program: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x1ff) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000000)={0x0, 0x1, 0x2, 0x0, @vifc_lcl_ifindex, @local}, 0x10) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/216, 0xd8}], 0x1, 0xa3, 0xd) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x20d3, &(0x7f0000000300)=[{&(0x7f0000000400)=""/110, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f00000006c0)=""/118, 0x1c}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0xbe8}, {&(0x7f00000007c0)=""/154, 0x53}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000001fc0)=""/191, 0xffffffffffffff52}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r1}, './proc/thread-self/fail-nth\x00'}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x4e) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl(r6, 0x4048aecb, &(0x7f0000001000)="070000000000000002000000ffffffff") ioctl$KVM_RUN(r6, 0xae80, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r3, 0xc020662a, &(0x7f0000000180)={0x8000000000000001, 0x3, 0x0, 0x7}) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x4b4a40, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x13, r7, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prctl$PR_SET_THP_DISABLE(0x29, 0x1) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB="48010000100001000000000000000000e00000020000000000000000000000000a010101000000000000000000000000000000004e2100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffdfff0000000000000000000000000000000033000000fe8000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000004000000010000000000000000000a000000000000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048460000000000000000000000000008001d00000000000800220003"], 0x148}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x0) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) [ 102.065832][ T5281] Bluetooth: hci0: command tx timeout [ 102.127939][ T5325] dvmrp0: entered allmulticast mode [ 102.336063][ C0] [ 102.337238][ C0] ============================= [ 102.339357][ C0] [ BUG: Invalid wait context ] [ 102.341461][ C0] syzkaller #0 Not tainted [ 102.343259][ C0] ----------------------------- [ 102.345284][ C0] syz.0.0/5324 is trying to lock: [ 102.347329][ C0] ffff888053999bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 102.351239][ C0] other info that might help us debug this: [ 102.353564][ C0] context-{2:2} [ 102.355019][ C0] locks held by syz.0.0/5324: 1, last CPU#0: [ 102.357616][ C0] #0: ffff88805399a110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0 [ 102.361757][ C0] stack backtrace: [ 102.363388][ C0] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.367149][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.371528][ C0] Call Trace: [ 102.373072][ C0] [ 102.374419][ C0] dump_stack_lvl+0xe8/0x150 [ 102.376473][ C0] __lock_acquire+0xf5b/0x2de0 [ 102.378648][ C0] ? __lock_acquire+0x747/0x2de0 [ 102.380941][ C0] lock_acquire+0x115/0x350 [ 102.383015][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 102.385393][ C0] ? xa_load+0x1db/0x210 [ 102.387333][ C0] _raw_read_lock_irqsave+0x48/0x60 [ 102.389586][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 102.392097][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 102.394574][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0 [ 102.397008][ C0] xen_timer_callback+0x109/0x220 [ 102.399203][ C0] ? __pfx_xen_timer_callback+0x10/0x10 [ 102.401562][ C0] __hrtimer_run_queues+0x371/0xa10 [ 102.403779][ C0] hrtimer_interrupt+0x4cd/0xaa0 [ 102.405869][ C0] __sysvec_apic_timer_interrupt+0x102/0x430 [ 102.408364][ C0] sysvec_apic_timer_interrupt+0x52/0xc0 [ 102.410827][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 102.413542][ C0] RIP: 0033:0x7f0bea072829 [ 102.416241][ C0] Code: 83 e6 07 0f 85 10 01 00 00 be 08 00 00 00 4c 89 ff 83 c5 01 e8 78 92 fe ff 49 8b 47 40 41 83 47 30 08 48 8d 48 f8 49 89 4f 40 <48> 89 58 f8 49 83 c5 01 45 3b 6c 24 04 0f 82 f4 fe ff ff 41 80 7f [ 102.424486][ C0] RSP: 002b:00007fff61c87e00 EFLAGS: 00010202 [ 102.427163][ C0] RAX: 00007f0be9bcf000 RBX: ffffffff822a8f5e RCX: 00007f0be9bceff8 [ 102.430617][ C0] RDX: 00007f0be8dff230 RSI: 0000000000000008 RDI: 00007f0beaf55720 [ 102.434060][ C0] RBP: 0000000000000077 R08: 00007f0bea410000 R09: 00007f0bea412000 [ 102.438120][ C0] R10: 00000000822a8f62 R11: 0000000000000017 R12: 00007f0bea426128 [ 102.441566][ C0] R13: 0000000000000139 R14: ffffffff822a8f5e R15: 00007f0beaf55720 [ 102.444863][ C0] ? vma_modify+0x46e/0x1bc0 [ 102.446941][ C0] ? vma_modify+0x46e/0x1bc0 [ 102.448983][ C0]