BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:248 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5603, name: syz-executor preempt_count: 10000, expected: 0 RCU nest depth: 0, expected: 0 2 locks held by syz-executor/5603: #0: ffff888041ad8808 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:310 #1: ffff8880400023c8 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline] #1: ffff8880400023c8 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline] #1: ffff8880400023c8 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1be/0x990 arch/x86/kvm/xen.c:1820 irq event stamp: 2878632 hardirqs last enabled at (2878631): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline] hardirqs last enabled at (2878631): [] _raw_spin_unlock_irqrestore+0x30/0x80 kernel/locking/spinlock.c:198 hardirqs last disabled at (2878632): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1062 softirqs last enabled at (2876684): [] __local_bh_enable_ip+0x1a0/0x2b0 kernel/softirq.c:305 softirqs last disabled at (2876678): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last disabled at (2876678): [] spin_lock_bh include/linux/spinlock_rt.h:89 [inline] softirqs last disabled at (2876678): [] release_sock+0x2f/0x290 net/core/sock.c:3857 Preemption disabled at: [] irq_enter_rcu+0x1e/0x1f0 kernel/softirq.c:664 CPU: 0 UID: 0 PID: 5603 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x329/0x480 kernel/sched/core.c:9197 rt_read_lock+0xa9/0x4b0 kernel/locking/spinlock_rt.c:248 kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1822 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3a0/0xaf0 kernel/time/hrtimer.c:2096 hrtimer_interrupt+0x44a/0x900 kernel/time/hrtimer.c:2215 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline] __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:policy_nodemask+0x751/0x8e0 mm/mempolicy.c:2310 Code: 03 42 0f b6 04 28 84 c0 0f 85 91 00 00 00 44 89 3a 45 31 f6 48 c7 44 24 40 0e 36 e0 45 48 8b 44 24 18 4a c7 04 28 00 00 00 00 <65> 48 8b 05 07 ed 71 10 48 3b 84 24 80 00 00 00 75 41 4c 89 f0 48 RSP: 0000:ffffc900050678e0 EFLAGS: 00000246 RAX: 1ffff92000a0cf24 RBX: 0000000000000000 RCX: ffff8880389b0000 RDX: ffffc900050679c4 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900050679b0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000006 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000140cca alloc_pages_mpol+0x50/0x280 mm/mempolicy.c:2451 folio_alloc_mpol_noprof+0x3b/0x1e0 mm/mempolicy.c:2509 vma_alloc_folio_noprof+0xe1/0x1e0 mm/mempolicy.c:2544 folio_prealloc mm/memory.c:-1 [inline] wp_page_copy mm/memory.c:3875 [inline] do_wp_page+0x115e/0x3d90 mm/memory.c:4336 handle_pte_fault mm/memory.c:6395 [inline] __handle_mm_fault mm/memory.c:6517 [inline] handle_mm_fault+0xa03/0x13f0 mm/memory.c:6686 do_user_addr_fault+0xa4d/0x1340 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0033:0x7f4d913235e3 Code: 5d ff ff eb a7 66 90 80 3d 11 92 df 00 00 74 57 41 54 45 31 e4 55 48 8d 2d 4a f8 28 00 53 48 89 eb 66 0f 1f 44 00 00 44 89 e0 <87> 03 83 f8 01 7f 26 48 8b 9b 70 08 00 00 48 39 eb 75 ea 31 c0 87 RSP: 002b:00007ffc6b1811e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00007f4d915b2e20 RCX: 00007f4d912ff727 RDX: 0000000000000000 RSI: 00007ffc6b1811d0 RDI: 0000000000000002 RBP: 00007f4d915b2e20 R08: 00007f4d92118060 R09: 0000000000000000 R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 R13: ffffffffffffffe8 R14: 0000000000000006 R15: 00007ffc6b1813b0 ============================= [ BUG: Invalid wait context ] syzkaller #0 Tainted: G W L ----------------------------- syz-executor/5603 is trying to lock: ffff888040001db0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1822 other info that might help us debug this: context-{2:2} 2 locks held by syz-executor/5603: #0: ffff888041ad8808 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:310 #1: ffff8880400023c8 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline] #1: ffff8880400023c8 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline] #1: ffff8880400023c8 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1be/0x990 arch/x86/kvm/xen.c:1820 stack backtrace: CPU: 0 UID: 0 PID: 5603 Comm: syz-executor Tainted: G W L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline] check_wait_context kernel/locking/lockdep.c:4902 [inline] __lock_acquire+0xe39/0x2ce0 kernel/locking/lockdep.c:5187 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 rt_read_lock+0xcc/0x4b0 kernel/locking/spinlock_rt.c:249 kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1822 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3a0/0xaf0 kernel/time/hrtimer.c:2096 hrtimer_interrupt+0x44a/0x900 kernel/time/hrtimer.c:2215 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline] __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:policy_nodemask+0x751/0x8e0 mm/mempolicy.c:2310 Code: 03 42 0f b6 04 28 84 c0 0f 85 91 00 00 00 44 89 3a 45 31 f6 48 c7 44 24 40 0e 36 e0 45 48 8b 44 24 18 4a c7 04 28 00 00 00 00 <65> 48 8b 05 07 ed 71 10 48 3b 84 24 80 00 00 00 75 41 4c 89 f0 48 RSP: 0000:ffffc900050678e0 EFLAGS: 00000246 RAX: 1ffff92000a0cf24 RBX: 0000000000000000 RCX: ffff8880389b0000 RDX: ffffc900050679c4 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900050679b0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000006 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000140cca alloc_pages_mpol+0x50/0x280 mm/mempolicy.c:2451 folio_alloc_mpol_noprof+0x3b/0x1e0 mm/mempolicy.c:2509 vma_alloc_folio_noprof+0xe1/0x1e0 mm/mempolicy.c:2544 folio_prealloc mm/memory.c:-1 [inline] wp_page_copy mm/memory.c:3875 [inline] do_wp_page+0x115e/0x3d90 mm/memory.c:4336 handle_pte_fault mm/memory.c:6395 [inline] __handle_mm_fault mm/memory.c:6517 [inline] handle_mm_fault+0xa03/0x13f0 mm/memory.c:6686 do_user_addr_fault+0xa4d/0x1340 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0033:0x7f4d913235e3 Code: 5d ff ff eb a7 66 90 80 3d 11 92 df 00 00 74 57 41 54 45 31 e4 55 48 8d 2d 4a f8 28 00 53 48 89 eb 66 0f 1f 44 00 00 44 89 e0 <87> 03 83 f8 01 7f 26 48 8b 9b 70 08 00 00 48 39 eb 75 ea 31 c0 87 RSP: 002b:00007ffc6b1811e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00007f4d915b2e20 RCX: 00007f4d912ff727 RDX: 0000000000000000 RSI: 00007ffc6b1811d0 RDI: 0000000000000002 RBP: 00007f4d915b2e20 R08: 00007f4d92118060 R09: 0000000000000000 R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 R13: ffffffffffffffe8 R14: 0000000000000006 R15: 00007ffc6b1813b0 ---------------- Code disassembly (best guess): 0: 03 42 0f add 0xf(%rdx),%eax 3: b6 04 mov $0x4,%dh 5: 28 84 c0 0f 85 91 00 sub %al,0x91850f(%rax,%rax,8) c: 00 00 add %al,(%rax) e: 44 89 3a mov %r15d,(%rdx) 11: 45 31 f6 xor %r14d,%r14d 14: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp) 1b: e0 45 1d: 48 8b 44 24 18 mov 0x18(%rsp),%rax 22: 4a c7 04 28 00 00 00 movq $0x0,(%rax,%r13,1) 29: 00 * 2a: 65 48 8b 05 07 ed 71 mov %gs:0x1071ed07(%rip),%rax # 0x1071ed39 <-- trapping instruction 31: 10 32: 48 3b 84 24 80 00 00 cmp 0x80(%rsp),%rax 39: 00 3a: 75 41 jne 0x7d 3c: 4c 89 f0 mov %r14,%rax 3f: 48 rex.W