BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:248 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5622, name: syz-executor363 preempt_count: 10000, expected: 0 RCU nest depth: 1, expected: 1 locks held by syz-executor363/5622: 4, last CPU#0: #0: ffff88804093d380 (&sb->s_type->i_mutex_key#8/2){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline] #0: ffff88804093d380 (&sb->s_type->i_mutex_key#8/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x19a/0x520 fs/libfs.c:619 #1: ffffffff8e53c398 (pin_fs_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #1: ffffffff8e53c398 (pin_fs_lock){+.+.}-{3:3}, at: simple_release_fs+0x2f/0xd0 fs/libfs.c:1120 #2: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rtlock_slowlock_locked+0x2ab/0x3c20 kernel/locking/rtmutex.c:1874 #3: ffff888038241b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline] #3: ffff888038241b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline] #3: ffff888038241b48 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1be/0x990 arch/x86/kvm/xen.c:1827 irq event stamp: 13272 hardirqs last enabled at (13271): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:187 [inline] hardirqs last enabled at (13271): [] _raw_spin_unlock_irq+0x23/0x50 kernel/locking/spinlock.c:206 hardirqs last disabled at (13272): [] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1062 softirqs last enabled at (6940): [] __local_bh_enable_ip+0x1a0/0x2b0 kernel/softirq.c:305 softirqs last disabled at (6932): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last disabled at (6932): [] __alloc_skb+0x189/0x7a0 net/core/skbuff.c:697 Preemption disabled at: [] irq_enter_rcu+0x1e/0x1f0 kernel/softirq.c:668 CPU: 0 UID: 0 PID: 5622 Comm: syz-executor363 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x329/0x480 kernel/sched/core.c:9194 rt_read_lock+0xa9/0x4b0 kernel/locking/spinlock_rt.c:248 kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:141 __run_hrtimer kernel/time/hrtimer.c:2065 [inline] __hrtimer_run_queues+0x3a0/0xaf0 kernel/time/hrtimer.c:2122 hrtimer_interrupt+0x44a/0x900 kernel/time/hrtimer.c:2241 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline] __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:rt_mutex_owner include/linux/rtmutex.h:52 [inline] RIP: 0010:rtmutex_spin_on_owner kernel/locking/rtmutex.c:1504 [inline] RIP: 0010:rtlock_slowlock_locked+0x34e5/0x3c20 kernel/locking/rtmutex.c:1893 Code: 80 3c 01 00 4c 8b b4 24 80 00 00 00 4c 8b 2c 24 74 08 4c 89 ef e8 db 0e df f6 48 8d 84 24 60 01 00 00 49 39 45 00 75 6c f3 90 <48> b8 00 00 00 00 00 fc ff df 48 8b 8c 24 a8 00 00 00 80 3c 01 00 RSP: 0018:ffffc90004e6f7a0 EFLAGS: 00000246 RAX: ffffc90004e6f900 RBX: 1ffff11006ff9bbe RCX: 1ffffffff1ca7871 RDX: 00000000e6b90d15 RSI: ffffffff8bcbd060 RDI: 0000000000000001 RBP: ffffc90004e6f9f0 R08: 1d00000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff8e3c3880 R12: ffff888037fcddc0 R13: ffffffff8e53c388 R14: ffffffff8e53c390 R15: 1ffff11006ff9bba rtlock_slowlock kernel/locking/rtmutex.c:1922 [inline] rtlock_lock kernel/locking/spinlock_rt.c:43 [inline] __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline] rt_spin_lock+0x165/0x400 kernel/locking/spinlock_rt.c:57 spin_lock include/linux/spinlock_rt.h:45 [inline] simple_release_fs+0x2f/0xd0 fs/libfs.c:1120 __simple_recursive_removal+0x215/0x520 fs/libfs.c:623 debugfs_remove+0x5b/0x70 fs/debugfs/inode.c:781 kvm_destroy_vm_debugfs virt/kvm/kvm_main.c:988 [inline] kvm_destroy_vm virt/kvm/kvm_main.c:1261 [inline] kvm_put_kvm+0x147/0xae0 virt/kvm/kvm_main.c:1331 kvm_vm_release+0x46/0x50 virt/kvm/kvm_main.c:1354 __fput+0x42a/0xa80 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x73a/0x2360 kernel/exit.c:1009 do_group_exit+0x22d/0x2f0 kernel/exit.c:1152 __do_sys_exit_group kernel/exit.c:1163 [inline] __se_sys_exit_group kernel/exit.c:1161 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1161 x64_sys_call+0x18bf/0x18c0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f132ec60d05 Code: Unable to access opcode bytes at 0x7f132ec60cdb. RSP: 002b:00007ffe413e3968 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f132ec60d05 RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000009 R10: 0000000000000009 R11: 0000000000000202 R12: 0000000000000000 R13: 00007f132ecfa118 R14: 00007f132ecfc3c8 R15: 00007f132ecfc3e0 ============================= [ BUG: Invalid wait context ] syzkaller #0 Tainted: G W ----------------------------- syz-executor363/5622 is trying to lock: ffff888038241530 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829 other info that might help us debug this: context-{2:2} locks held by syz-executor363/5622: 4, last CPU#0: #0: ffff88804093d380 (&sb->s_type->i_mutex_key#8/2){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline] #0: ffff88804093d380 (&sb->s_type->i_mutex_key#8/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x19a/0x520 fs/libfs.c:619 #1: ffffffff8e53c398 (pin_fs_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #1: ffffffff8e53c398 (pin_fs_lock){+.+.}-{3:3}, at: simple_release_fs+0x2f/0xd0 fs/libfs.c:1120 #2: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rtlock_slowlock_locked+0x2ab/0x3c20 kernel/locking/rtmutex.c:1874 #3: ffff888038241b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline] #3: ffff888038241b48 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline] #3: ffff888038241b48 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1be/0x990 arch/x86/kvm/xen.c:1827 stack backtrace: CPU: 0 UID: 0 PID: 5622 Comm: syz-executor363 Tainted: G W syzkaller #0 PREEMPT_{RT,(full)} Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_lock_invalid_wait_context kernel/locking/lockdep.c:4846 [inline] check_wait_context kernel/locking/lockdep.c:4918 [inline] __lock_acquire+0xef0/0x2e40 kernel/locking/lockdep.c:5204 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5906 rt_read_lock+0xcc/0x4b0 kernel/locking/spinlock_rt.c:249 kvm_xen_set_evtchn_fast+0x1f4/0x990 arch/x86/kvm/xen.c:1829 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:141 __run_hrtimer kernel/time/hrtimer.c:2065 [inline] __hrtimer_run_queues+0x3a0/0xaf0 kernel/time/hrtimer.c:2122 hrtimer_interrupt+0x44a/0x900 kernel/time/hrtimer.c:2241 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline] __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:rt_mutex_owner include/linux/rtmutex.h:52 [inline] RIP: 0010:rtmutex_spin_on_owner kernel/locking/rtmutex.c:1504 [inline] RIP: 0010:rtlock_slowlock_locked+0x34e5/0x3c20 kernel/locking/rtmutex.c:1893 Code: 80 3c 01 00 4c 8b b4 24 80 00 00 00 4c 8b 2c 24 74 08 4c 89 ef e8 db 0e df f6 48 8d 84 24 60 01 00 00 49 39 45 00 75 6c f3 90 <48> b8 00 00 00 00 00 fc ff df 48 8b 8c 24 a8 00 00 00 80 3c 01 00 RSP: 0018:ffffc90004e6f7a0 EFLAGS: 00000246 RAX: ffffc90004e6f900 RBX: 1ffff11006ff9bbe RCX: 1ffffffff1ca7871 RDX: 00000000e6b90d15 RSI: ffffffff8bcbd060 RDI: 0000000000000001 RBP: ffffc90004e6f9f0 R08: 1d00000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff8e3c3880 R12: ffff888037fcddc0 R13: ffffffff8e53c388 R14: ffffffff8e53c390 R15: 1ffff11006ff9bba rtlock_slowlock kernel/locking/rtmutex.c:1922 [inline] rtlock_lock kernel/locking/spinlock_rt.c:43 [inline] __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline] rt_spin_lock+0x165/0x400 kernel/locking/spinlock_rt.c:57 spin_lock include/linux/spinlock_rt.h:45 [inline] simple_release_fs+0x2f/0xd0 fs/libfs.c:1120 __simple_recursive_removal+0x215/0x520 fs/libfs.c:623 debugfs_remove+0x5b/0x70 fs/debugfs/inode.c:781 kvm_destroy_vm_debugfs virt/kvm/kvm_main.c:988 [inline] kvm_destroy_vm virt/kvm/kvm_main.c:1261 [inline] kvm_put_kvm+0x147/0xae0 virt/kvm/kvm_main.c:1331 kvm_vm_release+0x46/0x50 virt/kvm/kvm_main.c:1354 __fput+0x42a/0xa80 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x73a/0x2360 kernel/exit.c:1009 do_group_exit+0x22d/0x2f0 kernel/exit.c:1152 __do_sys_exit_group kernel/exit.c:1163 [inline] __se_sys_exit_group kernel/exit.c:1161 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1161 x64_sys_call+0x18bf/0x18c0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f132ec60d05 Code: Unable to access opcode bytes at 0x7f132ec60cdb. RSP: 002b:00007ffe413e3968 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f132ec60d05 RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000009 R10: 0000000000000009 R11: 0000000000000202 R12: 0000000000000000 R13: 00007f132ecfa118 R14: 00007f132ecfc3c8 R15: 00007f132ecfc3e0 ---------------- Code disassembly (best guess): 0: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1) 4: 4c 8b b4 24 80 00 00 mov 0x80(%rsp),%r14 b: 00 c: 4c 8b 2c 24 mov (%rsp),%r13 10: 74 08 je 0x1a 12: 4c 89 ef mov %r13,%rdi 15: e8 db 0e df f6 call 0xf6df0ef5 1a: 48 8d 84 24 60 01 00 lea 0x160(%rsp),%rax 21: 00 22: 49 39 45 00 cmp %rax,0x0(%r13) 26: 75 6c jne 0x94 28: f3 90 pause * 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction 31: fc ff df 34: 48 8b 8c 24 a8 00 00 mov 0xa8(%rsp),%rcx 3b: 00 3c: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1)