witness: lock order reversal: 1st 0xffff8000015b9130 sbufsnd (&so->so_snd.sb_lock) 2nd 0xfffff3806d16d1e8 inode (&ip->i_lock) lock order [1] sbufsnd (&so->so_snd.sb_lock) -> [2] inode (&ip->i_lock) lock order data 0xffffffff8351f5d2 -> 0xffffffff83494977 is missing lock order [2] inode (&ip->i_lock) -> [3] sbufrcv (&so->so_rcv.sb_lock) #0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 #1 sblock+0xb6 sys/kern/uipc_socket2.c:536 #2 soreceive+0x27d sys/kern/uipc_socket.c:890 #3 fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264 #4 VOP_READ+0x101 sys/kern/vfs_vops.c:227 #5 vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1 #6 vndsetcred+0xa1 sys/dev/vnd.c:685 #7 vndioctl+0xdfc sys/dev/vnd.c:486 #8 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #9 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 #10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #12 Xsyscall+0x128 lock order [3] sbufrcv (&so->so_rcv.sb_lock) -> [1] sbufsnd (&so->so_snd.sb_lock) #0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 #1 sblock+0xb6 sys/kern/uipc_socket2.c:536 #2 sosplice+0x32b sys/kern/uipc_socket.c:1352 #3 sys_setsockopt+0x2ba sys/kern/uipc_syscalls.c:1226 #4 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 #5 Xsyscall+0x128 Stopped at db_enter+0x25: addq $0x8,%rsp ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic the kernel did not panic ddb{1}> show kasan No such command ddb{1}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 witness_checkorder(fffff3806d16d1e8,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1 rw_do_enter_write(fffff3806d16d1d0,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 rrw_enter(fffff3806d16d1d0,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 VOP_LOCK(fffff38068c2e208,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 vn_lock(fffff38068c2e208,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576 vfs_lookup(ffff800033393f60) at vfs_lookup+0x12b sys/kern/vfs_lookup.c:431 namei(ffff800033393f60) at namei+0x7c5 sys/kern/vfs_lookup.c:250 unp_connect(ffff8000015b8f48,fffff3806f091e00,ffff800045fe54e8) at unp_connect+0x29d sys/kern/uipc_usrreq.c:872 uipc_dgram_send(ffff8000015b8f48,fffff3806da78f00,fffff3806f091e00,fffff3806d56c700) at uipc_dgram_send+0x163 sys/kern/uipc_usrreq.c:609 sosend(ffff8000015b8f48,fffff3806f091e00,ffff8000333941e8,0,fffff3806d56c700,c) at sosend+0x804 sys/kern/uipc_socket.c:-1 sendit(ffff800045fe54e8,3,ffff800033394368,c,ffff800033394420) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785 sys_sendmsg(ffff800045fe54e8,ffff8000333944d0,ffff800033394420) at sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603 syscall(ffff8000333944d0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff8000333944d0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x1cf481084e0, count: -15 ddb{1}> show registers rdi 0 rsi 0x80000 acpi_pdirpa+0x6be71 rbp 0xffff800033393bd0 rbx 0 rdx 0xffff8000015fd6c0 rcx 0xffff800045fe54e8 rax 0x7ffff acpi_pdirpa+0x6be70 r8 0xffff800033393ab0 r9 0x8080808080808080 r10 0x5054c75fe7c2fbb r11 0xd48eaa981a45b871 r12 0xfffff380040cd980 r13 0xfffff380048b5240 r14 0x3 r15 0xffffffff835305d4 substchar+0xacc9 rip 0xffffffff827fe5f5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff800033393bc0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=303970 pid=699 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=50, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800045fe4028,0xffffffff83ae7090 process=0xffff800045fdeb80 user=0xffff80003338f000, vmspace=0xfffff3806ced85d0 estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{1}>