[v6.1] WARNING in its_irq_domain_free

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e4f7d8be268e Linux 6.1.182
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1178fac6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=db67f2572dcb0db651bb
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7cd9b1875376/disk-e4f7d8be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4b5d35d18c31/vmlinux-e4f7d8be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d5ee64c2af77/Image-e4f7d8be.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+db67f2...@syzkaller.appspotmail.com

el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4702 at drivers/irqchip/irq-gic-v3-its.c:2175 its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
WARNING: CPU: 1 PID: 4702 at drivers/irqchip/irq-gic-v3-its.c:2175 its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
Modules linked in:
CPU: 1 PID: 4702 Comm: syz.2.64 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
pc : its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
lr : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
lr : its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
sp : ffff8000218d7080
x29: ffff8000218d7130 x28: 1fffe0001a3f96c2 x27: dfff800000000000
x26: ffff70000431ae14 x25: 00000000fffffff4 x24: ffff8000218d70c0
x23: ffff0000cafcb300 x22: ffff0000d1fcb600 x21: ffff0000c0022400
x20: 1fffe0001a3f96c6 x19: 0000000000000001 x18: 00000000703b3d8e
x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000000
x14: 0000000000000001 x13: 1ffff00002ac6fce x12: 0000000000000000
x11: ff0080000ab33af8 x10: 0000000000000000 x9 : ffff80000ab33af8
x8 : ffff0000c66d8000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : 00000000ffffffff x4 : 0000000000000cc0 x3 : 0000000000000cc0
x2 : 0000000000000018 x1 : 00000000fffffff4 x0 : 0000000000000000
Call trace:
its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
irq_domain_free_irqs_hierarchy kernel/irq/irqdomain.c:1470 [inline]
irq_domain_free_irqs_parent kernel/irq/irqdomain.c:1805 [inline]
irq_domain_free_irqs_common+0x250/0x2a0 kernel/irq/irqdomain.c:1437
irq_domain_free_irqs_top+0x90/0xa8 kernel/irq/irqdomain.c:1456
msi_domain_free+0x120/0x140 kernel/irq/msi.c:572
irq_domain_free_irqs_hierarchy kernel/irq/irqdomain.c:1470 [inline]
irq_domain_free_irqs+0x34c/0x474 kernel/irq/irqdomain.c:1767
__msi_domain_free_irqs+0x324/0x700 kernel/irq/msi.c:983
msi_domain_free_irqs_descs_locked+0x100/0x1a8 kernel/irq/msi.c:1014
pci_msi_teardown_msi_irqs+0x8c/0xd4 drivers/pci/msi/irqdomain.c:28
free_msi_irqs drivers/pci/msi/msi.c:227 [inline]
pci_disable_msix+0x398/0x584 drivers/pci/msi/msi.c:868
pci_free_irq_vectors+0x20/0x38 drivers/pci/msi/msi.c:1069
vp_del_vqs+0x568/0x754 drivers/virtio/virtio_pci_common.c:270
remove_common drivers/char/hw_random/virtio-rng.c:206 [inline]
virtrng_remove+0x108/0x1bc drivers/char/hw_random/virtio-rng.c:218
virtio_dev_remove+0x90/0x194 drivers/virtio/virtio.c:332
device_remove drivers/base/dd.c:547 [inline]
__device_release_driver drivers/base/dd.c:1279 [inline]
device_release_driver_internal+0x3d4/0x6e4 drivers/base/dd.c:1305
device_release_driver+0x28/0x38 drivers/base/dd.c:1328
bus_remove_device+0x294/0x384 drivers/base/bus.c:531
device_del+0x580/0x990 drivers/base/core.c:3900
device_unregister+0x2c/0xc8 drivers/base/core.c:3943
unregister_virtio_device+0x38/0x78 drivers/virtio/virtio.c:483
virtio_pci_remove+0x7c/0xf4 drivers/virtio/virtio_pci_common.c:600
pci_device_remove+0x9c/0x23c drivers/pci/pci-driver.c:483
device_remove drivers/base/dd.c:547 [inline]
__device_release_driver drivers/base/dd.c:1279 [inline]
device_release_driver_internal+0x3d4/0x6e4 drivers/base/dd.c:1305
device_release_driver+0x28/0x38 drivers/base/dd.c:1328
pci_stop_dev drivers/pci/remove.c:22 [inline]
pci_stop_bus_device+0x100/0x164 drivers/pci/remove.c:82
pci_stop_and_remove_bus_device drivers/pci/remove.c:116 [inline]
pci_stop_and_remove_bus_device_locked+0x24/0x40 drivers/pci/remove.c:124
remove_store+0xdc/0x148 drivers/pci/pci-sysfs.c:515
dev_attr_store+0x6c/0x90 drivers/base/core.c:2388
sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140
kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x3c8/0x7c8 fs/read_write.c:584
ksys_write+0x12c/0x228 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 1360
hardirqs last enabled at (1359): [<ffff800011b8e264>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last enabled at (1359): [<ffff800011b8e264>] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (1360): [<ffff800011b8c2bc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (988): [<ffff800008031254>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (986): [<ffff800008031220>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
pci 0000:00:01.0: [1af4:1005] type 00 class 0x00ff00
pci 0000:00:01.0: BAR 0 [io 0x1000-0x101f]
pci 0000:00:01.0: BAR 1 [mem 0x10110080-0x101100bf]
pci 0000:00:01.0: BAR 1 [mem 0x10110080-0x101100bf]: assigned
pci 0000:00:01.0: BAR 0 [io 0x1000-0x101f]: assigned
virtio-pci 0000:00:01.0: virtio_pci: leaving for legacy driver


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: e4f7d8be268e Linux 6.1.182
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=109af149580000

kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=db67f2572dcb0db651bb
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14eaa279580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7cd9b1875376/disk-e4f7d8be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4b5d35d18c31/vmlinux-e4f7d8be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d5ee64c2af77/Image-e4f7d8be.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+db67f2...@syzkaller.appspotmail.com

el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------

WARNING: CPU: 1 PID: 4537 at drivers/irqchip/irq-gic-v3-its.c:2175 its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
WARNING: CPU: 1 PID: 4537 at drivers/irqchip/irq-gic-v3-its.c:2175 its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
Modules linked in:
CPU: 1 PID: 4537 Comm: syz.0.17 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
pc : its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657
lr : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2175 [inline]
lr : its_irq_domain_free+0x4e0/0x54c drivers/irqchip/irq-gic-v3-its.c:3657

sp : ffff800021917080
x29: ffff800021917130 x28: 1fffe0001970b2c2 x27: dfff800000000000
x26: ffff700004322e14 x25: 00000000fffffff4 x24: ffff8000219170c0
x23: ffff0000cae92900 x22: ffff0000cb859600 x21: ffff0000c0022400
x20: 1fffe0001970b2c6 x19: 0000000000000001 x18: 1fffe00033e7277e
x17: 0000000000000000 x16: ffff800011b90080 x15: ffff8000089b5c5c
x14: 0000000000000001 x13: 1fffe00033e79c00 x12: 0000000000000000

x11: ff0080000ab33af8 x10: 0000000000000000 x9 : ffff80000ab33af8

x8 : ffff0000cc5fd400 x7 : ffff80000884bcac x6 : 0000000000000000
x5 : 0000000000040002 x4 : fffffc000371b020 x3 : 0000000000040002
x2 : ffff0000dc6c6000 x1 : 00000000fffffff4 x0 : 0000000000000000

irq event stamp: 1782
hardirqs last enabled at (1781): [<ffff800011c77b24>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (1781): [<ffff800011c77b24>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (1782): [<ffff800011b8c2bc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (1236): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (1236): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (1123): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630

---[ end trace 0000000000000000 ]---

---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.