git: abe84e611076 - main - stress2: Added syzkaller reproducers
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 12 May 2025 10:07:20 UTC
The branch main has been updated by pho:
URL: https://cgit.FreeBSD.org/src/commit/?id=abe84e61107639cdb5b7854ff74f9a5a91984e3d
commit abe84e61107639cdb5b7854ff74f9a5a91984e3d
Author: Peter Holm <pho@FreeBSD.org>
AuthorDate: 2025-05-12 10:06:37 +0000
Commit: Peter Holm <pho@FreeBSD.org>
CommitDate: 2025-05-12 10:06:37 +0000
stress2: Added syzkaller reproducers
---
tools/test/stress2/misc/syzkaller76.sh | 235 ++++++++++++++++++++++++++
tools/test/stress2/misc/syzkaller77.sh | 290 +++++++++++++++++++++++++++++++++
tools/test/stress2/misc/syzkaller78.sh | 282 ++++++++++++++++++++++++++++++++
tools/test/stress2/misc/syzkaller79.sh | 82 ++++++++++
4 files changed, 889 insertions(+)
diff --git a/tools/test/stress2/misc/syzkaller76.sh b/tools/test/stress2/misc/syzkaller76.sh
new file mode 100755
index 000000000000..67a566cbfa00
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller76.sh
@@ -0,0 +1,235 @@
+#!/bin/sh
+
+# panic: aio_process_rw: opcode 70
+# cpuid = 7
+# time = 1746175480
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe010844ccb0
+# vpanic() at vpanic+0x136/frame 0xfffffe010844cde0
+# panic() at panic+0x43/frame 0xfffffe010844ce40
+# aio_process_rw() at aio_process_rw+0x28e/frame 0xfffffe010844cea0
+# aio_daemon() at aio_daemon+0x286/frame 0xfffffe010844cef0
+# fork_exit() at fork_exit+0x82/frame 0xfffffe010844cf30
+# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe010844cf30
+# --- trap 0xc, rip = 0x2020f02a472a, rsp = 0x2020ec9bb8d8, rbp = 0x2020ec9bb9d0 ---
+# KDB: enter: panic
+# [ thread pid 71553 tid 100216 ]
+# Stopped at kdb_enter+0x33: movq $0,0x122f9c2(%rip)
+# db> x/s version
+# version: FreeBSD 15.0-CURRENT #0 main-n276945-2735c20d114f-dirty: Fri May 2 07:17:00 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=0549d8c089382a2593078734cc8166a0fc9049f1
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+b6e15476c91852bb2264@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <pwd.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+uint64_t r[1] = {0xffffffffffffffff};
+
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ intptr_t res = 0;
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ res = syscall(SYS_freebsd10_pipe, /*pipefd=*/0x2000000005c0ul);
+ if (res != -1)
+ r[0] = *(uint32_t*)0x2000000005c4;
+ syscall(SYS_close, /*fd=*/r[0]);
+ memcpy((void*)0x200000000080, ".\000", 2);
+ syscall(SYS_open, /*file=*/0x200000000080ul, /*flags=*/0ul, /*mode=*/0ul);
+ *(uint32_t*)0x200000000080 = 0;
+ *(uint32_t*)0x200000000084 = 0;
+ *(uint32_t*)0x200000000088 = 4;
+ *(uint64_t*)0x200000000090 = 0;
+ *(uint64_t*)0x200000000098 = 0;
+ *(uint32_t*)0x2000000000a0 = 0;
+ *(uint32_t*)0x2000000000a4 = 8;
+ *(uint64_t*)0x2000000000a8 = 0x7fffffffffffffff;
+ *(uint32_t*)0x2000000000b0 = 0;
+ *(uint32_t*)0x2000000000b4 = 0x100;
+ *(uint64_t*)0x2000000000b8 = 0;
+ *(uint32_t*)0x2000000000c0 = 0;
+ *(uint32_t*)0x2000000000c4 = 0;
+ *(uint32_t*)0x2000000000c8 = 0;
+ *(uint32_t*)0x2000000000cc = 3;
+ *(uint32_t*)0x2000000000d0 = 0;
+ *(uint32_t*)0x2000000000d4 = 0;
+ *(uint32_t*)0x2000000000d8 = 0x400008;
+ *(uint32_t*)0x2000000000dc = 0x8e;
+ *(uint32_t*)0x2000000000e0 = 0xfffffffd;
+ *(uint32_t*)0x2000000000e4 = 0xf;
+ *(uint32_t*)0x2000000000e8 = 0xfffffffc;
+ *(uint32_t*)0x2000000000ec = 0;
+ *(uint32_t*)0x2000000000f0 = 0;
+ *(uint32_t*)0x2000000000f4 = 0;
+ *(uint32_t*)0x2000000000f8 = 0xff;
+ *(uint32_t*)0x2000000000fc = 0;
+ *(uint32_t*)0x200000000100 = 0;
+ *(uint32_t*)0x200000000104 = 2;
+ *(uint32_t*)0x200000000108 = 0;
+ *(uint32_t*)0x20000000010c = 2;
+ *(uint32_t*)0x200000000110 = 2;
+ *(uint32_t*)0x200000000114 = 0x5bee;
+ *(uint32_t*)0x200000000118 = 0;
+ *(uint32_t*)0x20000000011c = 0xc;
+ *(uint32_t*)0x200000000120 = 3;
+ *(uint32_t*)0x200000000124 = 2;
+ *(uint32_t*)0x200000000128 = 0;
+ *(uint32_t*)0x20000000012c = 0x10000000;
+ *(uint32_t*)0x200000000130 = 0;
+ *(uint32_t*)0x200000000134 = 1;
+ *(uint32_t*)0x200000000138 = 0;
+ *(uint32_t*)0x20000000013c = 0x83;
+ *(uint32_t*)0x200000000140 = 0;
+ *(uint32_t*)0x200000000144 = 0;
+ *(uint32_t*)0x200000000148 = 0;
+ *(uint32_t*)0x20000000014c = 0;
+ *(uint32_t*)0x200000000150 = 0;
+ *(uint32_t*)0x200000000154 = 0xfff;
+ *(uint32_t*)0x200000000158 = 1;
+ *(uint32_t*)0x20000000015c = 0x4c;
+ *(uint32_t*)0x200000000160 = 0x1fffffc;
+ *(uint32_t*)0x200000000164 = 4;
+ *(uint32_t*)0x200000000168 = 0x40000001;
+ *(uint32_t*)0x20000000016c = 0;
+ *(uint32_t*)0x200000000170 = 8;
+ *(uint32_t*)0x200000000174 = 0;
+ *(uint32_t*)0x200000000178 = 0;
+ *(uint32_t*)0x20000000017c = 0x100001;
+ *(uint32_t*)0x200000000180 = 0;
+ *(uint32_t*)0x200000000184 = 0x1ff;
+ *(uint32_t*)0x200000000188 = 0xe;
+ *(uint32_t*)0x20000000018c = 8;
+ *(uint32_t*)0x200000000190 = 0;
+ *(uint32_t*)0x200000000194 = 0;
+ *(uint32_t*)0x200000000198 = 0;
+ *(uint32_t*)0x20000000019c = 0xc;
+ *(uint32_t*)0x2000000001a0 = 9;
+ *(uint32_t*)0x2000000001a4 = 2;
+ *(uint32_t*)0x2000000001a8 = 0x10000002;
+ *(uint32_t*)0x2000000001ac = 0x100000;
+ *(uint32_t*)0x2000000001b0 = 0x46;
+ *(uint32_t*)0x2000000001b4 = 6;
+ *(uint32_t*)0x2000000001b8 = 0x3ff;
+ *(uint32_t*)0x2000000001bc = 2;
+ *(uint32_t*)0x2000000001c0 = 0;
+ *(uint32_t*)0x2000000001c4 = 0xfffffffa;
+ *(uint32_t*)0x2000000001c8 = 0x200;
+ *(uint32_t*)0x2000000001cc = 0;
+ *(uint32_t*)0x2000000001d0 = 1;
+ *(uint32_t*)0x2000000001d4 = 3;
+ *(uint32_t*)0x2000000001d8 = 0;
+ *(uint32_t*)0x2000000001dc = 0x100;
+ *(uint32_t*)0x2000000001e0 = 0;
+ *(uint32_t*)0x2000000001e4 = 8;
+ *(uint32_t*)0x2000000001e8 = 0x108c6b2;
+ *(uint32_t*)0x2000000001ec = 0xfffffffa;
+ *(uint32_t*)0x2000000001f0 = 0;
+ *(uint32_t*)0x2000000001f4 = 5;
+ *(uint32_t*)0x2000000001f8 = 0;
+ *(uint32_t*)0x2000000001fc = 0;
+ *(uint32_t*)0x200000000200 = 0;
+ *(uint32_t*)0x200000000204 = 0;
+ *(uint32_t*)0x200000000208 = 0;
+ *(uint32_t*)0x20000000020c = 0x80;
+ *(uint32_t*)0x200000000210 = 0;
+ *(uint32_t*)0x200000000214 = 1;
+ *(uint32_t*)0x200000000218 = 0;
+ *(uint32_t*)0x20000000021c = 6;
+ *(uint32_t*)0x200000000220 = 0;
+ *(uint32_t*)0x200000000224 = 0;
+ *(uint32_t*)0x200000000228 = 0;
+ *(uint32_t*)0x20000000022c = 6;
+ *(uint32_t*)0x200000000230 = 0;
+ *(uint32_t*)0x200000000234 = 0;
+ *(uint32_t*)0x200000000238 = 0;
+ *(uint32_t*)0x20000000023c = 0xa9f;
+ syscall(SYS_ioctl, /*fd=*/(intptr_t)-1, /*cmd=*/0xc1c06d02ul,
+ /*arg=*/0x200000000080ul);
+ *(uint32_t*)0x200000000580 = -1;
+ *(uint64_t*)0x200000000588 = 0;
+ *(uint64_t*)0x200000000590 = 0x200000000180;
+ *(uint64_t*)0x200000000598 = 0;
+ *(uint32_t*)0x2000000005a0 = 0xfffff000;
+ *(uint32_t*)0x2000000005a4 = 3;
+ *(uint64_t*)0x2000000005a8 = 0;
+ *(uint32_t*)0x2000000005b0 = 0;
+ *(uint32_t*)0x2000000005b4 = 0;
+ *(uint64_t*)0x2000000005b8 = 0;
+ *(uint64_t*)0x2000000005c0 = 0;
+ *(uint64_t*)0x2000000005c8 = 0;
+ *(uint32_t*)0x2000000005d0 = 0;
+ *(uint32_t*)0x2000000005d4 = 0;
+ *(uint64_t*)0x2000000005d8 = 0;
+ *(uint16_t*)0x2000000005e0 = 0x4043;
+ *(uint32_t*)0x200000000620 = -1;
+ *(uint64_t*)0x200000000628 = 0;
+ *(uint64_t*)0x200000000630 = 0;
+ *(uint64_t*)0x200000000638 = 0;
+ *(uint32_t*)0x200000000640 = 0x10;
+ *(uint32_t*)0x200000000644 = 0;
+ *(uint64_t*)0x200000000648 = 0;
+ *(uint32_t*)0x200000000650 = 0;
+ *(uint32_t*)0x200000000654 = 0;
+ *(uint64_t*)0x200000000658 = 8;
+ *(uint64_t*)0x200000000660 = 0x3ff;
+ *(uint64_t*)0x200000000668 = 0;
+ *(uint32_t*)0x200000000670 = 1;
+ *(uint32_t*)0x200000000674 = 0;
+ *(uint32_t*)0x200000000678 = 3;
+ *(uint16_t*)0x200000000680 = 0;
+ *(uint32_t*)0x2000000006c0 = -1;
+ *(uint64_t*)0x2000000006c8 = 0;
+ *(uint64_t*)0x2000000006d0 = 0;
+ *(uint64_t*)0x2000000006d8 = 0;
+ *(uint32_t*)0x2000000006e0 = 0;
+ *(uint32_t*)0x2000000006e4 = 0;
+ *(uint64_t*)0x2000000006e8 = 2;
+ *(uint32_t*)0x2000000006f0 = 0;
+ *(uint32_t*)0x2000000006f4 = 0;
+ *(uint64_t*)0x2000000006f8 = 0x101;
+ *(uint64_t*)0x200000000700 = 0xb3;
+ *(uint64_t*)0x200000000708 = 0;
+ *(uint32_t*)0x200000000710 = 0;
+ *(uint32_t*)0x200000000714 = 0xa;
+ *(uint64_t*)0x200000000718 = 3;
+ *(uint32_t*)0x200000000720 = 0;
+ syscall(SYS_lio_listio, /*mode=*/0ul, /*list=*/0x200000000580ul, /*nent=*/3ul,
+ /*sig=*/0ul);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+timeout 3m /tmp/$prog > /dev/null 2>&1
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller77.sh b/tools/test/stress2/misc/syzkaller77.sh
new file mode 100755
index 000000000000..c77a3fd2dd22
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller77.sh
@@ -0,0 +1,290 @@
+#!/bin/sh
+
+# panic: sofree:1883 curvnet is NULL, so=0xfffff8017ca59000
+# cpuid = 8
+# time = 1746559098
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0182b5c8d0
+# vpanic() at vpanic+0x136/frame 0xfffffe0182b5ca00
+# panic() at panic+0x43/frame 0xfffffe0182b5ca60
+# sorele_locked() at sorele_locked+0x25f/frame 0xfffffe0182b5ca90
+# uipc_sendfile_wait() at uipc_sendfile_wait+0x1df/frame 0xfffffe0182b5caf0
+# vn_sendfile() at vn_sendfile+0x59b/frame 0xfffffe0182b5cd70
+# sendfile() at sendfile+0x129/frame 0xfffffe0182b5ce00
+# amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe0182b5cf30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0182b5cf30
+# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x8223fb72a, rsp = 0x824baaf58, rbp = 0x824baaf90 ---
+# KDB: enter: panic
+# [ thread pid 6382 tid 103296 ]
+# Stopped at kdb_enter+0x33: movq $0,0x122f202(%rip)
+# db> x/s version
+# version: FreeBSD 15.0-CURRENT #0 main-n277057-794e792121ba-dirty: Tue May 6 18:34:20 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=f04b36c4f2b84533225a1bd695a0aed2efa559e5
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+7b0b20cf2c672c181d98@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/syscall.h>
+#include <time.h>
+#include <unistd.h>
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void thread_start(void* (*fn)(void*), void* arg)
+{
+ pthread_t th;
+ pthread_attr_t attr;
+ pthread_attr_init(&attr);
+ pthread_attr_setstacksize(&attr, 128 << 10);
+ int i = 0;
+ for (; i < 100; i++) {
+ if (pthread_create(&th, &attr, fn, arg) == 0) {
+ pthread_attr_destroy(&attr);
+ return;
+ }
+ if (errno == EAGAIN) {
+ usleep(50);
+ continue;
+ }
+ break;
+ }
+ exit(1);
+}
+
+typedef struct {
+ pthread_mutex_t mu;
+ pthread_cond_t cv;
+ int state;
+} event_t;
+
+static void event_init(event_t* ev)
+{
+ if (pthread_mutex_init(&ev->mu, 0))
+ exit(1);
+ if (pthread_cond_init(&ev->cv, 0))
+ exit(1);
+ ev->state = 0;
+}
+
+static void event_reset(event_t* ev)
+{
+ ev->state = 0;
+}
+
+static void event_set(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ if (ev->state)
+ exit(1);
+ ev->state = 1;
+ pthread_mutex_unlock(&ev->mu);
+ pthread_cond_broadcast(&ev->cv);
+}
+
+static void event_wait(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ while (!ev->state)
+ pthread_cond_wait(&ev->cv, &ev->mu);
+ pthread_mutex_unlock(&ev->mu);
+}
+
+static int event_isset(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static int event_timedwait(event_t* ev, uint64_t timeout)
+{
+ uint64_t start = current_time_ms();
+ uint64_t now = start;
+ pthread_mutex_lock(&ev->mu);
+ for (;;) {
+ if (ev->state)
+ break;
+ uint64_t remain = timeout - (now - start);
+ struct timespec ts;
+ ts.tv_sec = remain / 1000;
+ ts.tv_nsec = (remain % 1000) * 1000 * 1000;
+ pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
+ now = current_time_ms();
+ if (now - start > timeout)
+ break;
+ }
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+struct thread_t {
+ int created, call;
+ event_t ready, done;
+};
+
+static struct thread_t threads[16];
+static void execute_call(int call);
+static int running;
+
+static void* thr(void* arg)
+{
+ struct thread_t* th = (struct thread_t*)arg;
+ for (;;) {
+ event_wait(&th->ready);
+ event_reset(&th->ready);
+ execute_call(th->call);
+ __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->done);
+ }
+ return 0;
+}
+
+static void loop(void)
+{
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ int i, call, thread;
+ for (call = 0; call < 8; call++) {
+ for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
+ thread++) {
+ struct thread_t* th = &threads[thread];
+ if (!th->created) {
+ th->created = 1;
+ event_init(&th->ready);
+ event_init(&th->done);
+ event_set(&th->done);
+ thread_start(thr, th);
+ }
+ if (!event_isset(&th->done))
+ continue;
+ event_reset(&th->done);
+ th->call = call;
+ __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->ready);
+ event_timedwait(&th->done, 50);
+ break;
+ }
+ }
+ for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
+ sleep_ms(1);
+}
+
+uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
+ 0xffffffffffffffff, 0xffffffffffffffff};
+
+void execute_call(int call)
+{
+ intptr_t res = 0;
+ switch (call) {
+ case 0:
+ memcpy((void*)0x200000000480, "./file0\000", 8);
+ res = syscall(
+ SYS_open, /*file=*/0x200000000480ul,
+ /*flags=O_NONBLOCK|O_CREAT|O_RDWR|0x80000000000000*/ 0x80000000000206ul,
+ /*mode=*/0ul);
+ if (res != -1)
+ r[0] = res;
+ break;
+ case 1:
+ syscall(SYS_ftruncate, /*fd=*/r[0], /*len=*/0x3862ul);
+ break;
+ case 2:
+ res = syscall(SYS_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88);
+ if (res != -1)
+ r[1] = res;
+ break;
+ case 3:
+ res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_STREAM*/ 1ul,
+ /*proto=*/0, /*fds=*/0x200000000180ul);
+ if (res != -1) {
+ r[2] = *(uint32_t*)0x200000000180;
+ r[3] = *(uint32_t*)0x200000000184;
+ }
+ break;
+ case 4:
+ syscall(SYS_dup2, /*oldfd=*/r[2], /*newfd=*/r[1]);
+ break;
+ case 5:
+ memcpy((void*)0x200000000140, "./file0\000", 8);
+ res = syscall(SYS_open, /*file=*/0x200000000140ul, /*flags=*/0ul,
+ /*mode=*/0ul);
+ if (res != -1)
+ r[4] = res;
+ break;
+ case 6:
+ syscall(SYS_sendfile, /*fd=*/r[4], /*s=*/r[1], /*offset=*/0ul,
+ /*nbytes=*/0ul, /*hdtr=*/0ul, /*sbytes=*/0ul,
+ /*flags=SF_SYNC|SF_NOCACHE*/ 0x14ul);
+ break;
+ case 7:
+ syscall(SYS_dup2, /*oldfd=*/r[4], /*newfd=*/r[3]);
+ break;
+ }
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ loop();
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+(cd ../testcases/swap; ./swap -t 3m -i 30 -l 100 > /dev/null 2>&1) &
+sleep 5
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+for i in `jot 30`; do
+ (
+ mkdir d$i
+ cd d$i
+ timeout 3m /tmp/$prog > /dev/null 2>&1 &
+ )
+done
+while pgrep -q $prog; do sleep 2; done
+while pkill swap; do :; done
+wait
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller78.sh b/tools/test/stress2/misc/syzkaller78.sh
new file mode 100755
index 000000000000..1858129d4c81
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller78.sh
@@ -0,0 +1,282 @@
+#!/bin/sh
+
+# Fatal trap 12: page fault while in kernel mode
+# cpuid = 10; apic id = 07
+# fault virtual address = 0x0
+# fault code = supervisor read data, page not present
+# instruction pointer = 0x20:0xffffffff80c3c276
+# stack pointer = 0x28:0xfffffe017273eb00
+# frame pointer = 0x28:0xfffffe017273eb30
+# code segment = base 0x0, limit 0xfffff, type 0x1b
+# = DPL 0, pres 1, long 1, def32 0, gran 1
+# processor eflags = interrupt enabled, resume, IOPL = 0
+# current process = 43905 (syzkaller78)
+# rdi: fffff8005b5d55e0 rsi: 0000000000000008 rdx: ffffffff81249e88
+# rcx: fffff8001b9aed00 r8: 0000000000000000 r9: fffff80003396000
+# rax: 0000000000000000 rbx: fffff8005b5d5400 rbp: fffffe017273eb30
+# r10: 0000000000000000 r11: fffff804d84e9c60 r12: fffff8005b5d55f8
+# r13: 0000000000000000 r14: fffff80497171700 r15: fffff8005b5d55c0
+# trap number = 12
+# panic: page fault
+# cpuid = 7
+# time = 1746555157
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe017273e830
+# vpanic() at vpanic+0x136/frame 0xfffffe017273e960
+# panic() at panic+0x43/frame 0xfffffe017273e9c0
+# trap_pfault() at trap_pfault+0x48d/frame 0xfffffe017273ea30
+# calltrap() at calltrap+0x8/frame 0xfffffe017273ea30
+# --- trap 0xc, rip = 0xffffffff80c3c276, rsp = 0xfffffe017273eb00, rbp = 0xfffffe017273eb30 ---
+# unp_dispose() at unp_dispose+0x3b6/frame 0xfffffe017273eb30
+# uipc_detach() at uipc_detach+0x35/frame 0xfffffe017273eb80
+# sorele_locked() at sorele_locked+0x107/frame 0xfffffe017273ebb0
+# soclose() at soclose+0x17d/frame 0xfffffe017273ec10
+# _fdrop() at _fdrop+0x1b/frame 0xfffffe017273ec30
+# closef() at closef+0x1e3/frame 0xfffffe017273ecc0
+# fdescfree() at fdescfree+0x41e/frame 0xfffffe017273ed80
+# exit1() at exit1+0x4a4/frame 0xfffffe017273edf0
+# sys_exit() at sys_exit+0xd/frameamd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe017273ef30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe017273ef30
+# --- syscall (1, FreeBSD ELF64, exit), rip = 0x823ab472a, rsp = 0x8208e3ea8, rbp = 0x8208e3ec0 ---
+# KDB: enter: panic
+# [ thread pid 43905 tid 103344 ]
+# Stopped at kdb_enter+0x33: movq $0,0x122f202(%rip)
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=46eb92ee6e2f6acbd4250d0f2065b1f93296bd82
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+0e99ffc200638909ca1c@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <dirent.h>
+#include <errno.h>
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static unsigned long long procid;
+
+static void kill_and_wait(int pid, int* status)
+{
+ kill(pid, SIGKILL);
+ while (waitpid(-1, status, 0) != pid) {
+ }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void use_temporary_dir(void)
+{
+ char tmpdir_template[] = "./syzkaller.XXXXXX";
+ char* tmpdir = mkdtemp(tmpdir_template);
+ if (!tmpdir)
+ exit(1);
+ if (chmod(tmpdir, 0777))
+ exit(1);
+ if (chdir(tmpdir))
+ exit(1);
+}
+
+static void reset_flags(const char* filename)
+{
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE |
+ SF_APPEND | UF_APPEND);
+ if (lchflags(filename, st.st_flags))
+ exit(1);
+}
+static void __attribute__((noinline)) remove_dir(const char* dir)
+{
+ DIR* dp = opendir(dir);
+ if (dp == NULL) {
+ if (errno == EACCES) {
+ if (rmdir(dir))
+ exit(1);
+ return;
+ }
+ exit(1);
+ }
+ struct dirent* ep = 0;
+ while ((ep = readdir(dp))) {
+ if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
+ continue;
+ char filename[FILENAME_MAX];
+ snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ if (S_ISDIR(st.st_mode)) {
+ remove_dir(filename);
+ continue;
+ }
+ if (unlink(filename)) {
+ if (errno == EPERM) {
+ reset_flags(filename);
+ reset_flags(dir);
+ if (unlink(filename) == 0)
+ continue;
+ }
+ exit(1);
+ }
+ }
+ closedir(dp);
+ while (rmdir(dir)) {
+ if (errno == EPERM) {
+ reset_flags(dir);
+ if (rmdir(dir) == 0)
+ break;
+ }
+ exit(1);
+ }
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+ int iter = 0;
+ for (;; iter++) {
+ char cwdbuf[32];
+ sprintf(cwdbuf, "./%d", iter);
+ if (mkdir(cwdbuf, 0777))
+ exit(1);
+ int pid = fork();
+ if (pid < 0)
+ exit(1);
+ if (pid == 0) {
+ if (chdir(cwdbuf))
+ exit(1);
+ execute_one();
+ exit(0);
+ }
+ int status = 0;
+ uint64_t start = current_time_ms();
+ for (;;) {
+ sleep_ms(10);
+ if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+ break;
+ if (current_time_ms() - start < 5000)
+ continue;
+ kill_and_wait(pid, &status);
+ break;
+ }
+ remove_dir(cwdbuf);
+ }
+}
+
+uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff,
+ 0xffffffffffffffff, 0xffffffffffffffff};
+
+void execute_one(void)
+{
+ intptr_t res = 0;
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ memcpy((void*)0x200000000480, "./file0\000", 8);
+ res = syscall(
+ SYS_open, /*file=*/0x200000000480ul,
+ /*flags=O_NONBLOCK|O_CREAT|O_RDWR|0x80000000000000*/ 0x80000000000206ul,
+ /*mode=*/0ul);
+ if (res != -1)
+ r[0] = res;
+ syscall(SYS_ftruncate, /*fd=*/r[0], /*len=*/0x3862ul);
+ memcpy((void*)0x200000000100, "./file0\000", 8);
+ res = syscall(SYS_open, /*file=*/0x200000000100ul,
+ /*flags=O_DIRECT*/ 0x10000ul, /*mode=*/0ul);
+ if (res != -1)
+ r[1] = res;
+ *(uint64_t*)0x2000000000c0 = 0x200000000340;
+ *(uint64_t*)0x2000000000c8 = 0x41;
+ syscall(SYS_readv, /*fd=*/r[1], /*vec=*/0x2000000000c0ul, /*vlen=*/1ul);
+ res = syscall(SYS_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88);
+ if (res != -1)
+ r[2] = res;
+ res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_STREAM*/ 1ul,
+ /*proto=*/0, /*fds=*/0x200000000180ul);
+ if (res != -1)
+ r[3] = *(uint32_t*)0x200000000180;
+ syscall(SYS_dup2, /*oldfd=*/r[3], /*newfd=*/r[2]);
+ memcpy((void*)0x200000000140, "./file0\000", 8);
+ res =
+ syscall(SYS_open, /*file=*/0x200000000140ul, /*flags=*/0ul, /*mode=*/0ul);
+ if (res != -1)
+ r[4] = res;
+ syscall(SYS_sendfile, /*fd=*/r[4], /*s=*/r[2], /*offset=*/0xcbul,
+ /*nbytes=*/0x2000ul, /*hdtr=*/0ul, /*sbytes=*/0ul,
+ /*flags=SF_USER_READAHEAD|SF_NODISKIO|0x2*/ 0xbul);
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ for (procid = 0; procid < 4; procid++) {
+ if (fork() == 0) {
+ use_temporary_dir();
+ loop();
+ }
+ }
+ sleep(1000000);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+(cd ../testcases/swap; ./swap -t 3m -i 30 -l 100 > /dev/null 2>&1) &
+sleep 5
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+for i in `jot 30`; do
+ (
+ mkdir d$i
+ cd d$i
+ timeout 3m /tmp/$prog > /dev/null 2>&1 &
+ )
+done
+while pgrep -q $prog; do sleep 2; done
+while pkill swap; do :; done
+wait
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller79.sh b/tools/test/stress2/misc/syzkaller79.sh
new file mode 100755
index 000000000000..7413a2034a3d
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller79.sh
@@ -0,0 +1,82 @@
+#!/bin/sh
+
+# panic: mutex so_rcv not owned at ../../../kern/uipc_usrreq.c:1750
+# cpuid = 5
+# time = 1746938647
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01e75c5b40
+# vpanic() at vpanic+0x136/frame 0xfffffe01e75c5c70
+# panic() at panic+0x43/frame 0xfffffe01e75c5cd0
+# __mtx_assert() at __mtx_assert+0xa9/frame 0xfffffe01e75c5ce0
+# knote() at knote+0x45/frame 0xfffffe01e75c5d30
+# sowwakeup_locked() at sowwakeup_locked+0xc8/frame 0xfffffe01e75c5d50
+# socantsendmore() at socantsendmore+0x4f/frame 0xfffffe01e75c5d70
+# uipc_shutdown() at uipc_shutdown+0x113/frame 0xfffffe01e75c5db0
+# soshutdown() at soshutdown+0x3e/frame 0xfffffe01e75c5dd0
+# kern_shutdown() at kern_shutdown+0x5e/frame 0xfffffe01e75c5e00
+# amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe01e75c5f30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01e75c5f30
+# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x82281772a, rsp = 0x82092efd8, rbp = 0x82092f000 ---
+# KDB: enter: panic
+# [ thread pid 54792 tid 1014483 ]
+# Stopped at kdb_enter+0x33: movq $0,0x122f192(%rip)
+# db> x/s version
+# version: FreeBSD 15.0-CURRENT #0 main-n277201-48578dcb6b7e-dirty: Sat May 10 13:10:42 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=ac94349a29f2efc40e9274239e4ca9b2c473a4e7
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzkaller.appspot.com/x/repro.c?x=16c074d4580000
+
+#define _GNU_SOURCE
+
+#include <pwd.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+uint64_t r[1] = {0xffffffffffffffff};
+
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ intptr_t res = 0;
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul,
+ /*proto=*/0, /*fds=*/0x200000000040ul);
+ if (res != -1)
+ r[0] = *(uint32_t*)0x200000000044;
+ syscall(SYS_fcntl, /*fd=*/r[0], /*cmd=*/4ul, /*flags=FASYNC*/ 0x40ul);
+ syscall(SYS_shutdown, /*fd=*/r[0], /*how=*/2ul);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+timeout 3m /tmp/$prog > /dev/null 2>&1
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/$prog.?????? $work
+exit 0