=============================
[ BUG: Invalid wait context ]
6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 Not tainted
-----------------------------
ksoftirqd/1/23 is trying to lock:
ffffc9000d632410 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9a0 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
3 locks held by ksoftirqd/1/23:
#0: ffffffff8df3b980 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8df3b980 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2562 [inline]
#0: ffffffff8df3b980 (rcu_callback){....}-{0:0}, at: rcu_core+0xc34/0x1710 kernel/rcu/tree.c:2824
#1: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#1: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#1: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
#1: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa5/0x2390 arch/x86/kernel/unwind_orc.c:479
#2: ffffc9000d632958 (&kvm->srcu){.?.?}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
#2: ffffc9000d632958 (&kvm->srcu){.?.?}-{0:0}, at: srcu_read_lock include/linux/srcu.h:253 [inline]
#2: ffffc9000d632958 (&kvm->srcu){.?.?}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9a0 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 1 UID: 0 PID: 23 Comm: ksoftirqd/1 Not tainted 6.15.0-rc3-syzkaller-00342-g5bc1018675ec #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4831 [inline]
check_wait_context kernel/locking/lockdep.c:4903 [inline]
__lock_acquire+0xbcf/0xd20 kernel/locking/lockdep.c:5185
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5866
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
_raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x1fb/0x9a0 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x4dd/0xc60 kernel/time/hrtimer.c:1825
hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1887
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x108/0x410 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x3a/0xb0 kernel/rcu/tree.c:736
Code: e8 7b db ae 09 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 10 cc 96 8d 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 8c cd 7a 00 48 c7 c3 58 6b 76 92 49 03 1e 48 89
RSP: 0018:ffffc900001d73b8 EFLAGS: 00000246
RAX: 1ffffffff1b2d983 RBX: 0000000000000001 RCX: 5bdeb52677cbb900
RDX: ffffc900001d7401 RSI: ffffffff8bc1cdc0 RDI: ffffffff8bc1cd80
RBP: dffffc0000000000 R08: ffffc900001d7d10 R09: 0000000000000000
R10: ffffc900001d74f8 R11: fffff5200003aea1 R12: ffffc900001d7d20
R13: ffffc900001d0000 R14: ffffffff8d96cc18 R15: dffffc0000000000
rcu_read_unlock include/linux/rcupdate.h:869 [inline]
class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0x1965/0x2390 arch/x86/kernel/unwind_orc.c:680
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2398 [inline]
slab_free mm/slub.c:4656 [inline]
kmem_cache_free+0x192/0x3f0 mm/slub.c:4758
pagetable_dtor include/linux/mm.h:3109 [inline]
pagetable_dtor_free include/linux/mm.h:3116 [inline]
__tlb_remove_table+0x81/0x3b0 include/asm-generic/tlb.h:215
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:290
rcu_do_batch kernel/rcu/tree.c:2568 [inline]
rcu_core+0xca5/0x1710 kernel/rcu/tree.c:2824
handle_softirqs+0x283/0x870 kernel/softirq.c:579
run_ksoftirqd+0x9b/0x100 kernel/softirq.c:968
smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:164
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
vkms_vblank_simulate: vblank timer overrun
vkms_vblank_simulate: vblank timer overrun
vkms_vblank_simulate: vblank timer overrun
----------------
Code disassembly (best guess):
0: e8 7b db ae 09 call 0x9aedb80
5: 89 c3 mov %eax,%ebx
7: 83 f8 08 cmp $0x8,%eax
a: 73 65 jae 0x71
c: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
13: fc ff df
16: 4c 8d 34 dd 10 cc 96 lea -0x726933f0(,%rbx,8),%r14
1d: 8d
1e: 4c 89 f0 mov %r14,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 4c 89 f7 mov %r14,%rdi
2f: e8 8c cd 7a 00 call 0x7acdc0
34: 48 c7 c3 58 6b 76 92 mov $0xffffffff92766b58,%rbx
3b: 49 03 1e add (%r14),%rbx
3e: 48 rex.W
3f: 89 .byte 0x89