login: witness: lock order reversal:
 1st 0xfffffd807f00bcc0 vmmaplk (&map->lock) @ /syzkaller/managers/setuid/kernel/sys/uvm/uvm_fault.c:1444
 2nd 0xfffffd807ecf04e0 inode (&ip->i_lock) @ /syzkaller/managers/setuid/kernel/sys/ufs/ufs/ufs_vnops.c:1547
lock order "&ip->i_lock"(rrwlock) -> "&map->lock"(rwlock) first seen at:
#0  witness_checkorder+0x6cd sys/kern/subr_witness.c:902
#1  _rw_enter+0xd5
#2  vm_map_lock_ln+0x164 sys/uvm/uvm_map.c:5261
#3  uvm_map+0x2fb sys/uvm/uvm_map.c:1220
#4  km_alloc+0x1b7 sys/uvm/uvm_km.c:908
#5  pool_multi_alloc_ni+0xe8 sys/kern/subr_pool.c:1692
#6  pool_p_alloc+0x74 pool_allocator_alloc sys/kern/subr_pool.c:1606 [inline]
#6  pool_p_alloc+0x74 sys/kern/subr_pool.c:927
#7  pool_do_get+0x12b sys/kern/subr_pool.c:718
#8  pool_get+0x106 sys/kern/subr_pool.c:587
#9  ufsdirhash_build+0x420 sys/ufs/ufs/ufs_dirhash.c:180
#10 ufs_lookup+0x2c1 sys/ufs/ufs/ufs_lookup.c:200
#11 VOP_LOOKUP+0x67 sys/kern/vfs_vops.c:90
#12 vfs_lookup+0x556 sys/kern/vfs_lookup.c:523
#13 namei+0x4b2 sys/kern/vfs_lookup.c:224
#14 start_init+0xec check_console sys/kern/init_main.c:600 [inline]
#14 start_init+0xec sys/kern/init_main.c:640
#15 proc_trampoline+0x1c
lock order "&map->lock"(rwlock) -> "&ip->i_lock"(rrwlock) first seen at:
#0  witness_checkorder+0x6cd sys/kern/subr_witness.c:902
#1  _rw_enter+0xd5
#2  _rrw_enter+0x60 sys/kern/kern_rwlock.c:410
#3  VOP_LOCK+0x57 sys/kern/vfs_vops.c:602
#4  vn_lock+0x6e sys/kern/vfs_vnops.c:549
#5  uvn_io+0x2fc sys/uvm/uvm_vnode.c:1188
#6  uvn_get+0x236 sys/uvm/uvm_vnode.c:1048
#7  uvm_fault+0x1312 sys/uvm/uvm_fault.c:1023
#8  uvm_fault_wire+0x70 sys/uvm/uvm_fault.c:1295
#9  uvm_map_pageable_wire+0x31d sys/uvm/uvm_map.c:2266
#10 sys_mlock+0x18b sys/uvm/uvm_mmap.c:739
#11 syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#11 syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
#12 Xsyscall+0x128
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
the kernel did not panic
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
witness_checkorder(fffffd807ecf04e0,9,ffffffff81f40027,60b,0) at witness_checkorder+0x12ff witness_debugger sys/kern/subr_witness.c:2646 [inline]
witness_checkorder(fffffd807ecf04e0,9,ffffffff81f40027,60b,0) at witness_checkorder+0x12ff sys/kern/subr_witness.c:1118
_rw_enter(fffffd807ecf04d0,81,ffffffff81f40027,60b) at _rw_enter+0xd5
_rrw_enter(fffffd807ecf04d0,81,ffffffff81f40027,60b) at _rrw_enter+0x60 sys/kern/kern_rwlock.c:410
VOP_LOCK(fffffd8074ca4e80,81) at VOP_LOCK+0x57 sys/kern/vfs_vops.c:602
vn_lock(fffffd8074ca4e80,81) at vn_lock+0x6e sys/kern/vfs_vnops.c:549
uvn_io(fffffd8074875e20,ffff800020bd8f00,1,2,0) at uvn_io+0x2fc sys/uvm/uvm_vnode.c:1188
uvn_get(fffffd8074875e20,3000,ffff800020bd9020,ffff800020bd9034,0,1) at uvn_get+0x236 sys/uvm/uvm_vnode.c:1048
uvm_fault(fffffd807f00bca8,20003000,2,3) at uvm_fault+0x1312 sys/uvm/uvm_fault.c:1023
uvm_fault_wire(fffffd807f00bca8,20003000,20004000,3) at uvm_fault_wire+0x70 sys/uvm/uvm_fault.c:1295
uvm_map_pageable_wire(fffffd807f00bca8,fffffd806d3c2390,fffffd806d3c2c18,0,0,0) at uvm_map_pageable_wire+0x31d sys/uvm/uvm_map.c:2266
sys_mlock(ffff800020b15520,ffff800020bd93b8,ffff800020bd93a0) at sys_mlock+0x18b sys/uvm/uvm_mmap.c:739
syscall(ffff800020bd9450) at syscall+0x5b8 mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(ffff800020bd9450) at syscall+0x5b8 sys/arch/amd64/amd64/trap.c:574
Xsyscall(6,0,6ce75c8d288,0,6ce75c8d268,6ce75c8d260) at Xsyscall+0x128
end of kernel
end trace frame: 0x6d115493790, count: -14
ddb{1}> show registers
rdi                              0x3
rsi               0xffffffff8219cce0    __sancov_gen_cov_switch_values.127
rbp               0xffff800020bd8b30
rbx                              0x3
rdx                             0x8b
rcx                              0x3
rax                              0x3
r8                0xffffffff812a5a28    witness_checkorder+0x12d8
r9                               0x5
r10               0x8951ad9bbd72a389
r11               0x1ef497fe77d0869d
r12               0xffffffff81f40027    cmd0646_9_tim_udma+0x336db
r13               0xfffffd8002640c30
r14               0xffffffff822e7ff0    w_lodata+0x4e3f0
r15               0xfffffd80026488e0
rip               0xffffffff818c8cf8    db_enter+0x18
cs                               0x8
rflags                         0x246
rsp               0xffff800020bd8b20
ss                              0x10
db_enter+0x18:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor6841) pid=19707 stat=onproc
    flags process=10<SUGID> proc=4000000<THREAD>
    pri=86, usrpri=86, nice=20
    forw=0xffffffffffffffff, list=0xffff800020b14710,0xffff800020b14270
    process=0xffff800020b3a9e8 user=0xffff800020bd4000, vmspace=0xfffffd807f00bca8
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb{1}>