=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz.7.3284/18525 is trying to lock:
ffff8880878192d0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
2 locks held by syz.7.3284/18525:
#0: ffff88807f8538f0 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x1e2/0xd60 net/unix/af_unix.c:2584
#1: ffff888087819850 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffff888087819850 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#1: ffff888087819850 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9b0 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 0 UID: 0 PID: 18525 Comm: syz.7.3284 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xec1/0x2cf0 kernel/locking/lockdep.c:5187
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:240
kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x375/0xa20 kernel/time/hrtimer.c:1994
hrtimer_interrupt+0x44b/0x950 kernel/time/hrtimer.c:2113
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
__sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1067
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:skb_copy_datagram_iter+0xb0/0x240 net/core/datagram.c:535
Code: f6 08 31 f8 84 c0 74 49 e8 cd f0 4b f8 eb 05 e8 c6 f0 4b f8 4c 89 ff 89 ee 4c 89 f2 89 d9 45 31 c0 49 c7 c1 f0 c6 79 89 6a 00 bb f4 ff ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
RSP: 0018:ffffc90005d9f6c0 EFLAGS: 00000246
RAX: ffffffff8979c533 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffffc90005d9fcf0 RSI: 0000000000000000 RDI: ffff88802b8a5c80
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8979c6f0
R10: dffffc0000000000 R11: fffffbfff2061b5f R12: 0000000000000001
R13: 0000000000000000 R14: ffffc90005d9fcf0 R15: ffff88802b8a5c80
skb_copy_datagram_msg include/linux/skbuff.h:4243 [inline]
__unix_dgram_recvmsg+0x666/0xd60 net/unix/af_unix.c:2629
sock_recvmsg_nosec+0x10c/0x140 net/socket.c:1137
____sys_recvmsg+0x3e3/0x4a0 net/socket.c:2916
___sys_recvmsg+0x215/0x590 net/socket.c:2960
do_recvmmsg+0x334/0x800 net/socket.c:3055
__sys_recvmmsg net/socket.c:3129 [inline]
__do_sys_recvmmsg net/socket.c:3152 [inline]
__se_sys_recvmmsg net/socket.c:3145 [inline]
__x64_sys_recvmmsg+0x198/0x250 net/socket.c:3145
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd14979ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd14a56e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007fd149a16090 RCX: 00007fd14979ce59
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000006
RBP: 00007fd149832d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd149a16128 R14: 00007fd149a16090 R15: 00007fd149b3fa48
----------------
Code disassembly (best guess):
0: f6 08 31 testb $0x31,(%rax)
3: f8 clc
4: 84 c0 test %al,%al
6: 74 49 je 0x51
8: e8 cd f0 4b f8 call 0xf84bf0da
d: eb 05 jmp 0x14
f: e8 c6 f0 4b f8 call 0xf84bf0da
14: 4c 89 ff mov %r15,%rdi
17: 89 ee mov %ebp,%esi
19: 4c 89 f2 mov %r14,%rdx
1c: 89 d9 mov %ebx,%ecx
1e: 45 31 c0 xor %r8d,%r8d
21: 49 c7 c1 f0 c6 79 89 mov $0xffffffff8979c6f0,%r9
28: 6a 00 push $0x0
* 2a: e8 bb f4 ff ff call 0xfffff4ea <-- trapping instruction
2f: 48 83 c4 08 add $0x8,%rsp
33: 5b pop %rbx
34: 41 5c pop %r12
36: 41 5d pop %r13
38: 41 5e pop %r14
3a: 41 5f pop %r15
3c: 5d pop %rbp
3d: c3 ret
3e: cc int3
3f: cc int3