witness: lock order reversal: 1st 0xffff800010fdd978 sbufsnd (&so->so_snd.sb_lock) 2nd 0xffffef806cc5aea8 inode (&ip->i_lock) lock order [1] sbufsnd (&so->so_snd.sb_lock) -> [2] inode (&ip->i_lock) lock order data 0xffffffff835174a1 -> 0xffffffff8348f227 is missing lock order [2] inode (&ip->i_lock) -> [3] sbufrcv (&so->so_rcv.sb_lock) #0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 #1 sblock+0xb6 sys/kern/uipc_socket2.c:536 #2 soreceive+0x27d sys/kern/uipc_socket.c:890 #3 fifo_read+0x117 sys/miscfs/fifofs/fifo_vnops.c:264 #4 VOP_READ+0x101 sys/kern/vfs_vops.c:227 #5 vn_rdwr+0x15b sys/kern/vfs_vnops.c:-1 #6 vndsetcred+0xa1 sys/dev/vnd.c:685 #7 vndioctl+0xdfc sys/dev/vnd.c:486 #8 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #9 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 #10 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #12 Xsyscall+0x128 lock order [3] sbufrcv (&so->so_rcv.sb_lock) -> [1] sbufsnd (&so->so_snd.sb_lock) #0 rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 #1 sblock+0xb6 sys/kern/uipc_socket2.c:536 #2 sosplice+0x32b sys/kern/uipc_socket.c:1352 #3 sys_setsockopt+0x2ba sys/kern/uipc_syscalls.c:1226 #4 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #5 Xsyscall+0x128 Stopped at db_enter+0x25: addq $0x8,%rsp ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic the kernel did not panic ddb{0}> show kasan No such command ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 witness_checkorder(ffffef806cc5aea8,9,0) at witness_checkorder+0x10d1 sys/kern/subr_witness.c:-1 rw_do_enter_write(ffffef806cc5ae90,1) at rw_do_enter_write+0xba sys/kern/kern_rwlock.c:234 rrw_enter(ffffef806cc5ae90,1) at rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 VOP_LOCK(ffffef80607646e0,2001) at VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 vn_lock(ffffef80607646e0,2001) at vn_lock+0xa4 sys/kern/vfs_vnops.c:576 vfs_lookup(ffff80003bfb6b30) at vfs_lookup+0x12b sys/kern/vfs_lookup.c:431 namei(ffff80003bfb6b30) at namei+0x7c5 sys/kern/vfs_lookup.c:250 unp_connect(ffff800010fdd790,ffffef806d80b300,ffff80003bfb94e0) at unp_connect+0x29d sys/kern/uipc_usrreq.c:872 uipc_dgram_send(ffff800010fdd790,ffffef807583cb00,ffffef806d80b300,0) at uipc_dgram_send+0x163 sys/kern/uipc_usrreq.c:609 sosend(ffff800010fdd790,ffffef806d80b300,ffff80003bfb6db8,0,0,c) at sosend+0x804 sys/kern/uipc_socket.c:-1 sendit(ffff80003bfb94e0,3,ffff80003bfb6f38,c,ffff80003bfb6ff0) at sendit+0x5a5 sys/kern/uipc_syscalls.c:785 sys_sendmsg(ffff80003bfb94e0,ffff80003bfb70a0,ffff80003bfb6ff0) at sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603 syscall(ffff80003bfb70a0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003bfb70a0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x1f5bb58a3b0, count: -15 ddb{0}> show registers rdi 0 rsi 0x80000 acpi_pdirpa+0x6be71 rbp 0xffff80003bfb67a0 rbx 0 rdx 0xffff8000015d7bc0 rcx 0xffff80003bfb94e0 rax 0x7ffff acpi_pdirpa+0x6be70 r8 0xffff80003bfb6680 r9 0x8080808080808080 r10 0xd1279a298f8fda93 r11 0x8ba41ccf5be1b322 r12 0xffffef80040c1980 r13 0xffffef80048a8f10 r14 0x3 r15 0xffffffff835281e2 substchar+0xe54c rip 0xffffffff830c2a95 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003bfb6790 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=301231 pid=15027 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003bfb82b8,0xffffffff83aff008 process=0xffff80002a37eb68 user=0xffff80003bfb2000, vmspace=0xffffef806cf197b8 estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 15027 388177 52071 0 2 0 syz-executor *15027 301231 52071 0 7 0x4000000 syz-executor 43330 313587 20227 0 2 0 syz-executor 43330 126810 20227 0 3 0x4000080 fsleep syz-executor 43903 197759 29650 0 2 0 syz-executor 43903 140480 29650 0 3 0x4000080 fsleep syz-executor 88084 258617 99398 0 2 0 syz-executor 88084 181657 99398 0 3 0x4000080 fsleep syz-executor 48772 361536 63074 0 2 0x1000000 syz-executor 48772 361808 63074 0 3 0x5000080 netacc syz-executor 35818 92384 65891 0 3 0x80 nanoslp syz-executor 35818 353677 65891 0 3 0x4000080 msgwait syz-executor 35818 477495 65891 0 3 0x4000080 fsleep syz-executor 35818 432135 65891 0 3 0x4000080 fsleep syz-executor 7350 46445 63860 0 3 0x80 nanoslp syz-executor 7350 314831 63860 0 3 0x4000080 ttyin syz-executor 7350 423746 63860 0 3 0x4000080 fsleep syz-executor 73339 520856 0 0 3 0x14200 acct acct 88945 232357 1 0 3 0x100083 ttyin getty 65891 321996 53560 0 2 0x2 syz-executor 63860 1816 53560 0 3 0x82 nanoslp syz-executor 29650 313202 53560 0 3 0x82 nanoslp syz-executor 52071 472572 53560 0 3 0x82 nanoslp syz-executor 43437 238444 53560 0 3 0x82 nanoslp syz-executor 63074 494532 53560 0 3 0x82 nanoslp syz-executor 20227 478036 53560 0 3 0x82 nanoslp syz-executor 99398 514175 53560 0 3 0x82 nanoslp syz-executor 53560 468545 1 0 3 0x82 kqread syz-executor 24522 295706 0 0 3 0x14200 bored smr 46842 259149 0 0 2 0x14200 zerothread 3318 397892 0 0 3 0x14200 aiodoned aiodoned 53634 361085 0 0 3 0x14200 syncer update 40350 390527 0 0 3 0x14200 cleaner cleaner 38334 335619 0 0 3 0x14200 reaper reaper 94357 143046 0 0 3 0x14200 pgdaemon pagedaemon 13829 442891 0 0 3 0x14200 bored viomb 18380 76845 0 0 3 0x40014200 acpi0 acpi0 40662 174522 0 0 7 0x40014200 idle1 6063 394707 0 0 3 0x14200 bored softnet1 45998 407204 0 0 3 0x14200 bored softnet0 22831 357952 0 0 3 0x14200 smrbar systqmp 5458 195242 0 0 3 0x14200 bored systq 9670 80074 0 0 3 0x14200 tmoslp softclockmp 25787 216384 0 0 3 0x40014200 tmoslp softclock 36350 47178 0 0 3 0x40014200 idle0 1 407141 0 0 3 0x82 wait init 0 0 -1 0 3 0x10010200 scheduler swapper ddb{0}> show all locks Process 15027 (syz-executor) thread 0xffff80003bfb94e0 (301231) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a6f680) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 unp_connect+0x28c sys/kern/uipc_usrreq.c:872 #2 uipc_dgram_send+0x163 sys/kern/uipc_usrreq.c:609 #3 sosend+0x804 sys/kern/uipc_socket.c:-1 #4 sendit+0x5a5 sys/kern/uipc_syscalls.c:785 #5 sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603 #6 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #7 Xsyscall+0x128 exclusive rwlock sbufsnd r = 0 (0xffff800010fdd978) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 sblock+0xb6 sys/kern/uipc_socket2.c:536 #3 sosend+0x2e9 sys/kern/uipc_socket.c:639 #4 sendit+0x5a5 sys/kern/uipc_syscalls.c:785 #5 sys_sendmsg+0x246 sys/kern/uipc_syscalls.c:603 #6 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #7 Xsyscall+0x128 Process 7350 (syz-executor) thread 0xffff800045feed10 (314831) exclusive rrwlock inode r = 0 (0xffffef807bc80b80) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:621 #3 VOP_LOCK+0xbd sys/kern/vfs_vops.c:527 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:576 #5 spec_open+0x2f2 sys/kern/spec_vnops.c:151 #6 VOP_OPEN+0x8b sys/kern/vfs_vops.c:138 #7 vn_open+0x7a5 sys/kern/vfs_vnops.c:183 #8 vndioctl+0xc43 sys/dev/vnd.c:458 #9 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264 #10 vn_ioctl+0xf8 sys/kern/vfs_vnops.c:537 #11 sys_ioctl+0x674 sys/kern/sys_generic.c:-1 #12 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline] #12 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783 #13 Xsyscall+0x128 Process 22831 (systqmp) thread 0xffff800045ffe298 (357952) shared rwlock systqmp r = 0 (0xffffffff838f8528) #0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160 #1 taskq_thread+0x12a sys/kern/kern_task.c:442 #2 proc_trampoline+0x10 ddb{0}>