=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
udevd/5005 is trying to lock:
ffff88802ce99bc8 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x208/0x8d0 arch/x86/kvm/xen.c:1872
other info that might help us debug this:
context-{2:2}
locks held by udevd/5005: 2, on CPU#1:
#0: ffffffff904b3910 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:249 [inline]
#0: ffffffff904b3910 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:356
#1: ffff88802ce9a118 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:249 [inline]
#1: ffff88802ce9a118 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:356 [inline]
#1: ffff88802ce9a118 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1d2/0x8d0 arch/x86/kvm/xen.c:1870
stack backtrace:
CPU: 1 UID: 0 PID: 5005 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4874 [inline]
check_wait_context kernel/locking/lockdep.c:4946 [inline]
__lock_acquire+0xf5b/0x2de0 kernel/locking/lockdep.c:5238
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:271
kvm_xen_set_evtchn_fast+0x208/0x8d0 arch/x86/kvm/xen.c:1872
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:139
__run_hrtimer kernel/time/hrtimer.c:2079 [inline]
__hrtimer_run_queues+0x371/0xa10 kernel/time/hrtimer.c:2136
hrtimer_interrupt+0x4cd/0xaa0 kernel/time/hrtimer.c:2255
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
__sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1079
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1073 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1073
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:arch_try_cmpxchg128 arch/x86/include/asm/cmpxchg_64.h:83 [inline]
RIP: 0010:__update_freelist_fast mm/slub.c:698 [inline]
RIP: 0010:slab_update_freelist mm/slub.c:764 [inline]
RIP: 0010:__slab_free+0x106/0x2c0 mm/slub.c:5893
Code: e8 8f 9b 00 00 89 c3 eb 52 49 89 de 48 8b 44 24 40 48 8b 54 24 48 48 8b 5c 24 30 48 8b 4c 24 38 48 8b 34 24 f0 48 0f c7 4e 20 <0f> 84 9d 00 00 00 48 89 44 24 40 48 89 54 24 48 eb 3b e8 43 02 9c
RSP: 0018:ffffc90002e97cc0 EFLAGS: 00000242
RAX: ffff8880512a09c0 RBX: ffff8880512a0820 RCX: 000000020013000b
RDX: 000000020013000c RSI: ffffea000144a800 RDI: 00000000000000b0
RBP: ffffc90002e97d48 R08: 0000000000000001 R09: ffffffff8241bffe
R10: dffffc0000000000 R11: fffffbfff23c2198 R12: 0000000000000000
R13: ffff8880512a09c0 R14: 0000000000000000 R15: ffff888140415280
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:364
kasan_slab_alloc include/linux/kasan.h:257 [inline]
slab_post_alloc_hook mm/slub.c:4718 [inline]
slab_alloc_node mm/slub.c:5031 [inline]
kmem_cache_alloc_noprof+0x2b4/0x600 mm/slub.c:5045
alloc_filename fs/namei.c:147 [inline]
do_getname+0x2e/0x250 fs/namei.c:187
getname_flags fs/namei.c:230 [inline]
getname include/linux/fs.h:2569 [inline]
class_filename_constructor include/linux/fs.h:2596 [inline]
__do_sys_unlink fs/namei.c:5771 [inline]
__se_sys_unlink+0x1e/0x140 fs/namei.c:5769
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f00c8915937
Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007fffcd966b88 EFLAGS: 00000202 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 00007f00c8915937
RDX: 0000000000000000 RSI: 000000000f7f4900 RDI: 000055b53398902e
RBP: 0000000000000000 R08: 000000000f8e243f R09: 3fffffffffffffff
R10: 4000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 000055b5339a4100 R14: 0000000000000001 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: e8 8f 9b 00 00 call 0x9b94
5: 89 c3 mov %eax,%ebx
7: eb 52 jmp 0x5b
9: 49 89 de mov %rbx,%r14
c: 48 8b 44 24 40 mov 0x40(%rsp),%rax
11: 48 8b 54 24 48 mov 0x48(%rsp),%rdx
16: 48 8b 5c 24 30 mov 0x30(%rsp),%rbx
1b: 48 8b 4c 24 38 mov 0x38(%rsp),%rcx
20: 48 8b 34 24 mov (%rsp),%rsi
24: f0 48 0f c7 4e 20 lock cmpxchg16b 0x20(%rsi)
* 2a: 0f 84 9d 00 00 00 je 0xcd <-- trapping instruction
30: 48 89 44 24 40 mov %rax,0x40(%rsp)
35: 48 89 54 24 48 mov %rdx,0x48(%rsp)
3a: eb 3b jmp 0x77
3c: e8 .byte 0xe8
3d: 43 rex.XB
3e: 02 .byte 0x2
3f: 9c pushf