program:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x14)
sendmsg$netlink(r2, &(0x7f0000003f40)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)={0x10, 0x1002, 0x300}, 0x10}], 0x1, 0x0, 0x0, 0x800}, 0x10)
socket$netlink(0x10, 0x3, 0x10) (async)
r3 = socket$netlink(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000280), 0x620280, 0x0) (async)
r5 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000280), 0x620280, 0x0)
ioctl$RTC_PLL_SET(r5, 0x40207012, &(0x7f00000002c0)={0x8, 0x3ff, 0x7, 0xc, 0x12, 0x8, 0x6})
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000006800)={&(0x7f0000000080)={0x44, r4, 0x615, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x44}, 0x5}, 0x0)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000240)={&(0x7f0000000140), 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, r4, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf9}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xfb}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x8010) (async)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000240)={&(0x7f0000000140), 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, r4, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf9}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xfb}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x8010)
r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r6, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
socket$inet6_udp(0xa, 0x2, 0x0) (async)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
getsockopt$inet_mreqsrc(r8, 0x0, 0x26, &(0x7f0000000100)={@loopback, @private, @remote}, &(0x7f00000000c0)=0xc)
sendmmsg$inet6(r7, &(0x7f0000002e80)=[{{&(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c, 0x0, 0x0, 0x0, 0xffffffffffffffca}}, {{&(0x7f0000000080)={0xa, 0x4e20, 0x3b2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8}, 0x1c, 0x0, 0x0, &(0x7f0000000140), 0x30}}], 0x2, 0x24000884)
[ 87.964966][ T4638] Bluetooth: hci0: command tx timeout
[ 88.209477][ C0]
[ 88.210778][ C0] =============================
[ 88.213560][ C0] [ BUG: Invalid wait context ]
[ 88.215870][ C0] syzkaller #0 Not tainted
[ 88.217930][ C0] -----------------------------
[ 88.220334][ C0] syz.0.0/5309 is trying to lock:
[ 88.222912][ C0] ffff88804f049bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 88.227749][ C0] other info that might help us debug this:
[ 88.230748][ C0] context-{2:2}
[ 88.232519][ C0] 1 lock held by syz.0.0/5309:
[ 88.234934][ C0] #0: ffff88804f04a110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 88.239831][ C0] stack backtrace:
[ 88.241560][ C0] CPU: 0 UID: 0 PID: 5309 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 88.241578][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.241585][ C0] Call Trace:
[ 88.241593][ C0]
[ 88.241599][ C0] dump_stack_lvl+0xe8/0x150
[ 88.241619][ C0] __lock_acquire+0xe39/0x2cf0
[ 88.241635][ C0] ? __lock_acquire+0x683/0x2cf0
[ 88.241651][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 88.241665][ C0] lock_acquire+0x106/0x350
[ 88.241678][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 88.241691][ C0] ? xa_load+0x1db/0x210
[ 88.241752][ C0] _raw_read_lock_irqsave+0x48/0x60
[ 88.241766][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 88.241779][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 88.241793][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 88.241805][ C0] xen_timer_callback+0x109/0x220
[ 88.241819][ C0] ? __pfx_xen_timer_callback+0x10/0x10
[ 88.241831][ C0] __hrtimer_run_queues+0x371/0xa10
[ 88.241845][ C0] hrtimer_interrupt+0x448/0x910
[ 88.241863][ C0] __sysvec_apic_timer_interrupt+0x102/0x430
[ 88.241875][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0
[ 88.241889][ C0]
[ 88.241892][ C0]
[ 88.241896][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 88.241909][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
[ 88.241923][ C0] Code: f7 e8 2d dd cd f5 f7 c3 00 02 00 00 74 05 e8 e0 cd f9 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 c4 f0 be f5 65 8b 05 bd f0 97 07 85 c0 74 18 5b 41 5e c3 cc cc
[ 88.241933][ C0] RSP: 0018:ffffc9000daa7c38 EFLAGS: 00000206
[ 88.241946][ C0] RAX: 0000000000000006 RBX: 0000000000000286 RCX: 0000000080000001
[ 88.241953][ C0] RDX: 0000000000000000 RSI: ffffffff8e22bc06 RDI: 0000000000000001
[ 88.241960][ C0] RBP: dffffc0000000000 R08: ffffffff90576d37 R09: 1ffffffff20aeda6
[ 88.241967][ C0] R10: dffffc0000000000 R11: fffffbfff20aeda7 R12: 1ffff11009e09410
[ 88.241975][ C0] R13: dffffc0000000000 R14: ffffffff8ec9c248 R15: 0000000000000000
[ 88.241988][ C0] synchronize_srcu+0x20/0x260
[ 88.242003][ C0] mmu_notifier_unregister+0x2c7/0x3c0
[ 88.242016][ C0] ? mmu_notifier_unregister+0xad/0x3c0
[ 88.242027][ C0] kvm_put_kvm+0x688/0xb50
[ 88.242044][ C0] ? _raw_spin_unlock_irq+0x2e/0x50
[ 88.242054][ C0] ? __pfx_kvm_vm_release+0x10/0x10
[ 88.242068][ C0] kvm_vm_release+0x43/0x50
[ 88.242082][ C0] __fput+0x418/0xa50
[ 88.242095][ C0] task_work_run+0x1d9/0x270
[ 88.242112][ C0] ? __pfx_task_work_run+0x10/0x10
[ 88.242129][ C0] exit_to_user_mode_loop+0x1fa/0x730
[ 88.242143][ C0] ? rcu_is_watching+0x15/0xb0
[ 88.242159][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.242170][ C0] do_syscall_64+0x353/0x580
[ 88.242183][ C0] ? trace_irq_disable+0x3b/0x140
[ 88.242196][ C0] ? clear_bhb_loop+0x70/0xc0
[ 88.242207][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.242219][ C0] RIP: 0033:0x7f8173d9e0d9
[ 88.242230][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.242239][ C0] RSP: 002b:00007fff05190398 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 88.242250][ C0] RAX: 0000000000000000 RBX: 00007fff05190480 RCX: 00007f8173d9e0d9
[ 88.242256][ C0] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 88.242263][ C0] RBP: 0000000000015734 R08: 0000000000000001 R09: 0000000000000000
[ 88.242270][ C0] R10: 00007f8173bff02c R11: 0000000000000246 R12: 00007fff051904c0
[ 88.242276][ C0] R13: 00007f8174025fac R14: 00000000000157fd R15: 00007f8174025fa0
[ 88.242289][ C0]