witness: reversal: pf_lock netlock (4)

Status: upstream: reported on 2026/05/10 04:56
Reported-by: syzbot+65be7385fa082665e7e8@syzkaller.appspotmail.com
First crash: 118d, last: 3h19m
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: pf_lock netlock (2) -1 syz, C 2 1610d 1610d 3/4 fixed on 2022/04/10 04:45
openbsd witness: reversal: pf_lock netlock (3) -1 syz 25 1589d 1601d 3/4 fixed on 2022/04/29 14:56
openbsd witness: reversal: pf_lock netlock -1 syz, C 19 1621d 1673d 3/4 fixed on 2022/04/08 05:01

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff838e6288 pf_lock (pf_lock)
 2nd 0xffffffff8393fd40 netlock (netlock)
lock order [1] pf_lock (pf_lock) -> [2] netlock (netlock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
#2  uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
#3  uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
#4  uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
#7  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
#8  alltraps_kern_meltdown+0x7b
#9  _copyin+0x5b
#10 pfioctl+0x13ff sys/net/pf_ioctl.c:3241
#11 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#12 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#13 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#14 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
lock order [2] netlock (netlock) -> [1] pf_lock (pf_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  pfi_attach_ifgroup+0x2a sys/net/pf_if.c:357
#2  if_addgroup+0x2f8 if_creategroup sys/net/if.c:3059 [inline]
#2  if_addgroup+0x2f8 sys/net/if.c:3097
#3  if_attachsetup+0xcf sys/net/if.c:512
#4  if_attach+0x6d sys/net/if.c:604
#5  vio_attach+0x1853 sys/dev/pv/if_vio.c:935
#6  config_attach+0x449 sys/kern/subr_autoconf.c:421
#7  virtio_pci_attach+0x52c sys/dev/pci/virtio_pci.c:675
#8  config_attach+0x449 sys/kern/subr_autoconf.c:421
#9  pci_probe_device+0x8e5 sys/dev/pci/pci.c:574
#10 pci_enumerate_bus+0x368 sys/dev/pci/pci.c:877
#11 config_attach+0x449 sys/kern/subr_autoconf.c:421
#12 acpipci_attach_bus+0x381 sys/arch/amd64/pci/acpipci.c:257
#13 acpipci_attach_busses+0x93 sys/arch/amd64/pci/acpipci.c:265
#14 mainbus_attach+0x304 sys/arch/amd64/amd64/mainbus.c:222
#15 config_attach+0x449 sys/kern/subr_autoconf.c:421
#16 cpu_configure+0x47 sys/arch/amd64/amd64/autoconf.c:124
#17 main+0x4c7 sys/kern/init_main.c:345
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> show kasan
No such command
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff8393fd40,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff8393fd28,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(fffffd005e46bf10,ffff8000383e17b8,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(fffffd005e46bf10,1000,ffff8000383e1888,ffff8000383e186c,0,1,1f0df61f52e10eb5,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff8000383e1aa0,ffff8000383e1ad8,ffff8000383e1920,ffff8000383e1908) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff8000383e1aa0,ffff8000383e1ad8,ffff8000383e1a20) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(fffffd000b1cb3d0,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff8000383e1c50,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff8000383e1c50) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(14900,c4504441,ffff8000015e8000,1,ffff80002a22a7e0) at pfioctl+0x13ff sys/net/pf_ioctl.c:3241
VOP_IOCTL(fffffd006a9f4700,c4504441,ffff8000015e8000,1,fffffd00097fd820,ffff80002a22a7e0) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffffd006ceed030,c4504441,ffff8000015e8000,ffff80002a22a7e0) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80002a22a7e0,ffff8000383e2800,ffff8000383e2750) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff8000383e2800) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000383e2800) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xcb3b7b3acd0, count: -18
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff8000383e1570
rbx                                0
rdx                                0
rcx               0xffff80002a22a7e0
rax               0xffff80002999dff0
r8                0xffff8000383e1450
r9                0x8080808080808080
r10               0x1f7302cb1574f247
r11               0x49713a3b853f9547
r12               0xfffffd00040c22c0
r13               0xfffffd00048b1ce0
r14                              0x3
r15               0xffffffff8352bf72    substchar+0x80c9
rip               0xffffffff8181cf75    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff8000383e1560
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=11920 pid=19857 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=62, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a22b770,0xffff80002a22bcb0
    process=0xffff800045ff44d8 user=0xffff8000383dd000, vmspace=0xfffffd000b1cb3d0
    estcpu=12, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 33666  285869   6395     0  2           0          0           syz-executor
  7499  449373  26220     0  2    0x100000          0           sh
 26220  509867  81062     0  3    0x100002       0x88 sigsusp   sh
 10395  290164  45553     0  2           0          0           syz-executor
 10395   70263  45553     0  3           0  0x4000080 lockf     syz-executor
 89420  479463  37150     0  2           0          0           syz-executor
 89420  202115  37150     0  3           0  0x4000080 fsleep    syz-executor
 19857  236722  41016     0  2           0          0           syz-executor
*19857   11920  41016     0  7           0  0x4000000           syz-executor
 46719  462690  74732     0  2    0x100002          0           sh
 86431  223696  92019     0  2         0x2          0           syz-executor
 74732  181500  92019     0  3         0x2       0x80 wait      syz-executor
 81062  327747  92019     0  3         0x2       0x80 wait      syz-executor
  6395  455366  92019     0  3         0x2       0x80 nanoslp   syz-executor
 37150  298123  92019     0  3         0x2       0x80 nanoslp   syz-executor
 45553  452639  92019     0  3         0x2       0x80 nanoslp   syz-executor
 32087   53911  92019     0  3         0x2       0x80 nanoslp   syz-executor
 41016  504865  92019     0  3         0x2       0x80 nanoslp   syz-executor
 92019   13875  45850     0  3         0x2       0x80 kqread    syz-executor
 45850  253521  79786     0  3    0x100002       0x88 sigsusp   ksh
 79786  225148  25194     0  3        0x10       0x88 kqread    sshd-session
 25194   46151  56293     0  3        0x12       0x80 kqread    sshd-session
 46485  282878      1     0  3    0x100003       0x80 ttyin     getty
 56293  182494      1     0  3           0       0x88 kqread    sshd
 67652  355123  63520    74  3   0x1100012       0x80 bpf       pflogd
 63520  521943      1     0  3           0       0x80 sbwait    pflogd
 10334  243504  12796    73  3   0x1100010       0x80 kqread    syslogd
 12796  126837      1     0  3    0x100002       0x80 sbwait    syslogd
 72958  445957      1     0  3    0x100000       0x80 kqread    resolvd
 42254  394250  55152    77  3    0x100012       0x80 kqread    dhcpleased
 10593  345793  55152    77  3    0x100012       0x80 kqread    dhcpleased
 55152  402609      1     0  3           0       0x80 kqread    dhcpleased
 16751  385946      0     0  2     0x14000 0x40000200           smr
 93369  375843      0     0  2     0x14000      0x200           zerothread
 41816   18236      0     0  3     0x14000      0x200 aiodoned  aiodoned
 75962  449648      0     0  3     0x14000      0x200 syncer    update
 56447  327752      0     0  3     0x14000      0x200 cleaner   cleaner
 57017  445745      0     0  3     0x14000      0x200 reaper    reaper
  3909  100416      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 51556  451932      0     0  3     0x14000      0x200 bored     viomb
 22911  295714      0     0  3     0x14000 0x40000200 acpi0     acpi0
  5227   58902      0     0  3     0x14000 0x40000200           idle1
 17384  398984      0     0  3     0x14000      0x200 bored     softnet1
 78483  493084      0     0  2     0x14000      0x200           softnet0
 82957     139      0     0  3     0x14000      0x200 smrbar    systqmp
 27858  289532      0     0  3     0x14000      0x200 bored     systq
 56963  432524      0     0  3     0x14000      0x200 tmoslp    softclockmp
 51715  360127      0     0  3     0x14000 0x40000200 tmoslp    softclock
 20193  133343      0     0  3     0x14000 0x40000200           idle0
     1  122569      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 19857 (syz-executor) thread 0xffff80002a22a7e0 (11920)
exclusive rwlock pf_lock r = 0 (0xffffffff838e6288)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x13ca sys/net/pf_ioctl.c:3241
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive rwlock pfioctl_rw r = 0 (0xffffffff838e6318)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1d4 sys/net/pf_ioctl.c:2075
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b3ee00)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_ioctl+0x4d sys/kern/vfs_vnops.c:520
#2  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
Process 82957 (systqmp) thread 0xffff800045ffe298 (139)
shared rwlock systqmp r = 0 (0xffffffff839d9578)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11068  12160K   12160K 166960K     12193        0
            pcb    17     12K      12K 166960K        27        0
         rtable   192      7K       9K 166960K       445        0
             pf    38     18K      22K 166960K        73        0
         ifaddr    37      6K       7K 166960K        61        0
        ifgroup    57      2K       2K 166960K        77        0
         sysctl     1      1K       9K 166960K         6        0
       counters    72     37K      37K 166960K        82        0
       ioctlops     1      2K       4K 166960K      1493        0
            iov     0      0K      16K 166960K         1        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1291     81K      82K 166960K      1437        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         3        0
         VM map     2      1K       1K 166960K         2        0
            sem     5      0K       0K 166960K         5        0
        dirhash    15      2K       2K 166960K        15        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    17     61K      97K 166960K       228        0
           proc    71    115K     180K 166960K       665        0
        subproc    72      4K       4K 166960K       117        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K         2        0
       in_multi    68      4K       6K 166960K       125        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         1        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    61    281K     281K 166960K        61        0
           exec     0      0K       1K 166960K       442        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   212    172K     177K 166960K      3817        0
       UVM aobj     4      2K       2K 166960K         4        0
     pinsyscall    42     84K     106K 166960K      1508        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
            NDP    15      0K       2K 166960K        38        0
           temp    34   9114K    9135K 166960K      5120        0
         kqueue    15     24K      24K 166960K        36        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       43    0       40     1     0     1     1     0     8    0
rtentry    176      139    0       56     6     0     6     6     0     8    0
unpcb      144       62    0       43     1     0     1     1     0     8    0
syncache   336        4    0        4     1     0     1     1     0     8    1
tcpcb      736       15    0       11     1     0     1     1     0     8    0
arp        136       24    0       10     1     0     1     1     0     8    0
inpcb      328      104    0       96     2     0     2     2     0     8    1
nd6        152       30    0       15     1     0     1     1     0     8    0
kcovpl      48       13    0        5     1     0     1     1     0     8    0
ppxss      1192       1    0        0     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       6    0        2     1     0     1     1     0     8    0
pfsrclim   320        1    0        1     1     0     1     1     0     8    1
pfanchor   1288       2    0        0     1     0     1     1     0     8    0
pfstitem    24       27    0        0     1     0     1     1     0     8    0
pfstkey    128       27    0        0     1     0     1     1     0     8    0
pfstate    448       27    0        0     3     0     3     3     0     8    0
pfrule     1360      22    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      546    0      176    29     0    29    29     0     8    4
art_table   40      547    0      176     5     0     5     5     0     8    0
art_node    32      139    0       52     1     0     1     1     0     8    0
semapl      72        3    0        0     1     0     1     1     0     8    0
shmpl      112        1    0        0     1     0     1     1     0     8    0
dirhash    1024      19    0        0     3     0     3     3     0     8    0
dino2pl    256     1653    0      175    93     0    93    93     0     8    0
ffsino     296     1653    0      175   114     0   114   114     0     8    0
nchpl      144     1895    0      179    64     0    64    64     0     8    0
vnodes     216     1800    0        0   100     0   100   100     0     8    0
namei      1024    7174    0     7174     4     1     3     3     0     8    3
percpumem   16       57    0        5     1     0     1     1     0     8    0
pfiaddrpl  120        2    0        0     1     0     1     1     0     8    0
kstatmem   264       39    0       10     2     0     2     2     0     8    0
scxspl     216     6502    0     6502     4     3     1     3     1     8    1
plimitpl   152      106    0       89     1     0     1     1     0     8    0
sigapl     424      547    0      499     7     0     7     7     0     8    1
knotepl    120      269    0        0     9     0     9     9     0     8    0
kqueuepl   224       41    0       29     1     0     1     1     0     8    0
pipepl     344      148    0      121     3     0     3     3     0     8    0
fdescpl    528      531    0      500     3     0     3     3     0     8    0
filepl     160     1984    0     1765    10     0    10    10     0     8    0
lockfpl    104       20    0       15     1     0     1     1     0     8    0
lockfspl    48       11    0        7     1     0     1     1     0     8    0
sessionpl  144       30    0       21     1     0     1     1     0     8    0
pgrppl      48       43    0       26     1     0     1     1     0     8    0
ucredpl    104      204    0      191     1     0     1     1     0     8    0
zombiepl   144      500    0      499     1     0     1     1     0     8    0
processpl  1232     547    0      499     5     0     5     5     0     8    1
procpl     664      616    0      565     5     0     5     5     0     8    0
sockpl     752      212    0      182     4     0     4     4     0     8    1
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     139    0        0    18     0    18    18     0     8    0
mcl2k      2048      14    0        0     2     0     2     2     0     8    0
mextrefs    64       16    0        0     1     0     1     1     0     8    0
mtagpl      96        1    0        0     1     0     1     1     0     8    0
mbufpl     256      178    0        0    12     0    12    12     0     8    0
bufpl      272     2344    0      105   150     0   150   150     0     8    0
anonpl      32     3622    0        0    30     0    30    30     0   247    0
amapchunkpl 152   10166    0     9766    19     0    19    19     0   158    0
amappl16   200     1415    0     1399     5     1     4     5     0     8    2
amappl15   192        6    0        6     1     1     0     1     0     8    0
amappl14   184      484    0      480     1     0     1     1     0     8    0
amappl13   176      131    0      119     1     0     1     1     0     8    0
amappl12   168      796    0      768     2     0     2     2     0     8    0
amappl11   160       61    0       61     1     1     0     1     0     8    0
amappl10   152       69    0       54     1     0     1     1     0     8    0
amappl9    144      272    0      271     1     0     1     1     0     8    0
amappl8    136      117    0      115     1     0     1     1     0     8    0
amappl7    128      158    0      144     1     0     1     1     0     8    0
amappl6    120      202    0      199     1     0     1     1     0     8    0
amappl5    112      102    0       92     1     0     1     1     0     8    0
amappl4    104      303    0      284     1     0     1     1     0     8    0
amappl3     96     1780    0     1702     3     0     3     3     0     8    0
amappl2     88      647    0      573     2     0     2     2     0     8    0
amappl1     80    11173    0    10581    16     1    15    15     0     8    2
amappl      88     3017    0     2879     4     0     4     4     0    92    0
uvmvnodes   80       99    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        8    0        8     2     1     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        3    0        0     1     0     1     1     0     8    0
uaddrrnd    24      531    0      500     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      531    0      500     1     0     1     1     0     8    0
vmmpekpl   168     6420    0     6373     3     0     3     3     0     8    0
vmmpepl    168    43409    0    41623    87     0    87    87     0   357    5
vmsppl     488      530    0      499     5     0     5     5     0     8    0
rwobjpl     80    15451    0    14453    26     1    25    26     0     8    3
pdppl      4096    1069    0      998   111    38    73    87     0     8    2
pvpl        32     9036    0        0    73     0    73    73     0   265    0
pmappl     256      530    0      499     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      438    0       42    12     0    12    12     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff83997ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x44 sys/dev/kcov.c:159
intr_handler(ffff800037fd67b0,ffff80000006e200) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x19 kd_curproc sys/dev/kcov.c:580 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x19 sys/dev/kcov.c:153
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__mp_lock(ffffffff83b3e600) at __mp_lock+0x190 __mp_lock_spin sys/kern/kern_lock.c:143 [inline]
__mp_lock(ffffffff83b3e600) at __mp_lock+0x190 sys/kern/kern_lock.c:173
exit1(ffff800045feaa80,0,0,1) at exit1+0x720 sys/kern/kern_exit.c:260
sys_exit(ffff800045feaa80,ffff800037fd6bd0,ffff800037fd6b20) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff800037fd6bd0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800037fd6bd0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x785095fafcf0, count: -15
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff8393fd40,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff8393fd28,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(fffffd005e46bf10,ffff8000383e17b8,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243
uvn_get(fffffd005e46bf10,1000,ffff8000383e1888,ffff8000383e186c,0,1,1f0df61f52e10eb5,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075
uvm_fault_lower_io(ffff8000383e1aa0,ffff8000383e1ad8,ffff8000383e1920,ffff8000383e1908) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff8000383e1aa0,ffff8000383e1ad8,ffff8000383e1a20) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(fffffd000b1cb3d0,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff8000383e1c50,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff8000383e1c50) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(14900,c4504441,ffff8000015e8000,1,ffff80002a22a7e0) at pfioctl+0x13ff sys/net/pf_ioctl.c:3241
VOP_IOCTL(fffffd006a9f4700,c4504441,ffff8000015e8000,1,fffffd00097fd820,ffff80002a22a7e0) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffffd006ceed030,c4504441,ffff8000015e8000,ffff80002a22a7e0) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80002a22a7e0,ffff8000383e2800,ffff8000383e2750) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff8000383e2800) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000383e2800) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xcb3b7b3acd0, count: -18

Crashes (190):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/05 04:53 openbsd a37481e85163 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/05 03:35 openbsd a37481e85163 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/05 01:39 openbsd a37481e85163 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/04 09:58 openbsd 702f41303f5f 801f0966 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/04 07:21 openbsd 702f41303f5f 801f0966 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/04 03:45 openbsd 702f41303f5f 801f0966 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/03 20:16 openbsd b6c1a7530e98 d2e5fb95 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/03 13:53 openbsd b6c1a7530e98 d2e5fb95 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/03 06:43 openbsd 3eb032007ac4 6a988719 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/02 13:37 openbsd 91392fcbf029 74e93e68 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/01 19:31 openbsd 0f464d413c50 587f6b29 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/01 00:39 openbsd 4077242b4a15 00e9c810 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/31 01:31 openbsd a0938fbae2a0 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/30 16:22 openbsd a0938fbae2a0 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/29 22:24 openbsd 2c3a37e498aa 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/29 19:31 openbsd 2c3a37e498aa 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/28 23:50 openbsd e885dbe04d18 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/28 17:06 openbsd 8fb22f705ce6 41d151d4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/27 20:25 openbsd eaf6a50527ed c53a1b9c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/27 09:30 openbsd eaf6a50527ed c53a1b9c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/26 22:11 openbsd 9c51b1274871 a2b77b9e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/26 16:17 openbsd 9c51b1274871 a2b77b9e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/26 05:40 openbsd 3505799fc8d8 6a91adb4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/25 19:30 openbsd 35698001175f a9a1fc32 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/25 05:05 openbsd c0485cf4f019 614e416a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/24 02:03 openbsd cf84231e2650 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/23 21:58 openbsd 69b59cbe79d8 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/23 18:31 openbsd 69b59cbe79d8 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/23 08:12 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/23 01:39 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/22 09:52 openbsd 94b8f25de2d2 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/21 23:01 openbsd d8ab52b87c98 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/21 09:02 openbsd 073728865af4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/21 05:34 openbsd 073728865af4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/20 05:44 openbsd 1a498b6f2b58 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/10 04:55 openbsd 33e6d7cf8045 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/08/25 09:33 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 614e416a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/25 01:18 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 614e416a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/24 17:22 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 b55bd4c3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/24 07:45 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/24 05:12 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 23:39 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 19:51 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 17:11 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 10:06 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 05:38 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/23 00:16 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/22 03:19 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 16d1c2a497d4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/21 19:06 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 16d1c2a497d4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/08/21 19:06 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 16d1c2a497d4 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
* Struck through repros no longer work on HEAD.