syzbot

 1st 0xfffffd806e92f458 vmmaplk (&map->lock) @ /syzkaller/managers/setuid/kernel/sys/uvm/uvm_fault.c:1442
 2nd 0xfffffd806deadf80 inode (&ip->i_lock) @ /syzkaller/managers/setuid/kernel/sys/ufs/ufs/ufs_vnops.c:1547
lock order "&ip->i_lock"(rrwlock) -> "&map->lock"(rwlock) first seen at:
#0  witness_checkorder+0x6d8
#1  _rw_enter+0xbf
#2  vm_map_lock_ln+0x14e
#3  uvm_map+0x2e2
#4  km_alloc+0x19a
#5  pool_multi_alloc_ni+0xe4
#6  pool_p_alloc+0x70
#7  pool_do_get+0x127
#8  pool_get+0x104
#9  ufsdirhash_build+0x40b
#10 ufs_lookup+0x2a5
#11 VOP_LOOKUP+0x63
#12 vfs_lookup+0x552
#13 namei+0x4af
#14 start_init+0xd6
lock order "&map->lock"(rwlock) -> "&ip->i_lock"(rrwlock) first seen at:
#0  witness_checkorder+0x6d8
#1  _rw_enter+0xbf
#2  _rrw_enter+0x5c
#3  VOP_LOCK+0x55
#4  vn_lock+0x6e
#5  uvn_io+0x2ca
#6  uvn_get+0x206
#7  uvm_fault+0x12c1
#8  uvm_fault_wire+0x70
#9  uvm_map_pageable_wire+0x2fd
#10 sys_mlockall+0x69
#11 syscall+0x5a0
#12 Xsyscall+0x128
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399
witness_checkorder(ae0828b4533a740f,81,fffffd806deadf70,fffffd806deadf70,0) at witness_checkorder+0x12f9 witness_debugger sys/kern/subr_witness.c:2543 [inline]
witness_checkorder(ae0828b4533a740f,81,fffffd806deadf70,fffffd806deadf70,0) at witness_checkorder+0x12f9 sys/kern/subr_witness.c:1089
_rw_enter(aa5934606d8498f5,60b,fffffd806deadf70,ffffffff81edebdf) at _rw_enter+0xbf
_rrw_enter(31f4c7a672a0571,fffffd806dceeaf8,ffffffff8139fd50,2) at _rrw_enter+0x5c sys/kern/kern_rwlock.c:410
VOP_LOCK(298cc098f1ddfcab,fffffd806dceeaf8) at VOP_LOCK+0x55 sys/kern/vfs_vops.c:598
vn_lock(e0904ac18d36d5c7,2000) at vn_lock+0x6e sys/kern/vfs_vnops.c:549
uvn_io(f88ad38f7f7b4aff,0,0,fffffd806e00f638,1000) at uvn_io+0x2ca sys/uvm/uvm_vnode.c:1188
uvn_get(a63dbfec490f829,ffffffff8146c190,fffffd806e00f638,fffffd8077d96650,1000,1) at uvn_get+0x206 sys/uvm/uvm_vnode.c:1048
uvm_fault(f88ad38f7f8fbea9,7b290c96000,fffffffffffff000,1) at uvm_fault+0x12c1 sys/uvm/uvm_fault.c:1023
uvm_fault_wire(a390d2050a23402c,1,7b290c96000,fffffd8077d96650) at uvm_fault_wire+0x70 sys/uvm/uvm_fault.c:1293
uvm_map_pageable_wire(298cc098f1f4393c,3,ffff800020be5780,7f7ffffef318,2,10f0) at uvm_map_pageable_wire+0x2fd sys/uvm/uvm_map.c:2258
sys_mlockall(3c4bbc7629bf4fae,2,ffff800020be5780) at sys_mlockall+0x69 sys/uvm/uvm_mmap.c:801
syscall(9f716b3e573ab6f0) at syscall+0x5a0 mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(9f716b3e573ab6f0) at syscall+0x5a0 sys/arch/amd64/amd64/trap.c:583
Xsyscall(6,0,7f7ffffef398,0,1,7f7ffffef3a8) at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffef330, count: -14
ddb{1}> show registers
rdi                              0x3
rsi               0xffffffff821837a8    __sancov_gen_cov_switch_values.125+0x28rbp               0xffff800020bfe7d0
rbx                              0x3
rdx                             0x8b
rcx                              0x3
rax                                0
r8                0xffffffff817c727f    witness_checkorder+0x12cf
r9                               0x5
r10               0x608e94c1d6d0c7c4
r11               0xd307d401d5fbbf1a
r12               0xfffffd80025cdc30
r13               0xffffffff81ebbd52    cmd0646_9_tim_udma+0xc96d
r14               0xffffffff8227c3a0    w_lodata+0x51db0
r15               0xffffffff82280390    w_lodata+0x55da0
rip               0xffffffff81107618    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020bfe7c0
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor0465) pid=240284 stat=onproc
    flags process=2<EXEC> proc=0
    pri=52, usrpri=52, nice=20
    forw=0xffffffffffffffff, list=0xffff800020be4970,0xffffffff82300be0
    process=0xffff800020bca360 user=0xffff800020bfa000, vmspace=0xfffffd806e92f440
    estcpu=2, cpticks=4, pctcpu=0.0
    user=0, sys=4, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*42372  240284  79999      0  7         0x2                syz-executor0465
 79999   27993  12004      0  3    0x10008a  pause         ksh
 12004  315339  91063      0  3        0x92  select        sshd
 14081  187999      1      0  3    0x100083  ttyin         getty
 91063  445362      1      0  3        0x80  select        sshd
 87241  189365    685     73  2    0x100090                syslogd
   685  503330      1      0  3    0x100082  netio         syslogd
 34706  160454      1     77  3    0x100090  poll          dhclient
 60080  421791      1      0  3        0x80  poll          dhclient
 88170  510733      0      0  2     0x14200                zerothread
 40689  436538      0      0  3     0x14200  aiodoned      aiodoned
 41481  474909      0      0  3     0x14200  syncer        update
 79300  340081      0      0  3     0x14200  cleaner       cleaner
 50111  434270      0      0  3     0x14200  reaper        reaper
 63383  192767      0      0  3     0x14200  pgdaemon      pagedaemon
  7293  318875      0      0  3     0x14200  bored         crynlk
 95872  452665      0      0  3     0x14200  bored         crypto
 69734  200187      0      0  3  0x40014200  acpi0         acpi0
 62736  256422      0      0  3  0x40014200                idle1
 98732  322640      0      0  3     0x14200  bored         softnet
 62632   28613      0      0  3     0x14200  bored         systqmp
 34362  316597      0      0  3     0x14200  bored         systq
 35525  436202      0      0  3  0x40014200  bored         softclock
 81892  295088      0      0  7  0x40014200                idle0
     1  508284      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}>