Applied filters: WithRepro (drop)

Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Closed	Patch
KASAN: invalid memory access in sysvipc_infoout	-1	C			10	7d08h	7d19h	1/4	never	sysv: fold the three SysV IPC info sysctls into one helper
protection_fault: sys_msgrcv (2)	-1	C			168	61d	1382d	4/4	16d	fa811effdbdb Make concurrent sys_msgrcv() wait until we finish message delivery. We left acquired message in the queue while we are sleeping in msg_copyout(). Concurrent sys_msgrcv() could acquire and delete this message.
panic: uvm_fault_unwire_locked: address not in map (4)	2	C			638	497d	1574d	3/4	481d	818e6b572963 Make vslock(9) similar to mlock(2): silently ignore non-mapped ranges.
panic: lock (rwlock) solock not locked	2	C			33	1420d	1421d	3/4	745d	ef9354f58d69 sync
panic: vmxon failed	2	syz			3	834d	839d	3/4	833d	ddfb6951b469 vmm: protect vmm activation with the vmm_softc rwlock.
uvm_fault: igmp_leavegroup (5)	-1	C			12	835d	836d	3/4	835d	4733ced31b52 Prevent changing interface loopback flag from userland.
panic: unix: lock not held	2	C			2	847d	847d	3/4	841d	e679c1f37540 Allow listen(2) only on sockets of type SOCK_STREAM or SOCK_SEQPACKET. listen(2) man(1) page clearly prohibits sockets of other types.
panic: rw_enter: unix locking against myself	2	C			2	864d	864d	3/4	859d	d1ea0a7c7de9 Do UNP_CONNECTING and UNP_BINDING flags check in uipc_listen() and return EINVAL if set. This prevents concurrent solisten() thread to make this socket listening while socket is unlocked.
panic: malformed IPv4 option passed to ip_optcopy (3)	2	syz			40	872d	873d	3/4	872d	c8a0ef6cb991 Validate IPv4 packet options in divert output.
assert "sin6tosa(&ro->ro_dst)->sa_family == AF_INET6" failed in in6_src.c	-1	C			218	904d	906d	3/4	904d	4a2c3c9ecbcf In in_pcbrtentry() add missing return of in6_pcbrtentry() value.
witness: reversal: pf_lock solock	-1	syz			23	926d	933d	3/4	926d	66bd633ef3ce Use domain name for socket lock.
panic: assertwaitok: non-zero mutex count: NUM	2	C			10	949d	950d	3/4	949d	540e94b5c59a soreceive() must not hold mutex when calling sblock().
uvm_fault: rtrequest (2)	-1	C			15	985d	986d	3/4	985d	a08e228de7c0 Fix rt_setgate() error handling.
assert "((len + sizeof(long) - NUM) &~ (sizeof(long) - NUM)) <= M_SIZE(m)" failed in uipc_mbuf.c	-1	C			2	1012d	1012d	3/4	1009d	7b4d35e0a60b Avoid assertion failure when splitting mbuf cluster.
assert "p->p_stat == SONPROC || p->p_stat == SSLEEP || p->p_stat == SSTOP" failed in kern_synch.c	-1	syz			10	1043d	1073d	3/4	1040d	de92f022b000 Before coredump or in pledge_fail use SINGLE_UNWIND to stop all threads.
assert "type != NULL" failed in subr_witness.c	-1	syz			1	1055d	1055d	3/4	1046d	ed07db5bc17e Revert commitid: yfAefyNWibUyjkU2, ESyyH5EKxtrXGkS6 and itscfpFvJLOj8mHB;
assert "nlevel >= IPL_NONE" failed in intr.c	-1	C			259	1046d	1055d	3/4	1046d	ed07db5bc17e Revert commitid: yfAefyNWibUyjkU2, ESyyH5EKxtrXGkS6 and itscfpFvJLOj8mHB;
witness: reversal: &sched_lock &pr->ps_mtx	-1	syz			170	1050d	1051d	3/4	1050d	4ab8b759f72e Fix SCHED_LOCK() leak in single_thread_set()
kernel: integer divide fault trap, code=NUM (4)	-1	C			6	1134d	1190d	3/4	1128d	6d14abdcc245 Avoid division by 0 in m_pool_used
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (7)	2	syz			9	1302d	1318d	3/4	1290d	9cf4e548dcbe Use solock() instead solock_shared() within sys_getsockopt(). Otherwise we acquiring kernel lock with mutex(9) held. This partially reverts rev 1.205 of sys/kern/uipc_syscalls.c. Shared solock() is still fine for getsockname(2) and getpeername(2).
pool: free list modified: semapl	-1	syz			2	1448d	1448d	3/4	1396d	5bf1588a93fe Fix memory corruptions with sysv semaphores due to sleeps in copyin, copyout and malloc. During a sleep another thread could delete the semaphore (and possibly allocate another one at the same location with different permissions) which would lead to an invalid access after wake up. Therefore check the semaphore pointer, the sequence, the permissions and some values in seminfo after each sleep. OK bluhm@ Reported-by: syzbot+60ba811fe2e8a6b0f975@syzkaller.appspotmail.com
panic: solock: lock not held	2	C			19	1420d	1421d	3/4	1420d	536333f5835e Use pru_send function to check socket splicing compatibility. Only checking socket type is not sufficient as it could splice together unix and inet sockets resulting in crashes. As splicing is about sending, the same send function looks like a good criteria. Reported-by: syzbot+fc6901d63d858d5dd00a@syzkaller.appspotmail.com Reported-by: syzbot+0e026f1bf8b259c6395e@syzkaller.appspotmail.com OK gnezdo@
assert "uvn->u_obj.uo_refs == NUM" failed in uvm_vnode.c	-1	syz			8	1436d	1487d	3/4	1424d	ce1ab8dd6b18 Lock vmobjlock then check u_flags & UVM_VNODE_VALID in uvn_attach
kernel: integer divide fault trap, code=NUM (3)	-1	C			157	1425d	1447d	3/4	1425d	b18f9d9c6b70 Syzkaller found a missing input validation in pipex mppe keylenbits. Reported-by: syzbot+2eca95b271d07ab91b43@syzkaller.appspotmail.com tested yasuoka@; OK mvs@ yasuoka@
panic: tcp_output	2	C			762	1426d	1428d	3/4	1426d	355f588a8749 Sendmsg could crash in tcp_output due to a missing check after the introduction of tcp_send. OK mvs@, bluhm@, gnezdo@ Reported-by: syzbot+e859fd353c90eeac26f8@syzkaller.appspotmail.com
no output from test machine (7)	-1	C			124310	1453d	2076d	3/4	1453d	fa90ac5c787b Add a pool for the allocation of the pf_anchor struct. It was possible to exhaust kernel memory by repeatedly calling pfioctl DIOCXBEGIN with different anchor names. OK bluhm@ Reported-by: syzbot+9dd98cbce69e26f0fc11@syzkaller.appspotmail.com
witness: userret: sendmsg	-1	C			28	1484d	1485d	3/4	1484d	635da3731041 Unlock peer in the SOCK_STREAM and SOCK_SEQPACKET error path.
assert "__mp_lock_held(&sched_lock, curcpu()) == NUM" failed in kern_lock.c	-1	C			860	1487d	1598d	3/4	1487d	1690b19512cc Move the deep check back into the loop. There are ways that even though we're deep the code will SSTOP and sleep and then on wakeup we need to recheck the deep conditions. Issue analyzed and OK by mpi@
pool: free list modified: fdescpl (2)	-1	C			6	1495d	1540d	3/4	1489d	dc399801d5c5 kqueue: Clear task when closing kqueue
assert "TAILQ_EMPTY(&lock->lf_blkhd)" failed in vfs_lockf.c (2)	-1	C			2	1520d	1521d	3/4	1515d	ee8a225221fd Fix ambiguity with lock range end
panic: m_copydata: null mbuf (2)	2	syz			2	1527d	1527d	3/4	1524d	0271abd8e494 In pf the kernel paniced if IP options in packet within ICMP payload were truncated. Drop such packets instead. Reported-by: syzbot+91abd3aa2fdfe900f9ce@syzkaller.appspotmail.com OK sashan@ claudio@
witness: reversal: pf_lock netlock (3)	-1	syz			25	1548d	1560d	3/4	1548d	f3a753b5d089 Release PF und NET lock before calling copyout for DIOCIGETIFACES. OK sashan@ Reported-by: syzbot+b6afd166e314799e3809@syzkaller.appspotmail.com
protection_fault: lf_advlock	-1	C			2	1596d	1640d	3/4	1550d	c30ab30fe47b Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
protection_fault: lf_findoverlap	-1	C			2	1563d	1595d	3/4	1550d	c30ab30fe47b Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
protection_fault: lf_clearlock	-1	C			1	1565d	1565d	3/4	1550d	c30ab30fe47b Remove the lock if an identical overlapping one is already present. Preventing a use after free discovered by syzkaller.
witness: reversal: pf_lock netlock (2)	-1	C			2	1569d	1569d	3/4	1568d	2e34be423f16 Release PF und NET lock before calling copyin for DIOCXROLLBACK. OK bluhm@ Reported-by: syzbot+2945769fc3e6fd9ee413@syzkaller.appspotmail.com
witness: reversal: pf_lock netlock	-1	C			19	1580d	1632d	3/4	1570d	82d8999861ab Release PF und NET lock before calling copyin and copyout for DIOCXBEGIN. OK bluhm@ OK sashan@ Reported-by: syzbot+b22ec16c5bf937578937@syzkaller.appspotmail.com
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (4)	-1	C			9	1574d	1587d	3/4	1573d	f77c87828076 Replace KASSERT in uvm_fault_unwire_locked() with code that handles the case where not all pages are wired. The KASSERT can be triggered in multi-threaded applications when a thread calling munmap(2) races another thread that invokes sysctl(2). Properly written code shouldn't do this, but making the kernel crash in this case is a bit harsh.
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (6)	2	C			80	1585d	1586d	3/4	1584d	2be5be2c1f9e For raw IPv6 packets rip6_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw6 table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. Reported-by: syzbot+5b2679ee9be0895d26f9@syzkaller.appspotmail.com OK claudio@
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (5)	2	C			104	1586d	never	3/4	1586d	d25fea59a0de For raw IP packets rip_input() traverses the loop of all PCBs. From there it calls sbappendaddr() while holding the raw table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. syzbot+ebe3f03a472fecf5e42e@syzkaller.appspotmail.com OK claudio@
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (4)	2	C			249	1586d	1587d	3/4	1586d	63abc0ec39b5 For multicast and broadcast packets udp_input() traverses the loop of all UDP PCBs. From there it calls udp_sbappend() while holding the UDP table mutex. This ends in sorwakeup() where we finally grab the kernel lock while holding a mutex. Witness detects this misuse. Use the same solution as for PCB notify. Collect the affected PCBs in a temporary list. The list is protected by exclusive net lock. Reported-by: syzbot+7596cb96fb9f3c9d6f4f@syzkaller.appspotmail.com OK sashan@
witness: reversal: vmmaplk fdlock	-1	syz			22	1596d	1596d	3/4	1593d	447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
witness: exclusive lock of (rwlock) vmmaplk while share locked	-1	C			9	1596d	1596d	3/4	1593d	447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
witness: reversal: netlock vmmaplk	-1	C			166	1596d	1596d	3/4	1593d	447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
panic: kmmaplk: lock not shared	2	C			15	1596d	1597d	3/4	1596d	447db83cf4f0 Revert holding a read lock on the map while copying out data during sysctl(2).
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (3)	-1	syz			11	1597d	1613d	3/4	1596d	5f69141a284a Hold a read lock on the map while copying out data during a sysctl(2) call to prevent another thread from unmapping the memory and triggering an assertion or even corrupting random physical memory pages.
uvm_fault: socreate	-1	C			106	1610d	1611d	3/4	1610d	532245610f13 Reported-by: syzbot+1b5b209ce506db4d411d@syzkaller.appspotmail.com Revert the pr_usrreqs move: syzkaller found a NULL pointer deref and I won't be available to monitor for followup issues for a bit
assert "m->m_pkthdr.pf.prio <= IFQ_MAXPRIO" failed in ifq.c	-1	syz			2	1626d	1626d	3/4	1620d	2960c8affbaf check pf rule "set prio" values consistently.
assert "len >= NUM && !M_READONLY(m)" failed in uipc_mbuf.c	-1	syz			153	1622d	1631d	3/4	1622d	4be097b86868 The length value in bpf_movein() is casted to from size_t to u_int and then rounded before checking. Put the same check before the calculations to avoid overflow. Reported-by: syzbot+6f29d23eca959c5a9705@syzkaller.appspotmail.com OK claudio@
kernel: integer divide fault trap, code=NUM (2)	-1	C			8	1628d	1631d	3/4	1627d	43496f5abc1b let pfattach() to also initialize pf_default_rule_new to avoid div-by-zero in pf_purge()
panic: unhandled af (4)	2	syz			11	1645d	1674d	3/4	1642d	035d4f5430cb An af-to pf rule must have an address family naf to use after translation. Make stricter sanity checks in pf ioctl to avoid later crashes during packet processing. Reported-by: syzbot+0ef9190e7d0195496d0d@syzkaller.appspotmail.com OK sashan@
uvm_fault: pppacopen	-1	C			92	1668d	1668d	3/4	1668d	7945134bbda7 Use a distinct variable while iterating the list of existing devices.
assert "(rule != NULL) && (rule->ruleset != NULL)" failed in pf_ioctl.c	-1	C			7	1672d	2215d	3/4	1672d	5a50f165b8ad DIOCHANGERRULE ioctl must set pointer to ruleset in rule it inserts.
witness: userret: ioctl (3)	-1	syz			2	1676d	1676d	3/4	1675d	41a45098bac2 Disk lock was held when returning to userland. Add a missing unlock in vnd ioctl error path. Reported-by: syzbot+6dde3fda33074a256318@syzkaller.appspotmail.com OK jsg@ anton@
uvm_fault: pfsync_state_import	-1	C			10	2163d	2233d	3/4	1676d	d13e571b26fd Remove ptr_array from struct pf_ruleset
panic: vndioctl: null vp	2	C			3	1682d	1683d	3/4	1677d	4d2db379fd33 Ensure that the disk has been initialized after acquiring the lock and not before as we might end up sleeping while acquiring the lock, introducing a potential race.
panic: malloc: allocation too large, type = NUM, size = ADDR	2	C			3	1683d	1684d	3/4	1677d	0b7f5aec6317 Let malloc return an error as opposed of panicking when sysctl kern.shminfo.shmseg is set to something ridiculously large.
assert "suser(curproc) == NUM" failed in dt_dev.c	-1	C			7	1678d	1678d	3/4	1678d	cf997a482905 Remove useless suser assert from dt(4). The ioctl(2) path checks the user anyway and close(2) may crash after setuid(2). Reported-by: syzbot+90e094f33d329fb2c3ab@syzkaller.appspotmail.com OK deraadt@
uvm_fault: uvm_fault_lower	-1	C			583	1678d	1682d	3/4	1678d	f08b8e936de9 Do not try to unlock a NULL object.
kernel: integer divide fault trap, code=NUM	-1	syz			2	1691d	1691d	3/4	1682d	38bfd041cb0f fix zero division found by syzkaller. The sanity checks in pf(4) ioctls are not powerful enough to detect invalid port ranges (or even invalid rules). syzkaller does not use pfctl(8), it uses ioctl(2) to pass some random chunk of memory as a rule to pf(4). Fix adds explicit check for 0 divider to pf_get_transaddr(). It should make syzkaller happy without disturbing anyone else.
panic: rw_enter: dklk locking against myself	2	C			6	1753d	1781d	3/4	1749d	placing the same vnd underneath a vnd (with VNDIOCSET) is a lock violation, but other circumstances are also bad, so let's block all vnd on top of vnd. While here, fix some toctou multiple-copyin of the path, and restructure the ioctl defer all softc updates to the end. ok mpi
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (3)	2	C			2	1784d	1787d	3/4	1782d	8e114673a836 vmm(4): grab kernel lock before vmspace init
uvm_fault: rtm_output	-1	C			14	1782d	1782d	3/4	1782d	d2084f835172 Fix NULL pointer dereference introduced by previous commit.
panic: lock (rwlock) vcpulock not locked	2	C			1	1789d	1789d	3/4	1784d	5f3d69798ad5 vmm(4): fix vcpu locking issues reported by syzbot
assert "_kernel_lock_held()" failed in uvm_map.c	-1	C			11	1788d	1789d	3/4	1786d	8e114673a836 vmm(4): grab kernel lock before vmspace init
panic: acquiring blockable sleep lock with spinlock or critical section held (kernel_lock) &kernel_lock (2)	2	C			152	1789d	2509d	3/4	1788d	1be9dae600aa Prevent lock ordering issue by raising ipl level of vcpu_pool to IPL_MPFLOOR.
panic: mutex ADDR not held in knote_dequeue	2	C			24	1870d	1871d	3/4	1870d	baa47be05351 Remember to lock kqueue mutex in filt_timermodify().
witness: reversal: lock order data missing	-1	C			667	1899d	1969d	3/4	1899d	8b594b45f4b5 Move ktrfds() below fdpunlock(). This fixes lock order issue between vn_lock(9) and fdplock().
panic: acquiring blockable sleep lock with spinlock or critical section held (rwlock) solock	2	C			4	1916d	1917d	3/4	1915d	Revert per-socket `so_lock' rwlock(9) and use it to protect routing (PF_ROUTE) sockets. There is a locking issue with timeouts that needs to be fixed. Requested by deraadt@
SYZFAIL: tun: can't open device	-1	syz			4	1969d	1970d	3/4	1964d	43dfcaac64e4 Issuing FIOSETOWN and TIOCSPGRP ioctl commands on a tun(4) device leaks device references causing a hang while trying to remove the same interface since the reference count will never reach zero. Instead of returning, break out of the switch in order to ensure that tun_put() gets called.
assert "frag->fr_firstoff[index] != NULL" failed in pf_norm.c	-1	syz			4	1981d	2000d	3/4	1979d	be7274bff2cd When cutting of the head of an overlapping fragment during pf reassembly, reinsert the fragment into the lookup table with correct index. Reported-by: syzbot+d043455a5346f726f1c4@syzkaller.appspotmail.com OK claudio@
kernel: protection fault trap, code=0 (8)	-1	syz			1348	1991d	2180d	3/4	1991d	44a45654aa78 Interface group names must fit into IFNAMSIZ and be unique. But the kernel made the unique check before trunkating with strlcpy(). So there could be two interface groups with the same name. The kif is created by a name lookup. The trunkated names are equal, so there was only one kif owned by both groups. When the groups got destroyed, the single kif was removed twice from the RB tree. Check length of group name before doing the unique check. The empty group name was allowed and is now invalid. Reported-by: syzbot+f47e8296ebd559f9bbff@syzkaller.appspotmail.com OK deraadt@ gnezdo@ anton@ mvs@ claudio@
panic: rw_enter: pf_state_lock locking against myself	2	C			8	1992d	1992d	3/4	1991d	d7220220b7ed pfsync_state_import() must not be called with the pf state lock held, since the actual modification of the state table is done by a call to pf_state_insert(), which takes the pf state lock itself. Other calls to pfsync_state_import() also only have the pf lock.
panic: vrele: v_writecount != 0 (2)	2	C			1955	1997d	1997d	3/4	1997d	df61468f8652 Revert previous commit. The vnode returned by ptm_vn_open() is open and can not simply be vrele()-ed on error. The code currently depends on closef() to do the cleanup.
assert "TAILQ_EMPTY(&kq->kq_head)" failed in kern_event.c	-1	C			2	2006d	2006d	3/4	2005d	715db9d67ba3 kqueue: Fix termination assert
uvm_fault: pf_addr_compare	-1	C			347	2011d	2012d	3/4	2011d	c34fe1b3cf88 An invalid packet may not have set src and dst in packet descriptor. Add a NULL check to prevent crash in pflog(4) introduced in previous commit. Reported-by: syzbot+c6d2f2ad34b822bce98a@syzkaller.appspotmail.com
kernel: double fault trap, code=0 (4)	-1	C			493	2036d	2293d	3/4	2023d	c11d76984715 Syzkaller has found a stack overflow in socket splicing. Broadcast packets were resent through simplex broadcast delivery and socket splicing. Although there is an M_LOOP check in somove(9), it did not take effect. if_input_local() cleared the M_BCAST and M_MCAST flags with m_resethdr(). As if_input_local() is used for broadcast and multicast delivery, it was a mistake to delete them. Keep the M_BCAST and M_MCAST mbuf flags when packets are reinjected into the network stack. Reported-by: syzbot+a43ace363f1b663238f8@syzkaller.appspotmail.com OK anton@; discussed with claudio@
kernel: integer divide fault trap, code=0	-1	syz			4	2210d	2239d	3/4	2046d	39c2a1337a94 Reject rules with invalid port ranges
uvm_fault: wsevent_fini (3)	-1	C			2	2060d	2060d	3/4	2057d	996a5b4d63fa Fix yet another wscons race. In the same subsystem, the following properties must always hold true:
no output from test machine (6)	-1	C			2779	2076d	2098d	3/4	2076d	0124df67671a Fix handling of MSG_PEEK in soreceive() for the case where an empty mbuf is encountered in a seqpacket socket.
no output from test machine (5)	-1	C			49467	2098d	2195d	3/4	2098d	d6d1940044d6 Fix a deadlock between uvn_io() and uvn_flush(). While faulting on a page backed by a vnode, uvn_io() will end up being called in order to populate newly allocated pages using I/O on the backing vnode. Before performing the I/O, newly allocated pages are flagged as busy by uvn_get(), that is before uvn_io() tries to lock the vnode. Such pages could then end up being flushed by uvn_flush() which already has acquired the vnode lock. Since such pages are flagged as busy, uvn_flush() will wait for them to be flagged as not busy. This will never happens as uvn_io() cannot make progress until the vnode lock is released.
witness: userret: ioctl	-1	C			3	2103d	2103d	3/4	2102d	610c242e11d3 - missing NET_UNLOCK() in pf_ioctl.c error path
panic: spl assertion failure in yield	2	C			12	2230d	2248d	3/4	2103d	- move NET_LOCK() further down in pf_ioctl.c. Also move memory allocations outside of NET_LOCK()/PF_LOCK() scope in easy spots.
panic: malloc: allocation too large, type = 98, size = ADDR	2	C			2	2120d	2120d	3/4	2119d	Recent changes for PROT_NONE pages to not count against resource limits, failed to note this also guarded against heavy amap allocations in the MAP_SHARED case. Bring back the checks for MAP_SHARED from semarie, ok kettenis https://syzkaller.appspot.com/bug?extid=d80de26a8db6c009d060
panic: syn_cache_insert: cacheoverflow: impossible (2)	2	C			6	2176d	2222d	3/4	2154d	7c72bba2fa26 Convert tcp_sysctl to sysctl_bounded_args
uvm_fault: pfi_address_add	-1	syz			1359	2191d	2248d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
panic: sbdrop	2	syz			183	2183d	2482d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: soreceive	-1	syz			240	2191d	2457d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: pool_do_put (2)	-1	syz			53	2192d	2436d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
kernel: protection fault trap, code=0 (7)	-1	syz			774692	2181d	2425d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: in_delmulti	-1	syz			375431	2181d	2467d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
panic: tcp_output: template len != hdrlen - optlen	2	syz			487	2182d	2494d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
soreceive 1a	-1	syz			510	2183d	2340d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault (2)	-1	syz			1	2233d	2233d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
pool: cpu free list modified: mbufpl	-1	syz			15863	2181d	2467d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
soreceive 3	-1	syz			755	2181d	2340d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
uvm_fault: vio_rxeof	-1	syz			15700	2191d	2502d	3/4	2181d	efa3c3dd644f Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does. Fixes a bunch of panics reported by syzkaller.
no output from test machine (3)	-1	C			25293	2202d	2217d	3/4	2202d	A pty write containing VDISCARD, VREPRINT, or various retyping cases of VERASE would perform (sometimes irrelevant) compute in the kernel which can be heavy (especially with our insufficient tty subsystem locking). Use tsleep_nsec for 1 tick in such circumstances to yield cpu, and also bring interruptability to ptcwrite() https://syzkaller.appspot.com/bug?extid=462539bc18fef8fc26cc ok kettenis millert, discussions with greg and anton
panic: unhandled af (2)	2	C			22	2219d	2245d	3/4	2218d	38e8113e1d44 state import should accept AF_INET/AF_INET6 only
panic: syn_cache_insert: bucketoverflow: impossible	2	C			5	2231d	2249d	3/4	2228d	2b10bfc1e665 Refuse to set 0 or a negative value for net.inet.tcp.synbucketlimit.
no output from test machine	-1	C			551400	2269d	2844d	3/4	2269d	7bb4371dccb1 Do not wait indefinitely for flushing when closing a tty.
panic: m_copydata: null mbuf	2	C			396	2273d	2460d	3/4	2271d	574b3a4fa98d Do sanity checks in ip6_pullexthdr() preventing a panic in m_copydata(9).
uvm_fault: pfi_dynaddr_remove	-1	C			17	2394d	2398d	3/4	2287d	3d97bff14298 fix insufficient input sanitization in pf_rulecopyin() and pf_pool_copyin()
uvm_fault: pfr_detach_table	-1	C			12	2394d	2397d	3/4	2287d	3d97bff14298 fix insufficient input sanitization in pf_rulecopyin() and pf_pool_copyin()
panic: rw_enter: netlock locking against myself	2	syz			2	2298d	2298d	3/4	2295d	27427a72e313 In sosplice(), temporarily release the socket lock before calling FRELE() as the last reference could be dropped which in turn will cause soclose() to be called where the socket lock is unconditionally acquired. Note that this is only a problem for sockets protected by the non-recursive NET_LOCK() right now.
assert "p == curproc" failed in vfs_vops.c	-1	C			187	2307d	2308d	3/4	2305d	fc5a743df3a9 Revert previous, syzkaller found a way to trigger the KASSERT().
panic: vputonfreelist: lock count is not zero	2	C			2	2340d	2340d	3/4	2311d	2a9890d8c8d9 Relax the lockcount assertion in vputonfreelist(). Back when I fixed several problems with the vnode exclusive lock implementation, I overlooked the fact that a vnode can be in a state where the usecount is zero while the holdcount still being positive. There could still be threads waiting on the vnode lock in uvn_io() as long as the holdcount is positive.
kernel: double fault trap, code=0 (3)	-1	C			69	2326d	2335d	3/4	2326d	aa1987fe7ce4 Fix unlimited recursion caused by local outbound bcast/mcast packet sent via spliced socket.
pool: free list modified: aobjpl	-1	C			3	2424d	2436d	3/4	2334d	c5a231fb6c1e Grab a reference for the shared memory segment before calling uvm_map() as the same function could end up putting the thread to sleep. Allowing another thread to free the shared memory segment, which in turns causes a use-after-free.
kqueue: knote !QUEUED	-1	syz			8	2350d	2387d	3/4	2350d	8c4786361ce1 Raise SPL when updating kn_status. Otherwise the field can become inconsistent if knote_acquire() or knote_release() is preempted by an interrupt that modifies the same knote.
panic: unhandled af	2	C			21	2394d	2395d	3/4	2389d	4804479228fb Check address family of pf ioctl(2) DIOCNATLOOK parameter at kernel entry instead of calling panic() due to unhandled af. Reported-by: syzbot+92be143c2dd1746cf2af@syzkaller.appspotmail.com from Benjamin Baier
panic: attempt to execute user address	2	syz			1539	2400d	2494d	3/4	2396d	f30ff743e528 Fix some races in kqueue_register().
witness: reversal: vmmaplk inode	-1	C			103124	2411d	2738d	3/4	2411d	Use separate rwlock initializations for userland ("vmspace") and kernel maps. This lets witness know that these really are different classes avoiding false positives when detecting lock order reversals.
kernel: protection fault trap, code=0 (6)	-1	C			55024	2425d	2509d	3/4	2425d	0f83bb56e561 Fix a bad offset calculation in uvm_share.
panic: uvm_mapent_clone: no space in map for entry in empty map	2	C			12	2425d	2431d	3/4	2425d	0f83bb56e561 Fix a bad offset calculation in uvm_share.
panic: amap_pp_adjref: negative reference count	2	C			98	2435d	2487d	3/4	2425d	0f83bb56e561 Fix a bad offset calculation in uvm_share.
uvm_fault: uvm_unmap_remove (2)	-1	C			7836	2425d	2508d	3/4	2425d	3c82c0b2df98 Fix uvm_unmap_remove panic when tearing down VMs.
panic: uvmspace_fork: no space in map for entry in empty map	2	C			450	2433d	2488d	3/4	2425d	0f83bb56e561 Fix a bad offset calculation in uvm_share.
panic: ifa_update_broadaddr does not support dynamic length	2	syz			6780	2452d	2510d	3/4	2452d	b36fd3da6fde Do propper kernel input validation for in_control() ioctl(2) SIOCGIFADDR, SIOCGIFNETMASK, SIOCGIFDSTADDR, SIOCGIFBRDADDR, SIOCSIFADDR, SIOCSIFNETMASK, SIOCSIFDSTADDR, and SIOCSIFBRDADDR. Name in_ioctl_set_ifaddr() consistently. Use in_sa2sin() to validate inet address. Combine if_addrlist loops and add comment. Although netmask is not a inet address, length must be valid. Reported-by: syzbot+5fc6da002fc4e8d994be@syzkaller.appspotmail.com OK visa@
pool: free list modified: shmpl	-1	C			22	2608d	2702d	3/4	2461d	d13730a27993 Copy in the user-supplied buffer in shmctl(2) before looking up the shared memory segment. Otherwise, if copyin ends up sleeping it allows another thread to remove the same segment leading to a use-after-free.
malloc: free list modified: devbuf	-1	syz			5	2469d	2475d	3/4	2468d	put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
uvm_fault: witness_checkorder	-1	syz			2	2471d	2471d	3/4	2468d	put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
uvm_fault: filt_bpfrdetach	-1	syz			1	2469d	2469d	3/4	2468d	put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
uvm_fault: bpfioctl	-1	C			14	2476d	2560d	3/4	2468d	put bpfdesc reference counting back, revert change introduced in 1.175 as: BPF: remove redundant reference counting of filedescriptors
assert "ps->ps_uvncount == 0" failed in kern_unveil.c	-1	syz			226	2495d	2763d	3/4	2488d	a239dbafd306 Only increment the ps_uvncount counter when a path is successfully added to the corresponding red-black tree; meaning the path was not already present in the tree. This prevents an assertion to trigger in unveil_destroy() later on when the process exits.
uvm_fault: uvm_unmap_remove	-1	C			780	2508d	2527d	3/4	2508d	00ba8250173b vm_teardown() must be serialized since it modifies the global vmm_softc structure. Therefore grab the appropriate lock before calling the same function. This issue has been known for a while and reported before but lacking a way to easily reproduce it; until syzkaller came up with a reproducer.
panic: malloc: allocation too large, type = 2, size = ADDR (2)	2	C			16842	2510d	2527d	3/4	2510d	225e50e8a961 Do not decrement the number of VMs counter twice in one of vm_create() error paths. If creation of the first VM fails, the counter will wrap around to a huge value. The same value could later be passed to malloc() through vm_get_info() causing a panic.
kernel: protection fault trap, code=0 (5)	-1	C			607	2516d	2590d	3/4	2515d	a42056240bd9 Fix a route use after free in IPv6 multicast route. Move the mrt6_mcast6_del() out of the rtable_walk(). This avoids recursion to prevent stack overflow. Also it allows freeing the route outside of the walk. Now mrt6_mcast_del() frees the route only when it is deleted from the routing table. If that fails, it must not be freed. After the route is returned by mf6c_find(), it is reference counted. Then we need a rtfree(), but not in the other case. Name mrt6_mcast_add() and mrt6_mcast_del() consistently. Move rt_timer_remove_all() into mrt6_mcast_del(). Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com OK mpi@
witness: userret: returning with the following locks held:	-1	C			315	2525d	2735d	3/4	2525d	b808994cf339 When a thread tries to exclusively lock a vnode, the same thread must ensure that any other thread currently trying to acquire the underlying vnode lock has observed that the same vnode is about to be exclusively locked. Such threads must then sleep until the exclusive lock has been released and then try to acquire the lock again. Otherwise, exclusive access to the vnode cannot be guaranteed.
panic: vput: ref cnt	2	C			6	2538d	2539d	3/4	2536d	d627fa5cc364 Serialize access to the vnode pointers associated with acct(2) system accounting. Prevents a race where the acct thread and the acct(2) syscall both tries to close a vnode.
assert "timo || _kernel_lock_held()" failed in kern_synch.c	-1	C			2	2539d	2539d	3/4	2538d	93e05fce3bab Revert unlock of lseek(2) since vn_lock() could end up calling tsleep() which is not allowed without holding the kernel lock. Otherwise, wakeups could be lost.
panic: vrele: v_writecount != 0	2	C			51	2546d	2552d	3/4	2546d	3e253b4759f0 Favor vn_close() in the error path of diskmapioctl() since side-effects caused by calling vn_open() with write permissions must be reverted. Otherwise, the vfs subsystem could panic while releasing the last vnode reference if the writecount is still positive.
panic: vput: v_writecount != 0 (2)	2	C			112	2546d	2552d	3/4	2546d	3e253b4759f0 Favor vn_close() in the error path of diskmapioctl() since side-effects caused by calling vn_open() with write permissions must be reverted. Otherwise, the vfs subsystem could panic while releasing the last vnode reference if the writecount is still positive.
assert "cpipe->pipe_buffer.cnt == 0" failed in sys_pipe.c	-1	C			8	2573d	2573d	3/4	2573d	40f8ed5eebb0 backout the unlock of pipe(2) and pipe2(2)
kernel: protection fault trap, code=0 (4)	-1	C			759	2591d	2704d	3/4	2590d	cf34c7c30780 Prevent recursions by not deleting entries inside rtable_walk(9).
uvm_fault: arp_rtrequest	-1	C			79	2610d	2620d	3/4	2599d	4cb088386ee5 In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag is set. These mpls routes use the rt_llinfo structure to store the MPLS label and would confuse the arp and nd6 code. OK bluhm@ anton@
assert "(rt->rt_flags & RTF_MPATH) || mrt->rt_priority != prio" failed in rtable.c	-1	C			143	2610d	2623d	3/4	2599d	ff10691ed095 Copy the user provided sockaddr into a normalized sockaddr in rtrequest() before adding it to the routing table. The rtable code is doing memcmp() of those rt_dest sockaddrs so it is important that they are stored in a canonical form. To do this struct domain is extended to include the sockaddr size for this address family. OK bluhm@ anton@
uvm_fault: mrt6_ioctl	-1	C			2	2620d	2620d	3/4	2608d	a8f2b5c7d3d3 Add missing NULL check for the protocol control block (pcb) pointer in mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL.
uvm_fault: mrt_ioctl	-1	C			2	2609d	2609d	3/4	2608d	a8f2b5c7d3d3 Add missing NULL check for the protocol control block (pcb) pointer in mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL.
uvm_fault: pckbc_start (2)	-1	syz			2	2621d	2621d	3/4	2609d	bc79b6e32eb3 Prevent corruption of the pckbc command queue. If multiple synchronous commands are in flight and all corresponding threads are sleeping waiting for a response, the first command to timeout will clear the command queue. The remaining threads once awake will then try to remove a dequeued command from the queue, leading to corruption. Instead, remove commands from the queue before waking up the sleeping thread. A quirk is still needed to handle the case where tsleep() returns successfully during suspend.
assert "_kernel_lock_held()" failed in kern_event.c	-1	C			11	2639d	2642d	3/4	2609d	1be240a95e4a Removed all diagnostic, calling printf() here might create a recursion.
witness: reversal: &pr->ps_mtx &sched_lock	-1	C			141	2611d	2612d	3/4	2611d	17b25159f963 Revert to using the SCHED_LOCK() to protect time accounting.
uvm_fault: wsmux_do_ioctl (4)	-1	C			3	2624d	2648d	3/4	2622d	78fe050fe549 A problem fixed in wskbd is also present in wsmux. Repeating the previous commit message:
uvm_fault: rtm_report	-1	C			2	2647d	2647d	3/4	2632d	1b18c0494f67 Make rt_mpls_set() be more strict in what it accepts. Also ensure that the RTF_MPLS can't be toggled without rt_mpls_set() being called. While RTF_MPLS is part of RTF_FMASK it should be excluded from the flags and mask when they are applied to the route since toggling it requires a call to rt_mpls_set(). OK bluhm@
panic: mtx ADDR: locking against myself	2	C			3	2653d	2653d	3/4	2651d	vmm(4): remove a debug printf that was causing lock issues (it was being called from an IPI routine).
panic: timeout_add: to_ticks < 0 (2)	2	syz			12	2670d	2671d	3/4	2669d	bf2018479c9a Reject negative and too large timeouts passed to BIOCSRTIMEOUT. Since the timeout converted to ticks is later passed timeout_add(), it could cause a panic if the timeout is negative.
uvm_fault: rtable_satoplen (2)	-1	syz			101	2673d	2682d	3/4	2670d	575ef11475ca Add a more strict rtm_hdrlen size check. Make sure that at least struct rt_msghdr bytes are passed in. Also return a failure from rtm_xaddrs() if rti_addrs has bad flags or run out of space. Ok bluhm@
uvm_fault: memcpy	-1	C			460	2673d	2693d	3/4	2673d	575ef11475ca Add a more strict rtm_hdrlen size check. Make sure that at least struct rt_msghdr bytes are passed in. Also return a failure from rtm_xaddrs() if rti_addrs has bad flags or run out of space. Ok bluhm@
panic: malloc: allocation too large, type = 2, size = ADDR	2	C			914	2674d	2737d	3/4	2674d	fd7c80607c62 Restrict the number of allowed wsmux devices, just like wskbd and wsmouse already does. Otherwise, malloc could panic if the device minor is sufficiently large.
assert "tname->un_flags & UNVEIL_USERSET" failed in kern_unveil.c	-1	C			1447	2677d	2680d	3/4	2677d	f4c23aa848ae Remove this assert, I can't do this here with UNVEIL_INSPECT added aggressively today. Hopefully post release a glorious flensing will remove UNVEIL_INSPECT anyway
witness: acquiring duplicate lock of same type: "&sc->sc_lock"	-1	C			231	2712d	2714d	3/4	2712d	1f8a38b155bf When adding a wsmux device to an existing wsmux device using ioctl(WSMUXIO_ADD_DEVICE), two distinct locks of the same type are acquired. Thus, witness will emit warning. Since acquiring two different locks of the same type is harmless in this context, relax the witness check by flagging the locks as RWL_DUPOK.
panic: timeout_add: to_ticks < 0	2	C			66	2712d	2717d	3/4	2712d	3cfc9cae129c Reject negative input from userland in spkrioctl(). One of the arguments are later passed to timeout_add() which panics if the given ticks are negative. While here, clamp arguments in pcppi_bell() in order to prevent overflow.
uvm_fault: wsmux_detach_sc	-1	syz			10	2716d	2727d	3/4	2714d	0c0bf6318018 Serialize access to the list of attached child devices belonging to a wsmux. When invoking wsevsrc_* functions on a attached child device, underlying driver can sleep; this introduces a race where another thread is able to modify the list leading to all kinds of corruptions.
panic: vmmaplk: lock not shared	2	C			16	2725d	2737d	3/4	2724d	Always refault if relocking maps fails after IO. This fixes a regression
panic: pool_p_free: semupl free list modified: page ADDR; item addr ADDR; offset 0x0=ADDR	2	C			5	2725d	2844d	3/4	2724d	When freeing the sem_undo structure in semundo_adjust(), update the
pool: free list modified: semupl	-1	C			6	2731d	2844d	3/4	2724d	When freeing the sem_undo structure in semundo_adjust(), update the
uvm_fault: wsmux_do_ioctl (2)	-1	C			17	2732d	2736d	3/4	2731d	In wskbdclose(), use the same logic as in wskbdopen() to determine if
kernel: protection fault trap, code=0 (3)	-1	C			3	2736d	2737d	3/4	2736d	Validate the user-supplied device index given to WSMUXIO_ADD_DEVICE. The same
kernel: protection fault trap, code=0 (2)	-1	syz			109	2742d	2765d	3/4	2741d	Introduce a dedicated entry point data structure for file locks. This new data
panic: malformed IPv4 option passed to ip_optcopy (2)	2	C			149	2747d	2751d	3/4	2744d	Bring back the ip_pcbopts() refactor. Pad the option buffer and therefor the mbuf to the next word length as it is required by the standard. Also use the correct offset from the input mbuf. OK visa@, input & OK bluhm@
panic: uvm_fault_unwire_locked: address not in map	2	C			2	2769d	2769d	3/4	2753d	Hold a read lock on the map while doing the actual device I/O during in
assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c	-1	C			2	2767d	2767d	3/4	2753d	Hold a read lock on the map while doing the actual device I/O during in
panic: malformed IPv4 option passed to ip_optcopy	2	C			10	2767d	2776d	3/4	2756d	Validate the version, and all length fields of IP packets passed to a raw socket
panic: m_zero: M_READONLY	2	C			3	2761d	2761d	3/4	2756d	It is possible to call m_zero with a read-only cluster. In that case just
assert "__mp_lock_held(&sched_lock, curcpu()) == 0" failed in kern_lock.c	-1	C			17	2758d	2769d	3/4	2757d	ec412da11be4 Fix unsafe use of ptsignal() in mi_switch().
pool: free list modified: mbufpl	-1	syz			13	2777d	2790d	3/4	2757d	54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
uvm_fault: switchwrite	-1	syz			7	2768d	2788d	3/4	2757d	54e30ac1a804 Fix mbuf releated crashes in switch(4). They have been found by syzkaller as pool corruption panic. It is unclear which bug caused what, but it should be better now. - Check M_PKTHDR with assertion before accessing m_pkthdr. - Do not access oh_length without m_pullup(). - After checking if there is space at the end of the mbuf, don't overwrite the data at the beginning. Append the new content. - Do not set m_len and m_pkthdr.len when it is unclear whether the ofp_error header fits at all. Use m_makespace() to adjust the mbuf. Reported-by: syzbot+6efc0a9d5b700b54392e@syzkaller.appspotmail.com test akoshibe@; OK claudio@
panic: pr_find_pagehead: mbufpl: page header missing	2	C			10	2777d	2790d	3/4	2766d	Fix mbuf releated crashes in switch(4). They have been found by
pool: free list modified: mcl2k	-1	C			4	2775d	2829d	3/4	2774d	Replace a wrong poor mans m_trailingspace() with the real thing. The mbuf
panic: receive 3: so ADDR, so_type 1, m ADDR, m_type 6	2	C			18	2776d	2786d	3/4	2775d	When using MSG_WAITALL, soreceive() can sleep while processing the receive buffer of a stream socket. Then a new pair of control and data mbuf can be appended to the mbuf queue. In this case, terminate the loop with a short read to prevent a panic. Userland should read the control message with the next system call. OK claudio@ deraadt@
panic: kernel diagnostic assertion "M_DATABUF(m) + M_SIZE(m) >= (m->m_data + m->m_len)" failed: file "/syzkaller/manager	2	C			7	2785d	2791d	3/4	2775d	49729d6ed45f In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees the inpcb apart from the disconnect. Just call soisdisconnected() and clear the inp->inp_faddr since the socket is still valid after a disconnect. Problem found by syzkaller via Greg Steuck OK visa@ Fixes: Reported-by: syzbot+2cd350dfe5c96f6469f2@syzkaller.appspotmail.com Reported-by: syzbot+139ac2d7d3d60162334b@syzkaller.appspotmail.com Reported-by: syzbot+02168317bd0156c13b69@syzkaller.appspotmail.com Reported-by: syzbot+de8d2459ecf4cdc576a1@syzkaller.appspotmail.com
uvm_fault: sogetopt	-1	C			2	2793d	2793d	1/4	2790d	In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
kernel: protection fault trap, code=0	-1	C			16	2790d	2795d	1/4	2790d	In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
uvm_fault: ip_ctloutput	-1	C			11	2790d	2794d	1/4	2790d	In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees
uvm_fault: ip_pcbopts	-1	C			6	2790d	2794d	1/4	2790d	In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter frees