=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz.6.3261/18237 is trying to lock:
ffff8880295212e0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
2 locks held by syz.6.3261/18237:
#0: ffff888013e1a038 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x255/0xc30 net/unix/af_unix.c:2568
#1: ffff888029521840 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffff888029521840 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#1: ffff888029521840 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x245/0xe80 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 2 UID: 0 PID: 18237 Comm: syz.6.3261 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xfa4/0x2630 kernel/locking/lockdep.c:5187
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1785 [inline]
__hrtimer_run_queues+0x1ad/0xa70 kernel/time/hrtimer.c:1849
hrtimer_interrupt+0x397/0x8c0 kernel/time/hrtimer.c:1911
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
__sysvec_apic_timer_interrupt+0x109/0x490 arch/x86/kernel/apic/apic.c:1062
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__mutex_lock+0x2aa/0x1b90 kernel/locking/mutex.c:777
Code: ff ff 48 b8 00 00 00 00 00 fc ff df 48 01 c1 48 c7 01 00 00 00 00 48 c7 41 08 00 00 00 00 48 c7 41 10 00 00 00 00 48 8b 45 c8 <65> 48 2b 05 e6 83 7e 08 0f 85 cc 15 00 00 48 8d 65 d0 89 d0 5b 41
RSP: 0018:ffffc9000c4af670 EFLAGS: 00000282
RAX: 81742545fe45ee00 RBX: 0000000080000000 RCX: fffff52001895edc
RDX: 0000000000000000 RSI: ffffffff8c1af8a0 RDI: 0000000000000001
RBP: ffffc9000c4af7f0 R08: 0000000000000000 R09: fffffbfff21b35c2
R10: ffffffff90d9ae17 R11: 0000000000000000 R12: ffff88804e8c4980
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88804e8c4980
__unix_dgram_recvmsg+0x255/0xc30 net/unix/af_unix.c:2568
unix_dgram_recvmsg+0xd0/0x110 net/unix/af_unix.c:2670
sock_recvmsg_nosec net/socket.c:1078 [inline]
____sys_recvmsg+0x5b3/0x640 net/socket.c:2810
___sys_recvmsg+0x16a/0x1a0 net/socket.c:2854
do_recvmmsg+0x563/0x760 net/socket.c:2941
__sys_recvmmsg+0x21f/0x270 net/socket.c:3023
__do_compat_sys_recvmmsg_time32 net/compat.c:418 [inline]
__se_compat_sys_recvmmsg_time32 net/compat.c:414 [inline]
__ia32_compat_sys_recvmmsg_time32+0xc4/0x160 net/compat.c:414
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7fa8f6c
Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8
RSP: 002b:00000000f544550c EFLAGS: 00000292 ORIG_RAX: 0000000000000151
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0
RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess), 1 bytes skipped:
0: ff 48 b8 decl -0x48(%rax)
3: 00 00 add %al,(%rax)
5: 00 00 add %al,(%rax)
7: 00 fc add %bh,%ah
9: ff lcall (bad)
a: df 48 01 fisttps 0x1(%rax)
d: c1 48 c7 01 rorl $0x1,-0x39(%rax)
11: 00 00 add %al,(%rax)
13: 00 00 add %al,(%rax)
15: 48 c7 41 08 00 00 00 movq $0x0,0x8(%rcx)
1c: 00
1d: 48 c7 41 10 00 00 00 movq $0x0,0x10(%rcx)
24: 00
25: 48 8b 45 c8 mov -0x38(%rbp),%rax
* 29: 65 48 2b 05 e6 83 7e sub %gs:0x87e83e6(%rip),%rax # 0x87e8417 <-- trapping instruction
30: 08
31: 0f 85 cc 15 00 00 jne 0x1603
37: 48 8d 65 d0 lea -0x30(%rbp),%rsp
3b: 89 d0 mov %edx,%eax
3d: 5b pop %rbx
3e: 41 rex.B