From: Sean Christopherson <seanjc@google.com>
To: syzbot <syzbot+ab6273c58262b9de56d9@syzkaller.appspotmail.com>
Cc: david@kernel.org, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, pbonzini@redhat.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [kvm?] INFO: task hung in kvm_gmem_release (2)
Date: Fri, 11 Sep 2026 16:02:40 -0700 [thread overview]
Message-ID: <aqSIkEt-GqCIJh9w@google.com> (raw)
In-Reply-To: <6aa42297.f2639fcc.29487d.002f.GAE@google.com>
On Fri, Sep 11, 2026, syzbot wrote:
> syzbot found the following issue on:
>
> HEAD commit: 50d05c7c76c9 Merge tag 'landlock-7.3-rc3' of git://git.ker..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13db5ef9580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e
> dashboard link: https://syzkaller.appspot.com/bug?extid=ab6273c58262b9de56d9
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> userspace arch: i386
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143121f9580000
The reproducer is "only" setting memory attributes on a 16MiB range. I was
expecting a much, much larger range. I suspect this one may be due to a problem
with the underlying GCE host? Though it did spit out a reproducer...
> CPU: 1 UID: 0 PID: 6083 Comm: syz.4.24 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> RIP: 0010:__this_cpu_preempt_check+0x0/0x20 lib/smp_processor_id.c:63
> Code: f5 48 8b 74 24 20 48 c7 c7 00 9b 6d 8c e8 88 ac 42 f5 e8 23 ab 4d f5 eb ae 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 89 fe 48 c7 c7 80 9a 6d 8c e9 0d ff ff ff cc cc cc
> RSP: 0018:ffffc90003d27460 EFLAGS: 00000046
> RAX: 0000000000000001 RBX: 0000000000000001 RCX: 8000000000000001
> RDX: 0000000000000000 RSI: ffff88807ea4a3d0 RDI: ffffffff8e6fe7fc
> RBP: 00000000ffffffff R08: ffffc90003d2755f R09: 0000000000000000
> R10: ffffc90003d27548 R11: fffff520007a4eac R12: 0000000000000246
> R13: ffff8880314c5dc0 R14: ffff88807ea4a3d0 R15: 0000000000000001
> FS: 0000000000000000(0000) GS:ffff888124dd2000(0063) knlGS:00000000f6834b40
> CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
> CR2: 00000000f71e8c10 CR3: 0000000073d5a000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline]
> lock_is_held_type+0xdf/0x150 kernel/locking/lockdep.c:6017
> lock_is_held include/linux/lockdep.h:249 [inline]
> xa_entry include/linux/xarray.h:1227 [inline]
> xas_descend lib/xarray.c:208 [inline]
> xas_load+0x198/0x5a0 lib/xarray.c:246
> __xa_cmpxchg_raw lib/xarray.c:1783 [inline]
> __xa_cmpxchg+0xc3/0x1f0 lib/xarray.c:1769
> xa_cmpxchg include/linux/xarray.h:699 [inline]
> xa_reserve include/linux/xarray.h:1088 [inline]
> kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2577 [inline]
> kvm_vm_ioctl_set_mem_attributes+0x429/0x1600 virt/kvm/kvm_main.c:2625
> kvm_vm_ioctl+0xb33/0xd30 virt/kvm/kvm_main.c:5356
> kvm_vm_compat_ioctl+0x2b1/0x3a0 virt/kvm/kvm_main.c:5480
> __do_compat_sys_ioctl fs/ioctl.c:695 [inline]
> __se_compat_sys_ioctl fs/ioctl.c:638 [inline]
> __ia32_compat_sys_ioctl+0x5ea/0x950 fs/ioctl.c:638
> do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
> __do_fast_syscall_32+0x27a/0x6a0 arch/x86/entry/syscall_32.c:291
> do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
> entry_SYSENTER_compat_after_hwframe+0x84/0x8e
> RIP: 0023:0xf705f0ec
> Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8
> RSP: 002b:00000000f683450c EFLAGS: 00000206 ORIG_RAX: 0000000000000036
> RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000004020aed2
> RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
prev parent reply other threads:[~2026-09-11 23:02 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-11 15:47 [syzbot] [kvm?] INFO: task hung in kvm_gmem_release (2) syzbot
2026-09-11 23:02 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aqSIkEt-GqCIJh9w@google.com \
--to=seanjc@google.com \
--cc=david@kernel.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=syzbot+ab6273c58262b9de56d9@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.