witness: userret: returning with the following locks held: exclusive rrwlock inode r = 0 (0xfffffd8068bf72c8) #0 witness_lock+0x52e sys/kern/subr_witness.c:1163 #1 rw_enter+0x46d sys/kern/kern_rwlock.c:306 #2 rrw_enter+0x4f sys/kern/kern_rwlock.c:435 #3 VOP_LOCK+0x4b sys/kern/vfs_vops.c:602 #4 vn_write+0x169 vn_lock sys/kern/vfs_vnops.c:561 [inline] #4 vn_write+0x169 sys/kern/vfs_vnops.c:401 #5 dofilewritev+0x1ac sys/kern/sys_generic.c:364 #6 sys_write+0x83 sys/kern/sys_generic.c:284 #7 syscall+0x552 mi_syscall sys/sys/syscall_mi.h:92 [inline] #7 syscall+0x552 sys/arch/amd64/amd64/trap.c:555 #8 Xsyscall+0x128 panic: witness_warn Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 89369 35348 32767 0x10 0 1 syz-executor.1 * 78424 86487 32767 0x1010 0x4080000 0 syz-executor.0 db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 witness_warn(2,0,ffffffff82203f4a) at witness_warn+0x69e witness_debugger sys/kern/subr_witness.c:2509 [inline] witness_warn(2,0,ffffffff82203f4a) at witness_warn+0x69e sys/kern/subr_witness.c:1454 userret(ffff800020ab0780) at userret+0x36a sys/kern/kern_sig.c:1916 syscall(ffff800021349800) at syscall+0x44a mi_syscall_return sys/sys/syscall_mi.h:115 [inline] syscall(ffff800021349800) at syscall+0x44a sys/arch/amd64/amd64/trap.c:577 Xsyscall(6,5,c,0,3,bcac85c30e0) at Xsyscall+0x128 end of kernel end trace frame: 0xbccfc38b850, count: 9 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic witness_warn ddb{0}> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 witness_warn(2,0,ffffffff82203f4a) at witness_warn+0x69e witness_debugger sys/kern/subr_witness.c:2509 [inline] witness_warn(2,0,ffffffff82203f4a) at witness_warn+0x69e sys/kern/subr_witness.c:1454 userret(ffff800020ab0780) at userret+0x36a sys/kern/kern_sig.c:1916 syscall(ffff800021349800) at syscall+0x44a mi_syscall_return sys/sys/syscall_mi.h:115 [inline] syscall(ffff800021349800) at syscall+0x44a sys/arch/amd64/amd64/trap.c:577 Xsyscall(6,5,c,0,3,bcac85c30e0) at Xsyscall+0x128 end of kernel end trace frame: 0xbccfc38b850, count: -6 ddb{0}> show registers rdi 0 rsi 0x3ffff acpi_pdirpa+0x2be67 rbp 0xffff800021349540 rbx 0xffff8000213495f0 rdx 0x40000 acpi_pdirpa+0x2be68 rcx 0xffff800022f6e000 rax 0xffff800000a6e740 r8 0xffffffff816e7983 kprintf+0x173 r9 0x1 r10 0x25 r11 0x17b9d39d4f8d71fe r12 0x3000000008 r13 0xffff800021349550 r14 0x100 r15 0x1 rip 0xffffffff81d5f328 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff800021349530 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor.0) pid=78424 stat=onproc flags process=1010 proc=4080000 pri=32, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff800020ab0508,0xffff800020ab13e8 process=0xffff800020addc00 user=0xffff800021344000, vmspace=0xfffffd807f00c8a0 estcpu=36, cpticks=5, pctcpu=0.0 user=0, sys=5, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 35348 89369 27014 32767 7 0x10 syz-executor.1 35348 461449 27014 32767 3 0x4000090 kqread syz-executor.1 86487 9592 58436 32767 3 0x3010 suspend syz-executor.0 *86487 78424 58436 32767 7 0x4081010 syz-executor.0 27014 454852 71429 32767 3 0x90 nanosleep syz-executor.1 71429 209989 93572 0 3 0x82 wait syz-executor.1 58436 504606 26669 32767 3 0x90 nanosleep syz-executor.0 26669 469411 93572 0 3 0x82 wait syz-executor.0 61173 263594 0 0 3 0x14200 bored sosplice 93572 313016 75017 0 3 0x82 thrsleep syz-fuzzer 93572 327950 75017 0 3 0x4000082 nanosleep syz-fuzzer 93572 19282 75017 0 3 0x4000082 thrsleep syz-fuzzer 93572 432401 75017 0 3 0x4000082 thrsleep syz-fuzzer 93572 391116 75017 0 3 0x4000082 thrsleep syz-fuzzer 93572 337246 75017 0 2 0x4000082 syz-fuzzer 93572 324028 75017 0 3 0x4000082 thrsleep syz-fuzzer 93572 398761 75017 0 3 0x4000082 thrsleep syz-fuzzer 93572 472416 75017 0 2 0x4000482 syz-fuzzer 93572 489461 75017 0 3 0x4000082 thrsleep syz-fuzzer 75017 207776 23643 0 3 0x10008a pause ksh 23643 395963 35169 0 3 0x92 select sshd 3353 317681 1 0 3 0x100083 ttyin getty 35169 74763 1 0 3 0x80 select sshd 1302 173572 87988 73 3 0x100090 kqread syslogd 87988 289684 1 0 3 0x100082 netio syslogd 69354 375510 1 77 3 0x100090 poll dhclient 31633 88000 1 0 3 0x80 poll dhclient 46083 436900 0 0 2 0x14200 zerothread 89258 149910 0 0 3 0x14200 aiodoned aiodoned 70518 337643 0 0 3 0x14200 syncer update 80730 474308 0 0 3 0x14200 cleaner cleaner 50607 275665 0 0 2 0x14200 reaper 35671 390107 0 0 3 0x14200 pgdaemon pagedaemon 36671 473462 0 0 3 0x14200 bored crynlk 58926 17827 0 0 3 0x14200 bored crypto 5382 80613 0 0 3 0x40014200 acpi0 acpi0 4545 352386 0 0 3 0x40014200 idle1 25181 392412 0 0 3 0x14200 bored softnet 18461 70594 0 0 3 0x14200 bored systqmp 78939 339922 0 0 3 0x14200 bored systq 14735 352778 0 0 3 0x40014200 bored softclock 6284 186362 0 0 3 0x40014200 idle0 87273 427670 0 0 3 0x14200 bored smr 1 202248 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 86487 (syz-executor.0) thread 0xffff800020ab0780 (78424) exclusive rrwlock inode r = 0 (0xfffffd8068bf72c8) #0 witness_lock+0x52e sys/kern/subr_witness.c:1163 #1 rw_enter+0x46d sys/kern/kern_rwlock.c:306 #2 rrw_enter+0x4f sys/kern/kern_rwlock.c:435 #3 VOP_LOCK+0x4b sys/kern/vfs_vops.c:602 #4 vn_write+0x169 vn_lock sys/kern/vfs_vnops.c:561 [inline] #4 vn_write+0x169 sys/kern/vfs_vnops.c:401 #5 dofilewritev+0x1ac sys/kern/sys_generic.c:364 #6 sys_write+0x83 sys/kern/sys_generic.c:284 #7 syscall+0x552 mi_syscall sys/sys/syscall_mi.h:92 [inline] #7 syscall+0x552 sys/arch/amd64/amd64/trap.c:555 #8 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9462 6321K 6321K 78643K 10729 0 0 pcb 13 8K 8K 78643K 13 0 0 rtable 105 3K 3K 78643K 1816 0 0 ifaddr 36 11K 11K 78643K 257 0 0 counters 39 33K 33K 78643K 39 0 0 ioctlops 0 0K 2K 78643K 116 0 0 iov 0 0K 24K 78643K 217 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1215 76K 76K 78643K 2273 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 28 0 0 VM map 2 1K 1K 78643K 2 0 0 sem 12 0K 0K 78643K 266 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1808 196K 290K 78643K 12765 0 0 file desc 8 25K 33K 78643K 2421 0 0 sigio 0 0K 0K 78643K 22 0 0 proc 41 38K 70K 78643K 1997 0 0 subproc 34 2K 2K 78643K 646 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 314 0 0 in_multi 33 2K 2K 78643K 513 0 0 ether_multi 1 0K 0K 78643K 20 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 60 265K 265K 78643K 60 0 0 exec 0 0K 1K 78643K 805 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 98 21K 30K 78643K 8663 0 0 UVM aobj 126 3K 4K 78643K 138 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 0K 78643K 150 0 0 NDP 5 0K 0K 78643K 117 0 0 temp 121 3546K 3618K 78643K 12331 0 0 kqueue 0 0K 0K 78643K 40 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 78 0 72 1 0 1 1 0 8 0 plcache 128 20 0 0 1 0 1 1 0 8 0 rtpcb 80 207 0 205 1 0 1 1 0 8 0 rtentry 112 441 0 397 2 0 2 2 0 8 0 unpcb 120 1038 0 1030 1 0 1 1 0 8 0 syncache 264 4 0 4 1 1 0 1 0 8 0 tcpqe 32 3997 0 3997 1 1 0 1 0 8 0 tcpcb 544 566 0 562 1 0 1 1 0 8 0 ipq 40 4 0 4 3 2 1 1 0 8 1 ipqe 40 15 0 15 3 2 1 1 0 8 1 inpcb 280 1359 0 1352 1 0 1 1 0 8 0 nd6 48 114 0 108 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 1798 0 1607 13 1 12 13 0 8 0 art_table 32 1799 0 1607 2 0 2 2 0 8 0 art_node 16 440 0 400 1 0 1 1 0 8 0 sysvmsgpl 40 6 0 4 2 1 1 1 0 8 0 semupl 112 3 0 3 1 1 0 1 0 8 0 semapl 112 264 0 254 1 0 1 1 0 8 0 shmpl 112 136 0 12 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 4099 0 2668 47 0 47 47 0 8 0 ffsino 272 4099 0 2668 96 0 96 96 0 8 0 nchpl 144 7172 0 5544 61 0 61 61 0 8 0 uvmvnodes 72 4754 0 0 87 0 87 87 0 8 0 vnodes 200 4754 0 0 251 0 251 251 0 8 0 namei 1024 27357 0 27357 3 2 1 1 0 8 1 percpumem 16 30 0 0 1 0 1 1 0 8 0 scxspl 192 20416 0 20416 16 15 1 7 0 8 1 plimitpl 152 422 0 413 1 0 1 1 0 8 0 sigapl 432 2484 0 2468 4 2 2 3 0 8 0 futexpl 56 24006 0 24006 2 1 1 1 0 8 1 knotepl 112 1303 0 1284 1 0 1 1 0 8 0 kqueuepl 104 603 0 600 1 0 1 1 0 8 0 pipepl 112 1544 0 1524 4 3 1 2 0 8 0 fdescpl 488 2485 0 2468 3 0 3 3 0 8 0 filepl 152 15674 0 15569 12 7 5 7 0 8 0 lockfpl 104 554 0 554 3 2 1 1 0 8 1 lockfspl 48 170 0 170 3 2 1 1 0 8 1 sessionpl 112 53 0 43 1 0 1 1 0 8 0 pgrppl 48 85 0 75 1 0 1 1 0 8 0 ucredpl 96 4552 0 4543 1 0 1 1 0 8 0 zombiepl 144 2469 0 2468 4 3 1 1 0 8 0 processpl 896 2501 0 2468 4 0 4 4 0 8 0 procpl 632 6410 0 6365 13 9 4 5 0 8 0 srpgc 64 72 0 72 12 11 1 1 0 8 1 sosppl 128 34 0 34 8 8 0 1 0 8 0 sockpl 384 2668 0 2651 7 4 3 4 0 8 1 mcl64k 65536 16 0 0 2 0 2 2 0 8 0 mcl16k 16384 4 0 0 1 0 1 1 0 8 0 mcl12k 12288 15 0 0 2 0 2 2 0 8 0 mcl9k 9216 6 0 0 1 0 1 1 0 8 0 mcl8k 8192 5 0 0 1 0 1 1 0 8 0 mcl4k 4096 11 0 0 2 0 2 2 0 8 0 mcl2k2 2112 5 0 0 1 0 1 1 0 8 0 mcl2k 2048 121 0 0 14 0 14 14 0 8 0 mtagpl 80 1 0 0 1 0 1 1 0 8 0 mbufpl 256 316 0 0 11 0 11 11 0 8 0 bufpl 256 11204 0 4190 439 0 439 439 0 8 0 anonpl 16 299412 0 292155 117 75 42 46 0 124 8 amapchunkpl 152 17862 0 17768 34 29 5 12 0 158 0 amappl16 192 12665 0 12277 116 88 28 33 0 8 8 amappl15 184 189 0 188 1 0 1 1 0 8 0 amappl14 176 592 0 588 1 0 1 1 0 8 0 amappl13 168 392 0 386 7 6 1 1 0 8 0 amappl12 160 175 0 174 2 1 1 1 0 8 0 amappl11 152 468 0 457 1 0 1 1 0 8 0 amappl10 144 463 0 461 1 0 1 1 0 8 0 amappl9 136 1314 0 1309 1 0 1 1 0 8 0 amappl8 128 847 0 820 3 1 2 2 0 8 0 amappl7 120 483 0 475 1 0 1 1 0 8 0 amappl6 112 353 0 343 1 0 1 1 0 8 0 amappl5 104 516 0 503 1 0 1 1 0 8 0 amappl4 96 2684 0 2655 1 0 1 1 0 8 0 amappl3 88 683 0 672 1 0 1 1 0 8 0 amappl2 80 16443 0 16367 3 1 2 3 0 8 0 amappl1 72 72504 0 72037 24 14 10 19 0 8 0 amappl 80 7238 0 7199 1 0 1 1 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma64 64 259 0 259 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 137 0 12 4 1 3 3 0 8 0 uaddrrnd 24 2485 0 2468 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 2485 0 2468 1 0 1 1 0 8 0 vmmpekpl 168 24075 0 24045 2 0 2 2 0 8 0 vmmpepl 168 320916 0 319223 146 64 82 86 0 357 7 vmsppl 368 2484 0 2468 2 0 2 2 0 8 0 pdppl 4096 4977 0 4936 6 0 6 6 0 8 0 pvpl 32 799202 0 788674 231 117 114 126 0 265 21 pmappl 232 2484 0 2468 4 3 1 2 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 597 0 5 17 0 17 17 0 8 0