=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
cmp/18912 is trying to lock:
ffff888082c31bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0 arch/x86/kvm/xen.c:1822
other info that might help us debug this:
context-{2:2}
5 locks held by cmp/18912:
#0: ffff8880236ac378 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline]
#0: ffff8880236ac378 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1284
#1: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
#2: ffff88807a109558 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
#2: ffff88807a109558 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
#3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: page_table_check_clear+0x124/0x500 mm/page_table_check.c:77
#4: ffff888082c32110 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#4: ffff888082c32110 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#4: ffff888082c32110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0 arch/x86/kvm/xen.c:1820
stack backtrace:
CPU: 0 UID: 0 PID: 18912 Comm: cmp Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xe39/0x2cf0 kernel/locking/lockdep.c:5187
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:240
kvm_xen_set_evtchn_fast+0x1f4/0x9a0 arch/x86/kvm/xen.c:1822
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x371/0xa10 kernel/time/hrtimer.c:2096
hrtimer_interrupt+0x448/0x910 kernel/time/hrtimer.c:2215
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
__sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:page_table_check_clear+0x212/0x500 mm/page_table_check.c:78
Code: 00 00 fc ff df 80 3c 08 00 74 0c 48 c7 c7 10 df 4e 8e e8 11 50 f4 ff 4c 2b 3d da 91 0e 0c 49 c1 ff 06 4c 89 ff e8 ce ee ff ff <48> 85 c0 0f 84 e2 01 00 00 48 89 c5 4c 89 34 24 41 bd 01 00 00 00
RSP: 0018:ffffc90004f67350 EFLAGS: 00000282
RAX: ffff88802127beb0 RBX: 0000000000000001 RCX: ffff88802656be00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff82404c54 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffffea0002ffcbf0
R13: 00007fc32936d000 R14: ffffffff82404c54 R15: 00000000000bff2f
ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline]
get_and_clear_full_ptes include/linux/pgtable.h:879 [inline]
zap_present_folio_ptes mm/memory.c:1648 [inline]
zap_present_ptes mm/memory.c:1730 [inline]
do_zap_pte_range mm/memory.c:1832 [inline]
zap_pte_range mm/memory.c:1934 [inline]
zap_pmd_range mm/memory.c:2020 [inline]
zap_pud_range mm/memory.c:2048 [inline]
zap_p4d_range mm/memory.c:2069 [inline]
__zap_vma_range+0x39b9/0x4f20 mm/memory.c:2109
unmap_vmas+0x390/0x550 mm/memory.c:2178
exit_mmap+0x293/0x9f0 mm/mmap.c:1300
__mmput+0x118/0x420 kernel/fork.c:1187
exec_mm_put_old fs/exec.c:916 [inline]
setup_new_exec+0x30d/0x360 fs/exec.c:1353
load_elf_binary+0xbcf/0x2950 fs/binfmt_elf.c:1024
search_binary_handler fs/exec.c:1694 [inline]
exec_binprm fs/exec.c:1726 [inline]
bprm_execve+0x9c7/0x1630 fs/exec.c:1778
do_execveat_common+0x4f4/0x670 fs/exec.c:1876
__do_sys_execve fs/exec.c:1949 [inline]
__se_sys_execve fs/exec.c:1943 [inline]
__x64_sys_execve+0x97/0xc0 fs/exec.c:1943
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc3292c9107
Code: Unable to access opcode bytes at 0x7fc3292c90dd.
RSP: 002b:00007ffcb75e2048 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 0000563c2bf4e1a8 RCX: 00007fc3292c9107
RDX: 0000563c2bf49e28 RSI: 0000563c2bf4e1a8 RDI: 0000563c2bf49eb0
RBP: 0000563c2bf49eb0 R08: 00007ffcb75e6e87 R09: 0000000000000210
R10: 0000000000000002 R11: 0000000000000246 R12: 0000563c2bf49e28
R13: 00007fc32948ee8b R14: 0000563c2bf49e28 R15: 0000000000000000
ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: fc cld
3: ff lcall (bad)
4: df 80 3c 08 00 74 filds 0x7400083c(%rax)
a: 0c 48 or $0x48,%al
c: c7 c7 10 df 4e 8e mov $0x8e4edf10,%edi
12: e8 11 50 f4 ff call 0xfff45028
17: 4c 2b 3d da 91 0e 0c sub 0xc0e91da(%rip),%r15 # 0xc0e91f8
1e: 49 c1 ff 06 sar $0x6,%r15
22: 4c 89 ff mov %r15,%rdi
25: e8 ce ee ff ff call 0xffffeef8
* 2a: 48 85 c0 test %rax,%rax <-- trapping instruction
2d: 0f 84 e2 01 00 00 je 0x215
33: 48 89 c5 mov %rax,%rbp
36: 4c 89 34 24 mov %r14,(%rsp)
3a: 41 bd 01 00 00 00 mov $0x1,%r13d