=============================
[ BUG: Invalid wait context ]
6.15.0-syzkaller #0 Not tainted
-----------------------------
kworker/u8:3/52 is trying to lock:
ffffc90003429410 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9a0 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
3 locks held by kworker/u8:3/52:
#0: ffff88814c48e148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
#0: ffff88814c48e148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
#1: ffffc90000be7c60 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
#1: ffffc90000be7c60 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
#2: ffffc90003429958 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
#2: ffffc90003429958 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:253 [inline]
#2: ffffc90003429958 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9a0 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.15.0-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: bat_events batadv_nc_worker
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4831 [inline]
check_wait_context kernel/locking/lockdep.c:4903 [inline]
__lock_acquire+0xbcf/0xd20 kernel/locking/lockdep.c:5185
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5866
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
_raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x1fb/0x9a0 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x4dd/0xc60 kernel/time/hrtimer.c:1825
hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1887
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
__sysvec_apic_timer_interrupt+0x108/0x410 arch/x86/kernel/apic/apic.c:1055
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
RIP: 0010:rcu_read_lock include/linux/rcupdate.h:841 [inline]
RIP: 0010:batadv_nc_process_nc_paths+0xc5/0x3a0 net/batman-adv/network-coding.c:687
Code: 8b 44 24 10 4c 89 74 24 08 49 63 ee 48 c1 e5 03 48 03 28 e8 fd c4 82 f6 48 8d 05 00 00 00 00 48 c7 c7 e0 de f3 8d 31 f6 31 d2 02 00 00 00 45 31 c0 45 31 c9 48 89 44 24 28 50 e8 25 36 79 f6
RSP: 0018:ffffc90000be7a50 EFLAGS: 00000246
RAX: ffffffff8b2508da RBX: ffffffff8b250bd0 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8df3dee0
RBP: ffff88802a414a28 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8b2508da R12: dffffc0000000000
R13: 1ffff1100b16db13 R14: 0000000000000045 R15: ffff888058b6cd80
batadv_nc_worker+0x429/0x610 net/batman-adv/network-coding.c:728
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 8b 44 24 10 mov 0x10(%rsp),%eax
4: 4c 89 74 24 08 mov %r14,0x8(%rsp)
9: 49 63 ee movslq %r14d,%rbp
c: 48 c1 e5 03 shl $0x3,%rbp
10: 48 03 28 add (%rax),%rbp
13: e8 fd c4 82 f6 call 0xf682c515
18: 48 8d 05 00 00 00 00 lea 0x0(%rip),%rax # 0x1f
1f: 48 c7 c7 e0 de f3 8d mov $0xffffffff8df3dee0,%rdi
26: 31 f6 xor %esi,%esi
28: 31 d2 xor %edx,%edx
* 2a: b9 02 00 00 00 mov $0x2,%ecx <-- trapping instruction
2f: 45 31 c0 xor %r8d,%r8d
32: 45 31 c9 xor %r9d,%r9d
35: 48 89 44 24 28 mov %rax,0x28(%rsp)
3a: 50 push %rax
3b: e8 25 36 79 f6 call 0xf6793665