program: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000340)="f4", 0xfdef}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0x3) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)={{0x1, 0x1, 0x18}, '\x00'}) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r4, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCGFLAGS1(r4, 0x40047457, 0x0) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl(r6, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff") r7 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r8, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x19, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) syz_open_procfs$namespace(0x0, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$tipc(r9, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) write$cgroup_devices(r9, 0x0, 0x9) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00U\x00=\t\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32=r10, @ANYBLOB="20000280", @ANYRES32, @ANYBLOB="0000000000000000000000000a000000000000000000001420000100", @ANYRES32=r10], 0x58}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000003c0)={'syztnl1\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x2d, 0x7, 0x8, 0x1ffe0, 0x2, @dev={0xfe, 0x80, '\x00', 0x40}, @mcast1, 0x10, 0x7, 0x3, 0x7}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000500)={'gretap0\x00', &(0x7f0000000400)={'tunl0\x00', 0x0, 0x20, 0x8, 0x800, 0x1, {{0x2b, 0x4, 0x3, 0x5, 0xac, 0x67, 0x0, 0x0, 0x2f, 0x0, @loopback, @empty, {[@timestamp_addr={0x44, 0x14, 0xb2, 0x1, 0x7, [{@multicast2, 0x45}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7fffffff}]}, @timestamp={0x44, 0x24, 0x37, 0x0, 0x1, [0x1, 0x80000000, 0x5c7da29c, 0x7, 0x75, 0xc, 0x7, 0x3]}, @generic={0x94, 0x7, "dca6b34788"}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x1c, 0xb3, 0x3, 0x5, [{@multicast1, 0x4}, {@multicast2, 0x80}, {@multicast1, 0x2}]}, @ssrr={0x89, 0x1f, 0xc, [@local, @multicast1, @multicast2, @remote, @multicast2, @rand_addr=0x64010101, @empty]}, @lsrr={0x83, 0x17, 0xd0, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @broadcast, @loopback, @private=0xa010101]}]}}}}}) ioctl$KDFONTOP_COPY(r3, 0x4b72, &(0x7f00000010c0)={0x3, 0x2, 0x4, 0x16, 0x48, &(0x7f0000000cc0)}) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x218, 0x30, 0x1, 0x0, 0x0, {}, [{0x204, 0x1, [@m_ct={0x44, 0x15, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xffffffff, 0x0, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_gact={0x9c, 0x20, 0x0, 0x0, {{0x9}, {0x34, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x3, 0x58f8, 0x3, 0xe, 0xf87}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x1c5d, 0x6}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x1483, 0x10000002}}]}, {0x3e, 0x6, "b317a5e8bfd7262cacfe626814c98fa8491180881a2d68f16a32f27ec08710843a6129e885e95c770162de70076adc597164778649b9960a6f67"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_mirred={0x120, 0x15, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x5, 0x6, 0x3, 0xff3, 0x1}, 0x2, r10}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0x77, 0x2, 0xff, 0x3}, 0x3, r11}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x80000000, 0x755, 0xffffffffffffffff, 0x1, 0x200000}, 0x4, r12}}]}, {0x94, 0x6, "b3055e067abbfb9ec23b7e0405ceaaad0b9d652f2137f55ace9212cc4ab1d8d16a4b2e3d37c61e9df976d7d22350fa1a314c921bb4f701d3dccbfc28fb088ae7b967da52443bdbab98f7fbd09c437162b9a61881a064d52383c2a5ad6de3fc90ac4907d4b58b2c8b8b2f41bf016e7894f73f6b5e24f3723f067679577cf11ea91f367fef78f1bef5850cac0c77ff8cc7"}, {0xc}, {0xc, 0x8, {0x2, 0x1}}}}]}]}, 0x218}}, 0x0) [ 102.837075][ T4642] Bluetooth: hci0: command tx timeout [ 103.118461][ C0] [ 103.119620][ C0] ============================= [ 103.121780][ C0] [ BUG: Invalid wait context ] [ 103.123997][ C0] syzkaller #0 Not tainted [ 103.125881][ C0] ----------------------------- [ 103.127992][ C0] syz.0.0/5320 is trying to lock: [ 103.130055][ C0] ffff88804ffbdbb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.133878][ C0] other info that might help us debug this: [ 103.135939][ C0] context-{2:2} [ 103.137249][ C0] 4 locks held by syz.0.0/5320: [ 103.139132][ C0] #0: ffff88803359c3a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_wait_for_rcvmsg+0x342/0x640 [ 103.143152][ C0] #1: ffff88803359bbe8 (slock-AF_TIPC){+...}-{3:3}, at: tipc_sk_rcv+0x420/0x2b50 [ 103.146532][ C0] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: tipc_write_space+0x20/0x260 [ 103.149745][ C0] #3: ffff88804ffbe110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0 [ 103.153704][ C0] stack backtrace: [ 103.155317][ C0] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.155330][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.155336][ C0] Call Trace: [ 103.155343][ C0] [ 103.155349][ C0] dump_stack_lvl+0xe8/0x150 [ 103.155366][ C0] __lock_acquire+0xe39/0x2cf0 [ 103.155381][ C0] ? __lock_acquire+0x683/0x2cf0 [ 103.155396][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.155407][ C0] lock_acquire+0x106/0x350 [ 103.155418][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.155430][ C0] ? xa_load+0x1db/0x210 [ 103.155445][ C0] _raw_read_lock_irqsave+0x48/0x60 [ 103.155456][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.155466][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.155478][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0 [ 103.155490][ C0] xen_timer_callback+0x109/0x220 [ 103.155502][ C0] ? __pfx_xen_timer_callback+0x10/0x10 [ 103.155513][ C0] __hrtimer_run_queues+0x371/0xa10 [ 103.155526][ C0] hrtimer_interrupt+0x448/0x910 [ 103.155542][ C0] __sysvec_apic_timer_interrupt+0x102/0x430 [ 103.155553][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 103.155566][ C0] [ 103.155570][ C0] [ 103.155573][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 103.155584][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 103.155596][ C0] Code: f7 e8 2d dd cd f5 f7 c3 00 02 00 00 74 05 e8 20 cd f9 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 c4 f0 be f5 65 8b 05 bd f0 97 07 85 c0 74 18 5b 41 5e c3 cc cc [ 103.155605][ C0] RSP: 0018:ffffc900014e6db8 EFLAGS: 00000206 [ 103.155614][ C0] RAX: 0000000000000006 RBX: 0000000000000282 RCX: 0000000080000202 [ 103.155620][ C0] RDX: 0000000000000002 RSI: ffffffff8e22b7e8 RDI: 0000000000000001 [ 103.155626][ C0] RBP: ffff88800bdb4680 R08: ffffffff90576c37 R09: 1ffffffff20aed86 [ 103.155633][ C0] R10: dffffc0000000000 R11: fffffbfff20aed87 R12: 0000000000000001 [ 103.155640][ C0] R13: 0000000000000000 R14: ffff88800bdb4640 R15: ffff88800bdb4680 [ 103.155651][ C0] __wake_up_common_lock+0x195/0x1f0 [ 103.155664][ C0] ? tipc_write_space+0x20/0x260 [ 103.155674][ C0] tipc_write_space+0x15c/0x260 [ 103.155684][ C0] tipc_sk_proto_rcv+0xc51/0x1810 [ 103.155694][ C0] ? unwind_next_frame+0x8f/0x2550 [ 103.155712][ C0] ? __pfx_tipc_sk_proto_rcv+0x10/0x10 [ 103.155723][ C0] ? tipc_sk_filtering+0x13c/0x510 [ 103.155732][ C0] tipc_sk_filter_rcv+0x2fd7/0x3210 [ 103.155742][ C0] ? __lock_acquire+0x683/0x2cf0 [ 103.155753][ C0] ? arch_stack_walk+0xfb/0x150 [ 103.155763][ C0] ? look_up_lock_class+0x57/0x110 [ 103.155775][ C0] ? register_lock_class+0x31/0x2e0 [ 103.155788][ C0] ? __lock_acquire+0x683/0x2cf0 [ 103.155800][ C0] ? tipc_sk_lookup+0xb5/0x920 [ 103.155815][ C0] ? tipc_sk_lookup+0xb5/0x920 [ 103.155824][ C0] ? __pfx_tipc_sk_filter_rcv+0x10/0x10 [ 103.155831][ C0] ? tipc_sk_rcv+0x73e/0x2b50 [ 103.155840][ C0] tipc_sk_rcv+0x877/0x2b50 [ 103.155849][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.155859][ C0] ? __pfx_tipc_sk_rcv+0x10/0x10 [ 103.155867][ C0] ? __pfx_netif_rx_internal+0x10/0x10 [ 103.155877][ C0] ? netif_rx+0x79/0x90 [ 103.155882][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 103.155891][ C0] ? tipc_clone_to_loopback+0x4c7/0x4f0 [ 103.155904][ C0] ? __raw_spin_lock_init+0x45/0x100 [ 103.155913][ C0] tipc_node_xmit+0x205/0xf10 [ 103.155926][ C0] ? __pfx_tipc_node_xmit+0x10/0x10 [ 103.155939][ C0] ? kmem_cache_alloc_node_noprof+0x1e1/0x610 [ 103.155949][ C0] ? rcu_is_watching+0x15/0xb0 [ 103.155963][ C0] ? kmem_cache_alloc_node_noprof+0x1e1/0x610 [ 103.155974][ C0] ? kmem_cache_alloc_node_noprof+0x1f5/0x610 [ 103.155983][ C0] ? __alloc_skb+0x276/0x7a0 [ 103.156003][ C0] tipc_node_xmit_skb+0x11e/0x190 [ 103.156016][ C0] ? __pfx_tipc_node_xmit_skb+0x10/0x10 [ 103.156030][ C0] ? tipc_sk_send_ack+0x101/0x590 [ 103.156043][ C0] tipc_recvstream+0x835/0xe90 [ 103.156057][ C0] ? __pfx_tipc_recvstream+0x10/0x10 [ 103.156067][ C0] sock_recvmsg+0x196/0x1e0 [ 103.156079][ C0] ____sys_recvmsg+0x1e6/0x4a0 [ 103.156090][ C0] ? __pfx_____sys_recvmsg+0x10/0x10 [ 103.156103][ C0] ? import_iovec+0x73/0xa0 [ 103.156159][ C0] ___sys_recvmsg+0x213/0x5a0 [ 103.156166][ C0] ? __pfx____sys_recvmsg+0x10/0x10 [ 103.156176][ C0] ? __fget_files+0x2a/0x420 [ 103.156190][ C0] ? __fget_files+0x3a2/0x420 [ 103.156203][ C0] __x64_sys_recvmsg+0x1ae/0x290 [ 103.156213][ C0] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 103.156226][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.156236][ C0] do_syscall_64+0x174/0x580 [ 103.156249][ C0] ? trace_irq_disable+0x3b/0x140 [ 103.156260][ C0] ? clear_bhb_loop+0x70/0xc0 [ 103.156270][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.156280][ C0] RIP: 0033:0x7fe65339e0d9 [ 103.156290][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.156298][ C0] RSP: 002b:00007fe654239fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 103.156308][ C0] RAX: ffffffffffffffda RBX: 00007fe653625fa0 RCX: 00007fe65339e0d9 [ 103.156315][ C0] RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 000000000000000b [ 103.156321][ C0] RBP: 00007fe653435024 R08: 0000000000000000 R09: 0000000000000000 [ 103.156327][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.156333][ C0] R13: 00007fe653626038 R14: 00007fe653625fa0 R15: 00007ffe8e340b48 [ 103.156342][ C0]