=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
syz.2.1496/11569 is trying to lock:
ffff88807f595bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1843
other info that might help us debug this:
context-{2:2}
locks held by syz.2.1496/11569: 3, last CPU#0:
#0: ffff88802c628e00 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#0: ffff88802c628e00 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
#0: ffff88802c628e00 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 drivers/base/dd.c:1369
#1: ffffffff922787a0 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
#1: ffffffff922787a0 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline]
#1: ffffffff922787a0 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_env+0xba8/0x18b0 lib/kobject_uevent.c:611
#2: ffff88807f596110 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
#2: ffff88807f596110 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
#2: ffff88807f596110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x245/0xe80 arch/x86/kvm/xen.c:1841
stack backtrace:
CPU: 0 UID: 0 PID: 11569 Comm: syz.2.1496 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4874 [inline]
check_wait_context kernel/locking/lockdep.c:4946 [inline]
__lock_acquire+0xfcc/0x1f40 kernel/locking/lockdep.c:5238
lock_acquire kernel/locking/lockdep.c:5942 [inline]
lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:271
kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1843
xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:139
__run_hrtimer kernel/time/hrtimer.c:2074 [inline]
__hrtimer_run_queues+0x13f/0x9c0 kernel/time/hrtimer.c:2131
hrtimer_interrupt+0x441/0xaa0 kernel/time/hrtimer.c:2250
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
__sysvec_apic_timer_interrupt+0x109/0x470 arch/x86/kernel/apic/apic.c:1068
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:might_alloc include/linux/sched/mm.h:316 [inline]
RIP: 0010:slab_pre_alloc_hook mm/slub.c:4636 [inline]
RIP: 0010:slab_alloc_node mm/slub.c:4974 [inline]
RIP: 0010:kmem_cache_alloc_node_noprof+0x50/0x6e0 mm/slub.c:5068
Code: 4c 89 6c 24 38 41 89 d5 48 8b 44 24 70 48 c7 44 24 28 00 00 00 00 48 c7 44 24 30 00 00 00 00 41 21 f4 48 89 44 24 18 8b 47 1c <44> 89 e7 48 c7 44 24 10 00 00 00 00 48 89 44 24 20 e8 ea 31 fc ff
RSP: 0018:ffffc9000579f7a0 EFLAGS: 00000206
RAX: 00000000000000f0 RBX: ffff8880216be500 RCX: 0000000000000000
RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: ffff8880216be500
RBP: 0000000000000cc0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000cc0
R13: 00000000ffffffff R14: ffff8880216be500 R15: 0000000000000cc0
__alloc_skb+0x140/0x710 net/core/skbuff.c:704
alloc_skb include/linux/skbuff.h:1384 [inline]
alloc_uevent_skb+0x7d/0x210 lib/kobject_uevent.c:289
uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline]
kobject_uevent_env+0xd2d/0x18b0 lib/kobject_uevent.c:611
device_remove+0xcb/0x180 drivers/base/dd.c:616
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
driver_detach+0xd8/0x1b0 drivers/base/dd.c:1435
bus_remove_driver+0x13b/0x2e0 drivers/base/bus.c:832
driver_unregister+0x76/0xb0 drivers/base/driver.c:202
usb_gadget_unregister_driver+0x49/0x70 drivers/usb/gadget/udc/core.c:1784
raw_release+0x19b/0x260 drivers/usb/gadget/legacy/raw_gadget.c:463
__fput+0x400/0xb60 fs/file_table.c:512
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x8da/0x2a50 kernel/exit.c:986
do_group_exit+0xd5/0x2a0 kernel/exit.c:1129
get_signal+0x1ec7/0x21e0 kernel/signal.c:3112
arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop kernel/entry/common.c:101 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
irqentry_exit+0x402/0xa10 kernel/entry/common.c:165
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0033:0x7f45fa86e644
Code: Unable to access opcode bytes at 0x7f45fa86e61a.
RSP: 002b:00007ffdd643f7f0 EFLAGS: 00000287
RAX: 00007f45f94fc048 RBX: 00007f45f94fb438 RCX: ffffffff87927be2
RDX: ffffffff87927be2 RSI: 00007f45f94fc048 RDI: 00007f45f94fa730
RBP: 00007f45f94f7518 R08: 00007f45fac10000 R09: 00007f45fac25f40
R10: 0000000000000000 R11: 00000000000000ff R12: 00007f45f94fd948
R13: 000000000000001a R14: 0000000000000c86 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 4c 89 6c 24 38 mov %r13,0x38(%rsp)
5: 41 89 d5 mov %edx,%r13d
8: 48 8b 44 24 70 mov 0x70(%rsp),%rax
d: 48 c7 44 24 28 00 00 movq $0x0,0x28(%rsp)
14: 00 00
16: 48 c7 44 24 30 00 00 movq $0x0,0x30(%rsp)
1d: 00 00
1f: 41 21 f4 and %esi,%r12d
22: 48 89 44 24 18 mov %rax,0x18(%rsp)
27: 8b 47 1c mov 0x1c(%rdi),%eax
* 2a: 44 89 e7 mov %r12d,%edi <-- trapping instruction
2d: 48 c7 44 24 10 00 00 movq $0x0,0x10(%rsp)
34: 00 00
36: 48 89 44 24 20 mov %rax,0x20(%rsp)
3b: e8 ea 31 fc ff call 0xfffc322a