syzbot


witness: reversal: &sched_lock &cq->cq_mtx

Status: upstream: reported on 2025/05/15 15:16
Reported-by: syzbot+9ec54ee1623e4ac93f78@syzkaller.appspotmail.com
First crash: 120d, last: 27d

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff838c8b88 &sched_lock (&sched_lock)
 2nd 0xffff8000299eee08 &cq->cq_mtx (&cq->cq_mtx)
lock order [1] &sched_lock (&sched_lock) -> [2] &cq->cq_mtx (&cq->cq_mtx)
#0  mtx_enter+0x4a sys/kern/kern_lock.c:260
#1  clockintr_cancel+0x2f sys/kern/kern_clockintr.c:323
#2  mi_switch+0x16f sys/kern/sched_bsd.c:378
#3  sleep_finish+0x2d8 sys/kern/kern_synch.c:367
#4  sys_futex+0xa99 futex_wait sys/kern/sys_futex.c:301 [inline]
#4  sys_futex+0xa99 sys/kern/sys_futex.c:151
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
#6  Xsyscall+0x128
lock order [2] &cq->cq_mtx (&cq->cq_mtx) -> [1] &sched_lock (&sched_lock)
#0  mtx_enter+0x4a sys/kern/kern_lock.c:260
#1  sleep_setup+0xc6 sys/kern/kern_synch.c:302
#2  msleep_nsec+0x10b sys/kern/kern_synch.c:217
#3  dt_ioctl_record_stop+0xbc sys/dev/dt/dt_dev.c:582
#4  dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
#4  dtclose+0x109 sys/dev/dt/dt_dev.c:232
#5  spec_close+0x466 sys/kern/spec_vnops.c:-1
#6  VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
#7  vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
#7  vn_closefile+0x12b sys/kern/vfs_vnops.c:615
#8  fdrop+0x121 sys/kern/kern_descrip.c:1280
#9  closef+0x192 sys/kern/kern_descrip.c:1264
#10 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
#11 Xsyscall+0x128
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffff8000299eee08,9,0) at witness_checkorder+0x10b9 sys/kern/subr_witness.c:-1
mtx_enter(ffff8000299eedf8) at mtx_enter+0x4a sys/kern/kern_lock.c:260
clockintr_cancel(ffff8000299ee2f8) at clockintr_cancel+0x2f sys/kern/kern_clockintr.c:323
mi_switch() at mi_switch+0x16f sys/kern/sched_bsd.c:378
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2d8 sys/kern/kern_synch.c:367
sys_futex(ffff8000ffff3768,ffff80003c475c30,ffff80003c475b80) at sys_futex+0xa99 futex_wait sys/kern/sys_futex.c:301 [inline]
sys_futex(ffff8000ffff3768,ffff80003c475c30,ffff80003c475b80) at sys_futex+0xa99 sys/kern/sys_futex.c:151
syscall(ffff80003c475c30) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c475c30) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf8cd7642ce0, count: -9
ddb{1}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80003c475850
rbx                                0
rdx               0xffff800001472f80
rcx               0xffff8000ffff3768
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80003c475730
r9                0x8080808080808080
r10               0x6fd3b7fc99254565
r11               0xd9656a9cca88a66f
r12               0xfffffd8003ef3300
r13               0xfffffd80046e3a28
r14                              0x3
r15               0xffffffff833e35c2    substchar+0xd6dc
rip               0xffffffff814f2bd5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c475840
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=383266 pid=62628 tcnt=2 stat=sleep
    flags process=4000000<ITIMER> proc=4000080<SINTR,THREAD>
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0xffff80003c475a90, wmesg=fsleep, ps_single=0x0 scnt=0 ecnt=0
    forw=0x0, list=0xffff80003c47a2d0,0xffff80003a8382d8
    process=0xffff800038c270e0 user=0xffff80003c470000, vmspace=0xfffffd806b9cdb88
    estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 62628  342181  30597      0  7   0x4000000                syz-executor
*62628  383266  30597      0  3   0x4000080  fsleep        syz-executor
  8102  396659  53358      0  2           0                syz-executor
  8102  319826  53358      0  3   0x4000080  fsleep        syz-executor
  8102  494824  53358      0  3   0x4000080  fsleep        syz-executor
 73887  157562  23333      0  2           0                syz-executor
 73887  451820  23333      0  3   0x4000080  fsleep        syz-executor
 24963  280672  14591      0  2           0                syz-executor
 24963  115022  14591      0  2   0x4000000                syz-executor
 73631   72518    710      0  2           0                syz-executor
 73631  317727    710      0  3   0x4000080  sbwait        syz-executor
 73631  182136    710      0  3   0x4000080  fsleep        syz-executor
 31749   55428  65522     -1  2        0x10                syz-executor
 31749  238596  65522     -1  2   0x4000010                syz-executor
 19256    8810  58470      0  3        0x80  nanoslp       syz-executor
 19256   94913  58470      0  3   0x4000080  sbwait        syz-executor
 19256  287509  58470      0  3   0x4000080  fsleep        syz-executor
 88816  112350      0      0  3     0x14280  nfsidl        nfsio
 75608  453284      0      0  3     0x14280  nfsidl        nfsio
 53918  473858      0      0  3     0x14280  nfsidl        nfsio
 81857  183761      0      0  3     0x14280  nfsidl        nfsio
 41975  510004      0      0  3     0x14280  nfsidl        nfsio
 48534  349186      0      0  3     0x14280  nfsidl        nfsio
 85038  422695      0      0  3     0x14280  nfsidl        nfsio
  6268  208785      0      0  3     0x14280  nfsidl        nfsio
  8105  197593      0      0  3     0x14280  nfsidl        nfsio
 61604  133649      0      0  3     0x14280  nfsidl        nfsio
 95056  145804      0      0  3     0x14280  nfsidl        nfsio
 84788  264687      0      0  3     0x14280  nfsidl        nfsio
 63664  198890      0      0  3     0x14280  nfsidl        nfsio
 90894  123413      0      0  3     0x14280  nfsidl        nfsio
 28281  284951      0      0  3     0x14280  nfsidl        nfsio
 55281  443774      0      0  3     0x14280  nfsidl        nfsio
 46990  335269      0      0  3     0x14280  nfsidl        nfsio
  1503  106164      0      0  3     0x14280  nfsidl        nfsio
 13968  310842      0      0  3     0x14280  nfsidl        nfsio
  1568  215698      0      0  3     0x14280  nfsidl        nfsio
 53358  483098  91643      0  3        0x82  nanoslp       syz-executor
 58470  313437  91643      0  3        0x82  nanoslp       syz-executor
 23333    1996  91643      0  3        0x82  nanoslp       syz-executor
 65522  182553  91643      0  3        0x82  nanoslp       syz-executor
 30597  170978  91643      0  3        0x82  nanoslp       syz-executor
   710  215562  91643      0  3        0x82  nanoslp       syz-executor
 40620  355721  91643      0  2         0x2                syz-executor
 14591  442977  91643      0  3        0x82  nanoslp       syz-executor
 91643  458705  53922      0  3        0x82  kqread        syz-executor
 53922  104509  69631      0  3    0x10008a  sigsusp       ksh
 69631  475574  44050      0  3        0x98  kqread        sshd-session
 44050  133514  59158      0  3        0x92  kqread        sshd-session
 26694  446210      1      0  3    0x100083  ttyopn        getty
 59158  432235      1      0  3        0x88  kqread        sshd
  7234  359408  82007     74  3   0x1100092  bpf           pflogd
 82007  379827      1      0  3        0x80  sbwait        pflogd
 84273   82102  80229     73  3   0x1100090  kqread        syslogd
 80229  413974      1      0  3    0x100082  sbwait        syslogd
 61106  484074      1      0  3    0x100080  kqread        resolvd
 11555  415020  79701     77  3    0x100092  kqread        dhcpleased
 54855   79125  79701     77  3    0x100092  kqread        dhcpleased
 79701  428059      1      0  3        0x80  kqread        dhcpleased
  9723  182157      0      0  3     0x14200  bored         smr
 73810  161554      0      0  2     0x14200                zerothread
    86  289493      0      0  3     0x14200  aiodoned      aiodoned
 63089  437437      0      0  3     0x14200  syncer        update
 69594  413448      0      0  3     0x14200  cleaner       cleaner
 52780  111440      0      0  3     0x14200  reaper        reaper
 51026  182296      0      0  3     0x14200  pgdaemon      pagedaemon
  7475   20707      0      0  3     0x14200  bored         viomb
 71512  339665      0      0  3  0x40014200  acpi0         acpi0
 32808  517926      0      0  3  0x40014200                idle1
 87076  225881      0      0  3     0x14200  bored         softnet7
 80820  236082      0      0  3     0x14200  bored         softnet6
 26734  147252      0      0  3     0x14200  bored         softnet5
 58473  169615      0      0  3     0x14200  bored         softnet4
 98245  315485      0      0  3     0x14200  bored         softnet3
 81560  200611      0      0  3     0x14200  bored         softnet2
 94527  450065      0      0  3     0x14200  bored         softnet1
  9000  412445      0      0  3     0x14200  bored         softnet0
  5299  118946      0      0  3     0x14200  bored         systqmp
 60122  341225      0      0  3     0x14200  bored         systq
 79933  467888      0      0  3     0x14200  tmoslp        softclockmp
 98690   38648      0      0  3  0x40014200  tmoslp        softclock
 87664  484034      0      0  3  0x40014200                idle0
     1  498994      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
CPU 0:
exclusive mutex &vioq->viq_rxmtx r = 0 (0xffff8000001a0db0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter_try+0x1ad sys/kern/kern_lock.c:311
#2  mtx_enter+0x62 sys/kern/kern_lock.c:261
#3  vio_rx_intr+0x82 sys/dev/pv/if_vio.c:1569
#4  vio_queue_intr+0x59 sys/dev/pv/if_vio.c:911
#5  intr_handler+0x125 sys/arch/amd64/amd64/intr.c:563
#6  Xintr_ioapic_edge26_untramp+0x18f
#7  mtx_enter+0xc1 sys/kern/kern_lock.c:264
#8  endtsleep+0x39 sys/kern/kern_synch.c:538
#9  timeout_run+0x13d sys/kern/kern_timeout.c:698
#10 softclock_process_tick_timeout+0x232 sys/kern/kern_timeout.c:756
#11 softclock+0x152 sys/kern/kern_timeout.c:788
#12 softintr_dispatch+0x13b sys/kern/kern_softintr.c:84
#13 dosoftint+0x54 sys/arch/amd64/amd64/intr.c:847
#14 Xsoftclock+0x27
#15 mtx_enter+0x105 sys/kern/kern_lock.c:273
#16 futex_wake+0x246 futex_list_wakeup sys/kern/sys_futex.c:340 [inline]
#16 futex_wake+0x246 sys/kern/sys_futex.c:476
#17 sys_futex+0x1c5 sys/kern/sys_futex.c:154
#18 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#18 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
shared mutex timeout r = 0 (0xffffffff837a9730)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  timeout_run+0x115 sys/kern/kern_timeout.c:694
#2  softclock_process_tick_timeout+0x232 sys/kern/kern_timeout.c:756
#3  softclock+0x152 sys/kern/kern_timeout.c:788
#4  softintr_dispatch+0x13b sys/kern/kern_softintr.c:84
#5  dosoftint+0x54 sys/arch/amd64/amd64/intr.c:847
#6  Xsoftclock+0x27
#7  mtx_enter+0x105 sys/kern/kern_lock.c:273
#8  futex_wake+0x246 futex_list_wakeup sys/kern/sys_futex.c:340 [inline]
#8  futex_wake+0x246 sys/kern/sys_futex.c:476
#9  sys_futex+0x1c5 sys/kern/sys_futex.c:154
#10 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
#11 Xsyscall+0x128
CPU 1:
exclusive mutex &sched_lock r = 0 (0xffffffff838c8b88)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter_try+0x1ad sys/kern/kern_lock.c:311
#2  mtx_enter+0x62 sys/kern/kern_lock.c:261
#3  sleep_finish+0x1d6 sys/kern/kern_synch.c:355
#4  sys_futex+0xa99 futex_wait sys/kern/sys_futex.c:301 [inline]
#4  sys_futex+0xa99 sys/kern/sys_futex.c:151
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
#6  Xsyscall+0x128
Process 62628 (syz-executor) thread 0xffff80003c47aa98 (342181)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff8394d310)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
#2  dosoftint+0x54 sys/arch/amd64/amd64/intr.c:847
#3  Xsoftclock+0x27
#4  mtx_enter+0x105 sys/kern/kern_lock.c:273
#5  futex_wake+0x246 futex_list_wakeup sys/kern/sys_futex.c:340 [inline]
#5  futex_wake+0x246 sys/kern/sys_futex.c:476
#6  sys_futex+0x1c5 sys/kern/sys_futex.c:154
#7  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#7  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
#8  Xsyscall+0x128
exclusive rwlock futexlk r = 0 (0xffffffff839849e8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  futex_wake+0xbc sys/kern/sys_futex.c:461
#3  sys_futex+0x1c5 sys/kern/sys_futex.c:154
#4  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
#5  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10257  11105K   11573K 166960K     11675        0
            pcb    17     12K      12K 166960K        54        0
         rtable   214      8K       9K 166960K       317        0
             pf    36     17K      21K 166960K        63        0
         ifaddr    41      7K       7K 166960K        53        0
        ifgroup    59      2K       2K 166960K        69        0
         sysctl     1      1K       9K 166960K         6        0
       counters    70     37K      37K 166960K        86        0
       ioctlops     0      0K       4K 166960K      1511        0
            iov     1     16K      16K 166960K         9        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1369     86K      86K 166960K      1610        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         6        0
         VM map     2      1K       1K 166960K         2        0
            sem     9      0K       0K 166960K        11        0
        dirhash    12      2K       2K 166960K        18        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K      93K 166960K       329        0
          sigio     0      0K       0K 166960K         3        0
           proc    72    115K     164K 166960K       555        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        31        0
       in_multi    88      6K       7K 166960K       111        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     2      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    79    360K     360K 166960K        79        0
           exec     0      0K       1K 166960K       390        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   253    168K     181K 166960K      4641        0
       UVM aobj    13      2K       2K 166960K        13        0
     pinsyscall    43     86K     104K 166960K      1447        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        15        0
            NDP    13      0K       1K 166960K        34        0
           temp    44   8639K    8705K 166960K     13151        0
         kqueue    15     24K      32K 166960K        66        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120       59    0       56     1     0     1     1     0     8    0
rtentry    176      100    0       10     5     0     5     5     0     8    0
unpcb      144      143    0      122     2     0     2     2     0     8    0
syncache   336        6    0        6     1     0     1     1     0     8    1
tcpqe       32        1    0        1     1     0     1     1     0     8    1
tcpcb      736       53    0       47     1     0     1     1     0     8    0
arp        128       12    0        1     1     0     1     1     0     8    0
inpcb      328      211    0      201     2     0     2     2     0     8    0
nd6        144       17    0        2     1     0     1     1     0     8    0
pkpcb       40        4    0        4     1     0     1     1     0     8    1
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1192       8    0        8     1     0     1     1     0     8    1
pffrag     232        3    0        1     1     0     1     1     0   482    0
pffrnode    88        3    0        1     1     0     1     1     0     8    0
pffrent     40        4    0        2     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfstitem    24       47    0        0     1     0     1     1     0     8    0
pfstkey    128       47    0        0     2     0     2     2     0     8    0
pfstate    384       47    0        0     5     0     5     5     0     8    0
pfrule     1344      23    0       18     2     1     1     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      440    0       42    28     0    28    28     0     8    1
art_table   40      442    0       42     5     0     5     5     0     8    0
art_node    32      100    0       20     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        0     1     0     1     1     0     8    0
semapl     112        8    0        1     1     0     1     1     0     8    0
shmpl      112       10    0        0     1     0     1     1     0     8    0
dirhash    1024      21    0        4     3     0     3     3     0     8    0
dino2pl    256     1938    0      434    96     0    96    96     0     8    1
ffsino     296     1938    0      434   117     0   117   117     0     8    0
nchpl      144     2405    0      717    64     0    64    64     0     8    0
rtmask      32        3    0        3     1     0     1     1     0     8    1
uvmvnodes   80     2194    0        0    45     0    45    45     0     8    0
vnodes     216     2194    0        0   122     0   122   122     0     8    0
namei      1024    8014    0     8014     2     0     2     2     0     8    2
percpumem   16       58    0        8     1     0     1     1     0     8    0
kstatmem   264       40    0       10     3     0     3     3     0     8    1
scxspl     216     8708    0     8708    10     2     8     8     1     8    8
plimitpl   152       64    0       45     1     0     1     1     0     8    0
sigapl     424      662    0      588     9     0     9     9     0     8    0
knotepl    120      404    0        0    13     0    13    13     0     8    0
kqueuepl   224       80    0       68     2     0     2     2     0     8    1
pipepl     344      121    0       94     3     0     3     3     0     8    0
fdescpl    528      620    0      588     3     0     3     3     0     8    0
filepl     160     2674    0     2415    14     0    14    14     0     8    3
lockfpl    104      208    0      206     2     0     2     2     0     8    1
lockfspl    48       37    0       35     1     0     1     1     0     8    0
sessionpl  144       24    0       15     1     0     1     1     0     8    0
pgrppl      48       32    0       15     1     0     1     1     0     8    0
ucredpl    104      291    0      277     1     0     1     1     0     8    0
zombiepl   144      589    0      588     1     0     1     1     0     8    0
processpl  1248     662    0      588     6     0     6     6     0     8    0
procpl     664     1001    0      917     8     0     8     8     0     8    0
sockpl     752      423    0      389     5     0     5     5     0     8    0
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     111    0        0    14     0    14    14     0     8    0
mcl2k      2048      23    0        0     3     0     3     3     0     8    0
mtagpl      96        9    0        0     1     0     1     1     0     8    0
mbufpl     256      172    0        0    11     0    11    11     0     8    0
bufpl      280     3488    0      125   241     0   241   241     0     8    0
anonpl      32     5438    0        0    44     0    44    44     0   246    0
amapchunkpl 152   14395    0    13851    30     3    27    27     0   158    5
amappl16   200     2184    0     2155     5     2     3     5     0     8    0
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184      163    0      150     1     0     1     1     0     8    0
amappl13   176        7    0        7     2     1     1     1     0     8    1
amappl12   168     1276    0     1244     3     1     2     2     0     8    0
amappl11   160       77    0       63     1     0     1     1     0     8    0
amappl10   152       24    0       24     1     1     0     1     0     8    0
amappl9    144      282    0      282     1     1     0     1     0     8    0
amappl8    136       36    0       33     1     0     1     1     0     8    0
amappl7    128      133    0      121     1     0     1     1     0     8    0
amappl6    120      187    0      184     1     0     1     1     0     8    0
amappl5    112      121    0      112     1     0     1     1     0     8    0
amappl4    104      313    0      293     1     0     1     1     0     8    0
amappl3     96     2595    0     2470     4     0     4     4     0     8    0
amappl2     88      658    0      594     2     0     2     2     0     8    0
amappl1     80     9645    0     9045    15     0    15    15     0     8    1
amappl      88     3903    0     3724     5     0     5     5     0    92    0
dma32768   32768      1    0        1     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       2    0        1     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       12    0        0     1     0     1     1     0     8    0
uaddrrnd    24      620    0      588     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      620    0      588     1     0     1     1     0     8    0
vmmpekpl   168     6793    0     6763     2     0     2     2     0     8    0
vmmpepl    168    46196    0    44155    96     0    96    96     0   357    7
vmsppl     488      619    0      588     5     0     5     5     0     8    0
rwobjpl     80    17402    0    14248    65     0    65    65     0     8    0
pdppl      4096    1247    0     1176   103    30    73    87     0     8    2
pvpl        32    11698    0        0    95     0    95    95     0   265    0
pmappl     256      619    0      588     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      274    0       32     8     0     8     8     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff8383fff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
mtx_enter(ffffffff838c8b78) at mtx_enter+0xd2 sys/kern/kern_lock.c:264
wakeup_n(ffff80000002c000,1) at wakeup_n+0x54 sys/kern/kern_synch.c:579
task_add(ffff80000002c000,ffff800000039530) at task_add+0x163 sys/kern/kern_task.c:372
ifiq_input(ffff8000000394c0,ffff80003c484ff8) at ifiq_input+0x4af sys/net/ifq.c:784
vio_rxeof(ffff8000001a0d00) at vio_rxeof+0x41d sys/dev/pv/if_vio.c:1555
vio_rx_intr(ffff80000019f800) at vio_rx_intr+0x98 sys/dev/pv/if_vio.c:1571
vio_queue_intr(ffff8000001a0d00) at vio_queue_intr+0x59 sys/dev/pv/if_vio.c:911
intr_handler(ffff80003c4851a0,ffff800000079d00) at intr_handler+0x125 sys/arch/amd64/amd64/intr.c:563
Xintr_ioapic_edge26_untramp() at Xintr_ioapic_edge26_untramp+0x18f
mtx_enter(ffffffff838c8b78) at mtx_enter+0xc1 sys/kern/kern_lock.c:264
endtsleep(ffff8000ffff3238) at endtsleep+0x39 sys/kern/kern_synch.c:538
timeout_run(ffffffff837a9788,ffff8000ffff32d0) at timeout_run+0x13d sys/kern/kern_timeout.c:698
softclock_process_tick_timeout(ffff8000ffff32d0,0) at softclock_process_tick_timeout+0x232 sys/kern/kern_timeout.c:756
softclock(0) at softclock+0x152 sys/kern/kern_timeout.c:788
softintr_dispatch(0) at softintr_dispatch+0x13b sys/kern/kern_softintr.c:84
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:847
Xsoftclock() at Xsoftclock+0x27
mtx_enter(ffffffff838c8b78) at mtx_enter+0x105 sys/kern/kern_lock.c:273
futex_wake(ffff80003c47aa98,f8cf3a26d30,7fffffff,80,ffff80003c485780) at futex_wake+0x246 futex_list_wakeup sys/kern/sys_futex.c:340 [inline]
futex_wake(ffff80003c47aa98,f8cf3a26d30,7fffffff,80,ffff80003c485780) at futex_wake+0x246 sys/kern/sys_futex.c:476
sys_futex(ffff80003c47aa98,ffff80003c485830,ffff80003c485780) at sys_futex+0x1c5 sys/kern/sys_futex.c:154
syscall(ffff80003c485830) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c485830) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7875cb35e1e0, count: -25
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffff8000299eee08,9,0) at witness_checkorder+0x10b9 sys/kern/subr_witness.c:-1
mtx_enter(ffff8000299eedf8) at mtx_enter+0x4a sys/kern/kern_lock.c:260
clockintr_cancel(ffff8000299ee2f8) at clockintr_cancel+0x2f sys/kern/kern_clockintr.c:323
mi_switch() at mi_switch+0x16f sys/kern/sched_bsd.c:378
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2d8 sys/kern/kern_synch.c:367
sys_futex(ffff8000ffff3768,ffff80003c475c30,ffff80003c475b80) at sys_futex+0xa99 futex_wait sys/kern/sys_futex.c:301 [inline]
sys_futex(ffff8000ffff3768,ffff80003c475c30,ffff80003c475b80) at sys_futex+0xa99 sys/kern/sys_futex.c:151
syscall(ffff80003c475c30) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c475c30) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf8cd7642ce0, count: -9

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/16 12:09 openbsd 0823c7e0b279 1804e95e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &sched_lock &cq->cq_mtx
2025/06/20 16:17 openbsd 58d1a60550ab e3003213 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &sched_lock &cq->cq_mtx
2025/06/07 08:03 openbsd 16c80f155e04 4826c28e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &sched_lock &cq->cq_mtx
2025/05/15 15:16 openbsd 8b901a85ba65 cfde8269 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: &sched_lock &cq->cq_mtx
* Struck through repros no longer work on HEAD.