witness: reversal: lock order data missing (5)

Status: upstream: reported on 2025/02/03 09:07
Reported-by: syzbot+6e45b18b14156f1df9f4@syzkaller.appspotmail.com
First crash: 614d, last: now
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: lock order data missing (2) -1 syz, C 173 1825d 1975d 0/4 closed as invalid on 2022/02/22 18:44
openbsd witness: reversal: lock order data missing (3) -1 8192 821d 1669d 3/4 fixed on 2024/07/10 22:52
openbsd witness: reversal: lock order data missing (4) -1 57671 688d 821d 0/4 auto-obsoleted due to no activity on 2025/01/09 12:07
openbsd witness: reversal: lock order data missing -1 syz, C 667 1975d 2045d 3/4 fixed on 2021/05/14 01:59

Sample crash report:
login: witness: lock order reversal:
 1st 0xffff800001628440 sbufrcv (&so->so_rcv.sb_lock)
 2nd 0xfffff800766dbb48 inode (&ip->i_lock)
lock order [1] sbufrcv (&so->so_rcv.sb_lock) -> [2] inode (&ip->i_lock)
lock order data 0xffffffff8347dcf6 -> 0xffffffff834c4520 is missing
lock order [2] inode (&ip->i_lock) -> [1] sbufrcv (&so->so_rcv.sb_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  sblock+0xb6 sys/kern/uipc_socket2.c:536
#2  soreceive+0x27d sys/kern/uipc_socket.c:890
#3  fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264
#4  VOP_READ+0x101 sys/kern/vfs_vops.c:227
#5  vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1
#6  vndsetcred+0xa1 sys/dev/vnd.c:685
#7  vndioctl+0xdfc sys/dev/vnd.c:486
#8  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#9  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#12 Xsyscall+0x128
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> show kasan
No such command
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(fffff800766dbb48,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(fffff800766dbb30,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
rrw_enter(fffff800766dbb30,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
VOP_LOCK(fffff80074ecc538,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
vn_lock(fffff80074ecc538,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576
vfs_getcwd_common(fffff80074ecc538,fffff80074eccbf8,0,0,200,0,2f478518b43c64b1) at vfs_getcwd_common+0xd1 sys/kern/vfs_getcwd.c:287
vn_isunder(fffff80074ecc538,fffff80074eccbf8,ffff800045feba10) at vn_isunder+0x56 sys/kern/vfs_vnops.c:700
unp_externalize(fffff8006da34600,42,3800) at unp_externalize+0x26f sys/kern/uipc_usrreq.c:1093
soreceive(ffff800001628350,ffff80002a30cbd8,ffff80002a30cb88,0,ffff80002a30cbd0,ffff80002a30cd4c,465d2a4d7a5e7945) at soreceive+0xc24 sys/kern/uipc_socket.c:1029
recvit(ffff800045feba10,1,ffff80002a30cd20,0,ffff80002a30cdd0) at recvit+0x40b sys/kern/uipc_syscalls.c:1078
sys_recvmsg(ffff800045feba10,ffff80002a30ce80,ffff80002a30cdd0) at sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878
syscall(ffff80002a30ce80) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a30ce80) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x16446ce8c80, count: -14
ddb{1}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80002a30c660
rbx                                0
rdx               0xffff800001610f40
rcx               0xffff800045feba10
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80002a30c540
r9                0x8080808080808080
r10               0x72d0d754c679601e
r11               0x3b2d508b3768ba79
r12               0xfffff80004100940
r13               0xfffff800048e7b58
r14                              0x3
r15               0xffffffff8355a94a    substchar+0xb4fb
rip               0xffffffff82140f95    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a30c650
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=379090 pid=41193 tcnt=3 stat=onproc
    flags process=1000010<SUGID,CHROOT> proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a33ed28,0xffff800045feafc0
    process=0xffff80003a3a4028 user=0xffff80002a307000, vmspace=0xfffff8006cefe200
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 55152  235187  77294     0  2        0x40          0           syz-executor
 41193   83432  93762 60929  2   0x1000010          0           syz-executor
*41193  379090  93762 60929  7   0x1000010  0x4000000           syz-executor
 41193  325292  93762 60929  3   0x1000010  0x4000080 fsleep    syz-executor
 59609  308152  26687     0  3    0x100002       0x88 sigsusp   sh
 68057  401358  41046     0  3    0x100002       0x88 sigsusp   sh
 39218  396192  31956     0  2           0          0           syz-executor
 39218  342449  31956     0  3           0  0x4000080 fsleep    syz-executor
 39218  267746  31956     0  3           0  0x4000080 fsleep    syz-executor
 39218   94638  31956     0  3           0  0x4000080 fsleep    syz-executor
 75483  110797  31875     0  2         0x2          0           syz-executor
 66984  418449  31875     0  3         0x2       0x80 wait      syz-executor
 60258  467815  89731    -1  2        0x10          0           syz-executor
 60258  317911  89731    -1  3        0x10  0x4000080 sbwait    syz-executor
 60258  326960  89731    -1  3        0x10  0x4000080 kqread    syz-executor
 60258  153532  89731    -1  3        0x10  0x4000080 kqread    syz-executor
 60258  182817  89731    -1  3        0x10  0x4000080 fsleep    syz-executor
 60258   19248  89731    -1  7        0x10  0x4000000           syz-executor
 60258  344508  89731    -1  3        0x10  0x4000080 fsleep    syz-executor
 60258   86622  89731    -1  3        0x10  0x4000080 fsleep    syz-executor
 60258  354336  89731    -1  2        0x10  0x4000000           syz-executor
 77294  440006  31875     0  3        0x82          0 ppwait    syz-executor
 41046  234969  31875     0  3         0x2       0x80 wait      syz-executor
 26687  316986  31875     0  3         0x2       0x80 wait      syz-executor
 89731  414729  31875     0  2         0x2          0           syz-executor
 31956  289853  31875     0  3         0x2       0x80 nanoslp   syz-executor
 93762  324850  31875     0  3         0x2       0x80 nanoslp   syz-executor
  5595  277626      1     0  3    0x100003       0x80 ttyin     getty
 25294  295986      0     0  3     0x14000      0x280 nfsidl    nfsio
 20872  275839      0     0  3     0x14000      0x280 nfsidl    nfsio
 63166  250579      0     0  3     0x14000      0x280 nfsidl    nfsio
 26370  175542      0     0  3     0x14000      0x280 nfsidl    nfsio
    52   63521      0     0  3     0x14000      0x280 nfsidl    nfsio
 56519  429175      0     0  3     0x14000      0x280 nfsidl    nfsio
  7623   46210      0     0  3     0x14000      0x280 nfsidl    nfsio
 36679  326946      0     0  3     0x14000      0x280 nfsidl    nfsio
 30794  230187      0     0  3     0x14000      0x280 nfsidl    nfsio
 86418   25546      0     0  3     0x14000      0x280 nfsidl    nfsio
 10094  298987      0     0  3     0x14000      0x280 nfsidl    nfsio
 29216  251765      0     0  3     0x14000      0x280 nfsidl    nfsio
 83166  270728      0     0  3     0x14000      0x280 nfsidl    nfsio
 51113  106452      0     0  3     0x14000      0x280 nfsidl    nfsio
 47414  268734      0     0  3     0x14000      0x280 nfsidl    nfsio
 60672  192486      0     0  3     0x14000      0x280 nfsidl    nfsio
 82376  266719      0     0  3     0x14000      0x280 nfsidl    nfsio
 22352  275929      0     0  3     0x14000      0x280 nfsidl    nfsio
 62502  430367      0     0  3     0x14000      0x280 nfsidl    nfsio
 26126  123460      0     0  3     0x14000      0x280 nfsidl    nfsio
 31875  211275  72492     0  3         0x2       0x80 kqread    syz-executor
 72492   49533   1974     0  3    0x100002       0x88 sigsusp   ksh
  1974  233821   7943     0  3        0x10       0x88 kqread    sshd-session
  7943  474580  43497     0  3        0x12       0x80 kqread    sshd-session
 43497  259339      1     0  3           0       0x88 kqread    sshd
 51586    6888  62830    74  3   0x1100012       0x80 bpf       pflogd
 62830  479631      1     0  3           0       0x80 sbwait    pflogd
 83062  223768  42473    73  3   0x1100010       0x80 kqread    syslogd
 42473   60531      1     0  3    0x100002       0x80 sbwait    syslogd
 50694  401741      1     0  3    0x100000       0x80 kqread    resolvd
 71402  216612  45021    77  3    0x100012       0x80 kqread    dhcpleased
 60391  391368  45021    77  3    0x100012       0x80 kqread    dhcpleased
 45021  268207      1     0  3           0       0x80 kqread    dhcpleased
 33933   29579      0     0  3     0x14000      0x200 bored     smr
 35617  302071      0     0  2     0x14000      0x200           zerothread
 84894  269163      0     0  3     0x14000      0x200 aiodoned  aiodoned
 85413  319905      0     0  3     0x14000      0x200 syncer    update
 96266  228626      0     0  3     0x14000      0x200 cleaner   cleaner
 47235  328023      0     0  2     0x14000      0x200           reaper
 27578  207492      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 44270  383169      0     0  3     0x14000      0x200 bored     viomb
 78605  220536      0     0  3     0x14000 0x40000200 acpi0     acpi0
 12782  318809      0     0  3     0x14000 0x40000200           idle1
 38999  374416      0     0  3     0x14000      0x200 bored     softnet1
 93623   93992      0     0  2     0x14000      0x200           softnet0
 43963  400150      0     0  2     0x14000      0x200           systqmp
 50235  461723      0     0  3     0x14000      0x200 bored     systq
 62516  229465      0     0  3     0x14000      0x200 tmoslp    softclockmp
 13288  222241      0     0  3     0x14000 0x40000200 tmoslp    softclock
 50759  439084      0     0  3     0x14000 0x40000200           idle0
     1  236802      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3  0x10010000      0x200 scheduler swapper
ddb{1}> show all locks
Process 41193 (syz-executor) thread 0xffff800045feba10 (379090)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a8c600)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  unp_externalize+0x155 sys/kern/uipc_usrreq.c:-1
#2  soreceive+0xc24 sys/kern/uipc_socket.c:1029
#3  recvit+0x40b sys/kern/uipc_syscalls.c:1078
#4  sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#6  Xsyscall+0x128
exclusive rwlock sbufrcv r = 0 (0xffff800001628440)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  sblock+0xb6 sys/kern/uipc_socket2.c:536
#3  soreceive+0x27d sys/kern/uipc_socket.c:890
#4  recvit+0x40b sys/kern/uipc_syscalls.c:1078
#5  sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
Process 60258 (syz-executor) thread 0xffff800045fe9a18 (317911)
exclusive rrwlock inode r = 0 (0xfffff8006ed93928)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4  ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:150
#5  ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ufs_lookup+0x16bd sys/ufs/ufs/ufs_lookup.c:573
#7  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#8  vfs_lookup+0x9e3 sys/kern/vfs_lookup.c:585
#9  namei+0x7c1 sys/kern/vfs_lookup.c:250
#10 vn_open+0x178 sys/kern/vfs_vnops.c:146
#11 vndioctl+0xc43 sys/dev/vnd.c:458
#12 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#13 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#14 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#15 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#15 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#16 Xsyscall+0x128
Process 43963 (systqmp) thread 0xffff800045ffe7c8 (400150)
shared rwlock systqmp r = 0 (0xffffffff839bd098)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11071  12093K   12217K 166960K     12919        0
            pcb    17     16K      18K 166960K       156        0
         rtable   153     13K      16K 166960K      3882        0
             pf    40     18K      25K 166960K       353        0
         ifaddr    31      6K       8K 166960K       528        0
        ifgroup    57      2K       2K 166960K       552        0
         sysctl     4      1K       9K 166960K        11        0
       counters    74     37K      37K 166960K       324        0
       ioctlops     0      0K       4K 166960K      1666        0
            iov     0      0K      16K 166960K        12        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1359     85K      86K 166960K      3013        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         6        0
         VM map     2      1K       1K 166960K         2        0
            sem    27      1K       1K 166960K        33        0
        dirhash    15      2K       3K 166960K        24        0
           ACPI  1734    201K     291K 166960K     11964        0
      file desc    16     57K      93K 166960K      2328        0
          sigio     0      0K       0K 166960K         4        0
           proc    72    115K     196K 166960K      3898        0
        subproc    66      4K       4K 166960K      1155        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        38        0
       in_multi    44      2K       6K 166960K      1377        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K        44        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    79    360K     360K 166960K        79        0
           exec     0      0K       1K 166960K      1924        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   226    169K     183K 166960K     16591        0
       UVM aobj    16      2K       2K 166960K        17        0
     pinsyscall    41     82K     103K 166960K      6532        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        12        0
            NDP    16      0K       2K 166960K       387        0
           temp    38   9123K    9142K 166960K     35798        0
         kqueue    14     20K      26K 166960K       102        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120      281    0      278     1     0     1     1     0     8    0
rtentry    176     1393    0     1335     7     2     5     6     0     8    0
unpcb      144      519    0      496     4     3     1     2     0     8    0
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      736      278    0      274     9     8     1     7     0     8    0
arp        136      250    0      242     1     0     1     1     0     8    0
inpcb      328     1205    0     1197     9     8     1     7     0     8    0
nd6        152      377    0      367     2     1     1     2     0     8    0
pkpcb       40        2    0        2     1     1     0     1     0     8    0
kcovpl      48      128    0      121     1     0     1     1     0     8    0
ppxss      1192       6    0        3     4     3     1     1     0     8    0
pffrag     232        5    0        0     1     0     1     1     0   482    0
pffrnode    88        5    0        0     1     0     1     1     0     8    0
pffrent     40        6    0        1     1     0     1     1     0     8    0
pfosfp      40     1430    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1430    0      714    21     0    21    21     0     8    0
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pfsrclim   320        1    0        1     1     1     0     1     0     8    0
pfanchor   1288      12    0        9     1     0     1     1     0     8    0
pfstitem    24       71    0       31     1     0     1     1     0     8    0
pfstkey    128       71    0       31     2     0     2     2     0     8    0
pfstate    448       71    0       31     6     0     6     6     0     8    0
pfrule     1360      27    0       21     2     1     1     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256     5627    0     5343    34     8    26    30     0     8    1
art_table   40     5629    0     5343     5     0     5     5     0     8    0
art_node    32     1393    0     1331     1     0     1     1     0     8    0
sysvmsgpl   40        2    0        2     1     1     0     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl      72       30    0        5     1     0     1     1     0     8    0
shmpl      120       14    0        1     1     0     1     1     0     8    0
dirhash    1024      25    0        6     3     0     3     3     0     8    0
dino2pl    256     2629    0      886   109     0   109   109     0     8    0
ffsino     296     2629    0      886   135     0   135   135     0     8    0
nchpl      144     3511    0     1278    83     0    83    83     0     8    0
vnodes     216     4082    0        0   227     0   227   227     0     8    0
namei      1024   27114    0    27114     4     3     1     2     0     8    1
percpumem   16      178    0      125     1     0     1     1     0     8    0
kstatmem   264      283    0      250     3     0     3     3     0     8    0
scsiplug    72        2    0        2     2     2     0     1     0     8    0
scxspl     216    10803    0    10803     5     4     1     3     1     8    1
plimitpl   152      312    0      295     1     0     1     1     0     8    0
sigapl     424     2425    0     2356    10     1     9     9     0     8    0
knotepl    120      514    0        0    15     0    15    15     0     8    0
kqueuepl   224      146    0      136     1     0     1     1     0     8    0
pipepl     344      537    0      510     4     0     4     4     0     8    0
fdescpl    528     2388    0     2358     3     0     3     3     0     8    0
filepl     160     9292    0     9081    17     6    11    14     0     8    0
lockfpl    104       98    0       96     1     0     1     1     0     8    0
lockfspl    48       48    0       46     1     0     1     1     0     8    0
sessionpl  144      417    0      408     1     0     1     1     0     8    0
pgrppl      48      548    0      531     1     0     1     1     0     8    0
ucredpl    104     1033    0     1017     1     0     1     1     0     8    0
zombiepl   144     2359    0     2356     1     0     1     1     0     8    0
processpl  1240    2425    0     2356     6     0     6     6     0     8    0
procpl     664     3348    0     3266     8     1     7     8     0     8    0
sockpl     752     2026    0     1992    13     9     4    11     0     8    0
mcl64k     65536      3    0        0     1     0     1     1     0     8    0
mcl16k     16384      3    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     130    0        0    17     0    17    17     0     8    0
mcl2k      2048      26    0        0     4     0     4     4     0     8    0
mextrefs    64       27    0        0     1     0     1     1     0     8    0
mtagpl      96        1    0        0     1     0     1     1     0     8    0
mbufpl     256      257    0        0    16     0    16    16     0     8    0
bufpl      272     3461    0      107   224     0   224   224     0     8    0
anonpl      32     5474    0        0    44     0    44    44     0   247    0
amapchunkpl 152   44364    0    43915    28     8    20    26     0   158    2
amappl16   200     3262    0     3185    10     5     5     5     0     8    0
amappl15   192       13    0       13     1     1     0     1     0     8    0
amappl14   184     1839    0     1836     1     0     1     1     0     8    0
amappl13   176      361    0      349     1     0     1     1     0     8    0
amappl12   168     3140    0     3112     2     0     2     2     0     8    0
amappl11   160       18    0       17     1     0     1     1     0     8    0
amappl10   152       70    0       56     1     0     1     1     0     8    0
amappl9    144      287    0      287     1     1     0     1     0     8    0
amappl8    136      572    0      570     1     0     1     1     0     8    0
amappl7    128      387    0      373     1     0     1     1     0     8    0
amappl6    120     1333    0     1330     1     0     1     1     0     8    0
amappl5    112      100    0       88     1     0     1     1     0     8    0
amappl4    104      662    0      642     1     0     1     1     0     8    0
amappl3     96     8581    0     8491     3     0     3     3     0     8    0
amappl2     88     2051    0     1978     2     0     2     2     0     8    0
amappl1     80    27192    0    26589    16     2    14    15     0     8    0
amappl      88    13817    0    13665     5     0     5     5     0    92    0
uvmvnodes   80      113    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       16    0        1     1     0     1     1     0     8    0
uaddrrnd    24     2388    0     2358     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2388    0     2358     1     0     1     1     0     8    0
vmmpekpl   168    19110    0    19044     4     0     4     4     0     8    0
vmmpepl    168   160808    0   158946    90     5    85    88     0   357    0
vmsppl     488     2387    0     2355     5     0     5     5     0     8    0
rwobjpl     80    45889    0    44765    25     1    24    25     0     8    0
pdppl      4096    4784    0     4710   224   150    74    86     0     8    0
pvpl        32    11890    0        0    97     1    96    96     0   265    0
pmappl     256     2387    0     2355     3     0     3     3     0     8    0
extentpl    40       46    0       28     1     0     1     1     0     8    0
phpool     112      664    0      173    15     0    15    15     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff8393bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83a8be00) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a8be00) at __mp_lock+0x192 sys/kern/kern_lock.c:173
intr_handler(ffff80003a027970,ffff80000006e200) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f
__mp_lock(ffffffff83a8be00) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83a8be00) at __mp_lock+0x192 sys/kern/kern_lock.c:173
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 kd_curproc sys/dev/kcov.c:585 [inline]
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 sys/dev/kcov.c:153
witness_checkorder(fffff8006ceb44f0,1,0) at witness_checkorder+0x16d sys/kern/subr_witness.c:779
rw_do_enter_read(fffff8006ceb44d8,0) at rw_do_enter_read+0x99 sys/kern/kern_rwlock.c:355
uvmfault_lookup(ffff80003a027ed0,0) at uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1880
uvm_fault_check(ffff80003a027ed0,ffff80003a027f08,ffff80003a027f40,0) at uvm_fault_check+0x4f sys/uvm/uvm_fault.c:693
uvm_fault(fffff8006ceb43f0,154000,0,2) at uvm_fault+0x106 sys/uvm/uvm_fault.c:627
kpageflttrap(ffff80003a028080,154c80) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff80003a028080) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x64
syscall(ffff80003a0284c0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003a0284c0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x82a9b7ebfc0, count: -22
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(fffff800766dbb48,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(fffff800766dbb30,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
rrw_enter(fffff800766dbb30,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
VOP_LOCK(fffff80074ecc538,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
vn_lock(fffff80074ecc538,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576
vfs_getcwd_common(fffff80074ecc538,fffff80074eccbf8,0,0,200,0,2f478518b43c64b1) at vfs_getcwd_common+0xd1 sys/kern/vfs_getcwd.c:287
vn_isunder(fffff80074ecc538,fffff80074eccbf8,ffff800045feba10) at vn_isunder+0x56 sys/kern/vfs_vnops.c:700
unp_externalize(fffff8006da34600,42,3800) at unp_externalize+0x26f sys/kern/uipc_usrreq.c:1093
soreceive(ffff800001628350,ffff80002a30cbd8,ffff80002a30cb88,0,ffff80002a30cbd0,ffff80002a30cd4c,465d2a4d7a5e7945) at soreceive+0xc24 sys/kern/uipc_socket.c:1029
recvit(ffff800045feba10,1,ffff80002a30cd20,0,ffff80002a30cdd0) at recvit+0x40b sys/kern/uipc_syscalls.c:1078
sys_recvmsg(ffff800045feba10,ffff80002a30ce80,ffff80002a30cdd0) at sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878
syscall(ffff80002a30ce80) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a30ce80) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x16446ce8c80, count: -14

Crashes (236810):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/10 09:18 openbsd 22a54d88cfed 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/10 07:54 openbsd 22a54d88cfed 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/10 06:18 openbsd 22a54d88cfed 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/10 05:26 openbsd 22a54d88cfed 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/10 03:55 openbsd 22a54d88cfed 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/10 02:51 openbsd ece1de515165 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 22:41 openbsd ece1de515165 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 21:44 openbsd ece1de515165 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 18:37 openbsd ece1de515165 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 17:24 openbsd ece1de515165 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 15:47 openbsd ece1de515165 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 14:00 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 12:58 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 11:56 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 10:29 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 09:24 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 06:15 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 05:10 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 03:53 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 02:53 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 02:17 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/09 00:55 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 23:39 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 22:28 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 21:03 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 21:02 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 19:56 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 17:16 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 16:03 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 15:00 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 13:46 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 12:41 openbsd e8af851f340b 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 11:39 openbsd e8af851f340b 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 11:35 openbsd e8af851f340b 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 08:59 openbsd 018a01b20aed 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 07:27 openbsd 018a01b20aed 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 06:57 openbsd 018a01b20aed 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/08 05:51 openbsd 018a01b20aed 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2025/02/03 09:06 openbsd db5d28f093d6 568559e4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: lock order data missing
2026/10/10 01:19 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3ca837577e76 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: lock order data missing
2026/10/10 00:16 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3ca837577e76 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: lock order data missing
2026/10/09 20:04 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3ca837577e76 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: lock order data missing
2026/10/09 15:14 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3ca837577e76 afb79809 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: lock order data missing
2026/10/09 07:15 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3ca837577e76 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: lock order data missing
2026/10/08 18:47 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3ca837577e76 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: lock order data missing
2026/10/08 10:13 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 3ca837577e76 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: lock order data missing
* Struck through repros no longer work on HEAD.