syzbot

witness: lock order reversal:
 1st 0xffff800010fdd970 sbufsnd (&so->so_snd.sb_lock)
 2nd 0xfffffd806c6771e8 inode (&ip->i_lock)
lock order [1] sbufsnd (&so->so_snd.sb_lock) -> [2] inode (&ip->i_lock)
lock order data 0xffffffff834ab5b0 -> 0xffffffff834241b2 is missing
lock order [2] inode (&ip->i_lock) -> [3] sbufrcv (&so->so_rcv.sb_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  sblock+0xb6 sys/kern/uipc_socket2.c:536
#2  soreceive+0x27d sys/kern/uipc_socket.c:890
#3  fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264
#4  VOP_READ+0x101 sys/kern/vfs_vops.c:227
#5  vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1
#6  vndsetcred+0xa1 sys/dev/vnd.c:685
#7  vndioctl+0xdfc sys/dev/vnd.c:486
#8  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#9  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#12 Xsyscall+0x128
lock order [3] sbufrcv (&so->so_rcv.sb_lock) -> [1] sbufsnd (&so->so_snd.sb_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  sblock+0xb6 sys/kern/uipc_socket2.c:536
#2  sosplice+0x312 sys/kern/uipc_socket.c:1347
#3  sys_setsockopt+0x2ba sys/kern/uipc_syscalls.c:1226
#4  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#5  Xsyscall+0x128
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(fffffd806c6771e8,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(fffffd806c6771d0,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
rrw_enter(fffffd806c6771d0,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
VOP_LOCK(fffffd806c3e63b8,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
vn_lock(fffffd806c3e63b8,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576
vget(fffffd806c3e63b8,2001) at vget+0x2a2 sys/kern/vfs_subr.c:686
ktrwriteraw(ffff80003afd2028,fffffd806c3e63b8,fffffd80097fd680,ffff8000393c9030,ffff8000393c9010) at ktrwriteraw+0x175 sys/kern/kern_ktrace.c:688
ktrnamei(ffff80003afd2028,ffff80002a233400) at ktrnamei+0x145 ktrwrite sys/kern/kern_ktrace.c:-1 [inline]
ktrnamei(ffff80003afd2028,ffff80002a233400) at ktrnamei+0x145 sys/kern/kern_ktrace.c:222
namei(ffff8000393c9180) at namei+0x29e sys/kern/vfs_lookup.c:170
unp_connect(ffff800010fdd788,fffffd807ea73600,ffff80003afd2028) at unp_connect+0x29d sys/kern/uipc_usrreq.c:872
uipc_dgram_send(ffff800010fdd788,fffffd806f102900,fffffd807ea73600,0) at uipc_dgram_send+0x163 sys/kern/uipc_usrreq.c:609
sosend(ffff800010fdd788,fffffd807ea73600,ffff8000393c9408,0,0,a) at sosend+0x804 sys/kern/uipc_socket.c:-1
sendit(ffff80003afd2028,5,ffff8000393c9588,a,ffff8000393c9640) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785
sys_sendmsg(ffff80003afd2028,ffff8000393c96f0,ffff8000393c9640) at sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603
syscall(ffff8000393c96f0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000393c96f0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xd15aeba5c80, count: -17
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff8000393c8c90
rbx                                0
rdx                                0
rcx               0xffff80003afd2028
rax               0xffffffff83883ff0    cpu_info_full_primary+0x1ff0
r8                0xffff8000393c8b70
r9                0x8080808080808080
r10               0x447f9692b4156680
r11               0x3b7856dc0dce4c2e
r12               0xfffffd80040448c0
r13               0xfffffd800482c5f8
r14                              0x3
r15               0xffffffff834b61a6    substchar+0x51b7
rip               0xffffffff82a86d25    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff8000393c8c80
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=518188 pid=71384 tcnt=3 stat=onproc
    flags process=0 proc=4000001<INKTR,THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003afd2d20,0xffff80003afd3cc0
    process=0xffff80003a7ce6a0 user=0xffff8000393c4000, vmspace=0xfffffd806c52a7c0
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 88034  386526  65075      0  2           0                syz-executor
 88034  402050  65075      0  3   0x4000080  fsleep        syz-executor
 85801   17976    719      0  2           0                syz-executor
 85801  210419    719      0  3   0x4000080  fsleep        syz-executor
 29961  340757  55370     -1  3        0x90  nanoslp       syz-executor
 29961  368572  55370     -1  3   0x4000090  lockf         syz-executor
 29961  209485  55370     -1  3   0x4000090  lockf         syz-executor
 29961  134843  55370     -1  3   0x4000090  fsleep        syz-executor
 71384  370400  50375      0  2           0                syz-executor
 71384   78006  50375      0  3   0x4000080  sbwait        syz-executor
*71384  518188  50375      0  7   0x4000001                syz-executor
 21132   11033  84104     -1  2        0x10                syz-executor
 21132   62112  84104     -1  3   0x4000090  fsleep        syz-executor
 59590  118856  25294      0  2           0                syz-executor
 59590  389216  25294      0  3   0x4000080  bpf           syz-executor
 43414   95459  15548      0  2           0                syz-executor
 43414  436502  15548      0  3   0x4000080  fsleep        syz-executor
 25092  396776  70411      0  3        0x80  nanoslp       syz-executor
 25092  167311  70411      0  3   0x4000080  ttyin         syz-executor
 27460  429568      1      0  3        0x82  nanoslp       getty
 15548   38506  10960      0  3        0x82  nanoslp       syz-executor
   719  320187  10960      0  3        0x82  nanoslp       syz-executor
 70411  322056  10960      0  3        0x82  nanoslp       syz-executor
 25294  505621  10960      0  3        0x82  nanoslp       syz-executor
 55370  347110  10960      0  3        0x82  nanoslp       syz-executor
 65075  271837  10960      0  3        0x82  nanoslp       syz-executor
 84104    5561  10960      0  3        0x82  nanoslp       syz-executor
 50375  130462  10960      0  3        0x82  nanoslp       syz-executor
 10960  422696      1      0  3        0x82  kqread        syz-executor
 53330  240142  69796     74  3   0x1100092  bpf           pflogd
 69796  310444      1      0  3        0x80  sbwait        pflogd
 29558   66854      1     73  3   0x1100090  kqread        syslogd
 67235   33731      0      0  3     0x14200  bored         smr
  2008  197189      0      0  2     0x14200                zerothread
  7933  303733      0      0  3     0x14200  aiodoned      aiodoned
  9550  122837      0      0  3     0x14200  syncer        update
 51045  202983      0      0  3     0x14200  cleaner       cleaner
   197  313614      0      0  3     0x14200  reaper        reaper
 72275   68651      0      0  3     0x14200  pgdaemon      pagedaemon
  5838   40198      0      0  3     0x14200  bored         viomb
  9619  443106      0      0  3  0x40014200  acpi0         acpi0
 26607   14139      0      0  7  0x40014200                idle1
 35090  376214      0      0  3     0x14200  bored         softnet1
 69441   79092      0      0  3     0x14200  bored         softnet0
 64458  324071      0      0  3     0x14200  bored         systqmp
 97104  517400      0      0  3     0x14200  bored         systq
 37052   65795      0      0  3     0x14200  tmoslp        softclockmp
 90682  192939      0      0  3  0x40014200  tmoslp        softclock
  5065  222082      0      0  3  0x40014200                idle0
     1  324703      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 71384 (syz-executor) thread 0xffff80003afd2028 (518188)
exclusive kernel_lock &kernel_lock r = 1 (0xffffffff83ab0f80)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  unp_connect+0x28c sys/kern/uipc_usrreq.c:872
#2  uipc_dgram_send+0x163 sys/kern/uipc_usrreq.c:609
#3  sosend+0x804 sys/kern/uipc_socket.c:-1
#4  sendit+0x5a5 sys/kern/uipc_syscalls.c:785
#5  sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
exclusive rwlock sbufsnd r = 0 (0xffff800010fdd970)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  sblock+0xb6 sys/kern/uipc_socket2.c:536
#3  sosend+0x2e9 sys/kern/uipc_socket.c:639
#4  sendit+0x5a5 sys/kern/uipc_syscalls.c:785
#5  sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
ddb{0}>