Re: [syzbot] [kvm-x86?] WARNING in vcpu_run (2)

[Sean Christopherson]

On Fri, Jun 19, 2026, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    8c13415c8a43 Merge tag 'media/v7.2-1' of git://git.kernel...
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=12ec001c580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d4e6991ab3edc95e
> dashboard link: https://syzkaller.appspot.com/bug?extid=dd769db18693736eee89
> compiler:       Debian clang version 22.1.6 (++20260514074242+fc4aad7b5db3-1~exp1~20260514074407.73), Debian LLD 22.1.6
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=157ce8ea580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1176e566580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/27752fb81380/disk-8c13415c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/192b476e0df1/vmlinux-8c13415c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/ba635e3d5aec/bzImage-8c13415c.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+dd769db18693736eee89@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> ------------[ cut here ]------------
> irq == -1
> WARNING: arch/x86/kvm/x86.c:10860 at kvm_check_and_inject_events arch/x86/kvm/x86.c:10860 [inline], CPU#0: syz.4.1716/11103
> WARNING: arch/x86/kvm/x86.c:10860 at vcpu_enter_guest arch/x86/kvm/x86.c:11356 [inline], CPU#0: syz.4.1716/11103
> WARNING: arch/x86/kvm/x86.c:10860 at vcpu_run+0x57ec/0x7950 arch/x86/kvm/x86.c:11770, CPU#0: syz.4.1716/11103

#syz test

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d9d51803b7b2..14a62c2ce3ad 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10797,10 +10797,12 @@ static int kvm_check_and_inject_events(struct kvm_vcpu *vcpu,
                if (r) {
                        int irq = kvm_cpu_get_interrupt(vcpu);
 
-                       if (!WARN_ON_ONCE(irq == -1)) {
+                       if (likely(irq != -1)) {
                                kvm_queue_interrupt(vcpu, irq, false);
                                kvm_x86_call(inject_irq)(vcpu, false);
                                WARN_ON(kvm_x86_call(interrupt_allowed)(vcpu, true) < 0);
+                       } else {
+                               WARN_ON_ONCE(!pic_in_kernel(vcpu->kvm));
                        }
                }
                if (kvm_cpu_has_injectable_intr(vcpu))