witness: lock order reversal: 1st 0xffff8000015ae9d0 sbufrcv (&so->so_rcv.sb_lock) 2nd 0xfffff6007efada58 inode (&ip->i_lock) lock order [1] sbufrcv (&so->so_rcv.sb_lock) -> [2] inode (&ip->i_lock) lock order data 0xffffffff83448891 -> 0xffffffff83494682 is missing lock order [2] inode (&ip->i_lock) -> [1] sbufrcv (&so->so_rcv.sb_lock) #0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 #1 sblock+0xb6 sys/kern/uipc_socket2.c:536 #2 soreceive+0x27d sys/kern/uipc_socket.c:890 #3 fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264 #4 VOP_READ+0x101 sys/kern/vfs_vops.c:227 #5 vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1 #6 vndsetcred+0xa1 sys/dev/vnd.c:685 #7 vndioctl+0xdfc sys/dev/vnd.c:486 #8 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #9 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 #10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #12 Xsyscall+0x128 Stopped at db_enter+0x25: addq $0x8,%rsp ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic the kernel did not panic ddb{0}> show kasan No such command ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 witness_checkorder(fffff6007efada58,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1 rw_do_enter_write(fffff6007efada40,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 rrw_enter(fffff6007efada40,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 VOP_LOCK(fffff6006cbd22b8,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 vn_lock(fffff6006cbd22b8,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576 vfs_getcwd_common(fffff6006cbd22b8,fffff6006cbd22b8,0,0,200,0,e9473a4f131140a6) at vfs_getcwd_common+0xd1 sys/kern/vfs_getcwd.c:287 vn_isunder(fffff6006cbd22b8,fffff6006cbd22b8,ffff80003c3d3cb0) at vn_isunder+0x56 sys/kern/vfs_vnops.c:700 unp_externalize(fffff6006db54900,33,0) at unp_externalize+0x26f sys/kern/uipc_usrreq.c:1090 soreceive(ffff8000015ae8e0,ffff80003c3bfa28,ffff80003c3bf9d8,0,ffff80003c3bfa10,ffff80003c3bfb9c,97318dc4109ab79f) at soreceive+0xc24 sys/kern/uipc_socket.c:1029 recvit(ffff80003c3d3cb0,1,ffff80003c3bfb70,0,ffff80003c3bfc20) at recvit+0x40b sys/kern/uipc_syscalls.c:1078 sys_recvmsg(ffff80003c3d3cb0,ffff80003c3bfcd0,ffff80003c3bfc20) at sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878 syscall(ffff80003c3bfcd0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c3bfcd0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xf838772c510, count: -14 ddb{0}> show registers rdi 0 rsi 0x80000 acpi_pdirpa+0x6be71 rbp 0xffff80003c3bf4b0 rbx 0 rdx 0xffff8000015dcb40 rcx 0xffff80003c3d3cb0 rax 0x7ffff acpi_pdirpa+0x6be70 r8 0xffff80003c3bf390 r9 0x8080808080808080 r10 0xc0d6d11f050df05e r11 0xaf589eb9d528de46 r12 0xfffff600040c7940 r13 0xfffff600048b0890 r14 0x3 r15 0xffffffff83524ea9 substchar+0x2485 rip 0xffffffff822e8f95 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003c3bf4a0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=167350 pid=12716 tcnt=2 stat=onproc flags process=1000000 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003c3d27f0,0xffffffff83a0a620 process=0xffff80003c3d49c0 user=0xffff80003c3ba000, vmspace=0xfffff6006cefd3e8 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 12716 450169 70325 0 2 0x1000000 0 syz-executor *12716 167350 70325 0 7 0x1000000 0x4000000 syz-executor 961 79956 95862 0 2 0 0 syz-executor 961 5771 95862 0 3 0 0x4000080 fsleep syz-executor 56781 263352 73494 0 2 0 0 syz-executor 56781 282898 73494 0 3 0 0x4000080 fsleep syz-executor 48813 413612 9122 0 2 0 0 syz-executor 48813 511315 9122 0 3 0 0x4000080 kqread syz-executor 86856 424669 2268 0 2 0 0 syz-executor 86856 457370 2268 0 3 0 0x4000080 fsleep syz-executor 71744 464517 70669 0 2 0 0 syz-executor 71744 60817 70669 0 3 0 0x4000080 sbwait syz-executor 71744 356397 70669 0 3 0 0x4000080 fsleep syz-executor 70795 345648 18129 60929 2 0x10 0 syz-executor 70795 484228 18129 60929 3 0x10 0x4000080 fsleep syz-executor 62193 144175 40304 0 3 0 0x80 nanoslp syz-executor 62193 292387 40304 0 3 0 0x4000080 sbwait syz-executor 62193 108426 40304 0 2 0 0x4000000 syz-executor 62193 447511 40304 0 3 0 0x4000080 fsleep syz-executor 2268 85227 89795 0 3 0x2 0x80 nanoslp syz-executor 22970 329259 1 0 3 0x100003 0x80 ttyin getty 36000 267718 0 0 3 0x14000 0x200 acct acct 9122 146171 89795 0 3 0x2 0x80 nanoslp syz-executor 40304 89646 89795 0 3 0x2 0x80 nanoslp syz-executor 18129 90460 89795 0 3 0x2 0x80 nanoslp syz-executor 73494 131137 89795 0 3 0x2 0x80 nanoslp syz-executor 95862 270775 89795 0 3 0x2 0x80 nanoslp syz-executor 70669 432969 89795 0 3 0x2 0x80 nanoslp syz-executor 70325 323567 89795 0 3 0x2 0x80 nanoslp syz-executor 89795 281641 1 0 3 0x2 0x80 kqread syz-executor 68668 377019 1 0 3 0x2 0x88 kqread sshd 80864 85816 33578 74 3 0x1100012 0x80 bpf pflogd 33578 8815 1 0 3 0 0x80 sbwait pflogd 19789 139229 476 73 3 0x1100010 0x80 kqread syslogd 476 45210 1 0 3 0x100002 0x80 sbwait syslogd 95463 409123 1 0 3 0x100000 0x80 kqread resolvd 63506 297290 72498 77 3 0x100012 0x80 kqread dhcpleased 93776 66725 72498 77 3 0x100012 0x80 kqread dhcpleased 72498 68963 1 0 3 0 0x80 kqread dhcpleased 3586 208543 0 0 3 0x14000 0x200 bored smr 93648 430692 0 0 2 0x14000 0x200 zerothread 2029 79067 0 0 3 0x14000 0x200 aiodoned aiodoned 67509 285068 0 0 3 0x14000 0x200 syncer update 56543 78083 0 0 3 0x14000 0x200 cleaner cleaner 97380 437033 0 0 3 0x14000 0x200 reaper reaper 86071 341380 0 0 3 0x14000 0x200 pgdaemon pagedaemon 33424 159885 0 0 3 0x14000 0x200 bored viomb 42818 214473 0 0 3 0x14000 0x40000200 acpi0 acpi0 48774 337945 0 0 7 0x14000 0x40000200 idle1 72246 195918 0 0 3 0x14000 0x200 bored softnet1 78320 424468 0 0 3 0x14000 0x200 bored softnet0 4351 445410 0 0 3 0x14000 0x200 bored systqmp 23007 149875 0 0 3 0x14000 0x200 bored systq 73418 315967 0 0 3 0x14000 0x200 tmoslp softclockmp 64794 216155 0 0 3 0x14000 0x40000200 tmoslp softclock 23762 365423 0 0 3 0x14000 0x40000200 idle0 1 18513 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks Process 12716 (syz-executor) thread 0xffff80003c3d3cb0 (167350) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a55480) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 unp_externalize+0x155 sys/kern/uipc_usrreq.c:-1 #2 soreceive+0xc24 sys/kern/uipc_socket.c:1029 #3 recvit+0x40b sys/kern/uipc_syscalls.c:1078 #4 sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878 #5 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #5 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #6 Xsyscall+0x128 exclusive rwlock sbufrcv r = 0 (0xffff8000015ae9d0) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 sblock+0xb6 sys/kern/uipc_socket2.c:536 #3 soreceive+0x27d sys/kern/uipc_socket.c:890 #4 recvit+0x40b sys/kern/uipc_syscalls.c:1078 #5 sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878 #6 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #7 Xsyscall+0x128 ddb{0}>