#!/bin/sh

# panic: mtx_lock() of spin mutex (null) @ ../../../kern/sys_socket.c:785
# cpuid = 7
# time = 1622878256
# KDB: stack backtrace:
# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01aaec6880
# vpanic() at vpanic+0x181/frame 0xfffffe01aaec68d0
# panic() at panic+0x43/frame 0xfffffe01aaec6930
# __mtx_lock_flags() at __mtx_lock_flags+0x13c/frame 0xfffffe01aaec6980
# soo_aio_cancel() at soo_aio_cancel+0x51/frame 0xfffffe01aaec69b0
# aio_cancel_job() at aio_cancel_job+0x95/frame 0xfffffe01aaec69f0
# aio_proc_rundown() at aio_proc_rundown+0xcf/frame 0xfffffe01aaec6a40
# exit1() at exit1+0x36e/frame 0xfffffe01aaec6ab0
# sys_sys_exit() at sys_sys_exit+0xd/frame 0xfffffe01aaec6ac0
# amd64_syscall() at amd64_syscall+0x147/frame 0xfffffe01aaec6bf0
# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01aaec6bf0
# --- syscall (1, FreeBSD ELF64, sys_sys_exit), rip = 0x8003b230a, rsp = 0x7fffffffe528, rbp = 0x7fffffffe540 ---
# KDB: enter: panic
# [ thread pid 3000 tid 100365 ]
# Stopped at      kdb_enter+0x37: movq    $0,0x127fb8e(%rip)
# db> x/s version
# version: FreeBSD 14.0-CURRENT #0 main-n247181-1b5bc3a54b6: Sat Jun  5 04:12:19 CEST 2021
# pho@t2.osted.lan:/usr/src/sys/amd64/compile/PHO
# db>

[ `uname -p` != "amd64" ] && exit 0
[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1

. ../default.cfg
cat > /tmp/syzkaller40.c <<EOF
// https://syzkaller.appspot.com/bug?id=00ad0c11fe2e5d29ae3d19d529251a14abe1f335
// autogenerated by syzkaller (https://github.com/google/syzkaller)
// Reported-by: syzbot+c8aa122fa2c6a4e2a28b@syzkaller.appspotmail.com

#define _GNU_SOURCE

#include <pwd.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/endian.h>
#include <sys/syscall.h>
#include <unistd.h>

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
  syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
  intptr_t res = 0;
  res = syscall(SYS_socket, 0x1cul, 1ul, 0);
  if (res != -1)
    r[0] = res;
  *(uint32_t*)0x20000200 = r[0];
  *(uint64_t*)0x20000208 = 8;
  *(uint64_t*)0x20000210 = 0;
  *(uint64_t*)0x20000218 = 0;
  *(uint32_t*)0x20000220 = 0x100;
  *(uint32_t*)0x20000224 = 9;
  *(uint64_t*)0x20000228 = 0x80000000;
  *(uint32_t*)0x20000230 = 5;
  *(uint32_t*)0x20000234 = 1;
  *(uint64_t*)0x20000238 = 6;
  *(uint64_t*)0x20000240 = 2;
  *(uint64_t*)0x20000248 = 0;
  *(uint32_t*)0x20000250 = 1;
  *(uint32_t*)0x20000254 = 3;
  *(uint64_t*)0x20000258 = 0x109;
  *(uint32_t*)0x20000260 = 0;
  syscall(SYS_aio_read, 0x20000200ul);
  syscall(SYS_listen, r[0], 0x8273);
  return 0;
}
EOF
mycc -o /tmp/syzkaller40 -Wall -Wextra -O0 /tmp/syzkaller40.c -lpthread ||
    exit 1

(cd /tmp; timeout 3m ./syzkaller40)

rm -rf /tmp/syzkaller40 syzkaller40.c /tmp/syzkaller.*
exit 0