program:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10)
connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10)
setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000000c0)=0x3, 0x4)
sendmmsg$inet(r1, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="19", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000280)="ae", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000029c0)=[{&(0x7f0000001800)="f35f79", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000002bc0)=[{&(0x7f0000002ac0)='p', 0x1}], 0x1}}], 0x4, 0x4040040)
write(r1, &(0x7f00000002c0)="f3", 0x1)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0xa, 0x0, &(0x7f0000000300)=0x9b)
r2 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl(r5, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000380)=0x7f, 0x4)
getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000940), &(0x7f0000000980)=0x4)
r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0x11)
ioctl$TCGETA(r6, 0x5405, &(0x7f0000000740))
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10452, &(0x7f0000000540)={[{@rodir}, {@numtail}, {@rodir}, {@shortname_win95}, {@shortname_lower}, {@shortname_win95}, {@uni_xlateno}, {@rodir}, {@shortname_lower}, {@fat=@codepage={'codepage', 0x3d, '862'}}, {@shortname_win95}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@utf8}, {@uni_xlate}, {@uni_xlate}, {@numtail}]}, 0x3, 0x27b, &(0x7f00000002c0)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=")
socket$nl_route(0x10, 0x3, 0x0)
ioctl$MEMGETREGIONINFO(0xffffffffffffffff, 0xc0104d08, &(0x7f0000000140)={0x8, 0x9, 0x6, 0x40})
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r7 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7})
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'wlan1\x00', 0x0})
bind$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x5, 0x9, 0x3, 0x4, 0x7, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10)
getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value, &(0x7f0000000040)=0x8)
io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0)
[ 87.723106][ T5310] can0: slcan on ttynull.
[ 87.735842][ T5275] Bluetooth: hci0: command tx timeout
[ 87.741328][ T5310] loop0: detected capacity change from 0 to 256
[ 87.756734][ T5310] =======================================================
[ 87.756734][ T5310] WARNING: The mand mount option has been deprecated and
[ 87.756734][ T5310] and is ignored by this kernel. Remove the mand
[ 87.756734][ T5310] option from the mount to silence this warning.
[ 87.756734][ T5310] =======================================================
[ 87.822198][ C0]
[ 87.823284][ C0] =============================
[ 87.825430][ C0] [ BUG: Invalid wait context ]
[ 87.827586][ C0] syzkaller #0 Not tainted
[ 87.829622][ C0] -----------------------------
[ 87.831867][ C0] dhcpcd-run-hook/5313 is trying to lock:
[ 87.834395][ C0] ffff888012299bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 87.838581][ C0] other info that might help us debug this:
[ 87.841240][ C0] context-{2:2}
[ 87.842793][ C0] 2 locks held by dhcpcd-run-hook/5313:
[ 87.845227][ C0] #0: ffff888032320518 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_order+0xb37/0xee0
[ 87.849874][ C0] #1: ffff88801229a110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 87.854140][ C0] stack backtrace:
[ 87.855605][ C0] CPU: 0 UID: 0 PID: 5313 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(full)
[ 87.855614][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.855619][ C0] Call Trace:
[ 87.855623][ C0]
[ 87.855627][ C0] dump_stack_lvl+0xe8/0x150
[ 87.855638][ C0] __lock_acquire+0xe39/0x2cf0
[ 87.855648][ C0] ? __lock_acquire+0x683/0x2cf0
[ 87.855657][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 87.855665][ C0] lock_acquire+0x106/0x350
[ 87.855672][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 87.855680][ C0] ? xa_load+0x1db/0x210
[ 87.855733][ C0] _raw_read_lock_irqsave+0x48/0x60
[ 87.855744][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 87.855755][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 87.855768][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 87.855778][ C0] xen_timer_callback+0x109/0x220
[ 87.855785][ C0] ? __pfx_xen_timer_callback+0x10/0x10
[ 87.855792][ C0] __hrtimer_run_queues+0x371/0xa10
[ 87.855821][ C0] hrtimer_interrupt+0x448/0x910
[ 87.855832][ C0] __sysvec_apic_timer_interrupt+0x102/0x430
[ 87.855839][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0
[ 87.855848][ C0]
[ 87.855850][ C0]
[ 87.855852][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 87.855860][ C0] RIP: 0010:lock_release+0x2d7/0x3c0
[ 87.855868][ C0] Code: cb ca 11 00 00 00 00 eb b5 e8 b5 db 2f 0a f7 c3 00 02 00 00 74 b9 65 48 8b 05 45 86 ca 11 48 3b 44 24 28 75 44 fb 48 83 c4 30 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d c2 14 b8
[ 87.855874][ C0] RSP: 0018:ffffc9000f3bf5f8 EFLAGS: 00000282
[ 87.855881][ C0] RAX: baf2373d1ce2ae00 RBX: 0000000000000206 RCX: 0000000000000046
[ 87.855886][ C0] RDX: 0000000000000001 RSI: ffffffff8e4b0c2e RDI: ffffffff8c4bce80
[ 87.855890][ C0] RBP: ffff88801231b108 R08: ffffffff823f13c0 R09: 0000000000000000
[ 87.855894][ C0] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000001
[ 87.855898][ C0] R13: 0000000000000001 R14: ffffffff8eb59c60 R15: ffff88801231a540
[ 87.855903][ C0] ? charge_memcg+0x20/0x2b0
[ 87.855912][ C0] ? charge_memcg+0x20/0x2b0
[ 87.855918][ C0] charge_memcg+0xeb/0x2b0
[ 87.855925][ C0] __mem_cgroup_charge+0x25/0x80
[ 87.855931][ C0] filemap_add_folio+0x151/0x530
[ 87.855941][ C0] page_cache_ra_unbounded+0x46d/0x9d0
[ 87.855952][ C0] page_cache_ra_order+0xb47/0xee0
[ 87.855962][ C0] ? maybe_unlock_mmap_for_io+0x20b/0x290
[ 87.855972][ C0] do_sync_mmap_readahead+0x75e/0x990
[ 87.855987][ C0] ? __pfx_do_sync_mmap_readahead+0x10/0x10
[ 87.856003][ C0] ? count_memcg_event_mm+0x1d/0x250
[ 87.856016][ C0] ? count_memcg_event_mm+0x1d/0x250
[ 87.856026][ C0] filemap_fault+0x7d9/0x13b0
[ 87.856036][ C0] ? __pfx_filemap_fault+0x10/0x10
[ 87.856044][ C0] ? blk_cgroup_congested+0x1d/0x210
[ 87.856092][ C0] ? blk_cgroup_congested+0x1d/0x210
[ 87.856099][ C0] ? blk_cgroup_congested+0x1d/0x210
[ 87.856106][ C0] ? blk_cgroup_congested+0x1d/0x210
[ 87.856114][ C0] __do_fault+0x138/0x2a0
[ 87.856122][ C0] do_pte_missing+0x1032/0x34b0
[ 87.856130][ C0] ? handle_mm_fault+0xec/0x3080
[ 87.856139][ C0] handle_mm_fault+0x1b36/0x3080
[ 87.856149][ C0] ? handle_mm_fault+0xec/0x3080
[ 87.856159][ C0] ? __pfx_handle_mm_fault+0x10/0x10
[ 87.856167][ C0] ? lock_vma_under_rcu+0x45a/0x500
[ 87.856174][ C0] ? __fget_files+0x2a/0x420
[ 87.856183][ C0] do_user_addr_fault+0xa4d/0x1340
[ 87.856194][ C0] ? trace_page_fault_user+0x84/0x1e0
[ 87.856202][ C0] exc_page_fault+0x6a/0xc0
[ 87.856210][ C0] asm_exc_page_fault+0x26/0x30
[ 87.856216][ C0] RIP: 0033:0x7f1a1ae4eff2
[ 87.856223][ C0] Code: 0f 60 c0 66 0f 61 c0 66 0f 70 c0 00 48 83 fa 10 72 76 48 83 fa 20 77 12 0f 11 44 17 f0 0f 11 07 c3 0f 11 47 e0 0f 11 47 f0 c3 <0f> 11 07 0f 11 47 10 48 01 d7 48 83 fa 40 76 e7 0f 11 40 20 0f 11
[ 87.856229][ C0] RSP: 002b:00007fff39b118c8 EFLAGS: 00010206
[ 87.856238][ C0] RAX: 00007f1a1ae21263 RBX: 0000000000000004 RCX: 00007f1a1ae21918
[ 87.856244][ C0] RDX: 00000000000006b5 RSI: 0000000000000000 RDI: 00007f1a1ae21263
[ 87.856249][ C0] RBP: 00007fff39b11c20 R08: 00007f1a1ae21263 R09: 0000000000000003
[ 87.856255][ C0] R10: 0000000000000812 R11: 00007fff39b11d08 R12: 00007fff39b11978
[ 87.856261][ C0] R13: 00007f1a1ae220c0 R14: 00007fff39b11cc0 R15: 00007f1a1ae21918
[ 87.856271][ C0]
[ 88.065972][ T5309] can0 (unregistered): slcan off ttynull.