On Fri, Jul 17, 2026 at 01:40:13AM +0000, Gleb Smirnoff wrote: > The branch main has been updated by glebius: > > URL: > https://cgit.FreeBSD.org/src/commit/?id=56ac3351c61f285ee5b8c9bd4411eeaeb20efe26 > > commit 56ac3351c61f285ee5b8c9bd4411eeaeb20efe26 > Author: Gleb Smirnoff <[email protected]> > AuthorDate: 2026-07-17 01:37:03 +0000 > Commit: Gleb Smirnoff <[email protected]> > CommitDate: 2026-07-17 01:37:03 +0000 > > witness: fix operation without WITNESS_SKIPSPIN > > Since malloc(9) even with M_NOWAIT is forbidden when we hold a spinlock, > we can't print detailed lock tree as the operation tries to allocate > memory.
I think malloc() actually can't be used at all here. It's possible to recurse into the vmem boundary tag allocator; syzkaller triggered the panic below once for me. Can we preallocate a single tracker at boot time, protected by w_mtx? panic: _mtx_lock_sleep: recursed on non-recursive mutex btag lock @ /home/markj/sb/main/src/sys/kern/subr_vmem.c:758 cpuid = 0 time = 1784121321 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe007c0ca450 kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe007c0ca5b0 vpanic() at vpanic+0x257/frame 0xfffffe007c0ca770 panic() at panic+0xb5/frame 0xfffffe007c0ca830 __mtx_lock_sleep() at __mtx_lock_sleep+0xa20/frame 0xfffffe007c0ca970 __mtx_lock_flags() at __mtx_lock_flags+0x1fe/frame 0xfffffe007c0caa50 vmem_bt_alloc() at vmem_bt_alloc+0x9f/frame 0xfffffe007c0cab10 keg_alloc_slab() at keg_alloc_slab+0x1f1/frame 0xfffffe007c0cac30 zone_import() at zone_import+0x2f4/frame 0xfffffe007c0cae30 zone_alloc_item() at zone_alloc_item+0x16a/frame 0xfffffe007c0caf20 _bt_fill() at _bt_fill+0x11b/frame 0xfffffe007c0caf70 vmem_xalloc() at vmem_xalloc+0x475/frame 0xfffffe007c0cb010 vmem_alloc() at vmem_alloc+0x170/frame 0xfffffe007c0cb070 kmem_malloc_domainset() at kmem_malloc_domainset+0x1a1/frame 0xfffffe007c0cb1b0 keg_alloc_slab() at keg_alloc_slab+0x1f1/frame 0xfffffe007c0cb2d0 zone_import() at zone_import+0x2f4/frame 0xfffffe007c0cb4e0 cache_alloc() at cache_alloc+0x7ea/frame 0xfffffe007c0cb5b0 cache_alloc_retry() at cache_alloc_retry+0x35/frame 0xfffffe007c0cb5f0 malloc() at malloc+0x192/frame 0xfffffe007c0cb6b0 witness_checkorder() at witness_checkorder+0x16dc/frame 0xfffffe007c0cb9b0 __mtx_lock_flags() at __mtx_lock_flags+0x187/frame 0xfffffe007c0cbaa0 vm_map_find() at vm_map_find+0x8a/frame 0xfffffe007c0cbaf0 kva_import() at kva_import+0xd4/frame 0xfffffe007c0cbbd0 vmem_try_fetch() at vmem_try_fetch+0x21e/frame 0xfffffe007c0cbcc0 vmem_xalloc() at vmem_xalloc+0x539/frame 0xfffffe007c0cbd60 kva_import_domain() at kva_import_domain+0x5f/frame 0xfffffe007c0cbdb0 vmem_try_fetch() at vmem_try_fetch+0x21e/frame 0xfffffe007c0cbe90 vmem_xalloc() at vmem_xalloc+0x539/frame 0xfffffe007c0cbf30 vmem_bt_alloc() at vmem_bt_alloc+0xec/frame 0xfffffe007c0cc010 keg_alloc_slab() at keg_alloc_slab+0x1f1/frame 0xfffffe007c0cc130 zone_import() at zone_import+0x2f4/frame 0xfffffe007c0cc330 zone_alloc_item() at zone_alloc_item+0x16a/frame 0xfffffe007c0cc420 _bt_fill() at _bt_fill+0x11b/frame 0xfffffe007c0cc470 vmem_xalloc() at vmem_xalloc+0x475/frame 0xfffffe007c0cc510 vmem_alloc() at vmem_alloc+0x170/frame 0xfffffe007c0cc570 kmem_malloc_domainset() at kmem_malloc_domainset+0x1a1/frame 0xfffffe007c0cc6b0 keg_alloc_slab() at keg_alloc_slab+0x1f1/frame 0xfffffe007c0cc7d0 zone_import() at zone_import+0x2f4/frame 0xfffffe007c0cc9e0 cache_alloc() at cache_alloc+0x7ea/frame 0xfffffe007c0ccab0 cache_alloc_retry() at cache_alloc_retry+0x35/frame 0xfffffe007c0ccaf0 fork1() at fork1+0xad4/frame 0xfffffe007c0ccc10 sys_fork() at sys_fork+0xe3/frame 0xfffffe007c0ccd10 amd64_syscall() at amd64_syscall+0x4e1/frame 0xfffffe007c0ccf30 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe007c0ccf30 --- syscall (198, FreeBSD ELF64, __syscall), rip = 0x3857ea, rsp = 0x8262dcf08, rbp = 0x8262dcf80 ---
