Hi FreeBSD maintainers, We discovered an issue while fuzzing freebsd kernel with syzkaller and our generated syscall descriptions. From the report I think the root cause of this issue appears to be located within ACPI subsystem. This issue is reproducible on the latest release (release/15.0.0-p4, commit 8ef0ed690df2dca0cc22b827819d112f868470bb). The kernel console output, kernel config, and C/syz reproducers can be found at https://drive.google.com/drive/folders/1A0e4OChcrWfSBgJHEpKxSL5envELKzNY?usp=sharing. The issue report is also listed below (symbolized by our modified syz-symbolize) to assist with the analysis: ``` TITLE: panic: mutex ACPI global lock owned at ../../../kern/kern_event.c:LINE CORRUPTED: false () SUPPRESSED: false MAINTAINERS (TO): [] MAINTAINERS (CC): [] login: panic: mutex ACPI global lock owned at ../../../kern/kern_event.c:2615 cpuid = 2 time = 1773840955 KDB: stack backtrace: #0 0xffffffff81608a59 at kdb_backtrace+0x119 /usr/obj/usr/src/kern/subr_kdb.c:452 #1 0xffffffff81537d67 at vpanic+0x257 /usr/obj/usr/src/kern/kern_shutdown.c:960 #2 0xffffffff81537b05 at panic+0xb5 /usr/obj/usr/src/kern/kern_shutdown.c:887 #3 0xffffffff814e6f44 at __mtx_assert+0x224 /usr/obj/usr/src/kern/kern_mutex.c:0 #4 0xffffffff81474f27 at knlist_add+0x57 /usr/obj/usr/src/kern/kern_event.c:2531 #5 0xffffffff8203c4ef at apmkqfilter+0xcf /usr/obj/usr/src/x86/acpica/acpi_apm.c:413 #6 0xffffffff811cc54b at devfs_kqfilter_f+0x18b /usr/obj/usr/src/fs/devfs/devfs_vnops.c:1003 #7 0xffffffff81470f16 at kqueue_register+0xd66 /usr/obj/usr/src/kern/kern_event.c:1769 #8 0xffffffff81473a49 at kqueue_kevent+0x1b9 /usr/obj/usr/src/kern/kern_event.c:1444 #9 0xffffffff814737f9 at kern_kevent_fp+0xf9 /usr/obj/usr/src/kern/kern_event.c:1475 #10 0xffffffff81473617 at kern_kevent+0x157 /usr/obj/usr/src/kern/kern_event.c:1415 #11 0xffffffff81472bb4 at kern_kevent_generic+0x174 /usr/obj/usr/src/kern/kern_event.c:1271 #12 0xffffffff8147288f at sys_kevent+0x1ef /usr/obj/usr/src/kern/kern_event.c:1245 #13 0xffffffff820f9372 at amd64_syscall+0x4e2 /usr/obj/usr/src/kern/subr_syscall.c:193 #14 0xffffffff8209ffab at fast_syscall_common+0xf8 /usr/obj/usr/src/amd64/amd64/exception.S:571 Uptime: 53s Automatic reboot in 15 seconds - press a key on the console to abort ```
Thanks for the report. I've posted a potential fix for review at https://reviews.freebsd.org/D55994
(In reply to John Baldwin from comment #1) Hi Baldwin, Thanks for your patch. I applied it against FreeBSD 15.0.0-p4, but the reproducer can still trigger the issue. Is there a specific branch or commit I should be testing this against? ``` TITLE: panic: _mtx_lock_sleep: recursed on non-recursive mutex ACPI global lock @ ../../../x86/acpica/acpi_apm.c:LINE CORRUPTED: false () SUPPRESSED: false MAINTAINERS (TO): [] MAINTAINERS (CC): [] panic: _mtx_lock_sleep: recursed on non-recursive mutex ACPI global lock @ ../../../x86/acpica/acpi_apm.c:431 cpuid = 2 time = 1774157849 KDB: stack backtrace: #0 0xffffffff81608a59 at kdb_backtrace+0x119 /usr/obj/usr/src/kern/subr_kdb.c:452 #1 0xffffffff81537d67 at vpanic+0x257 /usr/obj/usr/src/kern/kern_shutdown.c:960 #2 0xffffffff81537b05 at panic+0xb5 /usr/obj/usr/src/kern/kern_shutdown.c:887 #3 0xffffffff814e690d at __mtx_lock_sleep+0xa3d /usr/obj/usr/src/kern/kern_mutex.c:712 #4 0xffffffff814e5d9e at __mtx_lock_flags+0x1fe /usr/obj/usr/src/kern/kern_mutex.c:0 #5 0xffffffff8203ca46 at apmreadfilt+0x36 /usr/obj/usr/src/x86/acpica/acpi_apm.c:432 #6 0xffffffff8147141f at kqueue_register+0x126f /usr/obj/usr/src/kern/kern_event.c:1830 #7 0xffffffff81473a49 at kqueue_kevent+0x1b9 /usr/obj/usr/src/kern/kern_event.c:1444 #8 0xffffffff814737f9 at kern_kevent_fp+0xf9 /usr/obj/usr/src/kern/kern_event.c:1475 #9 0xffffffff81473617 at kern_kevent+0x157 /usr/obj/usr/src/kern/kern_event.c:1415 #10 0xffffffff81472bb4 at kern_kevent_generic+0x174 /usr/obj/usr/src/kern/kern_event.c:1271 #11 0xffffffff8147288f at sys_kevent+0x1ef /usr/obj/usr/src/kern/kern_event.c:1245 #12 0xffffffff820f9372 at amd64_syscall+0x4e2 /usr/obj/usr/src/kern/subr_syscall.c:193 #13 0xffffffff8209ff2b at fast_syscall_common+0xf8 /usr/obj/usr/src/amd64/amd64/exception.S:571 Uptime: 1m49s Automatic reboot in 15 seconds - press a key on the console to abort ```
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=cc2715cf1f864345ab175db691d4e152d5fb84af commit cc2715cf1f864345ab175db691d4e152d5fb84af Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2026-03-30 13:38:54 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2026-03-30 13:41:06 +0000 acpi_apm: Narrow scope of ACPI_LOCK This lock doesn't need to be held across seldrain/knlist_destroy. It is also redundant (and a bug) to hold it across knlist_add and knlist_remove since it is the mutex for the knlist. PR: 293901 Reported by: Jiaming Zhang <r772577952@gmail.com> Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D55994 sys/x86/acpica/acpi_apm.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
Ah, ok, I didn't go far enough. I almost removed this other lock anyway as it seemed mostly pointless, but I think this should fix your second panic (on top of the first patch which I've already merged): diff --git a/sys/x86/acpica/acpi_apm.c b/sys/x86/acpica/acpi_apm.c index 71e2573d5fde..e9db0c090f5c 100644 --- a/sys/x86/acpica/acpi_apm.c +++ b/sys/x86/acpica/acpi_apm.c @@ -430,9 +430,7 @@ apmreadfilt(struct knote *kn, long hint) int sleeping; clone = kn->kn_hook; - ACPI_LOCK(acpi); sleeping = clone->acpi_sc->acpi_next_stype != POWER_STYPE_AWAKE; - ACPI_UNLOCK(acpi); return (sleeping); }
(In reply to John Baldwin from comment #4) Are you able to test this followup fix to the original patch?
(In reply to John Baldwin from comment #5) Sorry for the late reply, I was overloaded recently. I will test the followup fix as soon as possible. Thank you for your patience :)
(In reply to John Baldwin from comment #5) After I applied the patch to the latest version (commit 2b954770ddd7a4246c2100373d86ef5316becd81), the reproducer did not trigger any issue. Thank you for the patch!
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=8c941e313e3925b17e49b093244c159db7a112f8 commit 8c941e313e3925b17e49b093244c159db7a112f8 Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2026-04-14 13:25:37 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2026-04-14 13:25:37 +0000 acpi_apm: Don't recurse on ACPI_LOCK in apmreadfilt The lock is already held by the caller since it is used as the knlist lock. PR: 293901 Reported by: Jiaming Zhang <r772577952@gmail.com> Fixes: cc2715cf1f86 ("acpi_apm: Narrow scope of ACPI_LOCK") sys/x86/acpica/acpi_apm.c | 2 -- 1 file changed, 2 deletions(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=a783b0bca2ca79e9f881538314347c5304edd11f commit a783b0bca2ca79e9f881538314347c5304edd11f Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2026-04-14 13:25:37 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2026-04-24 17:49:14 +0000 acpi_apm: Don't recurse on ACPI_LOCK in apmreadfilt The lock is already held by the caller since it is used as the knlist lock. PR: 293901 Reported by: Jiaming Zhang <r772577952@gmail.com> Fixes: cc2715cf1f86 ("acpi_apm: Narrow scope of ACPI_LOCK") (cherry picked from commit 8c941e313e3925b17e49b093244c159db7a112f8) sys/x86/acpica/acpi_apm.c | 2 -- 1 file changed, 2 deletions(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=a7cf142ba9044c3b8f88b4a8ed7f5720bc39b90c commit a7cf142ba9044c3b8f88b4a8ed7f5720bc39b90c Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2026-03-30 13:38:54 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2026-04-24 17:49:14 +0000 acpi_apm: Narrow scope of ACPI_LOCK This lock doesn't need to be held across seldrain/knlist_destroy. It is also redundant (and a bug) to hold it across knlist_add and knlist_remove since it is the mutex for the knlist. PR: 293901 Reported by: Jiaming Zhang <r772577952@gmail.com> Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D55994 (cherry picked from commit cc2715cf1f864345ab175db691d4e152d5fb84af) sys/x86/acpica/acpi_apm.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3639963148722404e92454ffdd4d795fa636a21e commit 3639963148722404e92454ffdd4d795fa636a21e Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2026-04-14 13:25:37 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2026-04-24 15:49:49 +0000 acpi_apm: Don't recurse on ACPI_LOCK in apmreadfilt The lock is already held by the caller since it is used as the knlist lock. PR: 293901 Reported by: Jiaming Zhang <r772577952@gmail.com> Fixes: cc2715cf1f86 ("acpi_apm: Narrow scope of ACPI_LOCK") (cherry picked from commit 8c941e313e3925b17e49b093244c159db7a112f8) sys/x86/acpica/acpi_apm.c | 2 -- 1 file changed, 2 deletions(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=50c4b12485fe1364148c2496ac18946779143ab6 commit 50c4b12485fe1364148c2496ac18946779143ab6 Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2026-03-30 13:38:54 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2026-04-24 15:48:36 +0000 acpi_apm: Narrow scope of ACPI_LOCK This lock doesn't need to be held across seldrain/knlist_destroy. It is also redundant (and a bug) to hold it across knlist_add and knlist_remove since it is the mutex for the knlist. PR: 293901 Reported by: Jiaming Zhang <r772577952@gmail.com> Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D55994 (cherry picked from commit cc2715cf1f864345ab175db691d4e152d5fb84af) sys/x86/acpica/acpi_apm.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)