program:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0xd4}}, 0x4001)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl(r2, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff")
[ 120.859851][ T4642] Bluetooth: hci0: command tx timeout
[ 121.134488][ C0]
[ 121.136002][ C0] =============================
[ 121.138436][ C0] [ BUG: Invalid wait context ]
[ 121.140614][ C0] syzkaller #0 Not tainted
[ 121.142775][ C0] -----------------------------
[ 121.145461][ C0] syz.0.0/5321 is trying to lock:
[ 121.148394][ C0] ffff88805247dbb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 121.153725][ C0] other info that might help us debug this:
[ 121.156701][ C0] context-{2:2}
[ 121.158380][ C0] 3 locks held by syz.0.0/5321:
[ 121.160940][ C0] #0: ffff88801fd28ae0 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x19a/0x520
[ 121.167677][ C0] #1: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550
[ 121.172831][ C0] #2: ffff88805247e110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 121.177926][ C0] stack backtrace:
[ 121.179913][ C0] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 121.179933][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 121.179941][ C0] Call Trace:
[ 121.179950][ C0]
[ 121.179957][ C0] dump_stack_lvl+0xe8/0x150
[ 121.179980][ C0] __lock_acquire+0xe39/0x2cf0
[ 121.180000][ C0] ? __lock_acquire+0x683/0x2cf0
[ 121.180018][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 121.180032][ C0] lock_acquire+0x106/0x350
[ 121.180050][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 121.180066][ C0] ? xa_load+0x1db/0x210
[ 121.180147][ C0] _raw_read_lock_irqsave+0x48/0x60
[ 121.180163][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 121.180176][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 121.180191][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0
[ 121.180207][ C0] xen_timer_callback+0x109/0x220
[ 121.180222][ C0] ? __pfx_xen_timer_callback+0x10/0x10
[ 121.180237][ C0] __hrtimer_run_queues+0x371/0xa10
[ 121.180254][ C0] hrtimer_interrupt+0x448/0x910
[ 121.180266][ C0] __sysvec_apic_timer_interrupt+0x102/0x430
[ 121.180275][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0
[ 121.180286][ C0]
[ 121.180289][ C0]
[ 121.180292][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 121.180302][ C0] RIP: 0010:finish_task_switch+0x417/0xc60
[ 121.180312][ C0] Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 53 ec 3f 0a e8 be ba 39 00 fb 4c 8b 65 c8 <49> 8d bc 24 f8 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
[ 121.180320][ C0] RSP: 0018:ffffc9000e0171c0 EFLAGS: 00000202
[ 121.180329][ C0] RAX: 0000000000000a43 RBX: ffff88801fc3bf20 RCX: 0000000080000001
[ 121.180335][ C0] RDX: 0000000000000006 RSI: ffffffff8e22bc06 RDI: ffffffff8c4bcf80
[ 121.180345][ C0] RBP: ffffc9000e017210 R08: ffffffff90576d37 R09: 1ffffffff20aeda6
[ 121.180354][ C0] R10: dffffc0000000000 R11: fffffbfff20aeda7 R12: ffff888000f14a80
[ 121.180362][ C0] R13: ffff88801fc3bef8 R14: dffffc0000000000 R15: 1ffff11003f877e4
[ 121.180377][ C0] __schedule+0x17e1/0x56c0
[ 121.180392][ C0] ? lockdep_unlock+0x5d/0xd0
[ 121.180406][ C0] ? __lock_acquire+0x13e8/0x2cf0
[ 121.180460][ C0] ? __pfx___schedule+0x10/0x10
[ 121.180479][ C0] preempt_schedule_irq+0x4d/0xa0
[ 121.180493][ C0] irqentry_exit+0x14f/0x8f0
[ 121.180508][ C0] ? trace_irq_disable+0x3b/0x140
[ 121.180524][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 121.180538][ C0] RIP: 0010:unwind_next_frame+0xafc/0x2550
[ 121.180551][ C0] Code: 54 24 08 48 8d 5a 01 48 8b 44 24 30 42 0f b6 04 20 84 c0 4c 89 04 24 0f 85 26 14 00 00 48 89 dd 48 c1 ed 03 42 0f b6 44 25 00 <84> c0 0f 85 3b 14 00 00 0f b6 72 01 83 e6 07 83 fe 04 0f 84 39 04
[ 121.180562][ C0] RSP: 0018:ffffc9000e017540 EFLAGS: 00000a06
[ 121.180573][ C0] RAX: 0000000000000000 RBX: ffffffff90ea54f9 RCX: ffffffff906ddf20
[ 121.180582][ C0] RDX: ffffffff90ea54f8 RSI: ffffffff90ea54f4 RDI: ffffffff8c4bcf20
[ 121.180591][ C0] RBP: 1ffffffff21d4a9f R08: ffffc9000e017d60 R09: 0000000000000000
[ 121.180597][ C0] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: dffffc0000000000
[ 121.180602][ C0] R13: ffffffff90ea54f4 R14: ffffc9000e0175e8 R15: 1ffff92001c02ebd
[ 121.180612][ C0] ? kvm_put_kvm+0x147/0xb50
[ 121.180624][ C0] ? unwind_next_frame+0x8f/0x2550
[ 121.180631][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 121.180641][ C0] arch_stack_walk+0x11b/0x150
[ 121.180650][ C0] ? kvm_put_kvm+0x147/0xb50
[ 121.180661][ C0] stack_trace_save+0xa9/0x100
[ 121.180670][ C0] ? __pfx_stack_trace_save+0x10/0x10
[ 121.180679][ C0] ? truncate_inode_pages_range+0xc4c/0xd80
[ 121.180694][ C0] kasan_save_stack+0x3e/0x60
[ 121.180708][ C0] ? kasan_save_stack+0x3e/0x60
[ 121.180719][ C0] ? kasan_record_aux_stack+0xbd/0xd0
[ 121.180737][ C0] ? call_rcu+0xee/0x8b0
[ 121.180754][ C0] ? __destroy_inode+0x2a1/0x630
[ 121.180766][ C0] ? evict+0x8d4/0xb50
[ 121.180781][ C0] ? dentry_kill+0x1b9/0x880
[ 121.180795][ C0] ? finish_dput+0x1a/0x260
[ 121.180803][ C0] ? find_next_child+0x1e7/0x250
[ 121.180810][ C0] ? __simple_recursive_removal+0x10b/0x520
[ 121.180818][ C0] ? debugfs_remove+0x5b/0x70
[ 121.180875][ C0] ? kvm_put_kvm+0x147/0xb50
[ 121.180899][ C0] kasan_record_aux_stack+0xbd/0xd0
[ 121.180916][ C0] ? __pfx_inode_free_by_rcu+0x10/0x10
[ 121.180935][ C0] call_rcu+0xee/0x8b0
[ 121.180952][ C0] ? preempt_count_add+0x91/0x190
[ 121.180966][ C0] ? bpf_inode_storage_free+0x3f3/0x5b0
[ 121.180979][ C0] __destroy_inode+0x2a1/0x630
[ 121.180992][ C0] evict+0x8d4/0xb50
[ 121.181012][ C0] ? __pfx_evict+0x10/0x10
[ 121.181029][ C0] ? do_raw_spin_unlock+0x4d/0x210
[ 121.181043][ C0] ? _raw_spin_unlock+0x28/0x50
[ 121.181056][ C0] ? iput+0xb84/0xf00
[ 121.181065][ C0] dentry_kill+0x1b9/0x880
[ 121.181077][ C0] finish_dput+0x1a/0x260
[ 121.181086][ C0] find_next_child+0x1e7/0x250
[ 121.181094][ C0] __simple_recursive_removal+0x10b/0x520
[ 121.181103][ C0] ? __pfx_remove_one+0x10/0x10
[ 121.181113][ C0] debugfs_remove+0x5b/0x70
[ 121.181123][ C0] kvm_put_kvm+0x147/0xb50
[ 121.181137][ C0] ? _raw_spin_unlock_irq+0x2e/0x50
[ 121.181151][ C0] ? __pfx_kvm_vm_release+0x10/0x10
[ 121.181167][ C0] kvm_vm_release+0x43/0x50
[ 121.181184][ C0] __fput+0x418/0xa50
[ 121.181199][ C0] task_work_run+0x1d9/0x270
[ 121.181219][ C0] ? __pfx_task_work_run+0x10/0x10
[ 121.181237][ C0] exit_to_user_mode_loop+0x1fa/0x730
[ 121.181247][ C0] ? rcu_is_watching+0x15/0xb0
[ 121.181259][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.181267][ C0] do_syscall_64+0x353/0x580
[ 121.181278][ C0] ? clear_bhb_loop+0x70/0xc0
[ 121.181292][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 121.181304][ C0] RIP: 0033:0x7feecc19e0d9
[ 121.181317][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 121.181327][ C0] RSP: 002b:00007ffc6de4db28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[ 121.181340][ C0] RAX: 0000000000000000 RBX: 00007ffc6de4dc10 RCX: 00007feecc19e0d9
[ 121.181348][ C0] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[ 121.181356][ C0] RBP: 000000000001d7a2 R08: 0000000000000001 R09: 0000000000000000
[ 121.181363][ C0] R10: 00007feecbfff040 R11: 0000000000000246 R12: 00007ffc6de4dc50
[ 121.181370][ C0] R13: 00007feecc425fac R14: 000000000001d870 R15: 00007feecc425fa0
[ 121.181382][ C0]