From nobody Tue Jun 16 08:52:42 2026 Received: from mail-oo1-f78.google.com (mail-oo1-f78.google.com [209.85.161.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B85F2D4816 for ; Fri, 17 Apr 2026 10:38:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.78 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776422293; cv=none; b=lKP7gs7nDeO6Sgqb5Jvz6nod2IOSDWx9Bzm4FbHKBLvOzGYaQTOVQqWghbEf1bNmtvafulmQi8ha7gysrfJa84l7c8VGKT/6SUMJGqLUlQXk4cHQKEknZtT2BdofcUo8IFqZK8aTGEKxvX8dquQjPEgcDZ0BNnOn+hUp1s4BbuE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776422293; c=relaxed/simple; bh=XuErD3A+2ITeef8nsXj0ASKQLX/pF7yJHGGVVPkf3d0=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=b3dClUjRPKSY+ptHN6K+sneAfi9eC+DOMAPHrDcBLSGA35NstZ8bByh0I5xw1f2aKajWj7y6tn9yq53XhYBK+MJvvhabfeOLSnAny6ynGNyERPGKQmYD1BrS9oCyhbIs2izWHt/ztiKOrKtCfO2SLqEdl/YcF9CMFm4WqTrkX4g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.78 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f78.google.com with SMTP id 006d021491bc7-68e7e213adfso920861eaf.0 for ; Fri, 17 Apr 2026 03:38:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776422280; x=1777027080; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=BPo5/OOCVdER5jw9I98TMIq3VPseXyIcksLQgs7td1c=; b=sudBRMIopS2W/WI7FVZJ+Xgw3FMTENHWkc3xx2oGYMVmTXZxV8xBWgUQCv7kYkETgH YSn0IFWb0al519MUu+30SWtKXeIAAja9lQkmeCGB1Ye1wgmlKB9xP90Ah2Hj5wQTaIt7 5zKazmENwL8d7rVRvXyxxBGAAz/E2DpCzm3NKFE7uKedX9r8+DuI/Zo6IgsYqqHC6OIT gPzckzO+T4AoSrkp+UzTdR2Um4l749iSrC/atppVz2dodqPgbfpKU24oR/iDNexRy8Eo 0i1HIQ+CVUd41s7Pfau2+nS0EyXCSOkqDTgc6mhtnGS/AoCgEDewLyKmehWwdb4N29k7 fmbg== X-Gm-Message-State: AOJu0Ywji2LJmz/z4BxcWw29RmNHERa0Sg/1M9c05hDie5G+e4OXucjI Kx7svAz0DiX4wVwUJwAskZQ+EIHYg5xAceAMcmPqxfy2wTaGX8u5Ywj8AOSUZFqzQGasxfL2rUB hRcHMBPFtPVkUdBxU5g4beOwV2XkEBY8OPDCWrMO1KbLuSOvszwx//vXfes3v5Q== Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:220a:b0:692:65c1:f900 with SMTP id 006d021491bc7-69462eb9901mr1258508eaf.32.1776422280021; Fri, 17 Apr 2026 03:38:00 -0700 (PDT) Date: Fri, 17 Apr 2026 03:38:00 -0700 In-Reply-To: <69d7f03b.050a0220.3030df.001b.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69e20d88.a00a0220.1cdc.0014.GAE@google.com> Subject: Forwarded: Re: [syzbot] [fuse?] BUG: scheduling while atomic in __synchronize_srcu From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Re: [syzbot] [fuse?] BUG: scheduling while atomic in __synchronize= _srcu Author: maz@kernel.org On Thu, 09 Apr 2026 19:30:19 +0100, syzbot wrote: >=20 > Hello, >=20 > syzbot found the following issue on: >=20 > HEAD commit: 7f87a5ea75f0 Merge tag 'hid-for-linus-2026040801' of git:= /.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=3D12439316580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=3D2d08886358f27= e8c > dashboard link: https://syzkaller.appspot.com/bug?extid=3D12b178b7c756664= d2518 > compiler: aarch64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (= GNU Binutils for Debian) 2.44 > userspace arch: arm64 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=3D1461aeba580= 000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=3D14c85e06580000 >=20 > Downloadable assets: > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/f= a3fbcfdac58/non_bootable_disk-7f87a5ea.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/28f02ff1720d/vmlinu= x-7f87a5ea.xz > kernel image: https://storage.googleapis.com/syzbot-assets/7d30b9e8505e/I= mage-7f87a5ea.gz.xz >=20 > IMPORTANT: if you fix the issue, please add the following tag to the comm= it: > Reported-by: syzbot+12b178b7c756664d2518@syzkaller.appspotmail.com >=20 > BUG: scheduling while atomic: syz.1.49/3699/0x00000002 > Modules linked in: > CPU: 1 UID: 0 PID: 3699 Comm: syz.1.49 Not tainted syzkaller #0 PREEMPT=20 > Hardware name: linux,dummy-virt (DT) > Call trace: > dump_backtrace arch/arm64/kernel/stacktrace.c:498 [inline] (C) > show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C) > __dump_stack lib/dump_stack.c:94 [inline] > dump_stack_lvl+0x60/0x80 lib/dump_stack.c:120 > dump_stack+0x18/0x24 lib/dump_stack.c:129 > __schedule_bug+0x54/0x78 kernel/sched/core.c:5847 > schedule_debug kernel/sched/core.c:5874 [inline] > __schedule+0x858/0xd84 kernel/sched/core.c:6786 > __schedule_loop kernel/sched/core.c:6993 [inline] > schedule+0x34/0x114 kernel/sched/core.c:7008 > schedule_timeout+0xd4/0x110 kernel/time/sleep_timeout.c:75 > do_wait_for_common kernel/sched/completion.c:100 [inline] > __wait_for_common kernel/sched/completion.c:121 [inline] > wait_for_common kernel/sched/completion.c:132 [inline] > wait_for_completion+0x78/0x160 kernel/sched/completion.c:153 > __synchronize_srcu+0x90/0xd0 kernel/rcu/srcutree.c:1496 > synchronize_srcu_expedited+0x24/0x40 kernel/rcu/srcutree.c:1521 > kvm_set_irq_routing+0x204/0x294 virt/kvm/irqchip.c:225 > kvm_vgic_setup_default_irq_routing+0x78/0xc0 arch/arm64/kvm/vgic/vgic-ir= qfd.c:153 > vgic_init+0x1ac/0x268 arch/arm64/kvm/vgic/vgic-init.c:421 > vgic_lazy_init+0x54/0x6c arch/arm64/kvm/vgic/vgic-init.c:550 > kvm_vgic_inject_irq+0x30/0x12c arch/arm64/kvm/vgic/vgic.c:520 > kvm_timer_update_irq+0x68/0x7c arch/arm64/kvm/arch_timer.c:450 > kvm_timer_vcpu_reset+0xd8/0x1e0 arch/arm64/kvm/arch_timer.c:1036 > kvm_reset_vcpu+0x194/0x360 arch/arm64/kvm/reset.c:268 > kvm_vcpu_set_target arch/arm64/kvm/arm.c:1632 [inline] > kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1652 [inline] > kvm_arch_vcpu_ioctl+0x2e4/0x8c8 arch/arm64/kvm/arm.c:1773 > kvm_vcpu_ioctl+0x4ac/0x8f4 virt/kvm/kvm_main.c:4653 > vfs_ioctl fs/ioctl.c:51 [inline] > __do_sys_ioctl fs/ioctl.c:597 [inline] > __se_sys_ioctl fs/ioctl.c:583 [inline] > __arm64_sys_ioctl+0xac/0x104 fs/ioctl.c:583 > __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] > invoke_syscall+0x48/0x104 arch/arm64/kernel/syscall.c:49 > el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 > do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 > el0_svc+0x34/0x124 arch/arm64/kernel/entry-common.c:724 > el0t_64_sync_handler+0xa0/0xf0 arch/arm64/kernel/entry-common.c:743 > el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596 > BUG: scheduling while atomic: syz.1.49/3699/0x00000000 > Modules linked in: > CPU: 1 UID: 0 PID: 3699 Comm: syz.1.49 Tainted: G W syzk= aller #0 PREEMPT=20 > Tainted: [W]=3DWARN > Hardware name: linux,dummy-virt (DT) > Call trace: > dump_backtrace arch/arm64/kernel/stacktrace.c:498 [inline] (C) > show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C) > __dump_stack lib/dump_stack.c:94 [inline] > dump_stack_lvl+0x60/0x80 lib/dump_stack.c:120 > dump_stack+0x18/0x24 lib/dump_stack.c:129 > __schedule_bug+0x54/0x78 kernel/sched/core.c:5847 > schedule_debug kernel/sched/core.c:5874 [inline] > __schedule+0x858/0xd84 kernel/sched/core.c:6786 > __schedule_loop kernel/sched/core.c:6993 [inline] > schedule+0x34/0x114 kernel/sched/core.c:7008 > futex_do_wait kernel/futex/waitwake.c:358 [inline] > __futex_wait+0xf0/0x178 kernel/futex/waitwake.c:687 > futex_wait+0x88/0x118 kernel/futex/waitwake.c:715 > do_futex+0xf8/0x1a0 kernel/futex/syscalls.c:130 > __do_sys_futex kernel/futex/syscalls.c:207 [inline] > __se_sys_futex kernel/futex/syscalls.c:188 [inline] > __arm64_sys_futex+0xfc/0x1a0 kernel/futex/syscalls.c:188 > __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] > invoke_syscall+0x48/0x104 arch/arm64/kernel/syscall.c:49 > el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 > do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 > el0_svc+0x34/0x124 arch/arm64/kernel/entry-common.c:724 > el0t_64_sync_handler+0xa0/0xf0 arch/arm64/kernel/entry-common.c:743 > el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596 > psi: inconsistent task state! task=3D30:pr/ttyAMA-1 cpu=3D1 psi_flags=3D1= 4 clear=3D0 set=3D10 #syz set subsystems: kvmarm #syz test From 45b43b17820bb17f4bc44a5ba198939a18c8e0bb Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Fri, 17 Apr 2026 11:33:23 +0100 Subject: [PATCH] test Signed-off-by: Marc Zyngier --- arch/arm64/kvm/arch_timer.c | 44 ++++++++++++++++++------------------ arch/arm64/kvm/arm.c | 7 ++++++ arch/arm64/kvm/vgic/vgic.c | 6 ++--- include/kvm/arm_arch_timer.h | 5 ---- 4 files changed, 31 insertions(+), 31 deletions(-) diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c index 600f250753b45..930a04928df4c 100644 --- a/arch/arm64/kvm/arch_timer.c +++ b/arch/arm64/kvm/arch_timer.c @@ -42,7 +42,7 @@ static const u8 default_ppi[] =3D { static bool kvm_timer_irq_can_fire(struct arch_timer_context *timer_ctx); static void kvm_timer_update_irq(struct kvm_vcpu *vcpu, bool new_level, struct arch_timer_context *timer_ctx); -static bool kvm_timer_should_fire(struct arch_timer_context *timer_ctx); +static bool kvm_timer_pending(struct arch_timer_context *timer_ctx); static void kvm_arm_timer_write(struct kvm_vcpu *vcpu, struct arch_timer_context *timer, enum kvm_arch_timer_regs treg, @@ -218,7 +218,7 @@ static irqreturn_t kvm_arch_timer_handler(int irq, void= *dev_id) else ctx =3D map.direct_ptimer; =20 - if (kvm_timer_should_fire(ctx)) + if (kvm_timer_pending(ctx)) kvm_timer_update_irq(vcpu, true, ctx); =20 if (userspace_irqchip(vcpu->kvm) && @@ -352,7 +352,7 @@ static enum hrtimer_restart kvm_hrtimer_expire(struct h= rtimer *hrt) return HRTIMER_NORESTART; } =20 -static bool kvm_timer_should_fire(struct arch_timer_context *timer_ctx) +static bool kvm_timer_pending(struct arch_timer_context *timer_ctx) { enum kvm_arch_timers index; u64 cval, now; @@ -411,9 +411,9 @@ void kvm_timer_update_run(struct kvm_vcpu *vcpu) /* Populate the device bitmap with the timer states */ regs->device_irq_level &=3D ~(KVM_ARM_DEV_EL1_VTIMER | KVM_ARM_DEV_EL1_PTIMER); - if (kvm_timer_should_fire(vtimer)) + if (kvm_timer_pending(vtimer)) regs->device_irq_level |=3D KVM_ARM_DEV_EL1_VTIMER; - if (kvm_timer_should_fire(ptimer)) + if (kvm_timer_pending(ptimer)) regs->device_irq_level |=3D KVM_ARM_DEV_EL1_PTIMER; } =20 @@ -440,37 +440,35 @@ static void kvm_timer_update_irq(struct kvm_vcpu *vcp= u, bool new_level, { kvm_timer_update_status(timer_ctx, new_level); =20 - timer_ctx->irq.level =3D new_level; trace_kvm_timer_update_irq(vcpu->vcpu_id, timer_irq(timer_ctx), - timer_ctx->irq.level); + new_level); =20 if (userspace_irqchip(vcpu->kvm)) return; =20 kvm_vgic_inject_irq(vcpu->kvm, vcpu, timer_irq(timer_ctx), - timer_ctx->irq.level, + new_level, timer_ctx); } =20 /* Only called for a fully emulated timer */ static void timer_emulate(struct arch_timer_context *ctx) { - bool should_fire =3D kvm_timer_should_fire(ctx); + bool pending =3D kvm_timer_pending(ctx); =20 - trace_kvm_timer_emulate(ctx, should_fire); + trace_kvm_timer_emulate(ctx, pending); =20 - if (should_fire !=3D ctx->irq.level) - kvm_timer_update_irq(timer_context_to_vcpu(ctx), should_fire, ctx); + kvm_timer_update_irq(timer_context_to_vcpu(ctx), pending, ctx); =20 - kvm_timer_update_status(ctx, should_fire); + kvm_timer_update_status(ctx, pending); =20 /* * If the timer can fire now, we don't need to have a soft timer * scheduled for the future. If the timer cannot fire at all, * then we also don't need a soft timer. */ - if (should_fire || !kvm_timer_irq_can_fire(ctx)) + if (pending || !kvm_timer_irq_can_fire(ctx)) return; =20 soft_timer_start(&ctx->hrtimer, kvm_timer_compute_delta(ctx)); @@ -660,6 +658,7 @@ static inline void set_timer_irq_phys_active(struct arc= h_timer_context *ctx, boo static void kvm_timer_vcpu_load_gic(struct arch_timer_context *ctx) { struct kvm_vcpu *vcpu =3D timer_context_to_vcpu(ctx); + bool pending =3D kvm_timer_pending(ctx); bool phys_active =3D false; =20 /* @@ -668,12 +667,12 @@ static void kvm_timer_vcpu_load_gic(struct arch_timer= _context *ctx) * this point and the register restoration, we'll take the * interrupt anyway. */ - kvm_timer_update_irq(vcpu, kvm_timer_should_fire(ctx), ctx); + kvm_timer_update_irq(vcpu, pending, ctx); =20 if (irqchip_in_kernel(vcpu->kvm)) phys_active =3D kvm_vgic_map_is_active(vcpu, timer_irq(ctx)); =20 - phys_active |=3D ctx->irq.level; + phys_active |=3D pending; =20 set_timer_irq_phys_active(ctx, phys_active); } @@ -681,6 +680,7 @@ static void kvm_timer_vcpu_load_gic(struct arch_timer_c= ontext *ctx) static void kvm_timer_vcpu_load_nogic(struct kvm_vcpu *vcpu) { struct arch_timer_context *vtimer =3D vcpu_vtimer(vcpu); + bool pending =3D kvm_timer_pending(vtimer); =20 /* * Update the timer output so that it is likely to match the @@ -688,7 +688,7 @@ static void kvm_timer_vcpu_load_nogic(struct kvm_vcpu *= vcpu) * this point and the register restoration, we'll take the * interrupt anyway. */ - kvm_timer_update_irq(vcpu, kvm_timer_should_fire(vtimer), vtimer); + kvm_timer_update_irq(vcpu, pending, vtimer); =20 /* * When using a userspace irqchip with the architected timers and a @@ -700,7 +700,7 @@ static void kvm_timer_vcpu_load_nogic(struct kvm_vcpu *= vcpu) * being de-asserted, we unmask the interrupt again so that we exit * from the guest when the timer fires. */ - if (vtimer->irq.level) + if (pending) disable_percpu_irq(host_vtimer_irq); else enable_percpu_irq(host_vtimer_irq, host_vtimer_irq_flags); @@ -900,8 +900,8 @@ bool kvm_timer_should_notify_user(struct kvm_vcpu *vcpu) vlevel =3D sregs->device_irq_level & KVM_ARM_DEV_EL1_VTIMER; plevel =3D sregs->device_irq_level & KVM_ARM_DEV_EL1_PTIMER; =20 - return kvm_timer_should_fire(vtimer) !=3D vlevel || - kvm_timer_should_fire(ptimer) !=3D plevel; + return kvm_timer_pending(vtimer) !=3D vlevel || + kvm_timer_pending(ptimer) !=3D plevel; } =20 void kvm_timer_vcpu_put(struct kvm_vcpu *vcpu) @@ -983,7 +983,7 @@ static void unmask_vtimer_irq_user(struct kvm_vcpu *vcp= u) { struct arch_timer_context *vtimer =3D vcpu_vtimer(vcpu); =20 - if (!kvm_timer_should_fire(vtimer)) { + if (!kvm_timer_pending(vtimer)) { kvm_timer_update_irq(vcpu, false, vtimer); if (static_branch_likely(&has_gic_active_state)) set_timer_irq_phys_active(vtimer, false); @@ -1530,7 +1530,7 @@ static bool kvm_arch_timer_get_input_level(int vintid) =20 ctx =3D vcpu_get_timer(vcpu, i); if (timer_irq(ctx) =3D=3D vintid) - return kvm_timer_should_fire(ctx); + return kvm_timer_pending(ctx); } =20 /* A timer IRQ has fired, but no matching timer was found? */ diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 410ffd41fd73a..2faa6d1dd01fa 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -46,6 +46,7 @@ #include #include =20 +#include "vgic/vgic.h" #include "sys_regs.h" =20 static enum kvm_mode kvm_mode =3D KVM_MODE_DEFAULT; @@ -1451,6 +1452,12 @@ int kvm_vm_ioctl_irq_line(struct kvm *kvm, struct kv= m_irq_level *irq_level, =20 trace_kvm_irq_line(irq_type, vcpu_id, irq_num, irq_level->level); =20 + if (irqchip_in_kernel(kvm)) { + int ret =3D vgic_lazy_init(kvm); + if (ret) + return ret; + } + switch (irq_type) { case KVM_ARM_IRQ_TYPE_CPU: if (irqchip_in_kernel(kvm)) diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c index e22b79cfff965..9acf44124ac89 100644 --- a/arch/arm64/kvm/vgic/vgic.c +++ b/arch/arm64/kvm/vgic/vgic.c @@ -515,11 +515,9 @@ int kvm_vgic_inject_irq(struct kvm *kvm, struct kvm_vc= pu *vcpu, { struct vgic_irq *irq; unsigned long flags; - int ret; =20 - ret =3D vgic_lazy_init(kvm); - if (ret) - return ret; + if (unlikely(!vgic_initialized(kvm))) + return 0; =20 if (!vcpu && intid < VGIC_NR_PRIVATE_IRQS) return -EINVAL; diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h index 7310841f45121..49c083c649425 100644 --- a/include/kvm/arm_arch_timer.h +++ b/include/kvm/arm_arch_timer.h @@ -64,11 +64,6 @@ struct arch_timer_context { */ bool loaded; =20 - /* Output level of the timer IRQ */ - struct { - bool level; - } irq; - /* Who am I? */ enum kvm_arch_timers timer_id; =20 --=20 2.47.3 --=20 Without deviation from the norm, progress is not possible.