witness: exclusive lock of (rwlock) vmmaplk while share locked panic: share->excl Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND * 2509 73298 32767 0x10 0x4000000 0K syz-executor.5 507881 94770 0 0x14000 0x200 1 reaper db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440 panic(ffffffff8257690f) at panic+0x177 sys/kern/subr_prf.c:202 witness_checkorder(fffffd80678e4030,9,0) at witness_checkorder+0x11bd witness_debugger sys/kern/subr_witness.c:2505 [inline] witness_checkorder(fffffd80678e4030,9,0) at witness_checkorder+0x11bd sys/kern/subr_witness.c:772 rw_enter(fffffd80678e4020,21) at rw_enter+0xd1 sys/kern/kern_rwlock.c:250 vm_map_lock_ln(fffffd80678e4018,8a7,ffff800028735000) at vm_map_lock_ln+0xda sys/uvm/uvm_map.c:5466 uvm_map_extract(fffffd80678e4018,7f7ffffda000,1000,ffff80002e3be530,0) at uvm_map_extract+0x173 sys/uvm/uvm_map.c:4530 uvm_io(fffffd80678e4018,ffff80002e3be5c8,0) at uvm_io+0x127 sys/uvm/uvm_io.c:100 sysctl_proc_args(ffff80002e3bea18,2,20000080,ffff80002e3bea48,ffff8000280e97b0) at sysctl_proc_args+0x24b sys/kern/kern_sysctl.c:1790 kern_sysctl(ffff80002e3bea14,3,20000080,ffff80002e3bea48,0,1c,1a3353c8c16c703) at kern_sysctl+0xfd sys/kern/kern_sysctl.c:449 sys_sysctl(ffff8000280e97b0,ffff80002e3beab8,ffff80002e3beb10) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:249 syscall(ffff80002e3beb80) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline] syscall(ffff80002e3beb80) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x63f45c32370, count: 3 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: share->excl ddb{0}> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440 panic(ffffffff8257690f) at panic+0x177 sys/kern/subr_prf.c:202 witness_checkorder(fffffd80678e4030,9,0) at witness_checkorder+0x11bd witness_debugger sys/kern/subr_witness.c:2505 [inline] witness_checkorder(fffffd80678e4030,9,0) at witness_checkorder+0x11bd sys/kern/subr_witness.c:772 rw_enter(fffffd80678e4020,21) at rw_enter+0xd1 sys/kern/kern_rwlock.c:250 vm_map_lock_ln(fffffd80678e4018,8a7,ffff800028735000) at vm_map_lock_ln+0xda sys/uvm/uvm_map.c:5466 uvm_map_extract(fffffd80678e4018,7f7ffffda000,1000,ffff80002e3be530,0) at uvm_map_extract+0x173 sys/uvm/uvm_map.c:4530 uvm_io(fffffd80678e4018,ffff80002e3be5c8,0) at uvm_io+0x127 sys/uvm/uvm_io.c:100 sysctl_proc_args(ffff80002e3bea18,2,20000080,ffff80002e3bea48,ffff8000280e97b0) at sysctl_proc_args+0x24b sys/kern/kern_sysctl.c:1790 kern_sysctl(ffff80002e3bea14,3,20000080,ffff80002e3bea48,0,1c,1a3353c8c16c703) at kern_sysctl+0xfd sys/kern/kern_sysctl.c:449 sys_sysctl(ffff8000280e97b0,ffff80002e3beab8,ffff80002e3beb10) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:249 syscall(ffff80002e3beb80) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline] syscall(ffff80002e3beb80) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x63f45c32370, count: -12 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80002e3be190 rbx 0xffffffff829bbbff cpu_info_full_primary+0x2bff rdx 0xffff800000bd5940 rcx 0 rax 0xffff8000280e97b0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x535086f2685082aa r11 0xdec2ec5be2607b0c r12 0xffffffff829bba00 cpu_info_full_primary+0x2a00 r13 0 r14 0 r15 0x1 rip 0xffffffff8138d658 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff80002e3be180 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor.5) pid=2509 stat=onproc flags process=10 proc=4000000 pri=32, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff8000280e9cf0,0xffff8000280e8d40 process=0xffff8000280e50c0 user=0xffff80002e3b9000, vmspace=0xfffffd80678e4018 estcpu=36, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 42131 52322 97136 32767 2 0x10 syz-executor.0 42131 186792 97136 32767 3 0x4000090 fsleep syz-executor.0 73298 422482 86706 32767 2 0x10 syz-executor.5 *73298 2509 86706 32767 7 0x4000010 syz-executor.5 73298 481896 86706 32767 3 0x4000090 fsleep syz-executor.5 82554 304875 76912 32767 2 0x10 syz-executor.3 82554 300665 76912 32767 3 0x4000090 fsleep syz-executor.3 82554 273099 76912 32767 3 0x4000090 fsleep syz-executor.3 48584 493046 92754 32767 2 0x10 syz-executor.1 48584 480828 92754 32767 3 0x4000090 fsleep syz-executor.1 92014 189865 0 0 3 0x14200 bored sosplice 92166 91351 46544 32767 3 0x90 nanoslp syz-executor.7 44105 380123 77331 32767 3 0x90 piperd syz-executor.6 86706 132384 27428 32767 3 0x90 nanoslp syz-executor.5 76912 30278 87483 32767 3 0x90 nanoslp syz-executor.3 46544 20159 65303 0 3 0x82 wait syz-executor.7 27428 40730 65303 0 3 0x82 wait syz-executor.5 77331 230927 65303 0 3 0x82 wait syz-executor.6 97294 221104 31817 32767 3 0x90 nanoslp syz-executor.4 57786 380058 73111 32767 2 0x490 syz-executor.2 87483 199445 65303 0 3 0x82 wait syz-executor.3 92754 261356 33109 32767 2 0x490 syz-executor.1 31817 470962 65303 0 3 0x82 wait syz-executor.4 97136 52810 88777 32767 3 0x90 nanoslp syz-executor.0 73111 257099 65303 0 3 0x82 wait syz-executor.2 33109 252626 65303 0 3 0x82 wait syz-executor.1 88777 320087 65303 0 3 0x82 wait syz-executor.0 65303 186319 86384 0 3 0x82 thrsleep syz-fuzzer 65303 419668 86384 0 3 0x4000082 thrsleep syz-fuzzer 65303 283279 86384 0 3 0x4000082 thrsleep syz-fuzzer 65303 150471 86384 0 3 0x4000082 thrsleep syz-fuzzer 65303 455759 86384 0 3 0x4000082 thrsleep syz-fuzzer 65303 516161 86384 0 3 0x4000082 thrsleep syz-fuzzer 65303 14628 86384 0 2 0x4000082 syz-fuzzer 65303 82770 86384 0 3 0x4000082 thrsleep syz-fuzzer 65303 371157 86384 0 3 0x4000082 thrsleep syz-fuzzer 86384 175663 48422 0 3 0x10008a sigsusp ksh 48422 253591 26189 0 3 0x9a kqread sshd 18999 391233 1 0 3 0x100083 ttyin getty 26189 183146 1 0 3 0x88 kqread sshd 24715 261808 3998 73 3 0x1100090 kqread syslogd 3998 366709 1 0 3 0x100082 netio syslogd 71283 435607 1 0 3 0x100080 kqread resolvd 25736 163389 53171 77 3 0x100092 kqread dhcpleased 6226 223083 53171 77 3 0x100092 kqread dhcpleased 53171 449386 1 0 3 0x80 kqread dhcpleased 36362 14360 0 0 3 0x14200 bored smr 54169 318566 0 0 2 0x14200 zerothread 25535 446408 0 0 3 0x14200 aiodoned aiodoned 94064 509901 0 0 3 0x14200 syncer update 26374 168986 0 0 3 0x14200 cleaner cleaner 94770 507881 0 0 7 0x14200 reaper 30844 347098 0 0 3 0x14200 pgdaemon pagedaemon 95997 38635 0 0 3 0x14200 bored viomb 56955 367032 0 0 3 0x40014200 acpi0 acpi0 54904 436305 0 0 3 0x40014200 idle1 5023 2188 0 0 3 0x14200 bored softnet 50398 383287 0 0 3 0x14200 bored systqmp 43084 394880 0 0 3 0x14200 bored systq 67281 10110 0 0 3 0x40014200 bored softclock 91163 76039 0 0 3 0x40014200 idle0 1 408569 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 73298 (syz-executor.5) thread 0xffff8000280e97b0 (2509) shared rwlock vmmaplk r = 0 (0xfffffd80678e4030) #0 witness_lock+0x44d #1 uvm_vslock+0xc8 sys/uvm/uvm_glue.c:129 #2 sys_sysctl+0x2d8 sys/kern/kern_sysctl.c:240 #3 syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline] #3 syscall+0x489 sys/arch/amd64/amd64/trap.c:585 #4 Xsyscall+0x128 exclusive rwlock sysctllk r = 0 (0xffffffff82941f10) #0 witness_lock+0x44d #1 rw_enter+0x3e1 sys/kern/kern_rwlock.c:310 #2 sys_sysctl+0x1b3 sys/kern/kern_sysctl.c:233 #3 syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline] #3 syscall+0x489 sys/arch/amd64/amd64/trap.c:585 #4 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff829de988) #0 witness_lock+0x44d #1 syscall+0x3ef mi_syscall sys/sys/syscall_mi.h:93 [inline] #1 syscall+0x3ef sys/arch/amd64/amd64/trap.c:585 #2 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10177 6408K 6419K 78643K 11267 0 pcb 13 8K 8K 78643K 13 0 rtable 240 6K 7K 78643K 359 0 ifaddr 81 16K 16K 78643K 82 0 sysctl 2 0K 0K 78643K 2 0 counters 56 35K 35K 78643K 56 0 ioctlops 0 0K 2K 78643K 38 0 iov 0 0K 16K 78643K 28 0 mount 1 1K 1K 78643K 1 0 log 0 0K 0K 78643K 5 0 vnodes 1271 79K 79K 78643K 1320 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 5K 78643K 5 0 VM map 2 1K 1K 78643K 2 0 sem 12 0K 0K 78643K 46 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1697 195K 286K 78643K 12548 0 file desc 22 81K 129K 78643K 820 0 sigio 0 0K 0K 78643K 2 0 proc 56 74K 111K 78643K 479 0 subproc 104 6K 6K 78643K 104 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 58 0 in_multi 99 6K 7K 78643K 125 0 ether_multi 1 0K 0K 78643K 7 0 mrt 1 0K 0K 78643K 1 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 79 360K 360K 78643K 79 0 exec 0 0K 2K 78643K 615 0 tdb 3 0K 0K 78643K 3 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 7 26K 26K 78643K 7 0 UVM amap 301 83K 86K 78643K 11192 0 UVM aobj 11 6K 6K 78643K 11 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 23 0 NDP 11 0K 2K 78643K 27 0 temp 103 4705K 4765K 78643K 5676 0 kqueue 12 18K 22K 78643K 66 0 SYN cache 2 16K 16K 78643K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 22 0 0 1 0 1 1 0 8 0 rtpcb 120 46 0 43 1 0 1 1 0 8 0 rtentry 112 112 0 1 4 0 4 4 0 8 0 unpcb 136 205 0 190 1 0 1 1 0 8 0 syncache 296 10 0 10 3 2 1 1 0 8 1 tcpqe 32 21 0 21 3 3 0 1 0 8 0 tcpcb 736 141 0 136 4 1 3 3 0 8 2 arp 120 19 0 0 1 0 1 1 0 8 0 inpcb 304 285 0 276 3 1 2 2 0 8 1 ip6q 72 3 0 2 1 0 1 1 0 8 0 ip6af 40 5 0 4 1 0 1 1 0 8 0 nd6 48 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 452 0 0 29 0 29 29 0 8 0 art_table 32 453 0 0 4 0 4 4 0 8 0 art_node 16 111 0 10 1 0 1 1 0 8 0 sysvmsgpl 40 14 0 9 1 0 1 1 0 8 0 semupl 112 7 0 7 1 1 0 1 0 8 0 semapl 112 36 0 26 1 0 1 1 0 8 0 shmpl 112 8 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 2352 0 919 91 1 90 91 0 8 0 ffsino 272 2352 0 919 97 1 96 97 0 8 0 nchpl 144 3412 0 1748 62 0 62 62 0 8 0 uvmvnodes 80 2465 0 0 51 0 51 51 0 8 0 vnodes 224 2465 0 0 145 0 145 145 0 8 0 namei 1024 10019 0 10019 3 2 1 2 0 8 1 percpumem 16 40 0 0 1 0 1 1 0 8 0 scxspl 216 14857 0 14857 10 9 1 8 0 8 1 plimitpl 152 86 0 62 1 0 1 1 0 8 0 sigapl 424 1096 0 1045 7 0 7 7 0 8 0 futexpl 64 3567 0 3562 3 2 1 1 0 8 0 knotepl 120 329 0 0 10 0 10 10 0 8 0 kqueuepl 216 100 0 92 1 0 1 1 0 8 0 pipepl 336 152 0 124 3 0 3 3 0 8 0 fdescpl 496 1081 0 1048 7 2 5 6 0 8 0 filepl 152 3451 0 3211 12 2 10 10 0 8 0 lockfpl 104 114 0 112 1 0 1 1 0 8 0 lockfspl 48 33 0 31 1 0 1 1 0 8 0 sessionpl 144 23 0 7 1 0 1 1 0 8 0 pgrppl 48 25 0 9 1 0 1 1 0 8 0 ucredpl 96 625 0 607 1 0 1 1 0 8 0 zombiepl 144 1048 0 1045 1 0 1 1 0 8 0 processpl 1064 1096 0 1045 5 1 4 4 0 8 0 procpl 672 1909 0 1843 8 2 6 7 0 8 0 sosppl 168 4 0 4 2 1 1 1 0 8 1 sockpl 480 537 0 511 6 2 4 5 0 8 0 mcl64k 65536 5 0 0 1 0 1 1 0 8 0 mcl16k 16384 3 0 0 1 0 1 1 0 8 0 mcl12k 12288 2 0 0 1 0 1 1 0 8 0 mcl9k 9216 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 7 0 0 1 0 1 1 0 8 0 mcl4k 4096 5 0 0 1 0 1 1 0 8 0 mcl2k2 2112 2 0 0 1 0 1 1 0 8 0 mcl2k 2048 178 0 0 20 0 20 20 0 8 0 mtagpl 96 1 0 0 1 0 1 1 0 8 0 mbufpl 256 602 0 0 34 0 34 34 0 8 0 bufpl 288 5805 0 147 405 0 405 405 0 8 0 anonpl 24 306884 0 294459 134 17 117 131 0 186 13 amapchunkpl 152 27895 0 27156 54 18 36 53 0 158 3 amappl16 200 4089 0 3792 41 13 28 31 0 8 7 amappl15 192 188 0 181 1 0 1 1 0 8 0 amappl14 184 214 0 206 1 0 1 1 0 8 0 amappl13 176 79 0 78 1 0 1 1 0 8 0 amappl12 168 91 0 88 1 0 1 1 0 8 0 amappl11 160 148 0 137 1 0 1 1 0 8 0 amappl10 152 206 0 200 1 0 1 1 0 8 0 amappl9 144 566 0 561 1 0 1 1 0 8 0 amappl8 136 655 0 603 2 0 2 2 0 8 0 amappl7 128 206 0 192 1 0 1 1 0 8 0 amappl6 120 282 0 260 2 1 1 2 0 8 0 amappl5 112 815 0 792 1 0 1 1 0 8 0 amappl4 104 1095 0 1064 2 1 1 2 0 8 0 amappl3 96 272 0 258 1 0 1 1 0 8 0 amappl2 88 504 0 461 3 1 2 3 0 8 0 amappl1 80 21600 0 20984 18 3 15 18 0 8 0 amappl 88 10749 0 10510 7 0 7 7 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 10 0 0 1 0 1 1 0 8 0 uaddrrnd 24 1081 0 1048 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1081 0 1048 1 0 1 1 0 8 0 vmmpekpl 168 10936 0 10889 3 0 3 3 0 8 0 vmmpepl 168 100408 0 98024 142 14 128 129 0 357 10 vmsppl 368 1080 0 1047 5 1 4 5 0 8 0 rwobjpl 56 27863 0 24170 53 0 53 53 0 8 0 pdppl 4096 2169 0 2094 133 52 81 97 0 8 6 pvpl 32 742657 0 725052 299 30 269 292 0 265 79 pmappl 248 1080 0 1047 4 1 3 3 0 8 0 extentpl 40 58 0 38 1 0 1 1 0 8 0 phpool 112 835 0 60 23 0 23 23 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:440 panic(ffffffff8257690f) at panic+0x177 sys/kern/subr_prf.c:202 witness_checkorder(fffffd80678e4030,9,0) at witness_checkorder+0x11bd witness_debugger sys/kern/subr_witness.c:2505 [inline] witness_checkorder(fffffd80678e4030,9,0) at witness_checkorder+0x11bd sys/kern/subr_witness.c:772 rw_enter(fffffd80678e4020,21) at rw_enter+0xd1 sys/kern/kern_rwlock.c:250 vm_map_lock_ln(fffffd80678e4018,8a7,ffff800028735000) at vm_map_lock_ln+0xda sys/uvm/uvm_map.c:5466 uvm_map_extract(fffffd80678e4018,7f7ffffda000,1000,ffff80002e3be530,0) at uvm_map_extract+0x173 sys/uvm/uvm_map.c:4530 uvm_io(fffffd80678e4018,ffff80002e3be5c8,0) at uvm_io+0x127 sys/uvm/uvm_io.c:100 sysctl_proc_args(ffff80002e3bea18,2,20000080,ffff80002e3bea48,ffff8000280e97b0) at sysctl_proc_args+0x24b sys/kern/kern_sysctl.c:1790 kern_sysctl(ffff80002e3bea14,3,20000080,ffff80002e3bea48,0,1c,1a3353c8c16c703) at kern_sysctl+0xfd sys/kern/kern_sysctl.c:449 sys_sysctl(ffff8000280e97b0,ffff80002e3beab8,ffff80002e3beb10) at sys_sysctl+0x209 sys/kern/kern_sysctl.c:249 syscall(ffff80002e3beb80) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:102 [inline] syscall(ffff80002e3beb80) at syscall+0x489 sys/arch/amd64/amd64/trap.c:585 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x63f45c32370, count: -12 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x1a: addq $0x8,%rsp x86_ipi_db(ffff800020ce8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23 __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xb sys/dev/kcov.c:144 uvm_map_teardown(fffffd80678e45d8) at uvm_map_teardown+0x267 sys/uvm/uvm_map.c:2791 uvmspace_free(fffffd80678e45d8) at uvmspace_free+0xa6 sys/uvm/uvm_map.c:3685 reaper(ffff8000210f97a0) at reaper+0x18b sys/kern/kern_exit.c:457 end trace frame: 0x0, count: 8 ddb{1}> trace x86_ipi_db(ffff800020ce8ff0) at x86_ipi_db+0x1a sys/arch/amd64/amd64/db_interface.c:393 x86_ipi_handler() at x86_ipi_handler+0xb7 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x23 __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0xb sys/dev/kcov.c:144 uvm_map_teardown(fffffd80678e45d8) at uvm_map_teardown+0x267 sys/uvm/uvm_map.c:2791 uvmspace_free(fffffd80678e45d8) at uvmspace_free+0xa6 sys/uvm/uvm_map.c:3685 reaper(ffff8000210f97a0) at reaper+0x18b sys/kern/kern_exit.c:457 end trace frame: 0x0, count: -7