=============================
[ BUG: Invalid wait context ]
syzkaller #0 Tainted: G L
-----------------------------
syz.0.7876/7433 is trying to lock:
ffff8880008052e0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
other info that might help us debug this:
context-{2:2}
2 locks held by syz.0.7876/7433:
#0: ffff88805c15e638 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x255/0xc30 net/unix/af_unix.c:2568
#1: ffff888000805840 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffff888000805840 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
#1: ffff888000805840 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x245/0xe80 arch/x86/kvm/xen.c:1817
stack backtrace:
CPU: 2 UID: 0 PID: 7433 Comm: syz.0.7876 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4830 [inline]
check_wait_context kernel/locking/lockdep.c:4902 [inline]
__lock_acquire+0xfa4/0x2630 kernel/locking/lockdep.c:5187
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:172 [inline]
_raw_read_lock_irqsave+0x46/0x90 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x253/0xe80 arch/x86/kvm/xen.c:1819
xen_timer_callback+0x1db/0x2a0 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1785 [inline]
__hrtimer_run_queues+0x1ad/0xa70 kernel/time/hrtimer.c:1849
hrtimer_interrupt+0x397/0x8c0 kernel/time/hrtimer.c:1911
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
__sysvec_apic_timer_interrupt+0x109/0x490 arch/x86/kernel/apic/apic.c:1062
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__unix_dgram_recvmsg+0x31f/0xc30 net/unix/af_unix.c:2600
Code: 83 80 07 00 00 49 39 c5 74 1b e8 9c c5 da f7 ba 04 03 00 00 be 01 00 00 00 48 8d bb 40 07 00 00 e8 46 a1 b3 f7 e8 81 c5 da f7 <48> 8b 54 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02
RSP: 0000:ffffc90004f27810 EFLAGS: 00000246
RAX: 0000000000080000 RBX: ffff88805c15e040 RCX: ffffc90025bb1000
RDX: 0000000000080000 RSI: ffffffff8a2d35ff RDI: ffff8880675e8000
RBP: 0000000000000002 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000000 R12: ffff88805c15e5d0
R13: ffff88805c15e7c0 R14: ffff88805c15e128 R15: ffff888000e32dc0
unix_dgram_recvmsg+0xd0/0x110 net/unix/af_unix.c:2670
sock_recvmsg_nosec net/socket.c:1078 [inline]
____sys_recvmsg+0x5f7/0x6b0 net/socket.c:2810
___sys_recvmsg+0x16a/0x1a0 net/socket.c:2854
do_recvmmsg+0x563/0x760 net/socket.c:2941
__sys_recvmmsg+0x21f/0x270 net/socket.c:3023
__do_compat_sys_recvmmsg_time32 net/compat.c:418 [inline]
__se_compat_sys_recvmmsg_time32 net/compat.c:414 [inline]
__ia32_compat_sys_recvmmsg_time32+0xc4/0x160 net/compat.c:414
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f08f6c
Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 8d b6 00 00 00 00 b8 ad
RSP: 002b:00000000f53a550c EFLAGS: 00000292 ORIG_RAX: 0000000000000151
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800000c0
RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess), 3 bytes skipped:
0: 00 00 add %al,(%rax)
2: 49 39 c5 cmp %rax,%r13
5: 74 1b je 0x22
7: e8 9c c5 da f7 call 0xf7dac5a8
c: ba 04 03 00 00 mov $0x304,%edx
11: be 01 00 00 00 mov $0x1,%esi
16: 48 8d bb 40 07 00 00 lea 0x740(%rbx),%rdi
1d: e8 46 a1 b3 f7 call 0xf7b3a168
22: e8 81 c5 da f7 call 0xf7dac5a8
* 27: 48 8b 54 24 20 mov 0x20(%rsp),%rdx <-- trapping instruction
2c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
33: fc ff df
36: 48 c1 ea 03 shr $0x3,%rdx
3a: 80 .byte 0x80
3b: 3c 02 cmp $0x2,%al