program: r0 = socket$inet(0x2, 0x3, 0x4) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f\x00', 0x1ff) swapoff(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f/dwFrameInterval\x00') connect$inet(r0, &(0x7f0000000080)={0x2, 0x4f20, @loopback}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20010000030a010100000000000000000700000914000c00bcdf4591debd57f27df5eaea554c23610c000480080001400002000461000c006349ee096d2d8371d94cd866b1f8ee2a6282b4ee0aa7f6bad5828d340136e108b190e6f73f2f60b7e8fc678ffff320dde201181d1ed5b14f3116d1148694070602b1ad28d768df6d38d9e47bec035e70c5df2b0c3b0af9739ae48106870000000c0002400000000000000002700008800c00024000000000000001ff0c00024000000000000000f50b00024000000000000000060c00014000000000000000060c00024000000004c90000000c00014000000000000000060c00014000000000000000080c00024000000000000000000c0002400000000000000004bc010000080a01010000000000000000030000060900020073796e0e560f00000000058008000140000088e508000240000000000800024000000000080001400000001644000580080001400000006c08000140000008060800014000000006080002400000000108000140000000330800024000000002b700014000008100080001400000001cee00074046b52c5816829c799b64d03fd4aca7136df00120d2ce682cd05cef4e2612b1ca9808a73c6f221ff1cba42619f5653c86e1ad1cfd77a6192fb01a0282d9df7af906508beea10fb69ce92e8f2ee2ebd07fdad7852cc39c45a81854908e4303938ed7a71679906287652945a7cf0fd6fd965ae5afe11ed8519812b46c1be57696c69360d3fa7fb2b6a79f42159eb03708e096dd4ce038d74351199598a58d7e8933c5374c26697a2d32c93f2bc5937ac9dcf53b22f2536ef15779e2bb8800ae0da784a317f0d6d044eeb7d4e319ba1dbd6a254f2bc9a9c2d2a96feb2c0e94c178c9c62c0823a08ec0afd63e00000c00064000000000000000050c000640000000000000000108000b400000000218000480140001800e000100696d6d6564696174650000000c000640000000000000000460000000140a010200000000000000000a0000070c000640000000000000000208000340000000040c000640000000000000000108000340000000040900020073797a30000000000c000640000000a0f3ffff050c0006400000000000000001140000001100010000000000000000000000000a"], 0x364}}, 0x40000c9) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl(r4, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff") r5 = socket$nl_route(0x10, 0x3, 0x0) syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000bff000/0x400000)=nil) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000000)=0x5, 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1c}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x9}]}, @NFT_MSG_NEWSETELEM={0x2c, 0x1e, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001000010025bd7000f9dbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1588040011afd0e008001b0000000000"], 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r7, 0xc02c564a, &(0x7f0000000000)={0x0, 0x47425247}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000007c0)={'vxcan0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r11, {0x0, 0xf}, {0xfff1, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x40004}, 0x0) sendmmsg$inet(r0, &(0x7f0000000880)=[{{&(0x7f00000005c0)={0x2, 0x4e22, @broadcast}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000600)="efa20f5a6d80c3d1d76d7c65df937479746aa96f266784becf754114ec616a4dff658302cad2244446666ee6c157006eba9ad9351620606b53b5a1356af646b0cc4db67e3f76879ccdb40ca7e34f0e9c5bd66f11bddd65dbd359fcc6477bc3f48e97582c61ac", 0x66}, {&(0x7f0000000680)="cdbc05a3c730d4efa71f8590740339e180570972b4132080a57f23f14ef15cbb96729b5500de8156d55c938ac5692168bb538c608497e0e144e2b16368ca77ef2ed44741d72ac70db97d8c17cbf06987ce8d5d1d93d500d60d929c3575b471884bcc9f357c643708bdd246be114940112704b7c6f33a07b4f34218ff4ed9dff54b13f64f66", 0x85}, {&(0x7f0000000740)="fdd6532c1d6910f9842a95dfbadf70d6ce27fa7dcde66091f8688bf8876370dfd15e985a1c8d6a557a846c3bb0d76230484ec3", 0x33}], 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="2800000000000000000000000700000001830b9191978b4bee0a726e440c4fe1ac1414bb000000051c000000000000000000000008000000", @ANYRES32=r8, @ANYBLOB="ac1e0101e0000001000000001c000000000000000000000008000000", @ANYRES32=r11, @ANYBLOB="ac0305000000000000000000"], 0x68}}], 0x1, 0x40805) [ 102.810592][ T4642] Bluetooth: hci0: command tx timeout [ 102.964336][ T24] audit: type=1800 audit(1786643103.888:2): pid=5321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="dwFrameInterval" dev="configfs" ino=4250 res=0 errno=0 [ 103.144985][ C0] [ 103.146271][ C0] ============================= [ 103.148757][ C0] [ BUG: Invalid wait context ] [ 103.150918][ C0] syzkaller #0 Not tainted [ 103.152997][ C0] ----------------------------- [ 103.155391][ C0] syz.0.0/5320 is trying to lock: [ 103.158044][ C0] ffff888052285bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.162647][ C0] other info that might help us debug this: [ 103.165239][ C0] context-{2:2} [ 103.166807][ C0] 3 locks held by syz.0.0/5320: [ 103.168997][ C0] #0: ffff888011d2ac90 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x19a/0x520 [ 103.173704][ C0] #1: ffff8880122b1270 (&lockref->lock){+.+.}-{3:3}, at: dentry_kill+0x27f/0x880 [ 103.177528][ C0] #2: ffff888052286110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0 [ 103.182148][ C0] stack backtrace: [ 103.184412][ C0] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.184431][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.184439][ C0] Call Trace: [ 103.184448][ C0] [ 103.184455][ C0] dump_stack_lvl+0xe8/0x150 [ 103.184478][ C0] __lock_acquire+0xe39/0x2cf0 [ 103.184495][ C0] ? __lock_acquire+0x683/0x2cf0 [ 103.184511][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.184524][ C0] lock_acquire+0x106/0x350 [ 103.184537][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.184550][ C0] ? xa_load+0x1db/0x210 [ 103.184604][ C0] _raw_read_lock_irqsave+0x48/0x60 [ 103.184616][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.184627][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 103.184639][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0 [ 103.184649][ C0] xen_timer_callback+0x109/0x220 [ 103.184662][ C0] ? __pfx_xen_timer_callback+0x10/0x10 [ 103.184674][ C0] __hrtimer_run_queues+0x371/0xa10 [ 103.184687][ C0] hrtimer_interrupt+0x448/0x910 [ 103.184701][ C0] __sysvec_apic_timer_interrupt+0x102/0x430 [ 103.184714][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 103.184729][ C0] [ 103.184732][ C0] [ 103.184736][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 103.184749][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 103.184761][ C0] Code: f7 e8 2d ed cd f5 f7 c3 00 02 00 00 74 05 e8 e0 dd f9 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 c4 00 bf f5 65 8b 05 bd 00 98 07 85 c0 74 18 5b 41 5e c3 cc cc [ 103.184770][ C0] RSP: 0018:ffffc9000de4fa70 EFLAGS: 00000206 [ 103.184783][ C0] RAX: 0000000000000006 RBX: 0000000000000286 RCX: 0000000080000002 [ 103.184790][ C0] RDX: 0000000000000006 RSI: ffffffff8e22bc06 RDI: 0000000000000001 [ 103.184797][ C0] RBP: ffff8880432d3a90 R08: ffffffff90576d37 R09: 1ffffffff20aeda6 [ 103.184804][ C0] R10: dffffc0000000000 R11: fffffbfff20aeda7 R12: ffffffff8bee2850 [ 103.184810][ C0] R13: ffff8880432d3a80 R14: ffffffff9aa8aed8 R15: 1ffff1100865a752 [ 103.184822][ C0] debug_object_activate+0x2ec/0x420 [ 103.184879][ C0] ? __pfx___d_free+0x10/0x10 [ 103.184895][ C0] call_rcu+0x43/0x8b0 [ 103.184913][ C0] ? do_raw_spin_unlock+0x4d/0x210 [ 103.184925][ C0] dentry_kill+0x4d3/0x880 [ 103.184940][ C0] finish_dput+0x1a/0x260 [ 103.184951][ C0] find_next_child+0x1e7/0x250 [ 103.184963][ C0] __simple_recursive_removal+0x10b/0x520 [ 103.184974][ C0] ? __pfx_remove_one+0x10/0x10 [ 103.184987][ C0] debugfs_remove+0x5b/0x70 [ 103.184998][ C0] kvm_put_kvm+0x147/0xb50 [ 103.185015][ C0] ? _raw_spin_unlock_irq+0x45/0x50 [ 103.185025][ C0] ? __pfx_kvm_vm_release+0x10/0x10 [ 103.185039][ C0] kvm_vm_release+0x43/0x50 [ 103.185058][ C0] __fput+0x418/0xa50 [ 103.185072][ C0] task_work_run+0x1d9/0x270 [ 103.185089][ C0] ? __pfx_task_work_run+0x10/0x10 [ 103.185104][ C0] exit_to_user_mode_loop+0x1fa/0x730 [ 103.185118][ C0] ? rcu_is_watching+0x15/0xb0 [ 103.185132][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.185142][ C0] do_syscall_64+0x353/0x580 [ 103.185155][ C0] ? clear_bhb_loop+0x70/0xc0 [ 103.185166][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.185176][ C0] RIP: 0033:0x7f011819e0d9 [ 103.185204][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.185211][ C0] RSP: 002b:00007ffc46862318 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 103.185223][ C0] RAX: 0000000000000000 RBX: 00007ffc46862400 RCX: 00007f011819e0d9 [ 103.185229][ C0] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 103.185235][ C0] RBP: 000000000001913e R08: 0000000000000001 R09: 0000000000000000 [ 103.185240][ C0] R10: 00007f0117fff030 R11: 0000000000000246 R12: 00007ffc46862440 [ 103.185245][ C0] R13: 00007f0118425fac R14: 0000000000019253 R15: 00007f0118425fa0 [ 103.185255][ C0]