witness: lock order reversal: 1st 0xffff800001be6c90 vmmaplk (&map->lock) 2nd 0xffff800001cbb598 inode (&ip->i_lock) lock order [1] vmmaplk (&map->lock) -> [2] inode (&ip->i_lock) #0 rw_do_enter_write+0xc4 sys/kern/kern_rwlock.c:234 #1 rrw_enter+0xf0 sys/kern/kern_rwlock.c:621 #2 VOP_LOCK+0x17e sys/kern/vfs_vops.c:527 #3 vn_lock+0xca sys/kern/vfs_vnops.c:576 #4 vn_rdwr+0x138 sys/kern/vfs_vnops.c:326 #5 vndstrategy+0x8e4 sys/dev/vnd.c:342 #6 physio+0x581 sys/kern/kern_physio.c:162 #7 spec_read+0x29a sys/kern/spec_vnops.c:215 #8 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #9 vn_read+0x1fc sys/kern/vfs_vnops.c:375 #10 dofilereadv+0x386 sys/kern/sys_generic.c:252 #11 sys_readv+0x168 sys/kern/sys_generic.c:199 #12 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #12 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #13 Xsyscall+0x128 lock order [2] inode (&ip->i_lock) -> [1] vmmaplk (&map->lock) #0 rw_do_enter_read+0x8b sys/kern/kern_rwlock.c:355 #1 uvmfault_lookup+0x1a2 sys/uvm/uvm_fault.c:-1 #2 uvm_fault_check+0x43 sys/uvm/uvm_fault.c:693 #3 uvm_fault+0x1e7 sys/uvm/uvm_fault.c:627 #4 kpageflttrap+0x41e sys/arch/amd64/amd64/trap.c:285 #5 kerntrap+0x1b6 sys/arch/amd64/amd64/trap.c:532 #6 alltraps_kern_meltdown+0x7b #7 copyout+0x59 #8 ffs_read+0x701 sys/ufs/ffs/ffs_vnops.c:254 #9 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #10 vn_rdwr+0x1bc sys/kern/vfs_vnops.c:-1 #11 vmcmd_map_readvn+0x20a sys/kern/exec_subr.c:250 #12 exec_process_vmcmds+0x164 sys/kern/exec_subr.c:139 #13 sys_execve+0x1354 sys/kern/kern_exec.c:540 #14 start_init+0x5fb sys/kern/init_main.c:732 #15 proc_trampoline+0x10 Stopped at db_enter+0x17: popq %rbp ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic the kernel did not panic ddb{0}> show kasan kasan: no report recorded this boot ddb{0}> trace db_enter() at db_enter+0x17 sys/arch/amd64/amd64/db_interface.c:457 witness_checkorder(ffff800001cbb598,9,0) at witness_checkorder+0x19db sys/kern/subr_witness.c:-1 rw_do_enter_write(ffff800001cbb580,1) at rw_do_enter_write+0xc4 sys/kern/kern_rwlock.c:234 rrw_enter(ffff800001cbb580,1) at rrw_enter+0xf0 sys/kern/kern_rwlock.c:621 VOP_LOCK(ffff800001cb1a60,2001) at VOP_LOCK+0x17e sys/kern/vfs_vops.c:527 vn_lock(ffff800001cb1a60,2001) at vn_lock+0xca sys/kern/vfs_vnops.c:576 vn_rdwr(0,ffff800001cb1a60,ffff800011b06000,b,0,1,ffff800000d9b5b8,ffff800001c51bc0,ffff800001c51c30,ffffffff84f6eff0) at vn_rdwr+0x138 sys/kern/vfs_vnops.c:326 vndstrategy(ffff800001c51bc0) at vndstrategy+0x8e4 sys/dev/vnd.c:342 physio(ffffffff83c7e780,2902,8000,ffffffff833ec6c0,ffff800039f1d980) at physio+0x581 sys/kern/kern_physio.c:162 spec_read(ffff800039f1d6c0) at spec_read+0x29a sys/kern/spec_vnops.c:215 VOP_READ(ffff80000196ba28,ffff800039f1d980,0,ffff800000119680) at VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 vn_read(ffff800001d680a0,ffff800039f1d980,0) at vn_read+0x1fc sys/kern/vfs_vnops.c:375 dofilereadv(ffff80003af2ba10,3,ffff800039f1d980,0,ffff800039f1db40) at dofilereadv+0x386 sys/kern/sys_generic.c:252 sys_readv(ffff80003af2ba10,ffff800039f1dbd0,ffff800039f1db40) at sys_readv+0x168 sys/kern/sys_generic.c:199 syscall(ffff800039f1dbd0) at syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff800039f1dbd0) at syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xf348b338480, count: -16 ddb{0}> show registers rdi 0 rsi 0 rbp 0xffff800039f1cdc0 rbx 0xffffffff84991460 .str.41 rdx 0xffff80000016c980 rcx 0x7ffff acpi_pdirpa+0x6be70 rax 0xffff8000386f8000 r8 0xffff800039f1cba0 r9 0xffff800039f1cb40 r10 0xffff800039f1d078 r11 0xffffffff821db0c0 x86_bus_space_io_read_1 r12 0xffffffff84a296e0 ffs_vget.__lock_type r13 0xffff800001be6c90 r14 0x3 r15 0xffffffff84a29720 .str.13 rip 0xffffffff8107c237 db_enter+0x17 cs 0x8 rflags 0x246 rsp 0xffff800039f1cdc0 ss 0x10 db_enter+0x17: popq %rbp ddb{0}> show proc PROC (syz-executor) tid=507984 pid=85587 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=76, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003af2aa80,0xffff800029885a08 process=0xffff80003bb50020 user=0xffff800039f12000, vmspace=0xffff800001be6b90 estcpu=26, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 45297 174136 58166 0 2 0x100000 0 sh 58166 264430 14982 0 3 0x100002 0x88 sigsusp sh 24467 378822 69089 0 2 0 0 syz-executor 24467 72341 69089 0 3 0 0x4000088 kqpoll syz-executor 85587 257827 14824 0 2 0 0 syz-executor *85587 507984 14824 0 7 0 0x4000000 syz-executor 85587 114265 14824 0 3 0 0x4000080 fsleep syz-executor 8827 137962 24706 0 2 0 0 syz-executor 8827 195343 24706 0 3 0 0x4000080 fsleep syz-executor 35225 350370 74777 0 3 0x1000 0x2000 suspend syz-executor 35225 110585 74777 0 2 0x1000 0x4080000 syz-executor 7306 246360 53496 0 2 0x2000 0x80000 syz-executor 7306 389591 53496 0 4 0x2000 0x4080000 syz-executor 7306 495916 53496 0 4 0x2000 0x4080000 syz-executor 7306 35091 53496 0 3 0x2000 0x4000000 suspend syz-executor 14982 420477 43946 0 3 0x2 0x80 wait syz-executor 69089 354925 43946 0 3 0x2 0x80 nanoslp syz-executor 74777 181699 43946 0 3 0x2 0x80 nanoslp syz-executor 14824 339832 43946 0 3 0x2 0x80 nanoslp syz-executor 99206 522993 43946 0 3 0x2 0x80 wait syz-executor 53496 81637 43946 0 3 0x2 0x80 nanoslp syz-executor 24706 368750 43946 0 7 0x2 0x1 syz-executor 35867 404182 1 0 3 0x100003 0x80 ttyin getty 82931 126364 0 0 3 0x14000 0x200 acct acct 43946 136918 1 0 3 0x2 0x80 wait syz-executor 79421 437087 69622 74 3 0x1100012 0x80 bpf pflogd 69622 354847 1 0 3 0 0x80 sbwait pflogd 63514 351658 0 0 3 0x14000 0x200 bored smr 7884 327840 0 0 2 0x14000 0x200 zerothread 87858 195022 0 0 3 0x14000 0x200 aiodoned aiodoned 76684 196381 0 0 3 0x14000 0x200 syncer update 30404 100475 0 0 3 0x14000 0x200 cleaner cleaner 95532 305392 0 0 3 0x14000 0x200 reaper reaper 99125 61196 0 0 3 0x14000 0x200 pgdaemon pagedaemon 82143 194043 0 0 3 0x14000 0x200 bored viomb 55169 379455 0 0 3 0x14000 0x40000200 acpi0 acpi0 74216 370004 0 0 3 0x14000 0x40000200 idle1 10190 2468 0 0 3 0x14000 0x200 bored softnet1 39082 518546 0 0 3 0x14000 0x200 bored softnet0 27263 277862 0 0 3 0x14000 0x200 bored systqmp 45484 477539 0 0 3 0x14000 0x200 bored systq 9857 138245 0 0 3 0x14000 0x200 tmoslp softclockmp 27460 93015 0 0 3 0x14000 0x40000200 tmoslp softclock 13208 42130 0 0 3 0x14000 0x40000200 idle0 1 50194 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{0}> show all locks Process 85587 (syz-executor) thread 0xffff80003af2ba10 (507984) shared rwlock vmmaplk r = 0 (0xffff800001be6c90) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 rw_do_enter_read+0x55d sys/kern/kern_rwlock.c:413 #2 uvm_vslock_device+0x1bc sys/uvm/uvm_glue.c:173 #3 physio+0x4a7 sys/kern/kern_physio.c:139 #4 spec_read+0x29a sys/kern/spec_vnops.c:215 #5 VOP_READ+0x1a8 sys/kern/vfs_vops.c:227 #6 vn_read+0x1fc sys/kern/vfs_vnops.c:375 #7 dofilereadv+0x386 sys/kern/sys_generic.c:252 #8 sys_readv+0x168 sys/kern/sys_generic.c:199 #9 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #9 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #10 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85609240) #0 witness_lock+0x632 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x632 sys/kern/subr_witness.c:1160 #1 vn_read+0x83 sys/kern/vfs_vnops.c:357 #2 dofilereadv+0x386 sys/kern/sys_generic.c:252 #3 sys_readv+0x168 sys/kern/sys_generic.c:199 #4 syscall+0x1089 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0x1089 sys/arch/amd64/amd64/trap.c:791 #5 Xsyscall+0x128 ddb{0}>