aboutsummaryrefslogtreecommitdiff
path: root/tools
diff options
context:
space:
mode:
Diffstat (limited to 'tools')
-rw-r--r--tools/build/Makefile4
-rw-r--r--tools/build/cross-build/include/common/sys/cdefs.h10
-rw-r--r--tools/build/mk/OptionalObsoleteFiles.inc21
-rw-r--r--tools/build/options/WITHOUT_BLACKLIST6
-rw-r--r--tools/build/options/WITHOUT_BLACKLIST_SUPPORT8
-rw-r--r--tools/build/options/WITHOUT_BLOCKLIST4
-rw-r--r--tools/build/options/WITHOUT_BLOCKLIST_SUPPORT6
-rw-r--r--tools/test/stress2/misc/all.exclude6
-rwxr-xr-xtools/test/stress2/misc/fuzz.sh6
-rwxr-xr-xtools/test/stress2/misc/kevent17.sh176
-rwxr-xr-xtools/test/stress2/misc/kevent18.sh152
-rwxr-xr-xtools/test/stress2/misc/kevent19.sh187
-rwxr-xr-xtools/test/stress2/misc/syzkaller84.sh402
-rwxr-xr-xtools/test/stress2/misc/syzkaller85.sh499
-rwxr-xr-xtools/test/stress2/misc/syzkaller86.sh555
-rwxr-xr-xtools/test/stress2/misc/unionfs20.sh206
-rw-r--r--tools/tools/crypto/cryptocheck.c9
-rw-r--r--tools/tools/nanobsd/rescue/Files/root/ZFS_Create.txt8
-rw-r--r--tools/tools/netrate/tcpp/README2
-rw-r--r--tools/tools/sysdoc/tunables.mdoc2
20 files changed, 2247 insertions, 22 deletions
diff --git a/tools/build/Makefile b/tools/build/Makefile
index 09351900599a..fdec5f11311d 100644
--- a/tools/build/Makefile
+++ b/tools/build/Makefile
@@ -85,6 +85,10 @@ INCS+= stdlib.h
SRCS+= reallocarray.c
.endif
+.if !exists(${HOST_INCLUDE_ROOT}/stdckdint.h)
+INCS+= stdckdint.h
+.endif
+
.if exists(${HOST_INCLUDE_ROOT}/sys/stat.h)
_WITH_UTIMENS!= grep -c utimensat ${HOST_INCLUDE_ROOT}/sys/stat.h || true
.else
diff --git a/tools/build/cross-build/include/common/sys/cdefs.h b/tools/build/cross-build/include/common/sys/cdefs.h
index 3f9b7866141f..faad5eccb3af 100644
--- a/tools/build/cross-build/include/common/sys/cdefs.h
+++ b/tools/build/cross-build/include/common/sys/cdefs.h
@@ -270,6 +270,16 @@
#define __ISO_C_VISIBLE 2011
#define __EXT1_VISIBLE 1
+/*
+ * Macro to test if we're using a specific version of gcc or later.
+ */
+#if defined(__GNUC__)
+#define __GNUC_PREREQ__(ma, mi) \
+ (__GNUC__ > (ma) || __GNUC__ == (ma) && __GNUC_MINOR__ >= (mi))
+#else
+#define __GNUC_PREREQ__(ma, mi) 0
+#endif
+
/* Alignment builtins for better type checking and improved code generation. */
/* Provide fallback versions for other compilers (GCC/Clang < 10): */
#if !__has_builtin(__builtin_is_aligned)
diff --git a/tools/build/mk/OptionalObsoleteFiles.inc b/tools/build/mk/OptionalObsoleteFiles.inc
index 13d7703148d2..7cf742616e63 100644
--- a/tools/build/mk/OptionalObsoleteFiles.inc
+++ b/tools/build/mk/OptionalObsoleteFiles.inc
@@ -161,7 +161,26 @@ OLD_FILES+=usr/share/man/man8/bhyveload.8.gz
OLD_DIRS+=usr/share/examples/bhyve
.endif
-.if ${MK_BLACKLIST} == no
+.if ${MK_BLOCKLIST} == no
+OLD_FILES+=etc/blocklistd.conf
+OLD_FILES+=etc/rc.d/blocklistd
+OLD_FILES+=usr/include/blocklist.h
+OLD_FILES+=usr/lib/libblocklist.a
+OLD_FILES+=usr/lib/libblocklist_p.a
+OLD_FILES+=usr/lib/libblocklist.so
+OLD_LIBS+=usr/lib/libblocklist.so.0
+OLD_FILES+=usr/libexec/blocklistd-helper
+OLD_FILES+=usr/sbin/blocklistctl
+OLD_FILES+=usr/sbin/blocklistd
+OLD_FILES+=usr/share/man/man3/blocklist.3.gz
+OLD_FILES+=usr/share/man/man3/blocklist_close.3.gz
+OLD_FILES+=usr/share/man/man3/blocklist_open.3.gz
+OLD_FILES+=usr/share/man/man3/blocklist_r.3.gz
+OLD_FILES+=usr/share/man/man3/blocklist_sa.3.gz
+OLD_FILES+=usr/share/man/man3/blocklist_sa_r.3.gz
+OLD_FILES+=usr/share/man/man5/blocklistd.conf.5.gz
+OLD_FILES+=usr/share/man/man8/blocklistctl.8.gz
+OLD_FILES+=usr/share/man/man8/blocklistd.8.gz
OLD_FILES+=etc/blacklistd.conf
OLD_FILES+=etc/rc.d/blacklistd
OLD_FILES+=usr/include/blacklist.h
diff --git a/tools/build/options/WITHOUT_BLACKLIST b/tools/build/options/WITHOUT_BLACKLIST
index c54c83f27553..df9c9a41227f 100644
--- a/tools/build/options/WITHOUT_BLACKLIST
+++ b/tools/build/options/WITHOUT_BLACKLIST
@@ -1,4 +1,2 @@
-Set this if you do not want to build
-.Xr blacklistd 8
-and
-.Xr blacklistctl 8 .
+This option has been renamed to
+.Va WITHOUT_BLOCKLIST .
diff --git a/tools/build/options/WITHOUT_BLACKLIST_SUPPORT b/tools/build/options/WITHOUT_BLACKLIST_SUPPORT
index ff1c2c43d595..cd484727d636 100644
--- a/tools/build/options/WITHOUT_BLACKLIST_SUPPORT
+++ b/tools/build/options/WITHOUT_BLACKLIST_SUPPORT
@@ -1,6 +1,2 @@
-Build some programs without
-.Xr libblacklist 3
-support, like
-.Xr fingerd 8
-and
-.Xr sshd 8 .
+This option has been renamed to
+.Va WITHOUT_BLOCKLIST_SUPPORT .
diff --git a/tools/build/options/WITHOUT_BLOCKLIST b/tools/build/options/WITHOUT_BLOCKLIST
new file mode 100644
index 000000000000..c456a98c672f
--- /dev/null
+++ b/tools/build/options/WITHOUT_BLOCKLIST
@@ -0,0 +1,4 @@
+Set this if you do not want to build
+.Xr blocklistd 8
+and
+.Xr blocklistctl 8 .
diff --git a/tools/build/options/WITHOUT_BLOCKLIST_SUPPORT b/tools/build/options/WITHOUT_BLOCKLIST_SUPPORT
new file mode 100644
index 000000000000..f06ebc6e4263
--- /dev/null
+++ b/tools/build/options/WITHOUT_BLOCKLIST_SUPPORT
@@ -0,0 +1,6 @@
+Build some programs without
+.Xr libblocklist 3
+support, like
+.Xr fingerd 8
+and
+.Xr sshd 8 .
diff --git a/tools/test/stress2/misc/all.exclude b/tools/test/stress2/misc/all.exclude
index f9b32db95799..0658bfdc0c1b 100644
--- a/tools/test/stress2/misc/all.exclude
+++ b/tools/test/stress2/misc/all.exclude
@@ -25,6 +25,7 @@ gnop13.sh https://people.freebsd.org/~pho/stress/log/log0386.txt 20221113
gnop7.sh Waiting for patch commit 20190820
gnop8.sh Waiting for patch commit 20201214
gnop9.sh Waiting for patch commit 20201214
+graid1_3.sh Hang seen 20250915
graid1_8.sh Known issue 20170909
graid1_9.sh panic: Bad effnlink 20180212
lockf5.sh Spinning threads seen 20160718
@@ -74,10 +75,13 @@ syzkaller67.sh panic: ASan: Invalid access, 8-byte read at ... 20230621
syzkaller80.sh panic 20250711
syzkaller81.sh panic 20250711
syzkaller82.sh panic: m_apply, length > size of mbuf chain 20250724
+syzkaller84.sh panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) 20250810
+syzkaller85.sh panic: Assertion uio->uio_resid < 0 failed 20250928
+syzkaller86.sh Fatal trap 12: page fault while in kernel mode 20251001
+write2.sh panic: sndbuf_acquire: count 255 > free 0 20251003
quota3.sh https://people.freebsd.org/~pho/stress/log/log0604.txt 20250728
quota6.sh https://people.freebsd.org/~pho/stress/log/log0456.txt 20240707
truss3.sh WiP 20200915
-zfs18.sh https://people.freebsd.org/~pho/stress/log/log0560.txt 20241118
zfs9.sh panic: sacked_bytes < 0 20250711
# Test not to run for other reasons:
diff --git a/tools/test/stress2/misc/fuzz.sh b/tools/test/stress2/misc/fuzz.sh
index 189cdbfebd01..add3d0d19a21 100755
--- a/tools/test/stress2/misc/fuzz.sh
+++ b/tools/test/stress2/misc/fuzz.sh
@@ -49,6 +49,7 @@
. ../default.cfg
D=$diskimage
+backup=/tmp/fuzz.sh.diskimage.`date +%Y%m%dT%H%M%S`.gz
tst() {
rm -f $D
@@ -62,6 +63,7 @@ tst() {
for i in `jot 50`; do
./fuzz -n 50 $D
+ gzip < $D > $backup
if fsck -f -y /dev/md$mdstart 2>&1 | egrep "^[A-Z]" > /dev/null; then
if fsck -f -y /dev/md$mdstart 2>&1 | egrep "^[A-Z]" > /dev/null; then
if fsck -f -y /dev/md$mdstart 2>&1 | egrep "^[A-Z]" > /dev/null; then
@@ -73,7 +75,7 @@ tst() {
sync;sync;sync
if mount /dev/md$mdstart $mntpoint; then
ls -l $mntpoint > /dev/null
- find $mntpoint -exec dd if={} of=/dev/null bs=1m count=3 \; > /dev/null 2>&1
+ find $mntpoint -type f -exec dd if={} of=/dev/null bs=1m count=3 \; > /dev/null 2>&1
umount $mntpoint
else
echo "Giving up at loop $i"
@@ -96,7 +98,7 @@ for j in `jot 10`; do
date '+%T'
tst
done
-rm -f fuzz
+rm -f fuzz $backup
exit
diff --git a/tools/test/stress2/misc/kevent17.sh b/tools/test/stress2/misc/kevent17.sh
new file mode 100755
index 000000000000..e7b8f1a0a00c
--- /dev/null
+++ b/tools/test/stress2/misc/kevent17.sh
@@ -0,0 +1,176 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# A kqueuex(KQUEUE_CPONFORK) test scenario
+# Test scenario suggestion by: kib
+
+. ../default.cfg
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+dir=/tmp
+odir=`pwd`
+prog=$(basename "$0" .sh)
+cd $dir
+sed '1,/^EOF/d' < $odir/$0 > $dir/$prog.c
+mycc -o $prog -Wall -Wextra -O0 -g $prog.c || exit 1
+rm -f $prog.c
+cd $odir
+
+set -e
+mount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint
+[ -c /dev/md$mdstart ] && mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 2g -u $mdstart
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+set +e
+
+(cd $odir/../testcases/swap; ./swap -t 5m -i 20 -h -l 100 > /dev/null) &
+cd $mntpoint
+$dir/$prog
+s=$?
+[ -f $prog.core -a $s -eq 0 ] &&
+ { ls -l $prog.core; mv $prog.core /tmp; s=1; }
+cd $odir
+while pkill -9 swap; do :; done
+wait
+
+for i in `jot 6`; do
+ mount | grep -q "on $mntpoint " || break
+ umount $mntpoint && break || sleep 10
+done
+[ $i -eq 6 ] && exit 1
+mdconfig -d -u $mdstart
+rm -rf $dir/$prog
+exit $s
+
+EOF
+#include <sys/param.h>
+#include <sys/event.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#include <machine/atomic.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+static volatile u_int *share;
+static int loops;
+static char *file = "file";
+
+#define MAXLOOPS 100
+#define PARALLEL 1
+#define RUNTIME (2 * 60)
+#define SYNC 0
+
+static void
+test(void)
+{
+ pid_t pid;
+ struct kevent ev[2];
+ struct timespec ts;
+ int kq, fd, n;
+
+ if ((fd = open(file, O_RDONLY, 0)) == -1)
+ err(1, "open(%s). %s:%d", file, __func__, __LINE__);
+
+ atomic_add_int(&share[SYNC], 1);
+ while (share[SYNC] != PARALLEL)
+ usleep(10000);
+
+ if ((kq = kqueuex(KQUEUE_CPONFORK)) < 0)
+ err(1, "kqueuex");
+
+ ts.tv_sec = 5;
+ ts.tv_nsec = 0;
+ n = 0;
+ EV_SET(&ev[n], fd, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_CLEAR,
+ NOTE_DELETE, 0, 0);
+ n++;
+
+ if (kevent(kq, ev, n, NULL, 0, NULL) < 0)
+ err(1, "kevent()");
+ if (loops >= MAXLOOPS) { /* start using fork(2) */
+ if ((pid = fork()) == 0) {
+ n = kevent(kq, NULL, 0, ev, 1, &ts);
+ if (n == -1)
+ err(1, "kevent() in fork\n");
+ close(fd);
+ close(kq);
+ _exit(0);
+ }
+ if (waitpid(pid, NULL, 0) != pid)
+ err(1, "waitpid(%d)\n", pid);
+ }
+
+ n = kevent(kq, NULL, 0, ev, 1, &ts);
+ if (n == -1)
+ err(1, "kevent()");
+ close(fd);
+ close(kq);
+
+ _exit(0);
+}
+
+int
+main(void)
+{
+ pid_t pids[PARALLEL];
+ size_t len;
+ time_t start;
+ int e, fd, i, status;
+
+ e = 0;
+ len = PAGE_SIZE;
+ loops = 0;
+ if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
+ err(1, "mmap");
+
+ start = time(NULL);
+ while ((time(NULL) - start) < RUNTIME && e == 0) {
+ loops++;
+ if ((fd = open(file, O_CREAT | O_TRUNC | O_RDWR, 0660)) ==
+ -1)
+ err(1, "open(%s)", file);
+ close(fd);
+ share[SYNC] = 0;
+ for (i = 0; i < PARALLEL; i++) {
+
+ if ((pids[i] = fork()) == 0)
+ test();
+ if (pids[i] == -1)
+ err(1, "fork()");
+ }
+ while (share[SYNC] != PARALLEL)
+ usleep(10000);
+ if (unlink(file) == -1)
+ err(1, "unlink(%s). %s:%d\n", file,
+ __FILE__, __LINE__);
+ for (i = 0; i < PARALLEL; i++) {
+ if (waitpid(pids[i], &status, 0) == -1)
+ err(1, "waitpid(%d)", pids[i]);
+ if (status != 0) {
+ if (WIFSIGNALED(status))
+ fprintf(stderr,
+ "pid %d exit signal %d\n",
+ pids[i], WTERMSIG(status));
+ }
+ e += status == 0 ? 0 : 1;
+ }
+ }
+
+ return (e);
+}
diff --git a/tools/test/stress2/misc/kevent18.sh b/tools/test/stress2/misc/kevent18.sh
new file mode 100755
index 000000000000..1492c49e2921
--- /dev/null
+++ b/tools/test/stress2/misc/kevent18.sh
@@ -0,0 +1,152 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# A kqueuex(KQUEUE_CPONFORK) test scenario
+
+# Sleeping thread seen in WiP code:
+# https://people.freebsd.org/~pho/stress/log/log0615.txt
+
+. ../default.cfg
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+ulimit -k 5000 || { echo FAIL; exit 1; }
+
+odir=`pwd`
+prog=$(basename "$0" .sh)
+
+cd /tmp
+sed '1,/^EOF/d' < $odir/$0 > $prog.c
+mycc -o $prog -Wall -Wextra -O2 -g $prog.c -lpthread || exit 1
+rm -f $prog.c
+cd $odir
+
+mount | grep "on $mntpoint " | grep -q md$mdstart && umount -f $mntpoint
+mdconfig -l | grep -q $mdstart && mdconfig -d -u $mdstart
+
+mdconfig -a -t swap -s 2g -u $mdstart
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+chmod 777 $mntpoint
+
+su $testuser -c "(cd $mntpoint; /tmp/$prog)" &
+for i in `jot 99`; do
+ sleep 1
+ kill -0 $! 2>/dev/null || break
+done
+pkill $prog
+wait
+umount -f $mntpoint
+
+while mount | grep -q $mntpoint; do
+ umount $mntpoint || sleep 1
+done
+mdconfig -d -u $mdstart
+rm -f /tmp/$prog
+
+exit 0
+EOF
+#include <sys/types.h>
+#include <sys/event.h>
+#include <sys/mman.h>
+#include <sys/wait.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define PARALLEL 64
+
+static int fd;
+static char path[80];
+
+static void *
+spin(void *arg __unused)
+{
+ int i;
+
+ for (i= 0;; i++) {
+ snprintf(path, sizeof(path), "file.%06d.%d", getpid(), i);
+ fd = open(path, O_CREAT | O_TRUNC | O_RDWR, 0622);
+ if (fd == -1 && errno == ENOTDIR)
+ break;
+ if (fd == -1)
+ err(1, "open(%s)", path);
+ close(fd);
+ fd = 0;
+ unlink(path);
+ }
+ fprintf(stderr, "spin loops: %d\n", i + 1);
+ return (NULL);
+}
+
+static void *
+test(void *arg __unused)
+{
+ struct kevent ev;
+ struct timespec ts;
+ pid_t pid;
+ int i, kq, n;
+
+ for (i = 0; i < 500000; i++) {
+ if ((kq = kqueuex(KQUEUE_CPONFORK)) < 0)
+ err(1, "kqueueex(KQUEUE_CPONFORK)");
+
+ n = 0;
+ memset(&ev, 0, sizeof(ev));
+ EV_SET(&ev, fd, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_CLEAR,
+ NOTE_DELETE|NOTE_RENAME|NOTE_EXTEND, 0, 0);
+ n++;
+
+ if ((pid = fork()) == 0) {
+ kevent(kq, &ev, n, NULL, 0, NULL);
+ _exit(0);
+ }
+ if (waitpid(pid, NULL, 0) != pid)
+ err(1, "waitpid(%d)", pid);
+
+ kevent(kq, &ev, n, NULL, 0, NULL);
+ memset(&ev, 0, sizeof(ev));
+ ts.tv_sec = 0;
+ ts.tv_nsec = 1000000;
+ if ((n = kevent(kq, NULL, 0, &ev, 1, &ts)) == -1)
+ err(1, "kevent()");
+
+ close(kq);
+ }
+ return (NULL);
+}
+
+int
+main(void)
+{
+ pthread_t cp[PARALLEL], sp;
+ int e, i;
+
+ if ((e = pthread_create(&sp, NULL, spin, NULL)) != 0)
+ errc(1, e, "pthread_create");
+
+ for (i = 0; i < PARALLEL; i++) {
+ if ((e = pthread_create(&cp[i], NULL, test, NULL)) != 0)
+ errc(1, e, "pthread_create");
+ }
+
+ for (i = 0; i < PARALLEL; i++)
+ pthread_join(cp[i], NULL);
+ pthread_join(sp, NULL);
+
+ close(fd);
+
+ return (0);
+}
diff --git a/tools/test/stress2/misc/kevent19.sh b/tools/test/stress2/misc/kevent19.sh
new file mode 100755
index 000000000000..0170fe0d93c8
--- /dev/null
+++ b/tools/test/stress2/misc/kevent19.sh
@@ -0,0 +1,187 @@
+#!/bin/sh
+
+# A kqueuex(KQUEUE_CPONFORK) test scenario
+
+set -u
+prog=$(basename "$0" .sh)
+
+cat > /tmp/$prog.c <<EOF
+/* \$Id: kqfork.c,v 1.4 2025/08/19 19:42:16 kostik Exp kostik $ */
+
+#include <sys/param.h>
+#include <sys/event.h>
+#include <err.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#ifndef KQUEUE_CPONFORK
+#define KQUEUE_CPONFORK 0x2
+#endif
+
+static pid_t pid_pipe_beat;
+static pid_t pid_controller;
+
+static void
+sighup_handler(int sig __unused)
+{
+ kill(pid_pipe_beat, SIGKILL);
+ _exit(1);
+}
+
+static void
+pipe_beat(int wp)
+{
+ static const char a[1] = { 'a' };
+ ssize_t s;
+
+ for (;;) {
+ sleep(1);
+ s = write(wp, a, 1);
+ if (s < 0)
+ err(1, "pipe write");
+ if (s == 0)
+ errx(1, "short pipe write");
+ }
+}
+
+static void
+worker(int kq, int rp)
+{
+ struct kevent ev[1];
+ char a[1];
+ ssize_t s;
+ int n;
+
+ for (;;) {
+ n = kevent(kq, NULL, 0, ev, nitems(ev), NULL);
+ if (n == -1) {
+ kill(pid_controller, SIGHUP);
+ err(1, "kqueue");
+ }
+ if (n == 0)
+ continue; // XXXKIB
+ switch (ev[0].filter) {
+ case EVFILT_TIMER:
+ printf("tick\n");
+ break;
+ case EVFILT_READ:
+ if (ev[0].ident != (uintptr_t)rp) {
+ kill(pid_controller, SIGHUP);
+ errx(1, "unknown read ident %d\n", (int)ev[0].ident);
+ }
+ s = read(rp, a, sizeof(a));
+ if (s == -1) {
+ kill(pid_controller, SIGHUP);
+ err(1, "read");
+ }
+ if (s == 0) {
+ kill(pid_controller, SIGHUP);
+ errx(1, "EOF");
+ }
+ printf("%c\n", a[0]);
+ break;
+ default:
+ kill(pid_controller, SIGHUP);
+ errx(1, "unknown fiter %d\n", ev[0].filter);
+ break;
+ }
+ }
+}
+
+static void
+usage(void)
+{
+ fprintf(stderr, "Usage: kqfork [fork]\n");
+ exit(2);
+}
+
+int
+main(int argc, char *argv[])
+{
+ struct kevent ev[2];
+ struct sigaction sa;
+ int kq, n, pp[2];
+ pid_t pid_worker;
+ bool do_fork;
+
+ do_fork = false;
+ if (argc != 1 && argc != 2)
+ usage();
+ if (argc == 2) {
+ if (strcmp(argv[1], "fork") != 0)
+ usage();
+ do_fork = true;
+ }
+
+ memset(&sa, 0, sizeof(sa));
+ sa.sa_handler = sighup_handler;
+ if (sigaction(SIGHUP, &sa, NULL) == -1)
+ err(1, "sigaction(SIGHUP)");
+
+ memset(&sa, 0, sizeof(sa));
+ sa.sa_flags = SA_NOCLDWAIT | SA_NOCLDSTOP;
+ sa.sa_handler = SIG_IGN;
+ if (sigaction(SIGCHLD, &sa, NULL) == -1)
+ err(1, "sigaction(SIGCHLD)");
+
+ if (pipe(pp) == -1)
+ err(1, "pipe");
+
+ pid_pipe_beat = fork();
+ if (pid_pipe_beat == -1)
+ err(1, "fork");
+ if (pid_pipe_beat == 0) {
+ close(pp[0]);
+ pipe_beat(pp[1]);
+ }
+
+ kq = kqueuex(do_fork ? KQUEUE_CPONFORK : 0);
+ if (kq == -1)
+ err(1, "kqueuex");
+
+ EV_SET(&ev[0], 1, EVFILT_TIMER, EV_ADD, NOTE_SECONDS, 1, NULL);
+ EV_SET(&ev[1], pp[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
+ n = kevent(kq, ev, nitems(ev), NULL, 0, NULL);
+ if (n == -1) {
+ kill(pid_pipe_beat, SIGKILL);
+ err(1, "kevent reg");
+ }
+ if (n != 0) {
+ kill(pid_pipe_beat, SIGKILL);
+ errx(1, "kevent reg %d", n);
+ }
+
+ pid_controller = getpid();
+
+ if (do_fork) {
+ pid_worker = fork();
+ if (pid_worker == -1) {
+ kill(pid_pipe_beat, SIGKILL);
+ err(1, "fork");
+ }
+ if (pid_worker == 0) {
+ close(pp[1]);
+ worker(kq, pp[0]);
+ }
+
+ for (;;)
+ pause();
+ } else {
+ worker(kq, pp[0]);
+ }
+ exit(0); // unreachable
+}
+EOF
+cc -o /tmp/$prog -Wall -Wextra -O2 /tmp/$prog.c || exit 1
+
+echo "--> No fork"
+timeout 4s /tmp/$prog
+echo "--> fork"
+timeout 4s /tmp/$prog fork
+
+rm -f /tmp/$prog.c $prog
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller84.sh b/tools/test/stress2/misc/syzkaller84.sh
new file mode 100755
index 000000000000..a7976be2eeb6
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller84.sh
@@ -0,0 +1,402 @@
+#!/bin/sh
+
+# panic: Assertion !(sb->sb_state & SBS_CANTRCVMORE) failed at ../../../kern/uipc_usrreq.c:1549
+# cpuid = 6
+# time = 1754809105
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0176ef6a80
+# vpanic() at vpanic+0x136/frame 0xfffffe0176ef6bb0
+# panic() at panic+0x43/frame 0xfffffe0176ef6c10
+# uipc_soreceive_stream_or_seqpacket() at uipc_soreceive_stream_or_seqpacket+0x968/frame 0xfffffe0176ef6cd0
+# soreceive() at soreceive+0x45/frame 0xfffffe0176ef6cf0
+# kern_recvit() at kern_recvit+0x181/frame 0xfffffe0176ef6da0
+# sys_recvmsg() at sys_recvmsg+0x67/frame 0xfffffe0176ef6e00
+# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0176ef6f30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0176ef6f30
+# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x821d3da8a, rsp = 0x824440f68, rbp = 0x824440f90 ---
+# KDB: enter: panic
+# [ thread pid 17448 tid 292963 ]
+# Stopped at kdb_enter+0x33: movq $0,0x12304a2(%rip)
+# db> x/s version
+# version: FreeBSD 15.0-PRERELEASE #0 main-n279510-db7c0e32a05d-dirty: Sat Aug 9 17:21:54 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=79d6de939eb5c7de69e8e4993b6239aa0ae67335
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+ffcc3612ea266e36604e@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <errno.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static unsigned long long procid;
+
+static void kill_and_wait(int pid, int* status)
+{
+ kill(pid, SIGKILL);
+ while (waitpid(-1, status, 0) != pid) {
+ }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void thread_start(void* (*fn)(void*), void* arg)
+{
+ pthread_t th;
+ pthread_attr_t attr;
+ pthread_attr_init(&attr);
+ pthread_attr_setstacksize(&attr, 128 << 10);
+ int i = 0;
+ for (; i < 100; i++) {
+ if (pthread_create(&th, &attr, fn, arg) == 0) {
+ pthread_attr_destroy(&attr);
+ return;
+ }
+ if (errno == EAGAIN) {
+ usleep(50);
+ continue;
+ }
+ break;
+ }
+ exit(1);
+}
+
+typedef struct {
+ pthread_mutex_t mu;
+ pthread_cond_t cv;
+ int state;
+} event_t;
+
+static void event_init(event_t* ev)
+{
+ if (pthread_mutex_init(&ev->mu, 0))
+ exit(1);
+ if (pthread_cond_init(&ev->cv, 0))
+ exit(1);
+ ev->state = 0;
+}
+
+static void event_reset(event_t* ev)
+{
+ ev->state = 0;
+}
+
+static void event_set(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ if (ev->state)
+ exit(1);
+ ev->state = 1;
+ pthread_mutex_unlock(&ev->mu);
+ pthread_cond_broadcast(&ev->cv);
+}
+
+static void event_wait(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ while (!ev->state)
+ pthread_cond_wait(&ev->cv, &ev->mu);
+ pthread_mutex_unlock(&ev->mu);
+}
+
+static int event_isset(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static int event_timedwait(event_t* ev, uint64_t timeout)
+{
+ uint64_t start = current_time_ms();
+ uint64_t now = start;
+ pthread_mutex_lock(&ev->mu);
+ for (;;) {
+ if (ev->state)
+ break;
+ uint64_t remain = timeout - (now - start);
+ struct timespec ts;
+ ts.tv_sec = remain / 1000;
+ ts.tv_nsec = (remain % 1000) * 1000 * 1000;
+ pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
+ now = current_time_ms();
+ if (now - start > timeout)
+ break;
+ }
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static void sandbox_common()
+{
+ struct rlimit rlim;
+ rlim.rlim_cur = rlim.rlim_max = 128 << 20;
+ setrlimit(RLIMIT_AS, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 8 << 20;
+ setrlimit(RLIMIT_MEMLOCK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_FSIZE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_STACK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 0;
+ setrlimit(RLIMIT_CORE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 256;
+ setrlimit(RLIMIT_NOFILE, &rlim);
+}
+
+static void loop();
+
+static int do_sandbox_none(void)
+{
+ sandbox_common();
+ loop();
+ return 0;
+}
+
+struct thread_t {
+ int created, call;
+ event_t ready, done;
+};
+
+static struct thread_t threads[16];
+static void execute_call(int call);
+static int running;
+
+static void* thr(void* arg)
+{
+ struct thread_t* th = (struct thread_t*)arg;
+ for (;;) {
+ event_wait(&th->ready);
+ event_reset(&th->ready);
+ execute_call(th->call);
+ __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->done);
+ }
+ return 0;
+}
+
+static void execute_one(void)
+{
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ int i, call, thread;
+ for (call = 0; call < 4; call++) {
+ for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
+ thread++) {
+ struct thread_t* th = &threads[thread];
+ if (!th->created) {
+ th->created = 1;
+ event_init(&th->ready);
+ event_init(&th->done);
+ event_set(&th->done);
+ thread_start(thr, th);
+ }
+ if (!event_isset(&th->done))
+ continue;
+ event_reset(&th->done);
+ th->call = call;
+ __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->ready);
+ event_timedwait(&th->done, 50);
+ break;
+ }
+ }
+ for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
+ sleep_ms(1);
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+// int iter = 0;
+ for (;; /*iter++*/) {
+ int pid = fork();
+ if (pid < 0)
+ exit(1);
+ if (pid == 0) {
+ execute_one();
+ exit(0);
+ }
+ int status = 0;
+ uint64_t start = current_time_ms();
+ for (;;) {
+ sleep_ms(10);
+ if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+ break;
+ if (current_time_ms() - start < 5000)
+ continue;
+ kill_and_wait(pid, &status);
+ break;
+ }
+ }
+}
+
+uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
+
+void execute_call(int call)
+{
+ intptr_t res = 0;
+ switch (call) {
+ case 0:
+ // socketpair\$unix arguments: [
+ // domain: const = 0x1 (8 bytes)
+ // type: unix_socket_type = 0x5 (8 bytes)
+ // proto: const = 0x0 (1 bytes)
+ // fds: ptr[out, unix_pair] {
+ // unix_pair {
+ // fd0: sock_unix (resource)
+ // fd1: sock_unix (resource)
+ // }
+ // }
+ // ]
+ res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul,
+ /*proto=*/0, /*fds=*/0x200000000440ul);
+ if (res != -1) {
+ r[0] = *(uint32_t*)0x200000000440;
+ r[1] = *(uint32_t*)0x200000000444;
+ }
+ break;
+ case 1:
+ // sendmsg arguments: [
+ // fd: sock (resource)
+ // msg: ptr[in, send_msghdr] {
+ // send_msghdr {
+ // msg_name: nil
+ // msg_namelen: len = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // msg_iov: nil
+ // msg_iovlen: len = 0x0 (8 bytes)
+ // msg_control: ptr[inout, array[ANYUNION]] {
+ // array[ANYUNION] {
+ // union ANYUNION {
+ // ANYBLOB: buffer: {04 01 00 00 ff ff 00 00 01} (length 0x9)
+ // }
+ // }
+ // }
+ // msg_controllen: bytesize = 0x104 (8 bytes)
+ // msg_flags: const = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // }
+ // }
+ // f: send_flags = 0x0 (8 bytes)
+ // ]
+ *(uint64_t*)0x200000000000 = 0;
+ *(uint32_t*)0x200000000008 = 0;
+ *(uint64_t*)0x200000000010 = 0;
+ *(uint64_t*)0x200000000018 = 0;
+ *(uint64_t*)0x200000000020 = 0x2000000007c0;
+ memcpy((void*)0x2000000007c0, "\x04\x01\x00\x00\xff\xff\x00\x00\x01", 9);
+ *(uint64_t*)0x200000000028 = 0x104;
+ *(uint32_t*)0x200000000030 = 0;
+ syscall(SYS_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000000ul, /*f=*/0ul);
+ for (int i = 0; i < 32; i++) {
+ syscall(SYS_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000000ul, /*f=*/0ul);
+ }
+ break;
+ case 2:
+ // close arguments: [
+ // fd: fd (resource)
+ // ]
+ syscall(SYS_close, /*fd=*/r[1]);
+ break;
+ case 3:
+ // recvmsg arguments: [
+ // fd: sock (resource)
+ // msg: ptr[inout, recv_msghdr] {
+ // recv_msghdr {
+ // msg_name: nil
+ // msg_namelen: len = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // msg_iov: nil
+ // msg_iovlen: len = 0x0 (8 bytes)
+ // msg_control: ptr[out, buffer] {
+ // buffer: (DirOut)
+ // }
+ // msg_controllen: len = 0x19 (8 bytes)
+ // msg_flags: const = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // }
+ // }
+ // f: recv_flags = 0x80 (8 bytes)
+ // ]
+ *(uint64_t*)0x2000000005c0 = 0;
+ *(uint32_t*)0x2000000005c8 = 0;
+ *(uint64_t*)0x2000000005d0 = 0;
+ *(uint64_t*)0x2000000005d8 = 0;
+ *(uint64_t*)0x2000000005e0 = 0x200000000580;
+ *(uint64_t*)0x2000000005e8 = 0x19;
+ *(uint32_t*)0x2000000005f0 = 0;
+ syscall(SYS_recvmsg, /*fd=*/r[0], /*msg=*/0x2000000005c0ul,
+ /*f=MSG_DONTWAIT*/ 0x80ul);
+ break;
+ }
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ for (procid = 0; procid < 4; procid++) {
+ if (fork() == 0) {
+ do_sandbox_none();
+ }
+ }
+ sleep(1000000);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+kldstat | grep -q sctp || { kldload sctp.ko && loaded=1; }
+timeout 3m /tmp/$prog > /dev/null 2>&1
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core $work
+[ $loaded ] && kldunload sctp.ko
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller85.sh b/tools/test/stress2/misc/syzkaller85.sh
new file mode 100755
index 000000000000..1772c0dc58b8
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller85.sh
@@ -0,0 +1,499 @@
+#!/bin/sh
+
+# panic: Assertion uio->uio_resid < 0 failed at ../../../netlink/netlink_domain.c:808
+# cpuid = 8
+# time = 1759044376
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0184d17a70
+# vpanic() at vpanic+0x136/frame 0xfffffe0184d17ba0
+# panic() at panic+0x43/frame 0xfffffe0184d17c00
+# nl_soreceive() at nl_soreceive+0x433/frame 0xfffffe0184d17ca0
+# soreceive() at soreceive+0x45/frame 0xfffffe0184d17cc0
+# kern_recvit() at kern_recvit+0x181/frame 0xfffffe0184d17d70
+# sys_recvfrom() at sys_recvfrom+0xa2/frame 0xfffffe0184d17e00
+# amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0184d17f30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0184d17f30
+# --- syscall (0, FreeBSD ELF64, syscall), rip = 0x822882cca, rsp = 0x823572e88, rbp = 0x823572f90 ---
+# KDB: enter: panic
+# [ thread pid 11012 tid 138112 ]
+# Stopped at $0,0x121a722(%rip)
+# db> x/s version
+# version: FreeBSD 16.0-CURRENT #0 main-n280667-52eb7e394a7e-dirty: Sun Sep 28 08:56:14 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=e33cdff88b17af77553159c4b372cac4e4bcd652
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+194f95f2c5fdffef1ef5@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <dirent.h>
+#include <errno.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/resource.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static unsigned long long procid;
+
+static __thread int clone_ongoing;
+static __thread int skip_segv;
+static __thread jmp_buf segv_env;
+
+static void segv_handler(int sig, siginfo_t* info, void* ctx __unused)
+{
+ if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
+ exit(sig);
+ }
+ uintptr_t addr = (uintptr_t)info->si_addr;
+ const uintptr_t prog_start = 1 << 20;
+ const uintptr_t prog_end = 100 << 20;
+ int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
+ int valid = addr < prog_start || addr > prog_end;
+ if (sig == SIGBUS)
+ valid = 1;
+ if (skip && valid) {
+ _longjmp(segv_env, 1);
+ }
+ exit(sig);
+}
+
+static void install_segv_handler(void)
+{
+ struct sigaction sa;
+ memset(&sa, 0, sizeof(sa));
+ sa.sa_sigaction = segv_handler;
+ sa.sa_flags = SA_NODEFER | SA_SIGINFO;
+ sigaction(SIGSEGV, &sa, NULL);
+ sigaction(SIGBUS, &sa, NULL);
+}
+
+#define NONFAILING(...) \
+ ({ \
+ int ok = 1; \
+ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
+ if (_setjmp(segv_env) == 0) { \
+ __VA_ARGS__; \
+ } else \
+ ok = 0; \
+ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
+ ok; \
+ })
+
+static void kill_and_wait(int pid, int* status)
+{
+ kill(pid, SIGKILL);
+ while (waitpid(-1, status, 0) != pid) {
+ }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void use_temporary_dir(void)
+{
+ char tmpdir_template[] = "./syzkaller.XXXXXX";
+ char* tmpdir = mkdtemp(tmpdir_template);
+ if (!tmpdir)
+ exit(1);
+ if (chmod(tmpdir, 0777))
+ exit(1);
+ if (chdir(tmpdir))
+ exit(1);
+}
+
+static void reset_flags(const char* filename)
+{
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE |
+ SF_APPEND | UF_APPEND);
+ if (lchflags(filename, st.st_flags))
+ exit(1);
+}
+static void __attribute__((noinline)) remove_dir(const char* dir)
+{
+ DIR* dp = opendir(dir);
+ if (dp == NULL) {
+ if (errno == EACCES) {
+ if (rmdir(dir))
+ exit(1);
+ return;
+ }
+ exit(1);
+ }
+ struct dirent* ep = 0;
+ while ((ep = readdir(dp))) {
+ if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
+ continue;
+ char filename[FILENAME_MAX];
+ snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ if (S_ISDIR(st.st_mode)) {
+ remove_dir(filename);
+ continue;
+ }
+ if (unlink(filename)) {
+ if (errno == EPERM) {
+ reset_flags(filename);
+ reset_flags(dir);
+ if (unlink(filename) == 0)
+ continue;
+ }
+ exit(1);
+ }
+ }
+ closedir(dp);
+ while (rmdir(dir)) {
+ if (errno == EPERM) {
+ reset_flags(dir);
+ if (rmdir(dir) == 0)
+ break;
+ }
+ exit(1);
+ }
+}
+
+static void thread_start(void* (*fn)(void*), void* arg)
+{
+ pthread_t th;
+ pthread_attr_t attr;
+ pthread_attr_init(&attr);
+ pthread_attr_setstacksize(&attr, 128 << 10);
+ int i = 0;
+ for (; i < 100; i++) {
+ if (pthread_create(&th, &attr, fn, arg) == 0) {
+ pthread_attr_destroy(&attr);
+ return;
+ }
+ if (errno == EAGAIN) {
+ usleep(50);
+ continue;
+ }
+ break;
+ }
+ exit(1);
+}
+
+typedef struct {
+ pthread_mutex_t mu;
+ pthread_cond_t cv;
+ int state;
+} event_t;
+
+static void event_init(event_t* ev)
+{
+ if (pthread_mutex_init(&ev->mu, 0))
+ exit(1);
+ if (pthread_cond_init(&ev->cv, 0))
+ exit(1);
+ ev->state = 0;
+}
+
+static void event_reset(event_t* ev)
+{
+ ev->state = 0;
+}
+
+static void event_set(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ if (ev->state)
+ exit(1);
+ ev->state = 1;
+ pthread_mutex_unlock(&ev->mu);
+ pthread_cond_broadcast(&ev->cv);
+}
+
+static void event_wait(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ while (!ev->state)
+ pthread_cond_wait(&ev->cv, &ev->mu);
+ pthread_mutex_unlock(&ev->mu);
+}
+
+static int event_isset(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static int event_timedwait(event_t* ev, uint64_t timeout)
+{
+ uint64_t start = current_time_ms();
+ uint64_t now = start;
+ pthread_mutex_lock(&ev->mu);
+ for (;;) {
+ if (ev->state)
+ break;
+ uint64_t remain = timeout - (now - start);
+ struct timespec ts;
+ ts.tv_sec = remain / 1000;
+ ts.tv_nsec = (remain % 1000) * 1000 * 1000;
+ pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
+ now = current_time_ms();
+ if (now - start > timeout)
+ break;
+ }
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static void sandbox_common()
+{
+ struct rlimit rlim;
+ rlim.rlim_cur = rlim.rlim_max = 128 << 20;
+ setrlimit(RLIMIT_AS, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 8 << 20;
+ setrlimit(RLIMIT_MEMLOCK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_FSIZE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_STACK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 0;
+ setrlimit(RLIMIT_CORE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 256;
+ setrlimit(RLIMIT_NOFILE, &rlim);
+}
+
+static void loop();
+
+static int do_sandbox_none(void)
+{
+ sandbox_common();
+ loop();
+ return 0;
+}
+
+struct thread_t {
+ int created, call;
+ event_t ready, done;
+};
+
+static struct thread_t threads[16];
+static void execute_call(int call);
+static int running;
+
+static void* thr(void* arg)
+{
+ struct thread_t* th = (struct thread_t*)arg;
+ for (;;) {
+ event_wait(&th->ready);
+ event_reset(&th->ready);
+ execute_call(th->call);
+ __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->done);
+ }
+ return 0;
+}
+
+static void execute_one(void)
+{
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ int i, call, thread;
+ for (call = 0; call < 3; call++) {
+ for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
+ thread++) {
+ struct thread_t* th = &threads[thread];
+ if (!th->created) {
+ th->created = 1;
+ event_init(&th->ready);
+ event_init(&th->done);
+ event_set(&th->done);
+ thread_start(thr, th);
+ }
+ if (!event_isset(&th->done))
+ continue;
+ event_reset(&th->done);
+ th->call = call;
+ __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->ready);
+ event_timedwait(&th->done, 50);
+ break;
+ }
+ }
+ for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
+ sleep_ms(1);
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+ int iter = 0;
+ for (;; iter++) {
+ char cwdbuf[32];
+ sprintf(cwdbuf, "./%d", iter);
+ if (mkdir(cwdbuf, 0777))
+ exit(1);
+ int pid = fork();
+ if (pid < 0)
+ exit(1);
+ if (pid == 0) {
+ if (chdir(cwdbuf))
+ exit(1);
+ execute_one();
+ exit(0);
+ }
+ int status = 0;
+ uint64_t start = current_time_ms();
+ for (;;) {
+ sleep_ms(10);
+ if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+ break;
+ if (current_time_ms() - start < 5000)
+ continue;
+ kill_and_wait(pid, &status);
+ break;
+ }
+ remove_dir(cwdbuf);
+ }
+}
+
+uint64_t r[1] = {0xffffffffffffffff};
+
+void execute_call(int call)
+{
+ intptr_t res = 0;
+ switch (call) {
+ case 0:
+ // socket arguments: [
+ // domain: socket_domain = 0x26 (8 bytes)
+ // type: socket_type = 0x2 (8 bytes)
+ // proto: int8 = 0x0 (1 bytes)
+ // ]
+ // returns sock
+ res = syscall(SYS_socket, /*domain=AF_INET|0x24*/ 0x26ul,
+ /*type=SOCK_DGRAM*/ 2ul, /*proto=*/0);
+ if (res != -1)
+ r[0] = res;
+ break;
+ case 1:
+ // bind arguments: [
+ // fd: sock (resource)
+ // addr: ptr[in, sockaddr_storage] {
+ // union sockaddr_storage {
+ // in6: sockaddr_in6 {
+ // len: len = 0x22 (1 bytes)
+ // family: const = 0x1c (1 bytes)
+ // port: proc = 0x3 (2 bytes)
+ // flow: int32 = 0x0 (4 bytes)
+ // addr: union ipv6_addr {
+ // mcast1: ipv6_addr_multicast1 {
+ // a0: const = 0xff (1 bytes)
+ // a1: const = 0x1 (1 bytes)
+ // a2: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00} (length
+ // 0xd) a3: const = 0x1 (1 bytes)
+ // }
+ // }
+ // scope: int32 = 0x0 (4 bytes)
+ // }
+ // }
+ // }
+ // addrlen: len = 0xc (8 bytes)
+ // ]
+ NONFAILING(*(uint8_t*)0x200000000040 = 0x22);
+ NONFAILING(*(uint8_t*)0x200000000041 = 0x1c);
+ NONFAILING(*(uint16_t*)0x200000000042 = htobe16(0x4e23 + procid * 4));
+ NONFAILING(*(uint32_t*)0x200000000044 = 0);
+ NONFAILING(*(uint8_t*)0x200000000048 = -1);
+ NONFAILING(*(uint8_t*)0x200000000049 = 1);
+ NONFAILING(memset((void*)0x20000000004a, 0, 13));
+ NONFAILING(*(uint8_t*)0x200000000057 = 1);
+ NONFAILING(*(uint32_t*)0x200000000058 = 0);
+ syscall(SYS_bind, /*fd=*/r[0], /*addr=*/0x200000000040ul,
+ /*addrlen=*/0xcul);
+ break;
+ case 2:
+ // recvfrom\$inet arguments: [
+ // fd: sock_in (resource)
+ // buf: nil
+ // len: len = 0x51 (8 bytes)
+ // f: recv_flags = 0x401313ab1a02f21f (8 bytes)
+ // addr: nil
+ // addrlen: len = 0x0 (8 bytes)
+ // ]
+ syscall(SYS_recvfrom, /*fd=*/r[0], /*buf=*/0ul, /*len=*/0x51ul,
+ /*f=MSG_PEEK|MSG_OOB|0x401313ab1a02f21c*/ 0x401313ab1a02f21ful,
+ /*addr=*/0ul, /*addrlen=*/0ul);
+ break;
+ }
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ install_segv_handler();
+ for (procid = 0; procid < 4; procid++) {
+ if (fork() == 0) {
+ use_temporary_dir();
+ do_sandbox_none();
+ }
+ }
+ sleep(1000000);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
+
+(cd ../testcases/swap; ./swap -t 5m -i 20 -l 100 > /dev/null 2>&1) &
+sleep 5
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+
+timeout 5m /tmp/$prog > /dev/null 2>&1
+
+while pkill swap; do :; done
+wait
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core /tmp/syzkaller.?????? $work
+exit 0
diff --git a/tools/test/stress2/misc/syzkaller86.sh b/tools/test/stress2/misc/syzkaller86.sh
new file mode 100755
index 000000000000..12922a2d05fa
--- /dev/null
+++ b/tools/test/stress2/misc/syzkaller86.sh
@@ -0,0 +1,555 @@
+#!/bin/sh
+
+# Fatal trap 12: page fault while in kernel mode
+# cpuid = 1; apic id = 01
+# fault virtual address = 0x18
+# fault code = supervisor read data, page not present
+# instruction pointer = 0x20:0xffffffff80b69835
+# stack pointer = 0x28:0xfffffe00ff8e7d90
+# frame pointer = 0x28:0xfffffe00ff8e7d90
+# code segment = base 0x0, limit 0xfffff, type 0x1b
+# = DPL 0, pres 1, long 1, def32 0, gran 1
+# processor eflags = interrupt enabled, resume, IOPL = 0
+# current process = 0 (thread taskq)
+# rdi: 0000000000000018 rsi: 0000000000000004 rdx: ffffffff812b3f65
+# rcx: 00000000000008ba r8: fffff800044b8780 r9: fffff80003397000
+# rax: 0000000000000001 rbx: fffff8004221fa00 rbp: fffffe00ff8e7d90
+# r10: 0000000000000001 r11: fffffe00dc47b000 r12: fffffe0177ed0000
+# r13: fffff800044b8780 r14: fffff8004221f800 r15: fffff8004221f800
+# trap number = 12
+# panic: page fault
+# cpuid = 1
+# time = 1759322830
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00ff8e7ac0
+# vpanic() at vpanic+0x136/frame 0xfffffe00ff8e7bf0
+# panic() at panic+0x43/frame 0xfffffe00ff8e7c50
+# trap_pfault() at trap_pfault+0x47c/frame 0xfffffe00ff8e7cc0
+# calltrap() at calltrap+0x8/frame 0xfffffe00ff8e7cc0
+# --- trap 0xc, rip = 0xffffffff80b69835, rsp = 0xfffffe00ff8e7d90, rbp = 0xfffffe00ff8e7d90 ---
+# __mtx_assert() at __mtx_assert+0x35/frame 0xfffffe00ff8e7d90
+# ktls_check_rx() at ktls_check_rx+0x2f/frame 0xfffffe00ff8e7dd0
+# socantrcvmore() at socantrcvmore+0x5e/frame 0xfffffe00ff8e7df0
+# unp_gc() at unp_gc+0x5df/frame 0xfffffe00ff8e7e40
+# taskqueue_run_locked() at taskqueue_run_locked+0x1c2/frame 0xfffffe00ff8e7ec0
+# taskqueue_thread_loop() at taskqueue_thread_loop+0xd3/frame 0xfffffe00ff8e7ef0
+# fork_exit() at fork_exit+0x82/frame 0xfffffe00ff8e7f30
+# fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00ff8e7f30
+# --- trap 0, rip = 0, rsp = 0, rbp = 0 ---
+# KDB: enter: panic
+# [ thread pid 0 tid 100045 ]
+# Stopped at kdb_enter+0x33: movq $0,0x121a9e2(%rip)
+# db> x/s version
+# version: FreeBSD 16.0-CURRENT #0 vmfqe-n280784-b7f165e45d6d: Wed Oct 1 13:48:43 CEST 2025
+# pho@mercat1.netperf.freebsd.org:/var/tmp/deviant3/sys/amd64/compile/PHO
+# db>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=ec40fe3e3e2b41218d1d417bc10d0be2517bf751
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// syzbot+a62883292a5c257703be@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <dirent.h>
+#include <errno.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/resource.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static unsigned long long procid;
+
+static void kill_and_wait(int pid, int* status)
+{
+ kill(pid, SIGKILL);
+ while (waitpid(-1, status, 0) != pid) {
+ }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+ usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+ struct timespec ts;
+ if (clock_gettime(CLOCK_MONOTONIC, &ts))
+ exit(1);
+ return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void use_temporary_dir(void)
+{
+ char tmpdir_template[] = "./syzkaller.XXXXXX";
+ char* tmpdir = mkdtemp(tmpdir_template);
+ if (!tmpdir)
+ exit(1);
+ if (chmod(tmpdir, 0777))
+ exit(1);
+ if (chdir(tmpdir))
+ exit(1);
+}
+
+static void reset_flags(const char* filename)
+{
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE |
+ SF_APPEND | UF_APPEND);
+ if (lchflags(filename, st.st_flags))
+ exit(1);
+}
+static void __attribute__((noinline)) remove_dir(const char* dir)
+{
+ DIR* dp = opendir(dir);
+ if (dp == NULL) {
+ if (errno == EACCES) {
+ if (rmdir(dir))
+ exit(1);
+ return;
+ }
+ exit(1);
+ }
+ struct dirent* ep = 0;
+ while ((ep = readdir(dp))) {
+ if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
+ continue;
+ char filename[FILENAME_MAX];
+ snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
+ struct stat st;
+ if (lstat(filename, &st))
+ exit(1);
+ if (S_ISDIR(st.st_mode)) {
+ remove_dir(filename);
+ continue;
+ }
+ if (unlink(filename)) {
+ if (errno == EPERM) {
+ reset_flags(filename);
+ reset_flags(dir);
+ if (unlink(filename) == 0)
+ continue;
+ }
+ exit(1);
+ }
+ }
+ closedir(dp);
+ while (rmdir(dir)) {
+ if (errno == EPERM) {
+ reset_flags(dir);
+ if (rmdir(dir) == 0)
+ break;
+ }
+ exit(1);
+ }
+}
+
+static void thread_start(void* (*fn)(void*), void* arg)
+{
+ pthread_t th;
+ pthread_attr_t attr;
+ pthread_attr_init(&attr);
+ pthread_attr_setstacksize(&attr, 128 << 10);
+ int i = 0;
+ for (; i < 100; i++) {
+ if (pthread_create(&th, &attr, fn, arg) == 0) {
+ pthread_attr_destroy(&attr);
+ return;
+ }
+ if (errno == EAGAIN) {
+ usleep(50);
+ continue;
+ }
+ break;
+ }
+ exit(1);
+}
+
+typedef struct {
+ pthread_mutex_t mu;
+ pthread_cond_t cv;
+ int state;
+} event_t;
+
+static void event_init(event_t* ev)
+{
+ if (pthread_mutex_init(&ev->mu, 0))
+ exit(1);
+ if (pthread_cond_init(&ev->cv, 0))
+ exit(1);
+ ev->state = 0;
+}
+
+static void event_reset(event_t* ev)
+{
+ ev->state = 0;
+}
+
+static void event_set(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ if (ev->state)
+ exit(1);
+ ev->state = 1;
+ pthread_mutex_unlock(&ev->mu);
+ pthread_cond_broadcast(&ev->cv);
+}
+
+static void event_wait(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ while (!ev->state)
+ pthread_cond_wait(&ev->cv, &ev->mu);
+ pthread_mutex_unlock(&ev->mu);
+}
+
+static int event_isset(event_t* ev)
+{
+ pthread_mutex_lock(&ev->mu);
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static int event_timedwait(event_t* ev, uint64_t timeout)
+{
+ uint64_t start = current_time_ms();
+ uint64_t now = start;
+ pthread_mutex_lock(&ev->mu);
+ for (;;) {
+ if (ev->state)
+ break;
+ uint64_t remain = timeout - (now - start);
+ struct timespec ts;
+ ts.tv_sec = remain / 1000;
+ ts.tv_nsec = (remain % 1000) * 1000 * 1000;
+ pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
+ now = current_time_ms();
+ if (now - start > timeout)
+ break;
+ }
+ int res = ev->state;
+ pthread_mutex_unlock(&ev->mu);
+ return res;
+}
+
+static void sandbox_common()
+{
+ struct rlimit rlim;
+ rlim.rlim_cur = rlim.rlim_max = 128 << 20;
+ setrlimit(RLIMIT_AS, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 8 << 20;
+ setrlimit(RLIMIT_MEMLOCK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_FSIZE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+ setrlimit(RLIMIT_STACK, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 0;
+ setrlimit(RLIMIT_CORE, &rlim);
+ rlim.rlim_cur = rlim.rlim_max = 256;
+ setrlimit(RLIMIT_NOFILE, &rlim);
+}
+
+static void loop();
+
+static int do_sandbox_none(void)
+{
+ sandbox_common();
+ loop();
+ return 0;
+}
+
+struct thread_t {
+ int created, call;
+ event_t ready, done;
+};
+
+static struct thread_t threads[16];
+static void execute_call(int call);
+static int running;
+
+static void* thr(void* arg)
+{
+ struct thread_t* th = (struct thread_t*)arg;
+ for (;;) {
+ event_wait(&th->ready);
+ event_reset(&th->ready);
+ execute_call(th->call);
+ __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->done);
+ }
+ return 0;
+}
+
+static void execute_one(void)
+{
+ if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+ }
+ int i, call, thread;
+ for (call = 0; call < 8; call++) {
+ for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
+ thread++) {
+ struct thread_t* th = &threads[thread];
+ if (!th->created) {
+ th->created = 1;
+ event_init(&th->ready);
+ event_init(&th->done);
+ event_set(&th->done);
+ thread_start(thr, th);
+ }
+ if (!event_isset(&th->done))
+ continue;
+ event_reset(&th->done);
+ th->call = call;
+ __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
+ event_set(&th->ready);
+ event_timedwait(&th->done, 50);
+ break;
+ }
+ }
+ for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
+ sleep_ms(1);
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+ int iter = 0;
+ for (;; iter++) {
+ char cwdbuf[32];
+ sprintf(cwdbuf, "./%d", iter);
+ if (mkdir(cwdbuf, 0777))
+ exit(1);
+ int pid = fork();
+ if (pid < 0)
+ exit(1);
+ if (pid == 0) {
+ if (chdir(cwdbuf))
+ exit(1);
+ execute_one();
+ exit(0);
+ }
+ int status = 0;
+ uint64_t start = current_time_ms();
+ for (;;) {
+ sleep_ms(10);
+ if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+ break;
+ if (current_time_ms() - start < 5000)
+ continue;
+ kill_and_wait(pid, &status);
+ break;
+ }
+ remove_dir(cwdbuf);
+ }
+}
+
+uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
+
+void execute_call(int call)
+{
+ intptr_t res = 0;
+ switch (call) {
+ case 0:
+ // freebsd10_pipe arguments: [
+ // pipefd: ptr[out, pipefd] {
+ // pipefd {
+ // rfd: fd (resource)
+ // wfd: fd (resource)
+ // }
+ // }
+ // ]
+ res = syscall(SYS_freebsd10_pipe, /*pipefd=*/0x2000000001c0ul);
+ if (res != -1)
+ r[0] = *(uint32_t*)0x2000000001c4;
+ break;
+ case 1:
+ // close arguments: [
+ // fd: fd (resource)
+ // ]
+ syscall(SYS_close, /*fd=*/r[0]);
+ break;
+ case 2:
+ // socket\$unix arguments: [
+ // domain: const = 0x1 (8 bytes)
+ // type: unix_socket_type = 0x5 (8 bytes)
+ // proto: const = 0x0 (1 bytes)
+ // ]
+ // returns sock_unix
+ res = syscall(SYS_socket, /*domain=*/1ul, /*type=SOCK_SEQPACKET*/ 5ul,
+ /*proto=*/0);
+ if (res != -1)
+ r[1] = res;
+ break;
+ case 3:
+ // bind\$unix arguments: [
+ // fd: sock_unix (resource)
+ // addr: ptr[in, sockaddr_un] {
+ // union sockaddr_un {
+ // file: sockaddr_un_file {
+ // len: len = 0xa (1 bytes)
+ // family: unix_socket_family = 0x1 (1 bytes)
+ // path: buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
+ // }
+ // }
+ // }
+ // addrlen: len = 0xa (8 bytes)
+ // ]
+ *(uint8_t*)0x2000000002c0 = 0xa;
+ *(uint8_t*)0x2000000002c1 = 1;
+ memcpy((void*)0x2000000002c2, "./file1\000", 8);
+ syscall(SYS_bind, /*fd=*/r[1], /*addr=*/0x2000000002c0ul,
+ /*addrlen=*/0xaul);
+ break;
+ case 4:
+ // listen arguments: [
+ // fd: sock (resource)
+ // backlog: int32 = 0xfffffffe (4 bytes)
+ // ]
+ syscall(SYS_listen, /*fd=*/r[1], /*backlog=*/0xfffffffe);
+ break;
+ case 5:
+ // sendmsg\$unix arguments: [
+ // fd: sock_unix (resource)
+ // msg: ptr[in, msghdr_un] {
+ // msghdr_un {
+ // addr: nil
+ // addrlen: len = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // vec: nil
+ // vlen: len = 0x0 (8 bytes)
+ // ctrl: ptr[inout, array[ANYUNION]] {
+ // array[ANYUNION] {
+ // union ANYUNION {
+ // ANYBLOB: buffer: {89 00 00 00 ff ff 00 00 01} (length 0x9)
+ // }
+ // }
+ // }
+ // ctrllen: bytesize = 0x9 (8 bytes)
+ // f: send_flags = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // }
+ // }
+ // f: send_flags = 0x0 (8 bytes)
+ // ]
+ *(uint64_t*)0x200000000080 = 0;
+ *(uint32_t*)0x200000000088 = 0;
+ *(uint64_t*)0x200000000090 = 0;
+ *(uint64_t*)0x200000000098 = 0;
+ *(uint64_t*)0x2000000000a0 = 0x200000000000;
+ memcpy((void*)0x200000000000, "\x89\x00\x00\x00\xff\xff\x00\x00\x01", 9);
+ *(uint64_t*)0x2000000000a8 = 9;
+ *(uint32_t*)0x2000000000b0 = 0;
+ syscall(SYS_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0x200000000080ul,
+ /*f=*/0ul);
+ break;
+ case 6:
+ // socketpair\$unix arguments: [
+ // domain: const = 0x1 (8 bytes)
+ // type: unix_socket_type = 0x2 (8 bytes)
+ // proto: const = 0x0 (1 bytes)
+ // fds: ptr[out, unix_pair] {
+ // unix_pair {
+ // fd0: sock_unix (resource)
+ // fd1: sock_unix (resource)
+ // }
+ // }
+ // ]
+ res = syscall(SYS_socketpair, /*domain=*/1ul, /*type=SOCK_DGRAM*/ 2ul,
+ /*proto=*/0, /*fds=*/0x200000000040ul);
+ if (res != -1)
+ r[2] = *(uint32_t*)0x200000000040;
+ break;
+ case 7:
+ // sendmsg arguments: [
+ // fd: sock (resource)
+ // msg: ptr[in, send_msghdr] {
+ // send_msghdr {
+ // msg_name: nil
+ // msg_namelen: len = 0x32c (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // msg_iov: nil
+ // msg_iovlen: len = 0x0 (8 bytes)
+ // msg_control: ptr[in, array[cmsghdr]] {
+ // array[cmsghdr] {
+ // }
+ // }
+ // msg_controllen: bytesize = 0x90 (8 bytes)
+ // msg_flags: const = 0x0 (4 bytes)
+ // pad = 0x0 (4 bytes)
+ // }
+ // }
+ // f: send_flags = 0x0 (8 bytes)
+ // ]
+ *(uint64_t*)0x200000000380 = 0;
+ *(uint32_t*)0x200000000388 = 0x32c;
+ *(uint64_t*)0x200000000390 = 0;
+ *(uint64_t*)0x200000000398 = 0;
+ *(uint64_t*)0x2000000003a0 = 0x200000000000;
+ *(uint64_t*)0x2000000003a8 = 0x90;
+ *(uint32_t*)0x2000000003b0 = 0;
+ syscall(SYS_sendmsg, /*fd=*/r[2], /*msg=*/0x200000000380ul, /*f=*/0ul);
+ break;
+ }
+}
+int main(void)
+{
+ syscall(SYS_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
+ /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+ /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul,
+ /*fd=*/(intptr_t)-1, /*offset=*/0ul);
+ const char* reason;
+ (void)reason;
+ for (procid = 0; procid < 4; procid++) {
+ if (fork() == 0) {
+ use_temporary_dir();
+ do_sandbox_none();
+ }
+ }
+ sleep(1000000);
+ return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -pthread || exit 1
+
+work=/tmp/$prog.dir
+rm -rf $work
+mkdir $work
+cd /tmp/$prog.dir
+for i in `jot 30`; do
+ (
+ mkdir d$i
+ cd d$i
+ timeout 3m /tmp/$prog > /dev/null 2>&1 &
+ )
+done
+while pgrep -q $prog; do sleep 2; done
+wait
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core $work
+exit 0
diff --git a/tools/test/stress2/misc/unionfs20.sh b/tools/test/stress2/misc/unionfs20.sh
new file mode 100755
index 000000000000..0c87bc0d80aa
--- /dev/null
+++ b/tools/test/stress2/misc/unionfs20.sh
@@ -0,0 +1,206 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# Bug 289700 - unionfs: page fault in unionfs_find_node_status when closing a file within a socket's receive buffer
+
+# "Fatal trap 12: page fault while in kernel mode" seen:
+# https://people.freebsd.org/~pho/stress/log/log0618.txt
+
+. ../default.cfg
+
+prog=$(basename "$0" .sh)
+here=`pwd`
+log=/tmp/$prog.log
+md1=$mdstart
+md2=$((md1 + 1))
+mp1=/mnt$md1
+mp2=/mnt$md2
+
+set -eu
+mdconfig -l | grep -q md$md1 && mdconfig -d -u $md1
+mdconfig -l | grep -q md$md2 && mdconfig -d -u $md2
+
+mdconfig -s 2g -u $md1
+newfs $newfs_flags /dev/md$md1 > /dev/null
+mdconfig -s 2g -u $md2
+newfs $newfs_flags /dev/md$md2 > /dev/null
+
+mkdir -p $mp1 $mp2
+mount /dev/md$md1 $mp1
+mount /dev/md$md2 $mp2
+mount -t unionfs -o noatime $mp1 $mp2
+set +e
+
+cd /tmp
+sed '1,/^EOF/d' < $here/$0 > $prog.c
+mycc -o $prog -Wall -Wextra -O2 $prog.c
+rm -f $prog.c
+[ -d $RUNDIR ] || mkdir -p $RUNDIR
+cd $RUNDIR
+
+n=3
+for i in `jot $n`; do
+ mkdir $mp2/d$i
+done
+(cd $here/../testcases/swap; ./swap -t 3m -i 20 -l 100 -h > /dev/null) &
+sleep 2
+for i in `jot $n`; do
+ (cd $mp2/d$i; /tmp/$prog) &
+done
+while pgrep -q $prog; do sleep .5; done
+while pkill swap; do :; done
+wait
+
+cd $here
+umount $mp2 # The unionfs mount
+umount $mp2
+umount $mp1
+
+mdconfig -d -u $md1
+mdconfig -d -u $md2
+rm -f /tmp/$prog
+exit 0
+EOF
+#include <sys/param.h>
+#include <sys/mman.h>
+#include <sys/socket.h>
+#include <sys/uio.h>
+#include <sys/wait.h>
+
+#include <stdio.h>
+#include <errno.h>
+#include <err.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <stdatomic.h>
+#include <string.h>
+
+#define PARALLEL 2
+#define SYNC 0
+
+static int debug;
+static _Atomic(int) *share;
+
+int
+send_fd(int socket, int fd_to_send)
+{
+ struct cmsghdr *cmsg;
+ struct msghdr msg = {0};
+ struct iovec iov;
+ char buf[1] = {0}; // dummy data
+ char cmsgbuf[CMSG_SPACE(sizeof(fd_to_send))];
+
+ memset(cmsgbuf, 0, sizeof(cmsgbuf));
+
+ iov.iov_base = buf;
+ iov.iov_len = sizeof(buf);
+ msg.msg_iov = &iov;
+ msg.msg_iovlen = 1;
+
+ msg.msg_control = cmsgbuf;
+ msg.msg_controllen = sizeof(cmsgbuf);
+
+ cmsg = CMSG_FIRSTHDR(&msg);
+ cmsg->cmsg_level = SOL_SOCKET;
+ cmsg->cmsg_type = SCM_RIGHTS;
+ cmsg->cmsg_len = CMSG_LEN(sizeof(fd_to_send));
+
+ memcpy(CMSG_DATA(cmsg), &fd_to_send, sizeof(fd_to_send));
+
+ return (sendmsg(socket, &msg, 0));
+}
+
+int
+recv_fd(int socket)
+{
+ struct cmsghdr *cmsg;
+ struct msghdr msg = {0};
+ struct iovec iov;
+ char buf[1];
+ int received_fd;
+ char cmsgbuf[CMSG_SPACE(sizeof(received_fd))];
+
+ memset(cmsgbuf, 0, sizeof(cmsgbuf));
+
+ iov.iov_base = buf;
+ iov.iov_len = sizeof(buf);
+ msg.msg_iov = &iov;
+ msg.msg_iovlen = 1;
+
+ msg.msg_control = cmsgbuf;
+ msg.msg_controllen = sizeof(cmsgbuf);
+
+ if (recvmsg(socket, &msg, 0) < 0)
+ err(1, "recvmsg()");
+
+ cmsg = CMSG_FIRSTHDR(&msg);
+ if (cmsg == NULL || cmsg->cmsg_len != CMSG_LEN(sizeof(received_fd))) {
+ fprintf(stderr, "No passed fd\n");
+ return (-1);
+ }
+
+ if (cmsg->cmsg_level != SOL_SOCKET || cmsg->cmsg_type != SCM_RIGHTS) {
+ fprintf(stderr, "Invalid cmsg_level or cmsg_type\n");
+ return (-1);
+ }
+
+ memcpy(&received_fd, CMSG_DATA(cmsg), sizeof(received_fd));
+ return (received_fd);
+}
+
+int
+main(void)
+{
+ pid_t pid;
+ time_t start;
+ size_t len;
+ int fd, pair[2], status;
+
+ fd = -1;
+ len = PAGE_SIZE;
+ if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
+ err(1, "mmap");
+
+ if (socketpair(AF_LOCAL, SOCK_DGRAM, 0, pair) == -1)
+ err(1, "socketpair");
+
+ start = time(NULL);
+ while (time(NULL) - start < 180) {
+ share[SYNC] = 0;
+ if ((pid = fork()) == -1)
+ err(1, "fork");
+ if (pid == 0) {
+ close(pair[0]);
+ atomic_fetch_add(&share[SYNC], 1);
+ while (share[SYNC] != PARALLEL)
+ usleep(1000);
+ // Not calling recv_fd() triggers the issue
+// fd = recv_fd(pair[1]);
+ if (debug)
+ fprintf(stderr, "Received fd=%d\n", fd);
+ _exit(0);
+ }
+ fd = open("foo", O_RDWR|O_CREAT|O_TRUNC, 0666);
+ if (fd == -1)
+ err(1, "open");
+ if (debug)
+ fprintf(stderr, "Sending fd=%d\n", fd);
+ atomic_fetch_add(&share[SYNC], 1);
+ while (share[SYNC] != PARALLEL)
+ usleep(1000);
+ send_fd(pair[0], fd);
+ usleep(arc4random() % 1000);
+ wait(&status);
+ close(fd);
+ unlink("foo");
+ }
+}
diff --git a/tools/tools/crypto/cryptocheck.c b/tools/tools/crypto/cryptocheck.c
index 6506671455ac..46a364b0453c 100644
--- a/tools/tools/crypto/cryptocheck.c
+++ b/tools/tools/crypto/cryptocheck.c
@@ -362,9 +362,11 @@ enable_user_soft(void)
size_t cursize = sizeof(curstate);
if (sysctlbyname(CRYPT_SOFT_ALLOW, &curstate, &cursize,
- &on, sizeof(on)) == 0) {
+ &on, sizeof(on)) == 0) {
if (curstate == 0)
atexit(reset_user_soft);
+ } else {
+ err(1, "sysctl(%s)", CRYPT_SOFT_ALLOW);
}
}
@@ -373,7 +375,10 @@ crlookup(const char *devname)
{
struct crypt_find_op find;
- if (strncmp(devname, "soft", 4) == 0) {
+ if (strncmp(devname, "soft", 4) == 0 ||
+ strncmp(devname, "ossl", 4) == 0 ||
+ strncmp(devname, "aesni", 5) == 0 ||
+ strncmp(devname, "armv8crypto", 11) == 0) {
enable_user_soft();
return CRYPTO_FLAG_SOFTWARE;
}
diff --git a/tools/tools/nanobsd/rescue/Files/root/ZFS_Create.txt b/tools/tools/nanobsd/rescue/Files/root/ZFS_Create.txt
index 1f475c957c0c..ece050bfab55 100644
--- a/tools/tools/nanobsd/rescue/Files/root/ZFS_Create.txt
+++ b/tools/tools/nanobsd/rescue/Files/root/ZFS_Create.txt
@@ -25,10 +25,10 @@ zfs_load="YES"
vfs.root.mountfrom="zfs:boot/ROOT/root"
#ZFS optional
vm.kmem_size="8G"
-vfs.zfs.arc_min="1G"
-vfs.zfs.arc_max="2G"
-vfs.zfs.prefetch_disable="1"
-vfs.zfs.zil_disable=1
+vfs.zfs.arc.min="1G"
+vfs.zfs.arc.max="2G"
+vfs.zfs.prefetch.disable="1"
+vfs.zfs.zil.replay_disable=1
vfs.zfs.zio.use_uma=0
#Power savings
hw.pci.do_power_nodriver=3
diff --git a/tools/tools/netrate/tcpp/README b/tools/tools/netrate/tcpp/README
index 6817bdf8ca25..ec0313a62eb8 100644
--- a/tools/tools/netrate/tcpp/README
+++ b/tools/tools/netrate/tcpp/README
@@ -84,7 +84,7 @@ In my testing, I use loader.conf entries of:
kern.ipc.maxsockets=1000000
net.inet.tcp.maxtcptw=3000000
-kern.ipc.somaxconn=49152
+kern.ipc.soacceptqueue=49152
kern.ipc.nmbjumbo16=262144
kern.ipc.nmbjumbo9=262144
kern.ipc.nmbjumbop=262144
diff --git a/tools/tools/sysdoc/tunables.mdoc b/tools/tools/sysdoc/tunables.mdoc
index 20b59f450cf2..397fe632322d 100644
--- a/tools/tools/sysdoc/tunables.mdoc
+++ b/tools/tools/sysdoc/tunables.mdoc
@@ -806,7 +806,7 @@ kern.ipc.nsfbufs
kern.ipc.numopensockets
---
-kern.ipc.somaxconn
+kern.ipc.soacceptqueue
int
The maximum pending socket connection queue size.
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-19 22:04:03 +0000