program:
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f000006f000/0xc000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00003ed000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000178000/0x2000)=nil, &(0x7f00002b6000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0}, 0x68)
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f00000001c0))
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r1 = io_uring_setup(0x2f64, &(0x7f0000000040)={0x0, 0x36e, 0xc000, 0x2, 0x23f})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, &(0x7f0000000680)='syzkaller\x00', 0x1, 0x40, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)={0xa403, 0xc, 0x6, 0xfd, 0x6, 0x8c, 0x8001}, 0xc)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000000)={0xb, 0x29, 0x2, {0x401}}, 0xb)
mremap(&(0x7f000006f000/0x2000)=nil, 0x2000, 0x3000, 0x6, &(0x7f0000279000/0x3000)=nil)
io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0)
sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002c80)=[{{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000640)="68a55d6df108bed91373cc794c16187a680c0c711ae161400d400e28f7117e17fd75340a58f8d37231d4e7cd61719f501fd0d890485c98ee906e64fad259a1000000fc4d76dadbb0", 0x48}], 0x1}}], 0x1, 0x0)
pipe2$watch_queue(&(0x7f00000002c0), 0x80)
mkdir(&(0x7f0000000100)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x1048801, &(0x7f0000000200)=ANY=[])
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x5, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r7 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4b, 0x1, 0x0, 0x0, 0x0, 0xffffffff, 0x82240, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xe}, 0x102, 0x0, 0x0, 0x8, 0x43fe, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb)
ioctl$PERF_EVENT_IOC_SET_BPF(r7, 0x40042408, r6)
ioctl(r4, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400))
chdir(&(0x7f0000000000)='./file1\x00')
r8 = syz_clone(0x904000, 0x0, 0x5f, 0x0, 0x0, 0x0)
syz_mount_image$romfs(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000280)=ANY=[], 0x1, 0x14f, &(0x7f0000000900)="$eJzs2r9Kw1AUBvAzFCodHZ0KlSho/mtddRQ33yC0uWnwxpREkPYFxElwuA6+hOAT+AgZ3XQR9CUi197aNhXrUBuL32/pR05IT28ut8vRkziyWaoTbXevj19WkziqN929FrOZRwOHRFSXIcvzG4OmPH3Ws5yML274VZVZN6y/DT4bm4E4umQh950FtAUAAAAAAAAAAAAAAAAAAAAAAPOg1VSodUR0wULu22PVtNc/8Tj3k7Sk9kqn1dUMFzHBb+X6uBP1rVcibV+mUBwksm5N1KvDsNER/Lm4vuZZ1DXTXl8PIy/wA//UcdymtWNZu4758Syz+ETtTvVEWX5vTY+TaWPzZo8/mTdT77+yFoqr8+K3jd4/wvxCProit0fp/fzbsKK2+V/pZ4nCzHNlWQz//9pVt/Egzz+jFfO2uriI5SzxtwPAN94DAAD//zRDNTE=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./file0/file0\x00', 0x40)
setpgid(r8, r8)
getpgid(r8)
[ 200.727568][ T5286] Bluetooth: hci0: command tx timeout
[ 200.947778][ T5322] No control pipe specified
[ 201.016151][ C0]
[ 201.017362][ C0] =============================
[ 201.019749][ C0] [ BUG: Invalid wait context ]
[ 201.021956][ C0] syzkaller #0 Not tainted
[ 201.024131][ C0] -----------------------------
[ 201.026604][ C0] syz.0.0/5321 is trying to lock:
[ 201.029074][ C0] ffff888012d91bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 201.033183][ C0] other info that might help us debug this:
[ 201.036073][ C0] context-{2:2}
[ 201.037843][ C0] 4 locks held by syz.0.0/5321:
[ 201.040268][ C0] #0: ffff888012561d38 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock_killable+0x1d/0x70
[ 201.044903][ C0] #1: ffffffff8ec9c0e0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: do_wp_page+0x375f/0x4c70
[ 201.050214][ C0] #2: ffffffff8ec9c138 (srcu){.+.+}-{0:0}, at: __mmu_notifier_invalidate_range_start+0x5ba/0xb70
[ 201.055020][ C0] #3: ffff888012d92110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 201.059416][ C0] stack backtrace:
[ 201.061090][ C0] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 201.061106][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 201.061112][ C0] Call Trace:
[ 201.061120][ C0]
[ 201.061126][ C0] dump_stack_lvl+0xe8/0x150
[ 201.061144][ C0] __lock_acquire+0xe39/0x2cf0
[ 201.061155][ C0] ? __lock_acquire+0x683/0x2cf0
[ 201.061168][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 201.061179][ C0] lock_acquire+0x106/0x350
[ 201.061190][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 201.061202][ C0] ? xa_load+0x1db/0x210
[ 201.061267][ C0] _raw_read_lock_irqsave+0x48/0x60
[ 201.061279][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 201.061290][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 201.061300][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 201.061307][ C0] xen_timer_callback+0x109/0x220
[ 201.061315][ C0] ? __pfx_xen_timer_callback+0x10/0x10
[ 201.061322][ C0] __hrtimer_run_queues+0x371/0xa10
[ 201.061331][ C0] hrtimer_interrupt+0x448/0x910
[ 201.061340][ C0] __sysvec_apic_timer_interrupt+0x102/0x430
[ 201.061352][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0
[ 201.061363][ C0]
[ 201.061365][ C0]
[ 201.061367][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 201.061377][ C0] RIP: 0010:lock_acquire+0x221/0x350
[ 201.061390][ C0] Code: ff ff ff e8 51 0d 30 0a f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 db b7 ca 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 80 10 33 0a cc 48 8d 3d e8 42 b8
[ 201.061397][ C0] RSP: 0018:ffffc9000fc9f940 EFLAGS: 00000282
[ 201.061408][ C0] RAX: 251f8018e9938f00 RBX: 0000000000000000 RCX: 0000000000000046
[ 201.061415][ C0] RDX: 0000000000030000 RSI: ffffffff8e4b0c2e RDI: ffffffff8c4bce80
[ 201.061422][ C0] RBP: ffffffff8234436a R08: ffffc9000fc9f760 R09: 0000000000000020
[ 201.061429][ C0] R10: 0000000000000000 R11: ffffffff81a324e0 R12: 0000000000000002
[ 201.061435][ C0] R13: ffffffff8ec9c138 R14: 0000000000000001 R15: 0000000000000246
[ 201.061442][ C0] ? __mmu_notifier_invalidate_range_start+0x5ba/0xb70
[ 201.061454][ C0] ? __pfx_hlock_conflict+0x10/0x10
[ 201.061469][ C0] __mmu_notifier_invalidate_range_start+0x5de/0xb70
[ 201.061479][ C0] ? __mmu_notifier_invalidate_range_start+0x5ba/0xb70
[ 201.061491][ C0] ? __mmu_notifier_invalidate_range_start+0x5ba/0xb70
[ 201.061502][ C0] ? __pfx___mmu_notifier_invalidate_range_start+0x10/0x10
[ 201.061515][ C0] do_wp_page+0x37c5/0x4c70
[ 201.061531][ C0] ? do_wp_page+0x375f/0x4c70
[ 201.061544][ C0] ? __pfx_do_wp_page+0x10/0x10
[ 201.061555][ C0] ? do_raw_spin_lock+0x12b/0x2f0
[ 201.061565][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 201.061576][ C0] handle_mm_fault+0x1490/0x3080
[ 201.061593][ C0] ? handle_mm_fault+0xec/0x3080
[ 201.061606][ C0] ? __pfx_handle_mm_fault+0x10/0x10
[ 201.061622][ C0] ? lock_mm_and_find_vma+0xa7/0x340
[ 201.061632][ C0] do_user_addr_fault+0x744/0x1340
[ 201.061650][ C0] exc_page_fault+0x6a/0xc0
[ 201.061663][ C0] asm_exc_page_fault+0x26/0x30
[ 201.061672][ C0] RIP: 0033:0x7f1a7099e0eb
[ 201.061683][ C0] Code: 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 <64> 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41
[ 201.061690][ C0] RSP: 002b:00007ffcd38ae7f8 EFLAGS: 00010213
[ 201.061701][ C0] RAX: 000000000000006e RBX: 0000000000030edc RCX: ffffffffffffffe8
[ 201.061708][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1a70c25fac
[ 201.061714][ C0] RBP: 0000000000000032 R08: 3fffffffffffffff R09: 0000000000000000
[ 201.061721][ C0] R10: 00007ffcd38ae900 R11: 0000000000000246 R12: 00007ffcd38ae920
[ 201.061727][ C0] R13: 00007f1a70c25fac R14: 0000000000030f0e R15: 00007ffcd38ae900
[ 201.061739][ C0]
[ 201.511587][ T5323] loop0: detected capacity change from 0 to 24
[ 201.554925][ T5323] romfs: Unknown parameter ''
[ 201.720077][ T5289] udevd[5289]: incorrect romfs checksum on /dev/loop0