Applied filters: WithRepro (drop)

Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Closed	Patch
panic: m_apply, length > size of mbuf chain (NUM extra)	2	syz, C			3	389d	389d	0/2	never	1f5b1de1fdf2 ipv6: account for jumbo payload option
Fatal trap NUM: page fault in __mtx_lock_flags (5)	-1	syz, C			3	285d	320d	2/2	276d	9d9fa9a2c22f unix: Fix handling of listening sockets during garbage collection
panic: freevnode: cannot lock vp ADDR for pollinfo destroy	2	syz, C			4	329d	337d	2/2	278d	99cb3dca4773 vnode: Rework vput() to avoid holding the vnode lock after decrementing
panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	2	syz, C			9	356d	372d	2/2	305d	4548b9f3a816 unix/stream: plug a corner case when control externalization failed
panic: kern_clock_gettime: NUM	2	syz, C			88	376d	427d	2/2	375d	7556b55f0d67 time: Handle kern_clock_gettime() failures in kern_clock_nanosleep()
panic: Assertion too many supplementary groups failed at /syzkaller/managers/main/kernel/sys/kern/kern_prot.c:LINE	2	syz			227	377d	381d	2/2	377d	28f618fcc2b4 kern: fix a panic in crcopysafe() found by syzkaller
panic: handle_workitem_remove: bad file delta	2	syz, C			91	383d	384d	2/2	383d	2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
panic: Assertion ip->i_mode != NUM failed at /syzkaller/managers/main/kernel/sys/ufs/ffs/ffs_softdep.c:LINE	2	syz, C			244	383d	383d	2/2	383d	2bc355c0182a ufs: Pass the new parent inode number to ufs_dirrewrite()
Fatal trap NUM: page fault in _vn_lock	-1	syz, C			561	409d	410d	2/2	409d	5ae9f8e9ac5e md: Restore guards in mddestroy()
Fatal trap NUM: page fault in destroy_indir	-1	syz, C			503	409d	410d	2/2	409d	5ae9f8e9ac5e md: Restore guards in mddestroy()
Fatal trap NUM: page fault in in_pcbremhash_locked	-1	syz, C			219	425d	541d	2/2	425d	ba3d547967c8 tcp: Fix the SO_REUSEPORT_LB check
panic: mutex so_rcv not owned at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	2	syz, C			7	460d	463d	2/2	449d	c44d6f43a68f unix/stream: provide uipc_cantrcvmore()
panic: sofree:NUM curvnet is NULL, so=ADDR	2	syz, C			49	467d	468d	2/2	467d	9a7d03c7df35 sendfile: cover the entire sendfile operation under CURVNET_SET()
panic: aio_process_rw: opcode NUM	2	syz, C			2	472d	472d	2/2	470d	ab01a5f5628e aio: Fix opcode handling in aio_process_rw()
panic: vm_pager_assert_in: page ADDR is mapped (2)	2	syz, C			3	479d	482d	2/2	479d	1cce7d86c86a vm_map: fix iterator jump size
panic: ktls_frame: mapped mbuf ADDR (top = ADDR)	2	syz, C			4	484d	485d	2/2	481d	1000cc4a0d39 so_splice: Disallow splicing with KTLS-enabled sockets
panic: _pctrie_lookup_node: freed node in iter path	2	syz, C			5	484d	485d	2/2	484d	bcd96c3180d6 vm_object: reset iter in page_clean
panic: neg writecount increment NUM + -NUM = -NUM	2	syz, C			2	494d	494d	2/2	491d	509189bb4109 fhopen: Enable handling of O_PATH, fix some bugs
panic: unhandled af NUM (2)	2	syz, C			5	494d	494d	2/2	493d	646b453110aa pf: fix pf_ioctl_add_addr() validation
panic: ASan: Invalid access, NUM-byte read at ADDR, StackMiddle(f2) (2)	2	syz, C			16	849d	1393d	2/2	503d	68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: ASan: Invalid access, NUM-byte read at ADDR, UseAfterScope(f8) (2)	2	syz, C			452	849d	1547d	2/2	503d	68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: ASan: Invalid access, NUM-byte read at ADDR, StackRight(f3)	2	syz			3	859d	863d	2/2	503d	68a3a7fc9483 kasan: fix false-positive kasan_report upon thread reuse
panic: Assertion M_WRITABLE(m0) failed at /syzkaller/managers/main/kernel/sys/kern/uipc_mbuf.c:LINE	2	syz, C			40	704d	704d	2/2	505d	299175f2e52e Revert "Assert that mbufs are writable if we write to them"
panic: nl_buf_alloc: invalid length ADDR	2	syz, C			2	535d	535d	2/2	533d	a80bbc4e9597 netlink: refuse a send(2) that is larger than socket buffer
Fatal trap NUM: page fault in rtsock_msg_buffer	-1	syz, C			9	636d	640d	2/2	635d	dae64402b3e8 rtsock: fix panic in rtsock_msg_buffer()
Fatal trap NUM: general protection fault in rtsock_msg_buffer	-1	syz			1	636d	636d	2/2	635d	dae64402b3e8 rtsock: fix panic in rtsock_msg_buffer()
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM (2)	2	syz, C			70	824d	870d	2/2	748d	71867653008c udp: improve handling of cached route
Fatal trap NUM: page fault in strlcpy	-1	syz, C			3	859d	860d	2/2	858d	b112232e4fb9 uipc_shm: Copyin userpath for ktrace(2)
panic: Unaligned free of ADDR from zone ADDR(mbuf) slab ADDR(NUM)	2	syz, C			28	860d	860d	2/2	859d	fb8a8333b481 unix: return immediately on MSG_OOB
Fatal trap NUM: page fault in uipc_soreceive_stream_or_seqpacket	-1	syz, C			3	860d	860d	2/2	859d	d1cbb17a873c unix: fix the ad hoc STAILQ_PREPEND()
panic: Assertion size > NUM failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE	2	syz, C			69	881d	885d	2/2	881d	b5a9299bb8b9 ktls: catch invalid parameters earlier
panic: lock (sleep mutex) sctp-inp not locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_usrreq.c:LINE	2	syz, C			455	942d	943d	2/2	942d	a079c891c01b sctp: restore missing inpcb lock
panic: sbflush_internal: ccc NUM mb ADDR mbcnt NUM	2	syz, C			3	954d	955d	2/2	950d	59ce044a7856 sockets: on shutdown(2) do sorflush() only in case of generic sockbuf
panic: vtnet_txq_offload_ctx: mbuf ADDR start NUM offset NUM proto -NUM	2	syz, C			4	986d	996d	2/2	957d	7df9da47e8f0 Fix udp IPv4-mapped address
panic: Assertion !(tp->t_flags2 & TF2_HPTS_CPU_SET) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_hpts.c:LIN	2	syz, C			375	983d	986d	2/2	983d	3f46be6acadd tcp_hpts: let tcp_hpts_init() set a random CPU only once
panic: Assertion !tcp_in_hpts(tp) failed at /syzkaller/managers/main/kernel/sys/netinet/tcp_subr.c:LINE	2	syz, C			35	983d	986d	2/2	983d	ade05d63b727 tcp: stop stack timers in tcp_switch_back_to_default()
panic: in_pcblookup_hash_locked: invalid local address (2)	2	syz, C			94	1047d	1258d	2/2	1044d	abca3ae7734f udp: fix sending of IPv4-mapped addresses
panic: in_pcblookup_hash_locked: invalid foreign address (2)	2	syz, C			38	1052d	1258d	2/2	1044d	abca3ae7734f udp: fix sending of IPv4-mapped addresses
panic: mbuf:ADDR len:NUM rsm:ADDR oml:NUM soff:NUM	2	syz, C			4	1048d	1097d	2/2	1047d	8818f0f1124e TCP: Fix a rack bug that skyzall found which results in a crash.
panic: Counter goes negative (3)	2	syz, C			595	1069d	1625d	2/2	1068d	bb56b36d7188 sctp: further improve shutting down the read side of a socket
panic: sbflush_internal: residual data (3)	2	syz, C			33	1161d	1527d	2/2	1069d	81c5f0fac91d sctp: improve shutting down the read side of a socket
panic: malloc: called with spinlock or critical section held	2	syz, C			3	1084d	1084d	2/2	1083d	6b635c74fd41 aesni: Push FPU sections down further
panic: sbcut_internal: no next, len NUM	2	syz, C			2	1102d	1102d	2/2	1088d	847fa61fad5e sctp: improve handling of socket shutdown for reading
Fatal trap NUM: page fault in tcp_input_with_port	-1	syz, C			6	1133d	1173d	2/2	1116d	a43e7a96b64e inpcb: use internal flag to mark pcbs that are inserted into lbgroup
panic: in_pcbconnect: inp is already connected	2	syz, C			2	1158d	1158d	2/2	1150d	de0a2eb2ef86 tcp: Disallow connecting a disconnected socket
panic: lock (sleep mutex) unp not locked @ /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	2	syz, C			2	1152d	1152d	2/2	1152d	712079d38106 unix: Fix uipc_peeraddr() to handle self-connected sockets
panic: in6_pcblookup_hash_locked: invalid local address	2	syz			37	1274d	1290d	2/2	1252d	aa71d6b4a2ec netinet: Disallow unspecified addresses in ICMP-embedded packets
panic: in_pcblookup_hash_locked: invalid local address	2	syz			165751	1258d	1290d	2/2	1258d	713264f6b8bc netinet: Tighten checks for unspecified source addresses
panic: in_pcblookup_hash_locked: invalid foreign address	2	syz			152	1259d	1290d	2/2	1258d	713264f6b8bc netinet: Tighten checks for unspecified source addresses
Fatal trap NUM: page fault in sctp_notify_stream_reset_tsn	-1	syz			2	1291d	1291d	2/2	1291d	7b2f1a7fe944 sctp: improve delivery of stream reset notifications
Fatal trap NUM: page fault in kern_cpuset_getid	-1	syz, C			3	1295d	1295d	2/2	1294d	2058f075b4af cpuset: Handle CPU_WHICH_TIDPID wherever cpuset_which() is called.
panic: Assertion sb->sb_hiwat >= sb->uxdg_cc failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usrreq.c:LINE	2	syz, C			2	1458d	1458d	2/2	1451d	820bafd0bc14 unix/dgram: don't panic if socket buffer has negative space
Fatal trap NUM: page fault in key_attach	-1	syz, C			117	1465d	1466d	2/2	1465d	b7bf3cb07fcf keysock: explicitly initialized LIST_HEAD
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2)	2	syz, C			3	1572d	1596d	2/2	1467d	bb995f2ef0e7 sctp: improve handling of send() calls with no user data`
panic: seq_out not found rack:ADDR tp:ADDR	2	syz, C			108	1492d	1890d	2/2	1489d	5b741298b11c tcp rack: fix switching to RACK when FIN has been sent
Fatal trap NUM: page fault in soclose	-1	syz, C			245	1511d	1514d	2/2	1511d	bafe71fd2720 sctp: do not clobber listening socket with sockbuf operations
panic: Assertion v != tid failed at /syzkaller/managers/main/kernel/sys/kern/kern_mutex.c:LINE	2	syz, C			245	1526d	2166d	2/2	1524d	a14465e1b9a5 rip6: Fix a lock order reversal in rip6_bind()
panic: Assertion v != tid failed at /syzkaller/managers/i386/kernel/sys/kern/kern_mutex.c:LINE	2	syz			115	1529d	2160d	2/2	1524d	a14465e1b9a5 rip6: Fix a lock order reversal in rip6_bind()
panic: Thread not suspended	2	syz			30	1527d	1571d	2/2	1525d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Assertion TD_CAN_RUN(td) failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:LINE	2	syz, C			1	1571d	1571d	2/2	1525d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: td ADDR is not suspended	2	syz, C			11	1526d	1571d	2/2	1525d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: already suspended	2	syz, C			130	1525d	1571d	2/2	1525d	1575804961d2 reap_kill_proc(): avoid singlethreading any other process if we are exiting
panic: Lock pf config not exclusively locked @ /syzkaller/managers/main/kernel/sys/netpfil/pf/pf_ioctl.c:LINE	2	syz, C			142	1559d	1602d	2/2	1525d	826c58d6656c pf: add missing unlock on error in DIOCCHANGERULE
panic: sctp_inpcb_free: inp ADDR still has socket	2	syz			12	1564d	1752d	2/2	1534d	a5c2009dd8ab sctp: improve handling of sctp inpcb flags
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT (2)	-1	syz, C			27	1540d	1557d	2/2	1538d	a3d974082549 pf: make sure the rule tree is allocated in DIOCCHANGERULE
panic: sbflush_internal: residual data (2)	2	syz, C			263	1540d	1802d	2/2	1540d	a6a596e102be sctp: improve handling of listen() call
panic: Warning: Last msg marked incomplete, yet nothing left? (2)	2	syz, C			3	1542d	1550d	2/2	1541d	2646cd085850 sctp: use a consistent view of the send parameters
panic: Queues are not empty when handling SHUTDOWN-COMPLETE	2	syz, C			17	1579d	2108d	2/2	1541d	64b297e803bd sctp: improve handling of send() when association is shutdown
panic: sctp: no chunks on the queues (2)	2	syz			1813	1541d	2185d	2/2	1541d	2646cd085850 sctp: use a consistent view of the send parameters
panic: Assertion clen >= sizeof(*cm) && clen <= cm->cmsg_len failed at /syzkaller/managers/main/kernel/sys/kern/uipc_usr	2	syz, C			6	1544d	1544d	2/2	1543d	75e7e3ce34d9 unix: fix incorrect assertion in 4682ac697ce
Fatal trap NUM: page fault in sctp_wakeup_the_read_socket (3)	-1	syz			3	1573d	1579d	2/2	1572d	490a0f77de77 sctp: improve locking
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd) (2)	2	syz, C			7	1580d	1582d	2/2	1580d	a12d89332efe sctp: hold the inp lock while calling ip6_output
Fatal trap NUM: page fault in __mtx_lock_flags (2)	-1	syz, C			2	1593d	1593d	2/2	1583d	3dc57df91e65 sctp: don't wakeup 1-to-1 listening sockets for data or notifications
panic: ASan: Invalid access, NUM-byte read in sctp_med_chunk_output	2	syz, C			180	1737d	1794d	2/2	1584d	eeba22217217 sctp: don't keep a pointer to a freed stcb around
panic: ASan: Invalid access, NUM-byte read at ADDR, UMAUseAfterFree(fd)	2	syz, C			515	1584d	1704d	2/2	1584d	eeba22217217 sctp: don't keep a pointer to a freed stcb around
panic: ASan: Invalid access, 4-byte write at ADDR, UMAUseAfterFree(fd)	2	syz, C			462	1599d	1866d	2/2	1596d	52106f072fd0 sctp: don't refer to a potentially outdated stream
Fatal trap NUM: page fault in pf_krule_global_RB_INSERT	-1	syz, C			81	1601d	1602d	2/2	1601d	e123e2294cb5 pf: guard against DIOCADDRULE without DIOCXBEGIN
panic: Don't own TCB send lock	2	syz, C			8016	1602d	1786d	2/2	1602d	5ac91821f5d7 sctp: get rid of stcb send lock
panic: Association about to be freed (2)	2	syz, C			4834	1602d	1638d	2/2	1602d	5ac91821f5d7 sctp: get rid of stcb send lock
panic: hold_tcblock is false	2	syz, C			468	1638d	1639d	2/2	1638d	e255f0c9fbd2 sctp: make sure new locking requirements are satisfied.
panic: Association about to be freed	2	syz, C			57	1638d	1639d	2/2	1638d	bdb99f6f5e31 sctp: remove KASSERT() which not always holds
panic: create_lock_applied is true	2	syz, C			104	1638d	1639d	2/2	1638d	2f0656fb9ba2 sctp: don't hold the assoc create lock longer than needed
Fatal trap NUM: page fault in inp_next	-1	syz			3	1692d	1697d	2/2	1688d	430df2abee90 in_pcb: improve inp_next()
panic: mutex blocked lock not owned at /syzkaller/managers/main/kernel/sys/kern/sched_ule.c:LINE	2	syz, C			33	1689d	1689d	2/2	1689d	6b95cf5bdedc callout: Wait for the softclock thread to switch before rescheduling
Fatal trap NUM: page fault in tcp_usr_send	-1	syz			1	1692d	1692d	2/2	1692d	4287aa56197f tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
panic: overhead (NUM) not a multiple of NUM	2	syz, C			248	1692d	1693d	2/2	1692d	ca0dd19f0933 sctp: check that the computed frag point is a multiple of 4
Fatal trap NUM: page fault in tcp_usr_shutdown	-1	syz, C			5	1693d	1693d	2/2	1692d	4287aa56197f tcp_usr_shutdown: don't cast inp_ppcb to tcpcb before checking inp_flags
Fatal trap NUM: page fault in tcp_usr_rcvd	-1	syz, C			7	1694d	1694d	2/2	1693d	37a7f5573716 tcp_usr_rcvd: don't cast inp_ppcb to tcpcb before checking inp_flags
panic: m_apply, offset > size of mbuf chain	2	syz, C			2	1699d	1699d	2/2	1693d	989453da0589 sctp: cleanup the SCTP_MAXSEG socket option.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/net/if.c:LINE (2)	2	syz, C			314	1703d	1707d	2/2	1703d	9f5432d5e5f0 netinet6: ip6_setpktopt() requires NET_EPOCH
panic: ASan: Invalid access, 2-byte read at ADDR, UMAUseAfterFree(fd)	2	syz, C			1103	1704d	1865d	2/2	1704d	014f98b11992 udp: Fix a use-after-free in udp_multi_input()
Fatal trap NUM: page fault in memcpy_erms	-1	syz, C			306	1705d	1711d	2/2	1705d	aa2681752d0d cryptosoft: Don't treat CRYPTO_NULL_HMAC as an hmac algorithm.
Fatal trap NUM: page fault in filt_bpfwrite	-1	syz, C			4	1762d	1768d	2/2	1755d	426682b05a4c bpf: Fix the write filter for detached descriptors
panic: ASan: Invalid access, NUM-byte read in newreno_cong_signal	2	syz, C			4	1756d	1759d	2/2	1755d	b15b0535968e tcp: allow new reno functions to be called from other CC modules
panic: Assertion (cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == NUM failed at /syzkaller/managers/main/kernel/sys/kern/v	2	syz, C			87	1764d	1765d	2/2	1764d	1045352f1503 cache: only assert on flags when dealing with EMPTYPATH
panic: TLS trailer length too long: NUM	2	syz, C			2	1773d	1773d	2/2	1768d	a63752cce646 ktls: Reject attempts to enable AES-CBC with TLS 1.3.
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (4)	2	syz, C			147	1866d	2090d	2/2	1791d	34b1efcea19d sctp: use a valid outstream when adding it to the scheduler
Fatal trap 12: page fault while in kernel mode (3)	-1	syz, C			140	1794d	2400d	2/2	1794d	ade1daa5c0d6 socket: Synchronize soshutdown() with listen(2) and AIO
Fatal trap 12: page fault in soo_aio_queue	-1	syz, C			349	1794d	1899d	2/2	1794d	ade1daa5c0d6 socket: Synchronize soshutdown() with listen(2) and AIO
panic: Assertion done != job_total_nbytes failed at /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE	2	syz, C			3	1806d	1871d	2/2	1797d	e6c19aa94da4 sctp: Allow blocking on I/O locks even with non-blocking sockets
Fatal trap 12: page fault in __mtx_lock_flags	-1	syz, C			1065	1800d	2299d	2/2	1800d	2d5c48eccd9f sctp: Tighten up locking around sctp_aloc_assoc()
panic: unexpected security protocol NUM	2	syz			7	1802d	1817d	2/2	1801d	10eb2a2bde61 ipsec: Validate the protocol identifier in ipsec4_ctlinput()
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/sys_socket.c:LINE (2)	2	syz, C			109	1804d	1899d	2/2	1801d	141fe2dceeae aio: Interlock with listen(2)
panic: Assertion owner->td_proc->p_magic == P_MAGIC failed at /syzkaller/managers/main/kernel/sys/kern/subr_turnstile.c:	2	syz, C			46	1864d	2120d	2/2	1801d	141fe2dceeae aio: Interlock with listen(2)
panic: Lock sctp-info not exclusively locked @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.c:LINE	2	syz, C			363	1802d	1802d	2/2	1802d	0c1a20beb456 sctp: use appropriate argument when freeing association
Fatal trap 9: general protection fault in strlen	-1	syz, C			1506	1867d	2625d	2/2	1802d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: mtx_lock() of destroyed mutex at sys/kern/uipc_sockbuf.c:LINE	2	syz			4	1952d	2142d	2/2	1802d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: mutex so_snd not owned at /syzkaller/managers/i386/kernel/sys/kern/uipc_sockbuf.c:LINE	2	syz			1	2096d	2096d	2/2	1802d	4250aa1188b5 sctp: Clear assoc socket references when freeing a PCB
panic: __rw_wlock_hard: recursing but non-recursive rw sctp-info @ /syzkaller/managers/main/kernel/sys/netinet/sctp_pcb.	2	syz, C			131	1803d	1803d	2/2	1803d	6e3af6321ba4 sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/netinet/tcp_output.c:LINE	2	syz			707	1826d	2711d	2/2	1803d	bd4a39cc93d9 socket: Properly interlock when transitioning to a listening socket
panic: ASan: Invalid access, NUM-byte read in strncmp	2	syz, C			12	1804d	1809d	2/2	1804d	5402baa5b5d1 g_label: Handle small sector sizes when tasting
Fatal trap 9: general protection fault in sctp_free_assoc	-1	syz			14	1872d	2180d	2/2	1810d	d35be50f5779 sctp: Hold association locks across socket wakeups when freeing
Fatal trap 9: general protection fault in itimer_proc_continue	-1	syz			2	1904d	1904d	2/2	1811d	3138392a46a4 itimer: Serialize access to the p_itimers array
panic: ASan: Invalid access, 1-byte read in g_raid_md_taste_ddf	2	syz, C			18	1816d	1863d	2/2	1811d	9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: ASan: Invalid access, 2-byte read in g_raid_md_taste_sii	2	syz, C			7	1824d	1849d	2/2	1811d	9e9ba9c73de9 graid: Avoid tasting devices with small sector sizes
panic: Bad list head ADDR first->prev != head	2	syz, C			3409	1811d	2709d	2/2	1811d	4a36122b1db1 sctp: Fix racy UNBOUND flag check in sctp_inpcb_bind()
panic: ASan: Invalid access, 16-byte read in aesni_encrypt_icm	2	syz, C			114	1813d	1864d	2/2	1812d	564b6aa7fccd aesni: Avoid a potential out-of-bounds load in aes_encrypt_icm()
panic: Assertion lock == sq->sq_lock failed at /syzkaller/managers/main/kernel/sys/kern/subr_sleepqueue.c:LINE (2)	2	syz, C			7	1868d	1892d	2/2	1826d	c4feb1ab0ae0 sigtimedwait: Use a unique wait channel for sleeping
panic: ASan: Invalid access, 4-byte read in sctp_sosend	2	syz, C			518	1835d	1864d	2/2	1835d	b732091a761a sctp: improve input validation of mapped addresses in send() Reported by: syzbot+35528f275f2eea6317cc@syzkaller.appspotmail.com Reported by: syzbot+ac29916d5f16d241553d@syzkaller.appspotmail.com MFC after: 3 days
panic: ASan: Invalid access, 4-byte read in tcp_usr_bind	2	syz, C			50	1837d	1862d	2/2	1837d	3f1f6b6ef7f6 tcp, udp: improve input validation in handling bind()
panic: ASan: Invalid access, 4-byte read in udp_bind	2	syz, C			69	1837d	1863d	2/2	1837d	3f1f6b6ef7f6 tcp, udp: improve input validation in handling bind()
panic: pmap_growkernel: no memory to grow kernel (2)	2	syz			299	1840d	2300d	2/2	1837d	600745f1e226 pf: bound DIOCGETSTATES memory use
panic: pmap_kasan_enter_alloc_4k: no memory to grow shadow map	2	syz, C			20	1840d	1859d	2/2	1837d	600745f1e226 pf: bound DIOCGETSTATES memory use
panic: vm_fault_lookup: fault on nofault entry, addr: ADDR (2)	2	syz, C			75	1876d	1920d	2/2	1845d	64432ad2a2c4 pf: Validate user string nul-termination before copying
panic: Assertion (cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0 failed at /syzkaller/managers/main/kernel/sys/kern/vfs	2	syz, C			4	1922d	1922d	2/2	1862d	6de3cf14c47d vn_open_cred(): disallow O_CREAT | O_EMPTY_PATH
panic: thread_lock() of sleep mutex ` @ /syzkaller/managers/main/kernel/sys/kern/kern_switch.c:LINE	2	syz, C			1	1906d	1906d	2/2	1902d	4a59cbc12532 amd64: Avoid enabling interrupts when handling kernel mode prot faults
Fatal trap 12: page fault in rack_process_to_cumack (2)	-1	syz			3	1910d	1911d	2/2	1909d	13c0e198ca27 tcp: Fix bugs related to the PUSH bit and rack and an ack war
panic: refcount ADDR wraparound (3)	2	syz, C			9	1911d	1912d	2/2	1911d	6f6cd1e8e8aa ktrace: Remove vrele() at the end of ktr_writerequest()
Fatal trap 9: general protection fault in rack_ctloutput	-1	syz			2	1914d	1914d	2/2	1912d	8923ce630492 tcp: Handle stack switch while processing socket options
panic: ktrace_enter: flag set	2	syz, C			44	1912d	1914d	2/2	1912d	e4b16f2fb18b ktrace: Avoid recursion in namei()
panic: Memory modified after free ADDR(4096) val=ADDR @ ADDR	2	syz, C			1	1918d	1918d	2/2	1913d	500eb6dd8040 tcp: Fix sending of TCP segments with IP level options
panic: releasing active pmap ADDR	2	syz, C			11	1923d	1966d	2/2	1921d	9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
panic: pmap active ADDR	2	syz, C			5	1928d	1966d	2/2	1921d	9246b3090cbc fork: Suspend other threads if both RFPROC and RFMEM are not set
Fatal trap 18: integer divide fault in realtimer_expire_l	-1	syz, C			15	1922d	1949d	2/2	1921d	8b3c4231abf0 posix timers: Check for overflow when converting to ns
Fatal trap 18: integer divide fault in realtimer_expire	-1	syz, C			20	1953d	1974d	2/2	1921d	8b3c4231abf0 posix timers: Check for overflow when converting to ns
panic: crp_iv_start set when IV isn't used	2	syz, C			2	1926d	1927d	2/2	1923d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: IV outside buffer length	2	syz, C			16	1923d	1928d	2/2	1923d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: More encryption data than allowed	2	syz, C			2	1924d	1924d	2/2	1923d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: AEAD without a separate IV	2	syz, C			25	1923d	1928d	2/2	1923d	1a04f0156c4e cryptodev: Fix some input validation bugs
Fatal trap 12: page fault in memcpy_erms	-1	syz, C			2	1924d	1924d	2/2	1923d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: IV_SEPARATE set when IV isn't used	2	syz, C			4	1924d	1927d	2/2	1923d	1a04f0156c4e cryptodev: Fix some input validation bugs
panic: _mtx_lock_sleep: recursed on non-recursive mutex process lock @ /syzkaller/managers/main/kernel/sys/kern/kern_sig	2	syz			2	1951d	1951d	2/2	1923d	5cc1d199412e realtimer_expire: avoid proc lock recursion when called from itimer_proc_continue()
Fatal trap 12: page fault in pmap_kextract (2)	-1	syz, C			8	1952d	1953d	2/2	1952d	5e98cae661f3 pf: Ensure that we don't use kif passed to pfi_kkif_attach()
panic: to_ticks == 0 for timer type 5 (2)	2	syz			2	1975d	1975d	2/2	1973d	d995cc7e5431 sctp: fix handling of RTO.initial of 1 ms
panic: to_ticks == 0 for timer type 5	2	syz, C			2	2000d	2000d	2/2	1996d	70e95f0b6917 sctp: avoid integer overflow when starting the HB timer
Fatal trap 12: page fault in sctp_find_alternate_net	-1	syz			131	2002d	2146d	2/2	2002d	b963ce4588b3 sctp: improve computation of an alternate net
panic: pfi_dynaddr_setup: non-NULL dyn (2)	2	syz, C			4	2033d	2033d	2/2	2027d	7a808c5ee329 pf: Improve pf_rule input validation
Fatal trap 12: page fault in copyin_nosmap_erms	-1	syz, C			8	2070d	2117d	2/2	2041d	ea36212bf571 pf: Don't hold PF_RULES_WLOCK during copyin() on DIOCRCLRTSTATS
panic: mtx_lock() of spin mutex (null) @ /syzkaller/managers/main/kernel/sys/kern/uipc_ktls.c:LINE	2	syz, C			11	2048d	2273d	2/2	2045d	6685e259e319 tcp: don't use KTLS socket option on listening sockets
panic: Memory modified after free ADDR(112) val=ADDR @ ADDR (2)	2	syz			475	2049d	2293d	2/2	2049d	a7aa5eea4fff sctp: improve handling of aborted associations
panic: sched_pickcpu: Failed to find a cpu.	2	syz, C			4	2078d	2078d	2/2	2077d	f1b18a668deb cpuset_set{affinity,domain}: do not allow empty masks
Fatal trap 9: general protection fault in cpuset_setproc	-1	syz			2	2079d	2079d	2/2	2077d	b2780e8537da kern: cpuset: resolve race between cpuset_lookup/cpuset_rel
panic: sleeping without a lock	2	syz, C			29	2082d	2249d	2/2	2081d	34af05ead3cf kern: soclose: don't sleep on SO_LINGER w/ timeout=0
panic: uma_zalloc_debug: called within spinlock or critical section	2	syz, C			9	2088d	2092d	2/2	2087d	e07e3fa3c95c kern: cpuset: drop the lock to allocate domainsets
panic: Bad tailq NEXT(ADDR->tqh_last) != NULL (3)	2	syz, C			12	2091d	2092d	2/2	2090d	5d49283f8857 pf: Make tag hashing more robust
panic: spin lock held too long	2	syz, C			1	2101d	2101d	2/2	2096d	a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
Fatal trap 12: page fault in _callout_stop_safe	-1	syz, C			1	2101d	2101d	2/2	2096d	a33fef5e25ac callout(9): Fix a race between CPU migration and callout_drain()
panic: Most recently used by pf_ifnet	2	syz, C			6	2134d	2134d	2/2	2133d	52b83a06184c pf: do not remove kifs that are referenced by rules
Fatal trap 9: general protection fault in sctp_lower_sosend	-1	syz, C			22	2233d	2285d	2/2	2191d	f5d30f7f7606 Improve the handling of concurrent send() calls for SCTP sockets, especially when having the explicit EOR mode enabled.
panic: in6p_lookup_mcast_ifp: not INP_IPV6 inpcb	2	syz, C			2	2239d	2239d	2/2	2203d	cfae6a92ac01 Remove an incorrect assertion from in6p_lookup_mcast_ifp().
Fatal trap 12: page fault in uipc_ready	-1	syz, C			5	2234d	2261d	2/2	2208d	1b778ba2609f Fix a logic error in uipc_ready_scan().
panic: witness_warn	2	syz			1	2253d	2253d	2/2	2237d	e54b7cd007b5 Fix the cleanup handling in a error path for TCP BBR.
Fatal trap 12: page fault in sctp_find_ifa_in_ep	-1	syz, C			3	2240d	2240d	2/2	2237d	7a3f60e7f571 Fix a bug introduced in https://svnweb.freebsd.org/changeset/base/362173
Fatal trap 12: page fault in sctp_process_control	-1	syz, C			47	2288d	2289d	2/2	2288d	86fd36c502db Fix a copy and paste error introduced in r360878.
Fatal trap 9: general protection fault in sctp_process_control	-1	syz, C			11	2288d	2289d	2/2	2288d	86fd36c502db Fix a copy and paste error introduced in r360878.
panic: pfi_dynaddr_setup: dyn is ADDR (2)	2	syz, C			22	2299d	2310d	2/2	2296d	1ef06ed8def9 pf: Improve DIOCADDRULE validation
panic: mallocarray: ADDR * 1064 overflowed	2	syz, C			3	2307d	2311d	2/2	2303d	a7c8533634ab pf: Improve input validation
panic: pfi_dynaddr_setup: dyn is ADDR	2	syz, C			7	2311d	2315d	2/2	2310d	98582ce38183 pf: Improve ioctl() input validation
panic: Assertion size0 > 0 failed at /syzkaller/managers/main/kernel/sys/kern/subr_vmem.c:LINE	2	syz, C			2	2314d	2314d	2/2	2312d	95324dc3f4d2 pf: Do not allow negative ps_len in DIOCGETSTATES
panic: mtx_unlock() of destroyed mutex at sys/kern/sys_socket.c:LINE	2	syz			1	2403d	2403d	2/2	2315d	99258935eb2b Lock the socket in soo_stat().
panic: sbfree: m ADDR !M_NOTREADY	2	syz, C			32	2685d	2711d	2/2	2318d	dde1b5985fcc Properly handle disconnected sockets in uipc_ready().
panic: Duplicate free of ADDR from zone ADDR(mbuf) slab ADDR(8)	2	syz, C			1	2708d	2708d	2/2	2319d	3d36b367cfb6 sbappendcontrol() needs to avoid clearing M_NOTREADY on data mbufs.
panic: to_ticks == 0 for timer type 2	2	syz, C			27	2332d	2336d	2/2	2332d	25ec35535397 Handle integer overflows correctly when converting msecs and secs to ticks and vice versa. These issues were caught by recently added panic() calls on INVARIANTS systems.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet/ip_output.c:LINE	2	syz			1870	2341d	2398d	2/2	2340d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/ip6_output.c:LINE	2	syz			229	2341d	2398d	2/2	2340d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet6/ip6_output.c:LINE	2	syz, C			591	2341d	2398d	2/2	2340d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/main/kernel/sys/netinet/ip_output.c:LINE	2	syz, C			2840	2341d	2398d	2/2	2340d	2bdebd0ce3e0 A a missing NET_EPOCH_ENTER/NET_EPOCH_EXIT pair. This was affecting implicit connection setups via sendmsg().
panic: Most recently used by ip6opt (2)	2	syz			4	2344d	2390d	2/2	2341d	e02582d1ae44 Fix synchronization in the IPV6_2292PKTOPTIONS set handler.
panic: mutex process lock not owned at /syzkaller/managers/i386/kernel/sys/kern/kern_time.c:LINE	2	syz, C			33	2385d	2385d	2/2	2341d	55aa9af7e971 Remove unneeded assert for curproc. Simplify.
panic: refcount ADDR wraparound	2	syz, C			6	2386d	2386d	2/2	2341d	adbdb897689b fd: always nullify *fdp in fget* routines
panic: mutex process lock not owned at /syzkaller/managers/main/kernel/sys/kern/kern_time.c:LINE	2	syz, C			83	2385d	2385d	2/2	2384d	55aa9af7e971 Remove unneeded assert for curproc. Simplify.
panic: pipe_destroy_write_buffer: pipe map for ADDR contains residual data	2	syz			11	2479d	2522d	2/2	2470d	1cbfe73da570 Fix handling of PIPE_EOF in the direct write path.
panic: mutex pcbinfohash not owned at /syzkaller/managers/main/kernel/sys/netinet6/in6_pcb.c:LINE	2	syz, C			5	2472d	2473d	2/2	2470d	c17cd08f5302 It is unclear why in6_pcblookup_local() would require write access to the PCB hash. The function doesn't modify the hash. It always asserted write lock historically, but with epoch conversion this fails in some special cases.
panic: in_pcb_lport: laddrp NULL for v4 inp ADDR	2	syz, C			8	2515d	2631d	2/2	2488d	4a91aa8fc9b6 Ensure that the flags indicating IPv4/IPv6 are not changed by failing bind() calls. This would lead to inconsistent state resulting in a panic. A fix for stable/11 was committed in https://svnweb.freebsd.org/base?view=revision&revision=338986 An accelerated MFC is planned as discussed with emaste@.
panic: Assertion in_epoch(net_epoch_preempt) failed at /syzkaller/managers/i386/kernel/sys/netinet6/in6_ifattach.c:LINE	2	syz			2	2502d	2502d	2/2	2496d	in6ifa_llaonifp() is never called from fast path, so do not require epoch being entered.
Fatal trap 12: page fault in uipc_send	-1	syz			123	2505d	2636d	2/2	2503d	4013d7268446 Fix handling of empty SCM_RIGHTS messages.
Fatal trap 12: page fault in inp_freemoptions (2)	-1	syz			14	2622d	2631d	2/2	2512d	Convert all IPv4 and IPv6 multicast memberships into using a STAILQ instead of a linear array.
panic: m_getm2: len is < 0	2	syz			13	2704d	2710d	2/2	2518d	2ef5bd2f0c46 Limit the number of bytes which can be queued for SCTP sockets. This is joint work with rrs@. Reported by: syzbot+307f167f9bc214f095bc@syzkaller.appspotmail.com MFC after: 1 week
Fatal trap 9: general protection fault in sctp_copy_skeylist	-1	syz			3	2628d	2628d	2/2	2590d	8a956abe12c6 When calling sctp_initialize_auth_params(), the inp must have at least a read lock. To avoid more complex locking dances, just call it in sctp_aloc_assoc() when the write lock is still held.
panic: Most recently used by tty	2	syz			24	2643d	2657d	2/2	2600d	6a01874c5afa Defer funsetown() calls for a TTY to tty_rel_free().
panic: cap_rights_is_vset:LINE	2	syz			3	2624d	2624d	2/2	2605d	7c3703a69466 Use a consistent snapshot of the fd's rights in fget_mmap().
Fatal trap 12: page fault in vm_page_unhold_pages	-1	syz, C			1169	2613d	2707d	2/2	2605d	02476c44c5eb Fix mutual exclusion in pipe_direct_write().
panic: udp_output: shared udbinfo lock, excl inp lock (2)	2	syz			7	2646d	2665d	2/2	2633d	eafaa1bc35e9 After parts of the locking fixes in r346595, syzkaller found another one in udp_output(). This one is a race condition. We do check on the laddr and lport without holding a lock in order to determine whether we want a read or a write lock (this is in the "sendto/sendmsg" cases where addr (sin) is given).
Fatal trap 12: page fault in inp_freemoptions	-1	syz, C			11	2653d	2706d	1/2	2651d	5a1e222bfda7 Close some races in multicast socket option handling.
panic: inp_leave_group: imf_sources not empty	2	syz, C			6	2653d	2674d	1/2	2651d	5a1e222bfda7 Close some races in multicast socket option handling.
panic: vm_object_vndeallocate: bad object reference count	2	syz, C			974	2652d	2652d	1/2	2652d	8cd6a80d7d68 Restore the pre-r347532 behaviour of ignoring wiring failures in mmap().
panic: ffs_blkfree_cg: freeing free block	2	syz, C			5	2709d	2709d	1/2	2666d	a7a455c299b0 Optimize lseek(SEEK_DATA) on UFS.
panic: udp_output: shared udbinfo lock, excl inp lock	2	syz, C			46	2674d	2711d	1/2	2672d	d86ecbe993a7 iFix udp_output() lock inconsistency.
Fatal trap 12: page fault in in6_cksum_partial	-1	syz			6	2676d	2706d	1/2	2676d	70a0f3dcdc1f When a checksum has to be computed for a received IPv6 packet because it is requested by the application using the IPPROTO_IPV6 level socket option IPV6_CHECKSUM on a raw socket, ensure that the packet contains enough bytes to contain the checksum at the specified offset.
panic: rtrequest1_fib: locked	2	syz, C			10	2683d	2708d	1/2	2681d	e6481fd4c46a When sending a routing message, don't allow the user to set the RTF_RNH_LOCKED flag in rtm_flags, since this flag is used only internally.
panic: inp_join_group: imf_sources not empty	2	syz, C			398	2684d	2711d	1/2	2684d	f1ef572a1ecd Reinitialize multicast source filter structures after invalidation.
Fatal trap 12: page fault in __mtx_assert	-1	syz			4	2702d	2704d	1/2	2700d	7854c63d6fbe Fix a small bug in the tcp_log_id where the bucket was unlocked and yet the bucket-unlock flag was not changed to false. This can cause a panic if INVARIANTS is on and we go through the right path (though rare).
panic: Can't clear local locks with F_UNLCKSYS	2	syz, C			9	2701d	2711d	1/2	2701d	fd76e780a7c0 Reject F_SETLK_REMOTE commands when sysid == 0.
panic: Counter goes negative	2	syz, C			2	2708d	2708d	1/2	2702d	0d3cf13dabf8 Fix a signed/unsigned bug when receiving SCTP messages. This is joint work with rrs@.
panic: tcp_output: mbuf chain shorter than expected: 0 + 60 + 24 - 0 != 60	2	syz, C			2	2710d	2710d	1/2	2703d	05fb056c068d Fix a KASSERT() in tcp_output().
panic: pmap_demote_pde: page table page for a wired mapping is missing	2	syz, C			56	2705d	2710d	1/2	2705d	64087fd7f372 Disallow preemptive creation of wired superpage mappings.
panic: invalid dst page ADDR	2	syz, C			33	2707d	2711d	1/2	2706d	45d72c7d7fca vm_fault_copy_entry: accept invalid source pages.