syzbot


WARNING: locking bug in vgic_put_irq

Status: upstream: reported C repro on 2025/08/25 21:08
Subsystems: kvmarm
[Documentation on labels]
Reported-by: syzbot+cef594105ac7e60c6d93@syzkaller.appspotmail.com
Fix commit: d54594accf73 KVM: arm64: vgic-v3: Erase LPIs from xarray outside of raw spinlocks
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm]
First crash: 50d, last: 43d
Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [kvmarm?] [kvm?] WARNING: locking bug in vgic_put_irq 2 (5) 2025/09/10 00:53
[syzbot] Monthly kvm report (Sep 2025) 0 (1) 2025/09/01 07:38
Last patch testing requests (4)
Created Duration User Patch Repo Result
2025/09/15 14:44 48m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next error
2025/09/15 14:44 28m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next error
2025/09/10 00:03 49m hdanton@sina.com patch git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next error
2025/09/09 21:23 50m oliver.upton@linux.dev git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git fixes error

Sample crash report:
=============================
[ BUG: Invalid wait context ]
6.16.0-rc3-syzkaller-g7b8346bd9fce #0 Not tainted
-----------------------------
syz.2.100/3976 is trying to lock:
a8ff80008ea66e18 (&xa->xa_lock#20){....}-{3:3}, at: vgic_put_irq+0xb4/0x190 arch/arm64/kvm/vgic/vgic.c:137
other info that might help us debug this:
context-{5:5}
3 locks held by syz.2.100/3976:
 #0: a8ff80008ea660a8 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vgic_destroy+0x50/0x624 arch/arm64/kvm/vgic/vgic-init.c:499
 #1: a8ff80008ea66fa0 (&kvm->arch.config_lock){+.+.}-{4:4}, at: kvm_vgic_destroy+0x5c/0x624 arch/arm64/kvm/vgic/vgic-init.c:500
 #2: 5ef000001e241428 (&vgic_cpu->ap_list_lock){....}-{2:2}, at: vgic_flush_pending_lpis+0x3c/0x31c arch/arm64/kvm/vgic/vgic.c:150
stack backtrace:
CPU: 0 UID: 0 PID: 3976 Comm: syz.2.100 Not tainted 6.16.0-rc3-syzkaller-g7b8346bd9fce #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4833 [inline]
 check_wait_context kernel/locking/lockdep.c:4905 [inline]
 __lock_acquire+0x978/0x299c kernel/locking/lockdep.c:5190
 lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5871
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
 vgic_put_irq+0xb4/0x190 arch/arm64/kvm/vgic/vgic.c:137
 vgic_flush_pending_lpis+0x24c/0x31c arch/arm64/kvm/vgic/vgic.c:158
 __kvm_vgic_vcpu_destroy+0x44/0x500 arch/arm64/kvm/vgic/vgic-init.c:455
 kvm_vgic_destroy+0x100/0x624 arch/arm64/kvm/vgic/vgic-init.c:505
 kvm_arch_destroy_vm+0x80/0x138 arch/arm64/kvm/arm.c:244
 kvm_destroy_vm virt/kvm/kvm_main.c:1308 [inline]
 kvm_put_kvm+0x800/0xff8 virt/kvm/kvm_main.c:1344
 kvm_vm_release+0x58/0x78 virt/kvm/kvm_main.c:1367
 __fput+0x4ac/0x980 fs/file_table.c:465
 ____fput+0x20/0x58 fs/file_table.c:493
 task_work_run+0x1bc/0x254 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 do_notify_resume+0x1b4/0x270 arch/arm64/kernel/entry-common.c:151
 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]
 el0_svc+0xb4/0x160 arch/arm64/kernel/entry-common.c:768
 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/26 13:22 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next 7b8346bd9fce bf27483f .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-native-arm64-kvm WARNING: locking bug in vgic_put_irq
2025/08/25 20:55 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next 7b8346bd9fce bf27483f .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-native-arm64-kvm WARNING: locking bug in vgic_put_irq
2025/09/01 14:44 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next 7b8346bd9fce 807a3b61 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-native-arm64-kvm WARNING: locking bug in vgic_put_irq
2025/08/29 20:11 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next 7b8346bd9fce 3e1beec6 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-native-arm64-kvm WARNING: locking bug in vgic_put_irq
2025/08/26 16:02 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next 7b8346bd9fce e12e5ba4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-native-arm64-kvm WARNING: locking bug in vgic_put_irq
2025/08/26 07:44 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next 7b8346bd9fce bf27483f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-native-arm64-kvm WARNING: locking bug in vgic_put_irq
2025/08/25 04:06 git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git next 7b8346bd9fce bf27483f .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-native-arm64-kvm WARNING: locking bug in vgic_put_irq
* Struck through repros no longer work on HEAD.