=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
syz.0.0/5319 is trying to lock:
ffff88804ec6dbb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0 arch/x86/kvm/xen.c:1822
other info that might help us debug this:
context-{2:2}
locks held by syz.0.0/5319: 3, last CPU#0:
 #0: ffff8880347100a8 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x27f/0xfd0 virt/kvm/kvm_main.c:4438
 #1: ffff88804ec6e110 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
 #1: ffff88804ec6e110 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
 #1: ffff88804ec6e110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_vcpu_srcu_read_lock include/linux/kvm_host.h:963 [inline]
 #1: ffff88804ec6e110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_arch_vcpu_ioctl_run+0x2ba/0x2010 arch/x86/kvm/x86.c:11972
 #2: ffff88804ec6e110 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
 #2: ffff88804ec6e110 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
 #2: ffff88804ec6e110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0 arch/x86/kvm/xen.c:1820
stack backtrace:
CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4846 [inline]
 check_wait_context kernel/locking/lockdep.c:4918 [inline]
 __lock_acquire+0xe39/0x2cf0 kernel/locking/lockdep.c:5203
 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
 _raw_read_lock_irqsave+0x48/0x60 kernel/locking/spinlock.c:271
 kvm_xen_set_evtchn_fast+0x1f4/0x9a0 arch/x86/kvm/xen.c:1822
 xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
 __run_hrtimer kernel/time/hrtimer.c:2067 [inline]
 __hrtimer_run_queues+0x371/0xa10 kernel/time/hrtimer.c:2124
 hrtimer_interrupt+0x4cd/0xaa0 kernel/time/hrtimer.c:2243
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:seqcount_lockdep_reader_access+0xec/0x100 include/linux/seqlock.h:76
Code: 00 75 11 e8 66 65 82 00 4d 85 ff 75 16 e8 5c 65 82 00 eb 15 e8 55 65 82 00 e8 50 05 99 0a 4d 85 ff 74 ea e8 46 65 82 00 fb 5b <41> 5e 41 5f e9 9b 0c 9c 0a cc 66 2e 0f 1f 84 00 00 00 00 00 90 90
RSP: 0018:ffffc9000ddbf448 EFLAGS: 00000246
RAX: ffffffff8144cf7a RBX: ffff88804ec6d878 RCX: 0000000000100000
RDX: ffffc9000f391000 RSI: 00000000000fffff RDI: 0000000000100000
RBP: ffffc9000ddbf5d0 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46
R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: ffffc9000ddbf540
R13: 1ffff11009d8db16 R14: ffffffff8144c165 R15: 0000000000000200
 kvm_guest_time_update+0x145/0xe60 arch/x86/kvm/x86.c:3309
 vcpu_enter_guest arch/x86/kvm/x86.c:11149 [inline]
 vcpu_run+0x156c/0x7950 arch/x86/kvm/x86.c:11707
 kvm_arch_vcpu_ioctl_run+0x13ed/0x2010 arch/x86/kvm/x86.c:12062
 kvm_vcpu_ioctl+0xa61/0xfd0 virt/kvm/kvm_main.c:4470
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0045f9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0046dc6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0046226090 RCX: 00007f0045f9e0d9
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000d
RBP: 00007f0046035024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0046226128 R14: 00007f0046226090 R15: 00007fff5d783e48
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 75 11             	add    %dh,0x11(%rbp)
   3:	e8 66 65 82 00       	call   0x82656e
   8:	4d 85 ff             	test   %r15,%r15
   b:	75 16                	jne    0x23
   d:	e8 5c 65 82 00       	call   0x82656e
  12:	eb 15                	jmp    0x29
  14:	e8 55 65 82 00       	call   0x82656e
  19:	e8 50 05 99 0a       	call   0xa99056e
  1e:	4d 85 ff             	test   %r15,%r15
  21:	74 ea                	je     0xd
  23:	e8 46 65 82 00       	call   0x82656e
  28:	fb                   	sti
  29:	5b                   	pop    %rbx
* 2a:	41 5e                	pop    %r14 <-- trapping instruction
  2c:	41 5f                	pop    %r15
  2e:	e9 9b 0c 9c 0a       	jmp    0xa9c0cce
  33:	cc                   	int3
  34:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  3b:	00 00 00
  3e:	90                   	nop
  3f:	90                   	nop