=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz.2.2330/14372 is trying to lock:
ffff88807afadbc8 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x208/0x8d0 arch/x86/kvm/xen.c:1872
other info that might help us debug this:
context-{2:2}
locks held by syz.2.2330/14372: 8, last CPU#0:
#0: ffff88807aa70478 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0xac3/0x10c0 fs/coredump.c:1312
#1: ffff88805a0ed900 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock_killable include/linux/mmap_lock.h:625 [inline]
#1: ffff88805a0ed900 (&mm->mmap_lock){++++}-{4:4}, at: dump_user_range+0x1be/0xca0 fs/coredump.c:1583
#2: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#2: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: do_fault_around mm/memory.c:6061 [inline]
#2: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: do_read_fault mm/memory.c:6095 [inline]
#2: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: do_fault mm/memory.c:6238 [inline]
#2: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: do_pte_missing+0x139f/0x3570 mm/memory.c:4771
#3: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: filemap_map_pages+0x1d1/0x2170 mm/filemap.c:3939
#4: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#4: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#4: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302
#5: ffff888069997a98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
#5: ffff888069997a98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:423
#6: ffffffff9015a4e0 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#6: ffffffff9015a4e0 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:947 [inline]
#6: ffffffff9015a4e0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 include/linux/mmzone.h:2297
#7: ffff88807afae118 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline]
#7: ffff88807afae118 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:320 [inline]
#7: ffff88807afae118 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1d2/0x8d0 arch/x86/kvm/xen.c:1870
stack backtrace:
CPU: 0 UID: 0 PID: 14372 Comm: syz.2.2330 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4874 [inline]
check_wait_context kernel/locking/lockdep.c:4946 [inline]
__lock_acquire+0xf5b/0x2de0 kernel/locking/lockdep.c:5238
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:271
kvm_xen_set_evtchn_fast+0x208/0x8d0 arch/x86/kvm/xen.c:1872
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:139
__run_hrtimer kernel/time/hrtimer.c:2079 [inline]
__hrtimer_run_queues+0x371/0xa10 kernel/time/hrtimer.c:2136
hrtimer_interrupt+0x4cd/0xaa0 kernel/time/hrtimer.c:2255
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
__sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x56/0xb0 kernel/rcu/tree.c:753
Code: 47 ac 8e 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 1b b6 92 00 48 c7 c3 98 dd eb 94 49 03 1e 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 75 35 8b 03 65 48 ff 0d f7 f6 3c 13 74 11 83
RSP: 0018:ffffc9000383e1e0 EFLAGS: 00000a02
RAX: 1ffff110170467b3 RBX: ffff8880b8233d98 RCX: 8000000000000003
RDX: ffff88803162be80 RSI: ffffffff8c8ff960 RDI: ffffffff8c8ff920
RBP: 0000000000000001 R08: ffffffff824c77ba R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100fd6ca05 R12: dffffc0000000000
R13: 0000000000000001 R14: ffffffff8eac47d0 R15: dffffc0000000000
rcu_read_lock_sched include/linux/rcupdate.h:948 [inline]
pfn_valid+0xf3/0x490 include/linux/mmzone.h:2297
page_table_check_set+0x23/0x590 mm/page_table_check.c:105
page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
set_ptes include/linux/pgtable.h:447 [inline]
set_pte_range+0x7ef/0x840 mm/memory.c:5832
filemap_map_order0_folio mm/filemap.c:3907 [inline]
filemap_map_pages+0xe67/0x2170 mm/filemap.c:3978
do_fault_around mm/memory.c:6062 [inline]
do_read_fault mm/memory.c:6095 [inline]
do_fault mm/memory.c:6238 [inline]
do_pte_missing+0x2067/0x3570 mm/memory.c:4771
handle_pte_fault mm/memory.c:6657 [inline]
__handle_mm_fault mm/memory.c:6809 [inline]
handle_mm_fault+0x1807/0x2f80 mm/memory.c:6976
faultin_page mm/gup.c:1126 [inline]
__get_user_pages+0x1670/0x2750 mm/gup.c:1428
__get_user_pages_locked mm/gup.c:1692 [inline]
get_dump_page+0x1b5/0x410 mm/gup.c:2207
dump_user_range+0x208/0xca0 fs/coredump.c:1595
elf_core_dump+0x346a/0x3a70 fs/binfmt_elf.c:2106
coredump_write fs/coredump.c:1150 [inline]
do_coredump+0x5ed1/0x6a60 fs/coredump.c:1237
vfs_coredump+0xac3/0x10c0 fs/coredump.c:1312
get_signal+0x11d1/0x1430 kernel/signal.c:3098
arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop kernel/entry/common.c:101 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
irqentry_exit+0x348/0x9b0 kernel/entry/common.c:152
exc_general_protection+0x16b/0x1f0 arch/x86/kernel/traps.c:914
asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:589
RIP: 0033:0x7f172019f561
Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:00002000000000e0 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f1720425fa0 RCX: 00007f172019f559
RDX: 0000200000000100 RSI: 00002000000000e0 RDI: 0000000004268000
RBP: 00007f1720236b20 R08: 0000200000000180 R09: 0000200000000180
R10: 0000200000000140 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f1720426038 R14: 00007f1720425fa0 R15: 00007ffc8f90be08
----------------
Code disassembly (best guess):
0: 47 ac rex.RXB lods %ds:(%rsi),%al
2: 8e 4c 89 f0 mov -0x10(%rcx,%rcx,4),%cs
6: 48 c1 e8 03 shr $0x3,%rax
a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
f: 74 08 je 0x19
11: 4c 89 f7 mov %r14,%rdi
14: e8 1b b6 92 00 call 0x92b634
19: 48 c7 c3 98 dd eb 94 mov $0xffffffff94ebdd98,%rbx
20: 49 03 1e add (%r14),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 75 35 jne 0x68
33: 8b 03 mov (%rbx),%eax
35: 65 48 ff 0d f7 f6 3c decq %gs:0x133cf6f7(%rip) # 0x133cf734
3c: 13
3d: 74 11 je 0x50
3f: 83 .byte 0x83