syzbot


witness: shared lock of (rwlock) maddr while exclusively locked

Status: fixed on 2026/01/04 15:07
Reported-by: syzbot+de6bcf8e746b8a631885@syzkaller.appspotmail.com
Fix commit: 2b6fc957b059 Backout: Protect IGMP and MLD6 fast timer with rwlock.
First crash: 11d, last: 10d

Sample crash report:
witness: shared lock of (rwlock) maddr while exclusively locked
panic: excl->share
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
  58980  55668      0         0x2          0    0  syz-executor
*349124   1881      0     0x14000      0x200    1  softclockmp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833b4a35) at panic+0x1e5 sys/kern/subr_prf.c:198
witness_checkorder(ffff80000158b878,1,0) at witness_checkorder+0x122c sys/kern/subr_witness.c:854
rw_do_enter_read(ffff80000158b860,0) at rw_do_enter_read+0x99 sys/kern/kern_rwlock.c:355
in6_hasmulti(fffffd8069f4eff0,ffff80000158b800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd8069f4eff0,ffff80000158b800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd8069f4ef00,ffffffff839eee58,0,0,ffff80002a1fe880,0) at ip6_output+0x13bd sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff8000015ac880,83,0) at mld6_sendpkt+0x385 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff83a15020) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff83835dd8,ffffffff83a15020) at timeout_run+0x159 sys/kern/kern_timeout.c:698
softclock_thread_run(ffffffff83835dd8) at softclock_thread_run+0xe7 sys/kern/kern_timeout.c:842
softclock_thread_mp(ffff8000ffffea60) at softclock_thread_mp+0x86
end trace frame: 0x0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: excl->share
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833b4a35) at panic+0x1e5 sys/kern/subr_prf.c:198
witness_checkorder(ffff80000158b878,1,0) at witness_checkorder+0x122c sys/kern/subr_witness.c:854
rw_do_enter_read(ffff80000158b860,0) at rw_do_enter_read+0x99 sys/kern/kern_rwlock.c:355
in6_hasmulti(fffffd8069f4eff0,ffff80000158b800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd8069f4eff0,ffff80000158b800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd8069f4ef00,ffffffff839eee58,0,0,ffff80002a1fe880,0) at ip6_output+0x13bd sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff8000015ac880,83,0) at mld6_sendpkt+0x385 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff83a15020) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff83835dd8,ffffffff83a15020) at timeout_run+0x159 sys/kern/kern_timeout.c:698
softclock_thread_run(ffffffff83835dd8) at softclock_thread_run+0xe7 sys/kern/kern_timeout.c:842
softclock_thread_mp(ffff8000ffffea60) at softclock_thread_mp+0x86
end trace frame: 0x0, count: -12
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80002a1fe4d0
rbx               0xffff8000299dee07
rdx                                0
rcx               0xffff8000ffffea60
rax               0xffff8000299ddff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0xd4177127b57331f9
r11               0x178dbc341f3d4843
r12               0xffff8000299dec08
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff810e0165    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80002a1fe4c0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (softclockmp) tid=349124 pid=1881 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=0, usrpri=50, slppri=0, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffffef90,0xffff8000ffffe2a8
    process=0xffff8000ffffa680 user=0xffff80002a1f9000, vmspace=0xffffffff83a0c438
    estcpu=0, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 82898  482797  98351      0  2           0                syz-executor
 82898  375754  98351      0  2   0x4000000                syz-executor
 90647  113141   4296      0  2           0                syz-executor
 90647  377231   4296      0  3   0x4000080  fsleep        syz-executor
 90647  225807   4296      0  2   0x4000000                syz-executor
 72889  167022  53400      0  2           0                syz-executor
 72889  507892  53400      0  3   0x4000080  fsleep        syz-executor
 98544  377228  40727      0  2           0                syz-executor
 98544  431521  40727      0  3   0x4000080  fsleep        syz-executor
 40827   85695  13151      0  2           0                syz-executor
 40827  289078  13151      0  3   0x4000080  kqread        syz-executor
 40827  424524  13151      0  3   0x4000080  fsleep        syz-executor
 58724  104927      0      0  3     0x14200  acct          acct
 53501  226544  56657      0  3      0x3000  suspend       syz-executor
 53501   78179  56657      0  2   0x4081000                syz-executor
 53501  281750  56657      0  3   0x4081000  inode         syz-executor
 83957  413566      1      0  3    0x100083  ttyin         getty
 55668   58980   8154      0  7         0x2                syz-executor
 56657   91988   8154      0  3        0x82  nanoslp       syz-executor
 19228   66743   8154      0  3        0x82  wait          syz-executor
 40727  226704   8154      0  3        0x82  nanoslp       syz-executor
 13151  367257   8154      0  2       0xc82                syz-executor
 98351  347164   8154      0  3        0x82  nanoslp       syz-executor
  4296  507580   8154      0  3        0x82  nanoslp       syz-executor
 53400  494555   8154      0  3        0x82  nanoslp       syz-executor
  8154  499982  26251      0  3        0x82  kqread        syz-executor
 26251  376020  70624      0  3    0x10008a  sigsusp       ksh
 70624  475171  24131      0  3        0x98  kqread        sshd-session
 24131  161787  44854      0  3        0x92  kqread        sshd-session
 44854  254853      1      0  3        0x88  kqread        sshd
 33668  333575  61108     74  3   0x1100092  bpf           pflogd
 61108  281330      1      0  3        0x80  sbwait        pflogd
 48883  177243  46782     73  3   0x1100090  kqread        syslogd
 46782  127495      1      0  3    0x100082  sbwait        syslogd
 73327  371769      1      0  3    0x100080  kqread        resolvd
 86133  329013  46893     77  3    0x100092  kqread        dhcpleased
 10720  264527  46893     77  3    0x100092  kqread        dhcpleased
 46893  475379      1      0  3        0x80  kqread        dhcpleased
 81453  170867      0      0  3     0x14200  bored         smr
 95216  510581      0      0  3     0x14200  pgzero        zerothread
 16758  129379      0      0  3     0x14200  aiodoned      aiodoned
 46279  314034      0      0  3     0x14200  syncer        update
 67696  332436      0      0  3     0x14200  cleaner       cleaner
 14614  136156      0      0  3     0x14200  reaper        reaper
 25651  279345      0      0  3     0x14200  pgdaemon      pagedaemon
 99393   59498      0      0  3     0x14200  bored         viomb
 99568  342129      0      0  3  0x40014200  acpi0         acpi0
 41128  296606      0      0  3  0x40014200                idle1
 30274  322211      0      0  3     0x14200  bored         softnet1
 79088  485787      0      0  3     0x14200  bored         softnet0
 60368  311739      0      0  3     0x14200  bored         systqmp
 76967   23768      0      0  3     0x14200  bored         systq
* 1881  349124      0      0  7     0x14200                softclockmp
 23989  300751      0      0  3  0x40014200  tmoslp        softclock
 76663  158292      0      0  3  0x40014200                idle0
     1  153734      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 90647 (syz-executor) thread 0xffff80003c40b780 (225807)
exclusive rwlock fdlock r = 0 (0xffff8000fffeccd0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  doopenat+0x18e sys/kern/vfs_syscalls.c:1105
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:775
#4  Xsyscall+0x128
Process 53501 (syz-executor) thread 0xffff80003c40b250 (78179)
exclusive rrwlock inode r = 0 (0xfffffd805f900460)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vn_write+0x18f sys/kern/vfs_vnops.c:405
#6  dofilewritev+0x242 sys/kern/sys_generic.c:380
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:775
#9  Xsyscall+0x128
Process 55668 (syz-executor) thread 0xffff8000fffee7e0 (58980)
exclusive rrwlock inode r = 0 (0xfffffd805f900338)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4  ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:159
#5  ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1232
#6  ffs_inode_alloc+0x279 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112
#8  VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
#9  domkdirat+0x179 sys/kern/vfs_syscalls.c:3113
#10 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806d7d0450)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x11c sys/kern/vfs_lookup.c:-1
#6  namei+0x7ca sys/kern/vfs_lookup.c:250
#7  domkdirat+0x8b sys/kern/vfs_syscalls.c:3098
#8  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
#9  Xsyscall+0x128
Process 1881 (softclockmp) thread 0xffff8000ffffea60 (349124)
exclusive rwlock maddr r = 0 (0xffff80000158b878)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  mld6_fasttimo+0x8c mld6_checktimer sys/netinet6/mld6.c:-1 [inline]
#2  mld6_fasttimo+0x8c sys/netinet6/mld6.c:369
#3  pffasttimo+0x184 sys/kern/uipc_domain.c:-1
#4  timeout_run+0x159 sys/kern/kern_timeout.c:698
#5  softclock_thread_run+0xe7 sys/kern/kern_timeout.c:842
#6  softclock_thread_mp+0x86
#7  proc_trampoline+0x10
shared rwlock netlock r = 0 (0xffffffff83891cc0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  mld6_fasttimo+0x5f sys/netinet6/mld6.c:-1
#3  pffasttimo+0x184 sys/kern/uipc_domain.c:-1
#4  timeout_run+0x159 sys/kern/kern_timeout.c:698
#5  softclock_thread_run+0xe7 sys/kern/kern_timeout.c:842
#6  softclock_thread_mp+0x86
#7  proc_trampoline+0x10
shared rwlock timeout r = 0 (0xffffffff83835d78)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  timeout_run+0x131 sys/kern/kern_timeout.c:694
#2  softclock_thread_run+0xe7 sys/kern/kern_timeout.c:842
#3  softclock_thread_mp+0x86
#4  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11062  12088K   12411K 166960K     12445        0
            pcb    22     14K      16K 166960K       127        0
         rtable   233      8K       8K 166960K       407        0
             pf    34     17K      18K 166960K        68        0
         ifaddr    41      7K       7K 166960K        59        0
        ifgroup    55      2K       2K 166960K        84        0
         sysctl     1      1K       9K 166960K         5        0
       counters    70     37K      37K 166960K       104        0
       ioctlops     0      0K       4K 166960K      1515        0
            iov     0      0K      12K 166960K        72        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1405     88K      89K 166960K      1660        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K         7        0
         VM map     2      1K       1K 166960K         2        0
            sem     5      0K       0K 166960K         5        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      93K 166960K       366        0
          sigio     0      0K       0K 166960K         9        0
           proc    72    115K     148K 166960K       554        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     2      0K       0K 166960K        30        0
       in_multi    92      7K       7K 166960K       108        0
    ether_multi     1      0K       0K 166960K         2        0
            mrt     1      0K       0K 166960K         3        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     0      0K       1K 166960K       403        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   246    161K     169K 166960K      5285        0
       UVM aobj    46      5K       5K 166960K        48        0
     pinsyscall    42     84K     106K 166960K      1507        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        14        0
            NDP    12      0K       2K 166960K        39        0
           temp    45   8671K    8737K 166960K     18380        0
         kqueue    14     20K      26K 166960K        58        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120       46    0       43     1     0     1     1     0     8    0
rtentry    176      118    0       19     6     0     6     6     0     8    0
unpcb      144      152    0      128     2     0     2     2     0     8    1
syncache   336        5    0        5     2     1     1     1     0     8    1
tcpqe       32        1    0        1     1     0     1     1     0     8    1
tcpcb      736      124    0      118     7     0     7     7     0     8    6
arp        136       18    0        0     1     0     1     1     0     8    0
inpcb      328      385    0      372     9     2     7     7     0     8    5
nd6        152       27    0        2     2     0     2     2     0     8    0
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1192      14    0       14     3     2     1     1     0     8    1
pppxif     1576       1    0        1     1     0     1     1     0     8    1
pffrag     232        1    0        0     1     0     1     1     0   482    0
pffrnode    88        1    0        0     1     0     1     1     0     8    0
pffrent     40        2    0        1     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfstitem    24       30    0        1     1     0     1     1     0     8    0
pfstkey    128       30    0        1     1     0     1     1     0     8    0
pfstate    448       30    0        1     4     0     4     4     0     8    0
pfrule     1344      21    0       16     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     0     1     1     0     8    1
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      502    0       94    30     1    29    29     0     8    1
art_table   40      505    0       94     5     0     5     5     0     8    0
art_node    32      118    0       28     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        3     2     1     1     1     0     8    1
semapl     112        3    0        0     1     0     1     1     0     8    0
shmpl      112       44    0        2     2     0     2     2     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     2059    0      543    96     0    96    96     0     8    0
ffsino     296     2059    0      543   118     0   118   118     0     8    0
nchpl      144     2585    0      886    64     0    64    64     0     8    0
rtmask      32        2    0        2     1     1     0     1     0     8    0
vnodes     216     2308    0        0   129     0   129   129     0     8    0
namei      1024    8443    0     8442     4     2     2     2     0     8    1
percpumem   16       67    0       17     1     0     1     1     0     8    0
vcpupl     3968       1    0        0     1     0     1     1     0     8    0
vmpool     848        1    0        0     1     0     1     1     0     8    0
kstatmem   264       48    0       22     3     1     2     3     0     8    0
scxspl     216    13974    0    13974     3     2     1     2     1     8    1
plimitpl   152       72    0       54     1     0     1     1     0     8    0
sigapl     424      680    0      632     7     1     6     7     0     8    0
knotepl    120      537    0        0    17     0    17    17     0     8    0
kqueuepl   224       92    0       79     1     0     1     1     0     8    0
pipepl     344      141    0      113     3     0     3     3     0     8    0
fdescpl    528      662    0      631     3     0     3     3     0     8    0
filepl     160     3524    0     3286    15     2    13    13     0     8    1
lockfpl    104       75    0       72     1     0     1     1     0     8    0
lockfspl    48       33    0       30     1     0     1     1     0     8    0
sessionpl  144       25    0       16     1     0     1     1     0     8    0
pgrppl      48       36    0       19     1     0     1     1     0     8    0
ucredpl    104      475    0      461     1     0     1     1     0     8    0
zombiepl   144      687    0      685     2     1     1     1     0     8    0
processpl  1232     680    0      632     5     0     5     5     0     8    0
procpl     664     1088    0     1031     6     0     6     6     0     8    0
sockpl     752      655    0      614    11     1    10    10     0     8    5
mcl64k     65536      2    0        0     1     0     1     1     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     110    0        0    14     0    14    14     0     8    0
mcl2k      2048      26    0        0     4     0     4     4     0     8    0
mtagpl      96       11    0        0     1     0     1     1     0     8    0
mbufpl     256      152    0        0    10     0    10    10     0     8    0
bufpl      280     5856    0      128   410     0   410   410     0     8    0
anonpl      32     9598    0        0    78     0    78    78     0   246    0
amapchunkpl 152   16748    0    16131    42    12    30    31     0   158    6
amappl16   200     2969    0     2742    26     7    19    19     0     8    1
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184        5    0        5     1     1     0     1     0     8    0
amappl13   176      427    0      426     1     0     1     1     0     8    0
amappl12   168     1069    0     1027     3     0     3     3     0     8    0
amappl11   160        5    0        5     1     1     0     1     0     8    0
amappl10   152       52    0       37     1     0     1     1     0     8    0
amappl9    144      280    0      280     1     1     0     1     0     8    0
amappl8    136       28    0       26     1     0     1     1     0     8    0
amappl7    128       83    0       82     1     0     1     1     0     8    0
amappl6    120      282    0      268     1     0     1     1     0     8    0
amappl5    112       89    0       79     1     0     1     1     0     8    0
amappl4    104      429    0      399     1     0     1     1     0     8    0
amappl3     96     2668    0     2577     4     1     3     3     0     8    0
amappl2     88      792    0      716     2     0     2     2     0     8    0
amappl1     80    10576    0     9980    15     1    14    15     0     8    0
amappl      88     4501    0     4333     5     0     5     5     0    92    0
uvmvnodes   80      110    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       47    0        2     1     0     1     1     0     8    0
uaddrrnd    24      662    0      631     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      662    0      631     1     0     1     1     0     8    0
vmmpekpl   168     7282    0     7240     3     0     3     3     0     8    0
vmmpepl    168    50624    0    48500   115    14   101   101     0   357    1
vmsppl     488      661    0      631     6     1     5     5     0     8    0
rwobjpl     80    17597    0    16317    31     1    30    30     0     8    0
pdppl      4096    1334    0     1263   109    34    75    86     0     8    4
pvpl        32    18006    0        0   147     1   146   147     0   265    0
pmappl     256      662    0      631     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      294    0       40     8     0     8     8     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff837e3ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83902bc0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83902bc0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
__mp_acquire_count(ffffffff83902bc0,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2d8 sys/kern/kern_synch.c:369
biowait(fffffd806d16f030) at biowait+0xc6 sys/kern/vfs_bio.c:1242
bwrite(fffffd806d16f030) at bwrite+0x2e7 sys/kern/vfs_bio.c:754
VOP_BWRITE(fffffd806d16f030) at VOP_BWRITE+0x60 sys/kern/vfs_vops.c:651
ufs_direnter(fffffd806d44f7d8,fffffd805ec279a0,ffff80002a3bc240,ffff80002a3bc570,fffffd8067b2e8e0) at ufs_direnter+0x7ac sys/ufs/ufs/ufs_lookup.c:833
ufs_mkdir(ffff80002a3bc3e0) at ufs_mkdir+0x5d5 sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(fffffd806d44f7d8,ffff80002a3bc540,ffff80002a3bc570,ffff80002a3bc470) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff8000fffee7e0,ffffff9c,7e8fd7ddab20,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3113
syscall(ffff80002a3bc6f0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a3bc6f0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
end trace frame: 0xffff80002a3bc770, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff837e3ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83902bc0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83902bc0) at __mp_lock+0x192 sys/kern/kern_lock.c:173
__mp_acquire_count(ffffffff83902bc0,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
sleep_finish(ffffffffffffffff,1) at sleep_finish+0x2d8 sys/kern/kern_synch.c:369
biowait(fffffd806d16f030) at biowait+0xc6 sys/kern/vfs_bio.c:1242
bwrite(fffffd806d16f030) at bwrite+0x2e7 sys/kern/vfs_bio.c:754
VOP_BWRITE(fffffd806d16f030) at VOP_BWRITE+0x60 sys/kern/vfs_vops.c:651
ufs_direnter(fffffd806d44f7d8,fffffd805ec279a0,ffff80002a3bc240,ffff80002a3bc570,fffffd8067b2e8e0) at ufs_direnter+0x7ac sys/ufs/ufs/ufs_lookup.c:833
ufs_mkdir(ffff80002a3bc3e0) at ufs_mkdir+0x5d5 sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(fffffd806d44f7d8,ffff80002a3bc540,ffff80002a3bc570,ffff80002a3bc470) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff8000fffee7e0,ffffff9c,7e8fd7ddab20,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3113
syscall(ffff80002a3bc6f0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a3bc6f0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:775
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7e8fd7ddabc0, count: -15
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833b4a35) at panic+0x1e5 sys/kern/subr_prf.c:198
witness_checkorder(ffff80000158b878,1,0) at witness_checkorder+0x122c sys/kern/subr_witness.c:854
rw_do_enter_read(ffff80000158b860,0) at rw_do_enter_read+0x99 sys/kern/kern_rwlock.c:355
in6_hasmulti(fffffd8069f4eff0,ffff80000158b800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd8069f4eff0,ffff80000158b800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd8069f4ef00,ffffffff839eee58,0,0,ffff80002a1fe880,0) at ip6_output+0x13bd sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff8000015ac880,83,0) at mld6_sendpkt+0x385 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff83a15020) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff83835dd8,ffffffff83a15020) at timeout_run+0x159 sys/kern/kern_timeout.c:698
softclock_thread_run(ffffffff83835dd8) at softclock_thread_run+0xe7 sys/kern/kern_timeout.c:842
softclock_thread_mp(ffff8000ffffea60) at softclock_thread_mp+0x86
end trace frame: 0x0, count: 3
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff833b4a35) at panic+0x1e5 sys/kern/subr_prf.c:198
witness_checkorder(ffff80000158b878,1,0) at witness_checkorder+0x122c sys/kern/subr_witness.c:854
rw_do_enter_read(ffff80000158b860,0) at rw_do_enter_read+0x99 sys/kern/kern_rwlock.c:355
in6_hasmulti(fffffd8069f4eff0,ffff80000158b800) at in6_hasmulti+0x41 in6_lookupmulti sys/netinet6/in6.c:-1 [inline]
in6_hasmulti(fffffd8069f4eff0,ffff80000158b800) at in6_hasmulti+0x41 sys/netinet6/in6.c:1150
ip6_output(fffffd8069f4ef00,ffffffff839eee58,0,0,ffff80002a1fe880,0) at ip6_output+0x13bd sys/netinet6/ip6_output.c:507
mld6_sendpkt(ffff8000015ac880,83,0) at mld6_sendpkt+0x385 sys/netinet6/mld6.c:499
mld6_fasttimo() at mld6_fasttimo+0x16d mld6_checktimer sys/netinet6/mld6.c:395 [inline]
mld6_fasttimo() at mld6_fasttimo+0x16d sys/netinet6/mld6.c:369
pffasttimo(ffffffff83a15020) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff83835dd8,ffffffff83a15020) at timeout_run+0x159 sys/kern/kern_timeout.c:698
softclock_thread_run(ffffffff83835dd8) at softclock_thread_run+0xe7 sys/kern/kern_timeout.c:842
softclock_thread_mp(ffff8000ffffea60) at softclock_thread_mp+0x86
end trace frame: 0x0, count: -12

Crashes (1910):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/04 14:40 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 14:23 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 14:09 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 13:53 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 13:37 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 13:27 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 13:12 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 12:55 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 12:40 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 12:29 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 12:11 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 11:59 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 11:38 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 11:22 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 11:08 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 10:50 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 10:35 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 10:23 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 10:11 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 09:50 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 09:35 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 09:17 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 08:56 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 08:41 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 08:26 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 08:07 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 07:52 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 07:37 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 07:19 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 07:02 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 06:37 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 06:17 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 06:03 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 05:44 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 05:26 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 05:05 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 04:50 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 04:27 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 04:14 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 03:59 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 03:44 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/04 03:24 openbsd f9943f26ca81 e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
2026/01/03 12:51 openbsd 80bc9799356e e3fbc05e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: shared lock of (rwlock) maddr while exclusively locked
* Struck through repros no longer work on HEAD.