ÿÿÿN6witness: lock order reversal: 1st 0xffff8000015b0fb0 sbufrcv (&so->so_rcv.sb_lock) 2nd 0xfffffd00777d87e8 inode (&ip->i_lock) lock order [1] sbufrcv (&so->so_rcv.sb_lock) -> [2] inode (&ip->i_lock) lock order data 0xffffffff834621b7 -> 0xffffffff834aa610 is missing lock order [2] inode (&ip->i_lock) -> [1] sbufrcv (&so->so_rcv.sb_lock) #0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 #1 sblock+0xb6 sys/kern/uipc_socket2.c:536 #2 soreceive+0x27d sys/kern/uipc_socket.c:890 #3 fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264 #4 VOP_READ+0x101 sys/kern/vfs_vops.c:227 #5 vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1 #6 vndsetcred+0xa1 sys/dev/vnd.c:685 #7 vndioctl+0xdfc sys/dev/vnd.c:486 #8 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #9 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 #10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #12 Xsyscall+0x128 Stopped at db_enter+0x25: addq $0x8,%rsp ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic the kernel did not panic ddb{1}> show kasan No such command ddb{1}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 witness_checkorder(fffffd00777d87e8,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1 rw_do_enter_write(fffffd00777d87d0,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 rrw_enter(fffffd00777d87d0,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 VOP_LOCK(fffffd00698b1638,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 vn_lock(fffffd00698b1638,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576 vfs_getcwd_common(fffffd00698b1638,fffffd00698b1dd0,0,0,200,0,2ad67560e5c716f2) at vfs_getcwd_common+0xd1 sys/kern/vfs_getcwd.c:287 vn_isunder(fffffd00698b1638,fffffd00698b1dd0,ffff800045fe94e8) at vn_isunder+0x56 sys/kern/vfs_vnops.c:700 unp_externalize(fffffd0060e2fc00,42,3800) at unp_externalize+0x26f sys/kern/uipc_usrreq.c:1093 soreceive(ffff8000015b0ec0,ffff80002a379ce8,ffff80002a379c98,0,ffff80002a379ce0,ffff80002a379e5c,4ce736e848cd12df) at soreceive+0xc24 sys/kern/uipc_socket.c:1029 recvit(ffff800045fe94e8,2,ffff80002a379e30,0,ffff80002a379ee0) at recvit+0x40b sys/kern/uipc_syscalls.c:1078 sys_recvmsg(ffff800045fe94e8,ffff80002a379f90,ffff80002a379ee0) at sys_recvmsg+0x1bf sys/kern/uipc_syscalls.c:878 syscall(ffff80002a379f90) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a379f90) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x20c90cf6460, count: -14 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff80002a379770 rbx 0 rdx 0 rcx 0xffff800045fe94e8 rax 0xffff80002999dff0 r8 0xffff80002a379650 r9 0x8080808080808080 r10 0x7c3d1ed592758558 r11 0xab43c9b98ea56ad2 r12 0xfffffd00040dd940 r13 0xfffffd00048c6560 r14 0x3 r15 0xffffffff8353e968 substchar+0x402a rip 0xffffffff82f06db5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80002a379760 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=229159 pid=24761 tcnt=3 stat=onproc flags process=1000010 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a22cd08,0xffff800045fe9cc0 process=0xffff800045fee6d8 user=0xffff80002a375000, vmspace=0xfffffd006cf0d200 estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{1}>