=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz.8.6382/29825 is trying to lock:
ffff888032b81370 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0 arch/x86/kvm/xen.c:1822
other info that might help us debug this:
context-{2:2}
2 locks held by syz.8.6382/29825:
#0: ffffffff9002ca80 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:641 [inline]
#0: ffffffff9002ca80 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3506
#1: ffff888032b818d0 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffff888032b818d0 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#1: ffff888032b818d0 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0 arch/x86/kvm/xen.c:1820
stack backtrace:
CPU: 1 UID: 0 PID: 29825 Comm: syz.8.6382 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xe39/0x2cf0 kernel/locking/lockdep.c:5187
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
_raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:240
kvm_xen_set_evtchn_fast+0x1f4/0x9a0 arch/x86/kvm/xen.c:1822
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:2032 [inline]
__hrtimer_run_queues+0x371/0xa10 kernel/time/hrtimer.c:2096
hrtimer_interrupt+0x448/0x910 kernel/time/hrtimer.c:2215
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
__sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lockdep_unregister_key+0x2d5/0x350 kernel/locking/lockdep.c:6616
Code: 11 0c 09 00 89 c6 48 c7 c7 d0 e9 74 96 e8 d3 ab 2f 0a 90 e9 65 fe ff ff e8 a8 dc 2c 0a 41 f7 c7 00 02 00 00 74 b3 fb 40 84 ed <75> b2 eb c3 90 0f 0b 90 e9 26 ff ff ff 90 0f 0b 90 e9 2e ff ff ff
RSP: 0018:ffffc90005a979a0 EFLAGS: 00000246
RAX: 0000000000000046 RBX: ffff88804969e268 RCX: 0000000000000046
RDX: ffffffff94306538 RSI: ffffffff8e2462f4 RDI: ffffffff8c4bd980
RBP: ffff88802c915d00 R08: ffffffff81afab08 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000000
R13: ffff88804969e269 R14: 0000000000001000 R15: 0000000000000a07
qdisc_lock_uninit include/net/pkt_sched.h:332 [inline]
__qdisc_destroy+0x1ab/0x470 net/sched/sch_generic.c:1124
netdev_for_each_tx_queue include/linux/netdevice.h:2735 [inline]
dev_shutdown+0x92/0x450 net/sched/sch_generic.c:1512
unregister_netdevice_many_notify+0x11f0/0x2150 net/core/dev.c:12428
unregister_netdevice_many net/core/dev.c:12501 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12313
unregister_netdevice include/linux/netdevice.h:3472 [inline]
__tun_detach+0x1018/0x1880 drivers/net/tun.c:628
tun_detach drivers/net/tun.c:644 [inline]
tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3506
__fput+0x418/0xa50 fs/file_table.c:512
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
exit_to_user_mode_loop+0x1fa/0x730 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9a2459de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9a2494fba8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f9a24827da0 RCX: 00007f9a2459de59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f9a24827da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00000000003ffbc0 R11: 0000000000000246 R12: 000000000016c46b
R13: 00007f9a2482618c R14: 000000000016c1f6 R15: 00007f9a24826180
----------------
Code disassembly (best guess):
0: 11 0c 09 adc %ecx,(%rcx,%rcx,1)
3: 00 89 c6 48 c7 c7 add %cl,-0x3838b73a(%rcx)
9: d0 e9 shr $1,%cl
b: 74 96 je 0xffffffa3
d: e8 d3 ab 2f 0a call 0xa2fabe5
12: 90 nop
13: e9 65 fe ff ff jmp 0xfffffe7d
18: e8 a8 dc 2c 0a call 0xa2cdcc5
1d: 41 f7 c7 00 02 00 00 test $0x200,%r15d
24: 74 b3 je 0xffffffd9
26: fb sti
27: 40 84 ed test %bpl,%bpl
* 2a: 75 b2 jne 0xffffffde <-- trapping instruction
2c: eb c3 jmp 0xfffffff1
2e: 90 nop
2f: 0f 0b ud2
31: 90 nop
32: e9 26 ff ff ff jmp 0xffffff5d
37: 90 nop
38: 0f 0b ud2
3a: 90 nop
3b: e9 2e ff ff ff jmp 0xffffff6e