witness: reversal: pf_lock netlock (4)

Status: upstream: reported on 2026/05/10 04:56
Reported-by: syzbot+65be7385fa082665e7e8@syzkaller.appspotmail.com
First crash: 162d, last: 1h20m
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd witness: reversal: pf_lock netlock (2) -1 syz, C 2 1654d 1654d 3/4 fixed on 2022/04/10 04:45
openbsd witness: reversal: pf_lock netlock (3) -1 syz 25 1634d 1646d 3/4 fixed on 2022/04/29 14:56
openbsd witness: reversal: pf_lock netlock -1 syz, C 19 1666d 1718d 3/4 fixed on 2022/04/08 05:01

Sample crash report:
witness: lock order reversal:
 1st 0xffffffff839aa6c8 pf_lock (pf_lock)
 2nd 0xffffffff83976af0 netlock (netlock)
lock order [1] pf_lock (pf_lock) -> [2] netlock (netlock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  uvn_io+0x54c sys/uvm/uvm_vnode.c:1244
#2  uvn_get+0x31d sys/uvm/uvm_vnode.c:1076
#3  uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
#4  uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
#5  uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
#6  kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
#7  kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
#8  alltraps_kern_meltdown+0x7b
#9  _copyin+0x5b
#10 pfioctl+0x1377 sys/net/pf_ioctl.c:3284
#11 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#12 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#13 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#14 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#14 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#15 Xsyscall+0x128
lock order [2] netlock (netlock) -> [1] pf_lock (pf_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  pfi_attach_ifgroup+0x2a sys/net/pf_if.c:357
#2  if_addgroup+0x2f8 if_creategroup sys/net/if.c:3059 [inline]
#2  if_addgroup+0x2f8 sys/net/if.c:3097
#3  if_attachsetup+0xcf sys/net/if.c:512
#4  if_attach+0x6d sys/net/if.c:604
#5  vio_attach+0x1853 sys/dev/pv/if_vio.c:935
#6  config_attach+0x449 sys/kern/subr_autoconf.c:421
#7  virtio_pci_attach+0x4e6 sys/dev/pci/virtio_pci.c:673
#8  config_attach+0x449 sys/kern/subr_autoconf.c:421
#9  pci_probe_device+0x8e5 sys/dev/pci/pci.c:574
#10 pci_enumerate_bus+0x368 sys/dev/pci/pci.c:877
#11 config_attach+0x449 sys/kern/subr_autoconf.c:421
#12 acpipci_attach_bus+0x381 sys/arch/amd64/pci/acpipci.c:257
#13 acpipci_attach_busses+0x93 sys/arch/amd64/pci/acpipci.c:265
#14 mainbus_attach+0x304 sys/arch/amd64/amd64/mainbus.c:222
#15 config_attach+0x449 sys/kern/subr_autoconf.c:421
#16 cpu_configure+0x47 sys/arch/amd64/amd64/autoconf.c:124
#17 main+0x4c7 sys/kern/init_main.c:345
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> show kasan
No such command
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff83976af0,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff83976ad8,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(fffff4006cd40dd0,ffff80003839d7b8,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1244
uvn_get(fffff4006cd40dd0,0,ffff80003839d888,ffff80003839d86c,0,1,3e6e06bd75e2dabe,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1076
uvm_fault_lower_io(ffff80003839daa0,ffff80003839dad8,ffff80003839d920,ffff80003839d908) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80003839daa0,ffff80003839dad8,ffff80003839da20) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(fffff4006cefe3e8,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80003839dc50,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff80003839dc50) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(24900,c4504441,ffff800001575000,1,ffff80002a21c010) at pfioctl+0x1377 sys/net/pf_ioctl.c:3284
VOP_IOCTL(fffff4007af467b8,c4504441,ffff800001575000,1,fffff400097fd618,ffff80002a21c010) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff4006cf0b710,c4504441,ffff800001575000,ffff80002a21c010) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80002a21c010,ffff80003839e800,ffff80003839e750) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003839e800) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003839e800) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc8ba5158d80, count: -18
ddb{1}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80003839d570
rbx                                0
rdx               0xffff8000015fb780
rcx               0xffff80002a21c010
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80003839d450
r9                0x8080808080808080
r10               0x286a96440fe5da97
r11               0xc31fcdb152e3edae
r12               0xfffff400041072c0
r13               0xfffff400048f6d68
r14                              0x3
r15               0xffffffff8355ee31    substchar+0x500b
rip               0xffffffff81991da5    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003839d560
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=130573 pid=53864 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800045fe9778,0xffff80002a21d248
    process=0xffff800045fe49d0 user=0xffff800038399000, vmspace=0xfffff4006cefe3e8
    estcpu=18, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 69806  247034  77039     0  7           0          0           syz-executor
 69806  365986  77039     0  3           0  0x4000080 fsleep    syz-executor
 69806  475067  77039     0  3           0  0x4000080 ttyin     syz-executor
 69806    8036  77039     0  3           0  0x4000080 ttyin     syz-executor
 50037  474535  71933     0  2           0          0           syz-executor
 52914  216642  27511     0  2           0          0           syz-executor
 52914  126800  27511     0  2           0  0x4000000           syz-executor
 53864  454666  62414     0  2           0          0           syz-executor
*53864  130573  62414     0  7           0  0x4000000           syz-executor
 52480  498845  24662     0  2         0x2          0           syz-executor
 96354   46328  74987     0  3         0x2          0 clonelk   ifconfig
 74987  252280  92902     0  3    0x100002       0x88 sigsusp   sh
 92902  205361  24662     0  3         0x2       0x80 wait      syz-executor
 64398  218137   5255     0  3           0       0x80 nanoslp   syz-executor
 64398  383491   5255     0  3           0  0x4000080 fsleep    syz-executor
 64398  434449   5255     0  3           0  0x4000080 kqpoll    syz-executor
 64398  375259   5255     0  3           0  0x4000080 fsleep    syz-executor
 71933  189580  24662     0  2         0x2          0           syz-executor
  8970   63196  24662     0  3         0x2       0x80 nanoslp   syz-executor
 27511  164119  24662     0  3         0x2       0x80 nanoslp   syz-executor
 62414  308704  24662     0  3         0x2       0x80 nanoslp   syz-executor
  5255  338230  24662     0  3         0x2       0x80 nanoslp   syz-executor
 77039    2180  24662     0  3         0x2       0x80 nanoslp   syz-executor
 24662  318503   5788     0  3         0x2       0x80 kqread    syz-executor
  5788  118605  50231     0  3    0x100002       0x88 sigsusp   ksh
 50231  107766  45306     0  3        0x10       0x88 kqread    sshd-session
 45306  203309  25207     0  3        0x12       0x80 kqread    sshd-session
 76641  497890      1     0  3    0x100003       0x80 ttyin     getty
 25207  387845      1     0  3           0       0x88 kqread    sshd
 74899  154153  19339    74  3   0x1100012       0x80 bpf       pflogd
 19339   80306      1     0  3           0       0x80 sbwait    pflogd
 78325   93232  22605    73  3   0x1100010       0x80 kqread    syslogd
 22605  115702      1     0  3    0x100002       0x80 sbwait    syslogd
 62477  465735      1     0  3    0x100000       0x80 kqread    resolvd
 81054   50889  71137    77  3    0x100012       0x80 kqread    dhcpleased
 14642  117484  71137    77  3    0x100012       0x80 kqread    dhcpleased
 71137   51845      1     0  3           0       0x80 kqread    dhcpleased
 68136  221863      0     0  3     0x14000      0x200 bored     smr
  1339  227530      0     0  2     0x14000      0x200           zerothread
 95118  368465      0     0  3     0x14000      0x200 aiodoned  aiodoned
 86497  206638      0     0  3     0x14000      0x200 syncer    update
 92127  188551      0     0  3     0x14000      0x200 cleaner   cleaner
 49443  178031      0     0  3     0x14000      0x200 reaper    reaper
 15158   66930      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 39463  513969      0     0  3     0x14000      0x200 bored     viomb
 78314  408080      0     0  3     0x14000 0x40000200 acpi0     acpi0
 39897  381822      0     0  3     0x14000 0x40000200           idle1
 90394  249762      0     0  3     0x14000      0x200 bored     softnet1
  1835  408452      0     0  2     0x14000      0x200           softnet0
 20226  204998      0     0  3     0x14000      0x200 smrbar    systqmp
 75602  138358      0     0  3     0x14000      0x200 bored     systq
 55317  423944      0     0  3     0x14000      0x200 tmoslp    softclockmp
 95496  252427      0     0  3     0x14000 0x40000200 tmoslp    softclock
 23728   93512      0     0  3     0x14000 0x40000200           idle0
     1  193710      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{1}> show all locks
Process 53864 (syz-executor) thread 0xffff80002a21c010 (130573)
exclusive rwlock pf_lock r = 0 (0xffffffff839aa6c8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1342 sys/net/pf_ioctl.c:3284
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive rwlock pfioctl_rw r = 0 (0xffffffff839aa758)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  pfioctl+0x1d4 sys/net/pf_ioctl.c:2064
#3  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#4  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#5  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#7  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83ac6c80)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_ioctl+0x4d sys/kern/vfs_vnops.c:520
#2  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#3  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#3  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
#4  Xsyscall+0x128
Process 20226 (systqmp) thread 0xffff800045ffe530 (204998)
shared rwlock systqmp r = 0 (0xffffffff83979b58)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11050  12082K   12214K 166960K     12161        0
            pcb    17     12K      12K 166960K        28        0
         rtable   195      5K       7K 166960K       359        0
             pf    33     17K      24K 166960K        61        0
         ifaddr    36      6K       7K 166960K        46        0
        ifgroup    52      2K       2K 166960K        60        0
         sysctl     1      1K       9K 166960K         5        0
       counters    68     36K      37K 166960K        72        0
       ioctlops     1      2K       4K 166960K      1490        0
            iov     0      0K       1K 166960K         2        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1296     82K      82K 166960K      1395        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       1K 166960K         2        0
         VM map     2      1K       1K 166960K         2        0
            sem     4      0K       0K 166960K         4        0
        dirhash    15      2K       2K 166960K        15        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K      89K 166960K       164        0
           proc    79    131K     164K 166960K       564        0
        subproc    72      4K       4K 166960K        90        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     1      0K       0K 166960K         9        0
       in_multi    77      5K       6K 166960K        99        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    43    201K     201K 166960K        43        0
           exec     0      0K       1K 166960K       396        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   231    176K     184K 166960K      3284        0
       UVM aobj     3      2K       4K 166960K         4        0
     pinsyscall    43     86K     102K 166960K      1354        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       0K 166960K         2        0
            NDP    23      1K       2K 166960K        29        0
           temp    34   9122K    9128K 166960K      3736        0
         kqueue    14     22K      22K 166960K        28        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       28    0        0     1     0     1     1     0     8    0
rtpcb      120       36    0       33     1     0     1     1     0     8    0
rtentry    176      112    0       23     6     0     6     6     0     8    0
unpcb      144       54    0       36     1     0     1     1     0     8    0
syncache   336        5    0        5     1     0     1     1     0     8    1
tcpcb      736       13    0        9     1     0     1     1     0     8    0
arp        136       18    0        4     1     0     1     1     0     8    0
inpcb      328       92    0       80     2     0     2     2     0     8    1
nd6        152       25    0        6     1     0     1     1     0     8    0
kcovpl      48        9    0        2     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1288       4    0        0     1     0     1     1     0     8    0
pfstitem    24       28    0        0     1     0     1     1     0     8    0
pfstkey    128       28    0        0     1     0     1     1     0     8    0
pfstate    448       28    0        0     4     0     4     4     0     8    0
pfrule     1360      21    0       16     2     1     1     2     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256      461    0        0    29     0    29    29     0     8    0
art_table   40      462    0        0     5     0     5     5     0     8    0
art_node    32      112    0       21     1     0     1     1     0     8    0
semapl      72        2    0        0     1     0     1     1     0     8    0
shmpl      120        1    0        1     1     0     1     1     0     8    1
dirhash    1024      19    0        0     3     0     3     3     0     8    0
dino2pl    256     1599    0      124    93     0    93    93     0     8    0
ffsino     296     1599    0      124   114     0   114   114     0     8    0
nchpl      144     1819    0      111    64     0    64    64     0     8    0
vnodes     216     1716    0        0    96     0    96    96     0     8    0
namei      1024    6443    0     6443     3     1     2     2     0     8    2
percpumem   16       52    0        2     1     0     1     1     0     8    0
kstatmem   264       29    0        4     2     0     2     2     0     8    0
scxspl     216     6340    0     6340     4     2     2     3     1     8    2
plimitpl   152       34    0       16     1     0     1     1     0     8    0
sigapl     424      486    0      438     7     0     7     7     0     8    0
knotepl    120       55    0        0     2     0     2     2     0     8    0
kqueuepl   224       26    0       16     1     0     1     1     0     8    0
pipepl     344      136    0      109     3     0     3     3     0     8    0
fdescpl    528      470    0      438     3     0     3     3     0     8    0
filepl     160     1717    0     1494    10     0    10    10     0     8    0
lockfpl    104       12    0        8     1     0     1     1     0     8    0
lockfspl    48        8    0        4     1     0     1     1     0     8    0
sessionpl  144       27    0       18     1     0     1     1     0     8    0
pgrppl      48       37    0       20     1     0     1     1     0     8    0
ucredpl    104      106    0       93     1     0     1     1     0     8    0
zombiepl   144      439    0      438     1     0     1     1     0     8    0
processpl  1240     486    0      438     5     0     5     5     0     8    0
procpl     664      527    0      471     6     0     6     6     0     8    1
sockpl     752      182    0      149     4     0     4     4     0     8    0
mcl8k      8192       2    0        0     1     0     1     1     0     8    0
mcl4k      4096     135    0        0    17     0    17    17     0     8    0
mcl2k      2048      23    0        0     3     0     3     3     0     8    0
mextrefs    64       20    0        0     1     0     1     1     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256      182    0        0    12     0    12    12     0     8    0
bufpl      272     2310    0      105   147     0   147   147     0     8    0
anonpl      32     3529    0        0    29     0    29    29     0   247    0
amapchunkpl 152    8700    0     8235    18     0    18    18     0   158    0
amappl16   200     1115    0     1100     4     0     4     4     0     8    3
amappl15   192        5    0        5     1     0     1     1     0     8    1
amappl14   184      453    0      450     1     0     1     1     0     8    0
amappl13   176      126    0      114     1     0     1     1     0     8    0
amappl12   168      740    0      711     2     0     2     2     0     8    0
amappl11   160        5    0        4     1     0     1     1     0     8    0
amappl10   152       67    0       53     1     0     1     1     0     8    0
amappl9    144      273    0      273     1     0     1     1     0     8    1
amappl8    136      115    0      113     1     0     1     1     0     8    0
amappl7    128      170    0      156     1     0     1     1     0     8    0
amappl6    120      154    0      151     1     0     1     1     0     8    0
amappl5    112      110    0      100     1     0     1     1     0     8    0
amappl4    104      311    0      290     1     0     1     1     0     8    0
amappl3     96     1562    0     1472     3     0     3     3     0     8    0
amappl2     88      595    0      520     2     0     2     2     0     8    0
amappl1     80    10693    0    10084    15     0    15    15     0     8    0
amappl      88     2524    0     2367     4     0     4     4     0    92    0
uvmvnodes   80      102    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        3    0        1     1     0     1     1     0     8    0
uaddrrnd    24      470    0      438     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      470    0      438     1     0     1     1     0     8    0
vmmpekpl   168     5969    0     5933     3     0     3     3     0     8    0
vmmpepl    168    39375    0    37492    86     0    86    86     0   357    3
vmsppl     488      469    0      438     5     0     5     5     0     8    0
rwobjpl     80    14266    0    13241    23     0    23    23     0     8    0
pdppl      4096     948    0      876    96    12    84    84     0     8   12
pvpl        32     9114    0        0    75     1    74    74     0   265    0
pmappl     256      469    0      438     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      419    0       16    12     0    12    12     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{0}> trace
x86_ipi_db(ffffffff83934ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83ac6480) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:142 [inline]
__mp_lock(ffffffff83ac6480) at __mp_lock+0x192 sys/kern/kern_lock.c:173
intr_handler(ffff80002a2a8a00,ffff800000079600) at intr_handler+0xe9 sys/arch/amd64/amd64/intr.c:560
Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f
__sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x44 sys/dev/kcov.c:159
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x76ec1207b8e0, count: -10
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(ffffffff83976af0,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(ffffffff83976ad8,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
uvn_io(fffff4006cd40dd0,ffff80003839d7b8,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1244
uvn_get(fffff4006cd40dd0,0,ffff80003839d888,ffff80003839d86c,0,1,3e6e06bd75e2dabe,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1076
uvm_fault_lower_io(ffff80003839daa0,ffff80003839dad8,ffff80003839d920,ffff80003839d908) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612
uvm_fault_lower(ffff80003839daa0,ffff80003839dad8,ffff80003839da20) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381
uvm_fault(fffff4006cefe3e8,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1
kpageflttrap(ffff80003839dc50,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285
kerntrap(ffff80003839dc50) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
_copyin() at _copyin+0x5b
pfioctl(24900,c4504441,ffff800001575000,1,ffff80002a21c010) at pfioctl+0x1377 sys/net/pf_ioctl.c:3284
VOP_IOCTL(fffff4007af467b8,c4504441,ffff800001575000,1,fffff400097fd618,ffff80002a21c010) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
vn_ioctl(fffff4006cf0b710,c4504441,ffff800001575000,ffff80002a21c010) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
sys_ioctl(ffff80002a21c010,ffff80003839e800,ffff80003839e750) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1
syscall(ffff80003839e800) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003839e800) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc8ba5158d80, count: -18

Crashes (388):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/19 16:47 openbsd 10825b7eb358 440f8011 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/18 22:57 openbsd 903d56f9b046 432c0077 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/18 19:16 openbsd 903d56f9b046 432c0077 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/18 07:48 openbsd c30c84965dc4 432c0077 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/15 23:15 openbsd 2976452f6b3c 3f2522c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/14 12:59 openbsd 662782962efe 1a71827b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/14 07:30 openbsd 0a0964b49541 7321cd29 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/13 12:40 openbsd 2779855b37e2 5a1eeac4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/12 23:05 openbsd 932037cc97d6 745a967f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/12 15:41 openbsd 932037cc97d6 745a967f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/12 12:45 openbsd 932037cc97d6 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/12 04:23 openbsd f3dc682c6638 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/10 13:05 openbsd 22a54d88cfed 4f92358f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/09 02:41 openbsd 896fef95f254 b2734a59 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/08 22:24 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/08 19:48 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/08 18:04 openbsd e8af851f340b 9d4697fa .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/08 01:25 openbsd 018a01b20aed 4f6a9fcf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 15:00 openbsd 5e47a7ebbb41 6520ecdb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 14:45 openbsd 5e47a7ebbb41 6520ecdb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 12:41 openbsd 5e47a7ebbb41 6520ecdb .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 08:22 openbsd ce063bbc9d61 f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/07 05:49 openbsd ce063bbc9d61 f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/06 22:03 openbsd 10794ab7cbfe f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/06 18:58 openbsd 10794ab7cbfe f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/06 13:56 openbsd 10794ab7cbfe f7710056 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 20:25 openbsd fe7391f28055 af63e995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 15:39 openbsd fe7391f28055 af63e995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 14:28 openbsd fe7391f28055 af63e995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 10:07 openbsd e058c89070c2 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 05:58 openbsd e058c89070c2 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/05 04:01 openbsd e058c89070c2 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/04 09:23 openbsd 1e9f05948cfd 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/04 05:13 openbsd 1e9f05948cfd 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/04 03:36 openbsd 1e9f05948cfd 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/03 15:01 openbsd 27f877102cce 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/03 03:14 openbsd 71b6d95a243d 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/02 15:45 openbsd 3ce1f3f79392 b2bd33ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/01 20:39 openbsd 6318c367a341 52471257 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/01 14:00 openbsd 6318c367a341 52471257 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/30 21:50 openbsd 4deb6a849f76 38f7f0d1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/30 15:43 openbsd 39ef73e9ac8b 7808aef4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/30 13:56 openbsd 39ef73e9ac8b 7808aef4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/30 11:12 openbsd 39ef73e9ac8b 7808aef4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/30 04:41 openbsd 2fa008c68904 328436b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/29 18:55 openbsd 2fa008c68904 328436b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/29 16:53 openbsd 0049b4ffbd56 7bf4ea23 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/09/29 14:16 openbsd 0049b4ffbd56 7bf4ea23 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/05/10 04:55 openbsd 33e6d7cf8045 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore witness: reversal: pf_lock netlock
2026/10/17 14:09 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan bacaf78497a8 432c0077 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
2026/10/05 00:04 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 834bc6d187a0 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan witness: reversal: pf_lock netlock
* Struck through repros no longer work on HEAD.