=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
kworker/3:2/831 is trying to lock:
ffff888070e0d2e0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1820
other info that might help us debug this:
context-{2:2}
4 locks held by kworker/3:2/831:
 #0: ffff88801b87b148 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90004907c98 ((debug_obj_work).work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #2: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #2: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1195 [inline]
 #2: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x1ea0 arch/x86/kernel/unwind_orc.c:495
 #3: ffff888070e0d838 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
 #3: ffff888070e0d838 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:277 [inline]
 #3: ffff888070e0d838 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x245/0xe80 arch/x86/kvm/xen.c:1818
stack backtrace:
CPU: 3 UID: 0 PID: 831 Comm: kworker/3:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events free_obj_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
 check_wait_context kernel/locking/lockdep.c:4902 [inline]
 __lock_acquire+0xfa4/0x2630 kernel/locking/lockdep.c:5187
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x17c/0x330 kernel/locking/lockdep.c:5825
 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
 _raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236
 kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1820
 xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:140
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x1ad/0x990 kernel/time/hrtimer.c:1841
 hrtimer_interrupt+0x397/0x8c0 kernel/time/hrtimer.c:1903
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
 __sysvec_apic_timer_interrupt+0x109/0x3c0 arch/x86/kernel/apic/apic.c:1062
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:228 [inline]
RIP: 0010:unwind_next_frame+0x1f6/0x1ea0 arch/x86/kernel/unwind_orc.c:510
Code: 89 c3 39 d0 0f 83 8a 15 00 00 48 ba 00 00 00 00 00 fc ff df 89 c1 48 8d 3c 8d f4 d0 0e 92 49 89 f8 49 c1 e8 03 45 0f b6 04 10 <48> 89 fa 83 e2 07 83 c2 03 44 38 c2 7c 2f 45 84 c0 74 2a 48 89 4c
RSP: 0000:ffffc90004907670 EFLAGS: 00000a07
RAX: 000000000000cd72 RBX: 0000000000000001 RCX: 000000000000cd72
RDX: dffffc0000000000 RSI: 00000000000a77f2 RDI: ffffffff921206bc
RBP: ffffc90004907728 R08: 0000000000000000 R09: 0000000000000007
R10: 0000000000000200 R11: 000000000000cd72 R12: ffffc90004907730
R13: ffffc900049076e0 R14: ffffc90004907715 R15: ffffffff81cd72d1
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2540 [inline]
 slab_free mm/slub.c:6674 [inline]
 kmem_cache_free+0x143/0x720 mm/slub.c:6785
 free_object_list.isra.0+0xf8/0x2a0 lib/debugobjects.c:326
 free_obj_work+0x19d/0x3d0 lib/debugobjects.c:513
 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 c3                	mov    %eax,%ebx
   2:	39 d0                	cmp    %edx,%eax
   4:	0f 83 8a 15 00 00    	jae    0x1594
   a:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  11:	fc ff df
  14:	89 c1                	mov    %eax,%ecx
  16:	48 8d 3c 8d f4 d0 0e 	lea    -0x6df12f0c(,%rcx,4),%rdi
  1d:	92
  1e:	49 89 f8             	mov    %rdi,%r8
  21:	49 c1 e8 03          	shr    $0x3,%r8
  25:	45 0f b6 04 10       	movzbl (%r8,%rdx,1),%r8d
* 2a:	48 89 fa             	mov    %rdi,%rdx <-- trapping instruction
  2d:	83 e2 07             	and    $0x7,%edx
  30:	83 c2 03             	add    $0x3,%edx
  33:	44 38 c2             	cmp    %r8b,%dl
  36:	7c 2f                	jl     0x67
  38:	45 84 c0             	test   %r8b,%r8b
  3b:	74 2a                	je     0x67
  3d:	48                   	rex.W
  3e:	89                   	.byte 0x89
  3f:	4c                   	rex.WR