=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz-executor/11246 is trying to lock:
ffff888055d39db0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1843
other info that might help us debug this:
context-{2:2}
locks held by syz-executor/11246: 10, last CPU#0:
#0: ffff8880356fe460 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
#1: ffff88802d790c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
#2: ffff88802a96d4b8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff88802a96d4b8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:337
#3: ffffffff9023af40 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234
#4: ffff8880268fe128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#4: ffff8880268fe128 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
#4: ffff8880268fe128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 drivers/base/dd.c:1369
#5: ffff88807e461258 (&devlink->lock_key#8){+.+.}-{4:4}, at: nsim_drv_remove+0x4a/0x1e0 drivers/net/netdevsim/dev.c:1724
#6: ffffffff90cd4b40 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x1a6/0x970 drivers/net/netdevsim/netdev.c:1193
#7: ffff88807e5f4e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline]
#7: ffff88807e5f4e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x47f/0x2150 net/core/dev.c:12488
#8: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#8: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#8: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: atomic_notifier_call_chain+0x2f/0x1c0 kernel/notifier.c:222
#9: ffff888055d3a310 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
#9: ffff888055d3a310 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
#9: ffff888055d3a310 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x245/0xe80 arch/x86/kvm/xen.c:1841
stack backtrace:
CPU: 0 UID: 0 PID: 11246 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4874 [inline]
check_wait_context kernel/locking/lockdep.c:4946 [inline]
__lock_acquire+0xfcc/0x1f40 kernel/locking/lockdep.c:5238
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:271
kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1843
xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:139
__run_hrtimer kernel/time/hrtimer.c:2074 [inline]
__hrtimer_run_queues+0x13f/0x9c0 kernel/time/hrtimer.c:2131
hrtimer_interrupt+0x441/0xaa0 kernel/time/hrtimer.c:2250
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
__sysvec_apic_timer_interrupt+0x109/0x470 arch/x86/kernel/apic/apic.c:1068
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:206
Code: 46 57 61 00 48 89 df 5b e9 6d 39 67 00 be 03 00 00 00 5b e9 e2 1e 1f 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 65 48 8b 05 4c cb 80 12 48 8b 34 24 65 48 8b 15 30 cb
RSP: 0000:ffffc90003557170 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88802277cb00 RSI: ffffffff81d1288b RDI: ffff88802277cb00
RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000008
R13: ffff88801cb2d800 R14: ffff88802ced2758 R15: ffff88807e5f46f8
queue_work_on+0x141/0x1e0 kernel/workqueue.c:2506
queue_work include/linux/workqueue.h:700 [inline]
addr_event.isra.0+0x391/0x560 drivers/infiniband/core/roce_gid_mgmt.c:873
inet6addr_event+0x116/0x180 drivers/infiniband/core/roce_gid_mgmt.c:903
notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
atomic_notifier_call_chain+0x71/0x1c0 kernel/notifier.c:223
addrconf_ifdown.isra.0+0xe85/0x1b70 net/ipv6/addrconf.c:4014
addrconf_notify+0x4a3/0x1ba0 net/ipv6/addrconf.c:3812
notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275
call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
call_netdevice_notifiers net/core/dev.c:2327 [inline]
netif_close_many+0x3e7/0x810 net/core/dev.c:1829
netif_close_many_and_unlock+0x24/0x270 net/core/dev.c:12422
unregister_netdevice_many_notify+0x661/0x2150 net/core/dev.c:12492
unregister_netdevice_many net/core/dev.c:12600 [inline]
unregister_netdevice_queue net/core/dev.c:12401 [inline]
unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12387
unregister_netdevice include/linux/netdevice.h:3487 [inline]
nsim_destroy+0x23e/0x970 drivers/net/netdevsim/netdev.c:1198
__nsim_dev_port_del+0x194/0x2b0 drivers/net/netdevsim/dev.c:1472
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline]
nsim_dev_reload_destroy+0x10a/0x490 drivers/net/netdevsim/dev.c:1710
nsim_drv_remove+0x52/0x1e0 drivers/net/netdevsim/dev.c:1725
device_remove+0xcb/0x180 drivers/base/dd.c:616
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664
device_del+0x376/0x9b0 drivers/base/core.c:3965
device_unregister+0x1d/0xe0 drivers/base/core.c:4006
nsim_bus_dev_del drivers/net/netdevsim/bus.c:488 [inline]
del_device_store+0x346/0x480 drivers/net/netdevsim/bus.c:244
bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbeca75e98e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffd3dbc48e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555594d9d500 RCX: 00007fbeca75e98e
RDX: 0000000000000001 RSI: 00007ffd3dbc4970 RDI: 0000000000000005
RBP: 00007fbeca8358ee R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd3dbc4970 R14: 00007fbecb554620 R15: 0000000000000003
----------------
Code disassembly (best guess), 3 bytes skipped:
0: 00 48 89 add %cl,-0x77(%rax)
3: df 5b e9 fistps -0x17(%rbx)
6: 6d insl (%dx),%es:(%rdi)
7: 39 67 00 cmp %esp,0x0(%rdi)
a: be 03 00 00 00 mov $0x3,%esi
f: 5b pop %rbx
10: e9 e2 1e 1f 03 jmp 0x31f1ef7
15: 66 90 xchg %ax,%ax
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
* 27: f3 0f 1e fa endbr64 <-- trapping instruction
2b: 65 48 8b 05 4c cb 80 mov %gs:0x1280cb4c(%rip),%rax # 0x1280cb7f
32: 12
33: 48 8b 34 24 mov (%rsp),%rsi
37: 65 gs
38: 48 rex.W
39: 8b .byte 0x8b
3a: 15 .byte 0x15
3b: 30 cb xor %cl,%bl