BUG: sleeping function called from invalid context in vhost_get_avail_idx

BUG: sleeping function called from invalid context in vhost_get_avail_idx

Status: fixed on 2026/05/21 07:49
Subsystems: kvm net virt
[Documentation on labels]
Reported-by: syzbot+6985cb8e543ea90ba8ee@syzkaller.appspotmail.com
Fix commit: e08a9fac5cf8 vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
First crash: 52d, last: 52d

▶ ▼ ✨ AI Jobs (1)

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
9334e488-b837-4e8b-ae74-a493f3e81729	assessment-security		💥	BUG: sleeping function called from invalid context in vhost_get_avail_idx	2026/05/14 14:34	2026/05/14 14:34	2026/05/14 14:36	6ccb967e465e832a7bfd7a116ad00d52a0923a5d	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/ee7e3c0f7235af18eaa22059efcef4df8b347024" "-s" "bzImage" "compile_commands.json"]: exit status 2 * * Restart config... * * * General architecture-dependent options * SMT (Hyperthreading) scheduler support (SCHED_SMT) [Y/?] y Cluster scheduler support (SCHED_CLUSTER) [Y/n/?] y Multi-Core Cache (MC) scheduler support (SCHED_MC) [Y/n/?] y Kprobes (KPROBES) [N/y/?] n Optimize very unlikely/likely branches (JUMP_LABEL) [Y/n/?] y Static key selftest (STATIC_KEYS_SELFTEST) [N/y/?] n Static call selftest (STATIC_CALL_SELFTEST) [N/y/?] n Enable seccomp to safely execute untrusted bytecode (SECCOMP) [Y/n/?] y Show seccomp filter cache status in /proc/pid/seccomp_cache (SECCOMP_CACHE_DEBUG) [N/y/?] n Stack Protector buffer overflow detection (STACKPROTECTOR) [Y/n/?] y Strong Stack Protector (STACKPROTECTOR_STRONG) [Y/n/?] y Link Time Optimization (LTO) > 1. None (LTO_NONE) choice[1]: 1 Enable Clang's AutoFDO build (EXPERIMENTAL) (AUTOFDO_CLANG) [N/y/?] (NEW) Error in reading or end of file. Enable Clang's Propeller build (PROPELLER_CLANG) [N/y/?] (NEW) Error in reading or end of file. Use Kernel Control Flow Integrity (kCFI) (CFI) [N/y/?] (NEW) Error in reading or end of file. Number of bits to use for ASLR of mmap base address (ARCH_MMAP_RND_BITS) [28] 28 Number of bits to use for ASLR of mmap base address for compatible applications (ARCH_MMAP_RND_COMPAT_BITS) [8] 8 MMU page size > 1. 4KiB pages (PAGE_SIZE_4KB) choice[1]: 1 Provide system calls for 32-bit time_t (COMPAT_32BIT_TIME) [Y/n/?] y Use a virtually-mapped stack (VMAP_STACK) [Y/n/?] y Support for randomizing kernel stack offset on syscall entry (RANDOMIZE_KSTACK_OFFSET) [Y/n/?] y Default state of kernel stack offset randomization (RANDOMIZE_KSTACK_OFFSET_DEFAULT) [N/y/?] n Locking event counts collection (LOCK_EVENT_COUNTS) [N/y/?] n * * Memory initialization * Initialize kernel stack variables at function entry 1. no automatic stack variable initialization (weakest) (INIT_STACK_NONE) 2. pattern-init everything (strongest) (INIT_STACK_ALL_PATTERN) > 3. zero-init everything (strongest and safest) (INIT_STACK_ALL_ZERO) choice[1-3?]: 3 Poison kernel stack before returning from syscalls (KSTACK_ERASE) [N/y/?] (NEW) Error in reading or end of file. Enable heap memory zeroing on allocation by default (INIT_ON_ALLOC_DEFAULT_ON) [Y/n/?] y Enable heap memory zeroing on free by default (INIT_ON_FREE_DEFAULT_ON) [N/y/?] n Enable register zeroing on function exit (ZERO_CALL_USED_REGS) [N/y/?] n * * Kernel hardening options * Randomize layout of sensitive kernel structures > 1. Disable structure layout randomization (RANDSTRUCT_NONE) 2. Fully randomize structure layout (RANDSTRUCT_FULL) (NEW) choice[1-2?]: Error in reading or end of file. /app/workdir/cache/src/ca57ecb8fdb59054b50823206eac1bdc4d565b45/lib/maple_tree.c:3514:20: warning: stack frame size (2424) exceeds limit (2048) in 'mas_wr_store_entry' [-Wframe-larger-than] 3514 \| static inline void mas_wr_store_entry(struct ma_wr_state wr_mas) \| ^ 1 warning generated. /app/workdir/cache/src/ca57ecb8fdb59054b50823206eac1bdc4d565b45/sound/usb/mixer_s1810c.c:634:5: warning: stack frame size (2360) exceeds limit (2048) in 'snd_sc1810_init_mixer' [-Wframe-larger-than] 634 \| int snd_sc1810_init_mixer(struct usb_mixer_interface mixer) \| ^ 1 warning generated. /bin/sh: 1: printf: printf: I/O error make[5]: * [/app/workdir/cache/src/ca57ecb8fdb59054b50823206eac1bdc4d565b45/scripts/Makefile.build:477: block/partitions/built-in.a] Error 1 make[5]: * Deleting file 'block/partitions/built-in.a' make[4]: * [/app/workdir/cache/src/ca57ecb8fdb59054b50823206eac1bdc4d565b45/scripts/Makefile.build:548: block/partitions] Error 2 make[3]: * [/app/workdir/cache/src/ca57ecb8fdb59054b50823206eac1bdc4d565b45/scripts/Makefile.build:548: block] Error 2 make[3]: *** Waiting for unfinished jobs.... fixdep: not al

▶ ▼ Discussions (2)

Title	Replies (including bot)	Last reply
[PATCH net v1] vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()	3 (3)	2026/04/23 19:10
[syzbot] [kvm?] [net?] [virt?] BUG: sleeping function called from invalid context in vhost_get_avail_idx	4 (7)	2026/04/22 00:36

▶ ▼ Similar bugs (1)

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-6.1	BUG: sleeping function called from invalid context in vhost_get_avail_idx origin:upstream	5	C		error	3	236d	236d	0/3	upstream: reported C repro on 2025/10/16 01:54

▶ ▼ Last patch testing requests (2)


Created	Duration	User	Patch	Repo	Result
2026/04/21 23:36	32m	kohei@enjuk.jp	patch	upstream	OK log
2026/04/21 17:11	22m	kohei@enjuk.jp	patch	upstream	error

Sample crash report:

BUG: sleeping function called from invalid context at drivers/vhost/vhost.c:1527
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6110, name: vhost-6109
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
2 locks held by vhost-6109/6110:
 #0: ffff888055624cb0 (&vq->mutex/1){+.+.}-{4:4}, at: handle_tx+0x2d/0x160 drivers/vhost/net.c:971
 #1: ffff888055620248 (&vq->mutex){+.+.}-{4:4}, at: vhost_net_busy_poll+0x9c/0x730 drivers/vhost/net.c:554
Preemption disabled at:
[<ffffffff88f1a006>] vhost_net_busy_poll+0x1c6/0x730 drivers/vhost/net.c:563
CPU: 0 UID: 0 PID: 6110 Comm: vhost-6109 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 __might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9162
 __might_fault+0x8b/0x140 mm/memory.c:7322
 vhost_get_avail_idx+0x31c/0x4f0 drivers/vhost/vhost.c:1527
 vhost_vq_avail_empty drivers/vhost/vhost.c:3206 [inline]
 vhost_vq_avail_empty+0xa9/0xe0 drivers/vhost/vhost.c:3199
 vhost_net_busy_poll+0x297/0x730 drivers/vhost/net.c:574
 vhost_net_tx_get_vq_desc drivers/vhost/net.c:610 [inline]
 get_tx_bufs.constprop.0+0x338/0x600 drivers/vhost/net.c:650
 handle_tx_copy+0x28c/0x12e0 drivers/vhost/net.c:778
 handle_tx+0x139/0x160 drivers/vhost/net.c:985
 vhost_run_work_list+0x183/0x220 drivers/vhost/vhost.c:454
 vhost_task_fn+0x156/0x430 kernel/vhost_task.c:49
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/04/18 13:30	upstream	8541d8f725c6	5be7a9de	.config	console log	report	syz / log	C		[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	BUG: sleeping function called from invalid context in vhost_get_avail_idx

* ~~Struck through~~ repros no longer work on HEAD.