=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
modprobe/10649 is trying to lock:
ffff88803b565330 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
3 locks held by modprobe/10649:
#0: ffff88802bd0a7f8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:536 [inline]
#0: ffff88802bd0a7f8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x22c/0xa10 mm/mmap.c:1308
#1: ffff88803ea57300 (&anon_vma->rwsem){++++}-{4:4}, at: anon_vma_lock_write mm/internal.h:221 [inline]
#1: ffff88803ea57300 (&anon_vma->rwsem){++++}-{4:4}, at: unlink_anon_vmas+0xe1/0x8e0 mm/rmap.c:493
#2: ffff88803b565890 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#2: ffff88803b565890 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#2: ffff88803b565890 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x245/0xe80 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 2 UID: 0 PID: 10649 Comm: modprobe Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xfa4/0x2630 kernel/locking/lockdep.c:5187
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b1/0x370 kernel/locking/lockdep.c:5825
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:240
kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x142/0xa00 kernel/time/hrtimer.c:1994
hrtimer_interrupt+0x3e5/0x940 kernel/time/hrtimer.c:2113
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
__sysvec_apic_timer_interrupt+0x10b/0x460 arch/x86/kernel/apic/apic.c:1067
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:unwind_next_frame+0x36/0x2090 arch/x86/kernel/unwind_orc.c:487
Code: ff df 41 57 48 89 fa 41 56 48 c1 ea 03 41 55 49 89 fd 41 54 55 53 48 83 ec 38 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 42 0b 00 00 <41> 8b 5d 00 31 ed 85 db 75 15 48 83 c4 38 89 e8 5b 5d 41 5c 41 5d
RSP: 0018:ffffc90006507540 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc900065075b0 RCX: ffffc90006507504
RDX: 1ffff92000ca0eb6 RSI: ffffffff8276940b RDI: ffffc900065075b0
RBP: ffffc90006507640 R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000017666 R12: ffffffff81f2f5b0
R13: ffffc900065075b0 R14: 0000000000000000 R15: ffff888030c52540
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6251 [inline]
kmem_cache_free+0x127/0x6c0 mm/slub.c:6378
anon_vma_chain_free mm/rmap.c:147 [inline]
unlink_anon_vmas+0x228/0x8e0 mm/rmap.c:514
free_pgtables+0x2e7/0xd80 mm/memory.c:414
exit_mmap+0x44c/0xa10 mm/mmap.c:1312
__mmput+0x12a/0x410 kernel/fork.c:1178
mmput+0x67/0x80 kernel/fork.c:1201
exit_mm kernel/exit.c:582 [inline]
do_exit+0x8b2/0x2af0 kernel/exit.c:964
do_group_exit+0xd5/0x2a0 kernel/exit.c:1119
__do_sys_exit_group kernel/exit.c:1130 [inline]
__se_sys_exit_group kernel/exit.c:1128 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1128
x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6fc0b536c5
Code: Unable to access opcode bytes at 0x7f6fc0b5369b.
RSP: 002b:00007fff797685d8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f6fc0c54fe8 RCX: 00007f6fc0b536c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001
RBP: 0000000000000001 R08: 00007fff79768568 R09: 0000000000000000
R10: 00007fff79768400 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f6fc0c53680 R15: 00007f6fc0c55000
----------------
Code disassembly (best guess):
0: ff lcall (bad)
1: df 41 57 filds 0x57(%rcx)
4: 48 89 fa mov %rdi,%rdx
7: 41 56 push %r14
9: 48 c1 ea 03 shr $0x3,%rdx
d: 41 55 push %r13
f: 49 89 fd mov %rdi,%r13
12: 41 54 push %r12
14: 55 push %rbp
15: 53 push %rbx
16: 48 83 ec 38 sub $0x38,%rsp
1a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax
1e: 84 c0 test %al,%al
20: 74 08 je 0x2a
22: 3c 03 cmp $0x3,%al
24: 0f 8e 42 0b 00 00 jle 0xb6c
* 2a: 41 8b 5d 00 mov 0x0(%r13),%ebx <-- trapping instruction
2e: 31 ed xor %ebp,%ebp
30: 85 db test %ebx,%ebx
32: 75 15 jne 0x49
34: 48 83 c4 38 add $0x38,%rsp
38: 89 e8 mov %ebp,%eax
3a: 5b pop %rbx
3b: 5d pop %rbp
3c: 41 5c pop %r12
3e: 41 5d pop %r13