witness: lock order reversal: 1st 0xffffffff839293a8 pf_lock (pf_lock) 2nd 0xffffffff839792a0 netlock (netlock) lock order [1] pf_lock (pf_lock) -> [2] netlock (netlock) #0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 #1 uvn_io+0x54c sys/uvm/uvm_vnode.c:1243 #2 uvn_get+0x31d sys/uvm/uvm_vnode.c:1075 #3 uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612 #4 uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381 #5 uvm_fault+0x274 sys/uvm/uvm_fault.c:-1 #6 kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285 #7 kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532 #8 alltraps_kern_meltdown+0x7b #9 _copyin+0x5b #10 pfioctl+0x1377 sys/net/pf_ioctl.c:3284 #11 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #12 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 #13 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #14 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #14 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #15 Xsyscall+0x128 lock order [2] netlock (netlock) -> [1] pf_lock (pf_lock) #0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 #1 pfi_attach_ifgroup+0x2a sys/net/pf_if.c:357 #2 if_addgroup+0x2f8 if_creategroup sys/net/if.c:3059 [inline] #2 if_addgroup+0x2f8 sys/net/if.c:3097 #3 if_attachsetup+0xcf sys/net/if.c:512 #4 if_attach+0x6d sys/net/if.c:604 #5 vio_attach+0x1853 sys/dev/pv/if_vio.c:935 #6 config_attach+0x449 sys/kern/subr_autoconf.c:421 #7 virtio_pci_attach+0x52c sys/dev/pci/virtio_pci.c:675 #8 config_attach+0x449 sys/kern/subr_autoconf.c:421 #9 pci_probe_device+0x8e5 sys/dev/pci/pci.c:574 #10 pci_enumerate_bus+0x368 sys/dev/pci/pci.c:877 #11 config_attach+0x449 sys/kern/subr_autoconf.c:421 #12 acpipci_attach_bus+0x381 sys/arch/amd64/pci/acpipci.c:257 #13 acpipci_attach_busses+0x93 sys/arch/amd64/pci/acpipci.c:265 #14 mainbus_attach+0x304 sys/arch/amd64/amd64/mainbus.c:222 #15 config_attach+0x449 sys/kern/subr_autoconf.c:421 #16 cpu_configure+0x47 sys/arch/amd64/amd64/autoconf.c:124 #17 main+0x4c7 sys/kern/init_main.c:345 Stopped at db_enter+0x25: addq $0x8,%rsp ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic the kernel did not panic ddb{1}> show kasan No such command ddb{1}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 witness_checkorder(ffffffff839792a0,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1 rw_do_enter_write(ffffffff83979288,0) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 uvn_io(fffff2807ef61a60,ffff80002a24a078,1,202,0) at uvn_io+0x54c sys/uvm/uvm_vnode.c:1243 uvn_get(fffff2807ef61a60,0,ffff80002a24a148,ffff80002a24a12c,0,1,51d0b5c523742ccf,1) at uvn_get+0x31d sys/uvm/uvm_vnode.c:1075 uvm_fault_lower_io(ffff80002a24a360,ffff80002a24a398,ffff80002a24a1e0,ffff80002a24a1c8) at uvm_fault_lower_io+0x2ce sys/uvm/uvm_fault.c:1612 uvm_fault_lower(ffff80002a24a360,ffff80002a24a398,ffff80002a24a2e0) at uvm_fault_lower+0x28d sys/uvm/uvm_fault.c:1381 uvm_fault(fffff2800dd9f3f0,200000001000,0,1) at uvm_fault+0x274 sys/uvm/uvm_fault.c:-1 kpageflttrap(ffff80002a24a510,200000001200) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:285 kerntrap(ffff80002a24a510) at kerntrap+0x19d sys/arch/amd64/amd64/trap.c:532 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b _copyin() at _copyin+0x5b pfioctl(24900,c4504441,ffff800001576800,1,ffff800045fe34e8) at pfioctl+0x1377 sys/net/pf_ioctl.c:3284 VOP_IOCTL(fffff2800eed97b0,c4504441,ffff800001576800,1,fffff280097fd548,ffff800045fe34e8) at VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 vn_ioctl(fffff2806fb2a148,c4504441,ffff800001576800,ffff800045fe34e8) at vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 sys_ioctl(ffff800045fe34e8,ffff80002a24b0c0,ffff80002a24b010) at sys_ioctl+0x674 sys/kern/sys_generic.c:-1 syscall(ffff80002a24b0c0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a24b0c0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x5c8c2f65930, count: -18 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff80002a249e30 rbx 0 rdx 0 rcx 0xffff800045fe34e8 rax 0xffff80002998dff0 r8 0xffff80002a249d10 r9 0x8080808080808080 r10 0x89f9fd241b3c8046 r11 0x693447d7db8cea4 r12 0xfffff280041012c0 r13 0xfffff280048f1808 r14 0x3 r15 0xffffffff8355c928 substchar+0x6817 rip 0xffffffff82a40625 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a249e20 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=228411 pid=75595 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=72, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a21c2a8,0xffff800045fe3260 process=0xffff800045ff7a28 user=0xffff80002a246000, vmspace=0xfffff2800dd9f3f0 estcpu=22, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 9922 130752 59979 0 3 0x2 0 clonelk ifconfig 59979 200084 90749 0 3 0x100002 0x88 sigsusp sh 75595 314244 95972 0 2 0 0 syz-executor *75595 228411 95972 0 7 0 0x4000000 syz-executor 80079 380779 66406 0 3 0 0x80 nanoslp syz-executor 80079 156354 66406 0 3 0 0x4000080 fsleep syz-executor 90749 230886 61396 0 3 0x2 0x80 wait syz-executor 16353 107065 55433 0 3 0 0x80 nanoslp syz-executor 16353 228481 55433 0 3 0 0x4000080 klog syz-executor 66406 55453 61396 0 3 0x2 0x80 nanoslp syz-executor 5842 201182 61396 0 3 0x2 0x80 piperd syz-executor 61273 71701 1 0 3 0 0x80 nanoslp init 55433 91326 61396 0 3 0x2 0x80 nanoslp syz-executor 95972 123685 61396 0 3 0x2 0x80 nanoslp syz-executor 61396 186081 1 0 3 0x2 0x80 nanoslp syz-executor 3840 405602 0 0 3 0x14000 0x200 bored smr 35118 228127 0 0 7 0x14000 0x200 zerothread 60554 152161 0 0 3 0x14000 0x200 aiodoned aiodoned 52278 185159 0 0 3 0x14000 0x200 syncer update 6711 218117 0 0 3 0x14000 0x200 cleaner cleaner 19711 219044 0 0 3 0x14000 0x200 reaper reaper 48921 299047 0 0 3 0x14000 0x200 pgdaemon pagedaemon 23172 508399 0 0 3 0x14000 0x200 bored viomb 63702 248051 0 0 3 0x14000 0x40000200 acpi0 acpi0 83856 353548 0 0 3 0x14000 0x40000200 idle1 54373 320801 0 0 3 0x14000 0x200 bored softnet1 12374 462321 0 0 2 0x14000 0x200 softnet0 1831 230157 0 0 3 0x14000 0x200 smrbar systqmp 78264 468901 0 0 3 0x14000 0x200 bored systq 95266 263194 0 0 3 0x14000 0x200 tmoslp softclockmp 13455 93285 0 0 3 0x14000 0x40000200 tmoslp softclock 89611 473087 0 0 3 0x14000 0x40000200 idle0 1 414028 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks Process 75595 (syz-executor) thread 0xffff800045fe34e8 (228411) exclusive rwlock pf_lock r = 0 (0xffffffff839293a8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 pfioctl+0x1342 sys/net/pf_ioctl.c:3284 #3 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #4 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 #5 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #6 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #7 Xsyscall+0x128 exclusive rwlock pfioctl_rw r = 0 (0xffffffff83929438) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 pfioctl+0x1d4 sys/net/pf_ioctl.c:2064 #3 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #4 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 #5 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #6 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #7 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83adf400) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 vn_ioctl+0x4d sys/kern/vfs_vnops.c:520 #2 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #3 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #3 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #4 Xsyscall+0x128 Process 1831 (systqmp) thread 0xffff800045ffe000 (230157) shared rwlock systqmp r = 0 (0xffffffff83935fa8) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 taskq_thread+0x12a sys/kern/kern_task.c:442 #2 proc_trampoline+0x10 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11041 12021K 12232K 166960K 12692 0 pcb 18 12K 12K 166960K 62 0 rtable 203 7K 8K 166960K 1884 0 pf 31 17K 21K 166960K 294 0 ifaddr 36 7K 7K 166960K 255 0 ifgroup 47 2K 2K 166960K 267 0 sysctl 3 1K 9K 166960K 7 0 counters 66 36K 37K 166960K 180 0 ioctlops 1 2K 4K 166960K 1764 0 iov 0 0K 16K 166960K 13 0 mount 1 1K 1K 166960K 1 0 log 1 0K 0K 166960K 5 0 vnodes 1321 83K 84K 166960K 1979 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 9K 166960K 10 0 VM map 2 1K 1K 166960K 2 0 sem 14 0K 0K 166960K 16 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 13 49K 248K 166960K 1124 0 sigio 0 0K 0K 166960K 1 0 proc 19 33K 180K 166960K 1999 0 subproc 63 3K 4K 166960K 531 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 7 0 in_multi 81 5K 6K 166960K 653 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 17 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 61 281K 281K 166960K 61 0 exec 0 0K 1K 166960K 1214 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 90 70K 177K 166960K 9154 0 UVM aobj 11 2K 2K 166960K 11 0 pinsyscall 15 30K 103K 166960K 3576 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 5 0 NDP 16 0K 1K 166960K 182 0 temp 32 9122K 9186K 166960K 22594 0 kqueue 1 2K 24K 166960K 71 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}>