=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
pr/ttyS0/35 is trying to lock:
ffff88805960dbc8 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x208/0x8d0 arch/x86/kvm/xen.c:1872
other info that might help us debug this:
context-{2:2}
locks held by pr/ttyS0/35: 2, on CPU#0:
#0: ffffffff902346f8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline]
#0: ffffffff902346f8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:529 [inline]
#0: ffffffff902346f8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291
#1: ffff88805960e118 (&kvm->srcu){.?.?}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:249 [inline]
#1: ffff88805960e118 (&kvm->srcu){.?.?}-{0:0}, at: srcu_read_lock include/linux/srcu.h:356 [inline]
#1: ffff88805960e118 (&kvm->srcu){.?.?}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1d2/0x8d0 arch/x86/kvm/xen.c:1870
stack backtrace:
CPU: 0 UID: 0 PID: 35 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4874 [inline]
check_wait_context kernel/locking/lockdep.c:4946 [inline]
__lock_acquire+0xf5b/0x2de0 kernel/locking/lockdep.c:5238
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:271
kvm_xen_set_evtchn_fast+0x208/0x8d0 arch/x86/kvm/xen.c:1872
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:139
__run_hrtimer kernel/time/hrtimer.c:2079 [inline]
__hrtimer_run_queues+0x371/0xa10 kernel/time/hrtimer.c:2136
hrtimer_interrupt+0x4cd/0xaa0 kernel/time/hrtimer.c:2255
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
__sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1079
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1073 [inline]
sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1073
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:variable_ffs arch/x86/include/asm/bitops.h:312 [inline]
RIP: 0010:handle_softirqs+0x19f/0x8d0 kernel/softirq.c:657
Code: 6c 24 24 44 0f b7 f3 48 c7 c7 00 54 4b 8c e8 58 71 9e 0a 65 66 c7 05 2a 1c 85 13 00 00 e8 d9 52 48 00 fb 48 c7 c3 c0 a0 00 90 ff ff ff ff 41 0f bc c6 41 89 c5 41 ff c5 0f 84 f9 03 00 00 48
RSP: 0018:ffffc90000007f38 EFLAGS: 00000206
RAX: 0000000000022a0a RBX: ffffffff9000a0c0 RCX: 0000000000000101
RDX: 0000000000000000 RSI: ffffffff8e9f856c RDI: ffffffff8cb02a80
RBP: 000000000000000a R08: ffffffff91e196bf R09: 1ffffffff23c32d7
R10: dffffc0000000000 R11: fffffbfff23c32d8 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000102 R15: dffffc0000000000
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_call_function_single arch/x86/kernel/smp.c:267 [inline]
sysvec_call_function_single+0xa3/0xc0 arch/x86/kernel/smp.c:267
asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:681
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221
Code: f7 e8 ed 69 7a f5 f7 c3 00 02 00 00 74 05 e8 30 31 a7 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 b4 53 6b f5 65 48 8b 05 2c fa e3 08 48 85 c0 74 18 5b 41 5e c3
RSP: 0018:ffffc90000ab7ca8 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000206 RCX: 8000000000000001
RDX: 0000000000000000 RSI: ffffffff8e9f856c RDI: 0000000000000001
RBP: ffffc90000ab7e18 R08: ffffffff91e196bf R09: 1ffffffff23c32d7
R10: dffffc0000000000 R11: fffffbfff23c32d8 R12: 0000000000000002
R13: ffff8880212c1f40 R14: ffffffff9c4da140 R15: dffffc0000000000
nbcon_emit_one kernel/printk/nbcon.c:1165 [inline]
nbcon_kthread_func+0x724/0x8d0 kernel/printk/nbcon.c:1271
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 6c insb (%dx),%es:(%rdi)
1: 24 24 and $0x24,%al
3: 44 0f b7 f3 movzwl %bx,%r14d
7: 48 c7 c7 00 54 4b 8c mov $0xffffffff8c4b5400,%rdi
e: e8 58 71 9e 0a call 0xa9e716b
13: 65 66 c7 05 2a 1c 85 movw $0x0,%gs:0x13851c2a(%rip) # 0x13851c47
1a: 13 00 00
1d: e8 d9 52 48 00 call 0x4852fb
22: fb sti
23: 48 c7 c3 c0 a0 00 90 mov $0xffffffff9000a0c0,%rbx
* 2a: b8 ff ff ff ff mov $0xffffffff,%eax <-- trapping instruction
2f: 41 0f bc c6 bsf %r14d,%eax
33: 41 89 c5 mov %eax,%r13d
36: 41 ff c5 inc %r13d
39: 0f 84 f9 03 00 00 je 0x438
3f: 48 rex.W