WARNING in its_irq_domain_free

Status: upstream: reported syz repro on 2026/08/14 04:50
Reported-by: syzbot+db67f2572dcb0db651bb@syzkaller.appspotmail.com
First crash: 22h27m, last: 21h34m

Sample crash report:
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4537 at drivers/irqchip/irq-gic-v3-its.c:2175 its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
WARNING: CPU: 1 PID: 4537 at drivers/irqchip/irq-gic-v3-its.c:2175 its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
Modules linked in:
CPU: 1 PID: 4537 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
pc : its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
lr : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
lr : its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
sp : ffff800021917080
x29: ffff800021917130 x28: 1fffe0001970b2c2 x27: dfff800000000000
x26: ffff700004322e14 x25: 00000000fffffff4 x24: ffff8000219170c0
x23: ffff0000cae92900 x22: ffff0000cb859600 x21: ffff0000c0022400
x20: 1fffe0001970b2c6 x19: 0000000000000001 x18: 1fffe00033e7277e
x17: 0000000000000000 x16: ffff800011b90080 x15: ffff8000089b5c5c
x14: 0000000000000001 x13: 1fffe00033e79c00 x12: 0000000000000000
x11: ff0080000ab33af8 x10: 0000000000000000 x9 : ffff80000ab33af8
x8 : ffff0000cc5fd400 x7 : ffff80000884bcac x6 : 0000000000000000
x5 : 0000000000040002 x4 : fffffc000371b020 x3 : 0000000000040002
x2 : ffff0000dc6c6000 x1 : 00000000fffffff4 x0 : 0000000000000000
Call trace:
 its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
 its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
 irq_domain_free_irqs_hierarchy kernel/irq/irqdomain.c:1470 [inline]
 irq_domain_free_irqs_parent kernel/irq/irqdomain.c:1805 [inline]
 irq_domain_free_irqs_common+0x250/0x2a0 kernel/irq/irqdomain.c:1437
 irq_domain_free_irqs_top+0x90/0xa8 kernel/irq/irqdomain.c:1456
 msi_domain_free+0x120/0x140 kernel/irq/msi.c:572
 irq_domain_free_irqs_hierarchy kernel/irq/irqdomain.c:1470 [inline]
 irq_domain_free_irqs+0x34c/0x474 kernel/irq/irqdomain.c:1767
 __msi_domain_free_irqs+0x324/0x700 kernel/irq/msi.c:983
 msi_domain_free_irqs_descs_locked+0x100/0x1a8 kernel/irq/msi.c:1014
 pci_msi_teardown_msi_irqs+0x8c/0xd4 drivers/pci/msi/irqdomain.c:28
 free_msi_irqs drivers/pci/msi/msi.c:227 [inline]
 pci_disable_msix+0x398/0x584 drivers/pci/msi/msi.c:868
 pci_free_irq_vectors+0x20/0x38 drivers/pci/msi/msi.c:1069
 vp_del_vqs+0x568/0x754 drivers/virtio/virtio_pci_common.c:270
 remove_common drivers/char/hw_random/virtio-rng.c:206 [inline]
 virtrng_remove+0x108/0x1bc drivers/char/hw_random/virtio-rng.c:218
 virtio_dev_remove+0x90/0x194 drivers/virtio/virtio.c:332
 device_remove drivers/base/dd.c:547 [inline]
 __device_release_driver drivers/base/dd.c:1279 [inline]
 device_release_driver_internal+0x3d4/0x6e4 drivers/base/dd.c:1305
 device_release_driver+0x28/0x38 drivers/base/dd.c:1328
 bus_remove_device+0x294/0x384 drivers/base/bus.c:531
 device_del+0x580/0x990 drivers/base/core.c:3900
 device_unregister+0x2c/0xc8 drivers/base/core.c:3943
 unregister_virtio_device+0x38/0x78 drivers/virtio/virtio.c:483
 virtio_pci_remove+0x7c/0xf4 drivers/virtio/virtio_pci_common.c:600
 pci_device_remove+0x9c/0x23c drivers/pci/pci-driver.c:483
 device_remove drivers/base/dd.c:547 [inline]
 __device_release_driver drivers/base/dd.c:1279 [inline]
 device_release_driver_internal+0x3d4/0x6e4 drivers/base/dd.c:1305
 device_release_driver+0x28/0x38 drivers/base/dd.c:1328
 pci_stop_dev drivers/pci/remove.c:22 [inline]
 pci_stop_bus_device+0x100/0x164 drivers/pci/remove.c:82
 pci_stop_and_remove_bus_device drivers/pci/remove.c:116 [inline]
 pci_stop_and_remove_bus_device_locked+0x24/0x40 drivers/pci/remove.c:124
 remove_store+0xdc/0x148 drivers/pci/pci-sysfs.c:515
 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388
 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 1782
hardirqs last  enabled at (1781): [<ffff800011c77b24>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (1781): [<ffff800011c77b24>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (1782): [<ffff800011b8c2bc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (1236): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (1236): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (1123): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/14 05:42 linux-6.1.y e4f7d8be268e b13552fe .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in its_irq_domain_free
2026/08/14 04:49 linux-6.1.y e4f7d8be268e b13552fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in its_irq_domain_free
* Struck through repros no longer work on HEAD.