syzbot


witness: reversal: pf_lock solock

Status: fixed on 2024/01/12 04:21
Reported-by: syzbot+34d22dcbf20d76629c5a@syzkaller.appspotmail.com
Fix commit: 66bd633ef3ce Use domain name for socket lock.
First crash: 125d, last: 118d

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff82bc8280 pf_lock (pf_lock)
 2nd 0xfffffd806f1065d8 solock (&so->so_lock)
lock order "&so->so_lock"(rwlock) -> "pf_lock"(rwlock) first seen at:
#0  rw_enter_write+0x5c sys/kern/kern_rwlock.c:128
#1  pf_remove_divert_state+0xbf sys/net/pf.c:1833
#2  in_pcbdisconnect+0x2c sys/netinet/in_pcb.c:578
#3  udp_disconnect+0xf1 sys/netinet/udp_usrreq.c:1215
#4  soconnect+0xc1 pru_disconnect sys/sys/protosw.h:334 [inline]
#4  soconnect+0xc1 sodisconnect sys/kern/uipc_socket.c:521 [inline]
#4  soconnect+0xc1 sys/kern/uipc_socket.c:485
#5  sys_connect+0x207 sys/kern/uipc_syscalls.c:422
#6  syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#6  syscall+0x50f sys/arch/amd64/amd64/trap.c:606
#7  Xsyscall+0x128
lock order "pf_lock"(rwlock) -> "&so->so_lock"(rwlock) first seen at:
#0  rw_enter_write+0x5c sys/kern/kern_rwlock.c:128
#1  route_input+0x101 sys/net/rtsock.c:520
#2  rtm_send+0x1b2 sys/net/rtsock.c:1744
#3  rt_clone+0xd1 sys/net/route.c:279
#4  rtalloc+0x91 rt_match sys/net/route.c:248 [inline]
#4  rtalloc+0x91 sys/net/route.c:377
#5  icmp_reflect+0x1bd sys/netinet/ip_icmp.c:740
#6  icmp_error+0x61 sys/netinet/ip_icmp.c:300
#7  pf_test_rule+0x98d sys/net/pf.c:4478
#8  pf_test+0x1d1c sys/net/pf.c:7678
#9  ip_input_if+0x131 sys/netinet/ip_input.c:417
#10 ipv4_input+0x4c sys/netinet/ip_input.c:291
#11 ether_input+0x58a
#12 tun_dev_write+0x203 sys/net/if_tun.c:914
#13 spec_write+0xd9 sys/kern/spec_vnops.c:302
#14 VOP_WRITE+0xc3 sys/kern/vfs_vops.c:245
#15 vn_write+0x15b sys/kern/vfs_vnops.c:408
#16 dofilewritev+0x1a0 sys/kern/sys_generic.c:375
#17 sys_write+0x87 sys/kern/sys_generic.c:295
#18 syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#18 syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Stopped at      db_enter+0x1c:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
witness_checkorder(fffffd806f1065d8,9,0) at witness_checkorder+0x10b7 witness_debugger sys/kern/subr_witness.c:2510 [inline]
witness_checkorder(fffffd806f1065d8,9,0) at witness_checkorder+0x10b7 sys/kern/subr_witness.c:1110
rw_enter_write(fffffd806f1065c8) at rw_enter_write+0x5c sys/kern/kern_rwlock.c:128
route_input(fffffd806d21c000,0,2) at route_input+0x101 sys/net/rtsock.c:520
rtm_send(fffffd806edcfcb0,1,0,0) at rtm_send+0x1b2 sys/net/rtsock.c:1744
rt_clone(ffff80002a2a84e0,ffff80002a2a8558,0) at rt_clone+0xd1 sys/net/route.c:279
rtalloc(ffff80002a2a8558,1,0) at rtalloc+0x91 rt_match sys/net/route.c:248 [inline]
rtalloc(ffff80002a2a8558,1,0) at rtalloc+0x91 sys/net/route.c:377
icmp_reflect(fffffd806d232a00,0,0) at icmp_reflect+0x1bd sys/netinet/ip_icmp.c:740
icmp_error(fffffd806d21c000,3,3,0,0) at icmp_error+0x61 sys/netinet/ip_icmp.c:300
pf_test_rule(ffff80002a2a8818,ffff80002a2a8910,ffff80002a2a8920,ffff80002a2a8900,ffff80002a2a88e0,fffffd806d2280f0) at pf_test_rule+0x98d sys/net/pf.c:4478
pf_test(2,1,ffff800000cfe000,ffff80002a2a8a48) at pf_test+0x1d1c sys/net/pf.c:7678
ip_input_if(ffff80002a2a8a48,ffff80002a2a8a54,4,0,ffff800000cfe000) at ip_input_if+0x131 sys/netinet/ip_input.c:417
ipv4_input(ffff800000cfe000,fffffd806d228000) at ipv4_input+0x4c sys/netinet/ip_input.c:291
ether_input(ffff800000cfe000,fffffd806d228000) at ether_input+0x58a
tun_dev_write(5d00,ffff80002a2a8db8,11,2) at tun_dev_write+0x203 sys/net/if_tun.c:914
spec_write(ffff80002a2a8c10) at spec_write+0xd9 sys/kern/spec_vnops.c:302
VOP_WRITE(fffffd80707016c0,ffff80002a2a8db8,11,fffffd807f7d6548) at VOP_WRITE+0xc3 sys/kern/vfs_vops.c:245
vn_write(fffffd806f093858,ffff80002a2a8db8,0) at vn_write+0x15b sys/kern/vfs_vnops.c:408
dofilewritev(ffff80002a291818,c8,ffff80002a2a8db8,0,ffff80002a2a8ea0) at dofilewritev+0x1a0 sys/kern/sys_generic.c:375
sys_write(ffff80002a291818,ffff80002a2a8e50,ffff80002a2a8ea0) at sys_write+0x87 sys/kern/sys_generic.c:295
syscall(ffff80002a2a8f20) at syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
syscall(ffff80002a2a8f20) at syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x72fb9b0c5c50, count: -22
ddb{1}> show registers
rdi                              0x3
rsi               0xffffffff82bcbeb0    __sancov_gen_cov_switch_values.134
rbp               0xffff80002a2a80e0
rbx                              0x3
rdx                            0x3fd
rcx                                0
rax                              0x1
r8                0xffff80002a2a8050
r9                0x8080808080808080
r10               0x86e53937eb717c53
r11               0x754db76c0506287c
r12               0xfffffd8003a0ac10
r13                                0
r14               0xfffffd8003a0aab0
r15               0xfffffd80031d59c0
rip               0xffffffff81f96edc    db_enter+0x1c
cs                               0x8
rflags                         0x246
rsp               0xffff80002a2a80d0
ss                              0x10
db_enter+0x1c:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor.0) tid=7658 pid=91353 tcnt=1 stat=onproc
    flags process=0 proc=0
    runpri=50, usrpri=50, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0
    forw=0xffffffffffffffff, list=0xffff80002a2912c8,0xffffffff82d71d40
    process=0xffff8000ffff7ab0 user=0xffff80002a2a3000, vmspace=0xfffffd8008a3e000
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*91353    7658  88014      0  7           0                syz-executor.0
 88014   66326  35553      0  3        0x82  nanoslp       syz-executor.0
 35553  506830  25602      0  3   0x2000082  thrsleep      syz-execprog
 35553  433760  25602      0  3   0x6000082  nanoslp       syz-execprog
 35553   79991  25602      0  3   0x6000082  kqread        syz-execprog
 35553  344535  25602      0  3   0x6000082  thrsleep      syz-execprog
 35553   11372  25602      0  3   0x6000082  thrsleep      syz-execprog
 35553  326580  25602      0  3   0x6000082  wait          syz-execprog
 35553  195294  25602      0  3   0x6000082  thrsleep      syz-execprog
 35553  258472  25602      0  3   0x6000082  thrsleep      syz-execprog
 35553  278632  25602      0  3   0x6000082  thrsleep      syz-execprog
 35553  331338  25602      0  3   0x6000082  thrsleep      syz-execprog
 35553  399969  25602      0  3   0x6000082  thrsleep      syz-execprog
 25602  197058   1534      0  3    0x10008a  sigsusp       ksh
  1534  381555  74309      0  3        0x9a  kqread        sshd
 15231   68632      1      0  3    0x100083  ttyin         getty
 74309   63260      1      0  3        0x88  kqread        sshd
 88396  212112  81948     74  3   0x1100092  bpf           pflogd
 81948  145981      1      0  3        0x80  netio         pflogd
 81756  503192  91564     73  3   0x1100090  kqread        syslogd
 91564   43124      1      0  3    0x100082  netio         syslogd
 94192    9170      1      0  3    0x100080  kqread        resolvd
 64027  390558  80612     77  3    0x100092  kqread        dhcpleased
 27017  309212  80612     77  3    0x100092  kqread        dhcpleased
 80612  181960      1      0  3        0x80  kqread        dhcpleased
 51847  349040      0      0  3     0x14200  bored         smr
 41445  196656      0      0  3     0x14200  pgzero        zerothread
 40193   33215      0      0  3     0x14200  aiodoned      aiodoned
 21487  314355      0      0  3     0x14200  syncer        update
 78908  433644      0      0  3     0x14200  cleaner       cleaner
 14733  371066      0      0  3     0x14200  reaper        reaper
  8417  308524      0      0  3     0x14200  pgdaemon      pagedaemon
  1793  493045      0      0  3     0x14200  bored         viomb
 24347  342889      0      0  3  0x40014200  acpi0         acpi0
 87304  378774      0      0  3  0x40014200                idle1
 79737  127094      0      0  3     0x14200  bored         softnet3
    51  271650      0      0  3     0x14200  bored         softnet2
 22056  130378      0      0  3     0x14200  bored         softnet1
 50613  481700      0      0  3     0x14200  bored         softnet0
 47985  115833      0      0  3     0x14200  bored         systqmp
 95335  308615      0      0  3     0x14200  bored         systq
 29439  300729      0      0  3     0x14200  tmoslp        softclockmp
 27604  512361      0      0  3  0x40014200  tmoslp        softclock
 77855  129380      0      0  7  0x40014200                idle0
     1  331151      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 91353 (syz-executor.0) thread 0xffff80002a291818 (7658)
exclusive rwlock pf_lock r = 0 (0xffffffff82bc8280)
#0  witness_lock+0x447
#1  pf_test+0x1cfd
#2  ip_input_if+0x131 sys/netinet/ip_input.c:417
#3  ipv4_input+0x4c sys/netinet/ip_input.c:291
#4  ether_input+0x58a
#5  tun_dev_write+0x203 sys/net/if_tun.c:914
#6  spec_write+0xd9 sys/kern/spec_vnops.c:302
#7  VOP_WRITE+0xc3 sys/kern/vfs_vops.c:245
#8  vn_write+0x15b sys/kern/vfs_vnops.c:408
#9  dofilewritev+0x1a0 sys/kern/sys_generic.c:375
#10 sys_write+0x87 sys/kern/sys_generic.c:295
#11 syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#11 syscall+0x50f sys/arch/amd64/amd64/trap.c:606
#12 Xsyscall+0x128
exclusive rwlock netlock r = 0 (0xffffffff82bf4da0)
#0  witness_lock+0x447
#1  tun_dev_write+0x1f8 sys/net/if_tun.c:913
#2  spec_write+0xd9 sys/kern/spec_vnops.c:302
#3  VOP_WRITE+0xc3 sys/kern/vfs_vops.c:245
#4  vn_write+0x15b sys/kern/vfs_vnops.c:408
#5  dofilewritev+0x1a0 sys/kern/sys_generic.c:375
#6  sys_write+0x87 sys/kern/sys_generic.c:295
#7  syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#7  syscall+0x50f sys/arch/amd64/amd64/trap.c:606
#8  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82d71c60)
#0  witness_lock+0x447
#1  vn_write+0x46 sys/kern/vfs_vnops.c:393
#2  dofilewritev+0x1a0 sys/kern/sys_generic.c:375
#3  sys_write+0x87 sys/kern/sys_generic.c:295
#4  syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
#4  syscall+0x50f sys/arch/amd64/amd64/trap.c:606
#5  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10168   6459K    6459K 166960K     11246        0
            pcb    15     10K      10K 166960K        15        0
         rtable    82      2K       2K 166960K       152        0
             pf    18      7K      10K 166960K        29        0
         ifaddr    17     10K      10K 166960K        17        0
        ifgroup    27      1K       1K 166960K        27        0
       counters    50     34K      34K 166960K        50        0
       ioctlops     0      0K       4K 166960K      1476        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1176     74K      74K 166960K      1192        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     2      0K       0K 166960K         2        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1697    195K     286K 166960K     12548        0
      file desc     3      8K      12K 166960K        18        0
           proc    67     91K     103K 166960K       330        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
       in_multi    22      1K       1K 166960K        22        0
    ether_multi     1      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    25    122K     122K 166960K        25        0
           exec     0      0K       1K 166960K       299        0
            tdb     3      0K       0K 166960K         3        0
        pagedep     1      8K       8K 166960K         1        0
       inodedep     1     32K      32K 166960K         1        0
         newblk     1      0K       0K 166960K         1        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   165     15K      15K 166960K      2947        0
       UVM aobj     3      2K       2K 166960K         3        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP     7      0K       0K 166960K         7        0
           temp     1   5916K    5980K 166960K      3425        0
         kqueue    12     18K      18K 166960K        25        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120       22    0       19     1     0     1     1     0     8    0
rtentry    112       38    0        4     1     0     1     1     0     8    0
unpcb      144       35    0       20     1     0     1     1     0     8    0
syncache   312        5    0        5     2     1     1     1     0     8    1
tcpqe       32      166    0      166     1     1     0     1     0     8    0
tcpcb      808        8    0        5     1     0     1     1     0     8    0
arp        120        6    0        1     1     0     1     1     0     8    0
inpcb      368       40    0       31     1     0     1     1     0     8    0
nd6        136        3    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       12    0        7     2     1     1     1     0     8    0
pfstkey    128       12    0        7     2     1     1     1     0     8    0
pfstate    376       12    0        7     2     1     1     1     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      147    0        2    10     0    10    10     0     8    0
art_table   32      148    0        2     2     0     2     2     0     8    0
art_node    16       37    0        7     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     1465    0       52    89     0    89    89     0     8    0
ffsino     272     1465    0       52    95     0    95    95     0     8    0
nchpl      144     1704    0       63    61     0    61    61     0     8    0
uvmvnodes   80     1479    0        0    31     0    31    31     0     8    0
vnodes     216     1479    0        0    83     0    83    83     0     8    0
namei      1024    5491    0     5491     4     1     3     3     0     8    3
percpumem   16       39    0        0     1     0     1     1     0     8    0
kstatmem   264       10    0        0     1     0     1     1     0     8    0
scxspl     216     6372    0     6372    10     9     1     8     1     8    1
plimitpl   152       28    0       19     1     0     1     1     0     8    0
sigapl     424      369    0      334     6     0     6     6     0     8    1
knotepl    120       54    0        0     2     0     2     2     0     8    0
kqueuepl   216       21    0       13     1     0     1     1     0     8    0
pipepl     320      118    0      111     3     1     2     2     0     8    1
fdescpl    496      351    0      334     4     0     4     4     0     8    1
filepl     152     1541    0     1468     4     0     4     4     0     8    1
lockfpl    104        6    0        4     1     0     1     1     0     8    0
lockfspl    48        4    0        2     1     0     1     1     0     8    0
sessionpl  144       19    0        9     1     0     1     1     0     8    0
pgrppl      48       19    0        9     1     0     1     1     0     8    0
ucredpl    104       71    0       59     1     0     1     1     0     8    0
zombiepl   144      334    0      334     2     1     1     1     0     8    1
processpl  1072     369    0      334     4     0     4     4     0     8    1
procpl     680      379    0      334     5     0     5     5     0     8    0
sockpl     488       97    0       70     5     1     4     4     0     8    0
mcl8k      8192       1    0        0     1     0     1     1     0     8    0
mcl4k      4096       5    0        0     1     0     1     1     0     8    0
mcl2k      2048     243    0        0    31     1    30    31     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256      267    0        0    17     0    17    17     0     8    0
bufpl      288     3998    0      137   276     0   276   276     0     8    0
anonpl      24   189320    0   185700    70    14    56    56     0   186   31
amapchunkpl 152    9881    0     9503    28     1    27    27     0   158   11
amappl16   200     5381    0     5319    10     5     5     5     0     8    1
amappl15   192        7    0        7     1     1     0     1     0     8    0
amappl14   184      181    0      169     2     0     2     2     0     8    1
amappl13   176        7    0        7     1     1     0     1     0     8    0
amappl12   168      930    0      911     3     1     2     2     0     8    1
amappl11   160       99    0       84     1     0     1     1     0     8    0
amappl10   152       37    0       32     2     1     1     1     0     8    0
amappl9    144      162    0      161     2     1     1     1     0     8    0
amappl8    136      130    0      107     2     0     2     2     0     8    1
amappl7    128      174    0      154     2     0     2     2     0     8    0
amappl6    120      143    0      137     1     0     1     1     0     8    0
amappl5    112      121    0      110     1     0     1     1     0     8    0
amappl4    104      444    0      417     2     0     2     2     0     8    1
amappl3     96     2253    0     2206     4     1     3     3     0     8    1
amappl2     88      770    0      707     3     0     3     3     0     8    1
amappl1     80    10027    0     9528    27     4    23    23     0     8   10
amappl      88     2491    0     2393     5     0     5     5     0    92    2
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        2    0        0     1     0     1     1     0     8    0
uaddrrnd    24      351    0      334     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      351    0      334     1     0     1     1     0     8    0
vmmpekpl   168     9660    0     9640     2     0     2     2     0     8    0
vmmpepl    168    41965    0    40647   125     8   117   117     0   357   56
vmsppl     464      350    0      334     4     0     4     4     0     8    1
rwobjpl     56    20360    0    18001    50     3    47    47     0     8    8
pdppl      4096     710    0      668    90    32    58    66     0     8   16
pvpl        32    43590    0        0   352     1   351   351     0   265    0
pmappl     248      350    0      334     2     0     2     2     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      630    0       37    18     0    18    18     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x1e:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff82be2ff0) at x86_ipi_db+0x1e sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff82d71a58) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82d71a58) at __mp_lock+0x122 sys/kern/kern_lock.c:147
intr_handler(ffff80002a142120,ffff800000077e80) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f
__mp_lock(ffffffff82d71a58) at __mp_lock+0x122 __mp_lock_spin sys/kern/kern_lock.c:116 [inline]
__mp_lock(ffffffff82d71a58) at __mp_lock+0x122 sys/kern/kern_lock.c:147
intr_handler(ffff80002a142270,ffff80000027b700) at intr_handler+0x62 sys/arch/amd64/amd64/intr.c:532
Xintr_ioapic_edge26_untramp() at Xintr_ioapic_edge26_untramp+0x18f
acpicpu_idle() at acpicpu_idle+0x312 sys/dev/acpi/acpicpu.c:1206
sched_idle(ffffffff82be2ff0) at sched_idle+0x41e sys/kern/kern_sched.c:191
end trace frame: 0x0, count: -11
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x1c:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437
witness_checkorder(fffffd806f1065d8,9,0) at witness_checkorder+0x10b7 witness_debugger sys/kern/subr_witness.c:2510 [inline]
witness_checkorder(fffffd806f1065d8,9,0) at witness_checkorder+0x10b7 sys/kern/subr_witness.c:1110
rw_enter_write(fffffd806f1065c8) at rw_enter_write+0x5c sys/kern/kern_rwlock.c:128
route_input(fffffd806d21c000,0,2) at route_input+0x101 sys/net/rtsock.c:520
rtm_send(fffffd806edcfcb0,1,0,0) at rtm_send+0x1b2 sys/net/rtsock.c:1744
rt_clone(ffff80002a2a84e0,ffff80002a2a8558,0) at rt_clone+0xd1 sys/net/route.c:279
rtalloc(ffff80002a2a8558,1,0) at rtalloc+0x91 rt_match sys/net/route.c:248 [inline]
rtalloc(ffff80002a2a8558,1,0) at rtalloc+0x91 sys/net/route.c:377
icmp_reflect(fffffd806d232a00,0,0) at icmp_reflect+0x1bd sys/netinet/ip_icmp.c:740
icmp_error(fffffd806d21c000,3,3,0,0) at icmp_error+0x61 sys/netinet/ip_icmp.c:300
pf_test_rule(ffff80002a2a8818,ffff80002a2a8910,ffff80002a2a8920,ffff80002a2a8900,ffff80002a2a88e0,fffffd806d2280f0) at pf_test_rule+0x98d sys/net/pf.c:4478
pf_test(2,1,ffff800000cfe000,ffff80002a2a8a48) at pf_test+0x1d1c sys/net/pf.c:7678
ip_input_if(ffff80002a2a8a48,ffff80002a2a8a54,4,0,ffff800000cfe000) at ip_input_if+0x131 sys/netinet/ip_input.c:417
ipv4_input(ffff800000cfe000,fffffd806d228000) at ipv4_input+0x4c sys/netinet/ip_input.c:291
ether_input(ffff800000cfe000,fffffd806d228000) at ether_input+0x58a
tun_dev_write(5d00,ffff80002a2a8db8,11,2) at tun_dev_write+0x203 sys/net/if_tun.c:914
spec_write(ffff80002a2a8c10) at spec_write+0xd9 sys/kern/spec_vnops.c:302
VOP_WRITE(fffffd80707016c0,ffff80002a2a8db8,11,fffffd807f7d6548) at VOP_WRITE+0xc3 sys/kern/vfs_vops.c:245
vn_write(fffffd806f093858,ffff80002a2a8db8,0) at vn_write+0x15b sys/kern/vfs_vnops.c:408
dofilewritev(ffff80002a291818,c8,ffff80002a2a8db8,0,ffff80002a2a8ea0) at dofilewritev+0x1a0 sys/kern/sys_generic.c:375
sys_write(ffff80002a291818,ffff80002a2a8e50,ffff80002a2a8ea0) at sys_write+0x87 sys/kern/sys_generic.c:295
syscall(ffff80002a2a8f20) at syscall+0x50f mi_syscall sys/sys/syscall_mi.h:103 [inline]
syscall(ffff80002a2a8f20) at syscall+0x50f sys/arch/amd64/amd64/trap.c:606
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x72fb9b0c5c50, count: -22

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/01/11 13:24 openbsd 64cb89d06aef 00f3cc59 .config console log report syz [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/11 21:23 openbsd e9d2d4cd704b dda5a988 .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/11 19:49 openbsd e9d2d4cd704b dda5a988 .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/11 14:22 openbsd 64cb89d06aef 00f3cc59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/11 10:32 openbsd 64cb89d06aef 00f3cc59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/10 17:06 openbsd 5b7944c191c0 04815ef1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/10 10:00 openbsd 29ae6bbdbe85 b438bd66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/09 17:47 openbsd 6354f7248140 4807fb37 .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/09 08:59 openbsd 37149e4fa856 4c0fd4bb .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/09 02:26 openbsd 37149e4fa856 4c0fd4bb .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/08 18:12 openbsd e932005d1c48 4c0fd4bb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/08 15:40 openbsd e932005d1c48 4c0fd4bb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/08 08:39 openbsd d8fc03596367 28c42cff .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/07 21:40 openbsd 3db25975d7ae 28c42cff .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/07 17:19 openbsd 3db25975d7ae 28c42cff .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/07 01:56 openbsd 172a5cb9e97b 28c42cff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/06 15:50 openbsd 036f766dae03 28c42cff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/06 08:26 openbsd fba72c105684 28c42cff .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/06 07:56 openbsd fba72c105684 28c42cff .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/06 01:27 openbsd fba72c105684 28c42cff .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/05 16:20 openbsd baf9e3d1b05e 28c42cff .config console log report ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/05 05:57 openbsd 7a766feb92ce 28c42cff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
2024/01/05 01:35 openbsd 7a766feb92ce 28c42cff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock solock
* Struck through repros no longer work on HEAD.