[v6.1] BUG: sleeping function called from invalid context in vhost_get_avail_idx

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c2fda4b3f577 Linux 6.1.156
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=136f267c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=68aa5a3af1cb953a
dashboard link: https://syzkaller.appspot.com/bug?extid=cd4342eb795aa5f4a0e4
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d8907607c809/disk-c2fda4b3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/005117d6d256/vmlinux-c2fda4b3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/56e478409d48/Image-c2fda4b3.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cd4342...@syzkaller.appspotmail.com

BUG: sleeping function called from invalid context at drivers/vhost/vhost.c:1014
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4809, name: vhost-4808
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
2 locks held by vhost-4808/4809:
#0: ffff0000f39e4c70 (&vq->mutex/1){+.+.}-{3:3}, at: handle_tx+0xc4/0x2464 drivers/vhost/net.c:978
#1: ffff0000f39e0218 (&vq->mutex){+.+.}-{3:3}, at: vhost_net_busy_poll+0x4c/0x49c drivers/vhost/net.c:540
Preemption disabled at:
[<ffff80000f3a0814>] vhost_net_busy_poll+0xc8/0x49c drivers/vhost/net.c:549
CPU: 0 PID: 4809 Comm: vhost-4808 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
__might_resched+0x350/0x4cc kernel/sched/core.c:9966
__might_sleep+0x94/0x110 kernel/sched/core.c:9895
__might_fault+0x7c/0x124 mm/memory.c:5850
vhost_get_avail_idx+0x100/0x278 drivers/vhost/vhost.c:1014
vhost_vq_avail_empty+0x98/0x1d8 drivers/vhost/vhost.c:2526
vhost_net_busy_poll+0x254/0x49c drivers/vhost/net.c:560
vhost_net_tx_get_vq_desc drivers/vhost/net.c:595 [inline]
get_tx_bufs+0x120/0x5fc drivers/vhost/net.c:634
handle_tx_copy drivers/vhost/net.c:797 [inline]
handle_tx+0x2ec/0x2464 drivers/vhost/net.c:992
handle_tx_net+0x24/0x34 drivers/vhost/net.c:1287
vhost_worker+0x1f4/0x35c drivers/vhost/vhost.c:364
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c2fda4b3f577 Linux 6.1.156
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=167b8b04580000

kernel config: https://syzkaller.appspot.com/x/.config?x=68aa5a3af1cb953a
dashboard link: https://syzkaller.appspot.com/bug?extid=cd4342eb795aa5f4a0e4
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=126f45e2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1085fb34580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d8907607c809/disk-c2fda4b3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/005117d6d256/vmlinux-c2fda4b3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/56e478409d48/Image-c2fda4b3.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cd4342...@syzkaller.appspotmail.com

BUG: sleeping function called from invalid context at drivers/vhost/vhost.c:1014

in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4469, name: vhost-4468

preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0

2 locks held by vhost-4468/4469:
#0: ffff0000ca104c70 (&vq->mutex/1){+.+.}-{3:3}, at: handle_tx+0xc4/0x2464 drivers/vhost/net.c:978
#1: ffff0000ca100218 (&vq->mutex){+.+.}-{3:3}, at: vhost_net_busy_poll+0x4c/0x49c drivers/vhost/net.c:540

Preemption disabled at:
[<ffff80000f3a0814>] vhost_net_busy_poll+0xc8/0x49c drivers/vhost/net.c:549

CPU: 0 PID: 4469 Comm: vhost-4468 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
__might_resched+0x350/0x4cc kernel/sched/core.c:9966
__might_sleep+0x94/0x110 kernel/sched/core.c:9895
__might_fault+0x7c/0x124 mm/memory.c:5850
vhost_get_avail_idx+0x100/0x278 drivers/vhost/vhost.c:1014
vhost_vq_avail_empty+0x98/0x1d8 drivers/vhost/vhost.c:2526
vhost_net_busy_poll+0x254/0x49c drivers/vhost/net.c:560
vhost_net_tx_get_vq_desc drivers/vhost/net.c:595 [inline]
get_tx_bufs+0x120/0x5fc drivers/vhost/net.c:634
handle_tx_copy drivers/vhost/net.c:797 [inline]
handle_tx+0x2ec/0x2464 drivers/vhost/net.c:992
handle_tx_net+0x24/0x34 drivers/vhost/net.c:1287
vhost_worker+0x1f4/0x35c drivers/vhost/vhost.c:364
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.