=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz.6.3314/17520 is trying to lock:
ffff8880587852e0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
2 locks held by syz.6.3314/17520:
#0: ffff88802690b440 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline]
#0: ffff88802690b440 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa30 mm/mmap.c:1286
#1: ffff888058785840 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffff888058785840 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#1: ffff888058785840 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x245/0xe80 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 0 UID: 0 PID: 17520 Comm: syz.6.3314 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xfa4/0x2630 kernel/locking/lockdep.c:5187
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1785 [inline]
__hrtimer_run_queues+0x1ad/0xa70 kernel/time/hrtimer.c:1849
hrtimer_interrupt+0x397/0x8c0 kernel/time/hrtimer.c:1911
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
__sysvec_apic_timer_interrupt+0x109/0x490 arch/x86/kernel/apic/apic.c:1062
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:_compound_head include/linux/page-flags.h:286 [inline]
RIP: 0010:free_pages_and_swap_cache+0x132/0x480 mm/swap_state.c:414
Code: 0f 85 23 03 00 00 4d 8b 75 00 4c 89 f3 48 83 e3 fc 48 8d 7b 08 48 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 f9 02 00 00 48 8b 43 08 <31> ff 49 89 c7 48 89 44 24 10 41 83 e7 01 4c 89 fe e8 d8 ed 9c ff
RSP: 0018:ffffc900056c7248 EFLAGS: 00000246
RAX: ffffea00018e9088 RBX: ffffea00018e9440 RCX: ffff88805acf0010
RDX: ffff888037240000 RSI: ffffffff826c0472 RDI: ffffea00018e9448
RBP: dffffc0000000000 R08: 0000000000000004 R09: 00000000000001fd
R10: 0000000000000057 R11: 0000000000000000 R12: 0000000000000057
R13: ffff88805acf02c8 R14: ffffea00018e9440 R15: 0000000000000018
__tlb_batch_free_encoded_pages+0xe9/0x280 mm/mmu_gather.c:138
tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:398 [inline]
tlb_flush_mmu+0xe9/0x590 mm/mmu_gather.c:405
zap_pte_range mm/memory.c:1968 [inline]
zap_pmd_range mm/memory.c:2021 [inline]
zap_pud_range mm/memory.c:2049 [inline]
zap_p4d_range mm/memory.c:2070 [inline]
unmap_page_range+0x2333/0x4840 mm/memory.c:2091
unmap_single_vma+0x153/0x240 mm/memory.c:2133
unmap_vmas+0x295/0x590 mm/memory.c:2171
exit_mmap+0x1ef/0xa30 mm/mmap.c:1302
__mmput+0x12a/0x410 kernel/fork.c:1175
mmput+0x67/0x80 kernel/fork.c:1198
exit_mm kernel/exit.c:581 [inline]
do_exit+0x819/0x2b60 kernel/exit.c:964
do_group_exit+0xd5/0x2a0 kernel/exit.c:1118
get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
irqentry_exit+0x1f8/0x670 kernel/entry/common.c:219
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 002b:0000200000000008 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f1cdd615fa0 RCX: 00007f1cdd39c799
RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000001144280
RBP: 00007f1cdd432c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f1cdd616038 R14: 00007f1cdd615fa0 R15: 00007ffdbb2f56c8
----------------
Code disassembly (best guess):
0: 0f 85 23 03 00 00 jne 0x329
6: 4d 8b 75 00 mov 0x0(%r13),%r14
a: 4c 89 f3 mov %r14,%rbx
d: 48 83 e3 fc and $0xfffffffffffffffc,%rbx
11: 48 8d 7b 08 lea 0x8(%rbx),%rdi
15: 48 89 f8 mov %rdi,%rax
18: 48 c1 e8 03 shr $0x3,%rax
1c: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1)
20: 0f 85 f9 02 00 00 jne 0x31f
26: 48 8b 43 08 mov 0x8(%rbx),%rax
* 2a: 31 ff xor %edi,%edi <-- trapping instruction
2c: 49 89 c7 mov %rax,%r15
2f: 48 89 44 24 10 mov %rax,0x10(%rsp)
34: 41 83 e7 01 and $0x1,%r15d
38: 4c 89 fe mov %r15,%rsi
3b: e8 d8 ed 9c ff call 0xff9cee18