program:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x20001, 0x0)
setns(0xc9, 0x0) (async)
setns(0xc9, 0x0)
r1 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async)
bind$rds(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
sendmsg$rds(r1, &(0x7f00000001c0)={&(0x7f0000000200)={0x2, 0x4e21, @private=0xa010102}, 0x10, 0x0, 0x0, &(0x7f0000000240)=[@rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000000300)=""/221, 0xdd}, 0x0, 0x2}}], 0x30, 0x40}, 0x0) (async)
sendmsg$rds(r1, &(0x7f00000001c0)={&(0x7f0000000200)={0x2, 0x4e21, @private=0xa010102}, 0x10, 0x0, 0x0, &(0x7f0000000240)=[@rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000000300)=""/221, 0xdd}, 0x0, 0x2}}], 0x30, 0x40}, 0x0)
ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f00000002c0)={0x1, 0x0, [{0xce, 0x0, 0xffffffff}]})
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="140000e7780280000358b6ca1189000000000000", @ANYRES32, @ANYRESDEC=r0, @ANYRES16, @ANYRES32, @ANYBLOB='\x00'/16], 0x48)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r2, &(0x7f0000000280), 0x0}, 0x20)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
syz_init_net_socket$llc(0x1a, 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0xa002, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
connect$bt_l2cap(r6, &(0x7f0000000400)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000000440)={r6, r6, 0xa, 0x4b, 0x0, 0x5, 0x0, 0x46d, 0xa0e, 0x8, 0x3, 0xffffff80, 'syz1\x00'}) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000000440)={r6, r6, 0xa, 0x4b, 0x0, 0x5, 0x0, 0x46d, 0xa0e, 0x8, 0x3, 0xffffff80, 'syz1\x00'})
ioctl$KVM_GET_VCPU_EVENTS(r5, 0x4048aecb, &(0x7f0000000040)) (async)
ioctl$KVM_GET_VCPU_EVENTS(r5, 0x4048aecb, &(0x7f0000000040))
syz_open_dev$I2C(&(0x7f0000000280), 0x0, 0x82000) (async)
r8 = syz_open_dev$I2C(&(0x7f0000000280), 0x0, 0x82000)
ioctl$I2C_SLAVE_FORCE(r8, 0x706, 0x40316)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async)
r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r9, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
write$binfmt_misc(r9, &(0x7f00000000c0), 0xd)
ioctl$NILFS_IOCTL_SYNC(r9, 0x80086e8a, &(0x7f0000000140))
[ 102.753648][ T4652] Bluetooth: hci0: command tx timeout
[ 102.984431][ T5341] ------------[ cut here ]------------
[ 102.984447][ T5341] raw_local_irq_restore() called with IRQs enabled
[ 102.984452][ T5341] WARNING: kernel/locking/irqflag-debug.c:10 at warn_bogus_irq_restore+0xc/0x20, CPU#0: syz.0.0/5341
[ 102.995855][ T5341] Modules linked in:
[ 102.999787][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.003890][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.007926][ T5341] RIP: 0010:warn_bogus_irq_restore+0xc/0x20
[ 103.010480][ T5341] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 90 48 8d 3d 74 f9 92 05 <67> 48 0f b9 3a 90 e9 89 04 03 00 cc cc cc cc cc cc cc cc cc 90 90
[ 103.018448][ T5341] RSP: 0018:ffffc9000e617620 EFLAGS: 00010206
[ 103.021246][ T5341] RAX: 0000000000000202 RBX: 0000000000000287 RCX: 0000000000000000
[ 103.024673][ T5341] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff917dcf80
[ 103.028064][ T5341] RBP: ffffc9000e6177a0 R08: ffffffff914a1223 R09: 1ffffffff2294244
[ 103.031553][ T5341] R10: dffffc0000000000 R11: fffffbfff2294245 R12: ffffffff8b2adca5
[ 103.035026][ T5341] R13: ffff88801fbcf318 R14: ffffffff914a1220 R15: 0000000000000287
[ 103.038591][ T5341] FS: 00007feedea106c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
[ 103.042426][ T5341] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 103.045163][ T5341] CR2: 00007feedea0ffe8 CR3: 0000000012ef3000 CR4: 0000000000352ef0
[ 103.048603][ T5341] Call Trace:
[ 103.051344][ T5341]
[ 103.052791][ T5341] _raw_spin_unlock_irqrestore+0x67/0x80
[ 103.055343][ T5341] __rds_conn_create+0x1de5/0x2290
[ 103.059072][ T5341] ? __rds_conn_create+0x2d5/0x2290
[ 103.061811][ T5341] ? __pfx___rds_conn_create+0x10/0x10
[ 103.064523][ T5341] ? trace_kmalloc+0x2a/0xf0
[ 103.066726][ T5341] ? __raw_spin_lock_init+0x45/0x100
[ 103.069185][ T5341] rds_conn_create_outgoing+0x43/0x60
[ 103.071558][ T5341] rds_sendmsg+0xfca/0x20e0
[ 103.073536][ T5341] ? __pfx_rds_sendmsg+0x10/0x10
[ 103.075596][ T5341] ? lock_acquire+0x115/0x350
[ 103.077653][ T5341] ? __pfx_aa_sk_perm+0x10/0x10
[ 103.080025][ T5341] ? aa_sock_msg_perm+0x144/0x210
[ 103.082418][ T5341] ? apparmor_socket_sendmsg+0x98/0x360
[ 103.084778][ T5341] ? __pfx_rds_sendmsg+0x10/0x10
[ 103.086952][ T5341] sock_sendmsg_nosec+0x13a/0x180
[ 103.089511][ T5341] ____sys_sendmsg+0x54e/0x850
[ 103.091562][ T5341] ? __pfx_____sys_sendmsg+0x10/0x10
[ 103.093767][ T5341] ? import_iovec+0x73/0xa0
[ 103.095873][ T5341] ___sys_sendmsg+0x2a5/0x360
[ 103.097962][ T5341] ? __lock_acquire+0x747/0x2de0
[ 103.100365][ T5341] ? __pfx____sys_sendmsg+0x10/0x10
[ 103.102562][ T5341] ? __fget_files+0x2a/0x420
[ 103.104471][ T5341] ? __fget_files+0x3a2/0x420
[ 103.106533][ T5341] __x64_sys_sendmsg+0x1b1/0x290
[ 103.108733][ T5341] ? _raw_spin_unlock_irq+0x2e/0x50
[ 103.111043][ T5341] ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 103.113327][ T5341] ? do_user_addr_fault+0xc4c/0x1340
[ 103.117398][ T5341] ? __cpu_to_node+0x41/0xe0
[ 103.119963][ T5341] do_syscall_64+0x166/0x520
[ 103.121995][ T5341] ? trace_irq_disable+0x3b/0x140
[ 103.124019][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.128364][ T5341] ? clear_bhb_loop+0x70/0xc0
[ 103.130333][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.132663][ T5341] RIP: 0033:0x7feeddb9e559
[ 103.134632][ T5341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.142431][ T5341] RSP: 002b:00007feedea0ffe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 103.145986][ T5341] RAX: ffffffffffffffda RBX: 00007feedde26180 RCX: 00007feeddb9e559
[ 103.149384][ T5341] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004
[ 103.152585][ T5341] RBP: 00007feeddc35ab8 R08: 0000000000000000 R09: 0000000000000000
[ 103.155762][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.159160][ T5341] R13: 00007feedde26218 R14: 00007feedde26180 R15: 00007ffed46c5208
[ 103.162816][ T5341]
[ 103.164123][ T5341] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 103.167073][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.170849][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.175089][ T5341] Call Trace:
[ 103.176558][ T5341]
[ 103.177846][ T5341] vpanic+0x56d/0xa60
[ 103.179627][ T5341] ? __pfx__printk+0x10/0x10
[ 103.181620][ T5341] ? __pfx_vpanic+0x10/0x10
[ 103.183594][ T5341] ? is_bpf_text_address+0x292/0x2b0
[ 103.185905][ T5341] ? is_bpf_text_address+0x26/0x2b0
[ 103.188147][ T5341] panic+0xc5/0xd0
[ 103.189732][ T5341] ? __pfx_panic+0x10/0x10
[ 103.191600][ T5341] __warn+0x315/0x4c0
[ 103.193189][ T5341] ? warn_bogus_irq_restore+0xc/0x20
[ 103.195581][ T5341] ? warn_bogus_irq_restore+0xc/0x20
[ 103.197754][ T5341] __report_bug+0x276/0x570
[ 103.199751][ T5341] ? rds_sendmsg+0xfca/0x20e0
[ 103.201737][ T5341] ? sock_sendmsg_nosec+0x13a/0x180
[ 103.203982][ T5341] ? ____sys_sendmsg+0x54e/0x850
[ 103.205993][ T5341] ? warn_bogus_irq_restore+0xc/0x20
[ 103.208258][ T5341] ? __pfx___report_bug+0x10/0x10
[ 103.210426][ T5341] report_bug_entry+0x19b/0x290
[ 103.212628][ T5341] ? warn_bogus_irq_restore+0xc/0x20
[ 103.214785][ T5341] ? warn_bogus_irq_restore+0x11/0x20
[ 103.217073][ T5341] handle_bug+0xce/0x200
[ 103.218846][ T5341] exc_invalid_op+0x1a/0x50
[ 103.221067][ T5341] asm_exc_invalid_op+0x1a/0x20
[ 103.223356][ T5341] RIP: 0010:warn_bogus_irq_restore+0xc/0x20
[ 103.225923][ T5341] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 90 48 8d 3d 74 f9 92 05 <67> 48 0f b9 3a 90 e9 89 04 03 00 cc cc cc cc cc cc cc cc cc 90 90
[ 103.234142][ T5341] RSP: 0018:ffffc9000e617620 EFLAGS: 00010206
[ 103.236778][ T5341] RAX: 0000000000000202 RBX: 0000000000000287 RCX: 0000000000000000
[ 103.240154][ T5341] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff917dcf80
[ 103.243553][ T5341] RBP: ffffc9000e6177a0 R08: ffffffff914a1223 R09: 1ffffffff2294244
[ 103.246897][ T5341] R10: dffffc0000000000 R11: fffffbfff2294245 R12: ffffffff8b2adca5
[ 103.250060][ T5341] R13: ffff88801fbcf318 R14: ffffffff914a1220 R15: 0000000000000287
[ 103.253490][ T5341] ? __rds_conn_create+0x2d5/0x2290
[ 103.256324][ T5341] _raw_spin_unlock_irqrestore+0x67/0x80
[ 103.259216][ T5341] __rds_conn_create+0x1de5/0x2290
[ 103.261930][ T5341] ? __rds_conn_create+0x2d5/0x2290
[ 103.264690][ T5341] ? __pfx___rds_conn_create+0x10/0x10
[ 103.267678][ T5341] ? trace_kmalloc+0x2a/0xf0
[ 103.269758][ T5341] ? __raw_spin_lock_init+0x45/0x100
[ 103.272112][ T5341] rds_conn_create_outgoing+0x43/0x60
[ 103.274609][ T5341] rds_sendmsg+0xfca/0x20e0
[ 103.276537][ T5341] ? __pfx_rds_sendmsg+0x10/0x10
[ 103.278373][ T5341] ? lock_acquire+0x115/0x350
[ 103.280142][ T5341] ? __pfx_aa_sk_perm+0x10/0x10
[ 103.281930][ T5341] ? aa_sock_msg_perm+0x144/0x210
[ 103.283919][ T5341] ? apparmor_socket_sendmsg+0x98/0x360
[ 103.286585][ T5341] ? __pfx_rds_sendmsg+0x10/0x10
[ 103.288973][ T5341] sock_sendmsg_nosec+0x13a/0x180
[ 103.291547][ T5341] ____sys_sendmsg+0x54e/0x850
[ 103.294072][ T5341] ? __pfx_____sys_sendmsg+0x10/0x10
[ 103.296420][ T5341] ? import_iovec+0x73/0xa0
[ 103.298450][ T5341] ___sys_sendmsg+0x2a5/0x360
[ 103.300572][ T5341] ? __lock_acquire+0x747/0x2de0
[ 103.302653][ T5341] ? __pfx____sys_sendmsg+0x10/0x10
[ 103.304826][ T5341] ? __fget_files+0x2a/0x420
[ 103.306876][ T5341] ? __fget_files+0x3a2/0x420
[ 103.308917][ T5341] __x64_sys_sendmsg+0x1b1/0x290
[ 103.311063][ T5341] ? _raw_spin_unlock_irq+0x2e/0x50
[ 103.313280][ T5341] ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 103.315492][ T5341] ? do_user_addr_fault+0xc4c/0x1340
[ 103.317545][ T5341] ? __cpu_to_node+0x41/0xe0
[ 103.319369][ T5341] do_syscall_64+0x166/0x520
[ 103.321250][ T5341] ? trace_irq_disable+0x3b/0x140
[ 103.323215][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.325713][ T5341] ? clear_bhb_loop+0x70/0xc0
[ 103.327771][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.330273][ T5341] RIP: 0033:0x7feeddb9e559
[ 103.332240][ T5341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.340334][ T5341] RSP: 002b:00007feedea0ffe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 103.343868][ T5341] RAX: ffffffffffffffda RBX: 00007feedde26180 RCX: 00007feeddb9e559
[ 103.347230][ T5341] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004
[ 103.350741][ T5341] RBP: 00007feeddc35ab8 R08: 0000000000000000 R09: 0000000000000000
[ 103.354106][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.357374][ T5341] R13: 00007feedde26218 R14: 00007feedde26180 R15: 00007ffed46c5208
[ 103.360741][ T5341]
[ 103.362567][ T5341] Kernel Offset: disabled
[ 103.364536][ T5341] Rebooting in 86400 seconds..