* Re: [syzbot] [mm?] BUG: sleeping function called from invalid context in kvm_mmu_notifier_invalidate_range_start
2025-12-08 7:41 [syzbot] [mm?] BUG: sleeping function called from invalid context in kvm_mmu_notifier_invalidate_range_start syzbot
@ 2026-05-04 17:54 ` syzbot
2026-05-06 13:57 ` Sean Christopherson
2026-08-21 12:09 ` Forwarded: " syzbot
1 sibling, 1 reply; 4+ messages in thread
From: syzbot @ 2026-05-04 17:54 UTC (permalink / raw)
To: akpm, dwmw, kvm, liam.howlett, linux-kernel, linux-mm,
linux-rt-devel, lkp, llvm, lorenzo.stoakes, me, mhocko,
oe-kbuild-all, pbonzini, rientjes, rppt, seanjc, shaikhkamal2012,
shakeel.butt, skhan, surenb, syzkaller-bugs, vbabka
syzbot has found a reproducer for the following issue on:
HEAD commit: b9303e6bff70 Add linux-next specific files for 20260430
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13745dba580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5474e13c6d20d45c
dashboard link: https://syzkaller.appspot.com/bug?extid=c3178b6b512446632bac
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=125dd748580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b3a0a2e50f73/disk-b9303e6b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d3d481b220d4/vmlinux-b9303e6b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d6e012913960/bzImage-b9303e6b.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c3178b6b512446632bac@syzkaller.appspotmail.com
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 0, irqs_disabled(): 0, non_block: 1, pid: 40, name: oom_reaper
preempt_count: 0, expected: 0
RCU nest depth: 0, expected: 0
4 locks held by oom_reaper/40:
#0: ffff8880335ed1b0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:611 [inline]
#0: ffff8880335ed1b0 (&mm->mmap_lock){++++}-{4:4}, at: oom_reap_task_mm mm/oom_kill.c:566 [inline]
#0: ffff8880335ed1b0 (&mm->mmap_lock){++++}-{4:4}, at: oom_reap_task mm/oom_kill.c:609 [inline]
#0: ffff8880335ed1b0 (&mm->mmap_lock){++++}-{4:4}, at: oom_reaper+0x2bb/0xc10 mm/oom_kill.c:650
#1: ffffffff8e3066c0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: mmu_notifier_invalidate_range_start_nonblock include/linux/mmu_notifier.h:495 [inline]
#1: ffffffff8e3066c0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: zap_vma_for_reaping+0x193/0x380 mm/memory.c:2119
#2: ffffffff8e306718 (srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#2: ffffffff8e306718 (srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#2: ffffffff8e306718 (srcu){.+.+}-{0:0}, at: mn_hlist_invalidate_range_start mm/mmu_notifier.c:515 [inline]
#2: ffffffff8e306718 (srcu){.+.+}-{0:0}, at: __mmu_notifier_invalidate_range_start+0x5a1/0xb60 mm/mmu_notifier.c:580
#3: ffff88803996caf8 (&kvm->mn_invalidate_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88803996caf8 (&kvm->mn_invalidate_lock){+.+.}-{3:3}, at: kvm_mmu_notifier_invalidate_range_start+0x1b7/0xc00 virt/kvm/kvm_main.c:744
CPU: 0 UID: 0 PID: 40 Comm: oom_reaper Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
__might_resched+0x329/0x480 kernel/sched/core.c:9163
__rt_spin_lock kernel/locking/spinlock_rt.c:48 [inline]
rt_spin_lock+0xc2/0x400 kernel/locking/spinlock_rt.c:57
spin_lock include/linux/spinlock_rt.h:45 [inline]
kvm_mmu_notifier_invalidate_range_start+0x1b7/0xc00 virt/kvm/kvm_main.c:744
mn_hlist_invalidate_range_start mm/mmu_notifier.c:525 [inline]
__mmu_notifier_invalidate_range_start+0x6e4/0xb60 mm/mmu_notifier.c:580
mmu_notifier_invalidate_range_start_nonblock include/linux/mmu_notifier.h:498 [inline]
zap_vma_for_reaping+0x1f7/0x380 mm/memory.c:2119
__oom_reap_task_mm mm/oom_kill.c:548 [inline]
oom_reap_task_mm mm/oom_kill.c:585 [inline]
oom_reap_task mm/oom_kill.c:609 [inline]
oom_reaper+0x51e/0xc10 mm/oom_kill.c:650
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 0, irqs_disabled(): 0, non_block: 1, pid: 40, name: oom_reaper
preempt_count: 0, expected: 0
RCU nest depth: 0, expected: 0
4 locks held by oom_reaper/40:
#0: ffff8880335ed1b0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:611 [inline]
#0: ffff8880335ed1b0 (&mm->mmap_lock){++++}-{4:4}, at: oom_reap_task_mm mm/oom_kill.c:566 [inline]
#0: ffff8880335ed1b0 (&mm->mmap_lock){++++}-{4:4}, at: oom_reap_task mm/oom_kill.c:609 [inline]
#0: ffff8880335ed1b0 (&mm->mmap_lock){++++}-{4:4}, at: oom_reaper+0x2bb/0xc10 mm/oom_kill.c:650
#1: ffffffff8e3066c0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: __mmu_notifier_invalidate_range_end+0x67/0x400 mm/mmu_notifier.c:611
#2: ffffffff8e306718 (srcu){.+.+}-{0:0}, at: __mmu_notifier_invalidate_range_end+0x67/0x400 mm/mmu_notifier.c:611
#3: ffff88803996caf8 (&kvm->mn_invalidate_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88803996caf8 (&kvm->mn_invalidate_lock){+.+.}-{3:3}, at: kvm_mmu_notifier_invalidate_range_end+0x1d6/0x3d0 virt/kvm/kvm_main.c:814
CPU: 0 UID: 0 PID: 40 Comm: oom_reaper Tainted: G W syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
__might_resched+0x329/0x480 kernel/sched/core.c:9163
__rt_spin_lock kernel/locking/spinlock_rt.c:48 [inline]
rt_spin_lock+0xc2/0x400 kernel/locking/spinlock_rt.c:57
spin_lock include/linux/spinlock_rt.h:45 [inline]
kvm_mmu_notifier_invalidate_range_end+0x1d6/0x3d0 virt/kvm/kvm_main.c:814
mn_hlist_invalidate_end mm/mmu_notifier.c:597 [inline]
__mmu_notifier_invalidate_range_end+0x23b/0x400 mm/mmu_notifier.c:616
mmu_notifier_invalidate_range_end include/linux/mmu_notifier.h:511 [inline]
zap_vma_for_reaping+0x2d9/0x380 mm/memory.c:2124
__oom_reap_task_mm mm/oom_kill.c:548 [inline]
oom_reap_task_mm mm/oom_kill.c:585 [inline]
oom_reap_task mm/oom_kill.c:609 [inline]
oom_reaper+0x51e/0xc10 mm/oom_kill.c:650
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
oom_reaper: reaped process 6034 (syz.0.24), now anon-rss:0kB, file-rss:64kB, shmem-rss:0kB
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 4+ messages in thread* Forwarded: Re: [syzbot] [mm?] BUG: sleeping function called from invalid context in kvm_mmu_notifier_invalidate_range_start
2025-12-08 7:41 [syzbot] [mm?] BUG: sleeping function called from invalid context in kvm_mmu_notifier_invalidate_range_start syzbot
2026-05-04 17:54 ` syzbot
@ 2026-08-21 12:09 ` syzbot
1 sibling, 0 replies; 4+ messages in thread
From: syzbot @ 2026-08-21 12:09 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [mm?] BUG: sleeping function called from invalid context in kvm_mmu_notifier_invalidate_range_start
Author: dwmw2@infradead.org
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Commit 312364f3534cc ("kernel.h: Add non_block_start/end()") added
non_block_star()/end(). The intention was to catch any callbacks which
depend on locks or sleep able conditionals in order to ensure forward
progress. According to the commit message spinlocks were excluded
"because spinlocks can't have an indirect dependency upon the page
allocator…".
On PREEMPT_RT this leads to a splat because spinlock_t and rwlock_t are
turned into a sleeping spinlock which have a might_sleep() as they could
schedule() on lock contention.
Besids mm, the other used of non_block_start() is pwm. Here the hrtimer
can acnqure a spinlock_t on RT and I can't tell other user but I assume
it is not atomic on RT since it wouldn't be able to acquire its own
(spinlock_t) lock.
Since spinlock_t (and rwlock_t) are not problem, add a sleeping_lock
argument to __might_resched() signaling if this is scheduling request
is from a sleeping lock (true) or regular scheduling request (false).
Add the `true' argument to rtlock_might_resched() which is used on
PREEMPT_RT for both sleeping lock types.
Cc: Michal Hocko <mhocko@suse.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Sean Young <sean@mess.org>
Cc: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
include/linux/kernel.h | 5 +++--
include/linux/sched.h | 24 ++++++++++++------------
kernel/locking/spinlock_rt.c | 2 +-
kernel/sched/core.c | 7 ++++---
4 files changed, 20 insertions(+), 18 deletions(-)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index e5570a16cbb1a..fbafdfe9bdb78 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -70,7 +70,8 @@ extern int dynamic_might_resched(void);
#endif /* CONFIG_PREEMPT_* */
#ifdef CONFIG_DEBUG_ATOMIC_SLEEP
-extern void __might_resched(const char *file, int line, unsigned int offsets);
+extern void __might_resched(const char *file, int line, unsigned int offsets,
+ bool rt_sleeping_lock);
extern void __might_sleep(const char *file, int line);
extern void __cant_sleep(const char *file, int line, int preempt_offset);
extern void __cant_migrate(const char *file, int line);
@@ -128,7 +129,7 @@ extern void __cant_migrate(const char *file, int line);
# define non_block_end() WARN_ON(current->non_block_count-- == 0)
#else
static inline void __might_resched(const char *file, int line,
- unsigned int offsets) { }
+ unsigned int offsets, bool rt_sleeping_lock) { }
static inline void __might_sleep(const char *file, int line) { }
# define might_sleep() do { might_resched(); } while (0)
# define cant_sleep() do { } while (0)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 373bcc0598d10..650e42d55e1e8 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -2158,9 +2158,9 @@ static inline int _cond_resched(void)
#endif /* !CONFIG_PREEMPTION || CONFIG_PREEMPT_DYNAMIC */
-#define cond_resched() ({ \
- __might_resched(__FILE__, __LINE__, 0); \
- _cond_resched(); \
+#define cond_resched() ({ \
+ __might_resched(__FILE__, __LINE__, 0, false); \
+ _cond_resched(); \
})
extern int __cond_resched_lock(spinlock_t *lock) __must_hold(lock);
@@ -2186,19 +2186,19 @@ extern int __cond_resched_rwlock_write(rwlock_t *lock) __must_hold(lock);
(PREEMPT_LOCK_OFFSET + (1U << MIGHT_RESCHED_RCU_SHIFT))
#endif
-#define cond_resched_lock(lock) ({ \
- __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS); \
- __cond_resched_lock(lock); \
+#define cond_resched_lock(lock) ({ \
+ __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS, false); \
+ __cond_resched_lock(lock); \
})
-#define cond_resched_rwlock_read(lock) ({ \
- __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS); \
- __cond_resched_rwlock_read(lock); \
+#define cond_resched_rwlock_read(lock) ({ \
+ __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS, false); \
+ __cond_resched_rwlock_read(lock); \
})
-#define cond_resched_rwlock_write(lock) ({ \
- __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS); \
- __cond_resched_rwlock_write(lock); \
+#define cond_resched_rwlock_write(lock) ({ \
+ __might_resched(__FILE__, __LINE__, PREEMPT_LOCK_RESCHED_OFFSETS, false); \
+ __cond_resched_rwlock_write(lock); \
})
#ifndef CONFIG_PREEMPT_RT
diff --git a/kernel/locking/spinlock_rt.c b/kernel/locking/spinlock_rt.c
index 1d5e1b3c60bfa..0a89e7f10af18 100644
--- a/kernel/locking/spinlock_rt.c
+++ b/kernel/locking/spinlock_rt.c
@@ -33,7 +33,7 @@
(rcu_preempt_depth() << MIGHT_RESCHED_RCU_SHIFT)
#define rtlock_might_resched() \
- __might_resched(__FILE__, __LINE__, RTLOCK_RESCHED_OFFSETS)
+ __might_resched(__FILE__, __LINE__, RTLOCK_RESCHED_OFFSETS, true)
static __always_inline void rtlock_lock(struct rt_mutex_base *rtm)
{
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 96226707c2f61..ee0fbb41fc61c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -9123,7 +9123,7 @@ void __might_sleep(const char *file, int line)
(void *)current->task_state_change,
(void *)current->task_state_change);
- __might_resched(file, line, 0);
+ __might_resched(file, line, 0, false);
}
EXPORT_SYMBOL(__might_sleep);
@@ -9148,7 +9148,8 @@ static inline bool resched_offsets_ok(unsigned int offsets)
return nested == offsets;
}
-void __might_resched(const char *file, int line, unsigned int offsets)
+void __might_resched(const char *file, int line, unsigned int offsets,
+ bool rt_sleeping_lock)
{
/* Ratelimiting timestamp: */
static unsigned long prev_jiffy;
@@ -9159,7 +9160,7 @@ void __might_resched(const char *file, int line, unsigned int offsets)
rcu_sleep_check();
if ((resched_offsets_ok(offsets) && !irqs_disabled() &&
- !is_idle_task(current) && !current->non_block_count) ||
+ !is_idle_task(current) && (rt_sleeping_lock || !current->non_block_count)) ||
system_state == SYSTEM_BOOTING || system_state > SYSTEM_RUNNING ||
oops_in_progress)
return;
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread