program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
setns(0xc9, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x8a402, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2200}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x4)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_CNT={0x8, 0x14}, @IFLA_BR_STP_STATE={0x8, 0x5, 0x1}, @IFLA_BR_FORWARD_DELAY={0x8}]}}}]}, 0x4c}}, 0x0)
write(r3, &(0x7f0000000200)='2', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) (async)
setns(0xc9, 0x0) (async)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff") (async)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x8a402, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0) (async)
sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2200}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x4) (async)
socket$nl_route(0x10, 0x3, 0x0) (async)
sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_CNT={0x8, 0x14}, @IFLA_BR_STP_STATE={0x8, 0x5, 0x1}, @IFLA_BR_FORWARD_DELAY={0x8}]}}}]}, 0x4c}}, 0x0) (async)
write(r3, &(0x7f0000000200)='2', 0x1) (async)
[ 102.902769][ T5281] Bluetooth: hci0: command tx timeout
[ 103.006359][ T5320] lo: entered allmulticast mode
[ 103.027579][ T5320] bond0: entered allmulticast mode
[ 103.038505][ T5320] dummy0: entered allmulticast mode
[ 103.051384][ T5320] eql: entered allmulticast mode
[ 103.060563][ T5320] ifb0: entered allmulticast mode
[ 103.073040][ T5320] ifb1: entered allmulticast mode
[ 103.128432][ C0]
[ 103.129461][ C0] =============================
[ 103.131461][ C0] [ BUG: Invalid wait context ]
[ 103.133552][ C0] syzkaller #0 Not tainted
[ 103.135379][ C0] -----------------------------
[ 103.137349][ C0] cmp/5324 is trying to lock:
[ 103.139157][ C0] ffff888052615bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 103.142853][ C0] other info that might help us debug this:
[ 103.145122][ C0] context-{2:2}
[ 103.146537][ C0] 3 locks held by cmp/5324:
[ 103.148560][ C0] #0: ffff88801b079078 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0
[ 103.152328][ C0] #1: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550
[ 103.156357][ C0] #2: ffff888052616110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 103.160464][ C0] stack backtrace:
[ 103.162188][ C0] CPU: 0 UID: 0 PID: 5324 Comm: cmp Not tainted syzkaller #0 PREEMPT(full)
[ 103.162200][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.162207][ C0] Call Trace:
[ 103.162214][ C0]
[ 103.162219][ C0] dump_stack_lvl+0xe8/0x150
[ 103.162235][ C0] __lock_acquire+0xe39/0x2cf0
[ 103.162251][ C0] ? __lock_acquire+0x683/0x2cf0
[ 103.162265][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 103.162276][ C0] lock_acquire+0x106/0x350
[ 103.162288][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 103.162299][ C0] ? xa_load+0x1db/0x210
[ 103.162363][ C0] _raw_read_lock_irqsave+0x48/0x60
[ 103.162375][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 103.162386][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 103.162398][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 103.162408][ C0] xen_timer_callback+0x109/0x220
[ 103.162421][ C0] ? __pfx_xen_timer_callback+0x10/0x10
[ 103.162432][ C0] __hrtimer_run_queues+0x371/0xa10
[ 103.162445][ C0] hrtimer_interrupt+0x448/0x910
[ 103.162460][ C0] __sysvec_apic_timer_interrupt+0x102/0x430
[ 103.162470][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0
[ 103.162488][ C0]
[ 103.162491][ C0]
[ 103.162495][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 103.162506][ C0] RIP: 0010:kasan_check_range+0x97/0x2c0
[ 103.162520][ C0] Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 3d 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 9e 01 00 00 49 ff c3 48 ff c3 75 ee e9 1d 01 00 00 44 89 dd
[ 103.162528][ C0] RSP: 0018:ffffc9000f3ef088 EFLAGS: 00000246
[ 103.162538][ C0] RAX: ffffc9000f3efa01 RBX: fffffffffffffffe RCX: ffffffff81778ef4
[ 103.162546][ C0] RDX: 0000000000000001 RSI: 0000000000000010 RDI: ffffc9000f3ef1d8
[ 103.162552][ C0] RBP: 0000000000000000 R08: ffffc9000f3ef1e7 R09: 1ffff92001e7de3c
[ 103.162559][ C0] R10: dffffc0000000000 R11: fffff52001e7de3b R12: 0000000000000002
[ 103.162565][ C0] R13: ffffffff90fb4b50 R14: fffff52001e7de3d R15: 1ffff92001e7de3b
[ 103.162574][ C0] ? unwind_next_frame+0xd04/0x2550
[ 103.162587][ C0] __asan_memset+0x22/0x50
[ 103.162596][ C0] unwind_next_frame+0xd04/0x2550
[ 103.162607][ C0] ? exit_mmap+0x4aa/0x9f0
[ 103.162616][ C0] ? unwind_next_frame+0x8f/0x2550
[ 103.162625][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 103.162636][ C0] arch_stack_walk+0x11b/0x150
[ 103.162648][ C0] ? __mmput+0x118/0x420
[ 103.162658][ C0] stack_trace_save+0xa9/0x100
[ 103.162668][ C0] ? __pfx_stack_trace_save+0x10/0x10
[ 103.162681][ C0] kasan_save_stack+0x3e/0x60
[ 103.162691][ C0] ? kasan_save_stack+0x3e/0x60
[ 103.162700][ C0] ? kasan_record_aux_stack+0xbd/0xd0
[ 103.162713][ C0] ? call_rcu+0xee/0x8b0
[ 103.162726][ C0] ? kmem_cache_free+0x462/0x650
[ 103.162736][ C0] ? __put_anon_vma+0x12b/0x2d0
[ 103.162746][ C0] ? unlink_anon_vmas+0x589/0x730
[ 103.162755][ C0] ? free_pgtables+0x836/0xb70
[ 103.162765][ C0] ? exit_mmap+0x4aa/0x9f0
[ 103.162780][ C0] ? __put_anon_vma+0x12b/0x2d0
[ 103.162790][ C0] kasan_record_aux_stack+0xbd/0xd0
[ 103.162802][ C0] ? __pfx_slab_free_after_rcu_debug+0x10/0x10
[ 103.162814][ C0] call_rcu+0xee/0x8b0
[ 103.162830][ C0] ? __put_anon_vma+0x12b/0x2d0
[ 103.162838][ C0] kmem_cache_free+0x462/0x650
[ 103.162849][ C0] __put_anon_vma+0x12b/0x2d0
[ 103.162859][ C0] unlink_anon_vmas+0x589/0x730
[ 103.162870][ C0] free_pgtables+0x836/0xb70
[ 103.162880][ C0] ? exit_mmap+0x2d8/0x9f0
[ 103.162890][ C0] ? __pfx_free_pgtables+0x10/0x10
[ 103.162900][ C0] ? __pfx_down_write+0x10/0x10
[ 103.162916][ C0] exit_mmap+0x4aa/0x9f0
[ 103.162926][ C0] ? __pfx_exit_mmap+0x10/0x10
[ 103.162938][ C0] ? __pfx_exit_aio+0x10/0x10
[ 103.162950][ C0] ? arch_uprobe_clear_state+0x1c8/0x240
[ 103.162963][ C0] ? uprobe_clear_state+0x2ac/0x3e0
[ 103.162979][ C0] __mmput+0x118/0x420
[ 103.162988][ C0] setup_new_exec+0x30d/0x360
[ 103.163001][ C0] load_elf_binary+0xbcf/0x2950
[ 103.163011][ C0] ? __lock_acquire+0x683/0x2cf0
[ 103.163024][ C0] ? load_elf_binary+0x981/0x2950
[ 103.163033][ C0] ? load_misc_binary+0x10f/0xc00
[ 103.163046][ C0] ? lock_acquire+0x106/0x350
[ 103.163059][ C0] ? __pfx_load_elf_binary+0x10/0x10
[ 103.163072][ C0] bprm_execve+0x9c7/0x1630
[ 103.163086][ C0] ? __pfx_bprm_execve+0x10/0x10
[ 103.163099][ C0] do_execveat_common+0x4f4/0x670
[ 103.163113][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.163123][ C0] __x64_sys_execve+0x97/0xc0
[ 103.163135][ C0] do_syscall_64+0x174/0x580
[ 103.163148][ C0] ? trace_irq_disable+0x3b/0x140
[ 103.163160][ C0] ? clear_bhb_loop+0x70/0xc0
[ 103.163170][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.163180][ C0] RIP: 0033:0x7ff62a18a107
[ 103.163195][ C0] Code: Unable to access opcode bytes at 0x7ff62a18a0dd.
[ 103.163201][ C0] RSP: 002b:00007fffb1f64258 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
[ 103.163211][ C0] RAX: ffffffffffffffda RBX: 000056540672d1a8 RCX: 00007ff62a18a107
[ 103.163218][ C0] RDX: 00005654067251c8 RSI: 000056540672d1a8 RDI: 0000565406725250
[ 103.163224][ C0] RBP: 0000565406725250 R08: 00007fffb1f68eba R09: 000000000000001f
[ 103.163230][ C0] R10: 000056540671c010 R11: 0000000000000246 R12: 00005654067251c8
[ 103.163237][ C0] R13: 00007ff62a34fe8b R14: 00005654067251c8 R15: 0000000000000000
[ 103.163245][ C0]
[ 103.442803][ T5320] e1000 0000:00:06.0 eth0: entered allmulticast mode
[ 103.570105][ T5320] e1000e 0000:00:02.0 eth1: NIC Link is Down
[ 103.574587][ T5320] e1000e 0000:00:02.0 eth1: entered allmulticast mode
[ 103.581838][ T5320] mac80211_hwsim hwsim0 wlan0: entered allmulticast mode
[ 103.588033][ T5320] mac80211_hwsim hwsim1 wlan1: entered allmulticast mode
[ 103.591508][ T5320] hwsim0: entered allmulticast mode
[ 103.594547][ T5320] ieee802154 phy0 wpan0: entered allmulticast mode
[ 103.600346][ T5320] ieee802154 phy1 wpan1: entered allmulticast mode
[ 103.603744][ T5320] teql0: entered allmulticast mode
[ 103.606213][ T5320] tunl0: entered allmulticast mode
[ 103.608720][ T5320] gre0: entered allmulticast mode
[ 103.611049][ T5320] gretap0: entered allmulticast mode
[ 103.613334][ T5320] erspan0: entered allmulticast mode
[ 103.615507][ T5320] ip_vti0: entered allmulticast mode
[ 103.618103][ T5320] ip6_vti0: entered allmulticast mode
[ 103.620456][ T5320] sit0: entered allmulticast mode
[ 103.622790][ T5320] ip6tnl0: entered allmulticast mode
[ 103.625183][ T5320] ip6gre0: entered allmulticast mode
[ 103.627781][ T5320] lapb0: entered allmulticast mode
[ 103.630091][ T5320] lapb1: entered allmulticast mode
[ 103.632327][ T5320] lapb2: entered allmulticast mode
[ 103.634681][ T5320] lapb3: entered allmulticast mode
[ 103.637357][ T5320] lapb4: entered allmulticast mode
[ 103.639664][ T5320] lapb5: entered allmulticast mode
[ 103.642009][ T5320] lapb6: entered allmulticast mode
[ 103.644306][ T5320] lowpan0: entered allmulticast mode