=============================
[ BUG: Invalid wait context ]
syzkaller #0 Not tainted
-----------------------------
kworker/u4:1/14 is trying to lock:
ffff888052eb5410 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1820
other info that might help us debug this:
context-{2:2}
3 locks held by kworker/u4:1/14:
#0: ffff88803ee3f948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff88803ee3f948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319
#1: ffffc9000040fbc0 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc9000040fbc0 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319
#2: ffff888052eb5960 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
#2: ffff888052eb5960 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:253 [inline]
#2: ffff888052eb5960 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9b0 arch/x86/kvm/xen.c:1818
stack backtrace:
CPU: 0 UID: 0 PID: 14 Comm: kworker/u4:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: bat_events batadv_nc_worker
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xbcb/0xd20 kernel/locking/lockdep.c:5187
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
_raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1820
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x4e0/0xc60 kernel/time/hrtimer.c:1825
hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1887
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline]
__sysvec_apic_timer_interrupt+0x108/0x410 arch/x86/kernel/apic/apic.c:1056
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:27 [inline]
RIP: 0010:__local_bh_disable_ip+0xdc/0x190 kernel/softirq.c:350
Code: 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 0f 85 a4 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 65 8b 05 b4 5a 1c 11 <25> ff ff ff 7f 39 d8 75 42 48 8b 5d 08 48 89 df e8 7f 07 19 00 85
RSP: 0018:ffffc9000040f8c0 EFLAGS: 00000206
RAX: 0000000080000201 RBX: 0000000000000201 RCX: 0000000000046400
RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff8b4a0117
RBP: ffffc9000040f960 R08: ffffffff8fa3c037 R09: 1ffffffff1f47806
R10: dffffc0000000000 R11: fffffbfff1f47807 R12: 1ffff92000081f18
R13: dffffc0000000000 R14: 0000000000000246 R15: dffffc0000000000
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:125 [inline]
_raw_spin_lock_bh+0x1c/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
batadv_nc_purge_paths+0xe7/0x3b0 net/batman-adv/network-coding.c:442
batadv_nc_worker+0x369/0x610 net/batman-adv/network-coding.c:722
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 48 c7 44 24 20 00 00 movq $0x0,0x20(%rsp)
7: 00 00
9: 9c pushf
a: 8f 44 24 20 pop 0x20(%rsp)
e: f6 44 24 21 02 testb $0x2,0x21(%rsp)
13: 0f 85 a4 00 00 00 jne 0xbd
19: 41 f7 c6 00 02 00 00 test $0x200,%r14d
20: 74 01 je 0x23
22: fb sti
23: 65 8b 05 b4 5a 1c 11 mov %gs:0x111c5ab4(%rip),%eax # 0x111c5ade
* 2a: 25 ff ff ff 7f and $0x7fffffff,%eax <-- trapping instruction
2f: 39 d8 cmp %ebx,%eax
31: 75 42 jne 0x75
33: 48 8b 5d 08 mov 0x8(%rbp),%rbx
37: 48 89 df mov %rbx,%rdi
3a: e8 7f 07 19 00 call 0x1907be
3f: 85 .byte 0x85