syzbot


witness: reversal: lock order data missing (3)

Status: upstream: reported on 2022/03/15 20:04
Reported-by: syzbot+444b020a92d87d6ded8b@syzkaller.appspotmail.com
Fix commit: Release PF und NET lock before calling copyout for DIOCIGETIFACES.
Patched on: [], missing on: [ci-openbsd-main ci-openbsd-multicore ci-openbsd-setuid]
First crash: 762d, last: 723d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: lock order data missing (2) C 173 918d 1068d 0/3 closed as invalid on 2022/02/22 18:44
openbsd witness: reversal: lock order data missing C 667 1068d 1138d 3/3 fixed on 2021/05/14 01:59

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff8294c010 pf_lock (pf_lock)
 2nd 0xffffffff82944ee0 netlock (netlock)
lock order "netlock"(rwlock) -> "pf_lock"(rwlock) first seen at:
#0  rw_enter_write+0x5b sys/kern/kern_rwlock.c:128
#1  pfioctl+0x417c sys/net/pf_ioctl.c:2964
#2  VOP_IOCTL+0x96 sys/kern/vfs_vops.c:264
#3  vn_ioctl+0xbc sys/kern/vfs_vnops.c:531
#4  sys_ioctl+0x4a2
#5  syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#5  syscall+0x489 sys/arch/amd64/amd64/trap.c:585
#6  Xsyscall+0x128
lock order data w1 -> w2 missing
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
witness_checkorder(ffffffff82944ee0,9,0) at witness_checkorder+0x10b7 witness_debugger sys/kern/subr_witness.c:2502 [inline]
witness_checkorder(ffffffff82944ee0,9,0) at witness_checkorder+0x10b7 sys/kern/subr_witness.c:1105
rw_enter_write(ffffffff82944ed0) at rw_enter_write+0x5b sys/kern/kern_rwlock.c:128
uvn_io(fffffd805aba5890,ffff80002e2200b8,1,202,0) at uvn_io+0x418 sys/uvm/uvm_vnode.c:1245
uvn_get(fffffd805aba5890,1000,ffff80002e220178,ffff80002e220148,0,2,d5b0a9c891e1afc5,0) at uvn_get+0x1df sys/uvm/uvm_vnode.c:1078
uvm_fault_lower(ffff80002e2202e0,ffff80002e220318,ffff80002e220260,0) at uvm_fault_lower+0x36c sys/uvm/uvm_fault.c:1275
uvm_fault(fffffd8064a50478,20001000,0,2) at uvm_fault+0x248
kpageflttrap(ffff80002e220470,20001000) at kpageflttrap+0x209
kerntrap(ffff80002e220470) at kerntrap+0xef sys/arch/amd64/amd64/trap.c:318
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x53
pfioctl(4900,c0284457,ffff80002e2208e0,1,ffff80002121f508) at pfioctl+0x4516 sys/net/pf_ioctl.c:2932
VOP_IOCTL(fffffd806f6828e8,c0284457,ffff80002e2208e0,1,fffffd807f7d7600,ffff80002121f508) at VOP_IOCTL+0x96 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd8065095688,c0284457,ffff80002e2208e0,ffff80002121f508) at vn_ioctl+0xbc sys/kern/vfs_vnops.c:531
sys_ioctl(ffff80002121f508,ffff80002e2209f8,ffff80002e220a50) at sys_ioctl+0x4a2
syscall(ffff80002e220ac0) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002e220ac0) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3751306a2f0, count: -17
ddb{0}> show registers
rdi                              0x3
rsi               0xffffffff82962980    __sancov_gen_cov_switch_values.134
rbp               0xffff80002e21fe80
rbx                              0x3
rdx                                0
rcx                                0
rax               0xffff80002121f508
r8                0xffff80002e21fe40
r9                0x8080808080808080
r10               0x21e3b190de65b15c
r11               0xe30d294a7e0b379c
r12               0xffffffff82ac8170    w_lodata+0x52800
r13                                0
r14                                0
r15               0xfffffd8002f78840
rip               0xffffffff81978268    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff80002e21fe70
ss                                 0
db_enter+0x18:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor.2) pid=174017 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=17, usrpri=84, nice=20
    forw=0xffffffffffffffff, list=0xffff80002121ed28,0xffff80002121e018
    process=0xffff8000fffedd38 user=0xffff80002e21b000, vmspace=0xfffffd8064a50478
    estcpu=34, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  1374  230134  51939      0  3        0x80  nanoslp       syz-executor.0
  1374  374192  51939      0  3   0x4000080  fsleep        syz-executor.0
 81851  387630  90553      0  2           0                syz-executor.5
 81851  145220  90553      0  3   0x4000080  nanoslp       syz-executor.5
 81851   42028  90553      0  3   0x4000080  fsleep        syz-executor.5
 43188   80215  31526      0  3        0x80  nanoslp       syz-executor.3
 43188   37026  31526      0  3   0x4000080  fsleep        syz-executor.3
 43188  385729  31526      0  3   0x4000080  fsleep        syz-executor.3
 80388  251147  61898      0  2         0x1                syz-executor.2
*80388  174017  61898      0  7   0x4000000                syz-executor.2
 31526  183064  58434      0  3        0x82  nanoslp       syz-executor.3
 56695  500561  58434      0  3        0x82  nanoslp       syz-executor.6
 82485  434034  58434      0  3        0x82  nanoslp       syz-executor.4
  2148  235258  58434      0  3         0x2  biowait       syz-executor.1
 51939   61434  58434      0  3        0x82  nanoslp       syz-executor.0
 90553  510766  58434      0  3        0x82  nanoslp       syz-executor.5
 98793  169035  58434      0  3        0x82  nanoslp       syz-executor.7
 61898   47702  58434      0  3        0x82  nanoslp       syz-executor.2
 11953  470392      1      0  3    0x100083  ttyin         getty
 39358  500929      0      0  3     0x14200  acct          acct
 25729  316607      0      0  3     0x14280  nfsidl        nfsio
 29595  422667      0      0  3     0x14280  nfsidl        nfsio
 88837   89905      0      0  3     0x14280  nfsidl        nfsio
 26844  302110      0      0  3     0x14280  nfsidl        nfsio
 19854  255816      0      0  3     0x14280  nfsidl        nfsio
 92657  494473      0      0  3     0x14280  nfsidl        nfsio
 19982   26558      0      0  3     0x14280  nfsidl        nfsio
 69963   25271      0      0  3     0x14280  nfsidl        nfsio
 27428  519372      0      0  3     0x14280  nfsidl        nfsio
 22828  335200      0      0  3     0x14280  nfsidl        nfsio
 92575  343234      0      0  3     0x14280  nfsidl        nfsio
 45456  204491      0      0  3     0x14280  nfsidl        nfsio
 38650   50168      0      0  3     0x14280  nfsidl        nfsio
  5915   72461      0      0  3     0x14280  nfsidl        nfsio
 20880  129249      0      0  3     0x14280  nfsidl        nfsio
 24475   16093      0      0  3     0x14280  nfsidl        nfsio
 78953  253719      0      0  3     0x14280  nfsidl        nfsio
 36871   91045      0      0  3     0x14280  nfsidl        nfsio
 33342   41355      0      0  3     0x14280  nfsidl        nfsio
 79705  224505      0      0  3     0x14280  nfsidl        nfsio
 75148  479208      0      0  3     0x14200  bored         sosplice
 58434  209917  58964      0  3        0x82  thrsleep      syz-fuzzer
 58434  500731  58964      0  3   0x4000082  nanoslp       syz-fuzzer
 58434  169330  58964      0  3   0x4000082  thrsleep      syz-fuzzer
 58434  516786  58964      0  3   0x4000082  nanoslp       syz-fuzzer
 58434  361600  58964      0  3   0x4000082  thrsleep      syz-fuzzer
 58434  392530  58964      0  3   0x4000082  thrsleep      syz-fuzzer
 58434  174458  58964      0  3   0x4000082  kqread        syz-fuzzer
 58434  105315  58964      0  3   0x4000082  thrsleep      syz-fuzzer
 58434  478625  58964      0  3   0x4000082  thrsleep      syz-fuzzer
 58964  147032   5625      0  3    0x10008a  sigsusp       ksh
  5625  429922  59445      0  3        0x9a  kqread        sshd
 59445  322744      1      0  3        0x88  kqread        sshd
 90699  387766  46010     74  3   0x1100092  bpf           pflogd
 46010  508663      1      0  3        0x80  netio         pflogd
 82342  295106  77055     73  3   0x1100090  kqread        syslogd
 77055  320330      1      0  3    0x100082  netio         syslogd
 31871  255381      1      0  3    0x100080  kqread        resolvd
 22182  256834  68939     77  3    0x100092  kqread        dhcpleased
 79950  152473  68939     77  3    0x100092  kqread        dhcpleased
 68939  451843      1      0  3        0x80  kqread        dhcpleased
 19666  447612      0      0  3     0x14200  bored         smr
 59536   47977      0      0  2     0x14200                zerothread
  6025  110747      0      0  3     0x14200  aiodoned      aiodoned
 96045   60840      0      0  3     0x14200  syncer        update
 74316  458864      0      0  3     0x14200  cleaner       cleaner
 83872  211299      0      0  3     0x14200  reaper        reaper
 42119  136572      0      0  3     0x14200  pgdaemon      pagedaemon
    51  397824      0      0  3     0x14200  bored         viomb
 72284  410158      0      0  3  0x40014200  acpi0         acpi0
 97787  188454      0      0  7  0x40014200                idle1
 57658  397092      0      0  3     0x14200  bored         softnet
 95857  230282      0      0  3     0x14200  bored         systqmp
 30517  470329      0      0  3     0x14200  bored         systq
 54077  168460      0      0  3  0x40014200  bored         softclock
 64674  206826      0      0  3  0x40014200                idle0
     1  386957      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> show all locks
Process 80388 (syz-executor.2) thread 0xffff80002121f508 (174017)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82a1ad58)
#0  witness_lock+0x44d
#1  __mp_acquire_count+0x48 sys/kern/kern_lock.c:227
#2  mi_switch+0x3d3 sys/kern/sched_bsd.c:416
#3  sleep_finish+0x198 sys/kern/kern_synch.c:437
#4  tsleep+0x12c sys/kern/kern_synch.c:158
#5  getblk+0x13c sys/kern/vfs_bio.c:1031
#6  bread+0x3a bio_doread sys/kern/vfs_bio.c:436 [inline]
#6  bread+0x3a sys/kern/vfs_bio.c:481
#7  ffs_read+0x313
#8  VOP_READ+0xbf sys/kern/vfs_vops.c:227
#9  uvn_io+0x3ce
#10 uvn_get+0x1df sys/uvm/uvm_vnode.c:1078
#11 uvm_fault_lower+0x36c sys/uvm/uvm_fault.c:1275
#12 uvm_fault+0x248
#13 kpageflttrap+0x209
#14 kerntrap+0xef sys/arch/amd64/amd64/trap.c:318
#15 alltraps_kern_meltdown+0x7b
#16 copyout+0x53
#17 pfioctl+0x4516 sys/net/pf_ioctl.c:2932
#18 VOP_IOCTL+0x96 sys/kern/vfs_vops.c:264
exclusive rwlock pf_lock r = 0 (0xffffffff8294c010)
#0  witness_lock+0x44d
#1  pfioctl+0x4504 sys/net/pf_ioctl.c:2931
#2  VOP_IOCTL+0x96 sys/kern/vfs_vops.c:264
#3  vn_ioctl+0xbc sys/kern/vfs_vnops.c:531
#4  sys_ioctl+0x4a2
#5  syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#5  syscall+0x489 sys/arch/amd64/amd64/trap.c:585
#6  Xsyscall+0x128
shared rwlock pfioctl_rw r = 0 (0xffffffff8294c070)
#0  witness_lock+0x44d
#1  pfioctl+0x946 sys/net/pf_ioctl.c:1150
#2  VOP_IOCTL+0x96 sys/kern/vfs_vops.c:264
#3  vn_ioctl+0xbc sys/kern/vfs_vnops.c:531
#4  sys_ioctl+0x4a2
#5  syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#5  syscall+0x489 sys/arch/amd64/amd64/trap.c:585
#6  Xsyscall+0x128
Process 2148 (syz-executor.1) thread 0xffff80002119e000 (235258)
exclusive rrwlock inode r = 0 (0xfffffd806415f1b8)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:461
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:534
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:579
#5  vget+0x1d3 sys/kern/vfs_subr.c:678
#6  ufs_ihashget+0x121 sys/ufs/ufs/ufs_ihash.c:119
#7  ffs_vget+0x7c sys/ufs/ffs/ffs_vfsops.c:1318
#8  ufs_lookup+0x13ba sys/ufs/ufs/ufs_lookup.c:487
#9  VOP_LOOKUP+0x58 sys/kern/vfs_vops.c:85
#10 vfs_lookup+0x6e5 sys/kern/vfs_lookup.c:561
#11 namei+0x36a sys/kern/vfs_lookup.c:245
#12 dounlinkat+0x99 sys/kern/vfs_syscalls.c:1850
#13 syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#13 syscall+0x489 sys/arch/amd64/amd64/trap.c:585
#14 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd8067f5ae68)
#0  witness_lock+0x44d
#1  rw_enter+0x3e1 sys/kern/kern_rwlock.c:310
#2  rrw_enter+0x8b sys/kern/kern_rwlock.c:461
#3  VOP_LOCK+0x87 sys/kern/vfs_vops.c:534
#4  vn_lock+0x84 sys/kern/vfs_vnops.c:579
#5  vget+0x1d3 sys/kern/vfs_subr.c:678
#6  cache_lookup+0x2b4 sys/kern/vfs_cache.c:224
#7  ufs_lookup+0x1ac sys/ufs/ufs/ufs_lookup.c:162
#8  VOP_LOOKUP+0x58 sys/kern/vfs_vops.c:85
#9  vfs_lookup+0x6e5 sys/kern/vfs_lookup.c:561
#10 namei+0x36a sys/kern/vfs_lookup.c:245
#11 dounlinkat+0x99 sys/kern/vfs_syscalls.c:1850
#12 syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
#12 syscall+0x489 sys/arch/amd64/amd64/trap.c:585
#13 Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10237   6529K   10811K  78643K     91103        0
            pcb    13     24K      28K  78643K      6554        0
         rtable   242     12K      12K  78643K      6483        0
         ifaddr   113     32K      39K  78643K      2642        0
         sysctl     3      1K       2K  78643K         9        0
       counters    62     36K      36K  78643K      1080        0
       ioctlops     0      0K       4K  78643K      9284        0
            iov     0      0K      40K  78643K     54011        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         5        0
         vnodes  1780    111K     111K  78643K     27276        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       9K  78643K       473        0
         VM map     2      1K       1K  78643K         2        0
            sem    23     20K      36K  78643K      3003        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    14     49K      89K  78643K     46588        0
          sigio     0      0K       0K  78643K       583        0
           proc    73     91K     128K  78643K      5659        0
        subproc   104      6K      14K  78643K      2111        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K      2498        0
       in_multi    96      6K       7K  78643K      2633        0
    ether_multi     1      0K       0K  78643K       426        0
            mrt     2      0K       0K  78643K       150        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys   253   1129K    1129K  78643K       253        0
           exec     0      0K       2K  78643K      9766        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   801   1913K    1927K  78643K    263638        0
       UVM aobj   131      8K       8K  78643K       131        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K      2401        0
            NDP    17      0K       1K  78643K       825        0
           temp   165   4759K    5015K  78643K    364672        0
         kqueue    12     18K      28K  78643K      2286        0
      SYN cache     2     16K      16K  78643K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       22    0        0     1     0     1     1     0     8    0
rtpcb      120     2756    0     2753    37    36     1     5     0     8    0
rtentry    112     2185    0     2078     6     2     4     4     0     8    0
unpcb      136    28947    0    28932   314   308     6     9     0     8    5
syncache   296      167    0      167    38    38     0     1     0     8    0
tcpqe       32      167   18      167    17    17     0     1     0     8    0
tcpcb      736    14997    0    14993   494   493     1    20     0     8    0
arp        120      316    0      297     1     0     1     1     0     8    0
inpcb      312    39512    0    39505   507   501     6    17     0     8    5
nd6         48      419    0      395     1     0     1     1     0     8    0
pkpcb       40      205    0      205    25    25     0     1     0     8    0
kcovpl      48      127    0      119     1     0     1     1     0     8    0
ppxss      1248     289    0      289    43    43     0     1     0     8    0
pfstscr     40        4    0        3     1     0     1     1     0     8    0
pffrag     232      141    0      140    14    13     1     1     0   482    0
pffrnode    88      141    0      140    14    13     1     1     0     8    0
pffrent     40      494    0      493    15    14     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344      12    0       11     1     0     1     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfstitem    24       40    0       36     1     0     1     1     0     8    0
pfstkey    112      174    0      170     1     0     1     1     0     8    0
pfstate    336      106    0      103     2     0     2     2     0     8    0
pfrule     1360     116    0      108     3     2     1     2     0     8    0
rttmrq      48      165    0      161     1     0     1     1     0     8    0
rttmr       72       33    0       33    10    10     0     1     0     8    0
art_heap8  4096       7    0        6     6     5     1     3     0     8    0
art_heap4  256     8929    0     8496    62    34    28    30     0     8    0
art_table   32     8936    0     8502     5     1     4     4     0     8    0
art_node    16     2069    0     1976     1     0     1     1     0     8    0
sysvmsgpl   40        8    0        2     1     0     1     1     0     8    0
semupl     112        3    0        3     2     2     0     1     0     8    0
semapl     112     2988    0     2967     1     0     1     1     0     8    0
shmpl      112      128    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256    71808    0    70247    98     0    98    98     0     8    0
ffsino     272    71808    0    70247   105     0   105   105     0     8    0
nchpl      144   140416    0   138758    63     0    63    63     0     8    0
uvmvnodes   80     8194    0        0   168     0   168   168     0     8    0
vnodes     224     8194    0        0   482     0   482   482     0     8    0
namei      1024  503815    0   503815    15    14     1     2     0     8    1
percpumem   16      552    0      509     1     0     1     1     0     8    0
vcpupl     2048     438    0        0    55     0    55    55     0     8    0
vmpool     560      512    0       74    32     0    32    32     0     8    0
pfiaddrpl  120        7    0        7     1     1     0     1     0     8    0
kstatmem   264     1052    0     1018     7     4     3     3     0     8    0
scsiplug    72       29    0       29    10    10     0     1     0     8    0
scxspl     216   390324    0   390323    34    33     1     8     0     8    0
plimitpl   152     6127    0     6112     1     0     1     1     0     8    0
sigapl     424    46680    0    46614     8     0     8     8     0     8    0
futexpl     64   491972    0   491968     8     7     1     1     0     8    0
knotepl    120     2072    0        0    12     1    11    12     0     8    0
kqueuepl   216     9749    0     9741   182   181     1     8     0     8    0
pipepl     336     9345    0     9317   238   235     3     8     0     8    0
fdescpl    496    46635    0    46608     5     0     5     5     0     8    0
filepl     152   335754    0   335506   441   424    17    24     0     8    7
lockfpl    104    62087    0    62082   101   100     1     4     0     8    0
lockfspl    48    13844    0    13839     2     1     1     2     0     8    0
sessionpl  144      147    0      130     1     0     1     1     0     8    0
pgrppl      48      399    0      382     1     0     1     1     0     8    0
ucredpl     96    34039    0    34026     1     0     1     1     0     8    0
zombiepl   144    46617    0    46614     5     4     1     1     0     8    0
processpl  1064   46680    0    46614     5     0     5     5     0     8    0
procpl     672   117030    0   116950    29    21     8     9     0     8    0
srpgc       96      166    0      166    55    55     0     1     0     8    0
sosppl     168      232    0      232    35    35     0     1     0     8    0
sockpl     480    71448    0    71418  1537  1518    19    36     0     8   14
mcl64k     65536     12    0        0     2     0     2     2     0     8    0
mcl16k     16384      5    0        0     1     0     1     1     0     8    0
mcl12k     12288     11    0        0     2     0     2     2     0     8    0
mcl9k      9216       6    0        0     1     0     1     1     0     8    0
mcl8k      8192      18    0        0     3     0     3     3     0     8    0
mcl4k      4096      17    0        0     3     0     3     3     0     8    0
mcl2k2     2112       6    0        0     1     0     1     1     0     8    0
mcl2k      2048     613    0        0    43     6    37    38     0     8    0
mtagpl      96     2183    0        0    24     1    23    23     0     8    0
mbufpl     256     9201    0        0   475     0   475   475     0     8    0
bufpl      288    77098    0    68903   586     0   586   586     0     8    0
anonpl      24  8607399    0  8586889   521   386   135   158     0   186    1
amapchunkpl 152  738894    0   738032   176   139    37    55     0   158    0
amappl16   200   117214    0   116494   339   299    40    53     0     8    0
amappl15   192     9312    0     9305     1     0     1     1     0     8    0
amappl14   184     2557    0     2550     1     0     1     1     0     8    0
amappl13   176     7134    0     7132     1     0     1     1     0     8    0
amappl12   168     6835    0     6828     1     0     1     1     0     8    0
amappl11   160     4704    0     4684     3     2     1     2     0     8    0
amappl10   152     5038    0     5026     1     0     1     1     0     8    0
amappl9    144     7343    0     7339     1     0     1     1     0     8    0
amappl8    136     9375    0     9122     9     0     9     9     0     8    0
amappl7    128     6187    0     6171     1     0     1     1     0     8    0
amappl6    120     7956    0     7926     2     1     1     2     0     8    0
amappl5    112    40695    0    40675     1     0     1     1     0     8    0
amappl4    104    12139    0    12098     5     3     2     2     0     8    0
amappl3     96   143568    0   143516     2     0     2     2     0     8    0
amappl2     88    58144    0    58057     6     3     3     3     0     8    0
amappl1     80  1081789    0  1081157    36    21    15    20     0     8    0
amappl      88   250049    0   249722    11     2     9     9     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      130    0        0     3     0     3     3     0     8    0
uaddrrnd    24    47147    0    46682     4     1     3     3     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24    47147    0    46682     4     1     3     3     0     8    0
vmmpekpl   168   287774    0   287659     6     0     6     6     0     8    0
vmmpepl    168  4548746    0  4544382   636   408   228   237     0   357    8
vmsppl     368    47146    0    46682    45     2    43    43     0     8    0
rwobjpl     56  1048577    0  1038138   200    51   149   149     0     8    0
pdppl      4096   94301    0    93802  2003  1496   507   509     0     8    8
pvpl        32 17099957    0 17076746   971   765   206   268     0   265    1
pmappl     248    47146    0    46682    31     1    30    30     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112     4752    0     2790    58     1    57    57     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:437
witness_checkorder(ffffffff82944ee0,9,0) at witness_checkorder+0x10b7 witness_debugger sys/kern/subr_witness.c:2502 [inline]
witness_checkorder(ffffffff82944ee0,9,0) at witness_checkorder+0x10b7 sys/kern/subr_witness.c:1105
rw_enter_write(ffffffff82944ed0) at rw_enter_write+0x5b sys/kern/kern_rwlock.c:128
uvn_io(fffffd805aba5890,ffff80002e2200b8,1,202,0) at uvn_io+0x418 sys/uvm/uvm_vnode.c:1245
uvn_get(fffffd805aba5890,1000,ffff80002e220178,ffff80002e220148,0,2,d5b0a9c891e1afc5,0) at uvn_get+0x1df sys/uvm/uvm_vnode.c:1078
uvm_fault_lower(ffff80002e2202e0,ffff80002e220318,ffff80002e220260,0) at uvm_fault_lower+0x36c sys/uvm/uvm_fault.c:1275
uvm_fault(fffffd8064a50478,20001000,0,2) at uvm_fault+0x248
kpageflttrap(ffff80002e220470,20001000) at kpageflttrap+0x209
kerntrap(ffff80002e220470) at kerntrap+0xef sys/arch/amd64/amd64/trap.c:318
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x53
pfioctl(4900,c0284457,ffff80002e2208e0,1,ffff80002121f508) at pfioctl+0x4516 sys/net/pf_ioctl.c:2932
VOP_IOCTL(fffffd806f6828e8,c0284457,ffff80002e2208e0,1,fffffd807f7d7600,ffff80002121f508) at VOP_IOCTL+0x96 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd8065095688,c0284457,ffff80002e2208e0,ffff80002121f508) at vn_ioctl+0xbc sys/kern/vfs_vnops.c:531
sys_ioctl(ffff80002121f508,ffff80002e2209f8,ffff80002e220a50) at sys_ioctl+0x4a2
syscall(ffff80002e220ac0) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff80002e220ac0) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3751306a2f0, count: -17
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x1a:        addq    $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff800020ce8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23
acpicpu_idle() at acpicpu_idle+0x312 sys/dev/acpi/acpicpu.c:1206
sched_idle(ffff800020ce8ff0) at sched_idle+0x417 sys/kern/kern_sched.c:178
end trace frame: 0x0, count: -5

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/04/23 09:19 openbsd 62198fa5a9d0 131df97d .config console log report ci-openbsd-multicore witness: reversal: lock order data missing
2022/03/15 20:04 openbsd 4141bb4bac68 9e8eaa75 .config console log report ci-openbsd-multicore witness: reversal: lock order data missing
* Struck through repros no longer work on HEAD.