=============================
[ BUG: Invalid wait context ]
6.15.0-syzkaller-08486-gf66bc387efbe #0 Not tainted
-----------------------------
syz.5.897/9323 is trying to lock:
ffffc90004214410 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x254/0xeb0 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
5 locks held by syz.5.897/9323:
#0: ffffffff8e480a28 (bpf_stats_enabled_mutex){+.+.}-{4:4}, at: bpf_stats_release+0x17/0x40 kernel/bpf/syscall.c:5643
#1: ffffffff8e266f70 (cpu_hotplug_lock){++++}-{0:0}, at: __static_key_slow_dec kernel/jump_label.c:320 [inline]
#1: ffffffff8e266f70 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_slow_dec+0x53/0xc0 kernel/jump_label.c:336
#2: ffffffff8e4e9448 (jump_label_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:201 [inline]
#2: ffffffff8e4e9448 (jump_label_mutex){+.+.}-{4:4}, at: __static_key_slow_dec_cpuslocked.part.0+0x18/0xf0 kernel/jump_label.c:300
#3: ffffffff8e283228 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145
#4: ffffc90004214960 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
#4: ffffc90004214960 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:253 [inline]
#4: ffffc90004214960 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x23a/0xeb0 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 1 UID: 0 PID: 9323 Comm: syz.5.897 Not tainted 6.15.0-syzkaller-08486-gf66bc387efbe #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4833 [inline]
check_wait_context kernel/locking/lockdep.c:4905 [inline]
__lock_acquire+0xa12/0x1c90 kernel/locking/lockdep.c:5190
lock_acquire kernel/locking/lockdep.c:5871 [inline]
lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5828
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x254/0xeb0 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x5ed/0xad0 kernel/time/hrtimer.c:1825
hrtimer_interrupt+0x397/0x8e0 kernel/time/hrtimer.c:1887
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline]
__sysvec_apic_timer_interrupt+0x108/0x3f0 arch/x86/kernel/apic/apic.c:1056
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:kvm_hypercall1 arch/x86/include/asm/kvm_para.h:59 [inline]
RIP: 0010:kvm_smp_send_call_func_ipi+0x1e5/0x250 arch/x86/kernel/kvm.c:645
Code: 00 fc ff df 48 89 da 48 c1 ea 03 0f b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 5d 8b 1b b8 0b 00 00 00 0f 01 c1 3a ff ff ff e8 a1 d5 51 00 90 0f 0b 48 89 df e8 26 66 b8 00 e9
RSP: 0018:ffffc90003b27aa8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff8169f3bf
RDX: 0000000000000000 RSI: ffffffff8169f3cd RDI: ffffffff8dd13db8
RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: fffffbfff1c44f25
R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000003
arch_send_call_function_ipi_mask arch/x86/include/asm/smp.h:100 [inline]
send_call_function_ipi_mask kernel/smp.c:127 [inline]
smp_call_function_many_cond+0xbac/0x1490 kernel/smp.c:869
on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1052
on_each_cpu include/linux/smp.h:71 [inline]
smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2660 [inline]
smp_text_poke_batch_finish+0x5ae/0xdb0 arch/x86/kernel/alternative.c:2932
arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
jump_label_update+0x376/0x550 kernel/jump_label.c:919
__static_key_slow_dec_cpuslocked.part.0+0xc0/0xf0 kernel/jump_label.c:315
__static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]
__static_key_slow_dec kernel/jump_label.c:321 [inline]
static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336
bpf_stats_release+0x23/0x40 kernel/bpf/syscall.c:5644
__fput+0x402/0xb70 fs/file_table.c:465
task_work_run+0x150/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0e5db8e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd72423198 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f0e5ddb7ba0 RCX: 00007f0e5db8e969
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f0e5ddb7ba0 R08: 0000000000000234 R09: 0000001e7242348f
R10: 00000000003ffba8 R11: 0000000000000246 R12: 000000000003d98a
R13: 00007ffd72423290 R14: ffffffffffffffff R15: 00007ffd724232b0
----------------
Code disassembly (best guess), 4 bytes skipped:
0: 48 89 da mov %rbx,%rdx
3: 48 c1 ea 03 shr $0x3,%rdx
7: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx
b: 48 89 d8 mov %rbx,%rax
e: 83 e0 07 and $0x7,%eax
11: 83 c0 03 add $0x3,%eax
14: 38 d0 cmp %dl,%al
16: 7c 04 jl 0x1c
18: 84 d2 test %dl,%dl
1a: 75 5d jne 0x79
1c: 8b 1b mov (%rbx),%ebx
1e: b8 0b 00 00 00 mov $0xb,%eax
23: 0f 01 c1 vmcall
* 26: e9 3a ff ff ff jmp 0xffffff65 <-- trapping instruction
2b: e8 a1 d5 51 00 call 0x51d5d1
30: 90 nop
31: 0f 0b ud2
33: 48 89 df mov %rbx,%rdi
36: e8 26 66 b8 00 call 0xb86661
3b: e9 .byte 0xe9