witness: reversal: sbufsnd inode (4)

Status: upstream: reported on 2026/05/23 21:30
Reported-by: syzbot+de15d066c25df21a5697@syzkaller.appspotmail.com
First crash: 119d, last: 17d
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: sbufsnd inode (3) -1 39 240d 465d 0/4 auto-obsoleted due to no activity on 2026/04/14 02:39
openbsd witness: reversal: sbufsnd inode (2) -1 19 529d 580d 0/4 auto-obsoleted due to no activity on 2025/05/28 20:57
openbsd witness: reversal: sbufsnd inode -1 4 699d 764d 0/4 auto-obsoleted due to no activity on 2025/01/18 21:43

Sample crash report:
pf: key search, out on vio0: witness: TCPlock order reversal:
 wire: (0)  1st 0xffff8000015ab0a8 sbufsnd (&so->so_snd.sb_lock)
10.128.15.235 2nd 0xfffff380701ee690 inode (&ip->i_lock)
:30002lock order [1] sbufsnd (&so->so_snd.sb_lock) -> [2] inode (&ip->i_lock)
 lock order data 0xffffffff8351fadc -> 0xffffffff83497753 is missing
10.128.0.159lock order [2] inode (&ip->i_lock) -> [3] sbufrcv (&so->so_rcv.sb_lock)
:17055#0  
pf: key search, in on vio0: rw_do_enter_writeTCP+0xba wire: (0) 
10.128.15.235#1  :30002 10.128.0.159:17055sblock
+0xb6
#2  soreceive+0x27d sys/kern/uipc_socket.c:890
#3  fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264
#4  VOP_READ+0x101 sys/kern/vfs_vops.c:227
#5  vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1
#6  vndsetcred+0xa1 sys/dev/vnd.c:685
#7  vndioctl+0xdfc sys/dev/vnd.c:486
#8  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#9  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#12 Xsyscall+0x128
lock order [3] sbufrcv (&so->so_rcv.sb_lock) -> [1] sbufsnd (&so->so_snd.sb_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  sblock+0xb6 sys/kern/uipc_socket2.c:536
#2  sosplice+0x32b sys/kern/uipc_socket.c:1352
#3  sys_setsockopt+0x2ba sys/kern/uipc_syscalls.c:1226
#4  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#5  Xsyscall+0x128
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(fffff380701ee690,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(fffff380701ee678,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
rrw_enter(fffff380701ee678,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
VOP_LOCK(fffff38063819890,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
vn_lock(fffff38063819890,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576
vfs_lookup(ffff80002a26c140) at vfs_lookup+0x12b sys/kern/vfs_lookup.c:431
namei(ffff80002a26c140) at namei+0x7c5 sys/kern/vfs_lookup.c:250
unp_connect(ffff8000015aaec0,fffff3806d9d8b00,ffff80003abb8fb0) at unp_connect+0x29d sys/kern/uipc_usrreq.c:872
uipc_dgram_send(ffff8000015aaec0,fffff3806d9d8d00,fffff3806d9d8b00,0) at uipc_dgram_send+0x163 sys/kern/uipc_usrreq.c:609
sosend(ffff8000015aaec0,fffff3806d9d8b00,ffff80002a26c3c8,0,0,c) at sosend+0x804 sys/kern/uipc_socket.c:-1
sendit(ffff80003abb8fb0,3,ffff80002a26c548,c,ffff80002a26c600) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785
sys_sendmsg(ffff80003abb8fb0,ffff80002a26c6b0,ffff80002a26c600) at sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603
syscall(ffff80002a26c6b0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a26c6b0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x11036456f40, count: -15
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a26bdb0
rbx                                0
rdx                                0
rcx               0xffff80003abb8fb0
rax               0xffffffff83966ff0    cpu_info_full_primary+0x1ff0
r8                0xffff80002a26bc90
r9                0x8080808080808080
r10               0xcdf551e617f178d6
r11               0x4981538aca45c407
r12               0xfffff380040cd980
r13               0xfffff380048b5240
r14                              0x3
r15               0xffffffff8352e654    substchar+0x1178a
rip               0xffffffff826643b5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a26bda0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/09 05:24 openbsd 350de6efe927 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: sbufsnd inode
2026/07/12 13:38 openbsd e38f82204f65 d78ea535 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: sbufsnd inode
2026/07/03 23:06 openbsd 2f91687338ee aa437a8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: sbufsnd inode
2026/06/26 06:21 openbsd a5986fc34424 7ff32d8b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: sbufsnd inode
2026/06/26 00:02 openbsd a5986fc34424 7ff32d8b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: sbufsnd inode
2026/06/22 13:04 openbsd a1ed62b580c9 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: sbufsnd inode
2026/05/23 21:29 openbsd 19a8be4fa5c4 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: sbufsnd inode
2026/09/01 23:36 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan aafb676041ac 587f6b29 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
2026/08/27 13:07 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 18607adc5162 c53a1b9c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
2026/08/13 06:31 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan a2d10d12a513 359b2492 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
2026/08/08 05:50 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan a6045cdb5fce 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
2026/07/23 13:51 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 7c61c2d2eaf2 71a13572 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
2026/07/20 05:17 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 7db9963a4e65 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
2026/07/16 10:40 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan b0ea410f6c4b 851bd571 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
2026/07/13 18:16 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan dbfd7807b1e0 a870962e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
2026/07/10 06:43 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 275dedaf93b0 4167ee25 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: sbufsnd inode
* Struck through repros no longer work on HEAD.