[syzbot] [kernel?] WARNING in gic_handle_irq

[syzbot] [kernel?] WARNING in gic_handle_irq

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    21d6ac051080 Merge branch 'for-next/core' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=12f93e79580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d1128bc53f2ef7f3
dashboard link: https://syzkaller.appspot.com/bug?extid=1e7fd72b380dc57b82b8
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/88380e2ddcb9/disk-21d6ac05.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5dba5c2896b7/vmlinux-21d6ac05.xz
kernel image: https://storage.googleapis.com/syzbot-assets/52ac739e37e0/Image-21d6ac05.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1e7fd72b380dc57b82b8@syzkaller.appspotmail.com

------------[ cut here ]------------
Unexpected interrupt (irqnr 8194)
WARNING: drivers/irqchip/irq-gic-v3.c:826 at __gic_handle_irq drivers/irqchip/irq-gic-v3.c:826 [inline], CPU#0: syz.7.608/7953
WARNING: drivers/irqchip/irq-gic-v3.c:826 at __gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline], CPU#0: syz.7.608/7953
WARNING: drivers/irqchip/irq-gic-v3.c:826 at gic_handle_irq+0xf8/0x180 drivers/irqchip/irq-gic-v3.c:917, CPU#0: syz.7.608/7953
Modules linked in:
CPU: 0 UID: 0 PID: 7953 Comm: syz.7.608 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __gic_handle_irq drivers/irqchip/irq-gic-v3.c:826 [inline]
pc : __gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
pc : gic_handle_irq+0xf8/0x180 drivers/irqchip/irq-gic-v3.c:917
lr : __gic_handle_irq drivers/irqchip/irq-gic-v3.c:826 [inline]
lr : __gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
lr : gic_handle_irq+0xf8/0x180 drivers/irqchip/irq-gic-v3.c:917
sp : ffff80008eb67fd0
x29: ffff80008eb67fd0 x28: ffff0000c2f78000 x27: dfff800000000000
x26: 0000000000000001 x25: 0000000000000000 x24: ffff800088af6598
x23: dfff800000000000 x22: ffff0000c2f78020 x21: ffff80008a19c000
x20: 0000000000002002 x19: 0000000000002002 x18: 1fffe00034bb7428
x17: ffff80011d2d8000 x16: ffff80008eb60000 x15: 0000000000000000
x14: 0000000000000001 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000010005 x9 : 73714fb681136800
x8 : 73714fb681136800 x7 : ffff80008048c5b8 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff8000802f6830
x2 : 0000000100010003 x1 : ffff0000c2f78000 x0 : 0000000000000000
Call trace:
 __gic_handle_irq drivers/irqchip/irq-gic-v3.c:826 [inline] (P)
 __gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline] (P)
 gic_handle_irq+0xf8/0x180 drivers/irqchip/irq-gic-v3.c:917 (P)
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885
 do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:178
 __el1_irq arch/arm64/kernel/entry-common.c:530 [inline]
 el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:543
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:548
 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:586
 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline] (P)
 _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:198 (P)
 spin_unlock_irqrestore include/linux/spinlock.h:408 [inline]
 rmqueue_bulk mm/page_alloc.c:2555 [inline]
 __rmqueue_pcplist+0x1008/0x1630 mm/page_alloc.c:3341
 alloc_pages_bulk_noprof+0x42c/0x730 mm/page_alloc.c:5204
 ___alloc_pages_bulk mm/kasan/shadow.c:345 [inline]
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:370 [inline]
 __kasan_populate_vmalloc+0xc0/0x1d0 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
 alloc_vmap_area+0xdf4/0x13e8 mm/vmalloc.c:2145
 __get_vm_area_node+0x210/0x32c mm/vmalloc.c:3248
 get_vm_area+0x9c/0xd0 mm/vmalloc.c:3290
 arena_map_alloc+0x200/0x668 kernel/bpf/arena.c:292
 map_create_alloc kernel/bpf/syscall.c:1523 [inline]
 map_create+0xa64/0x156c kernel/bpf/syscall.c:1640
 __sys_bpf+0x308/0x82c kernel/bpf/syscall.c:6395
 __do_sys_bpf kernel/bpf/syscall.c:6537 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6534 [inline]
 __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6534
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
irq event stamp: 15940
hardirqs last  enabled at (15939): [<ffff800086930818>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline]
hardirqs last  enabled at (15939): [<ffff800086930818>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:198
hardirqs last disabled at (15940): [<ffff80008690b4b4>] __el1_irq arch/arm64/kernel/entry-common.c:527 [inline]
hardirqs last disabled at (15940): [<ffff80008690b4b4>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:543
softirqs last  enabled at (15930): [<ffff80008030e6e4>] softirq_handle_end kernel/softirq.c:468 [inline]
softirqs last  enabled at (15930): [<ffff80008030e6e4>] handle_softirqs+0xc28/0xd98 kernel/softirq.c:650
softirqs last disabled at (15925): [<ffff8000800204c0>] __do_softirq+0x14/0x20 kernel/softirq.c:656
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [kernel?] WARNING in gic_handle_irq

[Marc Zyngier]

On Tue, 25 Aug 2026 20:14:33 +0100,
syzbot <syzbot+1e7fd72b380dc57b82b8@syzkaller.appspotmail.com> wrote:
> 
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    21d6ac051080 Merge branch 'for-next/core' into for-kernelci
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=12f93e79580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d1128bc53f2ef7f3
> dashboard link: https://syzkaller.appspot.com/bug?extid=1e7fd72b380dc57b82b8
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> userspace arch: arm64
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/88380e2ddcb9/disk-21d6ac05.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/5dba5c2896b7/vmlinux-21d6ac05.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/52ac739e37e0/Image-21d6ac05.gz.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+1e7fd72b380dc57b82b8@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> Unexpected interrupt (irqnr 8194)

This appears to be triggered by an LPI (most probably an MSI) firing,
but by the time we handle it, there is nothing to left handle it in
the corresponding irq domain.

The console log contains the following bits:

[   73.897524][ T1057] nvme nvme0: Identify namespace failed (-5)
[   73.906396][   T39] nvme nvme0: 2/0/0 default/read/poll queues
[   73.907149][ T7866] nvme nvme0: resetting controller
[   73.923113][  T866] usb 1-1: new high-speed USB device number 5 using dummy_hcd
[   73.943439][  T866] usb 1-1: device descriptor read/8, error -71
[   73.986096][    C0] ------------[ cut here ]------------
[   73.986109][    C0] Unexpected interrupt (irqnr 8194)

which indicates that some stuff is being reset/failing close to that
time. With the right timing (made easier with virtualisation), it
isn't impossible to think that the interrupt has already reached the
handling CPU while another CPU tears it down.

Not sure there is anything to do here other than tone down the
warning.

	M.

-- 
Jazz isn't dead. It just smells funny.