syzbot

witness: lock order reversal:
 1st 0xffff8000015ae9d0 sbufrcv (&so->so_rcv.sb_lock)
 2nd 0xfffff6007efada58 inode (&ip->i_lock)
lock order [1] sbufrcv (&so->so_rcv.sb_lock) -> [2] inode (&ip->i_lock)
lock order data 0xffffffff83448891 -> 0xffffffff83494682 is missing
lock order [2] inode (&ip->i_lock) -> [1] sbufrcv (&so->so_rcv.sb_lock)
#0  rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
#1  sblock+0xb6 sys/kern/uipc_socket2.c:536
#2  soreceive+0x27d sys/kern/uipc_socket.c:890
#3  fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264
#4  VOP_READ+0x101 sys/kern/vfs_vops.c:227
#5  vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1
#6  vndsetcred+0xa1 sys/dev/vnd.c:685
#7  vndioctl+0xdfc sys/dev/vnd.c:486
#8  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#9  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537
#10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#12 Xsyscall+0x128
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
witness_checkorder(fffff6007efada58,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1
rw_do_enter_write(fffff6007efada40,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234
rrw_enter(fffff6007efada40,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
VOP_LOCK(fffff6006cbd22b8,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527
vn_lock(fffff6006cbd22b8,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576
vfs_getcwd_common(fffff6006cbd22b8,fffff6006cbd22b8,0,0,200,0,e9473a4f131140a6) at vfs_getcwd_common+0xd1 sys/kern/vfs_getcwd.c:287
vn_isunder(fffff6006cbd22b8,fffff6006cbd22b8,ffff80003c3d3cb0) at vn_isunder+0x56 sys/kern/vfs_vnops.c:700
unp_externalize(fffff6006db54900,33,0) at unp_externalize+0x26f sys/kern/uipc_usrreq.c:1090
soreceive(ffff8000015ae8e0,ffff80003c3bfa28,ffff80003c3bf9d8,0,ffff80003c3bfa10,ffff80003c3bfb9c,97318dc4109ab79f) at soreceive+0xc24 sys/kern/uipc_socket.c:1029
recvit(ffff80003c3d3cb0,1,ffff80003c3bfb70,0,ffff80003c3bfc20) at recvit+0x40b sys/kern/uipc_syscalls.c:1078
sys_recvmsg(ffff80003c3d3cb0,ffff80003c3bfcd0,ffff80003c3bfc20) at sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878
syscall(ffff80003c3bfcd0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c3bfcd0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xf838772c510, count: -14
ddb{0}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80003c3bf4b0
rbx                                0
rdx               0xffff8000015dcb40
rcx               0xffff80003c3d3cb0
rax                          0x7ffff    acpi_pdirpa+0x6be70
r8                0xffff80003c3bf390
r9                0x8080808080808080
r10               0xc0d6d11f050df05e
r11               0xaf589eb9d528de46
r12               0xfffff600040c7940
r13               0xfffff600048b0890
r14                              0x3
r15               0xffffffff83524ea9    substchar+0x2485
rip               0xffffffff822e8f95    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c3bf4a0
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=167350 pid=12716 tcnt=2 stat=onproc
    flags process=1000000<CHROOT> proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c3d27f0,0xffffffff83a0a620
    process=0xffff80003c3d49c0 user=0xffff80003c3ba000, vmspace=0xfffff6006cefd3e8
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 12716  450169  70325     0  2   0x1000000          0           syz-executor
*12716  167350  70325     0  7   0x1000000  0x4000000           syz-executor
   961   79956  95862     0  2           0          0           syz-executor
   961    5771  95862     0  3           0  0x4000080 fsleep    syz-executor
 56781  263352  73494     0  2           0          0           syz-executor
 56781  282898  73494     0  3           0  0x4000080 fsleep    syz-executor
 48813  413612   9122     0  2           0          0           syz-executor
 48813  511315   9122     0  3           0  0x4000080 kqread    syz-executor
 86856  424669   2268     0  2           0          0           syz-executor
 86856  457370   2268     0  3           0  0x4000080 fsleep    syz-executor
 71744  464517  70669     0  2           0          0           syz-executor
 71744   60817  70669     0  3           0  0x4000080 sbwait    syz-executor
 71744  356397  70669     0  3           0  0x4000080 fsleep    syz-executor
 70795  345648  18129 60929  2        0x10          0           syz-executor
 70795  484228  18129 60929  3        0x10  0x4000080 fsleep    syz-executor
 62193  144175  40304     0  3           0       0x80 nanoslp   syz-executor
 62193  292387  40304     0  3           0  0x4000080 sbwait    syz-executor
 62193  108426  40304     0  2           0  0x4000000           syz-executor
 62193  447511  40304     0  3           0  0x4000080 fsleep    syz-executor
  2268   85227  89795     0  3         0x2       0x80 nanoslp   syz-executor
 22970  329259      1     0  3    0x100003       0x80 ttyin     getty
 36000  267718      0     0  3     0x14000      0x200 acct      acct
  9122  146171  89795     0  3         0x2       0x80 nanoslp   syz-executor
 40304   89646  89795     0  3         0x2       0x80 nanoslp   syz-executor
 18129   90460  89795     0  3         0x2       0x80 nanoslp   syz-executor
 73494  131137  89795     0  3         0x2       0x80 nanoslp   syz-executor
 95862  270775  89795     0  3         0x2       0x80 nanoslp   syz-executor
 70669  432969  89795     0  3         0x2       0x80 nanoslp   syz-executor
 70325  323567  89795     0  3         0x2       0x80 nanoslp   syz-executor
 89795  281641      1     0  3         0x2       0x80 kqread    syz-executor
 68668  377019      1     0  3         0x2       0x88 kqread    sshd
 80864   85816  33578    74  3   0x1100012       0x80 bpf       pflogd
 33578    8815      1     0  3           0       0x80 sbwait    pflogd
 19789  139229    476    73  3   0x1100010       0x80 kqread    syslogd
   476   45210      1     0  3    0x100002       0x80 sbwait    syslogd
 95463  409123      1     0  3    0x100000       0x80 kqread    resolvd
 63506  297290  72498    77  3    0x100012       0x80 kqread    dhcpleased
 93776   66725  72498    77  3    0x100012       0x80 kqread    dhcpleased
 72498   68963      1     0  3           0       0x80 kqread    dhcpleased
  3586  208543      0     0  3     0x14000      0x200 bored     smr
 93648  430692      0     0  2     0x14000      0x200           zerothread
  2029   79067      0     0  3     0x14000      0x200 aiodoned  aiodoned
 67509  285068      0     0  3     0x14000      0x200 syncer    update
 56543   78083      0     0  3     0x14000      0x200 cleaner   cleaner
 97380  437033      0     0  3     0x14000      0x200 reaper    reaper
 86071  341380      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 33424  159885      0     0  3     0x14000      0x200 bored     viomb
 42818  214473      0     0  3     0x14000 0x40000200 acpi0     acpi0
 48774  337945      0     0  7     0x14000 0x40000200           idle1
 72246  195918      0     0  3     0x14000      0x200 bored     softnet1
 78320  424468      0     0  3     0x14000      0x200 bored     softnet0
  4351  445410      0     0  3     0x14000      0x200 bored     systqmp
 23007  149875      0     0  3     0x14000      0x200 bored     systq
 73418  315967      0     0  3     0x14000      0x200 tmoslp    softclockmp
 64794  216155      0     0  3     0x14000 0x40000200 tmoslp    softclock
 23762  365423      0     0  3     0x14000 0x40000200           idle0
     1   18513      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> show all locks
Process 12716 (syz-executor) thread 0xffff80003c3d3cb0 (167350)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a55480)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  unp_externalize+0x155 sys/kern/uipc_usrreq.c:-1
#2  soreceive+0xc24 sys/kern/uipc_socket.c:1029
#3  recvit+0x40b sys/kern/uipc_syscalls.c:1078
#4  sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#6  Xsyscall+0x128
exclusive rwlock sbufrcv r = 0 (0xffff8000015ae9d0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  sblock+0xb6 sys/kern/uipc_socket2.c:536
#3  soreceive+0x27d sys/kern/uipc_socket.c:890
#4  recvit+0x40b sys/kern/uipc_syscalls.c:1078
#5  sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#7  Xsyscall+0x128
ddb{0}>