c5ee329 pf: Improve pf_rule input validation
Fatal trap 12: page fault in copyin_nosmap_erms	-1	syz, C			8	2131d	2177d	2/2	2101d	ea36212bf571 pf: Don't hold PF_RULES_WLOCK during copyin() on DIOCRCLRTSTATS
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/uipc_ktls.c:LINE	2	syz, C			11	2108d	2334d	2/2	2106d	6685e259e319 tcp: don't use KTLS socket option on listening sockets
panic: Memory modified after free ADDR(112) val=ADDR @ ADDR (2)	2	syz			475	2110d	2353d	2/2	2110d	a7aa5eea4fff sctp: improve handling of aborted associations
panic: sched_pickcpu: Failed to find a cpu.	2	syz, C			4	2138d	2138d	2/2	2137d	f1b18a668deb cpuset_set{affinity,domain}: do not allow empty masks
Fatal trap 9: general protection fault in cpuset_setproc	-1	syz			2	2139d	2139d	2/2	2137d	b2780e8537da kern: cpuset: resolve race between cpuset_lookup/cpuset_rel
panic: sleeping without a lock	2	syz, C			29	2143d	2309d	2/2	2142d	34af05ead3cf kern: soclose: don't sleep on SO_LINGER w/ timeout=0
panic: uma_zalloc_debug: called within spinlock or critical section	2	syz, C			9	2149d	2153d	2/2	2148d	e07e3fa3c95c kern: cpuset: drop the lock to allocate domainsets
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (3)	2	syz, C			12	2152d	2153d	2/2	2151d	5d49283f8857 pf: Make tag hashing more robust
panic: spin lock held too long	2	syz, C			1	2162d	2162d	2/2	2157d	a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
Fatal trap 12: page fault in _callout_stop_safe	-1	syz, C			1	2161d	2161d	2/2	2157d	a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
panic: Most recently used by pf_ifnet	2	syz, C			6	2195d	2195d	2/2	2194d	52b83a06184c pf: do not remove kifs that are referenced by rules
Fatal trap 9: general protection fault in sctp_lower_sosend	-1	syz, C			22	2293d	2346d	2/2	2252d	f5d30f7f7606 Improve the handling of concurrent send() calls for SCTP sockets, especially when having the explicit EOR mode enabled.
panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb	2	syz, C			2	2300d	2300d	2/2	2263d	cfae6a92ac01 Remove an incorrect assertion from in6p_lookup_mcast_ifp().
Fatal trap 12: page fault in uipc_ready	-1	syz, C			5	2294d	2322d	2/2	2269d	1b778ba2609f Fix a logic error in uipc_ready_scan().
panic: witness_warn	2	syz			1	2314d	2314d	2/2	2298d	e54b7cd007b5 Fix the cleanup handling in a error path for TCP BBR.
Fatal trap 12: page fault in sctp_find_ifa_in_ep	-1	syz, C			3	2300d	2300d	2/2	2298d	7a3f60e7f571 Fix a bug introduced in https://svnweb.freebsd.org/changeset/base/362173
Fatal trap 12: page fault in sctp_process_control	-1	syz, C			47	2348d	2349d	2/2	2348d	86fd36c502db Fix a copy and paste error introduced in r360878.
Fatal trap 9: general protection fault in sctp_process_control	-1	syz, C			11	2348d	2349d	2/2	2348d	86fd36c502db Fix a copy and paste error introduced in r360878.
panic: pfi_dynaddr_setup: dyn is ADDR (2)	2	syz, C			22	2359d	2370d	2/2	2356d	1ef06ed8def9 pf: Improve DIOCADDRULE validation
panic: mallocarray: ADDR * 1064 overflowed	2	syz, C			3	2367d	2371d	2/2	2364d	a7c8533634ab pf: Improve input validation
panic: pfi_dynaddr_setup: dyn is ADDR	2	syz, C			7	2372d	2376d	2/2	2371d	98582ce38183 pf: Improve ioctl() input validation
panic: Assertion size0 > 0 failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE	2	syz, C			2	2374d	2374d	2/2	2373d	95324dc3f4d2 pf: Do not allow negative ps_len in DIOCGETSTATES
panic: mtx_unlock() of destroyed mutex at sys/kern/sys_socket.c:LINE	2	syz			1	2464d	2464d	2/2	2376d	99258935eb2b Lock the socket in soo_stat().
panic: sbfree: m ADDR !M_NOTREADY	2	syz, C			32	2746d	2771d	2/2	2378d	dde1b5985fcc Properly handle disconnected sockets in uipc_ready().
panic: Duplicate free of ADDR from zone ADDR(mbuf) slab ADDR(8)	2	syz, C			1	2769d	2769d	2/2	2379d	3d36b367cfb6 sbappendcontrol() needs to avoid clearing M_NOTREADY on data mbufs.
panic: to_ticks == 0 for timer type 2	2	syz, C			27	2393d	2396d	2/2	2392d	25ec35535397 Handle integer overflows correctly when converting msecs and secs to ticks and vice versa. These issues were caught by recently added panic() calls on INVARIANTS systems.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet/ip_output.c:LINE	2	syz			1870	2401d	2459d	2/2	2401d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/ip6_output.c:LINE	2	syz			229	2402d	2459d	2/2	2401d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet6/ip6_output.c:LINE	2	syz, C			591	2402d	2459d	2/2	2401d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet/ip_output.c:LINE	2	syz, C			2840	2402d	2459d	2/2	2401d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Most recently used by ip6opt (2)	2	syz			4	2405d	2450d	2/2	2401d	e02582d1ae44 Fix synchronization in the IPV6_2292PKTOPTIONS set handler.
panic: mutex process lock not owned at /syzkaller/managers/i386/kernel/sys/kern/kern_time.c:LINE	2	syz, C			33	2445d	2446d	2/2	2401d	55aa9af7e971 Remove unneeded assert for curproc. Simplify.
panic: refcount ADDR wraparound	2	syz, C			6	2446d	2446d	2/2	2401d	adbdb897689b fd: always nullify *fdp in fget* routines
panic: mutex process lock not owned at /syzkaller/managers/main/kernel/sys/kern/kern_time.c:LINE	2	syz, C			83	2445d	2446d	2/2	2444d	55aa9af7e971 Remove unneeded assert for curproc. Simplify.
panic: pipe_destroy_write_buffer: pipe map for ADDR contains residual data	2	syz			11	2539d	2583d	2/2	2530d	1cbfe73da570 Fix handling of PIPE_EOF in the direct write path.
panic: mutex pcbinfohash not owned at /syzkaller/managers/main/kernel/sys/netinet6/in6_pcb.c:LINE	2	syz, C			5	2532d	2534d	2/2	2531d	c17cd08f5302 It is unclear why in6_pcblookup_local() would require write access to the PCB hash. The function doesn't modify the hash. It always asserted write lock historically, but with epoch conversion this fails in some special cases.
panic: in_pcb_lport: laddrp NULL for v4 inp ADDR	2	syz, C			8	2576d	2692d	2/2	2548d	4a91aa8fc9b6 Ensure that the flags indicating IPv4/IPv6 are not changed by failing bind() calls. This would lead to inconsistent state resulting in a panic. A fix for stable/11 was committed in https://svnweb.freebsd.org/base?view=revision&revision=338986 An accelerated MFC is planned as discussed with emaste@.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/in6_ifattach.c:LINE	2	syz			2	2563d	2563d	2/2	2557d	in6ifa_llaonifp() is never called from fast path, so do not require epoch being entered.
Fatal trap 12: page fault in uipc_send	-1	syz			123	2565d	2697d	2/2	2564d	4013d7268446 Fix handling of empty SCM_RIGHTS messages.
Fatal trap 12: page fault in inp_freemoptions (2)	-1	syz			14	2682d	2692d	2/2	2572d	Convert all IPv4 and IPv6 multicast memberships into using a STAILQ instead of a linear array.
panic: m_getm2: len is < 0	2	syz			13	2765d	2770d	2/2	2579d	2ef5bd2f0c46 Limit the number of bytes which can be queued for SCTP sockets. This is joint work with rrs@. Reported by: syzbot+307f167f9bc214f095bc@syzkaller.appspotmail.com MFC after: 1 week
Fatal trap 9: general protection fault in sctp_copy_skeylist	-1	syz			3	2689d	2689d	2/2	2650d	8a956abe12c6 When calling sctp_initialize_auth_params(), the inp must have at least a read lock. To avoid more complex locking dances, just call it in sctp_aloc_assoc() when the write lock is still held.
panic: Most recently used by tty	2	syz			24	2703d	2718d	2/2	2660d	6a01874c5afa Defer funsetown() calls for a TTY to tty_rel_free().
panic: cap_rights_is_vset:LINE	2	syz			3	2685d	2685d	2/2	2665d	7c3703a69466 Use a consistent snapshot of the fd's rights in fget_mmap().
Fatal trap 12: page fault in vm_page_unhold_pages	-1	syz, C			1169	2673d	2767d	2/2	2665d	02476c44c5eb Fix mutual exclusion in pipe_direct_write().
panic: udp_output: shared udbinfo lock, excl inp lock (2)	2	syz			7	2707d	2725d	2/2	2693d	eafaa1bc35e9 After parts of the locking fixes in r346595, syzkaller found another one in udp_output(). This one is a race condition. We do check on the laddr and lport without holding a lock in order to determine whether we want a read or a write lock (this is in the "sendto/sendmsg" cases where addr (sin) is given).
Fatal trap 12: page fault in inp_freemoptions	-1	syz, C			11	2713d	2767d	1/2	2711d	5a1e222bfda7 Close some races in multicast socket option handling.
panic: inp_leave_group: imf_sources not empty	2	syz, C			6	2714d	2734d	1/2	2711d	5a1e222bfda7 Close some races in multicast socket option handling.
panic: vm_object_vndeallocate: bad object reference count	2	syz, C			974	2712d	2713d	1/2	2712d	8cd6a80d7d68 Restore the pre-r347532 behaviour of ignoring wiring failures in mmap().
panic: ffs_blkfree_cg: freeing free block	2	syz, C			5	2769d	2769d	1/2	2726d	a7a455c299b0 Optimize lseek(SEEK_DATA) on UFS.
panic: udp_output: shared udbinfo lock, excl inp lock	2	syz, C			46	2734d	2772d	1/2	2733d	d86ecbe993a7 iFix udp_output() lock inconsistency.
Fatal trap 12: page fault in in6_cksum_partial	-1	syz			6	2737d	2767d	1/2	2737d	70a0f3dcdc1f When a checksum has to be computed for a received IPv6 packet because it is requested by the application using the IPPROTO_IPV6 level socket option IPV6_CHECKSUM on a raw socket, ensure that the packet contains enough bytes to contain the checksum at the specified offset.
panic: rtrequest1_fib: locked	2	syz, C			10	2743d	2769d	1/2	2742d	e6481fd4c46a When sending a routing message, don't allow the user to set the RTF_RNH_LOCKED flag in rtm_flags, since this flag is used only internally.
panic: inp_join_group: imf_sources not empty	2	syz, C			398	2745d	2772d	1/2	2745d	f1ef572a1ecd Reinitialize multicast source filter structures after invalidation.
Fatal trap 12: page fault in __mtx_assert	-1	syz			4	2763d	2764d	1/2	2761d	7854c63d6fbe Fix a small bug in the tcp_log_id where the bucket was unlocked and yet the bucket-unlock flag was not changed to false. This can cause a panic if INVARIANTS is on and we go through the right path (though rare).
panic: Can't clear local locks with F_UNLCKSYS	2	syz, C			9	2762d	2771d	1/2	2761d	fd76e780a7c0 Reject F_SETLK_REMOTE commands when sysid == 0.
panic: Counter goes negative	2	syz, C			2	2768d	2768d	1/2	2763d	0d3cf13dabf8 Fix a signed/unsigned bug when receiving SCTP messages. This is joint work with rrs@.
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 24 - 0 != 60	2	syz, C			2	2770d	2770d	1/2	2764d	05fb056c068d Fix a KASSERT() in tcp_output().
panic: pmap_demote_pde: page table page for a wired mapping is missing	2	syz, C			56	2766d	2770d	1/2	2765d	64087fd7f372 Disallow preemptive creation of wired superpage mappings.
panic: invalid dst page ADDR	2	syz, C			33	2767d	2772d	1/2	2766d	45d72c7d7fca vm_fault_copy_entry: accept invalid source pages.