syzbot


witness: reversal: fdlock inode (3)

Status: upstream: reported on 2026/07/01 23:17
Reported-by: syzbot+4f1b7ffbc5e341cce754@syzkaller.appspotmail.com
First crash: 18d, last: 5d15h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: fdlock inode (2) -1 7 179d 268d 0/4 auto-obsoleted due to no activity on 2026/04/22 03:55
openbsd witness: reversal: fdlock inode -1 4 398d 525d 0/4 auto-obsoleted due to no activity on 2025/09/15 07:18

Sample crash report:
pf: key search, out on vio0: TCP wire: (0) witness: 10.128.15.235lock order reversal:
:30002 1st 0xffff800038fae490 fdlock (&newfdp->fd_fd.fd_lock)
  2nd 0xfffff2807036ae98 inode (&ip->i_lock)
10.128.0.88lock order [1] fdlock (&newfdp->fd_fd.fd_lock) -> [2] inode (&ip->i_lock)
:25168lock order data 0xffffffff8349b8b0 -> 0xffffffff83492525 is missing

lock order [2] inode (&ip->i_lock) -> [3] sbufrcv (&so->so_rcv.sb_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  sblock+0xb6 sys/kern/uipc_socket2.c:536
#2  soreceive+0x27d sys/kern/uipc_socket.c:890
#3  fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264
#4  VOP_READ+0x101 sys/kern/vfs_vops.c:227
#5  vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1
#6  vndsetcred+0xa1 sys/dev/vnd.c:685
#7  vndioctl+0xdfc sys/dev/vnd.c:486
#8  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#9  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#12 Xsyscall+0x128
lock order [3] sbufrcv (&so->so_rcv.sb_lock) -> [1] fdlock (&newfdp->fd_fd.fd_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  unp_externalize+0x3cf sys/kern/uipc_usrreq.c:1074
#2  soreceive+0xc24 sys/kern/uipc_socket.c:1029
#3  recvit+0x40b sys/kern/uipc_syscalls.c:1078
#4  sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(fffff2807036ae98,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(fffff2807036ae80,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
rrw_enter(fffff2807036ae80,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
VOP_LOCK(fffff28070476298,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
vn_lock(fffff28070476298,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576
vn_closefile(fffff28074823780,ffff800038fa3a10) at vn_closefile+0x111 vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff28074823780,ffff800038fa3a10) at vn_closefile+0x111 sys/kern/vfs_vnops.c:621
fdrop(fffff28074823780,ffff800038fa3a10) at fdrop+0x121 sys/kern/kern_descrip.c:1281
knote_remove(ffff800038fa3a10,fffff2806fbe2000,fffff2806fbe2090,4,0) at knote_remove+0x368 sys/kern/kern_event.c:2186
knote_fdclose(ffff800038fa3a10,4) at knote_fdclose+0xf9 sys/kern/kern_event.c:2221
fdrelease(ffff800038fa3a10,4) at fdrelease+0xf9 sys/kern/kern_descrip.c:761
syscall(ffff80002a2294b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2294b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x85d13d8ced0, count: -13
ddb{0}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80002a228fb0
rbx                                0
rdx               0xffff8000015d65c0
rcx               0xffff800038fa3a10
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80002a228e90
r9                0x8080808080808080
r10               0x3a6117dcd0ceed66
r11               0x7f7c29cad8e230c3
r12               0xfffff280040c6d80
r13               0xfffff280048b3df0
r14                              0x3
r15               0xffffffff8352e473    substchar+0x12edd
rip               0xffffffff820a9515    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a228fa0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/14 19:42 openbsd ddde2be8d3c6 2130f682 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: fdlock inode
2026/07/01 23:16 openbsd 927838563536 5fb9973c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: fdlock inode
* Struck through repros no longer work on HEAD.