syzbot


witness: reversal: pf_lock netlock (4)

Status: upstream: reported on 2026/05/10 04:56
Reported-by: syzbot+65be7385fa082665e7e8@syzkaller.appspotmail.com
First crash: 10d, last: 8d06h
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: pf_lock netlock (2) -1 C 2 1502d 1502d 3/3 fixed on 2022/04/10 04:45
openbsd witness: reversal: pf_lock netlock (3) -1 syz 25 1481d 1493d 3/3 fixed on 2022/04/29 14:56
openbsd witness: reversal: pf_lock netlock -1 C 19 1513d 1565d 3/3 fixed on 2022/04/08 05:01

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff83945bf8 pf_lock (pf_lock)
 2nd 0xffffffff83926b00 netlock (netlock)
lock order [1] pf_lock (pf_lock) -> [2] netlock (netlock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
#2  uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
#3  uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
#4  uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
#7  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
#8  alltraps_kern_meltdown+0x7b
#9  _copyin+0x5b
#10 pfioctl+0x13ff sys/net/pf_ioctl.c:3238
#11 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#12 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#13 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#14 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#15 Xsyscall+0x128
lock order [2] netlock (netlock) -> [1] pf_lock (pf_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  pfi_attach_ifgroup+0x2a sys/net/pf_if.c:357
#2  if_addgroup+0x2f8 if_creategroup sys/net/if.c:3057 [inline]
#2  if_addgroup+0x2f8 sys/net/if.c:3095
#3  if_attachsetup+0xcf sys/net/if.c:512
#4  if_attach+0x6d sys/net/if.c:604
#5  vio_attach+0x17f7 sys/dev/pv/if_vio.c:927
#6  config_attach+0x449 sys/kern/subr_autoconf.c:421
#7  virtio_pci_attach+0x52c sys/dev/pci/virtio_pci.c:675
#8  config_attach+0x449 sys/kern/subr_autoconf.c:421
#9  pci_probe_device+0x8e5 sys/dev/pci/pci.c:574
#10 pci_enumerate_bus+0x368 sys/dev/pci/pci.c:877
#11 config_attach+0x449 sys/kern/subr_autoconf.c:421
#12 acpipci_attach_bus+0x37a sys/arch/amd64/pci/acpipci.c:231
#13 acpipci_attach_busses+0x93 sys/arch/amd64/pci/acpipci.c:239
#14 mainbus_attach+0x304 sys/arch/amd64/amd64/mainbus.c:222
#15 config_attach+0x449 sys/kern/subr_autoconf.c:421
#16 cpu_configure+0x47 sys/arch/amd64/amd64/autoconf.c:124
#17 main+0x4c7 sys/kern/init_main.c:345
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff83926b00,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff83926ae8,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(fffffd806c437a60,ffff80002a263988,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(fffffd806c437a60,0,ffff80002a263a58,ffff80002a263a3c,0,1,2b93832f61732f78,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff80002a263c70,ffff80002a263ca8,ffff80002a263af0,ffff80002a263ad8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80002a263c70,ffff80002a263ca8,ffff80002a263bf0) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(fffffd806e8721f8,200000000000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80002a263e20,200000000200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff80002a263e20) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:528
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(34900,c4504441,ffff800001591800,1,ffff80002a2334d0) at pfioctl+0x13ff sys/net/pf_ioctl.c:3238
VOP_IOCTL(fffffd806271b968,c4504441,ffff800001591800,1,fffffd80097fd750,ffff80002a2334d0) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffffd8069e5da48,c4504441,ffff800001591800,ffff80002a2334d0) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80002a2334d0,ffff80002a2649d0,ffff80002a264920) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80002a2649d0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2649d0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x444ec3f2750, count: -18
ddb{0}> 

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/12 03:15 openbsd 369ac04692fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/10 04:55 openbsd 33e6d7cf8045 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
* Struck through repros no longer work on HEAD.