syzbot


witness: reversal: &cq->cq_mtx &sched_lock

Status: upstream: reported on 2025/04/22 03:22
Reported-by: syzbot+8f5c1beabd11c2de64bb@syzkaller.appspotmail.com
First crash: 243d, last: 22h09m

Sample crash report:
witness: lock order reversal:
 1st 0xffff8000299dee30 &cq->cq_mtx (&cq->cq_mtx)
 2nd 0xffffffff838bc500 &sched_lock (&sched_lock)
lock order [1] &cq->cq_mtx (&cq->cq_mtx) -> [2] &sched_lock (&sched_lock)
#0  mtx_enter+0x95 sys/kern/kern_lock.c:406
#1  sleep_setup+0xed sys/kern/kern_synch.c:304
#2  msleep_nsec+0x10b sys/kern/kern_synch.c:217
#3  dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:589
#4  dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
#4  dtclose+0x109 sys/dev/dt/dt_dev.c:239
#5  spec_close+0x466 sys/kern/spec_vnops.c:-1
#6  VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
#7  vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
#7  vn_closefile+0x12b sys/kern/vfs_vnops.c:615
#8  fdrop+0x121 sys/kern/kern_descrip.c:1280
#9  closef+0x192 sys/kern/kern_descrip.c:1264
#10 fdfree+0x116 sys/kern/kern_descrip.c:1195
#11 exit1+0x576 sys/kern/kern_exit.c:215
#12 sys_exit+0x1a sys/kern/kern_exit.c:-1
#13 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
#14 Xsyscall+0x128
lock order [2] &sched_lock (&sched_lock) -> [1] &cq->cq_mtx (&cq->cq_mtx)
#0  mtx_enter+0x95 sys/kern/kern_lock.c:406
#1  clockintr_cancel+0x2f sys/kern/kern_clockintr.c:323
#2  mi_switch+0x187 sys/kern/sched_bsd.c:376
#3  sleep_finish+0x2d8 sys/kern/kern_synch.c:369
#4  sys_futex+0xb90 futex_wait sys/kern/sys_futex.c:306 [inline]
#4  sys_futex+0xb90 sys/kern/sys_futex.c:155
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:775
#6  Xsyscall+0x128
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff838bc500,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
mtx_enter(ffffffff838bc4f0) at mtx_enter+0x95 sys/kern/kern_lock.c:406
sleep_setup(ffff8000299dee80,220,ffffffff83434b95) at sleep_setup+0xed sys/kern/kern_synch.c:304
msleep_nsec(ffff8000299dee80,ffff8000299dee20,220,ffffffff83434b95,ffffffffffffffff) at msleep_nsec+0x10b sys/kern/kern_synch.c:217
dt_ioctl_record_stop(ffff800001583000) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:589
dtclose(11e5f,81,2000,ffff80002a27a7e0) at dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,81,2000,ffff80002a27a7e0) at dtclose+0x109 sys/dev/dt/dt_dev.c:239
spec_close(ffff80002f001d60) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd800bf902b8,81,fffffd80097fd340,ffff80002a27a7e0) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffd805fe4a808,ffff80002a27a7e0) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd805fe4a808,ffff80002a27a7e0) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd805fe4a808,ffff80002a27a7e0) at fdrop+0x121 sys/kern/kern_descrip.c:1280
closef(fffffd805fe4a808,ffff80002a27a7e0) at closef+0x192 sys/kern/kern_descrip.c:1264
fdfree(ffff80002a27a7e0) at fdfree+0x116 sys/kern/kern_descrip.c:1195
exit1(ffff80002a27a7e0,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff80002a27a7e0,ffff80002f0020d0,ffff80002f002020) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002f0020d0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002f0020d0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74e6ef410aa0, count: -17
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff80002f001a30
rbx                                0
rdx                                0
rcx               0xffff80002a27a7e0
rax               0xffffffff83835ff0    cpu_info_full_primary+0x1ff0
r8                0xffff80002f001910
r9                0x8080808080808080
r10               0xcef596630166d1c8
r11               0xae419cb84e830364
r12               0xfffffd8003f4be40
r13               0xfffffd80046f6330
r14                              0x3
r15               0xffffffff834251a8    substchar+0xf681
rip               0xffffffff811c7635    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002f001a20
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=330238 pid=3582 tcnt=0 stat=onproc
    flags process=1018<EXITING,SUGID,SINGLEEXIT> proc=2000<WEXIT>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff80002a27a7e0 scnt=-1 ecnt=1
    forw=0xffffffffffffffff, list=0xffff80002a27b240,0xffffffff8393d1a8
    process=0xffff80003bbdc4f0 user=0xffff80002effd000, vmspace=0xfffffd806ec52010
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 24542  130856  71918      0  2    0x100002                ndp
 71918  262390  89805      0  3    0x10008a  sigsusp       sh
 74933  492755  84638      0  3        0x80  nanoslp       syz-executor
 74933  473468  84638      0  3   0x4000080  ttyin         syz-executor
 74933  111296  84638      0  3   0x4000080  fsleep        syz-executor
 85837    8225  97231      0  3        0x80  nanoslp       syz-executor
 85837  175784  97231      0  3   0x4000080  ttyout        syz-executor
 85837  288444  97231      0  3   0x4000080  fsleep        syz-executor
 85837   70913  97231      0  3   0x4000080  fsleep        syz-executor
 55782  104746  97483      0  2           0                syz-executor
 55782  508513  97483      0  3   0x4000080  fsleep        syz-executor
 55782  215632  97483      0  3   0x4000080  fsleep        syz-executor
 55782  200340  97483      0  3   0x4000080  fsleep        syz-executor
 55782   86846  97483      0  3   0x4000080  fsleep        syz-executor
 69652  230315  55728      0  3      0x3000  suspend       syz-executor
 69652  298835  55728      0  3   0x4081000  biowait       syz-executor
 69652  274446  55728      0  3   0x4081000  inode         syz-executor
 89805  474545  29434      0  3        0x82  wait          syz-executor
 51817  491489      1      0  3    0x100083  ttyin         getty
 84638   33620  29434      0  3        0x82  nanoslp       syz-executor
 97483  361565  29434      0  3        0x82  nanoslp       syz-executor
 12662  323827  29434      0  3        0x82  nanoslp       syz-executor
 50140  501378  29434      0  3        0x82  nanoslp       syz-executor
 55728  407792  29434      0  2         0x2                syz-executor
 57368  235935  29434      0  3        0x82  piperd        syz-executor
 62449  266177  88441      0  3    0x100082  sbwait        arp
 88441  292225      1      0  3    0x10008a  sigsusp       sh
 97231  479943  29434      0  3        0x82  nanoslp       syz-executor
 29434  149693  16809      0  2         0x2                syz-executor
 16809  399825  74338      0  3    0x10008a  sigsusp       ksh
 74338  389235  22354      0  3        0x98  kqread        sshd-session
 22354   24917  31693      0  3        0x92  kqread        sshd-session
 31693  221351      1      0  3        0x88  kqread        sshd
 27079  521614  78620     74  3   0x1100092  bpf           pflogd
 78620  263050      1      0  3        0x80  sbwait        pflogd
 85529  160742  98353     73  3   0x1100090  kqread        syslogd
 98353  179401      1      0  3    0x100082  sbwait        syslogd
 97888  242856      1      0  3    0x100080  kqread        resolvd
 46528  205968  39587     77  3    0x100092  kqread        dhcpleased
  3721  139886  39587     77  3    0x100092  kqread        dhcpleased
 39587  320780      1      0  3        0x80  kqread        dhcpleased
 32363  287293      0      0  3     0x14200  bored         smr
 19087  341557      0      0  2     0x14200                zerothread
  9529  207079      0      0  3     0x14200  aiodoned      aiodoned
 94388  375665      0      0  3     0x14200  syncer        update
 13798  457930      0      0  3     0x14200  cleaner       cleaner
 46951  216169      0      0  3     0x14200  reaper        reaper
 60858   94700      0      0  3     0x14200  pgdaemon      pagedaemon
 18878  365417      0      0  3     0x14200  bored         viomb
  8357  305802      0      0  3  0x40014200  acpi0         acpi0
 22522  272492      0      0  7  0x40014200                idle1
  6614  213642      0      0  3     0x14200  bored         softnet1
 88482  354180      0      0  3     0x14200  bored         softnet0
  9611   66740      0      0  3     0x14200  smrbar        systqmp
 54313  493074      0      0  3     0x14200  bored         systq
 64792  494256      0      0  3     0x14200  tmoslp        softclockmp
 59457  429182      0      0  3  0x40014200  tmoslp        softclock
 30938  256415      0      0  3  0x40014200                idle0
     1  523773      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex &cq->cq_mtx r = 0 (0xffff8000299dee30)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter+0x4b4 sys/kern/kern_lock.c:487
#2  clockintr_unbind+0x56 sys/kern/kern_clockintr.c:375
#3  dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:589
#4  dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
#4  dtclose+0x109 sys/dev/dt/dt_dev.c:239
#5  spec_close+0x466 sys/kern/spec_vnops.c:-1
#6  VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
#7  vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
#7  vn_closefile+0x12b sys/kern/vfs_vnops.c:615
#8  fdrop+0x121 sys/kern/kern_descrip.c:1280
#9  closef+0x192 sys/kern/kern_descrip.c:1264
#10 fdfree+0x116 sys/kern/kern_descrip.c:1195
#11 exit1+0x576 sys/kern/kern_exit.c:215
#12 sys_exit+0x1a sys/kern/kern_exit.c:-1
#13 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
#14 Xsyscall+0x128
Process 69652 (syz-executor) thread 0xffff80002a27ad10 (298835)
exclusive rrwlock inode r = 0 (0xfffffd80704de7b8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vn_write+0x18f sys/kern/vfs_vnops.c:405
#6  dofilewritev+0x242 sys/kern/sys_generic.c:380
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:775
#9  Xsyscall+0x128
Process 9611 (systqmp) thread 0xffff8000ffffe298 (66740)
shared rwlock systqmp r = 0 (0xffffffff837efed8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10252  11076K   12621K 166960K     18371        0
            pcb    17     16K      17K 166960K       790        0
         rtable   275     14K      15K 166960K      1439        0
             pf    43     19K      83K 166960K       515        0
         ifaddr    44      9K       9K 166960K       306        0
        ifgroup    59      2K       3K 166960K       535        0
         sysctl     4      1K       9K 166960K        41        0
       counters    76     37K      38K 166960K       538        0
       ioctlops     0      0K       4K 166960K      2314        0
            iov     0      0K      24K 166960K       224        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1593    100K     100K 166960K      5535        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K      13K 166960K        50        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       184        0
        dirhash    12      2K       2K 166960K        54        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    22    187K     244K 166960K      3669        0
          sigio     0      0K       0K 166960K        57        0
           proc    73    115K     164K 166960K      1506        0
        subproc    81      5K       5K 166960K       273        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       354        0
       in_multi    87      6K       7K 166960K       452        0
    ether_multi     1      0K       0K 166960K        27        0
            mrt     2      0K       0K 166960K        38        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   229   1023K    1023K 166960K       229        0
           exec     0      0K       1K 166960K      1088        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K        16        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   266    171K     192K 166960K     33519        0
       UVM aobj    66     94K      94K 166960K        72        0
     pinsyscall    47     94K     110K 166960K      5379        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       226        0
            NDP    16      0K       1K 166960K       224        0
           temp    89   8680K    8792K 166960K    157914        0
         kqueue    13     20K      30K 166960K       597        0
      SYN cache     2      8K      16K 166960K         3        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      450    0      445     5     4     1     3     0     8    0
rtentry    176      446    0      341     5     0     5     5     0     8    0
unpcb      144     3003    0     2984    28    27     1     6     0     8    0
syncache   336       20    0       20     6     6     0     1     0     8    0
tcpqe       32        6    0        6     5     5     0     1     0     8    0
tcpcb      736     1417    0     1409    35    33     2     7     0     8    0
arp        136       80    0       53     1     0     1     1     0     8    0
ipq         40        1    0        1     1     1     0     1     0     8    0
ipqe        40        3    0        3     1     1     0     1     0     8    0
inpcb      328     4653    0     4642    39    37     2    12     0     8    0
nd6        152       93    0       72     2     0     2     2     0     8    0
pkpcb       40       37    0       37     4     3     1     1     0     8    1
kcovpl      48       30    0       21     1     0     1     1     0     8    0
mppekey    1024       5    0        5     4     4     0     1     0     8    0
ppxss      1192     161    0      158     1     0     1     1     0     8    0
pppxif     1504      32    0       32     8     8     0     1     0     8    0
pfstscr     40        6    0        6     3     3     0     1     0     8    0
pffrag     232       30    0       17     1     0     1     1     0   482    0
pffrnode    88       23    0       12     1     0     1     1     0     8    0
pffrent     40      187    0      174     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344      27    0       27     6     6     0     1     0     8    0
pfanchor   1288      14    0        7     1     0     1     1     0     8    0
pftag       88        2    0        1     2     1     1     1     0     8    0
pfstitem    24      216    0      138     1     0     1     1     0     8    0
pfstkey    128      223    0      143     3     0     3     3     0     8    0
pfstate    448      218    0      141    10     0    10    10     0     8    0
pfrule     1344      39    0       33     2     1     1     2     0     8    0
rttmr      136       10    0       10     6     5     1     1     0     8    1
art_heap8  4096       4    0        0     4     0     4     4     0     8    0
art_heap4  256     1870    0     1398    48    18    30    32     0     8    0
art_table   40     1874    0     1398     7     2     5     6     0     8    0
art_node    32      444    0      350     1     0     1     1     0     8    0
sysvmsgpl   40       12    0       10     4     3     1     1     0     8    0
semupl     112        2    0        2     2     2     0     1     0     8    0
semapl     112      181    0      171     1     0     1     1     0     8    0
shmpl      112       18    0        0     1     0     1     1     0     8    0
dirhash    1024      45    0       28     3     0     3     3     0     8    0
dino2pl    256     7954    0     6407    97     0    97    97     0     8    0
ffsino     296     7954    0     6407   120     0   120   120     0     8    0
nchpl      144    12674    0    10898    66     0    66    66     0     8    0
rtmask      32       45    0       44     6     5     1     1     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   47524    0    47524     6     5     1     2     0     8    1
percpumem   16      284    0      231     1     0     1     1     0     8    0
vcpupl     3968      47    0        2     6     0     6     6     0     8    0
vmpool     848       51    0        6     5     0     5     5     0     8    0
pfiaddrpl  120        1    0        1     1     1     0     1     0     8    0
kstatmem   264      322    0      290     5     2     3     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72       13    0       13     7     7     0     1     0     8    0
scxspl     216    62390    0    62389    15    14     1     8     1     8    0
plimitpl   152      908    0      886     1     0     1     1     0     8    0
sigapl     424     3900    0     3850     8     1     7     7     0     8    0
knotepl    120      777    0        0    22     0    22    22     0     8    0
kqueuepl   224     1238    0     1229    11    10     1     5     0     8    0
pipepl     344      802    0      772    21    17     4     9     0     8    0
fdescpl    528     3869    0     3835     3     0     3     3     0     8    0
filepl     160    29203    0    28961    53    38    15    25     0     8    0
lockfpl    104     1507    0     1503     3     2     1     2     0     8    0
lockfspl    48      549    0      546     1     0     1     1     0     8    0
sessionpl  144       62    0       53     1     0     1     1     0     8    0
pgrppl      48      124    0      106     1     0     1     1     0     8    0
ucredpl    104     4560    0     4546     1     0     1     1     0     8    0
zombiepl   144     3853    0     3850     1     0     1     1     0     8    0
processpl  1232    3900    0     3850     5     0     5     5     0     8    0
procpl     664     9285    0     9224     6     0     6     6     0     8    0
sosppl     176       19    0       19     5     4     1     1     0     8    1
sockpl     752     8240    0     8205    74    69     5    18     0     8    0
mcl64k     65536     12    0        0     2     0     2     2     0     8    0
mcl16k     16384      6    0        0     1     0     1     1     0     8    0
mcl12k     12288      3    0        0     1     0     1     1     0     8    0
mcl9k      9216       3    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     120    0        0    15     0    15    15     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      93    0        0     7     0     7     7     0     8    0
mtagpl      96      173    0        0     4     0     4     4     0     8    0
mbufpl     256     1351    0        0    78     0    78    78     0     8    0
bufpl      280    23145    0    17009   439     0   439   439     0     8    0
anonpl      32    11552    0        0    93     0    93    93     0   246    0
amapchunkpl 152  114656    0   114133    57    30    27    31     0   158    4
amappl16   200    11924    0    11712    74    62    12    27     0     8    0
amappl15   192        7    0        7     2     2     0     1     0     8    0
amappl14   184        9    0        8     1     0     1     1     0     8    0
amappl13   176      687    0      683     1     0     1     1     0     8    0
amappl12   168     4404    0     4358     3     0     3     3     0     8    0
amappl11   160        6    0        6     1     1     0     1     0     8    0
amappl10   152       50    0       35     1     0     1     1     0     8    0
amappl9    144      249    0      249     1     1     0     1     0     8    0
amappl8    136       31    0       28     1     0     1     1     0     8    0
amappl7    128      167    0      166     1     0     1     1     0     8    0
amappl6    120      559    0      541     1     0     1     1     0     8    0
amappl5    112       91    0       80     1     0     1     1     0     8    0
amappl4    104      622    0      589     1     0     1     1     0     8    0
amappl3     96    23571    0    23454     6     2     4     4     0     8    0
amappl2     88      864    0      798     2     0     2     2     0     8    0
amappl1     80    28646    0    28002    15     0    15    15     0     8    0
amappl      88    31803    0    31626     5     0     5     5     0    92    0
uvmvnodes   80      213    0        0     5     0     5     5     0     8    0
dma16384   16384      1    0        1     1     1     0     1     0     8    0
dma8192    8192       1    0        1     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      254    0      254     2     2     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       71    0        6     2     0     2     2     0     8    0
uaddrrnd    24     3869    0     3835     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3869    0     3835     1     0     1     1     0     8    0
vmmpekpl   168    30427    0    30352     4     0     4     4     0     8    0
vmmpepl    168   249596    0   247360   146    46   100   112     0   357    0
vmsppl     488     3868    0     3835     5     0     5     5     0     8    0
rwobjpl     80    64676    0    63187    41     7    34    36     0     8    0
pdppl      4096    7847    0     7727   195    73   122   124     0     8    2
pvpl        32    21156    0        0   171     1   170   170     0   265    0
pmappl     256     3919    0     3841     5     0     5     5     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      522    0      143    11     0    11    11     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff838bc500,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
mtx_enter(ffffffff838bc4f0) at mtx_enter+0x95 sys/kern/kern_lock.c:406
sleep_setup(ffff8000299dee80,220,ffffffff83434b95) at sleep_setup+0xed sys/kern/kern_synch.c:304
msleep_nsec(ffff8000299dee80,ffff8000299dee20,220,ffffffff83434b95,ffffffffffffffff) at msleep_nsec+0x10b sys/kern/kern_synch.c:217
dt_ioctl_record_stop(ffff800001583000) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:589
dtclose(11e5f,81,2000,ffff80002a27a7e0) at dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,81,2000,ffff80002a27a7e0) at dtclose+0x109 sys/dev/dt/dt_dev.c:239
spec_close(ffff80002f001d60) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd800bf902b8,81,fffffd80097fd340,ffff80002a27a7e0) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffd805fe4a808,ffff80002a27a7e0) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd805fe4a808,ffff80002a27a7e0) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd805fe4a808,ffff80002a27a7e0) at fdrop+0x121 sys/kern/kern_descrip.c:1280
closef(fffffd805fe4a808,ffff80002a27a7e0) at closef+0x192 sys/kern/kern_descrip.c:1264
fdfree(ffff80002a27a7e0) at fdfree+0x116 sys/kern/kern_descrip.c:1195
exit1(ffff80002a27a7e0,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff80002a27a7e0,ffff80002f0020d0,ffff80002f002020) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80002f0020d0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002f0020d0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x74e6ef410aa0, count: -17
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
mtx_enter(ffff8000299dee20) at mtx_enter+0x37b sys/kern/kern_lock.c:454
clockintr_dispatch(ffff80002a21ccb0) at clockintr_dispatch+0x401 sys/kern/kern_clockintr.c:215
lapic_clockintr(0,0) at lapic_clockintr+0x51 sys/arch/amd64/amd64/lapic.c:482
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff8000299ddff0) at sched_idle+0x391 sys/kern/kern_sched.c:191
end trace frame: 0x0, count: -9

Crashes (56):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/21 00:59 openbsd df8f251ef5f9 e14dbeb9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/19 02:16 openbsd 3f23c8878a83 e14dbeb9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/18 04:44 openbsd 10e7775f0707 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/17 19:59 openbsd 9c2b8e445a0b a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/17 09:10 openbsd 3a6d4b98bde9 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/17 07:31 openbsd 3a6d4b98bde9 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/17 05:16 openbsd 3a6d4b98bde9 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/17 02:14 openbsd 3a6d4b98bde9 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/15 13:02 openbsd 2c50c5af38ad a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/15 04:04 openbsd b46de5080dd7 a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/14 19:12 openbsd e294fe4a4b1d a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/09 06:40 openbsd bf8f637750de fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/12/09 03:25 openbsd bf8f637750de fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/11/12 22:56 openbsd 30ee307006ea 07e030de .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/11/10 14:02 openbsd 129ed0dedc2e 4e1406b4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/11/10 12:16 openbsd 129ed0dedc2e 4e1406b4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/10/04 10:03 openbsd 467d022937bc 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/10/03 03:41 openbsd 7cf39aff0fc8 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/09/25 07:18 openbsd a25aeda82389 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/09/24 01:47 openbsd d4a733e3e951 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/09/23 23:23 openbsd d4a733e3e951 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/09/22 03:06 openbsd 623648cde278 67c37560 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/09/13 12:39 openbsd 597bb1fc1f2a e2beed91 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/09/01 23:40 openbsd 813b141997c4 807a3b61 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/21 07:08 openbsd 70b219c460a6 0b9605c8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/19 04:09 openbsd b981b677995a 523f460e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/17 08:14 openbsd fd78d8b282be 1804e95e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/12 17:00 openbsd ca8bfee27b33 22ec1469 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/10 02:10 openbsd 6d30732ef287 32a0e5ed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/09 17:16 openbsd 86b9fcdd2575 32a0e5ed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/08 19:19 openbsd 297fbc8e674e 32a0e5ed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/07 10:59 openbsd 01075e58a8ba 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/07 00:00 openbsd 21888800dc4e 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/02 16:00 openbsd d2170a9a220c 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/08/01 12:47 openbsd 3b565b651350 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/29 22:00 openbsd b403f214b97b 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/25 12:18 openbsd 55a498f41818 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/22 03:47 openbsd 522fe508dc11 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/12 20:27 openbsd 2fd78fb00a47 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/11 17:50 openbsd 904c37accb58 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/06 19:00 openbsd 1a059e88663d 4f67c4ae .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/06 00:31 openbsd 0168633b2ab2 4f67c4ae .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/30 00:27 openbsd b4d1cb14c459 fc9d8ee5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/23 15:56 openbsd bfd2b5c81cd0 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/21 02:58 openbsd f62159b6a996 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/20 03:26 openbsd c7ecc8a6a85e ed3e87f7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/15 19:21 openbsd 1a751a5f99c1 5f4b362d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/08 08:16 openbsd 44b12aca1c11 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/01 13:48 openbsd ae460101462c 3d2f584d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/27 16:45 openbsd 34392d87e208 874a1386 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/20 01:47 openbsd 03d4002980cf b84f0537 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/19 17:25 openbsd 2fc058fc36e6 27f68995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/18 13:54 openbsd 6decc3d5f4d6 f41472b0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/09 20:18 openbsd 0dc0a232ede0 77908e5f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/04/22 03:22 openbsd e8eeea37c7e6 552876f8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
* Struck through repros no longer work on HEAD.