=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G             L     Y
-----------------------------
udevd/14952 is trying to lock:
ffff88804b521bc8 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x255/0xd70 arch/x86/kvm/xen.c:1872
other info that might help us debug this:
context-{2:2}
locks held by udevd/14952: 1, last CPU#0:
 #0: ffff88804b522118 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline]
 #0: ffff88804b522118 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:320 [inline]
 #0: ffff88804b522118 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x23b/0xd70 arch/x86/kvm/xen.c:1870
stack backtrace:
CPU: 0 UID: 0 PID: 14952 Comm: udevd Tainted: G             L     Y syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4874 [inline]
 check_wait_context kernel/locking/lockdep.c:4946 [inline]
 __lock_acquire+0xfcc/0x1f40 kernel/locking/lockdep.c:5238
 lock_acquire kernel/locking/lockdep.c:5942 [inline]
 lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:174 [inline]
 _raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:271
 kvm_xen_set_evtchn_fast+0x255/0xd70 arch/x86/kvm/xen.c:1872
 xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:139
 __run_hrtimer kernel/time/hrtimer.c:2075 [inline]
 __hrtimer_run_queues+0x135/0x9a0 kernel/time/hrtimer.c:2132
 hrtimer_interrupt+0x441/0xaa0 kernel/time/hrtimer.c:2251
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x109/0x470 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__fget_light fs/file.c:1345 [inline]
RIP: 0010:fdget+0x162/0x210 fs/file.c:1357
Code: 4d e8 d2 ad 66 ff 48 8d 7b 40 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 04 3c 03 7e 7b 8b 6b 40 <31> ff 81 e5 00 40 00 00 89 ee e8 0f a8 66 ff 85 ed 75 11 e8 96 ad
RSP: 0018:ffffc9000346fde8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff8880280bb340 RCX: 0000000000000000
RDX: 1ffff11005017670 RSI: ffffffff82a7a50e RDI: ffff8880280bb380
RBP: 000000000c2e0003 R08: 0000000000000000 R09: ffff8880280bb340
R10: ffff88802c69bc03 R11: 0000000000000000 R12: ffffffffffffffff
R13: 0000000000000000 R14: 0000000000000000 R15: ffffc9000346fe38
 class_fd_constructor include/linux/file.h:84 [inline]
 __sys_sendmsg+0xbd/0x210 net/socket.c:2793
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffa762a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffdfc0fa0b0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffa7693e880 RCX: 00007ffa762a7407
RDX: 0000000000000000 RSI: 00007ffdfc0fa110 RDI: 000000000000000c
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000076
R13: 0000555b58247d90 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	4d e8 d2 ad 66 ff    	rex.WRB call 0xff66add8
   6:	48 8d 7b 40          	lea    0x40(%rbx),%rdi
   a:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  11:	fc ff df
  14:	48 89 fa             	mov    %rdi,%rdx
  17:	48 c1 ea 03          	shr    $0x3,%rdx
  1b:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax
  1f:	84 c0                	test   %al,%al
  21:	74 04                	je     0x27
  23:	3c 03                	cmp    $0x3,%al
  25:	7e 7b                	jle    0xa2
  27:	8b 6b 40             	mov    0x40(%rbx),%ebp
* 2a:	31 ff                	xor    %edi,%edi <-- trapping instruction
  2c:	81 e5 00 40 00 00    	and    $0x4000,%ebp
  32:	89 ee                	mov    %ebp,%esi
  34:	e8 0f a8 66 ff       	call   0xff66a848
  39:	85 ed                	test   %ebp,%ebp
  3b:	75 11                	jne    0x4e
  3d:	e8                   	.byte 0xe8
  3e:	96                   	xchg   %eax,%esi
  3f:	ad                   	lods   %ds:(%rsi),%eax