=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz.6.623/8215 is trying to lock:
ffff8880556612e0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
2 locks held by syz.6.623/8215:
#0: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock_dont_migrate include/linux/rcupdate.h:992 [inline]
#0: ffffffff8e7e7920 (rcu_read_lock){....}-{1:3}, at: bpf_test_timer_enter+0xc3/0x2b0 net/bpf/test_run.c:39
#1: ffff888055661840 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffff888055661840 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#1: ffff888055661840 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x245/0xe80 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 2 UID: 0 PID: 8215 Comm: syz.6.623 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xfa4/0x2630 kernel/locking/lockdep.c:5187
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1785 [inline]
__hrtimer_run_queues+0x1ad/0xa70 kernel/time/hrtimer.c:1849
hrtimer_interrupt+0x397/0x8c0 kernel/time/hrtimer.c:1911
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
__sysvec_apic_timer_interrupt+0x109/0x490 arch/x86/kernel/apic/apic.c:1062
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:get_current arch/x86/include/asm/current.h:23 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0xf/0x70 kernel/kcov.c:216
Code: 00 00 00 5b e9 a2 1b ee 02 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 8b 05 05 83 05 12 48 8b 34 24 <65> 48 8b 15 e1 82 05 12 a9 00 01 ff 00 74 1b f6 c4 01 74 07 a9 00
RSP: 0018:ffffc9000349f848 EFLAGS: 00000246
RAX: 0000000080000200 RBX: 0000000000000102 RCX: ffffc90026ad9000
RDX: 0000000000080000 RSI: ffffffff89a4d5d8 RDI: ffff8880277e0808
RBP: ffff88805bc424c0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000080 R11: ffff88801decfc00 R12: 1ffff92000693f19
R13: ffffc90005fb9000 R14: ffffc9000349f998 R15: dffffc0000000000
local_bh_enable include/linux/bottom_half.h:33 [inline]
bpf_test_run+0x298/0xa40 net/bpf/test_run.c:426
bpf_prog_test_run_skb+0x107b/0x3230 net/bpf/test_run.c:1159
bpf_prog_test_run kernel/bpf/syscall.c:4743 [inline]
__sys_bpf+0x1725/0x4b90 kernel/bpf/syscall.c:6267
__do_sys_bpf kernel/bpf/syscall.c:6362 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6360 [inline]
__x64_sys_bpf+0x7b/0xc0 kernel/bpf/syscall.c:6360
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd314d9c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd315ce2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fd315016180 RCX: 00007fd314d9c819
RDX: 0000000000000050 RSI: 0000200000000140 RDI: 000000000000000a
RBP: 00007fd314e32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd315016218 R14: 00007fd315016180 R15: 00007ffe1bc1baf8
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 5b e9 add %bl,-0x17(%rbx)
5: a2 1b ee 02 66 90 90 movabs %al,0x909090906602ee1b
c: 90 90
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: f3 0f 1e fa endbr64
1f: 65 8b 05 05 83 05 12 mov %gs:0x12058305(%rip),%eax # 0x1205832b
26: 48 8b 34 24 mov (%rsp),%rsi
* 2a: 65 48 8b 15 e1 82 05 mov %gs:0x120582e1(%rip),%rdx # 0x12058313 <-- trapping instruction
31: 12
32: a9 00 01 ff 00 test $0xff0100,%eax
37: 74 1b je 0x54
39: f6 c4 01 test $0x1,%ah
3c: 74 07 je 0x45
3e: a9 .byte 0xa9