=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
syz.7.3550/20097 is trying to lock:
ffff888067275410 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1820
other info that might help us debug this:
context-{2:2}
2 locks held by syz.7.3550/20097:
#0: ffff888027c1ace0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:415 [inline]
#0: ffff888027c1ace0 (&mm->mmap_lock){++++}-{4:4}, at: do_mprotect_pkey+0x217/0xce0 mm/mprotect.c:892
#1: ffff888067275960 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
#1: ffff888067275960 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:253 [inline]
#1: ffff888067275960 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9b0 arch/x86/kvm/xen.c:1818
stack backtrace:
CPU: 1 UID: 0 PID: 20097 Comm: syz.7.3550 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xbcb/0xd20 kernel/locking/lockdep.c:5187
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
_raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1820
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x4dd/0xc60 kernel/time/hrtimer.c:1825
hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1887
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline]
__sysvec_apic_timer_interrupt+0x108/0x410 arch/x86/kernel/apic/apic.c:1056
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: 89 fb e8 23 00 00 00 48 8b 3d 64 87 fe 0b 48 89 de 5b e9 f3 ab 58 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0c 25 08 d0 a0 92 65 8b 15 88 22
RSP: 0018:ffffc900043b7598 EFLAGS: 00000246
RAX: 0000000000000003 RBX: ffffc900043b7750 RCX: 0000000000000005
RDX: ffffffff8b722eb4 RSI: ffffffff8f8a6840 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffff88802a68da00 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88802c656a00 R14: ffffc900043b7768 R15: ffffffffffffffff
ma_pivots lib/maple_tree.c:666 [inline]
mas_next_slot+0x140/0xcf0 lib/maple_tree.c:4696
mas_find+0xb0e/0xd30 lib/maple_tree.c:6062
vma_next include/linux/mm.h:866 [inline]
validate_mm+0xe1/0x4b0 mm/vma.c:652
__split_vma+0x8bd/0xa00 mm/vma.c:569
split_vma mm/vma.c:598 [inline]
vma_modify+0x13b3/0x1970 mm/vma.c:1631
vma_modify_flags+0x1e8/0x230 mm/vma.c:1649
mprotect_fixup+0x407/0x9c0 mm/mprotect.c:816
do_mprotect_pkey+0x8cd/0xce0 mm/mprotect.c:990
__do_sys_mprotect mm/mprotect.c:1011 [inline]
__se_sys_mprotect mm/mprotect.c:1008 [inline]
__x64_sys_mprotect+0x80/0x90 mm/mprotect.c:1008
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f674c38ece7
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f674c6ff9c8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a
RAX: ffffffffffffffda RBX: 00007f674d1bc6c0 RCX: 00007f674c38ece7
RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007f674d19d000
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000021000 R11: 0000000000000206 R12: 00007f674c6ffb20
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 89 fb mov %edi,%ebx
2: e8 23 00 00 00 call 0x2a
7: 48 8b 3d 64 87 fe 0b mov 0xbfe8764(%rip),%rdi # 0xbfe8772
e: 48 89 de mov %rbx,%rsi
11: 5b pop %rbx
12: e9 f3 ab 58 00 jmp 0x58ac0a
17: cc int3
18: cc int3
19: cc int3
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
29: 90 nop
* 2a: f3 0f 1e fa endbr64 <-- trapping instruction
2e: 48 8b 04 24 mov (%rsp),%rax
32: 65 48 8b 0c 25 08 d0 mov %gs:0xffffffff92a0d008,%rcx
39: a0 92
3b: 65 gs
3c: 8b .byte 0x8b
3d: 15 .byte 0x15
3e: 88 22 mov %ah,(%rdx)