=============================
[ BUG: Invalid wait context ]
6.16.0-rc4-syzkaller-00286-gc435a4f487e8 #0 Not tainted
-----------------------------
kworker/u4:3/38 is trying to lock:
ffffc900019f7410 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1820
other info that might help us debug this:
context-{2:2}
3 locks held by kworker/u4:3/38:
#0: ffff88803f4c4148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
#0: ffff88803f4c4148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321
#1: ffffc90000597bc0 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
#1: ffffc90000597bc0 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321
#2: ffffc900019f7960 (&kvm->srcu){.?.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
#2: ffffc900019f7960 (&kvm->srcu){.?.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:253 [inline]
#2: ffffc900019f7960 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9b0 arch/x86/kvm/xen.c:1818
stack backtrace:
CPU: 0 UID: 0 PID: 38 Comm: kworker/u4:3 Not tainted 6.16.0-rc4-syzkaller-00286-gc435a4f487e8 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: bat_events batadv_nc_worker
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_lock_invalid_wait_context kernel/locking/lockdep.c:4833 [inline]
check_wait_context kernel/locking/lockdep.c:4905 [inline]
__lock_acquire+0xbcb/0xd20 kernel/locking/lockdep.c:5190
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
__raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline]
_raw_read_lock_irqsave+0xaf/0x100 kernel/locking/spinlock.c:236
kvm_xen_set_evtchn_fast+0x1fb/0x9b0 arch/x86/kvm/xen.c:1820
xen_timer_callback+0x109/0x220 arch/x86/kvm/xen.c:140
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x4e0/0xc60 kernel/time/hrtimer.c:1825
hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1887
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline]
__sysvec_apic_timer_interrupt+0x10b/0x410 arch/x86/kernel/apic/apic.c:1056
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:104 [inline]
RIP: 0010:__local_bh_enable_ip+0x135/0x1c0 kernel/softirq.c:414
Code: 8b e8 6f c1 e9 09 65 66 8b 05 7f 9e 1a 11 66 85 c0 75 5a bf 01 00 00 00 e8 a8 32 0b 00 e8 f3 48 42 00 fb 65 8b 05 5b 9e 1a 11 <85> c0 75 05 e8 92 04 ae ff 48 c7 04 24 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc900005978e0 EFLAGS: 00000282
RAX: 0000000080000000 RBX: 0000000000000201 RCX: 7988a73a409ce800
RDX: 0000000000000006 RSI: ffffffff8d9979f6 RDI: ffffffff8be29680
RBP: ffffc90000597978 R08: ffffffff8fa1e7f7 R09: 1ffffffff1f43cfe
R10: dffffc0000000000 R11: fffffbfff1f43cff R12: ffffffff8b3d7c28
R13: dffffc0000000000 R14: dffffc0000000000 R15: 1ffff920000b2f1c
spin_unlock_bh include/linux/spinlock.h:396 [inline]
batadv_nc_purge_paths+0x318/0x3b0 net/batman-adv/network-coding.c:471
batadv_nc_worker+0x328/0x610 net/batman-adv/network-coding.c:720
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 8b e8 mov %eax,%ebp
2: 6f outsl %ds:(%rsi),(%dx)
3: c1 e9 09 shr $0x9,%ecx
6: 65 66 8b 05 7f 9e 1a mov %gs:0x111a9e7f(%rip),%ax # 0x111a9e8d
d: 11
e: 66 85 c0 test %ax,%ax
11: 75 5a jne 0x6d
13: bf 01 00 00 00 mov $0x1,%edi
18: e8 a8 32 0b 00 call 0xb32c5
1d: e8 f3 48 42 00 call 0x424915
22: fb sti
23: 65 8b 05 5b 9e 1a 11 mov %gs:0x111a9e5b(%rip),%eax # 0x111a9e85
* 2a: 85 c0 test %eax,%eax <-- trapping instruction
2c: 75 05 jne 0x33
2e: e8 92 04 ae ff call 0xffae04c5
33: 48 c7 04 24 0e 36 e0 movq $0x45e0360e,(%rsp)
3a: 45
3b: 4b rex.WXB
3c: c7 .byte 0xc7
3d: 04 37 add $0x37,%al