=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
syz.4.198/6424 is trying to lock:
ffff88807c8512d0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
2 locks held by syz.4.198/6424:
#0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
#0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: futex_hash+0x40/0x2c0 kernel/futex/core.c:308
#1: ffff88807c851850 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffff88807c851850 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#1: ffff88807c851850 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9b0 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 0 UID: 0 PID: 6424 Comm: syz.4.198 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xec1/0x2cf0 kernel/locking/lockdep.c:5187
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:240
kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x375/0xa20 kernel/time/hrtimer.c:1994
hrtimer_interrupt+0x44b/0x950 kernel/time/hrtimer.c:2113
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
__sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1067
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__futex_hash_private kernel/futex/core.c:190 [inline]
RIP: 0010:__futex_hash+0x3bd/0x760 kernel/futex/core.c:423
Code: 08 4c 89 ff e8 44 b0 78 00 41 be 30 04 00 00 4d 03 37 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 26 b0 78 00 4d 8b 36 4e b8 f0 09 41 89 c5 31 ff 89 c6 e8 82 76 0d 00 45 85 ed 74 21
RSP: 0018:ffffc9000431fb30 EFLAGS: 00000246
RAX: 1ffff1100eed0086 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: ffff88801df4dc40 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff81b84bf0 R09: ffffffff8e95cca0
R10: ffffc9000431fc20 R11: fffff52000863f87 R12: 1ffff92000863f86
R13: 0000000000000000 R14: ffff888069280000 R15: ffffc9000431fc20
futex_hash+0xe5/0x2c0 kernel/futex/core.c:309
class_hb_constructor kernel/futex/futex.h:240 [inline]
futex_wake+0x18f/0x580 kernel/futex/waitwake.c:172
do_futex+0x395/0x420 kernel/futex/syscalls.c:135
__do_sys_futex_time32 kernel/futex/syscalls.c:523 [inline]
__se_sys_futex_time32+0x3ab/0x440 kernel/futex/syscalls.c:506
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0x229/0x6e0 arch/x86/entry/syscall_32.c:307
do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:332
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f2301c
Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8
RSP: 002b:00000000f750fb1c EFLAGS: 00000206 ORIG_RAX: 00000000000000f0
RAX: ffffffffffffffda RBX: 00000000f73e5020 RCX: 0000000000000081
RDX: 00000000000f4240 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 08 4c 89 ff or %cl,-0x1(%rcx,%rcx,4)
4: e8 44 b0 78 00 call 0x78b04d
9: 41 be 30 04 00 00 mov $0x430,%r14d
f: 4d 03 37 add (%r15),%r14
12: 4c 89 f0 mov %r14,%rax
15: 48 c1 e8 03 shr $0x3,%rax
19: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1)
1d: 74 08 je 0x27
1f: 4c 89 f7 mov %r14,%rdi
22: e8 26 b0 78 00 call 0x78b04d
27: 4d 8b 36 mov (%r14),%r14
* 2a: e8 4e b8 f0 09 call 0x9f0b87d <-- trapping instruction
2f: 41 89 c5 mov %eax,%r13d
32: 31 ff xor %edi,%edi
34: 89 c6 mov %eax,%esi
36: e8 82 76 0d 00 call 0xd76bd
3b: 45 85 ed test %r13d,%r13d
3e: 74 21 je 0x61