=============================
[ BUG: Invalid wait context ]
6.13.0-rc2-syzkaller-00362-g2d8308bf5b67 #0 Not tainted
-----------------------------
syz.0.68/6159 is trying to lock:
ffff8880b863b0a0 (batched_entropy_u8.lock){..-.}-{3:3}, at: local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
ffff8880b863b0a0 (batched_entropy_u8.lock){..-.}-{3:3}, at: get_random_u8+0xef/0x7f0 drivers/char/random.c:551
other info that might help us debug this:
context-{2:2}
2 locks held by syz.0.68/6159:
#0: ffff88805f7914b8 (&xa->xa_lock#23){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#0: ffff88805f7914b8 (&xa->xa_lock#23){+.+.}-{3:3}, at: xa_erase+0x19/0x40 lib/xarray.c:1531
#1: ffffffff8ddba880 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#1: ffffffff8ddba880 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:941 [inline]
#1: ffffffff8ddba880 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid include/linux/mmzone.h:2048 [inline]
#1: ffffffff8ddba880 (rcu_read_lock_sched){....}-{1:2}, at: __virt_addr_valid+0x1a4/0x590 arch/x86/mm/physaddr.c:65
stack backtrace:
CPU: 0 UID: 0 PID: 6159 Comm: syz.0.68 Not tainted 6.13.0-rc2-syzkaller-00362-g2d8308bf5b67 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
check_wait_context kernel/locking/lockdep.c:4898 [inline]
__lock_acquire+0x878/0x3c40 kernel/locking/lockdep.c:5176
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849
local_lock_acquire include/linux/local_lock_internal.h:29 [inline]
get_random_u8+0x107/0x7f0 drivers/char/random.c:551
get_random_u32_below include/linux/random.h:78 [inline]
kfence_guarded_alloc mm/kfence/core.c:421 [inline]
__kfence_alloc+0x4e8/0x15f0 mm/kfence/core.c:1136
kfence_alloc include/linux/kfence.h:129 [inline]
slab_alloc_node mm/slub.c:4152 [inline]
__kmalloc_cache_noprof+0x125/0x420 mm/slub.c:4324
kmalloc_noprof include/linux/slab.h:901 [inline]
add_stack_record_to_list mm/page_owner.c:172 [inline]
inc_stack_record_count mm/page_owner.c:214 [inline]
__set_page_owner+0x50f/0x790 mm/page_owner.c:329
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474
__alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4751
alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
stack_depot_save_flags+0x8e0/0x9e0 lib/stackdepot.c:627
kasan_save_stack+0x42/0x60 mm/kasan/common.c:48
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:544
task_work_add+0xc0/0x3b0 kernel/task_work.c:77
__run_posix_cpu_timers kernel/time/posix-cpu-timers.c:1223 [inline]
run_posix_cpu_timers+0x69f/0x7d0 kernel/time/posix-cpu-timers.c:1422
update_process_times+0x1a1/0x2d0 kernel/time/timer.c:2526
tick_sched_handle kernel/time/tick-sched.c:276 [inline]
tick_nohz_handler+0x376/0x530 kernel/time/tick-sched.c:297
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x5fb/0xae0 kernel/time/hrtimer.c:1803
hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1865
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire.part.0+0x155/0x380 kernel/locking/lockdep.c:5814
Code: b8 ff ff ff ff 65 0f c1 05 f0 44 8c 7e 83 f8 01 0f 85 d0 01 00 00 9c 58 f6 c4 02 0f 85 e5 01 00 00 48 85 ed 0f 85 b6 01 00 00 <48> b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 00 00 00 48 c7
RSP: 0018:ffffc9000582f6b8 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 1ffff92000b05ed8 RCX: 000000004124cf80
RDX: 0000000000000001 RSI: ffffffff8b4cd480 RDI: ffffffff8bb16c00
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2d36998
R10: ffffffff969b4cc7 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffff8ddba880 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
rcu_read_lock_sched include/linux/rcupdate.h:941 [inline]
pfn_valid include/linux/mmzone.h:2048 [inline]
__virt_addr_valid+0x1aa/0x590 arch/x86/mm/physaddr.c:65
kasan_addr_to_slab+0xd/0x80 mm/kasan/common.c:37
__kasan_record_aux_stack+0xe/0xd0 mm/kasan/generic.c:529
__call_rcu_common.constprop.0+0x99/0x7a0 kernel/rcu/tree.c:3086
xa_node_free lib/xarray.c:259 [inline]
xas_delete_node lib/xarray.c:496 [inline]
update_node lib/xarray.c:760 [inline]
xas_store+0xc87/0x1960 lib/xarray.c:845
__xa_erase+0xb4/0x150 lib/xarray.c:1511
xa_erase+0x24/0x40 lib/xarray.c:1532
io_uring_del_tctx_node+0x64/0x350 io_uring/tctx.c:174
io_uring_clean_tctx+0xc3/0x190 io_uring/tctx.c:197
io_uring_cancel_generic+0x676/0x8e0 io_uring/io_uring.c:3203
io_uring_files_cancel include/linux/io_uring.h:20 [inline]
do_exit+0x541/0x2d70 kernel/exit.c:894
do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
get_signal+0x2576/0x2610 kernel/signal.c:3017
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd271d85d19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd272b14038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6
RAX: fffffffffffffdfc RBX: 00007fd271f75fa0 RCX: 00007fd271d85d19
RDX: 0000000000000000 RSI: 0000000000001000 RDI: 0000000000000002
RBP: 00007fd271e01a20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fd271f75fa0 R15: 00007ffc13e5ae88
----------------
Code disassembly (best guess):
0: b8 ff ff ff ff mov $0xffffffff,%eax
5: 65 0f c1 05 f0 44 8c xadd %eax,%gs:0x7e8c44f0(%rip) # 0x7e8c44fd
c: 7e
d: 83 f8 01 cmp $0x1,%eax
10: 0f 85 d0 01 00 00 jne 0x1e6
16: 9c pushf
17: 58 pop %rax
18: f6 c4 02 test $0x2,%ah
1b: 0f 85 e5 01 00 00 jne 0x206
21: 48 85 ed test %rbp,%rbp
24: 0f 85 b6 01 00 00 jne 0x1e0
* 2a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction
31: fc ff df
34: 48 01 c3 add %rax,%rbx
37: 48 c7 03 00 00 00 00 movq $0x0,(%rbx)
3e: 48 rex.W
3f: c7 .byte 0xc7