syzbot


witness: reversal: &cq->cq_mtx &sched_lock

Status: upstream: reported on 2025/04/22 03:22
Reported-by: syzbot+8f5c1beabd11c2de64bb@syzkaller.appspotmail.com
First crash: 87d, last: 5d16h

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff83894e00 &cq->cq_mtx (&cq->cq_mtx)
 2nd 0xffffffff839c3010 &sched_lock (&sched_lock)
lock order [1] &cq->cq_mtx (&cq->cq_mtx) -> [2] &sched_lock (&sched_lock)
#0  mtx_enter+0x4a sys/kern/kern_lock.c:260
#1  sleep_setup+0xc6 sys/kern/kern_synch.c:302
#2  msleep_nsec+0x119 sys/kern/kern_synch.c:217
#3  dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:576
#4  dtclose+0x105 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
#4  dtclose+0x105 sys/dev/dt/dt_dev.c:232
#5  spec_close+0x45f sys/kern/spec_vnops.c:-1
#6  VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
#7  vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
#7  vn_closefile+0x12b sys/kern/vfs_vnops.c:615
#8  fdrop+0x126 sys/kern/kern_descrip.c:1267
#9  closef+0x192 sys/kern/kern_descrip.c:1251
#10 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
#11 Xsyscall+0x128
lock order [2] &sched_lock (&sched_lock) -> [1] &cq->cq_mtx (&cq->cq_mtx)
#0  mtx_enter+0x4a sys/kern/kern_lock.c:260
#1  clockintr_cancel+0x2f sys/kern/kern_clockintr.c:323
#2  mi_switch+0x172 x86_atomic_clearbits_u32 machine/atomic.h:-1 [inline]
#2  mi_switch+0x172 sys/kern/sched_bsd.c:374
#3  ast+0x165 mi_ast sys/sys/syscall_mi.h:252 [inline]
#3  ast+0x165 sys/arch/amd64/amd64/trap.c:712
#4  intr_user_exit+0x3c
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff839c3010,9,0) at witness_checkorder+0x10fb sys/kern/subr_witness.c:-1
mtx_enter(ffffffff839c3000) at mtx_enter+0x4a sys/kern/kern_lock.c:260
sleep_setup(ffffffff83894e50,220,ffffffff833aeb55) at sleep_setup+0xc6 sys/kern/kern_synch.c:302
msleep_nsec(ffffffff83894e50,ffffffff83894df0,220,ffffffff833aeb55,ffffffffffffffff) at msleep_nsec+0x119 sys/kern/kern_synch.c:217
dt_ioctl_record_stop(ffff8000014a7000) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:576
dtclose(11e5f,81,2000,ffff80003c43aa68) at dtclose+0x105 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,81,2000,ffff80003c43aa68) at dtclose+0x105 sys/dev/dt/dt_dev.c:232
spec_close(ffff80003c4473a0) at spec_close+0x45f sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd807108c6d8,81,fffffd80097fb548,ffff80003c43aa68) at VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
vn_closefile(fffffd8064d9f590,ffff80003c43aa68) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd8064d9f590,ffff80003c43aa68) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd8064d9f590,ffff80003c43aa68) at fdrop+0x126 sys/kern/kern_descrip.c:1267
closef(fffffd8064d9f590,ffff80003c43aa68) at closef+0x192 sys/kern/kern_descrip.c:1251
syscall(ffff80003c447600) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c447600) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xbdb44c95ec0, count: -14
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff80003c4470a0
rbx               0xfffffd800474dc48
rdx                                0
rcx               0xffff80003c43aa68
rax               0xffff8000299ddff0
r8                0xffff80003c446f80
r9                0x8080808080808080
r10               0x566e23b127aff31b
r11               0xf25813ca1d21a565
r12                                0
r13               0xfffffd8003f5d300
r14                              0x3
r15                       0xffffffff
rip               0xffffffff81fadfc5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c447090
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=82567 pid=25959 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c43a548,0xffff80003c43b9d8
    process=0xffff8000fffe9380 user=0xffff80003c442000, vmspace=0xfffffd800b027780
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  7371  293586  20072      0  7           0                syz-executor
  7371    7374  20072      0  2   0x4000000                syz-executor
 25959  459815  76892      0  2           0                syz-executor
 25959  263915  76892      0  2   0x4000000                syz-executor
*25959   82567  76892      0  7   0x4000000                syz-executor
 84036   21357  36650      0  2           0                syz-executor
 84036  460631  36650      0  3   0x4000080  fsleep        syz-executor
 51347  306842   9968      0  2           0                syz-executor
 51347   29448   9968      0  3   0x4000080  fsleep        syz-executor
 64890   52820  17901      0  2           0                syz-executor
 64890   80552  17901      0  3   0x4000000  biowait       syz-executor
 64890  253129  17901      0  3   0x4000000  inode         syz-executor
 64890  302552  17901      0  3   0x4000080  fsleep        syz-executor
 56276  335341  93258      0  2         0x2                syz-executor
 91055  104532      1      0  3    0x100083  ttyin         getty
 36650  118523  93258      0  3        0x82  nanoslp       syz-executor
  9968  254722  93258      0  3        0x82  nanoslp       syz-executor
 99812   12801      0      0  3     0x14200  acct          acct
 29131   37432  93258      0  3        0x82  wait          syz-executor
 27480  400070      0      0  3     0x14280  nfsidl        nfsio
 10833  213813      0      0  3     0x14280  nfsidl        nfsio
 21464  138364      0      0  3     0x14280  nfsidl        nfsio
 62718  499267      0      0  3     0x14280  nfsidl        nfsio
 20788   99031      0      0  3     0x14280  nfsidl        nfsio
 59300  440680      0      0  3     0x14280  nfsidl        nfsio
 86376  134929      0      0  3     0x14280  nfsidl        nfsio
 89803  254282      0      0  3     0x14280  nfsidl        nfsio
 68826  323969      0      0  3     0x14280  nfsidl        nfsio
 91585  345293      0      0  3     0x14280  nfsidl        nfsio
 21466  445913      0      0  3     0x14280  nfsidl        nfsio
 53840  480609      0      0  3     0x14280  nfsidl        nfsio
 57011  253780      0      0  3     0x14280  nfsidl        nfsio
 60941  241918      0      0  3     0x14280  nfsidl        nfsio
 92348  491472      0      0  3     0x14280  nfsidl        nfsio
 74756  420479      0      0  3     0x14280  nfsidl        nfsio
 97880  268241      0      0  3     0x14280  nfsidl        nfsio
 29965  472774      0      0  3     0x14280  nfsidl        nfsio
 55026  357312      0      0  3     0x14280  nfsidl        nfsio
 56932  266171      0      0  3     0x14280  nfsidl        nfsio
 60967  315213      0      0  3     0x14200  bored         sosplice
 70035  460395  93258      0  2         0x2                syz-executor
 20072  106721  93258      0  3        0x82  nanoslp       syz-executor
 76892  115718  93258      0  3        0x82  nanoslp       syz-executor
 17901  219100  93258      0  3        0x82  nanoslp       syz-executor
 93258   42824  71172      0  3        0x82  kqread        syz-executor
 71172  494683  93361      0  3    0x10008a  sigsusp       ksh
 93361  376675  12596      0  3        0x98  kqread        sshd-session
 12596  352421  61947      0  3        0x92  kqread        sshd-session
 61947  238601      1      0  3        0x88  kqread        sshd
 80627  344141  94321     74  3   0x1100092  bpf           pflogd
 94321  410764      1      0  3        0x80  sbwait        pflogd
 37655  461828   4085     73  3   0x1100090  kqread        syslogd
  4085  151583      1      0  3    0x100082  sbwait        syslogd
 89439  353776      1      0  3    0x100080  kqread        resolvd
 27034  357873  77296     77  3    0x100092  kqread        dhcpleased
 62047  433843  77296     77  3    0x100092  kqread        dhcpleased
 77296  348379      1      0  3        0x80  kqread        dhcpleased
 52195  253213      0      0  3     0x14200  bored         smr
 49772  107834      0      0  2     0x14200                zerothread
 77688  226120      0      0  3     0x14200  aiodoned      aiodoned
 13562  378521      0      0  3     0x14200  syncer        update
 62349  438981      0      0  3     0x14200  cleaner       cleaner
 48005  186589      0      0  3     0x14200  reaper        reaper
 36336  519509      0      0  3     0x14200  pgdaemon      pagedaemon
 32035  433206      0      0  3     0x14200  bored         viomb
 67376  406142      0      0  3  0x40014200  acpi0         acpi0
 72194  251708      0      0  3  0x40014200                idle1
   886   93685      0      0  3     0x14200  bored         softnet3
 32974  172664      0      0  3     0x14200  bored         softnet2
 70313   37928      0      0  3     0x14200  bored         softnet1
 71516  375272      0      0  3     0x14200  bored         softnet0
 46481  320586      0      0  3     0x14200  bored         systqmp
 44898   20319      0      0  3     0x14200  bored         systq
 37601  210986      0      0  3     0x14200  tmoslp        softclockmp
  4985  102585      0      0  3  0x40014200  tmoslp        softclock
 46343  234161      0      0  3  0x40014200                idle0
     1  288276      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
CPU 1:
exclusive mutex &cq->cq_mtx r = 0 (0xffffffff83894e00)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  mtx_enter_try+0x1ad sys/kern/kern_lock.c:311
#2  mtx_enter+0x13b sys/kern/kern_lock.c:261
#3  clockintr_unbind+0x56 sys/kern/kern_clockintr.c:375
#4  dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:576
#5  dtclose+0x105 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
#5  dtclose+0x105 sys/dev/dt/dt_dev.c:232
#6  spec_close+0x45f sys/kern/spec_vnops.c:-1
#7  VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
#8  vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
#8  vn_closefile+0x12b sys/kern/vfs_vnops.c:615
#9  fdrop+0x126 sys/kern/kern_descrip.c:1267
#10 closef+0x192 sys/kern/kern_descrip.c:1251
#11 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
#12 Xsyscall+0x128
Process 25959 (syz-executor) thread 0xffff80003c43aa68 (82567)
exclusive rwlock dtlk r = 0 (0xffffffff837f3fe8)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  dt_ioctl_record_stop+0x68 sys/dev/dt/dt_dev.c:-1
#3  dtclose+0x105 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
#3  dtclose+0x105 sys/dev/dt/dt_dev.c:232
#4  spec_close+0x45f sys/kern/spec_vnops.c:-1
#5  VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
#6  vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
#6  vn_closefile+0x12b sys/kern/vfs_vnops.c:615
#7  fdrop+0x126 sys/kern/kern_descrip.c:1267
#8  closef+0x192 sys/kern/kern_descrip.c:1251
#9  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#9  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
#10 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83940f90)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  vn_closefile+0x41 sys/kern/vfs_vnops.c:608
#2  fdrop+0x126 sys/kern/kern_descrip.c:1267
#3  closef+0x192 sys/kern/kern_descrip.c:1251
#4  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
#5  Xsyscall+0x128
exclusive mutex &cq->cq_mtx r = 0 (0xffffffff83894e00)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  mtx_enter_try+0x1ad sys/kern/kern_lock.c:311
#2  mtx_enter+0x13b sys/kern/kern_lock.c:261
#3  clockintr_unbind+0x56 sys/kern/kern_clockintr.c:375
#4  dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:576
#5  dtclose+0x105 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
#5  dtclose+0x105 sys/dev/dt/dt_dev.c:232
#6  spec_close+0x45f sys/kern/spec_vnops.c:-1
#7  VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
#8  vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
#8  vn_closefile+0x12b sys/kern/vfs_vnops.c:615
#9  fdrop+0x126 sys/kern/kern_descrip.c:1267
#10 closef+0x192 sys/kern/kern_descrip.c:1251
#11 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
#12 Xsyscall+0x128
Process 64890 (syz-executor) thread 0xffff80003c42a2c8 (80552)
exclusive rrwlock inode r = 0 (0xfffffd806c95a680)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vn_write+0x190 sys/kern/vfs_vnops.c:405
#6  dofilewritev+0x23c sys/kern/sys_generic.c:380
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
#9  Xsyscall+0x128
Process 64890 (syz-executor) thread 0xffff80003c43af88 (253129)
exclusive rrwlock inode r = 0 (0xfffffd806e2e1bf0)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x377 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:605
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  vn_open+0x1f4 sys/kern/vfs_vnops.c:107
#8  doopenat+0x32e sys/kern/vfs_syscalls.c:1137
#9  syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#9  syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
#10 Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10264  11209K   11529K 166960K     15329        0
            pcb    17     16K      18K 166960K       455        0
         rtable   250     12K      12K 166960K       782        0
             pf    42     18K   67486K 166960K       218        0
         ifaddr    44      8K       8K 166960K       159        0
        ifgroup    68      2K       2K 166960K       283        0
         sysctl     4      1K       9K 166960K        23        0
       counters    74     37K      38K 166960K       286        0
       ioctlops     0      0K       4K 166960K      1930        0
            iov     0      0K      28K 166960K       201        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1397     88K      88K 166960K      3224        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K      13K 166960K        38        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       116        0
        dirhash    12      2K       3K 166960K        72        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      93K 166960K      2072        0
          sigio     0      0K       0K 166960K        33        0
           proc    72     91K     128K 166960K       953        0
        subproc    72      4K       4K 166960K       126        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     1      0K       0K 166960K       369        0
       in_multi    84      6K       7K 166960K       236        0
    ether_multi     1      0K       0K 166960K        12        0
            mrt     1      0K       0K 166960K        17        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   253   1129K    1129K 166960K       253        0
           exec     0      0K       1K 166960K       872        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         7        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   256    173K     185K 166960K     20709        0
       UVM aobj   131      4K       4K 166960K       132        0
     pinsyscall    42     84K     103K 166960K      3402        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K       105        0
            NDP    15      0K       2K 166960K       112        0
           temp    75   8684K    8809K 166960K    107236        0
         kqueue    15     24K      30K 166960K       391        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      229    0      225     3     2     1     3     0     8    0
rtentry    176      239    0      141     5     0     5     5     0     8    0
unpcb      144     1154    0     1137     7     3     4     4     0     8    3
syncache   336       12    0       12     4     3     1     1     0     8    1
tcpqe       32        4    0        4     3     2     1     1     0     8    1
tcpcb      736      561    0      553    15    13     2     7     0     8    1
arp        128       39    0       22     1     0     1     1     0     8    0
inpcb      328     1943    0     1931    26    19     7    12     0     8    5
nd6        144       50    0       27     1     0     1     1     0     8    0
pkpcb       40       28    0       28     2     1     1     1     0     8    1
kcovpl      48       14    0        6     1     0     1     1     0     8    0
mppekey    1024       3    0        3     1     1     0     1     0     8    0
ppxss      1192      78    0       78     1     0     1     1     0     8    1
pppxif     1504      13    0       13     3     2     1     1     0     8    1
pffrag     232       17    0        8     1     0     1     1     0   482    0
pffrnode    88       16    0        8     1     0     1     1     0     8    0
pffrent     40       30    0       21     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       26    0       16     1     0     1     1     0     8    0
pfstkey    128       26    0       16     1     0     1     1     0     8    0
pfstate    384       26    0       16     3     1     2     3     0     8    0
pfrule     1344      26    0       19     2     1     1     2     0     8    0
rttmr      136        6    0        6     3     2     1     1     0     8    1
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      948    0      530    36     9    27    29     0     8    0
art_table   40      951    0      530     5     0     5     5     0     8    0
art_node    32      238    0      154     1     0     1     1     0     8    0
sysvmsgpl   40       13    0       10     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      113    0      103     1     0     1     1     0     8    0
shmpl      112      129    0        1     4     0     4     4     0     8    0
dirhash    1024      57    0       40     3     0     3     3     0     8    0
dino2pl    256     5223    0     3703    96     0    96    96     0     8    0
ffsino     288     5223    0     3703   109     0   109   109     0     8    0
nchpl      144     8020    0     6305    64     0    64    64     0     8    0
rtmask      32       10    0       10     3     2     1     1     0     8    1
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   28717    0    28716     3     2     1     2     0     8    0
percpumem   16      158    0      106     1     0     1     1     0     8    0
kstatmem   264      172    0      136     3     0     3     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        6    0        6     2     2     0     1     0     8    0
scxspl     216    57347    0    57346    14    12     2     8     1     8    1
plimitpl   152      522    0      504     1     0     1     1     0     8    0
sigapl     424     2410    0     2339    10     1     9     9     0     8    0
knotepl    120      827    0        0    24     0    24    24     0     8    0
kqueuepl   224      795    0      784     9     4     5     5     0     8    4
pipepl     336      299    0      271     3     0     3     3     0     8    0
fdescpl    520     2364    0     2333     3     0     3     3     0     8    0
filepl     160    15117    0    14889    20     6    14    18     0     8    1
lockfpl    104     1103    0     1099     2     1     1     2     0     8    0
lockfspl    48      504    0      500     1     0     1     1     0     8    0
sessionpl  144       40    0       31     1     0     1     1     0     8    0
pgrppl      48       73    0       56     1     0     1     1     0     8    0
ucredpl    104     2539    0     2525     1     0     1     1     0     8    0
zombiepl   144     2341    0     2339     1     0     1     1     0     8    0
processpl  1240    2410    0     2339     6     0     6     6     0     8    0
procpl     656     5632    0     5553     8     0     8     8     0     8    0
srpgc       96        1    0        1     1     1     0     1     0     8    0
sosppl     168       18    0       18     3     2     1     1     0     8    1
sockpl     728     3413    0     3380    37    25    12    15     0     8    7
mcl64k     65536      7    0        0     1     0     1     1     0     8    0
mcl16k     16384      3    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     117    0        0    15     0    15    15     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      33    0        0     5     0     5     5     0     8    0
mtagpl      96      132    0        0     4     0     4     4     0     8    0
mbufpl     256     1233    0        0    77     0    77    77     0     8    0
bufpl      280    25222    0    19080   440     0   440   440     0     8    0
anonpl      32    12659    0        0   102     0   102   102     0   246    0
amapchunkpl 152   69560    0    68905    39    10    29    31     0   158    1
amappl16   200     9244    0     9136    53    36    17    29     0     8    1
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184      154    0      141     1     0     1     1     0     8    0
amappl13   176       41    0       40     1     0     1     1     0     8    0
amappl12   168     3128    0     3097     3     1     2     2     0     8    0
amappl11   160       53    0       39     1     0     1     1     0     8    0
amappl10   152       11    0       11     1     1     0     1     0     8    0
amappl9    144      273    0      272     2     1     1     1     0     8    0
amappl8    136       24    0       21     1     0     1     1     0     8    0
amappl7    128      132    0      120     1     0     1     1     0     8    0
amappl6    120      260    0      256     1     0     1     1     0     8    0
amappl5    112      165    0      155     1     0     1     1     0     8    0
amappl4    104      381    0      361     1     0     1     1     0     8    0
amappl3     96    14173    0    14060     5     1     4     4     0     8    0
amappl2     88      812    0      748     2     0     2     2     0     8    0
amappl1     80    18408    0    17796    16     1    15    15     0     8    0
amappl      88    19508    0    19326     5     0     5     5     0    92    0
dma16384   16384      1    0        1     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      255    0      255     3     3     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        8    0        8     2     2     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      131    0        1     3     0     3     3     0     8    0
uaddrrnd    24     2364    0     2333     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2364    0     2333     1     0     1     1     0     8    0
vmmpekpl   168    20405    0    20351     3     0     3     3     0     8    0
vmmpepl    168   155486    0   153373   118    14   104   109     0   357    2
vmsppl     480     2363    0     2333     5     0     5     5     0     8    0
rwobjpl     72    48309    0    41215   134     0   134   134     0     8    0
pdppl      4096    4735    0     4666   127    56    71    85     0     8    2
pvpl        32    20620    0        0   166     0   166   166     0   265    0
pmappl     256     2363    0     2333     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      507    0       87    13     0    13    13     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff83893ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xf sys/dev/kcov.c:149
clockintr_dispatch(ffff8000357faa30) at clockintr_dispatch+0x3b4 sys/kern/kern_clockintr.c:215
lapic_clockintr(0,0) at lapic_clockintr+0x51 sys/arch/amd64/amd64/lapic.c:489
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
end of kernel
end trace frame: 0x7d118f2da930, count: -7
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff839c3010,9,0) at witness_checkorder+0x10fb sys/kern/subr_witness.c:-1
mtx_enter(ffffffff839c3000) at mtx_enter+0x4a sys/kern/kern_lock.c:260
sleep_setup(ffffffff83894e50,220,ffffffff833aeb55) at sleep_setup+0xc6 sys/kern/kern_synch.c:302
msleep_nsec(ffffffff83894e50,ffffffff83894df0,220,ffffffff833aeb55,ffffffffffffffff) at msleep_nsec+0x119 sys/kern/kern_synch.c:217
dt_ioctl_record_stop(ffff8000014a7000) at dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:576
dtclose(11e5f,81,2000,ffff80003c43aa68) at dtclose+0x105 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,81,2000,ffff80003c43aa68) at dtclose+0x105 sys/dev/dt/dt_dev.c:232
spec_close(ffff80003c4473a0) at spec_close+0x45f sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd807108c6d8,81,fffffd80097fb548,ffff80003c43aa68) at VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156
vn_closefile(fffffd8064d9f590,ffff80003c43aa68) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd8064d9f590,ffff80003c43aa68) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd8064d9f590,ffff80003c43aa68) at fdrop+0x126 sys/kern/kern_descrip.c:1267
closef(fffffd8064d9f590,ffff80003c43aa68) at closef+0x192 sys/kern/kern_descrip.c:1251
syscall(ffff80003c447600) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c447600) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xbdb44c95ec0, count: -14

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/12 20:27 openbsd 2fd78fb00a47 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/11 17:50 openbsd 904c37accb58 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/06 19:00 openbsd 1a059e88663d 4f67c4ae .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/07/06 00:31 openbsd 0168633b2ab2 4f67c4ae .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/30 00:27 openbsd b4d1cb14c459 fc9d8ee5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/23 15:56 openbsd bfd2b5c81cd0 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/21 02:58 openbsd f62159b6a996 d6cdfb8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/20 03:26 openbsd c7ecc8a6a85e ed3e87f7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/15 19:21 openbsd 1a751a5f99c1 5f4b362d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/08 08:16 openbsd 44b12aca1c11 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/06/01 13:48 openbsd ae460101462c 3d2f584d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/27 16:45 openbsd 34392d87e208 874a1386 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/20 01:47 openbsd 03d4002980cf b84f0537 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/19 17:25 openbsd 2fc058fc36e6 27f68995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/18 13:54 openbsd 6decc3d5f4d6 f41472b0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/05/09 20:18 openbsd 0dc0a232ede0 77908e5f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
2025/04/22 03:22 openbsd e8eeea37c7e6 552876f8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &cq->cq_mtx &sched_lock
* Struck through repros no longer work on HEAD.