syzbot
witness: reversal: sbufsnd inode (4)
Status:
upstream: reported on 2026/05/23 21:30
Reported-by: syzbot+de15d066c25df21a5697@syzkaller.appspotmail.com
First crash: 119d, last: 17d
Sample crash report:
pf: key search, out on vio0: witness: TCPlock order reversal:
wire: (0) 1st 0xffff8000015ab0a8 sbufsnd (&so->so_snd.sb_lock)
10.128.15.235 2nd 0xfffff380701ee690 inode (&ip->i_lock)
:30002lock order [1] sbufsnd (&so->so_snd.sb_lock) -> [2] inode (&ip->i_lock)
lock order data 0xffffffff8351fadc -> 0xffffffff83497753 is missing
10.128.0.159lock order [2] inode (&ip->i_lock) -> [3] sbufrcv (&so->so_rcv.sb_lock)
:17055#0
pf: key search, in on vio0: rw_do_enter_writeTCP+0xba wire: (0)
10.128.15.235#1 :30002 10.128.0.159:17055sblock
+0xb6
#2 soreceive+0x27d sys/kern/uipc_socket.c:890
#3 fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264
#4 VOP_READ+0x101 sys/kern/vfs_vops.c:227
#5 vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1
#6 vndsetcred+0xa1 sys/dev/vnd.c:685
#7 vndioctl+0xdfc sys/dev/vnd.c:486
#8 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#9 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#12 Xsyscall+0x128
lock order [3] sbufrcv (&so->so_rcv.sb_lock) -> [1] sbufsnd (&so->so_snd.sb_lock)
#0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1 sblock+0xb6 sys/kern/uipc_socket2.c:536
#2 sosplice+0x32b sys/kern/uipc_socket.c:1352
#3 sys_setsockopt+0x2ba sys/kern/uipc_syscalls.c:1226
#4 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#5 Xsyscall+0x128
Stopped at db_enter+0x25: addq $0x8,%rsp
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(fffff380701ee690,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(fffff380701ee678,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
rrw_enter(fffff380701ee678,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
VOP_LOCK(fffff38063819890,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
vn_lock(fffff38063819890,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576
vfs_lookup(ffff80002a26c140) at vfs_lookup+0x12b sys/kern/vfs_lookup.c:431
namei(ffff80002a26c140) at namei+0x7c5 sys/kern/vfs_lookup.c:250
unp_connect(ffff8000015aaec0,fffff3806d9d8b00,ffff80003abb8fb0) at unp_connect+0x29d sys/kern/uipc_usrreq.c:872
uipc_dgram_send(ffff8000015aaec0,fffff3806d9d8d00,fffff3806d9d8b00,0) at uipc_dgram_send+0x163 sys/kern/uipc_usrreq.c:609
sosend(ffff8000015aaec0,fffff3806d9d8b00,ffff80002a26c3c8,0,0,c) at sosend+0x804 sys/kern/uipc_socket.c:-1
sendit(ffff80003abb8fb0,3,ffff80002a26c548,c,ffff80002a26c600) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785
sys_sendmsg(ffff80003abb8fb0,ffff80002a26c6b0,ffff80002a26c600) at sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603
syscall(ffff80002a26c6b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a26c6b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x11036456f40, count: -15
ddb{0}> show registers
rdi 0
rsi 0
rbp 0xffff80002a26bdb0
rbx 0
rdx 0
rcx 0xffff80003abb8fb0
rax 0xffffffff83966ff0 cpu_info_full_primary+0x1ff0
r8 0xffff80002a26bc90
r9 0x8080808080808080
r10 0xcdf551e617f178d6
r11 0x4981538aca45c407
r12 0xfffff380040cd980
r13 0xfffff380048b5240
r14 0x3
r15 0xffffffff8352e654 substchar+0x1178a
rip 0xffffffff826643b5 db_enter+0x25
cs 0x8
rflags 0x246
rsp 0xffff80002a26bda0
ss 0x10
db_enter+0x25: addq $0x8,%rsp
ddb{0}>
* Struck through repros no longer work on HEAD.