------------[ cut here ]------------ debug_locks && !(lock_is_held(&(__rq_lockp(rq))->dep_map) != 0) WARNING: kernel/sched/sched.h:1641 at lockdep_assert_rq_held kernel/sched/sched.h:1641 [inline], CPU#0: syz.3.4/5794 WARNING: kernel/sched/sched.h:1641 at lockdep_assert_rq_held kernel/sched/sched.h:1638 [inline], CPU#0: syz.3.4/5794 WARNING: kernel/sched/sched.h:1641 at update_rq_clock+0x40a/0xd20 kernel/sched/core.c:865, CPU#0: syz.3.4/5794 Modules linked in: CPU: 0 UID: 0 PID: 5794 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1641 [inline] RIP: 0010:lockdep_assert_rq_held kernel/sched/sched.h:1638 [inline] RIP: 0010:update_rq_clock+0x40a/0xd20 kernel/sched/core.c:865 Code: ab c8 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 58 de e5 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 c0 0b 00 00 48 b8 00 00 00 00 00 RSP: 0018:ffffc9000442f290 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff8880b853b600 RCX: 0000000000000001 RDX: 0000000000000046 RSI: ffffffff8e182527 RDI: ffffffff8c400980 RBP: ffffc9000442f438 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff91229cd7 R11: 0000000000000000 R12: ffffffff9122d084 R13: ffff8880b853c4e0 R14: ffff88801eac9f00 R15: ffff8880b843c198 FS: 000055557df8d500(0000) GS:ffff888123de3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00002000002e2000 CR3: 0000000076f06000 CR4: 00000000003526f0 Call Trace: pick_next_task kernel/sched/core.c:6338 [inline] __schedule+0x1e2d/0x6730 kernel/sched/core.c:7149 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7556 irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x205/0xa00 kernel/entry/common.c:167 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:679 RIP: 0010:lock_release+0x19e/0x310 kernel/locking/lockdep.c:5893 Code: ff 65 0f c1 05 23 b5 7e 12 83 f8 01 0f 85 27 01 00 00 9c 58 f6 c4 02 0f 85 12 01 00 00 41 f7 c6 00 02 00 00 0f 85 c8 00 00 00 <48> 8b 44 24 10 65 48 2b 05 2d 6e 7e 12 0f 85 4d 01 00 00 48 83 c4 RSP: 0018:ffffc9000442f550 EFLAGS: 00000206 RAX: 0000000000000046 RBX: ffffffff8ebe7f80 RCX: ffffc9000442f55c RDX: 0000000000000001 RSI: ffffffff8e182527 RDI: ffffffff8c400980 RBP: ffffffff81b806be R08: 0000000000000001 R09: 0000000000000007 R10: 0000000000000200 R11: 000000000000f3d9 R12: ffff88802f31be00 R13: ffffc9000442f608 R14: 0000000000000202 R15: 0000000000000002 rcu_lock_release include/linux/rcupdate.h:310 [inline] rcu_read_unlock include/linux/rcupdate.h:871 [inline] class_rcu_destructor include/linux/rcupdate.h:1183 [inline] unwind_next_frame+0x3c3/0x2090 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 __call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3159 destroy_inode+0x134/0x1c0 fs/inode.c:392 evict+0x599/0xad0 fs/inode.c:849 iput_final fs/inode.c:2019 [inline] iput.part.0+0x989/0x1050 fs/inode.c:2068 iput+0x35/0x40 fs/inode.c:2034 dentry_unlink_inode+0x284/0x470 fs/dcache.c:479 dentry_kill+0x25d/0xc20 fs/dcache.c:826 finish_dput fs/dcache.c:1001 [inline] dput.part.0+0xd7/0x240 fs/dcache.c:1042 dput+0x1f/0x30 fs/dcache.c:1037 find_next_child+0x18f/0x280 fs/libfs.c:592 __simple_recursive_removal+0x2ab/0x5c0 fs/libfs.c:609 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781 kvm_destroy_vm_debugfs+0xc6/0x200 virt/kvm/kvm_main.c:988 kvm_destroy_vm virt/kvm/kvm_main.c:1261 [inline] kvm_put_kvm+0x119/0xc10 virt/kvm/kvm_main.c:1331 kvm_vm_release+0x3c/0x50 virt/kvm/kvm_main.c:1354 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x652/0x840 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9f0b19de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc200c08d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f9f0b427da0 RCX: 00007f9f0b19de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f9f0b427da0 R08: 00007f9f0b426038 R09: 0000000000000000 R10: 00000000003fa2f0 R11: 0000000000000246 R12: 0000000000014f75 R13: 00007f9f0b42609c R14: 0000000000014d1e R15: 00007f9f0b426090 ---------------- Code disassembly (best guess): 0: ff 65 0f jmp *0xf(%rbp) 3: c1 05 23 b5 7e 12 83 roll $0x83,0x127eb523(%rip) # 0x127eb52d a: f8 clc b: 01 0f add %ecx,(%rdi) d: 85 27 test %esp,(%rdi) f: 01 00 add %eax,(%rax) 11: 00 9c 58 f6 c4 02 0f add %bl,0xf02c4f6(%rax,%rbx,2) 18: 85 12 test %edx,(%rdx) 1a: 01 00 add %eax,(%rax) 1c: 00 41 f7 add %al,-0x9(%rcx) 1f: c6 00 02 movb $0x2,(%rax) 22: 00 00 add %al,(%rax) 24: 0f 85 c8 00 00 00 jne 0xf2 * 2a: 48 8b 44 24 10 mov 0x10(%rsp),%rax <-- trapping instruction 2f: 65 48 2b 05 2d 6e 7e sub %gs:0x127e6e2d(%rip),%rax # 0x127e6e64 36: 12 37: 0f 85 4d 01 00 00 jne 0x18a 3d: 48 rex.W 3e: 83 .byte 0x83 3f: c4 .byte 0xc4