=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz-executor/26488 is trying to lock:
ffff8880484f5bc8 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x208/0x8d0 arch/x86/kvm/xen.c:1872
other info that might help us debug this:
context-{2:2}
locks held by syz-executor/26488: 2, on CPU#0:
#0: ffff88807f328478 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:531
#1: ffff8880484f6118 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:249 [inline]
#1: ffff8880484f6118 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:356 [inline]
#1: ffff8880484f6118 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1d2/0x8d0 arch/x86/kvm/xen.c:1870
stack backtrace:
CPU: 0 UID: 0 PID: 26488 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4874 [inline]
check_wait_context kernel/locking/lockdep.c:4946 [inline]
__lock_acquire+0xf5b/0x2de0 kernel/locking/lockdep.c:5238
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:271
kvm_xen_set_evtchn_fast+0x208/0x8d0 arch/x86/kvm/xen.c:1872
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:139
__run_hrtimer kernel/time/hrtimer.c:2079 [inline]
__hrtimer_run_queues+0x371/0xa10 kernel/time/hrtimer.c:2136
hrtimer_interrupt+0x4cd/0xaa0 kernel/time/hrtimer.c:2255
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
__sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221
Code: f7 e8 bd 52 9c f5 f7 c3 00 02 00 00 74 05 e8 d0 f1 c8 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 84 44 8d f5 65 48 8b 05 bc f0 d8 08 48 85 c0 74 18 5b 41 5e e9
RSP: 0000:ffffc9001b417468 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000282 RCX: 8000000000000001
RDX: 0000000000000007 RSI: ffffffff8e6a82fb RDI: 0000000000000001
RBP: ffff88802aeecc00 R08: ffffffff91be00bf R09: 1ffffffff237c017
R10: dffffc0000000000 R11: fffffbfff237c018 R12: 0000000000000000
R13: ffff88807186e000 R14: ffffffff9c0c5868 R15: 0000000000000000
__debug_check_no_obj_freed lib/debugobjects.c:1180 [inline]
debug_check_no_obj_freed+0x39e/0x450 lib/debugobjects.c:1201
__free_pages_prepare mm/page_alloc.c:1410 [inline]
free_unref_folios+0x561/0x14e0 mm/page_alloc.c:3017
folios_put_refs+0x9e9/0xb30 mm/folio.c:1039
folio_batch_release include/linux/folio_batch.h:101 [inline]
shmem_undo_range+0x55a/0x1730 mm/shmem.c:1377
shmem_truncate_range mm/shmem.c:1513 [inline]
shmem_evict_inode+0x240/0xb00 mm/shmem.c:1657
evict+0x624/0xb50 fs/inode.c:821
filename_unlinkat+0x2f7/0x5c0 fs/namei.c:5741
__do_sys_unlink fs/namei.c:5772 [inline]
__se_sys_unlink+0x2e/0x140 fs/namei.c:5769
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x293/0x6e0 arch/x86/entry/syscall_32.c:286
do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:311
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf742ef1c
Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8
RSP: 002b:00000000f757ecd8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a
RAX: ffffffffffffffda RBX: 00000000f757ed80 RCX: 0000000000008000
RDX: 00000000f741fff4 RSI: 0000000000000000 RDI: 00000000f757fe14
RBP: 00000000f757ed80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: f7 e8 imul %eax
2: bd 52 9c f5 f7 mov $0xf7f59c52,%ebp
7: c3 ret
8: 00 02 add %al,(%rdx)
a: 00 00 add %al,(%rax)
c: 74 05 je 0x13
e: e8 d0 f1 c8 f5 call 0xf5c8f1e3
13: 9c pushf
14: 58 pop %rax
15: a9 00 02 00 00 test $0x200,%eax
1a: 75 29 jne 0x45
1c: f7 c3 00 02 00 00 test $0x200,%ebx
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 84 44 8d f5 call 0xf58d44b3 <-- trapping instruction
2f: 65 48 8b 05 bc f0 d8 mov %gs:0x8d8f0bc(%rip),%rax # 0x8d8f0f3
36: 08
37: 48 85 c0 test %rax,%rax
3a: 74 18 je 0x54
3c: 5b pop %rbx
3d: 41 5e pop %r14
3f: e9 .byte 0xe9